Managing Organisational Risk

Links between organisational risk and resilience.

We have already talked about the importance of categorising risk but we now need to know how to go about predicting risks and prioritising them.

We need to consistently prioritise, communicate, analyse and manage the risks an organisation faces.

This must be a key consideration of ours!

The following is an ideal process for organisations to deal with risk:

1. Identify the risks an organisation faces.

2. Prioritise those risks in terms of impact and occurrence

3. Determine a response to these risks

4. Monitor and control those risks

We can accept, avoid, mitigate or transfer risks to third parties. This is part of the organisational response to risks.

Let's remember that an uncertain event can be included as a risk which would cover total system failure!

A risk management template should include the following Columns, numbered from left to right:

1. Who identified the risk?

2. The date it was identified?

3. Description of the risk

4. The probability of its occurrence

5. What impact it might have

6. What is the risk priority score column - 4. multiplied by column 5.

7. Who will be responsible for responding to the risk?

8. What is the planned ridk response?

9. When are we going to respond to the risk by?

10. Additional comments on the risk.

Columns 4 and 5 could be pre specified e.g

Probability score of occurrence and impacts

High - 5 points

Significant -4 points

Medium -3 points

Low -2 points

Insignificant -1 point

These scales are illustrative and could be turned into probabilities of l or less for each risk element under discussion.

The values of volumns 4 and 5 are a matter to be determined by each organisation.

The risk priority score is the product of Columns 4 and 5 and this score can be used to allocate resources and budgets to cope with each individual risk.

This is the backbone of any real risk register to be determined by an organisational horizon scanning team.

But which risks are crucial to be included in this register?

That will be the subject of a later blog!

We need to