Module 1 - Unit 4 - Risk Assessment 1: Introduction and Identification

Question 1

What is the definition of risk assessment under BS 31100?

Answer 1

The overall process of risk identification, risk analysis and risk evaluation

Question 2

What is the purpose of risk assessment?

Answer 2

The purpose of risk assessment is to identify the significant risks that could impact the selected feature (stakeholder expectations/business objectives, core processes/, or key dependencies)

Question 3

Summarise each of the following:

Risk identification
Risk analysis
Risk evaluation

Answer 3

Risk identification: What might happen (the event)?

Risk analysis: How likely is it to happen? If it does, what might the impact be?

Risk evaluation: So what? Is it within our risk appetite and tolerance?

Question 4

What is a benefit of measuring inherent risk level?

Answer 4

Enables the difference between the current level and the inherent level can be identified. This will give an indication of the importance of the existing control measures and the information is used by internal auditors to help identify critical controls and set audit priorities.

Question 5

What are the four main risk assessment techniques?

Answer 5

1. Checklists and questionnaires
2. Workshops and brainstorming
3. Inspections and audits; and
4. Flowcharts and dependency analysis.

Question 6

What are the advantages/disadvantages of top down risk assessment?

Answer 6

Advantages

• Likely to result in enterprise wide approach
• Most signifcant strategic risks for the organisation can be captured quickly
• Shows managment buy in
• Likely to encourage consistent methodology

Disadvantages
- Senior managers more focus on external risks
- Limited awareness of internal operational risks or interdependecies
- Danger that the approach becomes too superfical because sneior manager belive they can manage crises
- New risks emergin from the operational activities of the organisation might not be fully identified
-

Question 7

What are the advantages/disadvantages of bottom up risk assessment?

Answer 7

Advantages

• Buy in at all levels
• Can be mirrored to an existing organisation chart and risk impacts beyond immediate operational risks can be discussed
• Operational staff have good awareness of local risks which may not be visible to senior management
• Methodology can be varied to suit norms and culture.

Disadvantages

• Little focus on external or strategic risks
• Time consuming and may demotivate
• Danger that the approach becomes too detailed leading to silo approach
• New risks emerging from the operational activities might not be reported by operational staff

Question 8

Give the advantages and disadvantages of using questionnaires to undertake risk assessment.

Answer 8

Advantages

• Consistent structure guarantees consistency
• Greater involvement than in a workshop

Disadvantages
- Rigid approach may result in some risks being missed
- Questions will be based on
historical knowledge

Question 9

Give the advantages and disadvantages of using workshops and brainstorming to undertake risk assessment.

Answer 9

Advantages:

• Consolidated opinions from all interested parties
• Greater interaction produces more ideas

Disadvantages

• Senior management tends to dominate
• Issues will be missed if incorrect people involved

Question 10

Give the advantages and disadvantages of using inspections and audit to undertake risk assessment.

Answer 10

Advantages

• Physical evidence forms the basis of opinion
• Audit approach results in good structure

Disadvantages

• Inspections are most suitable for hazard risks
• Audit approach tends to focus on historical experience

Question 11

Give the advantages and disadvantages of using Flow charts and dependency analysis to undertake risk assessment.

Answer 11

Advantages:

• Useful output that may be used elsewhere
• Analysis produces better understanding of processes

Disadvantages:

• Difficult to use for strategic risks
• May be very detailed and time-consuming

Question 12

What are two qualitative risk analysis techniques?

Answer 12

SWOT is an analysis of the strengths, weaknesses, opportunities and threats faced by the organization.

PESTLE analysis that considers the political, economic, social, technological, legal and ethical (or environmental) risks faced by the organization

Question 13

What are two quantitative risk analysis techniques?

Answer 13

Hazard and operability (HAZOP) studies

Failure modes effects analysis (FMEA)

Question 14

What factors impact risk perception?

Answer 14

Familiarity – Less afraid with risks we are familiar with
Personal Control – More risk felt when we have less control E.g. car use vs. aviation despite statistics on accidents
Voluntary/involuntary – People who chose to take a risk less likely to be concerned versus those who have risk forced upon them
Dreaded vs. non dreaded – Less worried about trip slip or fall compared to fall from great height
Benefits – We may derive joy from the risk e.g. skydiving

Question 15

What are two problems leading from differing risk perceptions during risk assessment?

Answer 15

1. Organisations are likely to manage the same risks very inconsistently, depending on the individual who must manage that risk, thus increasing the overall organisational uncertainty.
2. Risk managers could seek to achieve greater kudos among their stakeholders by focusing their efforts on helping to manage the stakeholders’ fears over what they perceive to be the most significant risks rather than what are actually the most significant risks.

Question 16

What are the four C’s of attitude to risk?

Answer 16

Comfortable
Cautious
Concerned
Critical

Question 17

Why do organisations classify risks?

Answer 17

1. Provides structure to the process of risk identification, which can facilitate the identification of more risks – for example, by delegates in a risk management workshop – than would be the case if a risk classification does not exist.
2. Helps with the development of consistent risk terminologies across the organisation, which is essential for ERM to work.
3. Enables the organisation to collect together similar risk types throughout the organisation, which can:

enhance organisation knowledge
assign responsibilities for specific types of risk
estimate total exposure to risk by type of risk using the expertise of relevant professionals for each risk type
help to determine the level of risk by type that can be accepted by the organisation
enable a bundling together of risks for similar treatment – such as single insurance policies for one type of risk – which can increase the efficiency of risk management

Question 18

How can risks be classified?

Answer 18

The main risk classification systems are the COSO ERM cube (SORC) , IRM standard (FSOH), BS 31100 and the FIRM risk scorecard. But also see PESTLE and CHOC classifications

Risks can also be classified as short, medium and long-term:
• Short-term risks – in other words, those risks with an immediate impact, primarily with operational activities.
• Medium-term risks with tactics – in other words, those risks whose impact becomes apparent between a few months and a year.
• Long-term risks with strategy – in other words impacting between one and five years after the event.

Question 19

What does EM3 stand for?

Answer 19

Embrace, manage, mitigate and minimize (EM3)

Question 20

What are the advantages of PESTLE?

Answer 20

• simple framework;
• facilitates an understanding of the wider business environment;
• encourages the development of external and strategic thinking;
• anticipates future business threats;
• helps identify actions to avoid or minimize impact of threats;
• facilitates identification of business opportunities.

Question 21

What are the disadvantages of PESTLE?

Answer 21

• can over-simplify the amount of data used for decisions;
• needs to be undertaken on a regular basis to be effective;
• requires different people being involved with different perspectives;
• access to quality external data sources can be time-consuming and costly;
• difficult to anticipate developments that may affect an organization in the future;
• risk of capturing too much data that makes it difficult to see priorities;
• can be based on assumptions that subsequently prove to be unfounded.