Planning the risk assessment technique (Scope, Context & Criteria)
The diagram above shows the Risk Management Process from ISO 31000:2018 Risk Management – Guidelines (Guideline). This sets out a method for managing risks. This ISO 31000:2018 Guideline is recommended for anybody interested in risk management.
The diagram below provides a very high-level positioning of the ‘Scope, Criteria & Context’ component of the Risk Management Process. This ‘Handy Hints’ covers some of the common pitfalls when planning for (and applying) the type of risk assessment technique / tools.
Pitfall 1 – Not matching the technique to the circumstances
There are many risk assessment techniques, and each has strengths and weaknesses. Selection of the most appropriate technique will depend on factors such as:
The type or types of risks to be assessed
The timing (e.g. short, medium or long term risks)
The nature of these risks (for example, High impact low likelihood risks, emerging risks)
Resources available vs. the resources required by the technique
Organisational maturity
Regulatory requirements
Whether the outputs will be quantitative, qualitative or a combination
Pitfall 2 - Skipping or rushing through the articulation of the risk assessment technique
Ensure the risk assessment technique and its limitations are described (clearly and in enough detail), communicated and understood.
For example, if the workshop risk assessment approach is to be used, decide on things such as:
Whether it will be conducted over one or more workshop
The expected time commitments
The stakeholders and their roles
The desired results (for example; a risk curve or one of more specific points such as inherent / residual / target risk levels)
Whether the aim is to produce a consensus view or not. If not, how will the differing views be handled.
The limitations could include things such as:
Underlying assumptions, exclusions or correlations
Missing, partial or unavailable input information &/or the accuracy of input information
Expected level of accuracy of the risk assessment outputs
Level of subjectivity.
It is critical that any stakeholders making decisions based on the risk assessment be aware of the limitations.
Pitfall 3 – Failing to address human factors
When selecting / designing the risk assessment approach / technique it is vital to consider a range of human factors and how to address these.
These human impacts include:
§ Risk perceptions and the types of ‘biases’ (or ‘heuristics’ / ‘judgement heuristics’), such as availability, representativeness, anchoring & adjustment, framing and motivational. Refer to [insert the Blog or handy Hints name with link] for more detail on this topic
The human ability (or inability) to make judgments on risks with a very high impact and/or very low probability (e.g. 1 in 100 years / 1 in 200 years / 1 in 500 years / 1 in 1000 years) or extremely high consequences
Group dynamics, for example:
The influence of the organisational culture
Group think
Where there is a mix including more and less senior staff
Where the risk assessment technique seeks to get a consensus view, and
The inclusion of one or more dominant personalities.
Pitfall 4 – Inadequate communication
Communication and consultation must occur during every part of the risk management process. Adequate communication provides clarity, shared understanding and reinforces consistent language.
Determine if all the each of the stakeholders / roles to be involved all need the same information or tailored information.
Before conducting the risk assessment, ensure that information on the risk assessment technique / tools is trialled on a few selected stakeholders for their feedback. Incorporate this and then communicate it to all the stakeholders that will be involved. Consider running group training sessions &/or individual training that all participants must attend.
Cover the situation where a stakeholder can’t participate in the risk assessment activities. For example, can they nominate a replacement? If so: Must the replacement first have the training and be bought up to speed, &/or; Must the replacement be able to make the final decisions the original stakeholder would have?
Inadequate communication about the risk assessment technique / tools can result in the actual risk assessment work being side tracked by questions or debates about the risk assessment technique / tools.
Once stakeholders have gained experience in the risk assessment technique / tools, only a short recap or communication on any changes may be required.
Whenever a new stakeholder is to be involved in the risk assessment, they should first be taken through the training on the risk assessment technique / tools.
COPYRIGHT NOTICE & DISCLAIMER
This document is the copyright of Primescope Technology Solutions (A'SIA) Pty Ltd – © 2020. All rights reserved.
Any redistribution or reproduction of part or all of the contents in any form is prohibited other than the following. You may print or download contents to a local hard disk for your personal and non-commercial use only. You may copy some extracts only to individual third parties for their personal use, but only if you acknowledge the website as the source of the material.
You may not, except with our express written permission, distribute or commercially exploit the content. You may not transmit it or store it on any other website or other form of electronic retrieval system.
The information contained in this website is for general information purposes only and is provided by www.primescope.com.au. While we endeavour to keep the information up to date and correct, we make no representations or warranties of any kind, express or implied, about the completeness, accuracy, reliability, suitability or availability with respect to the website or the information, products, services, or related graphics contained on the website for any purpose. Any reliance you place on such information is therefore strictly at your own risk. You need to make your own enquiries to determine if the information or products are appropriate for your intended use.
In no event will we be liable for any loss or damage including without limitation, indirect or consequential loss or damage, or any loss or damage whatsoever arising from loss of data or profits arising out of, or in connection with, the use of this website.
Through this website you may be able to link to other websites which are not under the control of www.primescope.com.au. We have no control over the nature, content and availability of those websites. The inclusion of any links does not necessarily imply a recommendation or endorse the views expressed within them.
Test Comment