ISO 31000 Risk management

Courtesy: ISO 31000 Risk management

Strategies to manage threats (uncertainties with negative consequences) typically include avoiding the threat, reducing the negative effect or probability of the threat, transferring all or part of the threat to another party, and even retaining some or all of the potential or actual consequences of a particular threat. The opposite of these strategies can be used to respond to opportunities (uncertain future states with benefits).

As a professional role, a Risk Manager will “oversee the organization’s comprehensive insurance and risk management program, assessing and identifying risks that could impede the reputation, safety, security, or financial success of the organization”, and then develop plans to minimize and / or mitigate any negative (financial) outcomes. Risk Analysts  support the technical side of the organization’s risk management approach: once risk data has been compiled and evaluated, analysts share their findings with their managers, who use those insights to decide among possible solutions. See also Chief Risk Officer, internal audit, and Financial risk management § Corporate finance.

Introduction

Risk management appears in scientific and management literature since the 1920s. It became a formal science in the 1950s, when articles and books with “risk management” in the title also appear in library searches. Most of research was initially related to finance and insurance.

A widely used vocabulary for risk management is defined by ISO Guide 73:2009, “Risk management. Vocabulary.”

In ideal risk management, a prioritization process is followed whereby the risks with the greatest loss (or impact) and the greatest probability of occurring are handled first. Risks with lower probability of occurrence and lower loss are handled in descending order. In practice the process of assessing overall risk can be difficult, and balancing resources used to mitigate between risks with a high probability of occurrence but lower loss, versus a risk with high loss but lower probability of occurrence can often be mishandled.

Intangible risk management identifies a new type of a risk that has a 100% probability of occurring but is ignored by the organization due to a lack of identification ability. For example, when deficient knowledge is applied to a situation, a knowledge risk materializes. Relationship risk appears when ineffective collaboration occurs. Process-engagement risk may be an issue when ineffective operational procedures are applied. These risks directly reduce the productivity of knowledge workers, decrease cost-effectiveness, profitability, service, quality, reputation, brand value, and earnings quality. Intangible risk management allows risk management to create immediate value from the identification and reduction of risks that reduce productivity.