RISK MANAGEMENT

IDENTIFYING, ASSESSING AND ESTIMATING RISK

METHODS OF IDENTIFYING RISKS

▪ aims to determine an organization’s exposure to uncertainty

▪ requires knowledge of the organization’s objectives, its product/services,
markets and the legal, political, economic, social and technological
environment in which it operates.
▪ Has to be methodical:
▪ Ensure that all significant activities within the organization have been
identified
▪ Ensure that all risks flowing from those activities are defined
▪ May employ top down (management knows best) or bottom up (operatives
knows best) approach
METHODS OF IDENTIFYING RISKS

Questionnaires Interviews and

Brainstorming Workshops
and surveys focus-groups

Stakeholder Industry Scenario

checklists
consultations benchmarking analysis

Business
Incident Auditing and
process
investigations investigation
analysis
METHODS OF IDENTIFYING RISKS:
RISK DESCRIPTION
▪ More than just describing the risk identified.
▪ It includes a description of who is affected, the
likely impact, appetite for such kinds of risk,
possible treatment, among others.
▪ Example of a risk description is presented on the
next slide.
METHODS OF IDENTIFYING RISKS:
RISK DESCRIPTION
RISK ESTIMATION

▪ concerned with estimating the likelihood of an event’s

occurrence and the possible consequences, on the basis
of the risk description
▪ can be quantitative, semi-quantitative or qualitative
METHODS OF RISK ESTIMATION

Information Gathering Business Continuity Probability or Statistical Computer Simulations

Soft Systems Analysis
(market survey, RDE) Planning Analysis (e.g. Monte Carlo)

Failure Mode and Effect Human Reliability

Decision Trees Root Cause Analysis Event Tree Analysis
Analysis Analysis

SWOT Analysis or
PESTLE (political,
Cost-Benefit Analysis
Sensitivity Analysis Real Option Analysis Delphi Method economic, social,
technological, legal and
environmental) Analysis

HAZOP (Hazard and

Operability Studies)
RISK ESTIMATION:
THE LIKELIHOOD OR CONSEQUENCES MATRIX

▪ More commonly called risk mapping.

A risk matrix is a graph on which risk
categories can be plotted in terms of
their LIKELIHOOD and IMPACT. The
diagonal line indicates the risk
appetite, above the line are the
significant risks facing the
organization which needs some form
of treatment.

Also, some organization use a 3x3

method of mapping. However, there
are also some who use 5x5 or 7x7.
RISK ESTIMATION:
THE LIKELIHOOD OR CONSEQUENCES MATRIX
This is just an example of
how managers measure
risks. Hence, you have the
freedom to come up with
your own.