This document defines key concepts in risk management including risk, risk analysis, risk assessment, risk communication, and risk management. It explains that risk management involves identifying potential risks, assessing their likelihood and impact, selecting techniques to address them such as tolerating, treating, transferring or terminating risks, then implementing and continually improving the risk management process using a plan-do-check-act framework. Common risk management strategies are outlined along with limitations of the approach.

1. RiskRisk
ManagementManagement
Yogesh ShahYogesh Shah

2. Learning ObjectivesLearning Objectives
• Risk
• Risk Analysis
• Risk Management

3. RiskRisk
• Risk is a concept that denotes a potential
negative impact to an asset or some
characteristic of value that may arise from
some present process or future event.
• In everyday usage, "risk" is often used
synonymously with the probability of a known
loss. Paradoxically, a probable loss can be
uncertain and relative in an individual event
while having a certainty in the aggregate of
multiple events

4. Risk Analysis can refer to:
• Risk analysis (engineering)
• Risk analysis (Business)
 ‘Risk analysis’ is employed in its broadest
sense to include:
 Risk Assessment
 Risk management
 Risk communication
Risk Analysis = Risk Assessment + Risk
Management + Risk Communication.

5. Risk Assessment
• Involves identifying sources of potential harm, assessing the
likelihood that harm will occur and the consequences if harm does
occur.
• Risk assessment is a step in the risk management process. Risk
assessment is measuring two quantities of the risk R, the
magnitude of the potential loss L, and the probability p that the
loss will occur.
Risk communication
• Involves an interactive dialogue between stakeholders and risk
assessors and risk managers which actively informs the other
processes.
Risk management
• Evaluates which risks identified in the risk assessment process
require management and selects and implements the plans or
actions that are required to ensure that those risks are controlled.

6. Risk Management
• Risk management is the human activity, which integrates recognition
of risk, risk assessment, developing strategies to manage it, and
mitigation of risk using managerial resources.
Objective of risk management
• To reduce different risks related to a pre-selected domain to the level
accepted by society.
Strategies
• Transferring the risk to another party
• Avoiding the risk,
• Reducing the negative effect of the risk
• Accepting some or all of the consequences of a particular risk.
• Some traditional risk managements are focused on risks stemming
from physical or legal causes (e.g. natural disasters or fires,
accidents, death and lawsuits). Financial risk management, on the
other hand, focuses on risks that can be managed using traded
financial instruments.

7. Major Causes of Risk
• By environment/Natural
• Technology
• Humans

8. General Approch to Handle Risk
• In ideal risk management, a prioritization process is followed whereby
the risks with the greatest loss and the greatest probability of occurring
are handled first, and risks with lower probability of occurrence and
lower loss are handled in descending order. In practice the process can
be very difficult, and balancing between risks with a high probability of
occurrence but lower loss versus a risk with high loss but lower
probability of occurrence can often be mishandled.
• Intangible risk management identifies a new type of risk - a risk that has
a 100% probability of occurring but is ignored by the organization due to
a lack of identification ability. For example, when deficient knowledge is
applied to a situation, a knowledge risk materialises. Relationship risk
appears when ineffective collaboration occurs. Process-engagement
risk may be an issue when ineffective operational procedures are
applied. These risks directly reduce the productivity of knowledge
workers, decrease cost effectiveness, profitability, service, quality,
reputation, brand value, and earnings quality. Intangible risk
management allows risk management to create immediate value from
the identification and reduction of risks that reduce productivity.

9. • Identification of risk in a selected domain of interest
• Risks will be evaluated, constraints.
• Developing an analysis of risks involved in the
process.
• Mitigation of risks using available technological,
human and organizational resources.
The PDCA Steps to establish effective RiskThe PDCA Steps to establish effective Risk
Management ProcessManagement Process
1. Plan:1. Plan:

10. Identification
• Source analysis :
Risk sources may be internal or external to the
system that is the target of risk management.
Examples of risk sources are: stakeholders of a
project, employees of a company or the weather over
an airport.
• Problem analysis:
Risks are related to identified threats. For example:
the threat of losing money, the threat of abuse of
privacy information or the threat of accidents and
casualties. The threats may exist with various
entities, most important with shareholders,
customers and legislative bodies such as the
government.

11. Assessment
• Once risks have been identified, they must then
be assessed as to their potential severity of loss
and to the probability of occurrence. These
quantities can be either simple to measure, in
the case of the value of a lost building, or
impossible to know for sure in the case of the
probability of an unlikely event occurring.
Therefore, in the assessment process it is
critical to make the best educated guesses
possible in order to properly prioritize the
implementation of the risk management plan.
Risk = Rate of occurrence X impact of the eventRisk = Rate of occurrence X impact of the event

12. Once risks have been identified and assessed, all
techniques to manage the risk fall into one or more
of these four major categories: (Dorfman, 1997)
(remember as 4 T's)
• Tolerate (retention)
• Treat (mitigation)
• Terminate (elimination)
• Transfer (buying insurance)
Potential Risk Treatments/TechniquesPotential Risk Treatments/Techniques

13. • Follow all of the planned methods for
mitigating the effect of the risks.
Purchase insurance policies for the risks
that have been decided to be transferred
to an insurer, avoid all risks that can be
avoided without sacrificing the entity's
goals, reduce others, and retain the rest.
2. Do:2. Do:
Implement a Test of the Chosen RiskImplement a Test of the Chosen Risk
Mangement TechniqueMangement Technique

14. • To evaluate whether the previously
selected techniques are still applicable
and effective, and
• To evaluate the possible risk level
changes in the business environment.
3. Check:3. Check:
Assess the effectiveness of theAssess the effectiveness of the technique,technique,
and make necessary adjustments or selectand make necessary adjustments or select
alternative.alternative.

15. 4. Act:4. Act:
Implement the full processImplement the full process
5.5. ImproveImprove::
Improve the Implemented Techniques,Improve the Implemented Techniques, ReturnReturn toto
Plan Step.Plan Step.

16. • If risks are improperly assessed and prioritized, time can be
wasted in dealing with risk of losses that are not likely to occur.
Spending too much time assessing and managing unlikely risks
can divert resources that could be used more profitably. Unlikely
events do occur but if the risk is unlikely enough to occur it may
be better to simply retain the risk and deal with the result if the
loss does in fact occur.
• Prioritizing too highly the risk management processes could
keep an organization from ever completing a project or even
getting started. This is especially true if other work is suspended
until the risk management process is considered complete.
• It is also important to keep in mind the distinction between risk
and uncertainty. Risk can be measured by impacts x probability. .
LimitationsLimitations

17. • Crockford, Neil (1986). An Introduction to Risk Management (2nd
ed.). Woodhead-Faulkner. 0-85941-332-2.
• http://en.wikipedia.org/wiki/Risk_management
ReferenceReference