Module 4

Risk Management Process

1
Risk Management Process

2
 Risk Management Process Management Elements
SCOPE
• program to achieve Organisational
Objectives
• Governance, policy and processes
CONTEXT
• Organisational operating environment
• Organizational operations and
management
• Impact on stakeholders Scope, Context, Criteria
CRITERIA
• Determination of risk acceptance and
tolerance
Risk Assessment

Communication & Consultation

Communication &

Monitoring & Review

Consultation Risk Identification
• Communications Strategy Monitoring & Review
• Client and Stakeholder • Accountability
requirements • Responsibility
• Privacy • Consistency
• Confidentiality Risk Analysis • Probity
• Sources of validation • Audit
• Process guidance • Assurance
• Roles • Policy and process
• Information access and Risk Evaluation review
use

Risk Treatment
Recording & Reporting
• Records Policy
• Records management system Recording & Reporting
• Access to documentation
• Reporting Channels
Risk Management Assessment and Treatment Process Elements

Scope, Context, Criteria

RISK ASSESSMENT
Risk Identification
• Value and Criticality of Assets Risk Assessment

Communication & Consultation

• Proposed level of access and authority
• Current Vulnerability and Sources of Threat

Monitoring & Review

Risk Analysis Risk Identification
• Impact analysis of loss or damage
• Level of certainty
• Volatility – rate of changes in variables
Risk Identification
• Potential for Risk Analysis
• loss or damage of assets
• Product quality loss
• Damage to reputation
• Impact on clients/customers
• Los of competitiveness Risk Identification

RISK TREATMENT
Specific selection criteria
• Physical Controls Risk Treatment
• Personal Controls
• Information Management Controls
• Work History and performance Recording and Reporting
• Cyber Controls
• Review and Improvement Processes
 Identify Sources of Risk
▪ Personnel/human behavior.
▪ Management activities and controls.
▪ Economic circumstances.
▪ Natural events.
▪ Political circumstances.
▪ Technology/technical issues.
▪ Commercial and legal relationships.
▪ The activity itself.

6
 Risk Identification

▪ Process of finding recognizing and describing risks

▪ Comprehensive list of risks based on events that might create, enhance,

prevent, degrade, accelerate or delay achievement of objectives

▪ A risk that is not identified at this stage will not be included in further

analysis

▪ Identification should include risks whether or not their source is under

the control of the organization

7
Example

8
 Risk Analysis

▪ It involves consideration of the causes and sources of

risk, their positive and negative consequences, and the
likelihood that those consequences can occur

9
 Risk Evaluation

▪ The purpose of risk evaluation is to assist in making

decisions, based on the outcomes of risk analysis, about
which risks need treatment and the priority for treatment
implementation

10
 Risk Criteria

▪ Risk criteria are used to evaluate the significance of risk

based on organizational objectives, and external and
internal context i.e. the risk level.

▪ It can be derived from standards, laws, policies and other

requirements

11
 Example :Level of Risk
▪ Magnitude of a risk or combination of risks, expressed in terms of
the combination of consequences and their likelihood

▪ Risk levels with relation to the project objectives are evaluated using
the risk matrices

▪ Example: Risk level of events that may have a negative impact on

the project cost or time schedule is evaluated using the "Cost
increase" or "Delay" risk matrices, respectively. And ;

▪ Risk level of events that may have a positive impact on the project's
cost or time schedule is evaluated using the "Cost decrease" or
"Advance" risk matrices, respectively.

12
Example : Risk Matrices

13
Risk Assessment Matrix

14
 Example :Risk Matrices

▪ Definition of likelihood classes in the Risk Matrices:

Possible : Event is possible, but not expected to happen in

the project period.

Probable : Event may happen in the project period.

Likely : Event is expected to happen in the project period.

15
 Example: Definition of Consequence
classes in the Risk Matrices
▪ you should modify a appropriate for your project scale, and maybe
add some arguments to why the values are chosen as they are:
Negligible : Event will have negligible impact on the objective.
Project cost: about ±$10k, or less
Time schedule: about ±1 week, or less
Serious : Event will have a sizeable impact on the objective.
Project cost: about ±$100k
Time schedule: about ±1 month
Major : Event will have a large impact on the objective.
Project cost: about ±$1m, or more
Time schedule: about ±6 months, or more

16
The colors of the Matrix fields indicate
Risk level:

High risk

Medium risk

Low risk

17
 Example: Evaluation of Risk levels

The criteria for evaluation of risk levels are:

▪ If the risk level is high, risk treatment is required and implementation
of risk controls is a high priority, to reduce the risk level to medium
or low risk.

▪ If the risk level is medium, risk treatment is recommended, but not

required. If risk controls are not implemented, it should be justified
why this is acceptable.

▪ If the risk level is low, risk treatment is not required. Risk may be
accepted without further justification.

18
 Risk Treatment

▪ Selecting the most appropriate risk treatment option

involves balancing the costs and efforts of
implementation against the benefits derived, with regard
to legal, regulatory, and other requirements such as
social responsibility and the protection of the natural
environment

19
 Risk Treatment

▪ A signification risk can be the failure on ineffectiveness

the risk treatment measures

20
 Monitor & Review
▪ Monitoring
▪ Continual checking, supervising, critically observing or determining
the status in order to identify change from the performance level
requires or expected
▪ Can be applied to a risk management framework, risk management
process, risk or control
▪ Reviewing
▪ Activity undertaken to determine suitability, adequacy and
effectiveness of subject matter to achieve established objectives
▪ Can be applied to a risk management framework, risk management
process, risk or control

21