RISK MANAGEMENT
Risk management is the identification, assessment and prioritization of risks followed by co-ordinated and economical application of resources to minimize, monitor and control the probability/ impact on unfortunate events/ to maximize the realization of opportunities. Risk management’s objectives is to assure uncertainty does not deflect the endeavor from the business goals. Risk can come from various sources, for e.g. uncertainty in financial markets, threats from project failures, legal liabilities, credit risks, accidents, natural causes and disasters as well as deliberate attack from an adversary, or events of uncertain/unpredictable root cause.
In ideal risk management, a prioritization is followed whereby the risks with greatest loss and the greatest probability of occurring are handled in descending order. In practice the process of assessing overall risk can be difficult, and balancing resources used to mitigate between risks with a high probability of occurrence but lower loss versus a risk with a high loss but lower probability of occurrence can often be mishandled.
Intangible risk management identifies a new type of risk that has 100% probability of occurring but is ignored by the organisation due to a lack of identification ability. Intangible risk management allows risk management to create immediate value from the identification and reduction of risks that reduces productivity. Risk management also faces difficulties in allocating resources. This is the idea of opportunity cost. Resources spend on risk management could have been spend on more profitable activities. Again, ideal risk management minimises spending and also minimizes the negative effects of risks.
Methods of Risk Management
Methods of risk management include:
- Identifying, characterizing threats.
- Assessing the vulnerability of critical assets to specific threats.
- Determining the risk.
- Identifying ways to reduce those risks.
- Prioritizing risk reduction measures based on a strategy.
Principles of Risk Management
There are specific core principles in regard to risk management. When looking to perform an actual risk assessment, the following target areas should be part of overall risk management procedure (as defined by the International Standards Organisation: ISO):
Risk management should:-
- Create value.
- Be an integral part of organizational processes.
- Be part of the decision-making process.
- Explicitly address uncertainty and assumptions.
- Be a systematic and structured process.
- Be based on the best available information.
- Be tailorable.
- Take human factors into account.
- Be transparent and inclusive.
- Be dynamic, iterative, and responsive to change.
- Be capable of continual improvement and enhancement.
- Be continually/periodically re-assessed.
Risk Management Process
A work, health, and safety management system provides a framework for a systematic approach to managing WHS/OHs within an organization to comply with
Legislative requirements and regulations. For this approach to be successful it needs to adhere to a centralized ideal of effectively managing risk as defined in AS/NZS 31000-2009 Risk Management –Principle and Guidelines “co-ordinated activities to direct and control an organization with regard to risk”. This risk management standard explains the overall approach towards identifying, analyzing, evaluating, and controlling risk within the work environment and how those approaches are interlinked.
Establishing the context
This involves-
- Identification of risk in the selected domain.
- Planning the remainder of the process.
- Mapping out
- the scope of risk management.
- Identify and objectives of stakeholders.
- The basis upon which risk will be evaluated.
- Defining a framework for the activity and an agenda for identification.
- Developing an analysis of risks involved in the process.
- Mitigation/solution of risks using available technological, human, and organizational resources.
Risk Assessment Process
The risk assessment process includes the steps like risk identification, risk analysis, risk evaluation, and risk treatment. All staffs supplies and contractors should review their processes and wherever possible, to look for low impact methods with the recognition that a best practice approach would be:
- Evaluate which risks are present.
- Remove unnecessary risks.
- Minimize unavoidable hazards.
- Protect workers from remaining risks.
Risk assessment should be written down and made visible to all staff in the organization. For managing the risk, after the risk assessment processes some of the records and checklist should be used such as WHS policy, hazard identification report, job rotation report, medical records noise monitoring report, first aid reports, fire safety records, maintenance records etc.
Identify risks
- Identify the risks that can happen.
- Describe risks by determining the possible causes and scenarios.
Risk analysis
- Assess the relative likelihood of occurrence of the risk.
- Identify the existing and new controls that reduce the likelihood/consequence of the risk.
- Identify the potential consequences and assess their severity in terms of the magnitude of each risk.
- Identify the cost of controls.
- Assess the adequacy and evaluate the importance and benefits of the controls.
- Produce the estimated risk level by combining the assessment of likelihood and consequences, in the context of existing control measures.
Risk Evaluation
Risk evaluation will determine a prioritized list of risks for further action,
- Compare risk exposure levels against predetermined tolerance level.
- Assess existing levels of exposure in terms of the levels of exposure reduction that are achievable.
- Rank the risks to establish management priorities.
Risk treatment
- Treatments are selected using the options –accepting and avoiding risk, transferring the risk, reducing the likelihood and consequence, and retaining risk.
- Assessing the treatment options.
- Developing treatment plan.
- Managing and monitoring the implementation of the action plan.
Monitoring and reviewing
It is an integral part of the risk management process.
- Monitor the effectiveness of the mitigation task.
- Review all steps in the process.
- On-going evaluation to verify the mitigation plan remains relevant.
A risk register database is the main management tool for monitoring risk. It contains a ranked list of risks, references to associated risk action plans, and names of individuals responsible for each risk. Regular updating of the risk register should be part of the ongoing project management process.
Communicate and Consult
Communication and consultation are important elements of risk management.
- Undertaken at each step of the process.
- Involves internal and external stakeholders.
- Clarify the responsibilities of each stakeholder.
Techniques of Risk Management
There are four techniques of risk management.
legislative requirements and regulations. For this approach to be successful it needs to adhere to a centralized ideal of effectively managing risk as defined in AS/NZS 31000-2009 Risk Management –Principle and Guidelines “co-ordinated activities to direct and control an organization with regard to risk”. This risk management standard explains the overall approach towards identifying, analyzing, evaluating, and controlling risk within the work environment and how those approaches are interlinked.
Risk Assessment Process
- Risk Avoidance.
- Loss control.
- Risk-retention.
- Risk transfer.
These techniques work for pure risks but not speculative risks. Insurance reduces uncertainty about nonspeculative financial losses. There are requirements for insurable risks.
Risk avoidance eliminates the risks at any cost, it is most aggressive and effective but not practical sometimes. Loss control is done by loss prevention (reducing the frequency of loss), loss reduction (reducing the severity and financial impact), and using safety measures. Risk-retention is carried out by financing some or all of the losses by the organization itself. Risk transfer is done by non-insurance and insurance.
Summary
Risk management is a very broad field and often requires a very specialized knowledge set and background to perform adequately. The purpose of risk management is to identity potential problems before they occur so that risk handling activities may be planned and invoked as needed across the life of the product or project to mitigate adverse impacts on achieving objectives. Risk management is a continuous, forward-looking process that is an important part of business and technical management processes. Risk management should address issues that could endanger achievement of critical objectives. A continuous risk management approach is applied to effectively anticipate and mitigate the risks that have critical impact on the project. Effective risk management includes early and aggressive risk identification through the collaboration and involvement of relevant stakeholders. Strong leadership across all relevant stakeholders is needed to establish an environment for the free and open disclosure and discussion of risk.
