Risk Management Process: Identifying Risks

Introduction And Definition

Risk Management is an inherent process within organizations operating across all industries and sectors for business sustainability. In today’s competitive and complex environment, it is now one of the most important decision-making functions in an organization compared to the times when Risk Management was considered a Support Function. Risk Management was seen as a Corporate Function related to Insurance & Finance with no relation to the other scope of business operations. Over time, the concept of “Risk” has gradually evolved and now plays a significant role in organizational effectiveness and is integrated into the organizational strategic objectives and daily practices.

As per ISO 31000 – International Risk Management System Standard, the Risk Management Process consists of Risk Identification, Risk Analysis, Risk Evaluation, Risk Treatment, Risk Monitor & Review, Risk Communication & Culture, etc. Risk management helps an organisation to identify, evaluate, analyze, monitor, and mitigate the risks that threaten the organisation’s objectives.

The risk identification method involves a strategy for identifying, recognizing, and describing risks that may aid or obstruct the attainment of goals and their many concrete and intangible effects. There are multiple risks faced and exposed by an organisation concerning internal and external factors such as Environmental Risk, Financial Risk, Human Resource Risk, Health & Safety Risk, Operational Risk, Security Risk, Strategic Risk, etc.

It is of high significance that the organisation should adopt measures to identify high-level risks related to the Project, Operational, Financial, Legal, Compliance, Reputational, Stakeholder Interface, Natural Disaster and Strategic, etc. aspects of the organisation.

Essential Steps | Elements Of A Risk Management Process:

The Five Essential Steps of a Risk Management Process are:

• Identify the Risk
• Analyse the Risk
• Evaluate the Risk
• Treat the Risk
• Monitor and Review the Risk

Step 1: Identify The Risk

 The initial step in the risk management process is to identify the risks that the business is exposed to in its environment.

Step 2: Analyse The Risk

 Once a risk has been identified it needs to be analysed. The scope of the risk must be determined. It is also important to understand the effect of the risk on different factors within the organisation.

Step 3: Evaluate The Risk Or Risk Assessment

 Risks need to be ranked and prioritised. Most risk management frameworks have different categories of risks, depending on the severity of the impact of the risk. A risk that may cause little inconvenience is rated the lowest, and risks that can result in greater loss are rated the highest. There are two types of risk assessments: Qualitative Risk Assessment and Quantitative Risk Assessment.

Step 4: Treat The Risk

Every risk needs to be eliminated or controlled as much as possible. This is done by the experts in the field to which the risk belongs.

Step 5: Monitor And Review The Risk

 Not all risks can be eliminated. Market risks and environmental risks are just two examples of risks that always need to be monitored. It is important to make sure to keep a close watch on all risk factors.

Tools For Risk Management

1. Brainstorming: Before any project begins, the first step is to plan a strategy. For this, the team members conduct brainstorming sessions. This brainstorming session needs to include all the risks that could impact the company.
2. Root Cause Analysis: This is a technique to help identify all the risks that are embedded in the company itself. Conducting a root cause analysis shows the responsiveness in risk management.
3. SWOT Analysis: SWOT is an analysis to measure the strengths, weaknesses, opportunities, and threats to a company. This tool can be used to identify risks as well.
4. Risk Assessment Template for IT: This assessment gives a list of risks in an arranged order. It is a space where all the risks can be collected in one place.
5. Probability And Impact Matrix: The probability and impact matrix helps in prioritizing risks based on the impact they will have. This technique is a combination of the probability scores and impact scores of individual risks. After all the calculations are over, the risks are ranked based on how serious they are.
6. Risk Data Quality Assessment: The risk data quality assessment method helps utilise all the collected data for identified risks and find details about the risks that could impact the company. This helps to understand the accuracy and quality of the risk based on the data collected.

Risk Identification Process

 The objective of the Risk Identification process is to identify a comprehensive list of risks and events that might impact the achievement of the organisation’s strategic objectives, including weaknesses, opportunities, threats, and sub-optimized results.

Identifying Risks is the first step in understanding the risks that may prevent the organisation from achieving its objectives, its overall risk exposure, and how risks should be managed.

The following should be considered while identifying risks across business operations in the organisation:

1. What is the Risk?
2. What can happen if it is not treated?
3. List the Risk & Possible Events
4. Why and how can the risk create a negative impact on the organisation?
5. List the root cause and event scenarios.

How can the risk be treated? List the tools and techniques to approach and treat the risk

All risks should be identified, regardless of whether they are under the organisation’s jurisdiction authority or related to the organisational business operations.

There are various risk identification tools utilised by organisations depending on the scope of business operations and other factors such as Management Systems, etc. Some of the Risk Identification tools include:

• Bow Tie Analysis
• Hazard & Operability Studies (HAZOP)
• Monte Carlos Simulation
• PESTLE
• Risk Register
• SWOT Analysis
• Event Tree Analysis
• Fault Tree Analysis

Risk registers are a common tool used when undergoing risk identification processes. ERM Risk registers are different from the risk and control matrices commonly used in internal audits. ERM risk registers represent risks to achieving strategic objectives, whereas risk registers for controls and internal audit purposes are generally at the process, activity, and task level.

Risk Assessment is to identify potential threats due to which risks are classified by using two separate values: Likelihood and Impact. Specifically, the main objective of Risk Assessment is to understand the threat. Risk Assessment is mainly undertaken to: Identify and Record all Potential Threats and to provide those threats with a Comparative Risk Value on a quantitative and qualitative aspect. The likelihood is described in different units such as once every 10 years, once every hundred times, once every 24 hours, etc. The impact is also described in different ways based on factors such as Safety (Lives Saved/Lost), Financial Loss, Production (Hours Saved/Lost), Reputational Loss, Asset Lost, etc.

Videos To Watch:

Get risk-intelligent with the IRM’s qualifications

What is Enterprise Risk Management?

Frequently Asked Questions

What Are The 5 Principles Of Risk Assessment?

Five steps to risk assessment can be followed to ensure that your risk assessment is carried out correctly, these five steps are:

1. Identify the hazards
2. Decide who might be harmed and how
3. Evaluate the risks and decide on control measures
4. Record the findings and implement them
5. Review the assessment and update if necessary

Step 1: Identify The hazards

To identify hazards you need to understand the difference between a ‘hazard’ and ‘risk’. A hazard is ‘something with the potential to cause harm and a risk is ‘the likelihood of that potential harm being realized’.

Step 2: Decide Who Might Be Harmed And How

Once you have identified several hazards you need to understand who might be harmed and how, such as employees, shareholders or members of the public.

Step 3: Evaluate The Risks And Decide On Control Measures

After ‘identifying the hazards’ and ‘deciding who might be harmed and how you are then required to protect the people from harm. The hazards can either be removed completely or the risks controlled so that a larger impact is unlikely.

Step 4: Record The Findings

Findings should be written by recording them. It shows that they have the identified hazards, decided who could be harmed and how, and also shows the plan to eliminate the risks and hazards.

Step 5: Review The Assessment And Update As And When Necessary

This risk assessment should be reviewed and updated when required and reviewed from time to time with changing conditions.

What Are The 4 Commonly Used Risk Mitigation Processes?

The four common risk mitigation strategies typically include avoidance, reduction, transference, and acceptance.

1. Avoidance: In this process, one takes all the measures required to avoid the risk happening. This may require compromising other elements to make sure the risk doesn’t occur.
2. Reduction: In this process once you’ve completed your risk analysis, you take steps to reduce either the likelihood of a risk event happening or the impact should it occur.
3. Transference: Transferring risks involves passing the consequence of the risk becoming an issue to a third party. For many businesses, that might involve paying an insurance company to cover certain risks.
4. Acceptance: The acceptance strategy is simply accepting the risk as it stands. Sometimes the possibility of reward is greater than the associated risk.

What Are The 10P’s Of Risk Management?

 The 10 P’s of risk management are:

1. Policy: It is a critical element in developing strategies that will enable the policy aims to be met.
2. Planning: This includes planning at the strategic management level and the practical operations level, with all the other elements feeding information back to this stage and priorities for action being decided. While all the other “P’s” feed into this stage, it is vital that they are considered in such a way that they are all equally important in the decision-making process.
3. Product Or Service: There are several risk factors associated with the product or service itself. These include – stages of the life cycle of the product and recent trends, the firm’s competitive position now and potential in the future, lifestyle trends and demographic changes etc.
4. Process: Risks associated with the process itself can vary enormously, depending on the type of business being considered.
5. Premises: This is often a significant risk factor for smaller firms, as they frequently have limited access to suitable premises either at an early stage or when expanding production. On the other end, larger companies with a variety of sites have additional risk factors to consider and must optimise the facilities available to them.
6. People: It is important to consider workers’ well-being at all levels in the firm. There are bigger considerations for some firms, as risks to visitors to the site and the wider public in the area may need to be identified.
7. Protection: This is much broader than just protection of people from health and safety risks and includes identifying risks associated with the protection of people, premises, materials, intellectual rights, data and security and the environment.
8. Procedures: This element relates to others in the 10 P’s quite closely, particularly the Product, Process and People. It includes the procedures involved in managing them and how they potentially reduce risks affecting the organisation.
9. Purchasing: This is a significant element in the management of risks that are often isolated. It includes the use of recognised standards in the business, the firm’s policy on Quality, Government Policy On Standards, Environment, Protection Of Workers etc.
10. Performance: As a risk, this relates to performance measures chosen by the firm. Performance can be viewed at individual worker/ department/ company level, and may just be related to the individual firm.

What Is The Risk Management Process?

 The risk management process involves identifying, monitoring, and managing potential risks and their negative impacts on a business.

A risk management plan enables a company to control risk so it can make better business decisions and reach its objectives.

A company must identify possible risks before they can harm the business. Identifying the potential risks makes it easier for the organisation to take the appropriate steps to prevent them from happening.

Risk management plans follow these steps that comprise the overall risk management process:

• Risk Identification- The organisation has to identify and define potential risks that might negatively affect a particular process or project.
• Risk Analysis- After the company has identified the specific types of potential risks, it must determine the odds that those potential risks will occur as well as their impact. The goal of risk analysis is to better understand each specific risk, and how it could affect the company’s projects and objectives.
• Risk Assessment And Evaluation- The organisation further evaluates each potential risk after it determines how likely it is that the potential risk will occur and what the consequences will be if it does occur. This allows the company to decide whether a risk is acceptable and if it is willing to accept the risk based on its risk appetite.
• Risk Mitigation- The company reviews its highest-ranked risks and develops a plan to mitigate these risks using specific risk controls. In addition, there are four types of risk mitigation: Accept the risk, choose to avoid the risk, decide to transfer the risk, or work to reduce the risk.
• Risk Monitoring- The mitigation plan includes following up on the potential risks and continually monitoring and tracking new risks as well as existing risks. The risk management plan should also be reviewed and updated as necessary.

Conclusion

Risk management is an important process that managers should maintain in an organisation. It is inevitable to have risks and managers should have better strategies to deal with risks. The long-term survival of an organisation depends on the ability to manage risks. The intensifying competition in the global markets has forced managers to focus on maintaining a strong risk management program by establishing values.

References

1.  Anon, 2017. National Risk Register of Civil Emergencies: 2017 edition, London: Cabinet Office.
2. Leitch, M. (2010). ISO 31000:2009-The New International Standard on Risk Management. Risk Analysis, 30(6), pp.887–892.
3. International Organisation For Standardisation (2012). Societal security: business continuity management systems requirements. Geneva: International Organisation For Standardisation.
4. org. (2021). [online] Available at: https://www.iso.org/obp/ui/#iso:std:iso:22301:ed-2:v1:en.
5. British Standards Institution (2014). Crisis management: guidance and good practice. London: British Standards Institution.
6. Global Risks 2019. (n.d.). The Global Risks Report 2019. [online] Available at: http://reports.weforum.org/global-risks-2019/?doing_wp_cron=1634906993.6807320117950439453125 [Accessed 22 Oct. 2021].

Submitted By: Kartik Unnikrishnan – Member of Student Risk Club (SRC) & Sanskar Raheja, Cleared IRM’s Level 1 ERM exam