MONITORING AND

CONTROLLING RISK
 The last process of risk
management.
The action phase of risk
management.
MONITORING AND CONTROLLING RISK

Monitoring risk events is like making

periodic checks of the risk

Control refers to the actual actions we

take to handle the risk event
CONTROL RISK

• Focuses special attention on crisis management

• Steps that need to be taken when dealing with
worstcase situations that can harm people’s health
and lives or can seriously threaten the well-being
of the organization.
MONITORING RISK
 MONITORING RISK
is an information-gathering effort, carried out during the normal
course of business with a view to determining whether any risk events
have surfaced

it is a preventive maintenance activity

Ex:
Car owners change the oil in their automobiles every three thousand
miles. If Car owners is sensitive to potential problems, the level of risk
reduced through their monitoring efforts.
 STATUS REPORTS
 The most commonly used mechanism to assess progress on projects and
operations
 A common feature of status reports is that they focus on variances from the
plan.
 Example, a review of cost and schedule status for a project may indicate
that it is 10 percent over budget and 12 percent behind schedule.
An important question is:Will these variances continue to grow, or are
there steps we can take to bring the project back on track?
Some of these may be related inexperienced workers are used on
tasks, or needed materials arrive late, or related to excessively
optimistic plans
EVALUATIONS
Checks that are conducted to see whether the fundamental
objectives of an undertaking are being achieved

Examples
Preliminary design reviews, critical design reviews,
audits, management by- objectives (MBO) reviews,
and performance appraisal reviews.
EVALUATIONS

Evaluators are looking for trouble not for the

purpose of punishing employees but for the
purpose of identifying problems when they are
still small and manageable.
RISK AUDIT

To implement good risk management practices

• systematic attempts to examine an organization’s
projects, processes, and risk management procedures to
determine whether things are progressing smoothly or
whether problems happen
• Implement at IBM, Hewlett Packard
• Preventing the organization from failure
THREE CONDITIONS NEED TO BE MET FOR RISK
MONITORING

1. The monitoring effort must be focused

on the right sources of information
• If you want to anticipate the arrival of a
rainstorm, you should monitor atmospheric
pressure on a barometer rather than check the
temperature in your living room.
THREE CONDITIONS NEED TO BE MET FOR RISK
MONITORING
2. The information must be timely
• Even the best information is not useful if it arrives too
late.
• Example : the cable warning Washington of an
impending attack by the Japanese on Pearl Harbor.
By the time the cable had been processed and gone
through channels, the attack had already occurred
and U.S. entry into World War II had begun.
THREE CONDITIONS NEED TO BE MET FOR RISK
MONITORING
3. The people reviewing the information
must be able to make sense out of it
• People who monitor risk come across heaps of data
but have trouble separating signal from noise.
• If they don’t know what they are looking for, they
cannot see patterns in the data that reveal
potential threats.
CONTROLLING RISK
RISK CONTROL

Called risk handling

The steps that are taken to get risk events under control once
they arise.
If a newly released product fails to sell in the marketplace, a
control action might be to implement a backup marketing plan.
If a project experiences severe schedule slippage, a control
action might be to trim back on its scope
 RISK CONTROL

To control the risk, you implement the riskhandling

actions you identified during the risk response
planning:

• You draw funds from your contingency reserve accounts (risk avoidance),
• You now fix the problems that you anticipated would arise (risk mitigation)
• Contact your insurance company to be compensated for the damage you
experience (risk transfer)
RISK CONTROL ISSUE: THE NEED FOR FLEXIBILITY
When an anticipated risk event translates into a real incident, there is a
good chance that it will not follow the script defined during risk planning
exercises. This means that the people responding to the risk event need to be
flexible.

When they see that things are not playing out as planned, they
should be able to improvise. It is important to note that the
improvisation must be rooted in knowledge, experience, and
good judgment, because poorly conceived improvisation can
create more problems than it solves.
RISK CONTROL ISSUE: THE NEED FOR FLEXIBILITY
Knowledge means that the people handling the risk event have a
thorough understanding of what they are working with

Ex: a person who is an expert on using a particular database is more

qualified to deal with problems affecting the database than an amateur
who has no knowledge of its workings. The amateur will be slower in
dealing with the problems than the expert. Furthermore, the amateur
is likely to make mistakes and add to the problems rather than alleviate
them.
RISK CONTROL ISSUE: THE NEED FOR FLEXIBILITY
Experience means that the people handling the risk event
have dealt with similar circumstances previously

Ex: Experienced people are less likely to panic

when they encounter adverse situations. Also,
their experience
may provide them with significant insights into
how to handle particular problems.
RISK CONTROL ISSUE: THE NEED FOR FLEXIBILITY
Good judgment means that the people handling the risk event operate
logically and ethically and employ good sense

Ex: there once was an occasion when large numbers of Melbourne

school children were engaged in field trips in the bush when
a prairie fire arose. The standard school safety rules required the
school bus drivers to return to home base in the event of an emergency.
But in view of the fact that the fire raged between the school
buses and home base, the school bus drivers wisely decided to ignore
standard procedure.
END OF THE CHAPTER -THANK YOU