What are the 3 components of risk management

In this installment of our Risk Management Basics series, we're going to take a closer look at risk assessment. In doing so, we'll break risk assessment down into three separate steps: risk identification, risk analysis, and risk evaluation.

We hope this article and our entire Risk Management Basics series will help you gain a better understanding of risk management and help you begin to use risk management techniques at your workplace. Or, if you're already using risk management at work, to perhaps improve what you're doing now.

Drop us a note in the comments section below if you'd like us to address any particular risk-related topic in this ongoing risk series.

And if you're involved in occupational safety and health, feel free to download the free Guide to Using Risk Management for Occupational Safety and Health at the bottom of this article (but note, this article addresses risk management and risk assessment in a general manner and can be applied to any aspect of enterprise risk management).

What Is Risk Assessment?

[optin-monster slug="ydheitmvhxurgh0b70t3"]

Risk assessment is the name for the three-part process that includes:

• Risk identification
• Risk analysis
• Risk evaluation

Your organization should conduct risk assessment in a systematic manner. Perform risk assessment collaboratively, as a team effort, involving different stakeholders and always taking into account their unique knowledge and views.

When performing your risk assessment, use the best information available to your organization, realizing this may mean you'll have to look outside your organization and/or do additional research to gather more information and more knowledge.

[optin-monster slug="nhfzfxq0hdm2vvxcw3lf"]

What Is Risk Identification?

Risk identification is the first phase of risk assessment.

Risk identification is the process of finding and describing risks that might help or prevent an organization achieve its objectives.

Side note: Remember that risk can be thought of as the effect that uncertainty may have on your organization's attempt to reach your objectives, and that effect may be positive/beneficial or negative/harmful.

During the risk identification process, your organization should identify risks that seek to identify risks that are both under your control and those that are not.

What Is Risk Analysis?

During risk analysis, it's your goal to learn the nature of the risk(s). During risk analysis, be sure to consider:

• Uncertainties, including those with possible negative and positive consequences
• Sources of risk
• Events
• Likelihood of events
• The consequence of those events
• The effectiveness of current controls
• The effectiveness of potential future controls

A risk analysis will be more accurate if you're using high-quality, accurate, and complete information. Remember you may have to go outside your organization to get some of this information.

You should be aware of, document, and communicate to decision makers the opinions, biases, assumptions, exclusions, as well as any limitations of any techniques used, during the risk analysis process.

[optin-monster slug="gcy12zqmovkr3si1a9ga"]

What Is Risk Evaluation?

During risk evaluation, you'll compare the results you came up with during your risk analysis and compare those to your organization's existing risk criteria to determine if you'll need to do more to treat the risk(s) you're assessing.

During risk evaluation, your organization may choose to:

• Do nothing
• Consider implementing other risk treatments
• Reconsider your organization's objectives
• Return to the risk analysis phase to develop a more thorough understanding of the risk at hand

What's Next: Risk Treatment

Once a risk assessment (including risk identification, analysis, and evaluation) has been conducted, it's time to turn your attention to risk treatment. Risk treatment is the process of considering, selecting, and implementing one or more options for addressing the risk(s) you've been assessing.

We'll address risk treatment in a future Risk Management Basics article. Look for it!

Where to Learn More About Risk Management

Of course, you can hang tight for the next article(s) in our Risk Management Basic Series, but here are some additional resources for you if you want to kickstart your risk management awareness.

Risk Standards and Organizations

• ISO 31000
• RIMS (the Risk Management Society)

Risk Management Basics Articles from Convergence Training

Occupational Safety & Risk Management Related Articles from Convergence Training

Other Risk-Related Articles from Convergence Training

• Eight Ways an LMS Serves as a Risk Management Tool

[optin-monster slug="pvbrt1q3wdjfugqy7s55"]

Conclusion: Effective Risk Management Programs Are Built on Strong Foundations & Principles

Stay tune for more Risk Basics articles and let us know all your risk management questions.

Although risk management techniques can be used in any industry and for any subject matter, we DO create a lot of tools for safety, including online EHS training courses and an online incident management system, so we've got a free Guide to Using Risk Management for Occupational Safety and Health Management for you below--download it and getting started on your risk-based occupational safety efforts today.

[optin-monster slug="gcy12zqmovkr3si1a9ga"]

To manage risk proactively and successfully in your organization, you probably already take an enterprise risk management (ERM) approach. But if you fail to dedicate sufficient time and attention to all the components of ERM, you’re in danger of neglecting some of the key challenges you should be tackling. Here, we examine the 9 components of enterprise risk management and how you should approach them. 

What is Enterprise Risk Management?

The COSO 2013 Framework defines ERM as:

“The culture, capabilities, and practices, integrated with strategy-setting and its performance, that organizations rely on to manage risk in creating, preserving, and realizing value.” 

Investopedia defines it as “a methodology that looks at risk management strategically from the perspective of the entire firm or organization.” 

Enterprise risk management differs from traditional risk management in its scope (encompassing the entire organization, rather than one process or team), its approach (forward-looking rather than reflective) and its ability to adapt to a changing landscape; the former is typically more agile and fluid, incorporating ERM tools and technology to keep up with the evolving risk landscape. On the other hand, the later – traditional risk management – is more static. 

What Risks Does an Enterprise Risk Management Framework Address?

An enterprise risk management framework focuses on three core areas of risk; operations risk, financial risk and strategic risk. Here we look at each of these components of corporate risk management in more detail:  

Operations Risk Management 

The international capital framework generated by the Basel II Accords defines operations risk as “the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events,” including legal liabilities.

Examples of operations risk might include the potential damage caused by employee turnover, management oversight or poor IT design. Managing operational risks requires identification of risks in all operations through surveys, workshops and a framework of risk assessment. Once this is in place, a robust and organization-wide corporate governance structure must be put in place to manage operational risks. 

Financial Risk Management 

ERM became obligatory after the legendary financial scandals perpetrated by leaders of companies like Enron and WorldCom. In response to these, the US Congress introduced the Sarbanes-Oxley Act of 2002, part of which required internal control systems as at publicly traded companies.

Financial risks emerge from the effects of markets on an entity’s assets and include risks to credit, price and liquidity. Since these risks, unlike operations risk, can, to a certain extent, be projected and planned for, they’re considered a speculative risk. It’s usually the job of the CFO and their department to be on top of them. 

Strategic Risk Management 

Looking at strategic risk requires you to step back from the granular detail of your business’ operations and finances to its future growth and development. It could be put this way: while ERM strategies in operations and finances will help you do things right, strategic risk management is more focused on getting your entity to do the right things. Strategic risks are those that threaten the “big picture” of your operations and future plans.

The company that has the best budgeting and the most efficient operations will go bust if no one wants its products. Turnover and redundancy of products are a natural part of the business cycle; strategic risks that enterprise risk management can help you to handle.

Exploring the Components of an Effective Enterprise Risk Management Framework

What are the major components of enterprise risk management? As with any management framework, there are many different ERM framework components, with different bodies and experts including different ERM components within their definitions.

One of the best-known ERM frameworks was introduced by the Committee of Sponsoring Organisations of the Treadway Commission (COSO) in 1992. 

Although the inclusion of guidelines from the Sarbanes-Oxley Act (SOX) aligns the COSO framework with financial institutions and other large corporations in scope of SOX regulation, the transferability of the COSO ERM framework components means it is used across a range of sectors worldwide. 

And although COSO guidance is non-mandatory, its ability to deliver a framework companies can use to assess and improve their controls and processes means it has been highly influential. 

9 Components of a Comprehensive ERM Framework

1. Organizational culture/internal environment: Risk management doesn’t happen in a vacuum; what COSO calls your internal environment, including the organization’s attitude to risk, will drive your ERM approach. This is the first of the key ERM framework components you need to consider. 

1. Objective setting: You need to know what your ERM goals are: are you aiming for total risk avoidance or are you able to tolerate certain risks? Are there some areas of your organization that will take more work than others to bring into an ERM framework? Understanding your goals and challenges is the crucial next step. 

1. Risk identification (sometimes referred to as “framing the risk” or “event identification”): Identifying internal and external events that could affect the achievement of your objectives. This is another one of the COSO ERM components, and COSO points out that these could be positive or negative; explore the opportunities as well as the risks. 

1. Risk assessment and measurement: Assessing the risks you face is one of the essential components of corporate risk management. You need to determine their likelihood, severity and your ability to respond.  

1. Risk response, or risk mitigation: Identifying actions to take in line with your corporate tolerance and appetite for risk 

1. Control activities: Determining appropriate internal controls to monitor and test your approach. This series of checks and balances is designed to identify any out-of-tolerance activity or results. 

1. Internal communication to drive buy-in: Building an ERM framework requires support from across your organization – communicating your objectives and strategy is one of the core ERM components. 

1. Risk reporting and monitoring: Determine what this will look like and who will be responsible for it. In many organizations, particularly larger ones, the audit function will be accountable. 

1. Risk governance: Building an ERM framework demands ongoing refinement to ensure you take on board lessons learned and finesse controls and governance processes in synergy. 

Get the Most Out of Your ERM Strategy With the Right Tools and Technology

Enterprise risk management strategies have many benefits; it’s no surprise that more and more organizations are understanding and embracing ERM. But to achieve these benefits, your ERM framework has to be implemented and monitored at the highest levels of your entity. These practices are not only legally required, but can be your main line of defense against financial and reputational damage. 

Understanding the various ERM framework components is a vital step towards delivering the risk mitigation strategy you need.

Diligent’s comprehensive enterprise risk management software accelerates your ERM performance, enabling you to identify, monitor and manage risks across your entire organization. Compliance and reporting are made easy, increasing board and stakeholder confidence in your ability to strategically tackle risk. Find out more about Diligent Enterprise Risk Management.