Question

WEEK 1 DISCUSSION #2

ANSWER THE QUESTION BELOW:

1: Describe how an organization you've worked for or observed handles risk. Do they use a formal risk management process or tool? Or is it more ad-hoc, where risks are handled differently on a case-by-case basis?

Answer 1

In general, risk management starts as a three stage systematic process for an organisation (or individual) to handle uncertainty:

1. identification of the most important risks including estimating both how likely each is and how big its impact could be if it happened. While it’s nice to be able to quantify risk often that’s not realistically possible - so a subjective or semi-quantitative labelling is fine. The point of this stage is to identify risks that need further attention. (Risks with low impact and low probability can usually be ignored or at least given less attention).

2. decision on whether the risk should be avoided, accepted, transferred or mitigated. (If you’re not sure what these concepts mean when applied to risk there’s a lot of help available out there).

3. evaluation and execution of appropriate actions.

There may be some iteration between the second and third - for example as an individual you may first decide to transfer the risk of paying for repairs or replacement when your household appliance breaks down to an insurance company but after discovering the hefty insurance premium you would have to pay change your mind and accept the risk instead.

Often a business in its ‘appropriate actions’ will focus on one aspect of risk and wholly or largely ignore others - and that may be fit for purpose if it’s related to its primary value generation activity. Very complex processes can be developed for some departments looking at only one category of risk - e.g. insurance or investment/trading portfolios.

For general management processes will often be much simpler as they have to span risks across very different categories.