0
Upcoming SlideShare
×

# Risk Mgmt V1 0c

548

Published on

Summary of the principal issues of risk management

0 Likes
Statistics
Notes
• Full Name
Comment goes here.

Are you sure you want to Yes No
Your message goes here
• Be the first to comment

• Be the first to like this

Views
Total Views
548
On Slideshare
0
From Embeds
0
Number of Embeds
2
Actions
Shares
0
65
0
Likes
0
Embeds 0
No embeds

No notes for slide

### Transcript of "Risk Mgmt V1 0c"

1. 1. Risk management A management perspective mercredi 28 avril 2010
2. 2. Plan What is risk ? Risk Governance Risk management Risk and culture Risk taxonomy Risk Metrics Wrap-up mercredi 28 avril 2010
3. 3. Introduction What is risk ? mercredi 28 avril 2010
4. 4. A deﬁnition of risk Pb(event) x impact mercredi 28 avril 2010
5. 5. Risk has two meanings In English, Risk is an umbrella term, with two varieties: opportunity which is a risk with positive effects threat which is a risk with negative effects Hillson(2001) mercredi 28 avril 2010
6. 6. Risk is not uncertainty Risk refers to situations where the decision-maker can assign mathematical probabilities to the randomness which he is faced with. Uncertainty refers to situations when this randomness "cannot" be expressed in terms of speciﬁc mathematical probabilities. Knight, Frank H. (1921) mercredi 28 avril 2010
7. 7. Risk and uncertainty The terms risk and uncertainty have become interchangeable, and one can often be found in the description of the other. Risk and uncertainty will be deﬁned and used accordingly as separate issues of the same complex phenomena, that of hazard management. Beck(1986) mercredi 28 avril 2010
8. 8. Risk is formal Risk can be considered as a systematic way of dealing with hazards. If it is assumed that there is uncertainty associated with any prediction of a hazard occurring, then there is only uncertainty because there is only ever a prediction of the likely occurrence. Beck(1986) mercredi 28 avril 2010
9. 9. Uncertainty is not risk By uncertain knowledge, (...) I do not mean merely to distinguish what is known for certain from what is only probable. uncertainty is present when there is no scientiﬁc basis on which to form any calculable probability whatever. We simply do not know. Keynes(1937) mercredi 28 avril 2010
10. 10. Risk and probability The very assignment of numerical probabilities - even if subjective - implies that it represents choice under "risk" These probabilities are merely expressions of what is ultimately amorphous belief and thus may seem more like "uncertainty". Savage(1954) mercredi 28 avril 2010
11. 11. Risk is about outcomes Risk is the probability that an event will occur. In epidemiology, it is most often used to express the probability that a particular outcome will occur following a particular exposure. Last JM, (2001) mercredi 28 avril 2010
12. 12. What is the problem ? Risk is an old concept, classically measured as a product of outcome, usually negative, and a measure of uncertainty, such as probability, balancing bad, but unlikely, outcomes with less bad but more frequent ones. The problems arise in deﬁning what one means by an outcome and how one assesses the probabilities. Hudson(2003) mercredi 28 avril 2010
13. 13. Risk Management Risk Utility management RISK 0 time mercredi 28 avril 2010
14. 14. A more complete deﬁnition R! (E,A,!) " mercredi 28 avril 2010
15. 15. E : element at risk Element (asset, process, system, etc.) or group of elements that have an expected utility (u) for a given period of time (Δt) in a ﬁnite space (s) A : Hazard (real, foreseeable or perceived) Event or sequence of events resulting from the exploitation of a vulnerability (ψ) of an element at risk (E) which can cause a dammage (δ) which results in a reduction of the expected utility (u) for a given period of time (Δt) in a ﬁnite space (s) ψ : vulnerability Fragility (relative) of an element at risk (E) to a hazard (A) mercredi 28 avril 2010
16. 16. θ : resilience Capacity of an element at risk (E) to overcome a hazard (A) by minimizing damages (δ) or by using adversity as a catalyst for improvement. It is linked to organisational maturity δ: damage (real, foreseen or perceived) Reduction of the expected utility (u) of an element at risk (E) by a hazard (A) t : time s: space mercredi 28 avril 2010
17. 17. The risk triangle Da ma ity ge bil or ra Risk lne im Vu (E,t,s) pa ct Ha z a rd or t hre at mercredi 28 avril 2010
18. 18. Risk governance A management perspective mercredi 28 avril 2010
19. 19. Ecosystemic view • A system formed by an ecological community and its environment that functions as a unit. • The interconnectedness of organisms (plants, animals, microbes) with each other and their environment. http:// www.neok12.com/ php/watch.php? mercredi 28 avril 2010
20. 20. Governance structure Executive Corporate directors supports Strategic Governance comitee directs Tactical Management comitee manages Operational Professionals mercredi 28 avril 2010
21. 21. mercredi 28 avril 2010
22. 22. Role of the Board of directors Management Stockholders Employees Board of directors Other Lenders Suppliers stakeholders mercredi 28 avril 2010
23. 23. Roles and responsibilities Mission statement and values Sets culture and normative framework Arbitrage Exercises authority mercredi 28 avril 2010
24. 24. Subsidiarity Responsability for actions must be alloted to the smallest possible entity that can resolve it Decision making as close as possible to the end-user or customer Act locally: responsabilize the actors Empower local competencies and decentralize mercredi 28 avril 2010
25. 25. Risk governance Basic ethical principles mercredi 28 avril 2010
26. 26. Due diligence Organisations need to demonstrate that they are being diligent They need to be able to demonstrate that they have in place formal processes to ensure that risks are known and managed mercredi 28 avril 2010
27. 27. Precaution When there is the possibility, event if unlikely, that hazards may cause grave or irreversible dammages, the absence of absolute scientiﬁc certitude can not become a pretext to avoid taking actions to prevent the degredation of the situation Contrary to rational theory, precausion justiﬁes taking decisions in cases of incomplete information to avoid irreversable damages. It justiﬁes non optimal solutions that may satisfy all parties (minimum regrets) mercredi 28 avril 2010
28. 28. Continuous improvement Deming’s wheell approach Recurrence feedback loops Evolution of solutions aligned with the availability of ressources mercredi 28 avril 2010
29. 29. Evaluation Must determine, a priori: Objectives Follow-up parameters Control and corrective action plans A space for all stakeholders to review information Finality: Create mecanisms that allow the conversion of data into usefull planning information mercredi 28 avril 2010
30. 30. Risk Management Formal processes mercredi 28 avril 2010
31. 31. IPMa process Identify risks IPMa Prioritize Mobiize ressources Audit mercredi 28 avril 2010
32. 32. Qualitative or Quantitative ? In the absence of solid historical data, all data is subjective. Sources of historical data: Past events, hazards and incidents in the organization Data from similar organizations Regulatory bodies Gartner group, IDC, Forester Research and litterature Standards (ITU, ISO, IEEE) mercredi 28 avril 2010
33. 33. Scenario based risk mgmt Using scenarios is the most ‘human sensitive’ approach to risk management it’s simpler to get people to tell you a story What if ... Then ... This would result in ... But, we could do ... to prevent it or to reduce it’s impacts. mercredi 28 avril 2010
34. 34. Incidents are central Using past incidents is a key to risk management Quantitative data ﬁnds it’s source in historical data It is a chance to improve individuals has to feel that they can, and must, report incidents Management has to support this A risk registry, or journal, serves this purpose mercredi 28 avril 2010
35. 35. IPM process Identify Hazards Vulnerabilities Damages Prioritize Mobilize ressources mercredi 28 avril 2010
36. 36. Cognitive processes The cognitive operations of individual decision makers involved on decisions about risk are (in order) : Identify the scenarios to consider Predict the consequences for each scenario and estimate their likelyhood Identify the variables susceptible to inﬂuence utility and ajust them to account for the context Evaluate the probabilities to assign to contexts that have been retained Apply a decisional strategy mercredi 28 avril 2010
37. 37. L i Transfer Avoid k risk risk e li h o Accept Mitigate o risk risk d D a m a g e s mercredi 28 avril 2010
38. 38. L i Transfer risk Avoid k risk e li h Accept risk Mitigate o risk o d Tolerate risks D a m a g e s mercredi 28 avril 2010
39. 39. Biaises that may affect decision makers Errors in reasoning Cognitive dissonances Heuristics Cultural variations Limitis of vigilance mercredi 28 avril 2010
40. 40. Methodologies Several are available All have their limitations Choice of variables Scientiﬁcity Validity (internal and external) Must consider maturity mercredi 28 avril 2010
41. 41. Risk Management Framework An integrated risk framework allows organisation to integrate all the organisational, regulatory and scientiﬁc requirements in a cyclical approach (continuous improvement). Should include: Business processes Standard Operating Procedures A governance model Risk awareness, education & training programs Workﬂow management tool (software) mercredi 28 avril 2010
42. 42. Change management Implementing a RMF is a Change management problem ﬁve (5) stages of change Denial Resistance Decompensation Resignation Integration mercredi 28 avril 2010
43. 43. How to facilitate change ? Education, training Setting normative factors Rationalization Consensus Other (dictatorship, coersion,esoteric) mercredi 28 avril 2010
44. 44. Risk and culture Risk, culture, perception and subjectivity mercredi 28 avril 2010
45. 45. Risk, culture and perception According to one cultural theory, people choose what to fear as a way to defend their way of life. The theory hypothesizes that adherents of a hierarchical culture will approve of technology, provided it is certiﬁed as safe by their experts. Competitive individualists will view risk as opportunity and, hence, be optimistic about technology. And egalitarians will view technology as part of the apparatus by which corporate capitalism maintains inequalities that harm society and the natural environment. Widavsky (2002) mercredi 28 avril 2010
46. 46. Difﬁculty to assess risk Risk is not always easy to assess, since the probability of occurrence and the consequence of occurrence are usually not directly measurable parameters and must be estimated by statistical or other procedures. Risk constitutes a lack of knowledge of future events. Typically, future events (or outcomes) that are favorable are called opportunities, whereas unfavorable events are called risks. Another element of risk is its cause. Kerzner, H. (2003) mercredi 28 avril 2010
47. 47. Risk tolerance Risk tolerance looks at acceptable/unacceptable deviations from what is expected. In ﬁnancial investments, The extent to wish an investor is willing to accept more risk in exchange for the possibility of a higher return. mercredi 28 avril 2010
48. 48. Risk appetite Where do we feel we should allocate our limited time and resources to minimise risk exposures? What level of risk exposure requires immediate action? What level of risk requires a formal response strategy to mitigate the potentially material impact? What events have occurred in the past, and at what level were they managed? mercredi 28 avril 2010
49. 49. Predictable outcomes Many activities undertaken by organizations do not have predictable outcomes One can’t predict the return from a new project, for example. Occurrence of these types of events can only be described in terms of a range of possible outcomes and the likelihood or probability of each outcome. The lack of predictability of outcomes is referred to as risk. The concept of risk does not imply all possible outcomes are adverse, only that the precise probabilities of the outcomes are unknown. Lewis(2003) mercredi 28 avril 2010
50. 50. Distribution of outcomes According to classical decision theory, risk is generally understood to be the distribution of possible outcomes, their likelihood, and their subjective values. In project management, this deﬁnition can be applied to time, cost, performance, and many other inﬂuential factors in any project that impact these three concerns. March and Shapira (1987) in Kwak(2005) mercredi 28 avril 2010
51. 51. Reference points The reference points that people use to evaluate risky prospects affect risk-taking. In this respect, risk tolerance is a subjective notion in the absence of clear and uniform communication and tools for risk analysis. Kahneman and Taversky (1979) and Taversky and Kahneman (1992) in Kwak(2005) mercredi 28 avril 2010
52. 52. Risk taxonomy Categories of organisational risks mercredi 28 avril 2010
53. 53. Risk categories There is an inﬁnite number of categories of risk Depends on : organisational culture legislation many other factors mercredi 28 avril 2010
54. 54. Risk Taxonomy mercredi 28 avril 2010
55. 55. What is needed ? For each incident identiﬁed, information needs to be collected about : direct monetary losses caused by the incident Annualized (or aligned on budgetary strategy) indirect losses (reputation damage or lost business) with an estimate of the monetary losses resulting from these indirect losses. Blakley, B., McDermott, E., Geer, D.(2001) mercredi 28 avril 2010
56. 56. Risk register Dates: As the register is a living document, it is important to record the date that risks are identiﬁed or modiﬁed. Optional dates to include are the target and completion dates. Description of the Risk: A phrase that describes the risk. Project Management Institute Body of Knowledge (PMBOK) mercredi 28 avril 2010
57. 57. Risk register Risk type (business, project, stage): Classiﬁcation of the risk, business risks relate to delivery of achieved beneﬁts, project risks relate to the management of the project such as timeframes and resources, stage risks are risks associated with a speciﬁc stage plan. Likelihood of Occurrence: Provides an assessment on how likely it is that this risk will occur. Examples of classiﬁcations are: L-Low (<30%), M-Medium (31-70%), H-High (>70%). Project Management Institute Body of Knowledge (PMBOK) mercredi 28 avril 2010
58. 58. Risk register Severity of effect: Provides an assessment of the impact that the occurrence of this risk would have on the project. Counter Measures: Action to be taken to prevent, reduce or transfer the risk. This may include production of contingency plans. Owner: Individual responsible for the ensuring this risk is appropriately managed and counter measures are undertaken. Project Management Institute Body of Knowledge (PMBOK) mercredi 28 avril 2010
59. 59. Risk register Status: Indicates whether this is a current risk or if risk can no longer arise and impact the project. Example classiﬁcations are: C-current or E-ended. Other columns such as quantitative value can also be added if appropriate. Project Management Institute Body of Knowledge (PMBOK) mercredi 28 avril 2010
60. 60. Risk metrics A management perspective mercredi 28 avril 2010
61. 61. The use of metrics From the governanced based risk management perspective: Risk assessment Continuous improvement Evaluation mercredi 28 avril 2010
62. 62. Identifying variables Metrics are about measurement Attributing values to variables Values depend on measurement scales There are rules on how to use measurement scales nominal, ordinal, interval, proportional mercredi 28 avril 2010
63. 63. Example of measurement scales mercredi 28 avril 2010
64. 64. Scientiﬁcity and reliability Scientiﬁc data must meet certain criterias trust, repeatable, verifyable We must be able to justify the choices we make in data and in manipulation (formulas) mercredi 28 avril 2010
65. 65. marcandre@leger.ca http://www.leger.ca Montreal, Quebec, Canada:+1(514)824-6302 Philadelphia, PA, USA:+1(215)543-6352 Paris, France: +33.(0)9.77.19.63.02 LinkedIn: http://www.linkedin.com/in/itriskmgr Blog: http://crhoma.org/blogue mercredi 28 avril 2010
1. #### A particular slide catching your eye?

Clipping is a handy way to collect important slides you want to go back to later.