Risk management

is the identification, assessment, and prioritization of risks followed by coordinated and

economical application of resources to minimize, monitor, and control the probability and/or
impact of unfortunate events or to maximize the realization of opportunities. Risks can come
from uncertainty in financial markets, threats from project failures (at any phase in design,
development, production, or sustainment life-cycles), legal liabilities, credit risk,
accidents, natural causes and disasters as well as deliberate attack from an adversary, or events of
uncertain or unpredictable root-cause.
In ideal risk management, a prioritization process is followed whereby the risks with the
greatest loss (or impact) and the greatest probability of occurring are handled first, and risks with
lower probability of occurrence and lower loss are handled in descending order. In practice the
process of assessing overall risk can be difficult, and balancing resources used to mitigate
between risks with a high probability of occurrence but lower loss versus a risk with high loss
but lower probability of occurrence can often be mishandled.

Stages in Risk Management
Identifying the hazards
*hazard the potential to cause harm. Harm including ill health and injury, damage to property,
plant, products or the environment, production losses or increased liabilities.
Evaluating the associated risks
*risk the likelihood that a specified undesired event will occur due to the realization of a
hazard by, or during work activities or by the products and services created by work activities.
Controlling the risks
risk avoidance this strategy involves a conscious decision on the part of the
organization to avoid completely a particular risk by discontinuing the operation
producing the risk e.g. replacing a hazardous chemical by one with less or no risk
potential.
risk retention this risk is retained in the organization where any consequent loss is
financed by the company. There are two aspects to consider here, risk retention with
knowledge and risk retention without knowledge.
risk transfer this refers to the legal assignment of the cost of certain potential losses
from one party to another. The most commonly way is by insurance.
risk reduction - here the risks are systematically reduced through control measures,
according to the hierarchy of risk control described in earlier sections.



Risk analysis
is a technique used to identify and assess factors that may jeopardize the success of
a project or achieving a goal. This technique also helps to define preventive measures to reduce
the probability of these factors from occurring and identify countermeasures to successfully deal
with these constraints when they develop to avert possible negative effects on the
competitiveness of the company. One of the popular methods to perform a risk analysis in the
computer field is called facilitated risk analysis process (FRAP).
Facilitated risk analysis process
FRAP analyzes one system, application or segment of business processes at time.
FRAP assumes that additional efforts to develop precisely quantified risks are not cost effective
because:
such estimates are time consuming
risk documentation becomes too voluminous for practical use
specific loss estimates are generally not needed to determine if controls are needed.
without assumptions there is little risk analysis

After identifying and categorizing risks, a team identifies the controls that could mitigate
the risk. The decision for what controls are needed lies with the business manager. The team's
conclusions as to what risks exists and what controls needed are documented along with a related
action plan for control implementation.

Environmental Risk Assessment and Uncertainties
ERA is comprised of:
1. Human health risk assessment the characterization of the probability of potentially adverse
health effects from human exposures to environmental hazards.
2. Ecological risk assessment - a process that estimates the likelihood of undesirable ecological
effects occurring as a result of human activities.

Systematic approach to risk assessment
ERA should be conducted when it is determined that a management action may have
consequences to either humans or the environment

1. Human Health Risk Assessment
It involves:
hazard identification
Hazard identification involves gathering and evaluating toxicity data on the types of
health injury or disease that may be produced by a chemical and the conditions of exposure
under which injury of disease is produced.
Dose-response assessment
The dose-response assessment involves describing the quantitative relationship between
the amount of exposure to a chemical and the extent of toxic injury or disease.
Exposure assessment
Exposure assessment involves describing the nature and size of various populations
exposed to a chemical agent, and the magnitude and duration of their exposures. Without
exposure there can be no toxicity.
Steps in exposure assessment
Characterization of exposure setting
-what are the situations which could lead to exposure?
-what would lead to high exposure, medium exposure and low exposure?
-describe the situations for the various exposure scenarios
-who are the people/animals exposed?
Identification of exposure pathways
-Source
-Route of exposure
-ingestion
-inhalation
-dermal absorption
-Exposure point
-concentrations

2. Ecological Risk Assessment
Hazards:
-chemicals toxic to humans, animals and plants
-materials that are highly flammable or explosive
-mechanical equipment, the failure of which would endanger persons and property
-structural failure (e. g. dam or containment vessel)
-natural disasters that exacerbate technological hazards
-ecosystem damage (e.g. eutrophication, soil erosion)

Uncertainties:
-lack of understanding of important cause-and-effect relationships, lack of scientific theory
-models that do not correspond to reality
-weaknesses in available data
-data gaps
-toxicological data that are extrapolated
-natural variations in the environmental parameters
-necessary assumptions on which estimates are based, and the sensitivity of the resulting
estimates to changes in the assumptions

Purposes in performing ERA
- to learn about the risks
- to reduce the risks