Management of risk - Revision history

Tkokotas at 15:12, 18 December 2018

2018-12-18T15:12:58Z

← Older revision		Revision as of 15:12, 18 December 2018
Line 1:		Line 1:
			''Developed by Arnar Gauti Gudmundsson''


	[[File:Image2.png\|500px\|thumb\|right\|Figure 1: Risk management process (based on ISO 31000: 2009) <ref>Carmen Nadia Ciocoiu and Razvan Catalin Dobrea (2010). The Role of Standardization in Improving the Effectiveness of Integrated Risk Management, Advances in Risk Management, Giancarlo Nota (Ed.), ISBN: 978-953-307-138-1, InTech, DOI: 10.5772/9893. Available from: http://www.intechopen.com/books/advances-in-risk-management/the-role-of-standardization-in-improving-the-effectiveness-of-integrated-risk-management</ref>]]		[[File:Image2.png\|500px\|thumb\|right\|Figure 1: Risk management process (based on ISO 31000: 2009) <ref>Carmen Nadia Ciocoiu and Razvan Catalin Dobrea (2010). The Role of Standardization in Improving the Effectiveness of Integrated Risk Management, Advances in Risk Management, Giancarlo Nota (Ed.), ISBN: 978-953-307-138-1, InTech, DOI: 10.5772/9893. Available from: http://www.intechopen.com/books/advances-in-risk-management/the-role-of-standardization-in-improving-the-effectiveness-of-integrated-risk-management</ref>]]

S141543 at 21:27, 28 September 2015

2015-09-28T21:27:14Z

← Older revision		Revision as of 21:27, 28 September 2015
Line 126:		Line 126:
	Risk evaluation is the process by which organizations, individuals and other social groups within society determine the acceptability of a given risk. If a risk is judged as unacceptable, adequate measures for risk reduction are required.		Risk evaluation is the process by which organizations, individuals and other social groups within society determine the acceptability of a given risk. If a risk is judged as unacceptable, adequate measures for risk reduction are required.

	''Klinke'' and ''Renn''<ref>http://josiah.berkeley.edu/2007Fall/NE275/CourseReader/6.pdf</ref> talked about three major strategies in risk evaluation:		''Klinke'' and ''Renn''<ref>Klinke Andreas and Renn Ortwin. A New Approach to Risk Evaluation and Management: Risk-Based, Precaution-Based, and Discourse-Based Strategies. Risk Analysis, Vol. 22, No. 6, 2002. PP 1070 http://josiah.berkeley.edu/2007Fall/NE275/CourseReader/6.pdf</ref> talked about three major strategies in risk evaluation:

	# Risk-based approaches, including numerical thresholds (quantitative safety goals, exposure limits, standards, etc.)		# Risk-based approaches, including numerical thresholds (quantitative safety goals, exposure limits, standards, etc.)

S141543 at 21:11, 28 September 2015

2015-09-28T21:11:25Z

← Older revision		Revision as of 21:11, 28 September 2015
Line 210:		Line 210:
	==Other mentionable tools==		==Other mentionable tools==

	* Failure mode and effect analysis (FMEA)		* [https://en.wikipedia.org/wiki/Failure_mode_and_effects_analysis Failure mode and effect analysis (FMEA)]
	* Brainstorming		* [http://www2.mitre.org/work/sepo/toolkits/risk/procedures/brainstorming.html Brainstorming]
	* Structured or semi-structured interviews		* [https://en.wikipedia.org/wiki/Structured_interview Structured or semi-structured interviews]
	* Delphi		* [https://en.wikipedia.org/wiki/Delphi_method Delphi method]
	* Check-lists		* [http://www.safetyrisk.net/risk-assessment-checklist/ Check-lists]
	* Primary hazard analysis		* [https://en.wikipedia.org/wiki/Hazard_analysis Primary hazard analysis]
	* Hazard analysis and critical control points (HACCP)		* [https://en.wikipedia.org/wiki/Hazard_analysis_and_critical_control_points Hazard analysis and critical control points (HACCP)]
	* Environmental risk assessment		* [http://www.dantes.info/Tools&Methods/Environmentalassessment/enviro_asse_era.html Environmental risk assessment]
	* Event tree analysis		* [https://en.wikipedia.org/wiki/Event_tree_analysis Event tree analysis]

S141543 at 20:42, 28 September 2015

2015-09-28T20:42:40Z

← Older revision		Revision as of 20:42, 28 September 2015
Line 1:		Line 1:

	[[File:Image2.png\|500px\|thumb\|right\|Risk management process (based on ISO 31000: 2009) <ref>Carmen Nadia Ciocoiu and Razvan Catalin Dobrea (2010). The Role of Standardization in Improving the Effectiveness of Integrated Risk Management, Advances in Risk Management, Giancarlo Nota (Ed.), ISBN: 978-953-307-138-1, InTech, DOI: 10.5772/9893. Available from: http://www.intechopen.com/books/advances-in-risk-management/the-role-of-standardization-in-improving-the-effectiveness-of-integrated-risk-management</ref>]]		[[File:Image2.png\|500px\|thumb\|right\|Figure 1: Risk management process (based on ISO 31000: 2009) <ref>Carmen Nadia Ciocoiu and Razvan Catalin Dobrea (2010). The Role of Standardization in Improving the Effectiveness of Integrated Risk Management, Advances in Risk Management, Giancarlo Nota (Ed.), ISBN: 978-953-307-138-1, InTech, DOI: 10.5772/9893. Available from: http://www.intechopen.com/books/advances-in-risk-management/the-role-of-standardization-in-improving-the-effectiveness-of-integrated-risk-management</ref>]]

	Risk is part of all our lives. We need to take risks to grow and develop. Effectively managed risk in hospitals, airport security, construction sites, projects, programmes, portfolios and in so many more circumstances help societies achieve.		Risk is part of all our lives. We need to take risks to grow and develop. Effectively managed risk in hospitals, airport security, construction sites, projects, programmes, portfolios and in so many more circumstances help societies achieve.
Line 45:		Line 45:


	As well as helping organizations reach these objectives the standard is intended to meet the needs of a wide range of stakeholders. Stakeholders that are included are those responsible for developing risk management policy within their organization, those accountable for ensuring that risk is effectively managed within the organization as a whole or within a specific area, project or activity. Those who need to evaluate an organization's effectiveness in managing risk and developers of standards, guides, procedures and codes of practice that, in whole or in part, set out how risk is to be managed withing the specific context of these documents. Figure X shows the relationships between the risk management principles, framework and process.[[File: fig_1.png\|~~800px~~\|thumb\|center\|Relationships between risk management principles, framework and process]]		As well as helping organizations reach these objectives the standard is intended to meet the needs of a wide range of stakeholders. Stakeholders that are included are those responsible for developing risk management policy within their organization, those accountable for ensuring that risk is effectively managed within the organization as a whole or within a specific area, project or activity. Those who need to evaluate an organization's effectiveness in managing risk and developers of standards, guides, procedures and codes of practice that, in whole or in part, set out how risk is to be managed withing the specific context of these documents. Figure X shows the relationships between the risk management principles, framework and process.[[File: fig_1.png\|500px\|thumb\|center\|Figure 2: Relationships between risk management principles, framework and process]]

	== Important principles ==		== Important principles ==
Line 68:		Line 68:
	=Risk assessment=		=Risk assessment=

	As figure 1 illustrates, risk assessment takes place after establishing the context.'''Risk assessment''' is the determination of [[quantitative]] or [[qualitative]] estimate of risk related to a concrete situation and a recognized hazard. Two components of risk are required for calculations in quantitative risk assessment. The magnitude of the potential loss (L) and the probability (p) that the loss will occur. If the countermeasure for handling a certain risk exceeds the value of the expected loss it is called acceptable risk. That kind of risk is understood and tolerated		As figure 1 illustrates, risk assessment takes place after establishing the context. '''Risk assessment''' is the determination of [https://en.wikipedia.org/wiki/Quantitative quantitative] or [https://en.wikipedia.org/wiki/Qualitative qualitative] estimate of risk related to a concrete situation and a recognized hazard. Two components of risk are required for calculations in quantitative risk assessment. The magnitude of the potential loss (L) and the probability (p) that the loss will occur. If the countermeasure for handling a certain risk exceeds the value of the expected loss it is called acceptable risk. That kind of risk is understood and tolerated

	==Risk assessment process==		==Risk assessment process==
Line 201:		Line 201:
	Show the symbols used in FTA and show an example of a fault tree:		Show the symbols used in FTA and show an example of a fault tree:

	[[File:FTA1.png\|900px\|thumb\|left\|Symbols in FTA <ref>http://conceptdraw.com/solution-park/resource/images/solutions/fault-tree-analysis-diagrams/Design-elements-Fault-tree-analysis-solution-Sample.png</ref>]]		[[File:FTA1.png\|900px\|thumb\|left\|Figure 3: Symbols in FTA <ref>http://conceptdraw.com/solution-park/resource/images/solutions/fault-tree-analysis-diagrams/Design-elements-Fault-tree-analysis-solution-Sample.png</ref>]]
	[[File:FTA2.png\|1000px\|thumb\|right\|Example of a fault tree <ref>http://reliawiki.com/images/thumb/e/ea/10.5.png/450px-10.5.png</ref>]]		[[File:FTA2.png\|1000px\|thumb\|right\|Figure 4: Example of a fault tree <ref>http://reliawiki.com/images/thumb/e/ea/10.5.png/450px-10.5.png</ref>]]


Line 252:		Line 252:

	=Conclusions=		=Conclusions=

			I think it is safe to say that risk management is very important for every organization in order to maximize the probability of achieving their objectives. There is a wide range of tools that can be used in different circumstances in risk management. Every organization should find the proper tools and perform risk management no matter their size. As stated in the limitation section, risk management can also have its flaws. Communication strategies as well as constantly reviewing and monitoring the process are the most likely ways to prevent these flaws to occur.

S141543 at 20:24, 28 September 2015

2015-09-28T20:24:21Z

← Older revision		Revision as of 20:24, 28 September 2015
Line 10:		Line 10:
	Because risk is inherent in everything we do, risk professionals undertake roles that are very diverse. It includes roles in insurance, business, health and safety, corporate governance, engineering, planning and financial services to name a few.		Because risk is inherent in everything we do, risk professionals undertake roles that are very diverse. It includes roles in insurance, business, health and safety, corporate governance, engineering, planning and financial services to name a few.

	In this article ~~general methodologies and~~ important principles of [https://en.wikipedia.org/wiki/Risk_management risk management] will be outlined, risk assessment will be explained and ~~programme~~ risk ~~management introduced~~. Benefits and limitations of risk management will be discussed before stating the conclusions.		In this article important principles of [https://en.wikipedia.org/wiki/Risk_management risk management] will be outlined, risk assessment will be explained in detail and risk assessment tools explained. Benefits and limitations of risk management will be discussed before stating the conclusions.

	__TOC__		__TOC__
Line 197:		Line 197:
	Fault tree analysis is a technique for identifying and analysing factors that can contribute to a specified undesired event (called the "top event"). Causal factors are deductively identified, organised in a logical manner and represented pictorially in a tree diagram which depicts causal factors and their logical relationships to the top event. A fault tree may be used qualitatively to identify potential causes and pathways to a failure (the top event) or quantitatively to calculate the probability of the top event, given knowledge of the probabilities of causal events.		Fault tree analysis is a technique for identifying and analysing factors that can contribute to a specified undesired event (called the "top event"). Causal factors are deductively identified, organised in a logical manner and represented pictorially in a tree diagram which depicts causal factors and their logical relationships to the top event. A fault tree may be used qualitatively to identify potential causes and pathways to a failure (the top event) or quantitatively to calculate the probability of the top event, given knowledge of the probabilities of causal events.

	The following figures ~~show and explain the symbols used in fault tree analysis and also show how a fault tree looks like.~~		The following figures will:

	~~<ref>http://conceptdraw.com/solution-park/resource/images/solutions/~~fault~~-tree-analysis-diagrams/Design-elements-Fault-~~tree~~-analysis-solution-Sample.png</ref>~~		Show the symbols used in FTA and show an example of a fault tree:
	~~<ref>http~~:~~//reliawiki.com/images/thumb/e/ea/10.5.png/450px-10.5.png</ref>~~

			[[File:FTA1.png\|900px\|thumb\|left\|Symbols in FTA <ref>http://conceptdraw.com/solution-park/resource/images/solutions/fault-tree-analysis-diagrams/Design-elements-Fault-tree-analysis-solution-Sample.png</ref>]]
			[[File:FTA2.png\|1000px\|thumb\|right\|Example of a fault tree <ref>http://reliawiki.com/images/thumb/e/ea/10.5.png/450px-10.5.png</ref>]]

	===Other mentionable tools===



			==Other mentionable tools==

	* Failure mode and effect analysis (FMEA)		* Failure mode and effect analysis (FMEA)
Line 214:		Line 219:
	* Environmental risk assessment		* Environmental risk assessment
	* Event tree analysis		* Event tree analysis

	~~=Programme risk management=~~

	There are four defined steps in programme risk management. Identify step, assess step, plan step and implement step. In order for a programme to run as smoothly as possible, these four steps must be followed. Other factors play along these four steps, good and effective communication is the most important factor. Communication has to be good throughout each and every step. Let's take a better look at the four steps.

	~~==Identify step==~~

	In the beginning of programme management, the identification of uncertain events which can both be threats and opportunities takes place. The programme's objectives and scope, what assumptions have been made, who the stakeholders are and where the programme fits inside the organization as well as the environment should be understood. If those aspects are understood it enables the programme to search for risk methodically and take the correct actions should a response be needed at some point.

	~~Actual risks should then be identified. Both threats to the programme objectives and opportunities to overachieve on outcomes and benefits.~~

	~~==Assess step==~~

	The assessment of risk can be broken down into two activities. Estimate the threats and the opportunities in terms of their probability impact and proximity on the one hand, and on the other hand to evaluate the net aggregated effect of the identified threats and opportunities on the programme. This is explained in detail in the Risk assessment section.

	~~==Plan step==~~

	Preparation of specific management response to the threats and opportunities that have been identified are the primary goal of the plan step. The objective is to remove or reduce the threats and to maximize the opportunities.

	~~==Implement step==~~

	Here it shall be ensured that the previously planned risk management actions are successfully implemented and monitored as to their effectiveness. Corrective actions should be taken where responses do not live up to expectations. It is an important factor that roles and responsibilities are allocated. Someone has to be responsible for the management and control of the risk. Key roles in that perspective are: '''Risk owner''' is responsible for the management and control of all aspects of the risks assigned to them. Managing, tracking and reporting the implementation of the selected actions to address the threats or to maximize the opportunities is included in that role. '''Risk actionee''' is responsible for the implementation of risk response actions. Support and take directions from the risk owner.


Line 251:		Line 234:
	* robust contingency planning		* robust contingency planning

	~~==For projects==~~		These benefits can be achieved if risk management is run effectively. As figure 1 shows, communication and consultation as well as monitoring and reviewing are key factors for a successful risk management.

	[[Contingency]] in projects can make or break them. Too much contingency is uncompetitive and too little increases the chance of failure. Risk assessment helps set contingency levels. It aims to figure out the most probable level of risk and gives the confidence level of outcome targets.		=Limitations=

	~~==For portfolios==~~		There are of course limitations to risk management, otherwise organizations would never experience failure as they would have answers to everything if the risk management process had been done properly.
	~~==For businesses==~~

	~~=Limitations=~~		The first limitation is regarding prioritizing, by prioritizing the risk management processes too highly could keep an organization from ever completing a project or even getting started.
	~~=Conclusions=~~
	~~=References=~~		Second is regarding if risks are improperly assessed and prioritized, time can be wasted in dealing with risk of losses that are not likely to occur. Spending too much time assessing and managing unlikely risks can divert resources that could be used more profitably. It is inevitable that unlikely events will occur at some point. If the risk is unlikely enough to occur sometimes it may even be better to simply retain the risk and deal with the consequences.

			Third is about qualitative risk assessment, it is subjective and lacks consistency.

			Subjective assessments are often influenced by past experience. This is a dangerous shortcoming of the process, because one thing we have learned over the years is that the past is not always a reliable indicator of what to expect in the future

			To summarize, an assessment process that subjects all risks to the same analytical grid has shortcomings that need to be recognized. If very little happens as a result of an organization's risk assessment process, it is a clear sign that alternative approaches should be considered.<ref>http://corporatecomplianceinsights.com/the-limitations-of-traditional-risk-assessments/</ref>

	~~Among strategies used to manage threats are.~~

	* Transferring the threat to another party		=Conclusions=
	* Avoid the threat
	* Reducing both the negative effect and lowering the probability of the threat
	* Accepting the potential negative consequences of a particular thread is the only option.
	* For uncertain events with benefits (opportunities) the opposite is done.


			=References=


	<references/>		<references/>

S141543 at 19:19, 28 September 2015

2015-09-28T19:19:47Z

@@ Line 133: / Line 133: @@
 A brief summarize of the concept: It is a process that is used to compare risk analysis results with risk criteria in order to determine whether or not a specified level of risk is acceptable or tolerable. <ref>http://www.praxiom.com/iso-31000-terms.htm</ref>
 =Programme risk management=
@@ Line 156: / Line 237: @@
 Here it shall be ensured that the previously planned risk management actions are successfully implemented and monitored as to their effectiveness. Corrective actions should be taken where responses do not live up to expectations. It is an important factor that roles and responsibilities are allocated. Someone has to be responsible for the management and control of the risk. Key roles in that perspective are: '''Risk owner''' is responsible for the management and control of all aspects of the risks assigned to them. Managing, tracking and reporting the implementation of the selected actions to address the threats or to maximize the opportunities is included in that role. '''Risk actionee''' is responsible for the implementation of risk response actions. Support and take directions from the risk owner.
 =Benefits=

S141543: /* Risk evaluation */

2015-09-28T17:43:17Z

Risk evaluation

← Older revision		Revision as of 17:43, 28 September 2015
Line 126:		Line 126:
	Risk evaluation is the process by which organizations, individuals and other social groups within society determine the acceptability of a given risk. If a risk is judged as unacceptable, adequate measures for risk reduction are required.		Risk evaluation is the process by which organizations, individuals and other social groups within society determine the acceptability of a given risk. If a risk is judged as unacceptable, adequate measures for risk reduction are required.

	Klinke and Renn ~~talked about three major strategies in risk evaluation:~~<ref>http://josiah.berkeley.edu/2007Fall/NE275/CourseReader/6.pdf</ref>		''Klinke'' and ''Renn''<ref>http://josiah.berkeley.edu/2007Fall/NE275/CourseReader/6.pdf</ref> talked about three major strategies in risk evaluation:

	# Risk-based approaches, including numerical thresholds (quantitative safety goals, exposure limits, standards, etc.)		# Risk-based approaches, including numerical thresholds (quantitative safety goals, exposure limits, standards, etc.)
Line 133:		Line 133:

	A brief summarize of the concept: It is a process that is used to compare risk analysis results with risk criteria in order to determine whether or not a specified level of risk is acceptable or tolerable. <ref>http://www.praxiom.com/iso-31000-terms.htm</ref>		A brief summarize of the concept: It is a process that is used to compare risk analysis results with risk criteria in order to determine whether or not a specified level of risk is acceptable or tolerable. <ref>http://www.praxiom.com/iso-31000-terms.htm</ref>


	=Programme risk management=		=Programme risk management=

S141543 at 17:25, 28 September 2015

2015-09-28T17:25:50Z

@@ Line 81: / Line 81: @@
 It would also ensure that the organization is aware of its major risks at any point in time.
 In this process questions such as: what can happen? when and where? how and why? should be answered in order to move to the next step in the risk assessment process, risk analysis.
@@ Line 117: / Line 119: @@
 |-
 |}
 =Programme risk management=

S141543: /* Risk assessment */

2015-09-28T16:56:29Z

Risk assessment

← Older revision		Revision as of 16:56, 28 September 2015
Line 68:		Line 68:
	=Risk assessment=		=Risk assessment=

	'''Risk assessment''' is the determination of [[quantitative]] or [[qualitative]] estimate of risk related to a concrete situation and a recognized hazard. Two components of risk are required for calculations in quantitative risk assessment. The magnitude of the potential loss (L) and the probability (p) that the loss will occur. If the countermeasure for handling a certain risk exceeds the value of the expected loss it is called acceptable risk. That kind of risk is understood and tolerated		As figure 1 illustrates, risk assessment takes place after establishing the context.'''Risk assessment''' is the determination of [[quantitative]] or [[qualitative]] estimate of risk related to a concrete situation and a recognized hazard. Two components of risk are required for calculations in quantitative risk assessment. The magnitude of the potential loss (L) and the probability (p) that the loss will occur. If the countermeasure for handling a certain risk exceeds the value of the expected loss it is called acceptable risk. That kind of risk is understood and tolerated
	==~~Qualitative~~==
			==Risk assessment process==

			===Risk identification===

			For an organization to effectively manage its key risks and demonstrate whether they are in control a risk identification process must be in place. Risk identification is a key component of a robust framework. By going through the risk identification process an organization would be able to identify the following:<ref>https://www.lloyds.com/the-market/operating-at-lloyds/performance-framework-of-minimum-standards/risk-management/process_identification_assessment_control_and_mitigation</ref>

			* Significant risks to the achievement of its business objectives.
			* All types of risks, associated major components and controls currently in place, from all sources, across the entire scope of the organisation's activities.
			* Risks around opportunities as well as threats, to increase the organization's chance of maximizing the benefit of those opportunities when they arise.

			It would also ensure that the organization is aware of its major risks at any point in time.

			In this process questions such as: what can happen? when and where? how and why? should be answered in order to move to the next step in the risk assessment process, risk analysis.

			===Risk analysis===

			To successfully determine the level of risk, consequences have to be determined as well as the likelihood of an event. Risk analysis includes qualitative and quantitative assessments. <ref>http://www.pwc.com/us/en/issues/enterprise-risk-management/assets/risk_assessment_guide.pdf</ref>

			'''Qualitative'''

	A pre-defined rating scale is used to prioritize the identified project risks. The probability or likelihood and the impact on a project objectives should they occur gives the score for a certain risk. A qualitative risk analysis also includes the appropriate categorization of the risks. Source-based or effect-based.		A pre-defined rating scale is used to prioritize the identified project risks. The probability or likelihood and the impact on a project objectives should they occur gives the score for a certain risk. A qualitative risk analysis also includes the appropriate categorization of the risks. Source-based or effect-based.

	==Quantitative==		'''Quantitative'''

	A further analysis of the highest priority risks during which a numerical or quantitative rating is assigned in order to develop a probabilistic analysis of the project. Possible outcomes for the project are quantified and the probability of achieving specific project objectives is assessed. When there is uncertainty a quantitative approach can be used to make decisions. It also creates realistic and achievable cost, schedule or scope targets.		A further analysis of the highest priority risks during which a numerical or quantitative rating is assigned in order to develop a probabilistic analysis of the project. Possible outcomes for the project are quantified and the probability of achieving specific project objectives is assessed. When there is uncertainty a quantitative approach can be used to make decisions. It also creates realistic and achievable cost, schedule or scope targets.

S141543 at 14:15, 28 September 2015

2015-09-28T14:15:57Z

← Older revision		Revision as of 14:15, 28 September 2015
Line 1:		Line 1:

	[[File:~~overviewrisk~~.png\|500px\|thumb\|right\|~~Overview~~ of risk management]]		[[File:Image2.png\|500px\|thumb\|right\|Risk management process (based on ISO 31000: 2009) <ref>Carmen Nadia Ciocoiu and Razvan Catalin Dobrea (2010). The Role of Standardization in Improving the Effectiveness of Integrated Risk Management, Advances in Risk Management, Giancarlo Nota (Ed.), ISBN: 978-953-307-138-1, InTech, DOI: 10.5772/9893. Available from: http://www.intechopen.com/books/advances-in-risk-management/the-role-of-standardization-in-improving-the-effectiveness-of-integrated-risk-management</ref>]]

	Risk is part of all our lives. We need to take risks to grow and develop. Effectively managed risk in hospitals, airport security, construction sites, projects, programmes, portfolios and in so many more circumstances help societies achieve.		Risk is part of all our lives. We need to take risks to grow and develop. Effectively managed risk in hospitals, airport security, construction sites, projects, programmes, portfolios and in so many more circumstances help societies achieve.