Risk management is a subject that is very much invoke in our modern world. At the heart of risk management is the macro of risk assessment. For us to understand risk assessment process, we need to have a working definition of risk. Risk is defined by ISO 31000 as effect of uncertainty on objectives. The effect can be positive, upside, or downside negative. We have a broad definition. This broad definition enables us to look at risk from a broad perspective. Risk constitutes opportunities, possibilities of gain or downside risks, negatives, which suggest losses.
For us to get to the real purpose of risk assessment, we must understand that organizations of all types face risks. These risks can affect the achievement of their objectives. Objectives may range from the organizations activities at the strategic level, so strategic initiatives, its operations, its processes, as well as its projects.
Risks are reflected in society on terms environmental, technological, safety and security, commercial, financial, economic measures, as well as social, culture, political and reputational related risks.
How do we classify risks?
We generally speak about reputational risks, risk to stakeholders, health safety environmental risks, financial risks, technological risks, risk related to asset integrity, commercial risks, security risks, legal risks and of course natural and manmade events, a wide range indeed.
How do we get our hands around these risks, how do we grasp with them and get an understanding of risks?
Well, ate the heart of the risk management process is a sub-process called risk assessment. Risk assessment consists of identification of risks, analyzing of risks, evaluation of risks and then determining what method to use in treating risks. All of this takes place within a context, and it’s important to establish the context to communicate and consult internally as well as externally, and of course monitoring and reviewing is essential. Let us consider the process of risk assessment. In identifying risks, we need to consider what can go wrong, so what can happen and why. This is identifying the risks. What are the consequences? What is the probability of future occurrence? Are the factors in place, which can mitigate the existing risks? This is looking at the risk assessment process from a broad perspective.
How should identification aspects be considered?
The identification aspects require that we pinpoint the hazard, the event; in terms of the event we consider the occurrence as well as the non-occurrence; natural or manmade disaster, upsides and downsides possibilities. For example, in food safety we know that there are three basic hazards, physical, chemical and microbiological; we need to consider all of these. Then, there is a quality risk; we consider factors that could decrease customer satisfaction. And we need to look at health, safety and environment, another broad area. So, we consider here risks of injury to people, or negative impacts on the environment.
How do you define risk analysis?
What is this? We here determine: likelihood and consequences of the risk. Here we need to consider confidence levels, where these are practical. We need to separate minor risks from major, and risk analysis provide data that feel right into the next stage which is risk evaluation. Here we consider the needs for treatment; we decide whether the risk can be tolerated, is it in keeping with the risk tolerance of the organization or entity. We decide whether the activity should be undertaken. We look at priorities for treatment, what are we gonna tackle first. Then, we compare the level of risks found in the analysis, with previously established criteria.
So, these are the basic segments, the fundamentals of risk assessment. First identification, then analysis, followed by risk evaluation, and then we consider options for treatment. Risk management, the key to success in the modern world and the heart of risk management is the process of risk assessment. Consider well as you engage in this process.