6 steps to risk assessment and management

Managing risk is not sexy. People do not talk about it during coffee breaks, but companies are spending big money on technology that may help reduce their risk.

Outsourcing a service increases the dependability that things work smoothly (Google took over Feedburner – services have been down several times during 2010).

We describe the combined risk assessment and management process in six steps that can help limit your risk exposure and reduce the chances for:

– cost overruns,
– project delays (e.g., the Boeing Dreamliner was postponed from 2008 to 2011), and
– disasters like the Deepwater Horizon oil spill.

3 steps to proper risk assessment

Assessing risk without factoring profit is like trying to tune up your car without knowing where the engine is.

Risk assessment is a process of analyzing potential losses from a given hazard or threat using a combination of:

– known information about the situation,
– knowledge about the underlying process, and
– judgment about the information that is not known or well understood.

The above is the bedrock for ensuring that potentially hazardous operations are carried out safely.

Risk assessment also provides some legal protection if an activity or process leads to an accident or disaster (e.g., a data security breach or the Deepwater Horizon oil spill).

The three steps to proper risk management are:

1. Describing the problem(s). This can be accomplished more effectively if a few questions are posed and addressed amongst stakeholders, such as:

a) Who must manage the problem (risk owner)?
b) Who are the stakeholders?

Also, what relationships exist between problems and can stakeholders further help with problem identification and characterization?

2. Performing a risk analysis. This includes evaluating the risks in order to:

a) Assess the likelihood of recurrence.
b) Address any uncertainties in estimates.

Everyday, each of us manages risk, from what we have for breakfast to how we commute, and what happens at our workplace.

3. Defining the options. This requires determining what can be done about the risk issue and how that can be accomplished.

Potential consequences, costs, and benefits of options or actions taken to mitigate risk must also be addressed. These must be identified and spelled out succinctly.

3 steps to proper risk management

The objective of risk assessment is to proactively identify areas of highest risk, such as auditing. This allows allocating resources based upon the determination of relative risk.

Risk management is the process of combining a risk assessment with decisions about how to address that risk.

Basically this involves the following three steps:

A. Making sound decisions. Determine the best solutions and how they could be implemented in ways that are:

– feasible,
– cost effective, and
– socially acceptable.

B. Implementing decisions. Find out what actions are needed to implement and deal with any objections or re-assessments regarding the decisions you made in step A.

For instance, doing a project audit two years into a four-year project is helpful. But having to report a huge cost overrun, technological difficulties that will delay project completion (e.g., the Boeing Dreamliner) is not what we call sound risk management.

A Qantas A380 bound for Sydney and carrying more than 450 people had part of its engine cover disintegrate mid-flight. The captain decided to make an emergency landing in Singapore.

C. Evaluating actions taken. Determine what is an acceptable and effective means of evaluating the effectiveness or appropriateness of the actions taken in the process of risk management.

To illustrate, when a few hundred angry but noisy Facebook fans are able to get a global brand like Gap to reverse its re-branding efforts, this action must be evaluated.

Bottom line
To perform a risk analysis and assessment that will be useful to your organization, you must first define that risk.

Risk assessment is the systematic determination of risk management priorities by evaluating and comparing the level of risk against predetermined standards, target risk levels or other criteria.

The very short video below outlines how to conduct risk analysis, risk mitigation (i.e. reducing your dependency on one supplier), and impact analysis. Worth watching.

Are you with me on proper risk assessment and risk management or am I completely off?
What have I missed? Please leave a comment; the floor is yours!

Another resource: 2011 trends: Risk management and social media ROI — 2010-12-01

Article source: 6 steps to proper risk assessment and management

Tagged as: best practice, compliance management, corporate governance, Risikoanalyse, Risikobeurteilung, risk assessment, risk management, ROI with higher average revenue per customer, six steps to success, social media risk