Module 3: Risk Assessment Flashcards
What are the deliverables of risk management?
Risk registers
Risk matrices
Risk reports
How does the ISO 31000 risk management standard describe the process of risk management?
“The systematic application of policies, procedures and practices to the activities of communicating and consulting, establishing the context and assessing, treating, monitoring, reviewing, recording, and reporting risk”
What is the process for “Establishing the Context” set out by ISO 31000?
External context (what does world look like, what are drivers and trends)
⬇️
Internal Context (what are our objectives, capacity, business processes, how do we make decisions)
⬇️
Context of the risk management process (what is the process expected to achieve, who is responsible, what resources are required)
⬇️
Defining risk criteria (What determines whether risk is acceptable and if it should be controlled, how can we measure our total risks)
What risks can the external environment present?
Regulatory or legal requirements Societal conditions Political challenges Financial/ economic constraints Cultural restrictions Competition Environmental conditions
These can be international, national, regional or local.
How can stakeholder analysis help us to understand external risk sources?
Stakeholder analysis is often carried out during the development of a communications plan. It can provide focus on who may be affected by, or may perceive themselves to be affected by, or who may be interested in your organisation.
What are the internal sources of risk information
Historic risk information - usually found in previous risk registers or databases.
Historic results from performance indicators.
Audit or quality assurance outcomes.
Use of isomorphic learning from within the business (also external). This is the learning that can take place across a business sector. Risks that impact one department/ sector may also impact others.
Internal risk community groups.
What are the external sources of risk information?
External consultants.
External risk community groups.
Regional, national, or international professional bodies. E.g the IRM.
Industry focused or risk management specific media.
Government bodies and standards.
Define’Risk Source’
The ISO 31000 standard defines risk source as the ‘…element which alone or in combination has the potential to give rise to risk’ (ISO, 2018:2)
Why do people assume risk is a “hard discipline”
Risk is assumed to be a hard discipline because it involves statistics, analysis and a rigorous approach. However the reality is that risk is managed by people not process or techniques.
People also think risk is hard because because it is difficult to do, however when done properly it should be an easy and intuitive process.
Which professional bodies or industry bodies would be able to provide useful information to help with the risk assessment process?
Ensuring that you keep yourself informed of what is going on in your industry, sector, and organisation, will help you to recognise emerging risks that although affecting others currently, may affect you in the future.
Resources: IRM Lexology ABI BIBA
What does PESTLE stand for
Politics, Economic, Sociological, Technological, Legal, and Environmental (or Ethical)
What are the responsibilities of each stage of the 3 lines of defence model
Own - senior managers, employees
Advise - risk ma after, compliance
Assure - internal/ external audit
Why might a risk assurance model fail?
- lack of board and senior management sponsorship and commitment
- risk management framework not sufficient developed
- different terminology and methods used by assurance providers
- no one taking ownership
- different self interests
- lack of competency or skills amongst staff
- timing of activities- risk management is not an overnight process
- reluctance among some assurance providers / risk managers to share information
What are the top 10 priorities for risk management?
- understand your stakeholder needs and expectations
- validate the purpose and position of risk management
- communicate with the ARC
- facilitate positive change
- drive efficiency
- attract, retain and develop talented people
- promote risk as a key element of good governance
- focus on maturity levels and continuous improvement
- add value and show this by measuring performance
- link risk and assurance
PESTLE may be considered a risk classification system with a emphasis on hazard risk. What are the advantages of PESTLE?
- simple framework
- facilitates an understanding of the wider business environment
- encourages the development of external and strategic thinking
- anticipates future business threats
- helps identify actions to avoid or minimise impact of threats
- facilitates identification of business opportunities
What are the disadvantages of using the PESTLE analysis as a means of identifying risks?
- can over simplify the amount of data used for decisions
- needs to be undertaken on a regular basis to be effective
- requires different people being involved with different perspectives
- access to quality external data sources can be time consuming and costly
- difficult to anticipate developments that may affect an organisation in the future
- risk of capturing too much data that makes it difficult to see priorities
- can be based on assumptions that subsequently prove to be unfounded
PESTLE classification system:
Define ‘Political’
Tax policy, employment laws, environmental regulations, trade restrictions and reform, tariffs and political stability
PESTLE classification system:
Define ‘Economic ‘
Economic growth/ decline, interest rates, exchange rates and inflation rate, wage rates, minimum wage, working hours, unemployment, credit availability, cost of living etc
PESTLE classification system:
Define ‘Sociological’
Cultural norms and expectations, health consciousness, population growth rate, age distribution, career attitudes, emphasis on safety, global warming
PESTLE classification system:
Define ‘Technological’
Technology changes the impact your products or services, new tech, barriers to market entry, financial decisions like outsourcing and supply chain
PESTLE classification system:
Define ‘Legal’
Change to legislation that may impact employment, access to materials, quotas, resources, imports/ exports, taxation etc
Why is the inclusion of reputations risk in the FIRM risk scorecard not universally accepted?
It is sometimes argued that damage to reputation is a consequence of other risks materialising and should not be considered as a separate risk category.
What is the link between PESTLE and SWOT
It is often suggested that the PESTLE risk classification system should be used in conjunction with an analysis of the strengths, weaknesses, opportunities and threats (SWOT) facing an organisation. A SWOT analysis of each of the 6 PESTLE categories is recommended by the Orange Book
Why don’t the main risk management systems identify compliance risks?
Risks can be defined as hazard, control and opportunity, or they can be classified as long term, medium term or short term. If either of these classifications systems is used there is a possible that compliance risks will not be identified because they do not fit with a classification system based on timescales. A further difficulty with compliance risks is that there is often a requirement for a trigger event. An organisation can be exposed to a number of compliance risks but it may be difficult to identity the particular issue that will become a problem.
What are the advantages of having a risk classification system? (BS 3100)
- Accumulations of risk that could undermine a key dependency or business objective can be identified
- Responsibility for improved management of each different type of risk can be more easily identified/ allocated if risks are classified
- Decisions and knowledge about the type of control(s) that will be implemented can be taken on a more structured and informed basis
- Circumstances where the risk appetite of the organisation is being exceeded (or the risk criteria not being implemented) can be more easily identified
What does FIRM stand for
Financial
Infrastructure
Repetitional
Marketplace
FIRM risk scorecard
What is the measurement/ performance indicator for each of the FIRM attributes
Financial- usually quantifiable. Measured by gains and losses from internal financial control
Infrastructure- sometimes quantifiable. Level of efficiency in processes and operations
Reputation - not always quantifiable. Nature of publicity and effectiveness of marketing profile
Marketplace - quantifiable. Income from commercial and market activities
FIRM risk scorecard
What is the performance gap for each of the FIRM attributes
Financial - procedures - failure of procedures to control internal financial risks
Infrastructure- process - failure of processes to operate without disruption
Reputation- perception- failure to achieve the desired perception
Marketplace- Presence - failure to achieve required presence in the marketplace
What are the main risk classification systems?
COSO, IRM standard, BS31100, and FIRM risk scorecard.
Other commonly used risk classification systems that can be used to provide structure to a risk assessment are the SWOT and PESTLE analysis.
What are the classification headings for the main risk classification systems?
COSO - strategic, operations, reporting, compliance
IRM standard- Financial, strategic, operational, hazard
FIRM - financial, infrastructure, reputation, marketplace
What is the benefit of classifying risks as short, medium and long term?
Although not a formalised risk classification system, the classification of risks into short , medium, and long term helps to identify risks as being related (primarily) to operations, tactics, and strategy, respectively
What would be classified as a short term risk?
A short term risk has the ability to impact the objectives, key dependencies and core processes, with the impact being immediate. These risks can cause disruption to operations immediately when the event occurs. Short term risks are predominantly hazard risks.
Short term risks usually impact the ability of the organisation to maintain effective and efficient core processes that are concerned with the continuity and monitoring of routine operations. There is a need to mitigate short term risks.
What would be classed as a medium term risk?
A medium term risk has the ability to impact the organisation following a (short) delay after the event occurs. Typically the impact of a medium term risk would not be apparent immediately but would appear with a year, maximum, of the event. Medium term risks usually impact the ability of the organisation to maintain effective and efficient core processes that are concerned with the management of tactics, projects and other change programmes. These medium term risks are often associated with projects, tactics, enhancements and other developments. There is a need to manage these medium term risks.
What could be classified as a long term risk?
A long term risk has the ability to impact the organisation some time after the even occurs. This would typically be 1-5 years. These risks usually impact the ability of the organisation to maintain the core processes that are concerned with the development and delivery of effective and efficient strategy.
What is the purpose of the bow-tie illustration?
To demonstrate that sources of risk can lead to events that have consequences
How do we summarise the need to respond to risks according to whether they arise from strategy, tactics, operations, or compliance (STOC)?
EM3
Embrace, Manage, Mitigate & Minimise
What is the benefit of a a formalised risk classification system
Formalised risk classification systems enable the organisation to identify where similar risks exist within the organisation. Classification of risks also enables the organisation to identify who should be responsible for setting strategy for management of related or similar risks. Finally, appropriate classification of risks will enable the organisation to better identify the risk appetite, risk capacity and total risk exposure in relation to each risk, group of similar risks or generic type of risk.
What is at the centre of the bow tie illustration?
The event in the centre of a bow tie illustration lists the components of the organisation that is impacted by the event - 4p’s
People, premises, processes, and products
How are the impacts of a an event described in a bow tie illustration?
FIRM
What are the sources of project risk?
The primary sources of project risk will include the following, but will vary depending on the project context such as the industry, location, and sector. There is no one size fits all.
Business environment Host industry Sponsors organisation Business case Project brief User requirements Project team Design, specification, layout Internal approvals External approvals Change controls Procurement Implementation Testing and commissioning Handover
What are the potential benefits of project risk management?
Supporting the business case Increased chance of success Make objectives clear/ prioritised Procurement will reflect risk appetite Forces team to think collaboratively Validated funding requirements Protects reputation Improving accountability/ decision making Better understanding of legal requirements Improved integration into operations
