lesson 20 risk management n.
Skip this Video
Loading SlideShow in 5 Seconds..
Lesson 20-Risk Management PowerPoint Presentation
Download Presentation
Lesson 20-Risk Management

Loading in 2 Seconds...

play fullscreen
1 / 24

Lesson 20-Risk Management - PowerPoint PPT Presentation

  • Uploaded on

Lesson 20-Risk Management. Objectives. Upon completion of this lesson, the learner will be able to: Explain the purpose of risk management and describe an approach to effectively manage risk. Describe differences between qualitative and quantitative risk assessment.

I am the owner, or an agent authorized to act on behalf of the owner, of the copyrighted work described.
Download Presentation

PowerPoint Slideshow about 'Lesson 20-Risk Management' - jonah

An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.

- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript

Upon completion of this lesson, the learner will be able to:

  • Explain the purpose of risk management and describe an approach to effectively manage risk.
  • Describe differences between qualitative and quantitative risk assessment.
  • Explain, by example, how both approaches, qualitative and quantitative risk assessment, are necessary to effectively manage risk.
  • Define important terms associated with risk management.
  • Describe various tools related to risk management.
risk management an overview
Risk Management: An Overview
  • Risk management can be described as a decision-making process which avoids costly oversights and unexpected problems.
  • It as an ongoing process and is an essential element of management. It encompasses all the actions to:
    • Reduce complexity.
    • Increase objectivity.
    • Identify important decision factors.
  • Businesses need to take risks to retain their competitive edge.
  • Risk management is both a skill and a task.
  • Depending on the size of the project and the amount of risk involved, risk management can be simple or complex.
macro level example of risk management international banking
Macro-Level Example of Risk Management: International Banking
  • The Basel Committee on Banking Supervision is composed of government central-bank governors from around the world.
  • This body created a basic, global risk management framework for market and credit risk.
  • The Basel Committee implemented capital charge to banks at flat 8 percent internationally to manage bank risks.
  • However, if banks can show they have very strong risk mitigation procedures and controls in place, that capital charge can be reduced to as low as $0.37 (0.37 percent).
  • If a bank has poor procedures and controls, then capital charge can be as high as $45 (45 percent).
understanding risk management
Understanding Risk Management

Key terms:

  • Risk - the possibility of suffering a loss.
  • Risk management - the decision-making process of identifying threats and vulnerabilities and their potential impacts.
  • Risk assessment (or risk analysis) - the process of analyzing an environment to identify the threats, vulnerabilities, and mitigating actions to determine the impact of an event on a project, program, or business.
  • Asset - a resource or information required by an organization to conduct its business.
  • Threat - any circumstance or event that may cause harm to an asset.
  • Vulnerability - the characteristic of an asset that can be exploited by a threat to cause harm.
  • Impact - the loss when a threat exploits a vulnerability.
  • Control (countermeasure or safeguard) - a measure to detect, prevent, or mitigate the risk associated with a threat.
understanding risk management1
Understanding Risk Management

Key terms (continued):

  • Qualitative risk assessment - the process of subjectively determining the impact of an event that affects a project, program, or business.
  • Quantitative risk assessment - the process of objectively determining the impact of an event that affects a project, program, or business.
  • Mitigate - action taken to reduce the likelihood of a threat occurring.
  • Single loss expectancy (SLE) - the monetary loss or impact of each occurrence of a threat.
  • Exposure factor - a measure of the magnitude of loss of an asset. It is used in the calculation of single loss expectancy.
  • Annualized rate of occurrence (ARO) - the frequency with which an event is expected to occur on an annualized basis.
  • Annualized loss expectancy (ALE) - the estimate of how much an event is expected to cost per year.
risk management
Risk Management
  • Carnegie Mellon University’s Software Engineering Institute defines continuous risk management as: processes, methods, and tools for managing risks in a project. It provides a disciplined environment for proactive decision-making to:
    • Assess what could go wrong (risks).
    • Determine which risks are important.
    • Implement strategies to deal with those risks.
  • Risk is often divided into two areas:
    • Business risk
    • Technology risk
examples of business risks
Treasury management

Revenue management

Contract management


Environmental risk management

Regulatory risk management

Business continuity management


Security and privacy.

Information technology operations.

Business systems control and effectiveness.

Business continuity management.

Information systems testing.

Reliability and performance management.

Information technology asset management.

Project risk management.

Change management.

Examples of Business Risks

The most common business risks

general risk management model
General Risk Management Model
  • There are several risk management models for managing risk through its various phases.
  • The chosen models should align with the business objectives and strategies.
  • The two risk management models are: general risk management model and the Software Engineering Institute model.
  • General risk management model includes the following steps:
    • Asset identification.
    • Threat assessment.
    • Impact definition and quantification.
    • Control design and evaluation.
    • Residual risk management.
asset identification
Asset Identification
  • In this step, the assets, systems, and processes that need protection need to be identified and classified, as they are vulnerable to threats.
  • Assets include:
    • Inventory and buildings.
    • Cash.
    • Information and data.
    • Hardware and software.
    • Services, documents, and personnel.
    • Brand recognition and organization reputation.
    • Goodwill.
threat assessment
Threat Assessment
  • In this step, the possible threats and vulnerabilities associated with each asset and the likelihood of their occurrence is identified.
  • Common classes of threat include:
    • Natural disasters.
    • Man-made disasters.
    • Terrorism.
    • Errors.
    • Malicious damage or attacks.
    • Fraud.
    • Theft.
    • Equipment or software failure.
threat assessment1
Threat Assessment
  • Vulnerabilities are characteristics of resources that can be exploited by a threat to cause harm.
    • Unprotected facilities.
    • Unprotected computer systems.
    • Unprotected data.
    • Insufficient procedures and controls.
    • Insufficient or unqualified personnel.
impact definition and quantification
Impact Definition and Quantification
  • When a threat is realized, it turns risk into impact which is the loss created when a threat exploits a vulnerability.
  • Impacts can be either tangible or intangible.
  • Tangible impacts include:
    • Direct loss of money.
    • Endangerment of staff or customers.
    • Loss of business opportunity.
    • Reduction in operational efficiency or performance.
    • Interruption of a business activity.
  • Intangible impacts include:
    • Breach of legislation or regulatory requirements.
    • Loss of reputation or goodwill (brand damage).
    • Breach of confidence.
control design and evaluation
Control Design and Evaluation
  • Controls are designed to control risk by reducing vulnerabilities to an acceptable level.
  • Controls can be actions, devices, or procedures.
  • They can be:
    • Preventive controls - prevent the vulnerability from being exploited by a threat, thus causing an impact.
    • Detective controls - detect a vulnerability that has been exploited by a threat so that action can be taken.
residual risk management
Residual Risk Management
  • Any risks that remain after implementing controls are termed residual risks.
  • Residual risks can be further evaluated to identify where additional controls are required to further reduce risk.
  • Business process reengineering or organizational changes can create new risks or weaken existing control activities.
software engineering institute model
Software Engineering Institute Model
  • The Software Engineering Institute model lists the following steps for risk management:
    • Identify - look for risks before they become problems.
    • Analyze – convert the data into information that can be used to make decisions.
    • Plan - review and evaluate the risks and decide the actions to mitigate them.
    • Track - monitor the risks and the mitigation plans.
    • Control - make corrections for deviations from the risk mitigation plans.
qualitatively assessing risk
Qualitatively Assessing Risk
  • To qualitatively assess risk, the impact of the threat needs to be compared with the probability of occurrence.
  • For example, if a threat has a high impact and a high probability of occurring, the risk exposure is high.
  • Conversely, if the impact is low with a low probability, the risk exposure is low.

Risk Complexity vs Project Size

qualitatively assessing risk1
Qualitatively Assessing Risk

Three levels of analysis

qualitatively assessing risk2
Qualitatively Assessing Risk

Example of a combination assessment

quantitatively assessing risk
Quantitatively Assessing Risk
  • Quantitative risk assessment applies historical information and trends to predict future performance. It is dependent on historical data, which can be difficult to gather.
  • Quantitative risk assessment may also rely on models.
  • These models provide decision-making information in the form of quantitative metrics, which attempt to measure risk levels across a common scale.
  • Key assumptions underlie any model, and different models will produce different results even when the input data is the same.
  • Despite research in improving and refining the various risk analysis models, expertise and experience are considered essential for risk assessment.
  • Models can never replace judgment and experience, but they can enhance the decision-making process.
adding objectivity to a qualitative assessment
Adding Objectivity to a Qualitative Assessment

Adding Weights and Definitions to the Potential Impact

a common objective approach
A Common Objective Approach
  • More complex models allow analyses based on statistical and mathematical models.
  • A common method is the calculation of the annualized loss expectancy (ALE).
  • This calculation begins by calculating single-loss expectancy (SLE) with the following formula:
    • SLE = asset value * exposure factor
qualitative versus quantitative risk assessment
Qualitative versus Quantitative Risk Assessment
  • It is impossible to conduct risk management that is purely quantitative.
  • Usually risk management includes both qualitative and quantitative elements, requiring both analysis and judgment or experience.
  • It is possibleto accomplish purely qualitative risk management.
  • The decision of whether to use qualitative versus quantitative risk management depends on:
    • The criticality of the project.
    • The resources available.
    • The management style.
  • The decision will be influenced by the degree to which the fundamental risk management metrics can be quantitatively defined.
tools to enhance risk management
Tools to Enhance Risk Management

The tools that can be used during the various phases of risk assessment are:

  • Affinity grouping - A method of identifying related items and then identifying the principle that ties them together into a group.
  • Baseline identification and analysis - The process of establishing a baseline set of risks. It produces a “snapshot” of all the identified risks at a given point in time.
  • Cause and effect analysis - Identifying relationships between a risk and the factors that can cause it.
  • Cost/benefit analysis - A method for comparing cost estimates with the benefits of a mitigation strategy.
  • Gantt charts - A management tool for diagramming schedules, events, and activity duration.
  • Interrelationship digraphs - A method for identifying cause-and-effect relationships by defining the problem, identifying its key elements, and describing their relationships.
  • PERT (program evaluation and review technique) charts - A diagram depicting interdependencies between project activities, showing the sequence and duration of each activity.
  • Risk management plan - A comprehensive plan documenting how risks will be managed on a given project.