Introduction
▪ Risk management refers to the co-ordinated activities taken by
an enterprise to direct and control activities pertaining to risk.
▪ Risk management is an active process, not simply a form of
elaborate
...
Introduction
▪ Risk management refers to the co-ordinated activities taken by
an enterprise to direct and control activities pertaining to risk.
▪ Risk management is an active process, not simply a form of
elaborate observation.
o ‘Control’, when used as a verb in the context of risk
management, is often used as a synonym for ‘measure’.
o However, the results of measurement must be used as the
basis for directing actions and activities.
▪ Comprehensive risk management includes four steps:
1. Identification
2. Assessment
3. Mitigation (response)
4. Ongoing monitoring and reporting
Introduction
▪ The core objective of every enterprise is value creation.
o In for-profit enterprises, ‘value’ is linked to profit, but nonprofit
and public enterprises also seek to create value.
▪ Risk is commonly defined as the combination of the probability of
an event and its consequence.
o Consequences may be positive or negative.
o When the consequence of an event is positive, risk refers to a
missed opportunity to add value.
o When the consequence is negative, risk refers to the loss of
value (as opposed to its preservation).
▪ Being able to manage risk—and thereby to both seize
opportunities to grow value and avoid scenarios that destroy
value—directly benefits the core objective.
Information technology (IT) risk always exists in every enterprise,
whether it is recognised or not.
▪ An enterprise that lacks a formalised approach to risk
management may successfully identify some risk before it results
in missed opportunities for lost value, but:
o The key drivers of controlling risk in such circumstances are
individual experience and luck.
o Warning signs may be missed by less experienced staff.
o Employee turnover has an unpredictable effect on risk
management within the enterprise.
▪ With a formalised approach, risk management grows
progressively more effective over time through institutional
knowledge and distributed experience.
[Show More]