RISK MANAGEMENT

Risk management is the process of identifying, assessing and controlling threats to an organization's capital and earnings. These threats, or risks, could stem from a wide variety of sources, including financial uncertainty, legal liabilities, strategic management errors, accidents and natural disasters. IT security threats and data-related risks, and the risk management strategies to alleviate them, have become a top priority for digitized companies. As a result, a risk management plan increasingly includes companies' processes for identifying and controlling threats to its digital assets, including proprietary corporate data, a customer's personally identifiable information (PII) and intellectual property.

Every business and organization faces the risk of unexpected, harmful events that can cost the company money or cause it to permanently close. Risk management allows organizations to attempt to prepare for the unexpected by minimizing risks and extra costs before they happen.

CONTENT CONTINUES BELOW

DOWNLOAD THIS FREE GUIDE

Risk Management is Evolving, Don’t Fall Behind

Download now for advice to help you improve accuracy of security questionnaires, interview third-party employees about risk and rethink third-party risk management best practices, and more.

• Corporate E-mail Address:
• I agree to TechTarget’s Terms of Use, Privacy Policy, and the transfer of my information to the United States for processing to provide me with relevant information as described in our Privacy Policy.
• I agree to my information being processed by TechTarget and its Partners to contact me via phone, email, or other means regarding information relevant to my professional interests. I may unsubscribe at any time.
• 
  

Importance

By implementing a risk management plan and considering the various potential risks or events before they occur, an organization can save money and protect their future. This is because a robust risk management plan will help a company establish procedures to avoid potential threats, minimize their impact should they occur and cope with the results. This ability to understand and control risk enables organizations to be more confident in their business decisions. Furthermore, strong corporate governance principles that focus specifically on risk management can help a company reach their goals.

Other important benefits of risk management include:

• Creates a safe and secure work environment for all staff and customers.
• Increases the stability of business operations while also decreasing legal liability.
• Provides protection from events that are detrimental to both the company and the environment.
• Protects all involved people and assets from potential harm.
• Helps establish the organization's insurance needs in order to save on unnecessary premiums.

The importance of combining risk management with patient safety has also been revealed. In most hospitals and organizations, the risk management and patient safety departments are separated; they incorporate different leadership, goals and scope. However, some hospitals are recognizing that the ability to provide safe, high-quality patient care is necessary to the protection of financial assets and, as a result, should be incorporated with risk management.

In 2006, the Virginia Mason Medical Center in Seattle, Washington integrated their risk management functions into their patient safety department, ultimately creating the Virginia Mason Production System (VMPS) management methods. VMPS focuses on continuously improving the patient safety system by increasing transparency in risk mitigation, disclosure and reporting. Since implementing this new system, Virginia Mason has experienced a significant reduction in hospital professional premiums and a large increase in the reporting culture.

Risk management strategies and processes

All risk management plans follow the same steps that combine to make up the overall risk management process:

• Establish context. Understand the circumstances in which the rest of the process will take place. The criteria that will be used to evaluate risk should also be established and the structure of the analysis should be defined.
• Risk identification. The company identifies and defines potential risks that may negatively influence a specific company process or project.
• Risk analysis. Once specific types of risk are identified, the company then determines the odds of them occurring, as well as their consequences. The goal of risk analysis is to further understand each specific instance of risk, and how it could influence the company's projects and objectives.
• Risk assessment and evaluation. The risk is then further evaluated after determining the risk's overall likelihood of occurrence combined with its overall consequence. The company can then make decisions on whether the risk is acceptable and whether the company is willing to take it on based on its risk appetite.
• Risk mitigation. During this step, companies assess their highest-ranked risks and develop a plan to alleviate them using specific risk controls. These plans include risk mitigation processes, risk prevention tactics and contingency plans in the event the risk comes to fruition.
• Risk monitoring. Part of the mitigation plan includes following up on both the risks and the overall plan to continuously monitor and track new and existing risks. The overall risk management process should also be reviewed and updated accordingly.
• Communicate and consult. Internal and external shareholders should be included in communication and consultation at each appropriate step of the risk management process and in regards to the process as a whole.

Risk management strategies should also attempt to answer the following questions:

1. What can go wrong? Consider both the workplace as a whole and individual work.
2. How will it affect the organization? Consider the probability of the event and whether it will have a large or small impact.
3. What can be done? What steps can be taken to prevent the loss? What can be done recover if a loss does occur?
4. If something happens, how will the organization pay for it?

Risk management approaches

After the company's specific risks are identified and the risk management process has been implemented, there are several different strategies companies can take in regard to different types of risk:

• Risk avoidance. While the complete elimination of all risk is rarely possible, a risk avoidance strategy is designed to deflect as many threats as possible in order to avoid the costly and disruptive consequences of a damaging event.
• Risk reduction. Companies are sometimes able to reduce the amount of damage certain risks can have on company processes. This is achieved by adjusting certain aspects of an overall project plan or company process, or by reducing its scope.
• Risk sharing. Sometimes, the consequences of a risk are shared, or distributed among several of the project's participants or business departments. The risk could also be shared with a third party, such as a vendor or business partner.
• Risk retaining. Sometimes, companies decide a risk is worth it from a business standpoint, and decide to keep the risk and deal with any potential fallout. Companies will often retain a certain level of risk if a project's anticipated profit is greater than the costs of its potential risk.

Limitations

While risk management can be an extremely beneficial practice for organizations, its limitations should also be considered. Many risk analysis techniques -- such as creating a model or simulation -- require gathering large amounts of data. This extensive data collection can be expensive and is not guaranteed to be reliable.

Furthermore, the use of data in decision making processes may have poor outcomes if simple indicators are used to reflect the much more complex realities of the situation. Similarly, adopting a decision throughout the whole project that was intended for one small aspect can lead to unexpected results.

Another limitation is the lack of analysis expertise and time. Computer software programs have been developed to simulate events that might have a negative impact on the company. While cost effective, these complex programs require trained personnel with comprehensive skills and knowledge in order to accurately understand the generated results. Analyzing historical data to identify risks also requires highly trained personnel. These individuals may not always be assigned to the project. Even if they are, there frequently is not enough time to gather all their findings, thus resulting in conflicts.

Other limitations include:

• A false sense of stability. Value-at-risk measures focus on the past instead of the future. Therefore, the longer things go smoothly, the better the situation looks. Unfortunately, this makes a downturn more likely.
• The illusion of control. Risk models can give organizations the false belief that they can quantify and regulate every potential risk. This may cause an organization to neglect the possibility of novel or unexpected risks. Furthermore, there is no historical data for new products, so there's no experience to base models on.
• Failure to see the big picture. It's difficult to see and understand the complete picture of cumulative risk.
• Risk management is immature. An organization's risk management policies are underdeveloped and lack the history to make accurate evaluations.

Risk management standards

Since the early 2000s, several industry and government bodies have expanded regulatory compliance rules that scrutinize companies' risk management plans, policies and procedures. In an increasing number of industries, boards of directors are required to review and report on the adequacy of enterprise risk management processes. As a result, risk analysis, internal audits and other means of risk assessment have become major components of business strategy.

Risk management standards have been developed by several organizations, including the National Institute of Standards and Technology (NIST) and the International Organization for Standardization (ISO). These standards are designed to help organizations identify specific threats, assess unique vulnerabilities to determine their risk, identify ways to reduce these risks and then implement risk reduction efforts according to organizational strategy.

The ISO 31000 principles, for example, provide frameworks for risk management process improvements that can be used by companies, regardless of the organization's size or target sector. The ISO 31000 is designed to "increase the likelihood of achieving objectives, improve the identification of opportunities and threats, and effectively allocate and use resources for risk treatment," according to the ISO website. Although ISO 31000 cannot be used for certification purposes, it can help provide guidance for internal or external risk audit, and it allows organizations to compare their risk management practices with the internationally recognized benchmarks.

The ISO recommends the following target areas, or principles, should be part of the overall risk management process:

• The process should create value for the organization.
• It should be an integral part of the overall organizational process.
• It should factor into the company's overall decision-making process.
• It must explicitly address any uncertainty.
• It should be systematic and structured.
• It should be based on the best available information.
• It should be tailored to the project.
• It must take into account human factors, including potential errors.
• It should be transparent and all-inclusive.
• It should be adaptable to change.
• It should be continuously monitored and improved upon.

The ISO standards and others like it have been developed worldwide to help organizations systematically implement risk management best practices. The ultimate goal for these standards is to establish common frameworks and processes to effectively implement risk management strategies.

These standards are often recognized by international regulatory bodies, or by target industry groups. They are also regularly supplemented and updated to reflect rapidly changing sources of business risk. Although following these standards is usually voluntary, adherence may be required by industry regulators or through business contracts.

Risk management examples

One example of risk management could be a business identifying the various risks associated with opening a new location. They can mitigate risks by choosing locations with a lot of foot traffic and low competition from similar businesses in the area.

Another example could be an outdoor amusement park that acknowledges their business is completely weather-dependent. In order to alleviate the risk of a large financial hit whenever there is a bad season, the park might choose to consistently spend low and build up cash reserves.

Yet another example could be an investor buying stock in an exciting new company with high valuation even though they know the stock could significantly drop. In this situation, risk acceptance is displayed as the investor buys despite the threat, feeling the potential of the large reward outweighs the risk.