Risk management
Risk management

Start this free course now. Just create an account and sign in. Enrol and complete the course for a free statement of participation or digital badge if available.

Free course

Risk management

1 Basic elements of risk assessment

Risk assessment is the activity of understanding the extent to which potential events can affect the organisation’s ability to achieve its objectives.

In many situations, organisations do not have the resources to deal with all of the risks they face. By ranking them in relative order of importance, organisations can prioritise the treatment of risks. Risk assessment is the first step in prioritising risks.

Risk assessment can be both qualitative and quantitative, based on highly complex mathematical models or ‘gut feel’. Both approaches have their merits, but in its most basic form the aim is to understand what is the relative order or importance of the risks.

Described image
Figure 2 Probability and Impact Diagram (PID)

The most common approach to assess a risk uses two dimensions: impact and probability. This approach is usually displayed in a risk matrix (sometimes referred to as a Probability and Impact Diagram, or PID). It is also common practice to assign a value to each ‘cell’ in the risk matrix and this is commonly known as the risk score.

The risk impact(s) is the outcome of the consequences, which you examined in Session 3 when you looked at risk identification. For an organisation, risk impacts are often expressed in financial values, but may also be expressed in other values that are important to the organisation (e.g. health & safety, compliance, reputation). As an example, you may have identified a risk that a project may overrun with consequences that will cause late delivery and incur financial penalties. The impact would be the value of these financial penalties and a measure of the reputational impact of the late delivery.

The probability is the extent to which those impacts are likely to occur. The probability must be related to impacts otherwise the assessment is invalid; the two elements exist as one complete risk assessment.

It should be noted that other valid combinations of impact and probability may exist for the risk. To ensure correct risk assessment, organisations should set out rules defining how risks should be recorded. Some organisations use the ‘most probable’ approach, while others use ‘severe but plausible’. Whichever method is used, it must be consistent across the organisation to avoid potential confusion. Consider the simple example of the risk of fire. It may be equally valid to state that in the UK there are a large number of small fires, and therefore a ‘high’ probability of a small fire, but there are also a small number of very large fires and therefore a ‘low’ probability of a very large fire.

Some organisations may choose to look at additional measures, the most commonly used being:

  • Timing of impact – when the risk could occur.
  • Velocity (or speed of onset) – how quickly the risk could occur.
  • Vulnerability – how susceptible the organisation is to the particular impact.

It is important to set out some prerequisites before moving forward. If you consider risk management as an isolated activity then the measures used to assess risk can be tailored specifically to that activity. However, having a bespoke way to assess risks in each individual area in an organisation with two or more activities is problematic. Look at a simple example, where Risk Managers compare three risks, each assessed on a different basis.

Download this audio clip.Audio player: Audio 1 Comparing risks
Skip transcript: Audio 1 Comparing risks

Transcript: Audio 1 Comparing risks

MAN 1
I imagine a huge risk in IT right now. If it occurs the server will be out for two weeks. There is a 50/50 chance this will happen.
MAN 2
That's nothing. There is a risk in our finance centre that could cost five million pounds. But thankfully, there is only a slim chance of it happening.
WOMAN 1
But all of that isn't important. I'm managing a project for our customer that could be late by two weeks. And I think there is a 77% probability of this risk being realised.
WOMAN 2
OK, so which really is the biggest risk?
WOMAN 1
We don't know.
MAN 1
I don't know.
End transcript: Audio 1 Comparing risks
Audio 1 Comparing risks
Interactive feature not available in single page view (see it in standard view).

As shown in the example above, without a common approach to scoring, with everyone using the same scoring variables and common units of measure, it is practically impossible to undertake meaningful risk management at a company level.

As discussed in Session 2, it is therefore a prerequisite to set out, across an organisation, a set of common scoring variables and units of measure that everyone uses. Only by doing this is it possible to compare risks from one part of an organisation with risks from another part and thus maximise the return for the effort invested in risk management. You can see an example of this under the scoring scheme in the RMP you can download from Session 2 [Tip: hold Ctrl and click a link to open it in a new tab. (Hide tip)] .

RM_1

Take your learning further

Making the decision to study can be a big step, which is why you'll want a trusted University. The Open University has 50 years’ experience delivering flexible learning and 170,000 students are studying with us right now. Take a look at all Open University courses.

If you are new to University-level study, we offer two introductory routes to our qualifications. You could either choose to start with an Access module, or a module which allows you to count your previous learning towards an Open University qualification. Read our guide on Where to take your learning next for more information.

Not ready for formal University study? Then browse over 1000 free courses on OpenLearn and sign up to our newsletter to hear about new free courses as they are released.

Every year, thousands of students decide to study with The Open University. With over 120 qualifications, we’ve got the right course for you.

Request an Open University prospectus371