Risk Management Process
A risk can be defined as the potential or possibility of injury or loss occurrence. Business risks are the aspects of a business organization with the potential capability of causing loss of value for the business. Risk management is the identification, estimation, analysis, assessment and acceptance or mitigation of business risks or threats (Ziemba and Kolasa, 2015). Business risks can originate from different business operations like financial operations, human operations, technical operations, production operations, advertising and marketing operations and legal operations among others (Aven, 2016). Nowadays, risks management has become a very crucial activity for most business organizations in the current modern business world. In the case of digitalized companies, the IT security threats and data security risks have become a priority, whereby the businesses have always devised various technique of managing the identified risks, e.g. by effectively ide3ntifying and controlling data and IT appliance and device threats especially in the organizational data assets (De Bakker et al, 2011). However, a business enterprise can mitigate these risks by avoiding, accepting, controlling, risk assumption method, risk retention methods and risk transfer method (Berg, 2010). In other words, it is important that every business organizations builds and implements an effective and efficient risk management plan so that it be in a better position to perform and achieve its objectives (Brustbauer, 2016).
Every business management team should ensure that there is timely and adequate risk identification plan which will be able to achieve the risk management goal and objective (Cole et al, 2017). This means that, there should be an effective risk management methodology as well, even in a business project. Additionally, a business enterprise should ensure that its plans, policies and procedures that relate to business risks are also effective and efficient especially when it comes to achieving the risk management standards. Risk management is a process that is actually undertaken by risk experts and professional (Chance and Brooks, 2015). These professionals basically analyze and assess different business departments and operations and roles including the insurance sector, business continuity status, human or employee welfare, health and safety, business’s corporate governance and business financial sector to name just but a few. This means that this process should be able to attain the main principles of risk management set up by the International Organization for Standardization which include aspects like: business value creation, inclusion in the decision making process, be systematically structure process, be flexible and iterative especially to change, have the capability of being improved and advanced when need be among others.
A risk management process should be preceded by a risk management plan which indicates various ways and methods of managing the risks (Cagno et al, 2008). Every risk management process should be certain of achieving and attaining the required standards and guidelines provided by the International Organization for Standardization (ISO). The project that I will be referring to is the development and advancement of information technology appliances in an Izteck Company. A risk management process involves the following steps:
Risk Context Establishment
This step involves the assessment of the circumstances under which a risk may occur. The risk management team should evaluate and analyze the relationship between the organization and the environment in which the risk is likely to occur. For instance, the team can assess the status of a specific organizational department, e.g. information technology department and the overall environment surrounding the business. By doing this, the team will have established and identified the boundaries where the risk is bound to occur. Therefore, in this first step, the team should consider evaluating both the external and internal environment of the organization, i.e. employees, business goals and objectives, business stakeholders among other things (Didraga, 2013).
This step basically involves the identification of potential risks in specifics. This involves analyzing and evaluating their origin or causes. Generally, this step involves identifying the business aspects that have the capability of causing risks. Just as mentioned earlier, most risks that occur in most businesses originate from the sources like, human resource sector, financial sector, information and technology sector, operations sector, technical sector and political sector of a business to name just but a few. The risk management team of specialists should therefore focus on evaluating and analyzing every step and activity involves in most of these sectors to be able to identify the risks that can occur there (Ennouri, 2013). There are different approaches that can be used to identify these risks:
- The risk management team can opt to ask the employees who work in those departments and sections of the business organization. By asking them, they will be able to get more information on how to identify he risks that are involved in those sectors (Glendon et al, 2016).
- The team can also ask for information and assistance from other risk management leaders who may have dealt with identification of risks in such organizations or sectors earlier. If it is in a business project, the risk management team leaders should take advice from prior leaders who may have run such projects. In other words, this process involves face-to-face interaction of the parties to encourage open communication and trust.
- To effectively identify business risks, the team leaders should focus on evaluating and analyzing all of the business systems, processes and structure that may be used. These are used in identifying the risks because these are some of the sources of business risks themselves.
- The risk management team also identify business risks by revisiting prior databases that contain any useful information that relates to risks that may have already occurred in the business.
Therefore, the identification stage is used to point out possible risks and define them in the best way possible by listing and analyzing the possible effects or impacts that may be caused by those risks. In my project, the risk management team must therefore be in a position to point out the possible risks and impact of consequences that may affect the technological appliances in Izteck Company which may include aspects like: data theft, software attack and security breaches, malicious programs and software attacks among others.
In this stage, the business should determine the probability of the occurrence of the identified risk. Additionally, the risk analysis team must determine the potential consequences or impacts that may arise or caused by the occurrence of the risk. This basically means estimation of risk value which can be calculated by multiplying the probability of the risk occurring with the cost of the risk. In other words, the main goal for risk estimation is simply to understand each risk in a specific way by understanding its occurrence chances and the impacts that it can cause to a business operation (Grimaldi et al, 2012).
After the probability of the risk occurrence is determined together with the impacts or consequences involves in case it occurs. The risk is evaluated so that the business managers can be able to identify the sensible measures that can be taken to control and mitigate the risks. Through risk assessment and evaluation, a business will get the opportunity to know whether the risk is worth taking or leaving. Therefore, this process of risk assessment is very crucial because it determines the decision to be made in terms of prioritizing a risk implementation plan. This means that the risk assessment and evaluation involves analyzing the probability of risk occurring, its impact, exposure and the other possible risk measures that can change or alter the priority or plan made about the risk occurrence (Grace et al, 2015). When the risks are listed according to their order of priority, the risk with more or highest impact of consequences should be the one to be managed first. Risk prioritizing can be evaluated by use of aspects like their likelihood or rater probability and impact of consequences.
Risk Identification
The likelihood of risks can be based on a 1-5 scale whereby 1 represents rare, 2 represent unlikelihood, 3 represent possible, 4 represent likelihood and 5 represent almost certain. On the other hand, the impact of risk consequences can be determined based on a 1-5 scale whereby 1 represents negligible, 2 represents minor, 3 represents moderate, 4 represents major and 5 represents catastrophic. To be clear, it is important to note that the higher or greater the combination of scales, the more the risk should be prioritized for mitigation. This means that if the risk management team is almost certain that the risk will occur and that the impact of consequences once it occurs are catastrophic, then that particular risk should be handles and mitigated being the first.
When the risk has been evaluated, then the management must have acquired some ideas on how it can be controlled or mitigated. In this step, the risk management team basically revisits the list of risks identified according to their priority and develops a plan on how to mitigate them using specific risk control measures. This process most involves some of the following steps: hazard elimination, substitution of the hazard, isolation of the hazard, exercising restrictive control over the hard among other things (Rabechini Junior and Monteiro de Carvalho, 2013). In addition to that, the following risk control measures and approaches are commonly used: risk acceptance, risk reduction, risk transfer, risk retaining to name a few. All of the latter measures are then kept into account and documented for future use and reference when need be. As for my project, the team should be able to list possible measures that can help implement the risk control measures, e.g. building a security fire wall to protect the technological appliances from malicious attacks, data theft and breaches.
This step involves revisiting the whole risk management process and evaluating all the steps deeper with an aim of correcting possible mistakes done. The step is also used to track the progress of all the identified risks with the inclusion of wanting to identify other related or upcoming risks. Basically, in this stage, the risk management team’s objective is to be able to understand the mitigation measures taken, their effects on the risks and possible hazard that the risk may have developed in the course of time (Rabechini Junior and Carvalho, 2013). If the risk does not pose any hazard after the control measure is implemented, the risk management process is deemed as successful but in case the risk still poses more additional risks then the measure and the risk management process is said to have failed (Harding, 2015). The main goal for this stage is to ensure that risks mitigation measures actually pose an effect to the risk itself and that it reduces its impact of consequences.
Risk management plan is a documentation that is prepared by a managers, e.g. project managers for the purpose of guiding them towards effective and efficient risk management. The plan is meant to guide then on identifying the potential risks, estimate their effects on the business and identifies different methods for managing the risks (Rodrigues-da-Silva and Crispim, 2014). In most cases, business organizations implement various strategies when it comes to managing risks. However, these risks management strategies are basically implemented according to the types, impacts on the organizational operations and the various ways to mitigate those risks (Grabara et al, 2016). In additionally to that, the risks strategies are provided and implemented according to their origin or cause. For instance, a risk that is likely to be caused by entire business image is to be managed by the top management team of a business while a risk that related to information technology (IT) and other electronic appliances and devices is to be managed by the business IT department or experts. Therefore, risk management plan is a very fundamental aspect for a risk management analysis plan for every business. The following strategies are popular and commonly used in most businesses to mitigate or manage their risks:
Risk Estimation
When a business implements such a strategy, then its aim is to completely avoid the risk, basically not to be involved with the risk at all. In this case, the business’s objective is to assume that the risk will not happen or that it does not exists. For instance, if the business is planning on engaging in a certain project or business venture, then it can avoid the risks that relate to such project or venture by: not venturing into the venture at all or passing on or skipping the project itself. Many business that implement such a management strategy are those that have the realization that no matter the case (whether they take the risk or fail to take the risk), the project or venture will not beneficial to its operations at all (Sanchez et al, 2009). Additionally, a risk can be avoided if the costs involved in taking the risk are actually not worth it, there is a probability of loss occurrence than profit realization for the business.
Sometime, the consequences caused and involved in a risk can be shared between many parties or rather other third parties. Besides that, the consequences can also be distributed among many participants (especially in a project) or various business departments (Schroeder and Hatton, 2012). This means that, the profits or losses caused by any potential business risk is to be shared equally or according to shares owned. For instance, a business shares a project or business venture with another organization.
It is also known as risk retention strategy or approach. This is basically the last option for every organization that is willing to take or be involved in a risk. This type of approach is used when businesses realize that they have no other option of preventing or mitigating the risks. Additionally, it is also applicable when the cost of potential loss from the risk is less than the cost of insuring the business from the specific risk. Also, when the future profit realization or gain is higher and when the risk is worth accepting. For a business to accept a risk, it should always conduct an impact analysis to be able to determine the levels of consequences and effects that may arise in case the risk is accepted (Shimizu et al, 2012). This is simply because even when the risk is accepted and the consequences are extremely negative and bring losses, it is easier for the business to come up with a contingency plan to cope with the impacts.
This is simply known as risk mitigation approach. It is applicable when business have already decided to take up the risk. Therefore, the business must improvise preventive or detective actions that can help it manage the risk. Through this actions, the business managers will be able to reduce the impact or the likelihood of risk occurrence. Preventive action aims at preventing the occurrence of a high risk situation. May include practicing and implementing issues to do with employee health and safety through training, building of security firewalls and protection programs to reduce data theft or IT security breach and insecurity to name a few things (Gutteling, 2015). The detective actions can referred to actions that relate to the identification of weak points in a business operations which can attract the occurrence of a risk or threat. Additionally, the risk detective actions also involve different ways to correct these areas of weakness in the effective methods.
Risk Assessment and Evaluation
Sometimes, business enterprises have the capability of reducing the impact caused and involved in a risk in case it occurs. This means that some organizations can reduce the level and rates of effects that a risk can cause to its daily operations. For instance, a business that has a plan to venture into a new business, can reduce the effects of a risk by reducing the scope of the venture.
In this strategy, a business entity passes on the risk or rather shifts the risk from itself to another party, i.e. the third party. In such a scenario, business must have identified the potential risk and estimated its effects which in most cases the organization finds it difficult to prevent or manage the potential consequences (Toth and Sebestyen, 2016). Most of the cases where risks are transferred is when a business insures its assets or employees. In this case, on the occurrence of the insured risk, the costs or effects of the risks are shifted to the insurance company or insurer.
Conclusion
Risk management is the identification, assessment and prioritization of risks with the aim of controlling and mitigating their impact of consequences. Risk management involves the coordination and implementation of economical measure with the aim of minimizing, monitoring and controlling the probability of risk occurrence and the impacts of their consequences. Risk management has become a very essential process and practice for most business organizations nowadays. This is simply because of the increase in the use of modern technology to conduct and perform business operations. However, the technological advancement has caused and allowed the opportunity for high risk occurrence. Therefore, business have decided to invest in this practice so that they can be able their goals and objectives without any hindrances. Risk management process and strategies are two main aspects that make up the risk management analysis process. Therefore, it is important for every organization to identify the most effective risk management team that will be able to follow the risk management process and implement the best strategies or approaches to tackle the business risks.
References
Aven, T., 2016. Risk assessment and risk management: Review of recent advances on their foundation. European Journal of Operational Research, 253(1), pp.1-13.
Berg, H.P., 2010. Risk management: procedures, methods and experiences. Risk Management, 1(17), pp.79-95.
Brustbauer, J., 2016. Enterprise risk management in SMEs: Towards a structural model. International Small Business Journal, 34(1), pp.70-85.
Cagno, E., Caron, F. and Mancini, M., 2008. Dynamic analysis of project risk. International Journal of Risk Assessment and Management, 10(1-2), pp.70-87.
Cagliano, A.C., Grimaldi, S. and Rafele, C., 2015. Choosing project risk management techniques. A theoretical framework. Journal of Risk Research, 18(2), pp.232-248.
Chance, D.M. and Brooks, R., 2015. Introduction to derivatives and risk management. Cengage Learning.
Cole, S., Giné, X. and Vickery, J., 2017. How does risk management influence production decisions? Evidence from a field experiment. The Review of Financial Studies, 30(6), pp.1935-1970.
De Bakker, K., Boonstra, A. and Wortmann, H., 2011. Risk management affecting IS/IT project success through communicative action. Project Management Journal, 42(3), pp.75-90.
Didraga, O., 2013. The role and the effects of risk management in IT projects success. Informatica Economica, 17(1), p.86.
Ennouri, W., 2013. Risks management: new literature review. Polish Journal of Management Studies, 8, pp.288-297.
Glendon, A.I., Clarke, S. and McKenna, E., 2016. Human safety and risk management. Crc Press.
Grabara, J.K., Okwiet, B. and Kot, S., 2016. Managing of Work Risk in Small and Medium-Size Companies. World Academy of Science, Engineering and Technology, International Journal of Social, Behavioral, Educational, Economic, Business and Industrial Engineering, 10(11), pp.3524-3529.
Grace, M.F., Leverty, J.T., Phillips, R.D. and Shimpi, P., 2015. The value of investing in enterprise risk management. Journal of Risk and Insurance, 82(2), pp.289-316.
Grimaldi, S., Rafele, C. and Cagliano, A.C., 2012. A Framework to Select Techniques Supporting Project Risk Management. In Risk Management-Current Issues and Challenges. InTech.
Gutteling, J.M., 2015. Risk communication. John Wiley & Sons, Inc..
Harding, J., 2012. Avoiding project failures. Chemical Engineering, 119(13), p.51.
Rabechini Junior, R. and Monteiro de Carvalho, M., 2013. Understanding the impact of project risk management on project performance: An empirical study. Journal of technology management & innovation, 8, pp.6-6.
Rabechini Junior, R. and Carvalho, M.M.D., 2013. Relationship between risk management and project success. Production, 23(3), pp.570-581.
Rodrigues-da-Silva, L.H. and Crispim, J.A., 2014. The project risk management process, a preliminary study. Procedia technology, 16, pp.943-949.
Sanchez, H., Robert, B., Bourgault, M. and Pellerin, R., 2009. Risk management applied to projects, programs, and portfolios. International journal of managing projects in Business, 2(1), pp.14-35.
Schroeder, K. and Hatton, M., 2012. Rethinking risk in development projects: from management to resilience. Development in Practice, 22(3), pp.409-416.
Shimizu, T., Won Park, Y. and Hong, P., 2012. Project managers for risk management: case for Japan. Benchmarking: An International Journal, 19(4/5), pp.532-547.
Toth, T. and Sebestyen, Z., 2016. Project Risk Management Process for Professionals: A Value-Based Approach. In Managing Project Risks for Competitive Advantage in Changing Business Environments (pp. 128-149). IGI Global.
Ziemba, E. and Kolasa, I., 2015, September. Risk factors framework for information systems projects in public organizations-insight from Poland. In Computer Science and Information Systems (FedCSIS), 2015 Federated Conference on (pp. 1575-1583). IEEE.
Order an Essay Now & Get These Features For Free:
Turnitin Report
Formatting
Title Page
Citation
Outline
