The Journey from Risk Assessment to Risk Management

“If you don’t invest in risk management, it doesn’t matter what business you’re in, it’s a risky business,” says Gary Cohn, the Vice Chairman of IBM.

However, the problem often is not just about investing in risk management, but not investing enough – both in terms of building processes and systems, and putting together the right team. The best risk teams are multi-disciplinary — bringing together stakeholders from various functions including operations, finance, production, quality and safety, supply chain and customer-facing departments.

The risk management team must bring in the right mindset towards tackling risk with both proactive and preventive frameworks.

Leaders and decision-makers set objectives and key results (OKRs), establish processes, and plan out operations to meet customer, financial and operational targets. The final outcome, though, may not match expectations. There are several risks companies face that can affect anything from product quality and employee well-being to workplace safety and day-to-day operations.

To overcome the consequences of the materialization of risk, businesses must implement controls that can mitigate or reduce the impact. The key is to drive agility into risk control measures being undertaken.

However, to do that, the first step is awareness. If the risk management team can clearly and exhaustively document all possible risks, then appropriate control measures can be planned. Risks can be caused by a variety of factors, including:

• Uncertain political and economic environment
• Threats due to project failures at the different phases from R&D, design, to development, production, and life cycle maintenance
• Legal issues
• Credit risk
• Natural or man-made disasters
• Security risks
• Risk from competition
• Quality and safety related risks
• Compliance risk
• Risks from third-parties such as suppliers, partners, and vendors

Standards such as ISO 31000 provide guidance to enable understanding the different risks and how to manage them efficiently. Risk assessment can be undertaken for the following reasons:

• When a new process or activity is being introduced
• When a process or activity is being changed
• When a certain type of risk is identified already
• When a customer or supplier pinpoints a possible risk

Risk Identification and Controls

To be able to effectively manage risks, the business needs to first assess the risks it faces and evaluate its risk appetite. In other words, it can fix a threshold up to which it can face a risk without dire consequences.

The assessment involves the following 3-steps:

• Identify the Risk: Find, list, and characterize risks based on their impact on the business environment using a Business Impact Analysis (BIA). Determine how it can affect normal operations and potential non-standard events such as the need for maintenance, shutdown, outages, emergencies, etc. Study which aspect of the business it will affect and the impact it will have on quality and safety. Define the risk appetite thresholds. To ensure that all risks are identified, set up processes to do the following:
  • Examine all functional areas, both routine and non-routine activities
  • Assess the skill levels of the workers and their proficiency in performing the assigned tasks
  • Predict future trends
  • Review the different phases of the lifecycle
• Risk Analysis: Having identified the risks, their impact needs to be assessed using a defined risk assessment methodology. It should include a qualitative and/or quantitative scoring model to score two parts of the risk:
  • the probability of its occurring
  • the potential impact

The scoring should be simple, the range spanning high, medium, and low, and tabulated against the above two aspects. It should also capture whether the risk is within the tolerance level of the organization’s risk appetite or outside it. The analysis should be based on current and historical data, stakeholder interests, theoretical analysis, and informed opinion. It should also include risk estimation.

• Risk Evaluation: The third step is categorizing the risks based on the score. This helps establish the significance of the risk based on the possibility of the risk becoming a reality and the impact on the business if it does.

From Risk Assessment to Risk Management

Often, businesses stop with the first three steps, which come under Risk Assessment. This is an important step as it provides an overview of the risks the company faces, the potential impact it can have, and the severity of the impact.

However, that in itself is insufficient in being able to manage the risk, which needs one more step – Risk Control or Treatment. A risk that has been identified and ranked based on the scoring model needs to be addressed with control measures to eliminate or reduce the impact. If a risk cannot be avoided, there needs to be a clear plan of action for dealing with that risk.

This aspect completes the Risk Management process and it must become a core part of any company’s business process and systems.

Some of the actions the company can take to manage risks include:

• Identify and implement controls that could be physical, environmental, technical, or administrative
• Transfer the risk, such as outsourcing some activities to a partner
• Accept the risk, which may be less expensive than mitigating it
• Avoid the risks by stopping the activity

Once a risk has been identified, the regulatory requirements and guidelines related to the risk should be referred and mitigative measures implemented. The effectiveness of the controls should be reviewed and its performance monitored. The details of how the risk was assessed, the evaluations performed, and the controls implemented should be documented and recorded.

Businesses wishing to move from Risk Assessment to Risk Management must ensure the fourth step of risk actioning is planned, streamlined and automated. It requires a concerted approach of integrated risk into key business processes like quality, safety and compliance. If risk management is done in a silo, by a separate team, it’s usually not as effective.

ComplianceQuest for Proactive and Data-driven Risk Management

The cloud-based risk management solution from ComplianceQuest helps businesses journey from risk assessment to risk management. It provides a clear, consolidated view of your organization’s risk through identification, evaluation, mitigation, and continuous monitoring.

The CQ Risk Management Software offers unique AI and analytics capabilities to spot potential risks based on history and trending data along with key metrics. With embedded intelligence, quality and risk management leaders can proactively start their risk mitigation efforts before they become a major challenge.

A centralized risk repository facilitates strategic decision-making regarding potential threats while aligning with the latest standards. By leveraging this repository, organizations can expedite risk assessments, identify and analyze emerging trends, and drive risk mitigation activities. The solution acts as a comprehensive tool to enhance risk management processes, enabling proactive measures to address and mitigate risks across various aspects of the business.

To identify the right approaches for process efficiency, improved risk management, and internal controls leverage the CQ risk framework. To know more, request a demo here: https://www.compliancequest.com/online-demo/