Introduction to Risk Management processes
- 3. WHAT ISA RISK? A risk is ANYTHING that may affectthe achievement of an organization’s objectives. It is the UNCERTAINTY that surrounds future events and outcomes. It is the expression of the likelihood and impact of an event with the potential to influence the achievement of an organization’s objectives.
- 4. ALTERNATIVELY … • Could also be an event with positive consequences A risk is a potential event with negative consequences that have not happened yet. • A source of problem, Find the root cause and not the leaves A possibility of loss – not the loss itself • In the widest sense, everything is a risk, Helps identify better ways of handling problems Something that makes the project special
- 5. WHY D O WE NEED RISK MANAGEMENT? • The only alternative to risk management is crisis management --- and crisis management is much more expensive, time consuming and embarrassing. • JAMES LAM,Enterprise Risk Management,Wiley Finance © 2003 • Without good risk management practices, government cannot manage its resources effectively. Risk management means more than preparing for the worst; it also means taking advantage of opportunities to improve services or lower costs. • Sheila Fraser,Auditor General of Canada
- 6. HOW DOES RISK MANAGEMENT HELP? Increase risk awareness & understanding Allows intelligent “informed” risk- taking. Focuses efforts – helps prioritize Is proactive not reactive – Prepare for risks before they happen. Improve outcomes – achievement of objectives Enables accountability, transparency and responsibility And maybe even mean survival
- 7. KEY TERMS Risk – Exposure to chance of hazard Risk Level – A measure to represent the significance of the risk Controls – Action(s) that could eliminate or reduce the risk level Residual Risk – Risk level after implementing controls Risk Response – An action on the risk, whether to accept, or not to accept
- 9. WHO IS INVOLVED? CUSTOMER END USER PROJECT TEAM SENIOR MANAGEMENT RELATED PROJECT TEAMS VENDORS AND SUPPLIERS
- 10. WHEN? A continuous process Starts from the proposal stage Ends on project completion Review stages Business case analysis Project approval Project planning Technology,Tools &Vendor selection Project status reviews Deployment and Maintenance
- 11. RISK MANAGEMENT BASICS RISK (UNCERTAINTY) MAY AFFECT THE ACHIEVEMENT OF OBJECTIVES. EFFECTIVE MITIGATION STRATEGIES/CONTROL S CAN REDUCE NEGATIVE RISKS OR INCREASE OPPORTUNITIES. RESIDUAL RISK IS THE LEVEL OF RISK AFTER EVALUATING THE EFFECTIVENESS OF CONTROLS. ACCEPTANCE AND ACTION SHOULD BE BASED ON RESIDUAL RISK LEVELS.
- 12. A SIMPLE FRAMEWORK Evaluate & Take Action Establish Objectives Identify Risks & Controls Assess Risks & Controls Monitor & Report Step 1 Step 2 Step 3 Step 4 Step 5 Communicate, learn, improve
- 13. Brainstorming Interviewing Root cause analysis Checklists SWOT RISK IDENTIFICATION TECHNIQUES
- 14. RISK MANAGEMENT IS CRITICAL TOALL LEVELS OF DECISIONS UNCERTAINTY Strategic Decisions Decisions transferring strategy into action Decisions required for implementation 15 Decisions can be categorized into three types. The amount of risk (uncertainty) varies with the type of decisions. Most decisions are concerned with implementation. The HM Treasury’s The Orange Book
- 15. CATEGORIZING RISK – COMPREHENSIVE 1. Political or Reputational Risk 2. Financial Risk 3. Service Delivery or Operational Risk 4. People / HR Risk 5. Information/Knowledge Risk 6. Strategic / Policy Risk 7. Stakeholder satisfaction / public perception risk 8. Legal / compliance risk 9. Technology risk 10. Governance / organizational risk 11. Privacy risk 12. Security risk 13. Equity risk This Photo by Unknown Author is licensed under CC BY-NC
- 16. Likelihoodof a risk event occurring ▪ Very High: Is almost certain to occur ▪ High: Is likely to occur ▪ Medium: Is as likely as not to occur ▪ Low: May occur occasionally ▪ Very Low: Unlikely to occur Risk Impact: Level of damage that can occur when a risk event occurs Very High: Threatens the success of the project High: Substantial impact on time,cost or quality Medium: Notable impact on time,cost or quality Low:Minor impact on time,cost or quality Very Low:Negligible impact RISK PRIORITIZATION
- 17. Immediate – now Less than 6 months Between 6- Between 12 12 months – 24 months Between 24 More than – 36 months 36 months THIRD DIMENSION FOR RATING RISK - PROXIMITY
- 18. RISK RATING …COMBINING IMPACT AND LIKELIHOOD IMPACT 1 1 2 2 3 3 4 LIKELIHOOD 5 RISK I x L RISK I x L RISK I x L RISK PRIORITIZATION MATRIX 5 4
- 19. RISK REPORTING AND COMMUNICATIONS Risk Level Action and Level of Involvement Required Critical Risk • Inform Chief Executive Officer and Board of Directors • Immediate action required High Risk • Inform Chief Executive Officer • Strategy Team involvement/attention is essential to manage risks – provide report to Board as appropriate Moderate Risk • Management mitigation and ongoing monitoring required • Inform relevant Strategy Team members Low Risk • Accept, but monitor risks • Manage by routine procedures within the program and site
- 20. Excellent • Advanced capabilities to identify, measure, manage all risk exposures within tolerances • Advanced implementation, development and execution of ERM parameters • Consistently optimizes risk adjusted returns throughout the organization Strong • Clear vision of risk tolerance and overall risk profile • Risk control exceeds adequate for most major risks • Has robust processes to identify and prepare for emerging risks • Incorporates risk management and decision making to optimize risk adjusted returns Adequate • Has fully functioning control systems in place for all of their major risks • May lack a robust process for identifying and preparing for emerging risks • Performing good classical “silo” based risk management • Not fully developed process to optimize risk adjusted returns Weak • Incomplete control process for one or more major risks • Inconsistent or limited capabilities to identify, measure or manage major risk exposures Source: Standard & Poor MEASURE AND REPORT IMPLEMENTATION PROGRESS
- 21. RISKS • Threats: • Death • Head Injury • Injury • Reputation • Financial • Damage to the bike • Sunburn/frost bite Opportunities: ✓ Exercise ✓ Sunlight ✓ Reputation ✓ Financial ✓ Role model ✓ Environment
- 22. MITIGATION STRATEGIES FOR THREATS • Death,head injury,another injury – helmet,bright clothes, lights,bell,bike course, obeying traffic laws,positive attitude, anger management course • Reputation – great outfit, change of wrinkle-free clothes, time management • Financial – high-quality locks,“beater”, stopping at stop signs • Damage to the bike – regular maintenance,avoiding potholes • Sunburn/frostbite – sunscreen,mittens, hats,token/change • Dehydration-filled water bottle