Risk Management is "the systematic application of management policies, procedures, and practices to the tasks of establishing the context, identifying, analyzing, assessing, treating, monitoring and communicating". Risk management is an essential for all businesses irrespective of their size, location, and nature.
According to Wikipedia,
" Risk management is the identification, assessment, and prioritization of risks followed by coordinated and economical application of resources to minimize, monitor, and control the probability and/or impact of unfortunate events or to maximize the realization of opportunities. Risk management's objective is to assure uncertainty does not deflect the endeavor from the business goals. "
Five Steps of Risk Management Process
1. Establish the Context
It is essential to recognize the circumstances in which a risk arises before it can be clearly assessed and mitigated. Firstly, defining the relationship between your organization and the environment in which the risk exists, this helps in identifying the boundaries to which risk is limited. For instance in the strategic context, consider the environment within which the organization operates or in the organizational context, consider the objectives, competencies, employees and goals.
2. Identify the risks
The motivation behind this step is to identify the risks an organization might face and gauge the consequence of their occurrence. List down unfavorable events that might occur while working through different stages or activities during the course of execution. Then make a list of all possible scenarios under which the risk event would occur. Draw an estimate to know the probability of occurrence of such events. Finally, gauge the impact of the consequences.
Risks may be categorized into legal, physical, financial, or ethical.
Legal risks constitute liabilities to other stakeholders in the business including shareholders, clients, suppliers, staff, or any other concerned party, revoked by a certain event, not in line with federal, state or local government laws.
Physical risks involve injuries, physical assets of the organization such as real estate, plant, vehicles, inventory, lands etc.
Financial risks involve financial assets of the organization including loans, fees receivable, attendances, other fees, insurance costs, lease payments, damage claims and penalties or fines.
Ethical risks involve real or possible damage to the repute or principles of your organization.
3. Analyse the Risks
This step involves evaluating the probability of occurrence and resulting impact of each identified risk factor and shortlisting over the risks that possibly have the highest impact and should be therefore managed first. The priority of the risk can be evaluated by combining effects of likelihood (probability) and impact of consequences.
The probability of occurrence or likelihood can be based on the 5 scale framework: 1-Rare, 2-Unlikely, 3-Possible, 4-Likely, 5-Almost certain. Similarly, the impact of consequences can be scaled on: 1-Negligible, 2-Minor, 3-Moderate, 4-Major, 5-Catastrophic. Greater the combined score of the parameters, higher the risk factor should be prioritized for mitigation.
If the risk is small or acceptable, they can be continued with minor adjustments/ treatments. However, they should be continually monitored going forward. If the risk is big, it should be mitigated at priority before executing the original plan.
4. Treat the Risks
Following listed are the standard risk treatment options. These options provide different solutions for different levels of risks which were identified in the previous steps:
Accepting the risk - for instance participating in a sporting event has an inherent risk of witnessing minor injuries.
Avoiding the risk is the decision of either proceeding in the planned direction or opt for an alternate route which has less risk and is in line with the final objective. For example, an NGO aiming to raise funds may decide that rather holding a sporting event, a cultural event is a safer way of raising funds.
Reducing the risk occurrence probability or impact of its consequences or both can be considered while facing a risk, for instance, utilization of complete safety kit for players in a particular sporting event.
Transferring the risk is another option, mostly done through buying insurances. Nowadays, even re-insurance is even getting popular, which can further be treated as a backup of a backup. Other ways include lease agreements, waivers, disclaimers, tickets, and warning signs.
Retaining the risk can be another strategy where one knows that it is an inherent part of the event. For instance, consider a sports betting club, if the risk is not the part of their game, the business would not work. The inherited risk brings in the participant and underlying motivation basis of betting business.
Financing the risk means allocating financial allowances to absorb the consequences of the risk in case it happens. This is a scenario where risk impact is manageable and is not as big as to cause bankruptcy or the like situations for any organization.
5. Monitor and Review
Monitoring and review is a continuing measure of risk management and is essential throughout the process. This step ensures that all the analysis in the risk management process is documented, utilized and followed up.
There are risks that do not change and are static in nature. However, other dynamic risks if not continually monitored and reviewed may grow like a bubble and their financial, legal and ethical impacts soon get out of control.
