Management of risk

2015-09-23T13:34:42Z

S141543:

[[File:overviewrisk.png|500px|thumb|right|Overview of risk management]]

Risk is part of all our lives. We need to take risks to grow and develop. Effectively managed risk in hospitals, airport security, construction sites, projects, programmes, portfolios and in so many more circumstances help societies achieve.

'''Management of risk''' involves identification, assessment, and prioritization of risks. Coordinated and economical application of resources to minimize, monitor, and control the probability and/or impact of unfortunate events or to maximize the realization of opportunities.

Figure 1 shows what is involved in risk management. Identifying, analysing and evaluating risks are all part of risk assessment and will be further analysed in the risk assessment section.

Because risk is inherent in everything we do, risk professionals undertake roles that are very diverse. It includes roles in insurance, business, health and safety, corporate governance, engineering, planning and financial services to name a few.

In this article general methodologies and important principles of [https://en.wikipedia.org/wiki/Risk_management risk management] will be outlined, risk assessment will be explained and programme risk management introduced. Benefits and limitations of risk management will be discussed before stating the conclusions.

__TOC__

=Introduction=

[https://en.wikipedia.org/wiki/Organization Organizations] of all types and sizes face internal and external factors and influences that make it uncertain whether and when they will achieve their objectives. Risk is the effect this uncertainty has on an organization's objectives. Risk can be managed by identifying it, analysing it and then evaluating whether the risk should be modified by risk treatment in order to satisfy their risk criteria. Constant communication and consultation with stakeholders is a key for the process to run smoothly as well as monitoring and reviewing the risk and making sure that the correct actions are taken to ensure that no further risk treatment is required.

Risk management can be applied to an entire organization, at its many areas and levels, at any time. It can also be applied to specific functions, projects and activities.

The practice of risk management is used within many sectors in order to meet diverse needs. Despite that wide range, adoption of consistent processes within a comprehensive framework can help to ensure that risk is managed effectively, efficiently and coherently across an organization. [https://en.wikipedia.org/wiki/ISO_31000 ISO 31000] is an international standard that describes a generic approach and provides the principles and guidelines for managing any form of risk in a systematic, transparent and credible manner and withing any scope and context. <ref>https://www.iso.org/obp/ui/#iso:std:iso:31000:ed-1:v1:en</ref>

As can be seen in figure 1, the first step is to establish the context in order to figure out the individual needs, audiences, perceptions and criteria for each specific sector while applying risk management. Establishing the context will capture the objectives of the organization, the environment in which it pursues those objectives, its stakeholders and the dicersity of risk criteria. those factors will help reveal and assess the nature and complexity of its risks.

The international standard has stated that when risk management is implemented and maintained in accordance with ISO, it enables an organization to achieve the following objectives:

* Increase the likelihood of achieving objectives
* encourage proactive management
* Be aware of the need to identify and treat risk throughout the organization
* Improve the identification of opportunities and threats
* Comply with relevant legal and regulatory requirements and international norms
* Improve mandatory and voluntary reporting
* Improve governance
* Improve stakeholder confidence and trust
* Establish a reliable basis for decision making and planning
* Improve controls
* Effectively allocate and use resources for risk treatment
* Improve operational effectiveness and efficiency
* Enhance health and safety performance, as well as environmental protection
* Improve loss prevention and incident management
* Minimize losses
* Improve organizational learning
* Improve organizational resilience

As well as helping organizations reach these objectives the standard is intended to meet the needs of a wide range of stakeholders. Stakeholders that are included are those responsible for developing risk management policy within their organization, those accountable for ensuring that risk is effectively managed within the organization as a whole or within a specific area, project or activity. Those who need to evaluate an organization's effectiveness in managing risk and developers of standards, guides, procedures and codes of practice that, in whole or in part, set out how risk is to be managed withing the specific context of these documents. Figure X shows the relationships between the risk management principles, framework and process.

ISO Guide 73:2009, ''Risk management - Vocabulary'' complements ISO 31000. According to ISO 73:2009 risk management is intended to be used by those engaged in managing risks, those who are involved in activities of ISO and IEC, and developers of national or sector-specific standards, guides, procedures and codes of practice relating to the management of risk. <ref>http://www.iso.org/iso/catalogue_detail?csnumber=44651</ref>

Risks with great impacts and a high probability of happening are treated before risks with smaller impacts and lower possibility. This is called [[prioritization]]. There are several tools that can be used in the process of assessing risks. Those tools will be discussed in '''CHAPTER XX'''.

When allocating resources, risk management faces some difficulties. Short term planning would recommend skipping risk management when starting a new project as the process itself costs manpower and is not directly involved in the project itself. While long term thinking would definitely recommend going through the processes of risk management. That is because it could save a lot of money and even lives if it prevents one unfortunate event to happen as it was accounted for in the process. The effect of negative effects of risks is minimized as well as spending in ideal risk management.

==General methodology==

The following methods are a part of the general methodology, these methods are usually performed in the order as they are listed.

# identify and characterize threats
# assess the vulnerability of critical assets to specific threats
# determine the risk
# identify ways to reduce those risks
# prioritize risk reduction measures based on a strategy

'''VANTAR HEIMILD'''

== Important principles ==

ISO has identified principles of risk management, some mentionable principles are.

* Create value
* Be part of decision making process
* Be a systematic and structured process
* Take human factors into account
* Be continually or periodically re-assessed

'''VANTAR HEIMILD'''

=Risk assessment=

'''Risk assessment''' is the determination of [[quantitative]] or [[qualitative]] estimate of risk related to a concrete situation and a recognized hazard. Two components of risk are required for calculations in quantitative risk assessment. The magnitude of the potential loss (L) and the probability (p) that the loss will occur. If the countermeasure for handling a certain risk exceeds the value of the expected loss it is called acceptable risk. That kind of risk is understood and tolerated
==Qualitative==

A pre-defined rating scale is used to prioritize the identified project risks. The probability or likelihood and the impact on a project objectives should they occur gives the score for a certain risk. A qualitative risk analysis also includes the appropriate categorization of the risks. Source-based or effect-based.

==Quantitative==

A further analysis of the highest priority risks during which a numerical or quantitative rating is assigned in order to develop a probabilistic analysis of the project. Possible outcomes for the project are quantified and the probability of achieving specific project objectives is assessed. When there is uncertainty a quantitative approach can be used to make decisions. It also creates realistic and achievable cost, schedule or scope targets.

Quantitative risk analysis can only be successfully carried out if there is high-quality data, a well-developed project model, and a prioritized lists of project risks. That usually yields from performing a qualitative risk analysis. <ref>https://www.passionatepm.com/blog/qualitative-risk-analysis-vs-quantitative-risk-analysis-pmp-concept-1</ref>

{| class="wikitable"
|-
! Qualitative
! Quantitative
|-
| risk-level
| project level
|-
| subjective evaluation of probability and impact
| probabilistic estimates of time and cost
|-
| quick and easy to perform
| time consuming
|-
| no special software or tools required
| may require specalized tools
|-
|}

=Programme risk management=

There are four defined steps in programme risk management. Identify step, assess step, plan step and implement step. In order for a programme to run as smoothly as possible, these four steps must be followed. Other factors play along these four steps, good and effective communication is the most important factor. Communication has to be good throughout each and every step. Let's take a better look at the four steps.

==Identify step==

In the beginning of programme management, the identification of uncertain events which can both be threats and opportunities takes place. The programme's objectives and scope, what assumptions have been made, who the stakeholders are and where the programme fits inside the organization as well as the environment should be understood. If those aspects are understood it enables the programme to search for risk methodically and take the correct actions should a response be needed at some point.

Actual risks should then be identified. Both threats to the programme objectives and opportunities to overachieve on outcomes and benefits.

==Assess step==

The assessment of risk can be broken down into two activities. Estimate the threats and the opportunities in terms of their probability impact and proximity on the one hand, and on the other hand to evaluate the net aggregated effect of the identified threats and opportunities on the programme. This is explained in detail in the Risk assessment section.

==Plan step==

Preparation of specific management response to the threats and opportunities that have been identified are the primary goal of the plan step. The objective is to remove or reduce the threats and to maximize the opportunities.

==Implement step==

Here it shall be ensured that the previously planned risk management actions are successfully implemented and monitored as to their effectiveness. Corrective actions should be taken where responses do not live up to expectations. It is an important factor that roles and responsibilities are allocated. Someone has to be responsible for the management and control of the risk. Key roles in that perspective are: '''Risk owner''' is responsible for the management and control of all aspects of the risks assigned to them. Managing, tracking and reporting the implementation of the selected actions to address the threats or to maximize the opportunities is included in that role. '''Risk actionee''' is responsible for the implementation of risk response actions. Support and take directions from the risk owner.

=Tools=
There are many tools used in risk assessment, sometimes it is recommended to use more than one tool in risk assessment. They all have their own focus areas. Lets take a better look at the most frequently used tools.

==Hazard and operability study (HAZOP)==
==Failure mode effect analysis (FMEA)==
==Structured What-IF technique (SWIFT)==
==Fault Tree Analysis (FTA)==

=Benefits=

The most notable potential benefits of a well-structured and efficiently run risk management are. <ref>http://irisintelligence.com/risk-management-explained/why-manage-risk.html</ref>

* Improved strategic and business planning
* More effective use of resources
* An ability to quickly grasp new opportunities
* Fewer unwelcome surprises
* Enhanced communication
* Ability to reassure key stakeholders throughout the organization
* Continuous improvement
* robust contingency planning

==For projects==

[[Contingency]] in projects can make or break them. Too much contingency is uncompetitive and too little increases the chance of failure. Risk assessment helps set contingency levels. It aims to figure out the most probable level of risk and gives the confidence level of outcome targets.

==For portfolios==
==For businesses==

=Limitations=
=Conclusions=
=References=

Among strategies used to manage threats are.

* Transferring the threat to another party
* Avoid the threat
* Reducing both the negative effect and lowering the probability of the threat
* Accepting the potential negative consequences of a particular thread is the only option.
* For uncertain events with benefits (opportunities) the opposite is done.

<references/>

Management of risk

2015-09-23T13:25:43Z

S141543:

[[File:overviewrisk.png|500px|thumb|right|Overview of risk management]]

Risk is part of all our lives. We need to take risks to grow and develop. Effectively managed risk in hospitals, airport security, construction sites, projects, programmes, portfolios and in so many more circumstances help societies achieve.

'''Management of risk''' involves identification, assessment, and prioritization of risks. Coordinated and economical application of resources to minimize, monitor, and control the probability and/or impact of unfortunate events or to maximize the realization of opportunities.

Figure 1 shows what is involved in risk management. Identifying, analysing and evaluating risks are all part of risk assessment and will be further analysed in the risk assessment section.

Because risk is inherent in everything we do, risk professionals undertake roles that are very diverse. It includes roles in insurance, business, health and safety, corporate governance, engineering, planning and financial services to name a few.

In this article general methodologies and important principles of risk management will be outlined, risk assessment will be explained and programme risk management introduced. Benefits and limitations of risk management will be discussed before stating the conclusions.

__TOC__

=Introduction=

Organizations of all types and sizes face internal and external factors and influences that make it uncertain whether and when they will achieve their objectives. Risk is the effect this uncertainty has on an organization's objectives. Risk can be managed by identifying it, analysing it and then evaluating whether the risk should be modified by risk treatment in order to satisfy their risk criteria. Constant communication and consultation with stakeholders is a key for the process to run smoothly as well as monitoring and reviewing the risk and making sure that the correct actions are taken to ensure that no further risk treatment is required.

Risk management can be applied to an entire organization, at its many areas and levels, at any time. It can also be applied to specific functions, projects and activities.

The practice of risk management is used within many sectors in order to meet diverse needs. Despite that wide range, adoption of consistent processes within a comprehensive framework can help to ensure that risk is managed effectively, efficiently and coherently across an organization. [https://en.wikipedia.org/wiki/ISO_31000 ISO 31000] is an international standard that describes a generic approach and provides the principles and guidelines for managing any form of risk in a systematic, transparent and credible manner and withing any scope and context. <ref>https://www.iso.org/obp/ui/#iso:std:iso:31000:ed-1:v1:en</ref>

As can be seen in figure 1, the first step is to establish the context in order to figure out the individual needs, audiences, perceptions and criteria for each specific sector while applying risk management. Establishing the context will capture the objectives of the organization, the environment in which it pursues those objectives, its stakeholders and the dicersity of risk criteria. those factors will help reveal and assess the nature and complexity of its risks.

The international standard has stated that when risk management is implemented and maintained in accordance with ISO, it enables an organization to achieve the following objectives:

* Increase the likelihood of achieving objectives
* encourage proactive management
* Be aware of the need to identify and treat risk throughout the organization
* Improve the identification of opportunities and threats
* Comply with relevant legal and regulatory requirements and international norms
* Improve mandatory and voluntary reporting
* Improve governance
* Improve stakeholder confidence and trust
* Establish a reliable basis for decision making and planning
* Improve controls
* Effectively allocate and use resources for risk treatment
* Improve operational effectiveness and efficiency
* Enhance health and safety performance, as well as environmental protection
* Improve loss prevention and incident management
* Minimize losses
* Improve organizational learning
* Improve organizational resilience

As well as helping organizations reach these objectives the standard is intended to meet the needs of a wide range of stakeholders

ISO Guide 73:2009, ''Risk management - Vocabulary'' complements ISO 31000. According to ISO 73:2009 risk management is intended to be used by those engaged in managing risks, those who are involved in activities of ISO and IEC, and developers of national or sector-specific standards, guides, procedures and codes of practice relating to the management of risk. <ref>http://www.iso.org/iso/catalogue_detail?csnumber=44651</ref>

Risks with great impacts and a high probability of happening are treated before risks with smaller impacts and lower possibility. This is called [[prioritization]]. There are several tools that can be used in the process of assessing risks. Those tools will be discussed in '''CHAPTER XX'''.

When allocating resources, risk management faces some difficulties. Short term planning would recommend skipping risk management when starting a new project as the process itself costs manpower and is not directly involved in the project itself. While long term thinking would definitely recommend going through the processes of risk management. That is because it could save a lot of money and even lives if it prevents one unfortunate event to happen as it was accounted for in the process. The effect of negative effects of risks is minimized as well as spending in ideal risk management.

==General methodology==

The following methods are a part of the general methodology, these methods are usually performed in the order as they are listed.

# identify and characterize threats
# assess the vulnerability of critical assets to specific threats
# determine the risk
# identify ways to reduce those risks
# prioritize risk reduction measures based on a strategy

'''VANTAR HEIMILD'''

== Important principles ==

ISO has identified principles of risk management, some mentionable principles are.

* Create value
* Be part of decision making process
* Be a systematic and structured process
* Take human factors into account
* Be continually or periodically re-assessed

'''VANTAR HEIMILD'''

=Risk assessment=

'''Risk assessment''' is the determination of [[quantitative]] or [[qualitative]] estimate of risk related to a concrete situation and a recognized hazard. Two components of risk are required for calculations in quantitative risk assessment. The magnitude of the potential loss (L) and the probability (p) that the loss will occur. If the countermeasure for handling a certain risk exceeds the value of the expected loss it is called acceptable risk. That kind of risk is understood and tolerated
==Qualitative==

A pre-defined rating scale is used to prioritize the identified project risks. The probability or likelihood and the impact on a project objectives should they occur gives the score for a certain risk. A qualitative risk analysis also includes the appropriate categorization of the risks. Source-based or effect-based.

==Quantitative==

A further analysis of the highest priority risks during which a numerical or quantitative rating is assigned in order to develop a probabilistic analysis of the project. Possible outcomes for the project are quantified and the probability of achieving specific project objectives is assessed. When there is uncertainty a quantitative approach can be used to make decisions. It also creates realistic and achievable cost, schedule or scope targets.

Quantitative risk analysis can only be successfully carried out if there is high-quality data, a well-developed project model, and a prioritized lists of project risks. That usually yields from performing a qualitative risk analysis. <ref>https://www.passionatepm.com/blog/qualitative-risk-analysis-vs-quantitative-risk-analysis-pmp-concept-1</ref>

{| class="wikitable"
|-
! Qualitative
! Quantitative
|-
| risk-level
| project level
|-
| subjective evaluation of probability and impact
| probabilistic estimates of time and cost
|-
| quick and easy to perform
| time consuming
|-
| no special software or tools required
| may require specalized tools
|-
|}

=Programme risk management=

There are four defined steps in programme risk management. Identify step, assess step, plan step and implement step. In order for a programme to run as smoothly as possible, these four steps must be followed. Other factors play along these four steps, good and effective communication is the most important factor. Communication has to be good throughout each and every step. Let's take a better look at the four steps.

==Identify step==

In the beginning of programme management, the identification of uncertain events which can both be threats and opportunities takes place. The programme's objectives and scope, what assumptions have been made, who the stakeholders are and where the programme fits inside the organization as well as the environment should be understood. If those aspects are understood it enables the programme to search for risk methodically and take the correct actions should a response be needed at some point.

Actual risks should then be identified. Both threats to the programme objectives and opportunities to overachieve on outcomes and benefits.

==Assess step==

The assessment of risk can be broken down into two activities. Estimate the threats and the opportunities in terms of their probability impact and proximity on the one hand, and on the other hand to evaluate the net aggregated effect of the identified threats and opportunities on the programme. This is explained in detail in the Risk assessment section.

==Plan step==

Preparation of specific management response to the threats and opportunities that have been identified are the primary goal of the plan step. The objective is to remove or reduce the threats and to maximize the opportunities.

==Implement step==

Here it shall be ensured that the previously planned risk management actions are successfully implemented and monitored as to their effectiveness. Corrective actions should be taken where responses do not live up to expectations. It is an important factor that roles and responsibilities are allocated. Someone has to be responsible for the management and control of the risk. Key roles in that perspective are: '''Risk owner''' is responsible for the management and control of all aspects of the risks assigned to them. Managing, tracking and reporting the implementation of the selected actions to address the threats or to maximize the opportunities is included in that role. '''Risk actionee''' is responsible for the implementation of risk response actions. Support and take directions from the risk owner.

=Tools=
There are many tools used in risk assessment, sometimes it is recommended to use more than one tool in risk assessment. They all have their own focus areas. Lets take a better look at the most frequently used tools.

==Hazard and operability study (HAZOP)==
==Failure mode effect analysis (FMEA)==
==Structured What-IF technique (SWIFT)==
==Fault Tree Analysis (FTA)==

=Benefits=

The most notable potential benefits of a well-structured and efficiently run risk management are. <ref>http://irisintelligence.com/risk-management-explained/why-manage-risk.html</ref>

* Improved strategic and business planning
* More effective use of resources
* An ability to quickly grasp new opportunities
* Fewer unwelcome surprises
* Enhanced communication
* Ability to reassure key stakeholders throughout the organization
* Continuous improvement
* robust contingency planning

==For projects==

[[Contingency]] in projects can make or break them. Too much contingency is uncompetitive and too little increases the chance of failure. Risk assessment helps set contingency levels. It aims to figure out the most probable level of risk and gives the confidence level of outcome targets.

==For portfolios==
==For businesses==

=Limitations=
=Conclusions=
=References=

Among strategies used to manage threats are.

* Transferring the threat to another party
* Avoid the threat
* Reducing both the negative effect and lowering the probability of the threat
* Accepting the potential negative consequences of a particular thread is the only option.
* For uncertain events with benefits (opportunities) the opposite is done.

<references/>

Management of risk

2015-09-22T19:20:29Z

S141543:

2015-09-18T16:58:07Z

S141543:

[[File:ISS impact RiskManagement.jpeg|thumb|320px|]]
According to ISO 31000 the definition of "risk" is "the effect of uncertainty on objectives". Looking into that definition it is noted that the word "risk" does refer to positive possibilities as well as negative ones. This definition was revised under the ISO 31000:2009. Before revision the definition of the word "risk" was "chance or probability of loss". Meaning that only negative results could be associated with a risk.

'''Management of risk''' involves identification, assessment, and prioritization of risks. Coordinated and economical application of resources to minimize, monitor, and control the probability and/or impact of unfortunate events or to maximize the realization of opportunities.

The term Risk management is really broad and can be used by individuals, families, firms, nations and so on. In this article risk management in general will be outlined with a special focus on risk management activities as applied to project management. That is one aspect inside of risk management called [[Project risk management]]

__TOC__

=Introduction=

ISO Guide 73:2009, ''Risk management - Vocabulary'' complements ISO 31000. According to ISO 73:2009 risk management is intended to be used by those engaged in managing risks, those who are involved in activities of ISO and IEC, and developers of national or sector-specific standards, guides, procedures and codes of practice relating to the management of risk. <ref>http://www.iso.org/iso/catalogue_detail?csnumber=44651</ref>

Risks with great impacts and a high probability of happening are treated before risks with smaller impacts and lower possibility. This is called [[prioritization]]. There are several tools that can be used in the process of assessing risks. Those tools will be discussed in '''CHAPTER XX'''.

When allocating resources, risk management faces some difficulties. Short term planning would recommend skipping risk management when starting a new project as the process itself costs manpower and is not directly involved in the project itself. While long term thinking would definitely recommend going through the processes of risk management. That is because it could save a lot of money and even lives if it prevents one unfortunate event to happen as it was accounted for in the process. The effect of negative effects of risks is minimized as well as spending in ideal risk management.

==Methodology==

The following methods are a part of the general methodology, these methods are usually performed in the order that they will be listed.

# identify and characterize threats
# assess the vulnerability of critical assets to specific threats
# determine the risk
# identify ways to reduce those risks
# prioritize risk reduction measures based on a strategy

== Important principles ==

ISO has identified principles of risk management, some mentionable principles are.

* Create value
* Be part of decision making process
* Be a systematic and structured process
* Take human factors into account
* Be continually or periodically re-assessed

=Benefits=

<references/>

2015-09-17T09:42:57Z

S141543: Created page with "According to ISO 31000 the definition of "risk" is "the effect of uncertainty on objectives". Looking into that definition it is noted that the word "risk" does refer to posit..."

Program management in change management

2015-09-15T13:00:26Z

S141543: Created page with "In today’s fast moving environment where innovation in technology, globalisation, massive competition and new demands of the market changes continuously it is very important..."

In today’s fast moving environment where innovation in technology, globalisation, massive competition and new demands of the market changes continuously it is very important that companies go through constant changes to adapt to the world’s needs in order to be competitive in their respective field. In the process of pursuing its own goals, companies need to pay attention to the environment as well as going through continuous transformation and readjustment. By misunderstanding the goals set or deviating from the goals a company can lose its identity which can eventually lead to the overall failure of the company <ref>[(Katsioloudes, M. I., 2006).]</ref>

The theory of change management makes sure that companies maintain clear sight of the goals set and go through the change process as smoothly as possible. In other words, a structured approach for ensuring that changes are thoroughly and smoothly implemented, and that the lasting benefits of change are achieved. The focus is on the wider impacts of change, particularly on people and how they, as individuals and teams, move from the current situation to the new one <ref> [(Hashim, M., 2013).] </ref>

Program management is a key method in organisational change. It allows change managers to have an overview of the wide range of projects and activities that should be executed in order for the company to achieve the changes intended. The most important aspects of the program management is to provide overview for change managers, as well as making sure projects are executed properly, making sure the alignment of projects and assessing the risks involved.

=== References ===
<References/>

Articles Fall Term 2015

2015-09-08T18:42:05Z

S141543: