4-1, ENG - For ALL - Overview To Risk Management Process

IN NOMINE
QUALITATIS
TKSG
Overview to Risk Management Processes

Reference: ISO 31000:2018 and ISO/IEC 27005:2018
© 2018 All rights reserved. TechKnowledge Services Group [Overview_Risk_Management]

IN NOMINE
QUALITATIS
TKSG
Risk-based thinking of management system -

TWO phases of risk management
Phase 2 - Specific risk management
Phase 1 - Business risk management (4)
“within the scope” of the
management system (6)
Scope, context,
criteria
Communication and consultation

Requirements from Risk assessment
interested parties (4.2)
Monitoring and review

Risk identification
Internal and
Organization
External issues (4.1)
Risk analysis
Risk evaluation
Risk treatment
Management system
“SCOPE” (4.3)
© 2018 All rights reserved. TechKnowledge Services Group [Overview_Risk_Management] 2

IN NOMINE
QUALITATIS
TKSG
Risk-based thinking of management system -

TWO phases of risk management
Phase 2 - Specific risk management
Phase 1 - Business risk management (4)
“within the scope” of the
management system (6)
Scope, context,
criteria

Requirements from Risk assessment
interested parties (4.2)

Risk identification
Internal and
Organization
External issues (4.1)
Risk analysis
Risk evaluation
Risk treatment
Management system
“SCOPE” (4.3)

IN NOMINE
QUALITATIS
TKSG

Scope, context,
criteria

Risk assessment
• bring different areas of expertise together for each step of

Risk identification
the risk management process;
Risk analysis
• ensure that different views are appropriately considered
when defining risk criteria and when evaluating risks;
Risk evaluation
• provide sufficient information to facilitate risk oversight

and decision-making;
Risk treatment
• build a sense of inclusiveness and ownership among
those affected by risk.

IN NOMINE
QUALITATIS
TKSG
Defining the scope

Scope, context,
criteria
• When planning the approach, considerations include:

Risk assessment
• objectives and decisions that need to be made;

Risk identification
• outcomes expected from the steps to be taken in the

process; Risk analysis
• time, location, specific inclusions and exclusions;

Risk evaluation
• appropriate risk assessment tools and techniques;
Risk treatment
• resources required, responsibilities and records to be
kept;
• relationships with other projects, processes and

activities.

IN NOMINE
QUALITATIS
TKSG
External and internal context

Scope, context,
criteria

Risk assessment
• Understanding the context of the organization is

Risk identification
important, because:
Risk analysis
• risk management takes place in the context of the
objectives and activities of the organization;
Risk evaluation
• organizational factors can be a source of risk;
• the purpose and scope of the risk management Risk treatment

process may be interrelated with the objectives of the
organization as a whole.

IN NOMINE
QUALITATIS
TKSG
Defining risk criteria

Scope, context,
criteria
• To set risk criteria, the following should be considered:

Risk assessment
• the nature and type of uncertainties that can affect outcomes
and objectives (both tangible and intangible);

Risk identification
• how consequences (both positive and negative) and likelihood

will be defined and measured; Risk analysis
• time-related factors;
Risk evaluation
• consistency in the use of measurements;
• how the level of risk is to be determined; Risk treatment
• how combinations and sequences of multiple risks will be

taken into account;
• the organization’s capacity.

IN NOMINE
QUALITATIS
TKSG
Risk assessment
Scope, context,
criteria

Risk assessment

Risk identification
• Risk assessment is the overall process of risk

identification, risk analysis and risk evaluation. Risk analysis
• Risk assessment should be conducted systematically, Risk evaluation

iteratively and collaboratively, drawing on the knowledge
and views of stakeholders. It should use the best
available information, supplemented by further enquiry as
necessary. Risk treatment

IN NOMINE
QUALITATIS
TKSG
Risk identification
Scope, context,
criteria

• The following factors, and the relationship between these Risk assessment
factors, should be considered:

Risk identification
• tangible and intangible sources of risk;

Risk analysis
• causes and events;

Risk evaluation
• threats and opportunities;
Risk treatment
• vulnerabilities and capabilities;
• changes in the external and internal context;

IN NOMINE
QUALITATIS
TKSG
Risk identification
Scope, context,
criteria

Risk assessment
• indicators of emerging risks;

Risk identification
• the nature and value of assets and resources;

Risk analysis
• consequences and their impact on objectives;

Risk evaluation
• limitations of knowledge and reliability of information;
• time-related factors; Risk treatment
• biases, assumptions and beliefs of those involved.

IN NOMINE
QUALITATIS
TKSG
Risk analysis
Scope, context,
criteria
• Risk analysis should consider factors such as:

Risk assessment

Risk identification
• the likelihood of events and consequences;
• the nature and magnitude of consequences; Risk analysis
• complexity and connectivity; Risk evaluation
• time-related factors and volatility;

Risk treatment
• the effectiveness of existing controls;
• sensitivity and confidence levels.

IN NOMINE
QUALITATIS
TKSG
Risk evaluation
Scope, context,
criteria
• The purpose of risk evaluation is to support decisions. Risk
evaluation involves comparing the results of the risk

analysis with the established risk criteria to determine Risk assessment
where additional action is required.

Risk identification
• This can lead to a decision to:

Risk analysis
• do nothing further;
Risk evaluation
• consider risk treatment options;
• undertake further analysis to better understand the risk; Risk treatment
• maintain existing controls;
• reconsider objectives.

IN NOMINE
QUALITATIS
TKSG
Risk treatment
Scope, context,
criteria
• The purpose of risk treatment is to select and implement

options for addressing risk. Risk assessment

Risk identification
• Risk treatment involves an iterative process of:
Risk analysis
• formulating and selecting risk treatment options;
Risk evaluation
• planning and implementing risk treatment;
• assessing the effectiveness of that treatment;

Risk treatment
• deciding whether the remaining risk is acceptable;
• if not acceptable, taking further treatment.

IN NOMINE
QUALITATIS
TKSG
Selection of risk treatment options

Scope, context,
criteria
• Options for treating risk may involve one or more of the
following:

Risk assessment
1.Risk avoidance: avoiding the risk by deciding not to start or
continue with the activity that gives rise to the risk;

Risk identification
2.Risk acceptance:
Risk analysis
• taking or increasing the risk in order to pursue an
opportunity;
• retaining the risk by informed decision Risk evaluation
3.Risk reduction:
• removing the risk source;

Risk treatment
• changing the likelihood;
• changing the consequences;
4.Risk transfer: sharing the risk (e.g. through contracts,

buying insurance);

IN NOMINE
QUALITATIS
TKSG
Preparing and implementing risk treatment

plans
Scope, context,
criteria
• The information provided in the treatment plan should include:

• the rationale for selection of the treatment options, including the Risk assessment
expected benefits to be gained;

Risk identification
• those who are accountable and responsible for approving and

implementing the plan;
Risk analysis
• the proposed actions;
Risk evaluation
• the resources required, including contingencies;
• the performance measures;

Risk treatment
• the constraints;
• the required reporting and monitoring;
• when actions are expected to be undertaken and completed.

IN NOMINE
QUALITATIS
TKSG

Scope, context,
criteria
• The purpose of monitoring and review is to assure and

Risk assessment
improve the quality and effectiveness of process design,
implementation and outcomes. Ongoing monitoring and

Risk identification
periodic review of the risk management process and its
outcomes should be a planned part of the risk
management process, with responsibilities clearly Risk analysis
defined.
Risk evaluation
• Monitoring and review should take place in all stages of
the process. Monitoring and review includes planning,
gathering and analysing information, recording results
and providing feedback.
Risk treatment
• The results of monitoring and review should be

incorporated throughout the organization’s performance
management, measurement and reporting activities.

IN NOMINE
QUALITATIS
TKSG
Recording and reporting
• Recording and reporting aims to:
• communicate risk management activities and outcomes across the organization;
• provide information for decision-making;
• improve risk management activities;
• assist interaction with stakeholders, including those with responsibility and

accountability for risk management activities.

IN NOMINE
QUALITATIS
TKSG
END

4-1, ENG - For ALL - Overview To Risk Management Process

Uploaded by

Copyright:

Available Formats

You might also like

4-1, ENG - For ALL - Overview To Risk Management Process

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

4-1, ENG - For ALL - Overview To Risk Management Process

Uploaded by

Copyright:

Available Formats

IN NOMINE

Overview to Risk Management Processes

© 2018 All rights reserved. TechKnowledge Services Group [Overview_Risk_Management]

Risk-based thinking of management system -

Communication and consultation

Monitoring and review

© 2018 All rights reserved. TechKnowledge Services Group [Overview_Risk_Management] 2

Risk-based thinking of management system -

Communication and consultation

Monitoring and review

© 2018 All rights reserved. TechKnowledge Services Group [Overview_Risk_Management] 3

Communication and consultation

Communication and consultation

• bring different areas of expertise together for each step of

Monitoring and review

• provide sufficient information to facilitate risk oversight

© 2018 All rights reserved. TechKnowledge Services Group [Overview_Risk_Management] 4

Defining the scope

Communication and consultation

Monitoring and review

• outcomes expected from the steps to be taken in the

• time, location, specific inclusions and exclusions;

• appropriate risk assessment tools and techniques;

• relationships with other projects, processes and

© 2018 All rights reserved. TechKnowledge Services Group [Overview_Risk_Management] 5

External and internal context

Communication and consultation

• Understanding the context of the organization is

Monitoring and review

• organizational factors can be a source of risk;

• the purpose and scope of the risk management Risk treatment

© 2018 All rights reserved. TechKnowledge Services Group [Overview_Risk_Management] 6

Defining risk criteria

Communication and consultation

Monitoring and review

• how consequences (both positive and negative) and likelihood

• consistency in the use of measurements;

• how the level of risk is to be determined; Risk treatment

• how combinations and sequences of multiple risks will be

• the organization’s capacity.

© 2018 All rights reserved. TechKnowledge Services Group [Overview_Risk_Management] 7

Communication and consultation

Monitoring and review

• Risk assessment is the overall process of risk

• Risk assessment should be conducted systematically, Risk evaluation

© 2018 All rights reserved. TechKnowledge Services Group [Overview_Risk_Management] 8

Communication and consultation

Monitoring and review

• tangible and intangible sources of risk;

• causes and events;

• threats and opportunities;

• changes in the external and internal context;

© 2018 All rights reserved. TechKnowledge Services Group [Overview_Risk_Management] 9

Communication and consultation

Monitoring and review

• the nature and value of assets and resources;

• consequences and their impact on objectives;

• limitations of knowledge and reliability of information;