《风险管理流程ppt课件.ppt》由会员分享，可在线阅读，更多相关《风险管理流程ppt课件.ppt（41页珍藏版）》请在三一办公上搜索。
1、1,The Risk Management Process,Prepared By: Rusul M. KanonaSupervised By: Dr. Loa i A.TawalbehArab Academy for Banking & Financial Sciences (AABFS)Fall 2007,2,What is the Risk Management process?,The Risk Management Process consists of a series of steps that, when undertaken in sequence, enable conti
2、nual improvement in decision-making.,3,Steps of the Risk Management Process? Step 1. Communicate and consult.Step 2. Establish the context.Step 3. Identify the risks.Step 4. Analyze the risks.Step 5. Evaluate the risks.Step 6. Treat the risks.Step 7. Monitor and review.,4,5,Step 1.Communicate and co
3、nsult,-Communication and consultation aims to identify who should be involved in assessment of risk (including identification,analysis and evaluation) and it should engage those who will be involved in the treatment, monitoring and review of risk.,6,-As such, communication and consultation will be r
4、eflected in each step of the process described here.-As an initial step, there are two main aspects that should be identified in order to establish the requirements for the remainder of the process. -These are communication and consultation aimed at:A- Eliciting risk informationB-Managing stakeholde
5、r perceptions for management of risk.,7,A- Eliciting risk information-Communication and consultation may occur within the organization or between the organization and its stakeholders.-It is very rare that only one person will hold all the information needed to identify the risks to a business or ev
6、en to an activity or project. -It therefore important to identify the range of stakeholders who will assist in making this information complete.,8,B-Managing stakeholder perceptions for management of risk,9,Tips for effective communication and consultation, Determine at the outset whether a communic
7、ation strategy and/or plan is required Determine the best method or media for communication and consultation The significance or complexity of the issue or activity in question can be used as a guide as to how much communication and consultation is required: the more complex and significant to the o
8、rganization, the more detailed and comprehensive the requirement.,10,Step 2. Establish the context,provides a five-step process to assist with establishing the context within which risk will be identified. 1-Establish the internal context 2-Establish the external context 3-Establish the risk managem
9、ent context 4- Develop risk criteria 5- Define the structure for risk analysis,11,1- Establish the internal context-As previously discussed, risk is the chance of something happening that will impact on objectives. As such, the objectives and goals of a business, project or activity must first be id
10、entified to ensure that all significant risks are understood. This ensures that risk decisions always support the broader goals and objectives of the business. This approach encourages long-term and strategic thinking.,12,In establishing the internal context, the business owner may also ask themselv
11、es the following questions:- Is there an internal culture that needs to be considered? For example, are staff Resistant to change? Is there a professional culture that might create unnecessary risks for the business?- What staff groups are present?- What capabilities does the business have in terms
12、of people, systems, processes, equipment and other resources?,13,2. Establish the external context,This step defines the overall environment in which a business operates and includes an understanding of the clients or customers perceptions of the business. An analysis of these factors will identify
13、the strengths, weaknesses, opportunities and threats to the business in the external environment.,14,A business owner may ask the following questions when determining the external context: What regulations and legislation must the business comply with? Are there any other requirements the business n
14、eeds to comply with? What is the market within which the business operates? Who are the competitors? Are there any social, cultural or political issues that need to be considered?,15,Tips for establishing internal and external contexts -Determine the significance of the activity in achieving the org
15、anizations goals and objectives- Define the operating environment- Identify internal and external stakeholders and determine their involvement in the risk management process.,16,3- Establish the risk management context,- Before beginning a risk identification exercise, it is important to define the
16、limits, objectives and scope of the activity or issue under examination. - For example, in conducting a risk analysis for a new project, such as the introduction of a new piece of equipment or a new product line, it is important to clearly identify the parameters for this activity to ensure that all
17、 significant risks are identified.,17,Tips for establishing the risk management context Define the objectives of the activity, task or function Identify any legislation, regulations, policies, standards and operating procedures that need to be complied with Decide on the depth of analysis required a
18、nd allocate resources accordingly Decide what the output of the process will be, e.g. a risk assessment, job safety analysis or a board presentation. The output will determine the most appropriate structure and type of documentation.,18,4. Develop risk criteria Risk criteria allow a business to clea
19、rly define unacceptable levels of risk. Conversely, risk criteria may include the acceptable level of risk for a specific activity or event. In this step the risk criteria may be broadly defined and then further refined later in the risk management process.,19,Tips for developing risk criteria Decid
20、e or define the acceptable level of risk for each activity Determine what is unacceptable Clearly identify who is responsible for accepting risk and at what level.,20,5. Define the structure for risk analysis,Isolate the categories of risk that you want to manage. This will provide greater depth and
21、 accuracy in identifying significant risks.The chosen structure for risk analysis will depend upon the type of activity or issue, its complexity and the context of the risks.,21,Step 3. Identify the risks,Risk cannot be managed unless it is first identified. Once the context of the business has been
22、 defined, the next step is to utilize the information to identify as many risks as possible.,22,The aim of risk identification is to identify possible risks that may affect, either negatively or positively, the objectives of the business and the activity under analysis. Answering the following quest
23、ions identifies the risk:,23,There are two main ways to identify risk: 1- Identifying retrospective risks Retrospective risks are those that have previously occurred, such as incidents or accidents. Retrospective risk identification is often the most common way to identify risk, and the easiest. Its
24、 easier to believe something if it has happened before. It is also easier to quantify its impact and to see the damage it has caused.,24,There are many sources of information about retrospective risk. These include: Hazard or incident logs or registers Audit reports Customer complaints Accreditation
25、 documents and reports Past staff or client surveys Newspapers or professional media, such as journals or websites.,25,2-Identifying prospective risksProspective risks are often harder to identify. These are things that have not yet happened, but might happen some time in the future.Identification s
26、hould include all risks, whether or not they are currently being managed. The rationale here is to record all significant risks and monitor or review the effectiveness of their control.,26,Methods for identifying prospective risks include: Brainstorming with staff or external stakeholders Researchin
27、g the economic, political, legislative and operating environment Conducting interviews with relevant people and/or organizations Undertaking surveys of staff or clients to identify anticipated issues or problems Flow charting a process Reviewing system design or preparing system analysis techniques.
28、,27,Tips for effective risk identification,Select a risk identification methodology appropriate to the type of risk and the nature of the activity Involve the right people in risk identification activities Take a life cycle approach to risk identification and determine how risks change and evolve th
29、roughout this cycle.,28,Step 4. Analyze the risks,During the risk identification step, a business owner may have identified many risks and it is often not possible to try to address all those identified.The risk analysis step will assist in determining which risks have a greater consequence or impac
30、t than others.,29,What is risk analysis?Risk analysis involves combining the possible consequences, or impact, of an event,with the likelihood of that event occurring. The result is a level of risk. That is: Risk = consequence x likelihood,30,Elements of risk analysisThe elements of risk analysis ar
31、e as follows:1. Identify existing strategies and controls that act to minimize negative risk and enhance opportunities.2. Determine the consequences of a negative impact or an opportunity (these may be positive or negative).3. Determine the likelihood of a negative consequence or an opportunity.4. E
32、stimate the level of risk by combining consequence and likelihood.5. Consider and identify any uncertainties in the estimates.,31,Types of analysis Three categories or types of analysis can be used to determine level of risk: Qualitative Semi-quantitative Quantitative. - The most common type of risk
33、 analysis is the qualitative method. The type of analysis chosen will be based upon the area of risk being analyzed.,32,Tips for effective risk analysis Risk analysis is usually done in the context of existing controls take the time to identify them The risk analysis methodology selected should, whe
34、re possible, be comparable to the significance and complexity of the risk being analyzed, i.e. the higher the potential consequence the more rigorous the methodology Risk analysis tools are designed to help rank or priorities risks. To do this they must be designed for the specific context and the r
35、isk dimension under analysis.,33,Step 5. Evaluate the risks,Risk evaluation involves comparing the level of risk found during the analysis process with previously established risk criteria, and deciding whether these risks require treatment.The result of a risk evaluation is a prioritized list of ri
36、sks that require further action.This step is about deciding whether risks are acceptable or need treatment.,34,Risk acceptanceA risk may be accepted for the following reasons: The cost of treatment far exceeds the benefit, so that acceptance is the only option (applies particularly to lower ranked r
37、isks) The level of the risk is so low that specific treatment is not appropriate with available resources The opportunities presented outweigh the threats to such a degree that the risks justified The risk is such that there is no treatment available, for example the risk that the business may suffe
38、r storm damage.,35,Step 6. Treat the risks,Risk treatment is about considering options for treating risks that were not considered acceptable or tolerable at Step 5.Risk treatment involves identifying options for treating or controlling risk, in order to either reduce or eliminate negative consequen
39、ces, or to reduce the likelihood of an adverse occurrence. Risk treatment should also aim to enhance positive outcomes.,36,Options for risk treatment: identifies the following options that may assist in the minimization of negative risk or an increase in the impact of positive risk. 1- Avoid the ris
40、k 2- Change the likelihood of the occurrence 3- Change the consequences 4- Share the risk 5- Retain the risk,37,Tips for implementing risk treatments The key to managing risk is in implementing effective treatment options When implementing the risk treatment plan, ensure that adequate resources are
41、available, and define a timeframe, responsibilities and a method for monitoring progress against the plan Physically check that the treatment implemented reduces the residual risk level In order of priority, undertake remedial measures to reduce the risk.,38,Step 7. Monitor and review,Monitor and re
42、view is an essential and integral step in the risk management process. A business owner must monitor risks and review the effectiveness of the treatment plan, strategies and management system that have been set up to effectively manage risk.,39,Risks need to be monitored periodically to ensure chang
43、ing circumstances do not alter the risk priorities. Very few risks will remain static, therefore the risk management process needs to be regularly repeated, so that new risks are captured in the process and effectively managed.A risk management plan at a business level should be reviewed at least on an annual basis. An effective way to ensure that this occurs is to combine risk planning or risk review with annual business planning.,40,Summary of risk management steps,41,
