Risk and Risk Management
There is so much that is risky in operating a business, shouldn't there be ways to manage the risk? Read the Wikipedia entry on risk management to get an overview of how businesses can manage risk.
As applied to financial accounting, risk management is the technique for measuring, monitoring and controlling the financial or operational risk on a firm's balance sheet, a traditional measure is the value at risk (VaR), but there also other measures like profit at risk (PaR) or margin at risk. The Basel II framework breaks risks into market risk (price risk), credit risk and operational risk and also specifies methods for calculating capital requirements for each of these components.
Information Technology, risk management includes "Incident Handling",
an action plan for dealing with intrusions, cyber-theft, denial of
service, fire, floods, and other security-related events. According to
the SANS Institute, it is a six step process: Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned.
Contractual Risk Management
The concept of "contractual risk management" emphasises the use of risk management techniques in contract deployment, i.e. managing the risks which are accepted through entry into a contract. Norwegian academic Petri Keskitalo defines "contractual risk management" as "a practical, proactive and systematical contracting method that uses contract planning and governance to manage risks connected to business activities". In an article by Samuel Greengard published in 2010, two US legal cases are mentioned which emphasise the importance of having a strategy for dealing with risk:
- UDC v. CH2M Hill, which deals with the risk to a professional advisor who signs an indemnification provision including acceptance of a duty to defend, who may thereby pick up the legal costs of defending a client subject to a claim from a third party,
- Witt v. La Gorce Country Club, which deals with the effectiveness of a limitation of liability clause, which may, in certain jurisdictions, be found to be ineffective.
Greengard recommends using industry-standard contract language as much as possible to reduce risk as much as possible and rely on clauses which have been in use and subject to established court interpretation over a number of years.
Memory institutions (museums, libraries and archives)
In enterprise risk management, a risk is defined as a possible event or circumstance that can have negative influences on the enterprise in question. Its impact can be on the very existence, the resources (human and capital), the products and services, or the customers of the enterprise, as well as external impacts on society, markets, or the environment. In a financial institution, enterprise risk management is normally thought of as the combination of credit risk, interest rate risk or asset liability management, liquidity risk, market risk, and operational risk.
In the more general case, every probable risk can have a pre-formulated plan to deal with its possible consequences (to ensure contingency if the risk becomes a liability).
From the information above and the average cost per employee over time, or cost accrual ratio, a project manager can estimate:
- the cost associated with the risk if it arises, estimated by multiplying employee costs per unit time by the estimated time lost (cost impact, C where C = cost accrual ratio * S)
- the probable increase in time associated with a risk (schedule variance due to risk, Rs where Rs = P * S):
- Sorting on this value puts the highest risks to the schedule first. This is intended to cause the greatest risks to the project to be attempted first so that risk is minimized as quickly as possible.
- This is slightly misleading as schedule variances with a large P and small S and vice versa are not equivalent. (The risk of the RMS Titanic sinking vs. the passengers' meals being served at slightly the wrong time).
- the probable increase in cost associated with a risk (cost variance due to risk, Rc where Rc = P*C = P*CAR*S = P*S*CAR)
- sorting on this value puts the highest risks to the budget first.
- see concerns about schedule variance as this is a function of it, as illustrated in the equation above.
Risk in a project or process can be due either to Special Cause Variation or Common Cause Variation and requires appropriate treatment. That is to re-iterate the concern about extremal cases not being equivalent in the list immediately above.
ESRM is a security program management approach that links security activities to an enterprise's mission and business goals through risk management methods. The security leader's role in ESRM is to manage risks of harm to enterprise assets in partnership with the business leaders whose assets are exposed to those risks. ESRM involves educating business leaders on the realistic impacts of identified risks, presenting potential strategies to mitigate those impacts, then enacting the option chosen by the business in line with accepted levels of business risk tolerance
For medical devices, risk management is a process for identifying, evaluating and mitigating risks associated with harm to people and damage to property or the environment. Risk management is an integral part of medical device design and development, production processes and evaluation of field experience, and is applicable to all types of medical devices. The evidence of its application is required by most regulatory bodies such as the US FDA. The management of risks for medical devices is described by the International Organization for Standardization (ISO) in ISO 14971:2019, Medical Devices – The application of risk management to medical devices, a product safety standard. The standard provides a process framework and associated requirements for management responsibilities, risk analysis and evaluation, risk controls and lifecycle risk management. Guidance on the application of the standard is available via ISO/TR 24971:2020.
The European version of the risk management standard was updated in 2009 and again in 2012 to refer to the Medical Devices Directive (MDD) and Active Implantable Medical Device Directive (AIMDD) revision in 2007, as well as the In Vitro Medical Device Directive (IVDD). The requirements of EN 14971:2012 are nearly identical to ISO 14971:2007. The differences include three "(informative)" Z Annexes that refer to the new MDD, AIMDD, and IVDD. These annexes indicate content deviations that include the requirement for risks to be reduced as far as possible, and the requirement that risks be mitigated by design and not by labeling on the medical device (i.e., labeling can no longer be used to mitigate risk).
Typical risk analysis and evaluation techniques adopted by the medical device industry include hazard analysis, fault tree analysis (FTA), failure mode and effects analysis (FMEA), hazard and operability study (HAZOP), and risk traceability analysis for ensuring risk controls are implemented and effective (i.e. tracking risks identified to product requirements, design specifications, verification and validation results etc.). FTA analysis requires diagramming software. FMEA analysis can be done using a spreadsheet program. There are also integrated medical device risk management solutions.
Through a draft guidance,
the FDA has introduced another method named "Safety Assurance Case" for
medical device safety assurance analysis. The safety assurance case is
structured argument reasoning about systems appropriate for scientists
and engineers, supported by a body of evidence, that provides a
compelling, comprehensible and valid case that a system is safe for a
given application in a given environment. With the guidance, a safety
assurance case is expected for safety critical devices (e.g. infusion
devices) as part of the pre-market clearance submission, e.g. 510(k). In
2013, the FDA introduced another draft guidance expecting medical
device manufacturers to submit cybersecurity risk analysis information.
Project risk management must be considered at the different phases of acquisition. In the beginning of a project, the advancement of technical developments, or threats presented by a competitor's projects, may cause a risk or threat assessment and subsequent evaluation of alternatives. Once a decision is made, and the project begun, more familiar project management applications can be used:
- Planning how risk will be managed in the particular project. Plans should include risk management tasks, responsibilities, activities and budget.
- Assigning a risk officer – a team member other than a project manager who is responsible for foreseeing potential project problems. Typical characteristic of risk officer is a healthy skepticism.
- Maintaining live project risk database. Each risk should have the following attributes: opening date, title, short description, probability and importance. Optionally a risk may have an assigned person responsible for its resolution and a date by which the risk must be resolved.
- Creating anonymous risk reporting channel. Each team member should have the possibility to report risks that he/she foresees in the project.
- Preparing mitigation plans for risks that are chosen to be mitigated. The purpose of the mitigation plan is to describe how this particular risk will be handled – what, when, by whom and how will it be done to avoid it or minimize consequences if it becomes a liability.
- Summarizing planned and faced risks, effectiveness of mitigation activities, and effort spent for the risk management.
Megaprojects (sometimes also called "major programs") are large-scale investment projects, typically costing more than $1 billion per project. Megaprojects include major bridges, tunnels, highways, railways, airports, seaports, power plants, dams, wastewater projects, coastal flood protection schemes, oil and natural gas extraction projects, public buildings, information technology systems, aerospace projects, and defense systems. Megaprojects have been shown to be particularly risky in terms of finance, safety, and social and environmental impacts. Risk management is therefore particularly pertinent for megaprojects and special methods and special education have been developed for such risk management.
It is important to assess risk in regard to natural disasters like floods, earthquakes, and so on. Outcomes of natural disaster risk assessment are valuable when considering future repair costs, business interruption losses and other downtime, effects on the environment, insurance costs, and the proposed costs of reducing the risk. The Sendai Framework for Disaster Risk Reduction is a 2015 international accord that has set goals and targets for disaster risk reduction in response to natural disasters. There are regular International Disaster and Risk Conferences in Davos to deal with integral risk management.
Several tools can be used to assess risk and risk management of
natural disasters and other climate events, including geospatial
modeling, a key component of land change science.
This modeling requires an understanding of geographic distributions of
people as well as an ability to calculate the likelihood of a natural
The management of risks to persons and property in wilderness and remote natural areas has developed with increases in outdoor recreation participation and decreased social tolerance for loss. Organizations providing commercial wilderness experiences can now align with national and international consensus standards for training and equipment such as ANSI/NASBLA 101-2017 (boating), UIAA 152 (ice climbing tools), and European Norm 13089:2015 + A1:2015 (mountaineering equipment). The Association for Experiential Education offers accreditation for wilderness adventure programs. The Wilderness Risk Management Conference provides access to best practices, and specialist organizations provide wilderness risk management consulting and training.
In his book, Outdoor Leadership and Education, climber, outdoor educator, and author Ari Schneider, notes that outdoor recreation is inherently risky, and there is no way to completely eliminate risk. However, he explains how that can be a good thing for outdoor education programs. According to Schneider, optimal adventure is achieved when real risk is managed and perceived risk is maintained in order to keep actual danger low and a sense of adventure high.
The text Outdoor Safety - Risk Management for Outdoor Leaders, published by the New Zealand Mountain Safety Council, provides a view of wilderness risk management from the New Zealand perspective, recognizing the value of national outdoor safety legislation and devoting considerable attention to the roles of judgment and decision-making processes in wilderness risk management.
One popular models for risk assessment is the Risk Assessment and
Safety Management (RASM) Model developed by Rick Curtis, author of The
Backpacker's Field Manual.
The formula for the RASM Model is: Risk = Probability of Accident ×
Severity of Consequences. The RASM Model weighs negative risk – the
potential for loss, against positive risk – the potential for growth.
IT risk is a risk related to information technology. This is a relatively new term due to an increasing awareness that information security is simply one facet of a multitude of risks that are relevant to IT and the real world processes it supports. "Cybersecurity is tied closely to the advancement of technology. It lags only long enough for incentives like black markets to evolve and new exploits to be discovered. There is no end in sight for the advancement of technology, so we can expect the same from cybersecurity".
ISACA's Risk IT framework ties IT risk to enterprise risk management.
Duty of Care Risk Analysis (DoCRA) evaluates risks and their safeguards and considers the interests of all parties potentially affected by those risks.
Petroleum and Natural Gas
For the offshore oil and gas industry, operational risk management is regulated by the safety case
regime in many countries. Hazard identification and risk assessment
tools and techniques are described in the international standard ISO
17776:2000, and organisations such as the IADC (International Association of Drilling Contractors) publish guidelines for Health, Safety and Environment
(HSE) Case development which are based on the ISO standard. Further,
diagrammatic representations of hazardous events are often expected by
governmental regulators as part of risk management in safety case
submissions; these are known as bow-tie diagrams (see Network theory in risk assessment). The technique is also used by organisations and regulators in mining, aviation, health, defence, industrial and finance.
The principles and tools for quality risk management are increasingly being applied to different aspects of pharmaceutical quality systems. These aspects include development, manufacturing, distribution, inspection, and submission/review processes throughout the lifecycle of drug substances, drug products, biological and biotechnological products (including the use of raw materials, solvents, excipients, packaging and labeling materials in drug products, biological and biotechnological products). Risk management is also applied to the assessment of microbiological contamination in relation to pharmaceutical products and cleanroom manufacturing environments.