Risk Mgmt V1 0c


Published on

Summary of the principal issues of risk management

  • Be the first to comment

  • Be the first to like this

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide

Risk Mgmt V1 0c

  1. 1. Risk management A management perspective mercredi 28 avril 2010
  2. 2. Plan What is risk ? Risk Governance Risk management Risk and culture Risk taxonomy Risk Metrics Wrap-up mercredi 28 avril 2010
  3. 3. Introduction What is risk ? mercredi 28 avril 2010
  4. 4. A definition of risk Pb(event) x impact mercredi 28 avril 2010
  5. 5. Risk has two meanings In English, Risk is an umbrella term, with two varieties: opportunity which is a risk with positive effects threat which is a risk with negative effects Hillson(2001) mercredi 28 avril 2010
  6. 6. Risk is not uncertainty Risk refers to situations where the decision-maker can assign mathematical probabilities to the randomness which he is faced with. Uncertainty refers to situations when this randomness "cannot" be expressed in terms of specific mathematical probabilities. Knight, Frank H. (1921) mercredi 28 avril 2010
  7. 7. Risk and uncertainty The terms risk and uncertainty have become interchangeable, and one can often be found in the description of the other. Risk and uncertainty will be defined and used accordingly as separate issues of the same complex phenomena, that of hazard management. Beck(1986) mercredi 28 avril 2010
  8. 8. Risk is formal Risk can be considered as a systematic way of dealing with hazards. If it is assumed that there is uncertainty associated with any prediction of a hazard occurring, then there is only uncertainty because there is only ever a prediction of the likely occurrence. Beck(1986) mercredi 28 avril 2010
  9. 9. Uncertainty is not risk By uncertain knowledge, (...) I do not mean merely to distinguish what is known for certain from what is only probable. uncertainty is present when there is no scientific basis on which to form any calculable probability whatever. We simply do not know. Keynes(1937) mercredi 28 avril 2010
  10. 10. Risk and probability The very assignment of numerical probabilities - even if subjective - implies that it represents choice under "risk" These probabilities are merely expressions of what is ultimately amorphous belief and thus may seem more like "uncertainty". Savage(1954) mercredi 28 avril 2010
  11. 11. Risk is about outcomes Risk is the probability that an event will occur. In epidemiology, it is most often used to express the probability that a particular outcome will occur following a particular exposure. Last JM, (2001) mercredi 28 avril 2010
  12. 12. What is the problem ? Risk is an old concept, classically measured as a product of outcome, usually negative, and a measure of uncertainty, such as probability, balancing bad, but unlikely, outcomes with less bad but more frequent ones. The problems arise in defining what one means by an outcome and how one assesses the probabilities. Hudson(2003) mercredi 28 avril 2010
  13. 13. Risk Management Risk Utility management RISK 0 time mercredi 28 avril 2010
  14. 14. A more complete definition R! (E,A,!) " mercredi 28 avril 2010
  15. 15. E : element at risk Element (asset, process, system, etc.) or group of elements that have an expected utility (u) for a given period of time (Δt) in a finite space (s) A : Hazard (real, foreseeable or perceived) Event or sequence of events resulting from the exploitation of a vulnerability (ψ) of an element at risk (E) which can cause a dammage (δ) which results in a reduction of the expected utility (u) for a given period of time (Δt) in a finite space (s) ψ : vulnerability Fragility (relative) of an element at risk (E) to a hazard (A) mercredi 28 avril 2010
  16. 16. θ : resilience Capacity of an element at risk (E) to overcome a hazard (A) by minimizing damages (δ) or by using adversity as a catalyst for improvement. It is linked to organisational maturity δ: damage (real, foreseen or perceived) Reduction of the expected utility (u) of an element at risk (E) by a hazard (A) t : time s: space mercredi 28 avril 2010
  17. 17. The risk triangle Da ma ity ge bil or ra Risk lne im Vu (E,t,s) pa ct Ha z a rd or t hre at mercredi 28 avril 2010
  18. 18. Risk governance A management perspective mercredi 28 avril 2010
  19. 19. Ecosystemic view • A system formed by an ecological community and its environment that functions as a unit. • The interconnectedness of organisms (plants, animals, microbes) with each other and their environment. http:// www.neok12.com/ php/watch.php? mercredi 28 avril 2010
  20. 20. Governance structure Executive Corporate directors supports Strategic Governance comitee directs Tactical Management comitee manages Operational Professionals mercredi 28 avril 2010
  21. 21. mercredi 28 avril 2010
  22. 22. Role of the Board of directors Management Stockholders Employees Board of directors Other Lenders Suppliers stakeholders mercredi 28 avril 2010
  23. 23. Roles and responsibilities Mission statement and values Sets culture and normative framework Arbitrage Exercises authority mercredi 28 avril 2010
  24. 24. Subsidiarity Responsability for actions must be alloted to the smallest possible entity that can resolve it Decision making as close as possible to the end-user or customer Act locally: responsabilize the actors Empower local competencies and decentralize mercredi 28 avril 2010
  25. 25. Risk governance Basic ethical principles mercredi 28 avril 2010
  26. 26. Due diligence Organisations need to demonstrate that they are being diligent They need to be able to demonstrate that they have in place formal processes to ensure that risks are known and managed mercredi 28 avril 2010
  27. 27. Precaution When there is the possibility, event if unlikely, that hazards may cause grave or irreversible dammages, the absence of absolute scientific certitude can not become a pretext to avoid taking actions to prevent the degredation of the situation Contrary to rational theory, precausion justifies taking decisions in cases of incomplete information to avoid irreversable damages. It justifies non optimal solutions that may satisfy all parties (minimum regrets) mercredi 28 avril 2010
  28. 28. Continuous improvement Deming’s wheell approach Recurrence feedback loops Evolution of solutions aligned with the availability of ressources mercredi 28 avril 2010
  29. 29. Evaluation Must determine, a priori: Objectives Follow-up parameters Control and corrective action plans A space for all stakeholders to review information Finality: Create mecanisms that allow the conversion of data into usefull planning information mercredi 28 avril 2010
  30. 30. Risk Management Formal processes mercredi 28 avril 2010
  31. 31. IPMa process Identify risks IPMa Prioritize Mobiize ressources Audit mercredi 28 avril 2010
  32. 32. Qualitative or Quantitative ? In the absence of solid historical data, all data is subjective. Sources of historical data: Past events, hazards and incidents in the organization Data from similar organizations Regulatory bodies Gartner group, IDC, Forester Research and litterature Standards (ITU, ISO, IEEE) mercredi 28 avril 2010
  33. 33. Scenario based risk mgmt Using scenarios is the most ‘human sensitive’ approach to risk management it’s simpler to get people to tell you a story What if ... Then ... This would result in ... But, we could do ... to prevent it or to reduce it’s impacts. mercredi 28 avril 2010
  34. 34. Incidents are central Using past incidents is a key to risk management Quantitative data finds it’s source in historical data It is a chance to improve individuals has to feel that they can, and must, report incidents Management has to support this A risk registry, or journal, serves this purpose mercredi 28 avril 2010
  35. 35. IPM process Identify Hazards Vulnerabilities Damages Prioritize Mobilize ressources mercredi 28 avril 2010
  36. 36. Cognitive processes The cognitive operations of individual decision makers involved on decisions about risk are (in order) : Identify the scenarios to consider Predict the consequences for each scenario and estimate their likelyhood Identify the variables susceptible to influence utility and ajust them to account for the context Evaluate the probabilities to assign to contexts that have been retained Apply a decisional strategy mercredi 28 avril 2010
  37. 37. L i Transfer Avoid k risk risk e li h o Accept Mitigate o risk risk d D a m a g e s mercredi 28 avril 2010
  38. 38. L i Transfer risk Avoid k risk e li h Accept risk Mitigate o risk o d Tolerate risks D a m a g e s mercredi 28 avril 2010
  39. 39. Biaises that may affect decision makers Errors in reasoning Cognitive dissonances Heuristics Cultural variations Limitis of vigilance mercredi 28 avril 2010
  40. 40. Methodologies Several are available All have their limitations Choice of variables Scientificity Validity (internal and external) Must consider maturity mercredi 28 avril 2010
  41. 41. Risk Management Framework An integrated risk framework allows organisation to integrate all the organisational, regulatory and scientific requirements in a cyclical approach (continuous improvement). Should include: Business processes Standard Operating Procedures A governance model Risk awareness, education & training programs Workflow management tool (software) mercredi 28 avril 2010
  42. 42. Change management Implementing a RMF is a Change management problem five (5) stages of change Denial Resistance Decompensation Resignation Integration mercredi 28 avril 2010
  43. 43. How to facilitate change ? Education, training Setting normative factors Rationalization Consensus Other (dictatorship, coersion,esoteric) mercredi 28 avril 2010
  44. 44. Risk and culture Risk, culture, perception and subjectivity mercredi 28 avril 2010
  45. 45. Risk, culture and perception According to one cultural theory, people choose what to fear as a way to defend their way of life. The theory hypothesizes that adherents of a hierarchical culture will approve of technology, provided it is certified as safe by their experts. Competitive individualists will view risk as opportunity and, hence, be optimistic about technology. And egalitarians will view technology as part of the apparatus by which corporate capitalism maintains inequalities that harm society and the natural environment. Widavsky (2002) mercredi 28 avril 2010
  46. 46. Difficulty to assess risk Risk is not always easy to assess, since the probability of occurrence and the consequence of occurrence are usually not directly measurable parameters and must be estimated by statistical or other procedures. Risk constitutes a lack of knowledge of future events. Typically, future events (or outcomes) that are favorable are called opportunities, whereas unfavorable events are called risks. Another element of risk is its cause. Kerzner, H. (2003) mercredi 28 avril 2010
  47. 47. Risk tolerance Risk tolerance looks at acceptable/unacceptable deviations from what is expected. In financial investments, The extent to wish an investor is willing to accept more risk in exchange for the possibility of a higher return. mercredi 28 avril 2010
  48. 48. Risk appetite Where do we feel we should allocate our limited time and resources to minimise risk exposures? What level of risk exposure requires immediate action? What level of risk requires a formal response strategy to mitigate the potentially material impact? What events have occurred in the past, and at what level were they managed? mercredi 28 avril 2010
  49. 49. Predictable outcomes Many activities undertaken by organizations do not have predictable outcomes One can’t predict the return from a new project, for example. Occurrence of these types of events can only be described in terms of a range of possible outcomes and the likelihood or probability of each outcome. The lack of predictability of outcomes is referred to as risk. The concept of risk does not imply all possible outcomes are adverse, only that the precise probabilities of the outcomes are unknown. Lewis(2003) mercredi 28 avril 2010
  50. 50. Distribution of outcomes According to classical decision theory, risk is generally understood to be the distribution of possible outcomes, their likelihood, and their subjective values. In project management, this definition can be applied to time, cost, performance, and many other influential factors in any project that impact these three concerns. March and Shapira (1987) in Kwak(2005) mercredi 28 avril 2010
  51. 51. Reference points The reference points that people use to evaluate risky prospects affect risk-taking. In this respect, risk tolerance is a subjective notion in the absence of clear and uniform communication and tools for risk analysis. Kahneman and Taversky (1979) and Taversky and Kahneman (1992) in Kwak(2005) mercredi 28 avril 2010
  52. 52. Risk taxonomy Categories of organisational risks mercredi 28 avril 2010
  53. 53. Risk categories There is an infinite number of categories of risk Depends on : organisational culture legislation many other factors mercredi 28 avril 2010
  54. 54. Risk Taxonomy mercredi 28 avril 2010
  55. 55. What is needed ? For each incident identified, information needs to be collected about : direct monetary losses caused by the incident Annualized (or aligned on budgetary strategy) indirect losses (reputation damage or lost business) with an estimate of the monetary losses resulting from these indirect losses. Blakley, B., McDermott, E., Geer, D.(2001) mercredi 28 avril 2010
  56. 56. Risk register Dates: As the register is a living document, it is important to record the date that risks are identified or modified. Optional dates to include are the target and completion dates. Description of the Risk: A phrase that describes the risk. Project Management Institute Body of Knowledge (PMBOK) mercredi 28 avril 2010
  57. 57. Risk register Risk type (business, project, stage): Classification of the risk, business risks relate to delivery of achieved benefits, project risks relate to the management of the project such as timeframes and resources, stage risks are risks associated with a specific stage plan. Likelihood of Occurrence: Provides an assessment on how likely it is that this risk will occur. Examples of classifications are: L-Low (<30%), M-Medium (31-70%), H-High (>70%). Project Management Institute Body of Knowledge (PMBOK) mercredi 28 avril 2010
  58. 58. Risk register Severity of effect: Provides an assessment of the impact that the occurrence of this risk would have on the project. Counter Measures: Action to be taken to prevent, reduce or transfer the risk. This may include production of contingency plans. Owner: Individual responsible for the ensuring this risk is appropriately managed and counter measures are undertaken. Project Management Institute Body of Knowledge (PMBOK) mercredi 28 avril 2010
  59. 59. Risk register Status: Indicates whether this is a current risk or if risk can no longer arise and impact the project. Example classifications are: C-current or E-ended. Other columns such as quantitative value can also be added if appropriate. Project Management Institute Body of Knowledge (PMBOK) mercredi 28 avril 2010
  60. 60. Risk metrics A management perspective mercredi 28 avril 2010
  61. 61. The use of metrics From the governanced based risk management perspective: Risk assessment Continuous improvement Evaluation mercredi 28 avril 2010
  62. 62. Identifying variables Metrics are about measurement Attributing values to variables Values depend on measurement scales There are rules on how to use measurement scales nominal, ordinal, interval, proportional mercredi 28 avril 2010
  63. 63. Example of measurement scales mercredi 28 avril 2010
  64. 64. Scientificity and reliability Scientific data must meet certain criterias trust, repeatable, verifyable We must be able to justify the choices we make in data and in manipulation (formulas) mercredi 28 avril 2010
  65. 65. marcandre@leger.ca http://www.leger.ca Montreal, Quebec, Canada:+1(514)824-6302 Philadelphia, PA, USA:+1(215)543-6352 Paris, France: +33.(0) LinkedIn: http://www.linkedin.com/in/itriskmgr Blog: http://crhoma.org/blogue mercredi 28 avril 2010