MOR (Management of Risk)
MOR (Management of Risk)
Risk management Management of Risk is focused on anticipating what might not go to plan and putting in place actions to reduce uncertainty to a tolerable level. Risk can be perceived either positively (upside opportunities) or negatively (downside threats). A risk is the potential of a situation or event to impact on the achievement of specific objectives Working with the risk owner, the project professional ensures that risks are clearly identified before moving on to the risk analysis step of the risk management process. The project risk MOR process reflects the dynamic nature of project work, capturing and managing emerging risks and reflecting new knowledge in existing risk analyses. A risk register is used to document risks, analysis and responses, and to assign clear ownership of actions.
What is risk analysis?
Risk analysis and risk management is a process that allows individual risk events and overall risk to be understood and managed proactively, optimising success by minimising threats and maximising opportunities and outcomes
Risk analysis provides guidance on where the greatest vulnerabilities lie. Because risk analysis is fundamentally perception based, it is important for the project professional to engage stakeholders early to identify risks.
To make sense of differing perceptions, it is important to describe risk events clearly, separating causes (facts now), from risk events (situations that may occur), from effects (that have an impact on one or more of the project measures). This enables subsequent analysis and management of risks.
Effective risk analysis and contingency planning will see planned time and/or contingency used. Unused contingency is most likely caused by overestimation, luck, or the efficient management of risk. Insufficient contingency is most likely caused by optimistic estimation, bad luck, or inefficient management of risk.
Outputs from risk analysis help the project professionally to:
• Understand the probability of achieving outturn dates, costs or
• Inform and influence decision-making about the chances of achieving the business case and
• Agree the level of contingency to provide the required level of confidence.
Why is risk management important?
Risk management is the process of identifying, assessing, and controlling financial, legal, strategic, and security risks to an organization’s capital and earnings. These threats, or risks, could stem from a wide variety of sources, including financial uncertainty, legal liabilities, strategic management errors, accidents, and natural disasters.
If an unforeseen event catches your organization unaware, the impact could be minor, such as a small impact on your overhead costs. In a worst-case scenario, though, it could be catastrophic and have serious ramifications, such as a significant financial burden or even the closure of your business.
To reduce risk, an organization needs to apply resources to minimize, monitor, and control the impact of negative events while maximizing positive events. A consistent, systemic, and integrated approach to risk management can help determine how best to identify, manage and mitigate significant risks.
Risk response strategies and treatment
There are five commonly accepted strategies for addressing risk. The process begins with an initial consideration of risk avoidance and then proceeds to three additional avenues of addressing risk (transfer, spreading, and reduction). Ideally, these three avenues are employed in concert with one another as part of a comprehensive strategy. Some residual risks may remain.
What are the most common responses to risk?
Risk avoidance
Avoidance is a method for mitigating risk by not participating in activities that may negatively affect the organization. Not making an investment or starting a product line are examples of such activities as they avoid the risk of loss.
Risk reduction
This method of risk management attempts to minimize the loss, rather than completely eliminate it. While accepting the risk, it stays focused on keeping the loss contained and preventing it from spreading. An example of this in health insurance is preventative care.
Risk sharing
When risks are shared, the possibility of loss is transferred from the individual to the group. A corporation is a good example of risk sharing — a number of investors pool their capital and each only bears a portion of the risk that the enterprise may fail.
Transferring risk
Contractually transferring risk to a third party, such as insurance to cover possible property damage or injury shifts the risks associated with the property from the owner to the insurance company.
Risk acceptance and retention
After all risk sharing, risk transfer, and risk reduction measures have been implemented, some risks will remain since it is virtually impossible to eliminate all risks (except through risk avoidance). This is called residual risk.
Limitations and risk management standards
Risk management standards set out a specific set of strategic processes that start with the objectives of an organization and intend to identify risks and promote the mitigation of risks through best practices. Standards are often designed by agencies who are working together to promote common goals, and to help to ensure high-quality risk management processes. For example, the ISO 31 000 standard on risk management is an international standard that provides principles and guidelines for effective risk management.
While adopting a risk management standard has its advantages, it is not without challenges. The new standard might not easily fit into what you are doing already, so you could have to introduce new ways of working. And the standards might need customizing to your industry or business.
Read more