Risk Management Essentials

Risk, Plainly Defined

The concept of Risk

• Risk is not always bad
• Good things happen and bad things happen
• Risk can present opportunities

Risk Terminology

Risk

• The possibility that an event will occur that will negatively affect objectives
• A company launching a new product faces the risk that customers may not buy it, impacting sales and delivery

Hazard

• A source of potential harm or adverse effect
• Wet floors in a workplace are a hazard because they can cause slips and injury

Threat

• Something that can exploit vulnerability and cause harm
• Cyber Criminals are a threat to an organisation’s IT systems

Finding What Could Go Wrong

Risk Management Flow Actions

Identify Risk

Assess Risk

Plan Risk Responses

Implement Risk Responses

Monitor Risk

Review Risk

Close Risk

Identifying Risk

• What could possibly go wrong? (Risk)
• Who would that happen? (Hazard)
• Ask the experts
• Listen and learn
• Research
• Refer to previous risk registers

SPECTRES

• Sociological
• Political
• Economic
• Commercial
• Technology
• Legal/Environmental
• Safety and Security

Assessing Risk Clearly

Qualitative Risk Assessment 

• Uses descriptive scales e.g., Low, Medium, High to assess likelihood and impact
• Tools: Risk matrix, heat maps
• Advantages: Simple, quick, easy to communicate
• Example: A project team rates a risk as ‘High likelihood, Medium impact’ without using numbers.

Quantitative Risk Assessment

• Assigns numerical values to likelihood and impact to make precise analysis
• Tools: Probability distributions, expected monetary value (EMV)
• Advantages: Provides measurable data for decision-making
• Example: A risk has a 30% chance of causing a £50,000 loss = EMV = £15,000

Reporting That Helps

Benefits of Risk Reporting

• Identifies areas where issues exist and allows for timely action
• Saves time and resources resolving issues
• Fosters accountability
• Supports compliance with regulatory requirements
• Creates transparency among stakeholders
• Informs decision making and builds confidence

How often should we create reports?

• In time to catch and control problems
• Depending on the level of complexity and risk in the project
• According to stakeholder requirements