Risk Management Flashcards
the Capability to effectively answer the following questions
ERM
Is the human activity which integrates recognition of risk, assessment, developing strategies to manage it.
RM - Risk Management
Ranges from 0-70MPH - the amount of risk an organization is willing to accept to achieve objectives.
Risk appetite
Ranges from 70-80 MPH:
the acceptable deviation from the organization’s risk appetite.
Risk Tolerance
80 MPH and Above
Unacceptable risk
organization risk exposure types
- Reputational Exposure
-Compliance Exposure
-Operational Exposure
-Strategic Exposure
Financial vs.
Non financial industries
-Insurable
-One-dimensional assessment (severity)
- Manages risks one-by-one
- Occurs within one business department (“siloed”)
-Reactive & sporadic
- Disjointed activities
- Standardized
- Risk Averse
Traditional Risk Management
-Non-Insurable
-multi-dimensional assessment
- Analyzes material risks and how they relate
- Spans the entire organization (holistic)
-Proactive & Continuous
- Embedded in Culture & mindset
- More nuanced; requires soft skills
- Risk taking
Enterprise Risk Management
five step risk management process
- Identify the risks
- Analyze the likelihood and impact of each
- Prioritize risk based on enterprise objectives.
- Treat or respond to the risk conditions
- Monitor results and adjust as necessary.
Processes can be applied to managing positive risks:
- Top-down, bottom-up
- Risk By Category
Risk by categories.
strategic risk (e.g., reputation, customer relations, technical innovations);
financial and reporting risk (e.g., market, tax, credit);
compliance and governance risk (e.g., ethics, regulatory, international trade, privacy); and
operational risk (e.g., IT security and privacy, supply chain, labor issues, natural disasters).
Four basic risk types for businesses: people risks, facility risks, process risks and technology risks.
The final task in the risk identification step is for organizations to record their findings in a risk register. It helps track the risks through the subsequent four steps of the risk management process.
the importance of embedding risk into business strategies and linking risk and operational performance.
governance and culture
*
strategy and objective-setting
*
performance
*
review and revision
*
information, communication and reporting
COSO ERM Framework
a framework to help organizations apply risk management mechanisms to operations, and a process for identifying, evaluating, prioritizing and mitigating risk.
ISO 31000.
including functions like identify, assess, respond, report and review.
British Standard (BS) 31100.
framework helps risk professionals assess their programs in five categories: strategy alignment; culture and accountability; risk management capabilities; risk governance; and analytics
The Risk and Insurance Management Society’s Risk Maturity Model (RMM).
implements policies, technology, employee training and other steps designed to eliminate risk.
a risk avoidance strategy
strategy implements policies, technology, employee, employee training and other steps to reduce risk to an acceptable level
Risk Reduction strategy
contracts with a third party to bear some or all costs of a risk that may or may not occur.
a risk transfer strategy
accepts the risk because its potential to harm the organization is very limited or the cost of mitigating it exceeds the damage it would inflict.
A risk acceptance
Benefits of risk management include the following:
increased awareness of risk across the organization;
*
more confidence in organizational objectives and goals because risk is factored into strategy;
*
better and more efficient compliance with regulatory and internal compliance mandates because compliance is coordinated;
*
improved operational efficiency through more consistent application of risk processes and control;
*
improved workplace safety and security for employees and customers; and
*
a competitive differentiator in the marketplace.
The following are some of the challenges risk management teams should expect to encounter:
*
Expenditures go up initially, as risk management programs can require expensive software and services.
*
The increased emphasis on governance also requires business units to invest time and money to comply.
*
Reaching consensus on the severity of risk and how to treat it can be a difficult and contentious exercise and sometimes lead to risk analysis paralysis.
*
Demonstrating the value of risk management to executives without being able to give them hard numbers is difficult.
ISO 31000’s seven-step process is a useful guide to follow:
- Communication and consultation
- Establishing the context
- Risk identification.
- Risk analysis
- Risk evaluation.
- Risk treatment.
- Monitoring and review
risk leaders must also develop -communication plan to convey the organization’s risk policies
- Communication and consultation.
defining -risk appetite and risk tolerance
- Establishing the context
risk scenarios - positive or negative impact on the organization’s ability to conduct business.
Risk identification.
Making a risk heat map
Risk analysis
o
Risk avoidance
o
Risk mitigation
o
Risk sharing or transfer
o
Risk acceptance
- Risk evaluation.
Monitoring activities should measure key performance indicators and look for key risk indicators that might trigger a change in strategy.
- Monitoring and review
Risk management best practices is ISO 31000’s 11 principles of risk management.
*
create value for the organization;
*
be an integral part of the overall organizational process;
*
factor into the company’s overall decision-making process;
*
explicitly address any uncertainty;
*
be systematic and structured;
*
be based on the best available information;
*
be tailored to the project;
*
take into account human factors, including potential errors;
*
be transparent and all-inclusive;
*
be adaptable to change; and
*
be continuously monitored and improved upon.
Risk management limitations and
examples of failures
poor governance
Create stability favoring efficiency
Resilient Systems
FRIGILE
Efficient Systems
is the process of evaluating and implementing procedures to reduce the impact of risks in construction projects.
Construction risk management
software like Project Manager makes the risk management process much easier.
Project management
What Are the Types of Risk in Construction Projects?
*
Safety Risk
*
Financial Risk
*
Legal Risk
*
Project Risk
*
Environmental Risk
The Construction Risk Management Process:
1.Identification
2.Assessment: Not all risks are equal
3. Mitigation
4. Monitoring
5. Reporting .
How do construction disputes transpire?
*Issues with contracts
*Behavior
*Project Uncertainty
Common types of construction disputes
*Change of finish date
*Delays
*Design
*Goals
*Quality of materials
*Difficult projects
How to resolve a dispute
*Negotiation
*Mediation
*Arbitration
*Litigation
Preventing disputes
*Clear payment terms
*Communication
*Keep records
*Follow the contract
