RISK MANAGEMENT ASSIGNMENT NUMBER:-2

1. Why is it important to understand the internal and external contexts of an organisation with
reference to risk management?

Understand external context

The external context defines the external environment in which the organisation operates. It
also defines the relationship between the organisation and its external environment.
Understanding the external context is important to ensure that stakeholders and their
objectives are considered when developing risk management criteria and that externally
generated threats and opportunities are captured during the “risk identification” step.
Key elements of external context:
 Political, Economic, Social, Technological, Environmental and Legal , be they international,
national or regional
 Key drivers and trends having an impact on the objectives of the organisation
 Perceptions and values of external stakeholders. It is particularly important to take into
account the perceptions and values of external stakeholders and to establish policies to
communicate with these parties.

Understand internal context

An understanding of the organisation is required before commencing any risk management
activity, at any level. Understanding the internal context is important because:
• risk management takes place in the context of the goals and objectives of the organisation.
• the major risk for most organisations is that they fail to achieve their strategic, business or
project objectives or are perceived to have failed by stakeholders.
• organisational objectives, policies, and processes help define the organisation’s risk
management policy, specific objectives and criteria of a project.
For risk management systems and processes to reflect each organisation’s specific needs, the
following steps should be taken prior to conducting formal risk identification exercises.
• Identifying key stakeholders who would need to be involved in risk management
communication
• Defining risk categories to reflect the types of risk faced by the organisation
• Defining and approving risk criteria (risk rating scales) to be used when assessing and
prioritising risks.
Key elements of internal context:
 Capabilities (e.g. capital, people, competencies, processes, systems and technologies
 Information flows and decision-making processes
 Internal stakeholders
 Objectives and strategies in place to achieve them
 Perceptions, values and culture
 Policies and processes
  Standards and reference models adopted by the organisation
 Structures (e.g. governance, roles and accountabilities)

2. Risk tolerance is defined as '…an organisation’s readiness to bear the risk, after treatments in
order to achieve its objectives'. How would you establish risk tolerance for an organisation and
will define its risk tolerance levels?
The typical steps involved in establishing and implementing risk tolerance are as follows:
1. Complete an analysis of the organisation’s ability to physically and financially recover from a
significant event (e.g. risk such as human influenza pandemic, loss of major plant or facility,
inability to supply or manufacture product, loss of major business partner, credit crunch, etc).
2. The above analysis will highlight the need for and importance of contingency plans, financial,
physical and human resources, and controls. From the analysis, determine the tolerance the
organisation can bear or accept.
3. Management determines the level of tolerance that should then be endorsed by the board.

Risk tolerance levels can be defined by dividing risks into a number of bands as appropriate for
the organisation
• An upper band where adverse risks are intolerable, whatever benefits the activity may bring,
and risk reduction measures are essential whatever their cost
• Middle bands where costs and benefits are taken into account and opportunities are balanced
against potential adverse consequences
• A lower band where positive or negative risks are negligible, or the costs associated with
implementing treatment actions outweigh the costs of the impact of the risk, should it occur.

3. Culture is defined as “the way we work around here”. It is the collective way of doing things,
through accepted behaviours and processes. Why risk management culture is important for a
risk management framework? Discuss the main drivers of culture.
Drivers of culture
There are various drivers within an organisation that shape its culture. These drivers influence
how well risk management is embedded throughout the organisation.
Embedding desired risk management culture
Embedding your desired risk management culture is a journey of change. Managing change
means shifting the organisation from where it is (current state) to where it wants to be (future
state).
Assess your organisation’s current risk culture
The current risk culture is an outcome of collective behaviour driven by existing norms around
risk management. Determining your organisation’s current culture and identifying the key
drivers will be useful for identifying the appropriate interventions to achieve the desired risk
culture. The most commonly used tools for assessing current culture are interviews, focus group
discussions and surveys. When conducting the assessment, it will be useful to gain input from a
sample of participants or respondents across the different parts of the organisation, and across
different levels.
 • Determine what cultural and behavioural interventions are useful to help close the gap.
• Determine the cultural and behavioural intervention will help you close the gap between
where you currently are and where you want to be in your risk culture. The assessment provides
a useful starting point in prioritising and developing your options for culture change.

4. ABC Limited is a construction company. Why and how ABC Limited should identify its risks?
1. Understand what to consider To develop a comprehensive list of risks, a systematic process
should be used that starts with the statement of context. To demonstrate that risks have
been identified effectively, it is useful to step through the process, project or activity in a
structured way using the key elements defined while establishing the context. This can help
provide confidence that the process of risk identification is complete and major issues have
not been missed.
2. Gather information to identify risks Good-quality information is important for identifying
risks. The starting point for risk identification may be historical information about this or
similar organisations, followed by discussions with a wide range of stakeholders about
historical, current and evolving issues.
3. Apply risk identification tools and techniques Organisations apply a set of risk identification
tools and techniques that are suited to their objectives and capabilities, and to the risks they
face. Relevant and up-to-date information is important in identifying risks. This should
include suitable background information where possible. People with appropriate
knowledge should be involved in identifying risks.
4. Use relevant risk categories for comprehensiveness The risk profiles of public sector
organisations may differ from those of commercial organisations, given the difference in
organisational objectives and stakeholder groups.
5. Document the identified risks The risks identified during the risk identification are typically
documented in a risk register that, at this stage in the risk assessment process, includes: •
risk description
• how and why the risk can happen (i.e. causes and consequences)
• the existing internal controls that that may reduce the likelihood or consequences of the
risks
6. Document your risk identification process In addition to documenting the risks identified, it
is also necessary to document the risk identification to help guide future risk identification
exercises and to ensure that good practices are maintained by drawing on lessons learned
from previous exercises. Documentation of this step should include: • the approach or
method used for identifying risks • the scope covered by the identification • the participants
in the risk identification and the information sources consulted.

5. The Directors of ABC Limited identified organisations' risks in a risk identification workshop. How
would you analyse and evaluate those risks?
i) Identify and evaluate existing controls When assessing a risk, it is important to identify
what controls are in place to mitigate the risk. Many controls are built into existing
business operations and systems. Examples of controls:
 • Controlled physical access (e.g. security codes, access cards, security personnel)
• Employee code of conduct
• Media and public relations strategies/protocols
• Specified training (e.g. software, hazardous substances)
• Automated software controls (e.g. temperature control)
• Policies and procedures
• Standardised business processes
• Insurance
• Quality control management
• Budget management
• Outsourcing functions to specialists
• Formalised contracts and Service Level Agreements
• Audits (internal and external)
ii) Determine risk consequence and likelihood The magnitude of the consequences of an
event, should it occur, and the likelihood of the event and its associated consequences
should be assessed in the context of the effectiveness of the existing strategies and
controls. Consequences and likelihood may be estimated using statistical analysis and
calculations. Where no reliable or relevant past data are available, subjective estimates
may be made which reflect an individual’s or group’s degree of belief that a particular
event or outcome will occur.
iii) Determine the overall risk rating Once you have rated the likelihood and consequence,
combine the two to determine the overall risk rating. Based on the risk analysis, risks are
classified by level to determine the appropriate level of response to those risks. Specific
responses are defined in the “Treat Risks” phase.
iv) Document the risk analysis process Documentation of the risk analysis process provides
a record of how risks were analysed in previous periods, thereby informing future risk
analysis exercises. A key outcome of documenting the risk analysis process is the
enabling of accurate tracking of risks over time using historical reference data.
Documentation should include:
• key assumptions and limitations
• sources of information used
• explanation of the analysis method, and the definitions of the terms used to specify
the likelihood and consequences of each risk
• existing controls and their effectiveness
• description and severity of consequences
• the likelihood of these specific occurrences
• resulting level of risk.

6. List and explain key risk treatment options.

1. Identify risk treatment options Risk treatment design should be based on a comprehensive
understanding of how risks arise. This means understanding not only the immediate causes
 of an event but also the underlying factors that influence whether the proposed treatment
will be effective.
2. 2. Select risk treatment options Risk treatment options are not necessarily mutually
exclusive or appropriate in all circumstancesIt is recommended that consideration be given
to the cost of the treatment as compared to the likely risk reduction that will result. For
example, if the only available treatment option would cost in excess of $10M to implement
and the cost impact of the risk is only $5M, it may not be advisable. To understand the costs
and benefits associated with each risk treatment option, it is necessary to conduct a cost-
benefit analysis
3. Assign risk ownership The CEO and/or the Executive Management Committee typically
allocate responsibility for risk to an operational or functional area line manager. Risk owners
nominated by executive management should assume responsibility for developing effective
risk treatment plans. The risk owner should be a senior staff member or manager with
sufficient technical knowledge about the risk and/or risk area for which treatment is
required.
4. Prepare treatment plans Once treatment options for individual risks have been selected, all
treatment options should be consolidated into risk action plans and/or strategies. As one
risk treatment may impact on multiple risks, treatment actions for different risks need to be
combined and compared in order to identify and resolve conflicts between plans and to
reduce duplication of effort.

7. How would you communicate and report risk information to internal stakeholders?
The key steps to communication are:
• establish communication and consultation objectives
• analyse stakeholders or recipients of the message
• develop key messages and purpose
• identify communication owners and senders
• identify appropriate channels
• determine timing of communication
• deliver key messages.

8. Why is regular review of risk management process necessary?

Regular review throughout the risk management process is necessary to:
• ensure accuracy of risk information - the environment in which the organisation is operating is
constantly changing and so therefore are its risks. If risk information is inaccurate, it may cause
the organisation to make poor decisions it might otherwise have avoided.
• ensure effectiveness and adequacy of risk management processes
• continuously evolve to desired levels of risk management maturity
• learn and continuously improve, adopting better practices and developments in risk
management.