Everyone knows how important it is to manage risks. However, most of us do not know where to start the process. If you already do not have a risk management process set up in your business, you could follow the steps below to conduct a simple risk assessment of your business.
While this article will not cover how to set up an ERM system in your organization, but it will help in coming up with a simple risk register for your business, which will prove to be an invaluable asset in managing your business risks.
If you would like assistance from our expert team of risk professionals certified by The Institute of Risk Management, feel free to drop us a line and we will have you covered.
1. Understand your business
2. Conduct what-if scenarios to help identify risk events
Opportunity risks can be identified by looking at the goals of your business and the events that could have an impact on the achievement of those goals. These risk events can be originating from internal or external sources. An example of this will be identifying a risk event that can hinder your goal of opening an outlet at a new location. Identifying risk events based on your goals is a good method to use since it will be the number one priority for any business to achieve the goals they set for themselves.
However, in order for this method to be effective, it is very important that you have written down goals for your business, both for the long and the short term.
Following is an example of a risk assessment for the goal ‘open a new outlet in a new location by the end of the year’. The example is shown in the form of a risk register.
Risk classification systems enable the organization to classify risk. Classifying risk according to categories such as compliance (mandatory) risks, hazard (pure) risks, control (uncertainty) risks and opportunity (speculative) risks help organizations to understand how to deal with the risk. In general terms, organizations will seek to minimize compliance risks, mitigate hazard risks, manage control risks and embrace opportunity risks.
3. Assessing the identified risk events based on probability and impact
For risks that will have a financial or a commercial impact, the benchmark test is likely to be based on monetary value and for risks that could disrupt the infrastructure of the organization, a benchmark test can be based on the impact, cost and duration of disruption.
The next step of the risk assessment process involves assessing the identified risks based on likelihood and impact. It is common for risk practitioners to assess risks based on the current or residual level rather than the inherent level.
Risk likelihood indicates how often a risk is expected to materialize. For hazard risks, previous history can be a good indication of how likely the risk is to occur. The impact is the estimate of the harm that could be caused by the event.
This can be shown in a risk matrix which is a simple way of demonstrating the level of risk that a particular event represents to an organization. Shown below is an example of a risk matrix with impact on the horizontal axis and likelihood on the vertical axis. A risk matrix is often used to demonstrate the current level of risk after controls are applied.
