You are on page 1of 17

A Risk Management Standard

Published by AIRMIC. ALARM. IRM: 2002 .

The standard represents best management involves. It is intended for any activity whether short or long that regular modifications will be made to term.The Association of Insurance and Risk Managers (AIRMIC) There are many ways of achieving the and ALARM The National Forum for objectives of risk management and it Risk Management in the Public Sector.Therefore it was In addition.The benefits and opportunities the standard in the light of best practice.Vocabulary . IRM: 2002 1 . Some form measure themselves. component parts of this standard. ALARM. A Risk Management Standard © AIRMIC. but back cover of this Guide). during an extensive period certifiable process. the standard recognises that area the authors would appreciate feedback risk has both an upside and a downside. Management (IRM).Guidelines for • organisation structure for risk management use in standards. would be impossible to try to set them all out in a single document. albeit in Risk management is a rapidly developing different ways. the team sought the views and never intended to produce a prescriptive opinions of a wide range of other standard which would have led to a box professional bodies with interests in risk ticking approach nor to establish a management. from organisations as they put the standard Risk management is not just something for into use (addresses to be found on the corporations or public organisations.The Institute of Risk affected. Introduction This Risk Management Standard is the should be viewed not just in the context of result of work by a team drawn from the the activity itself but in relation to the major risk management organisations in many and varied stakeholders who can be the UK . By meeting the various of consultation. how it should be practice against which organisations can conducted and what it is for. of standard is needed to ensure that there is The standard has wherever possible used an agreed: the terminology for risk set out by the • terminology related to the words used International Organization for • process by which risk management can be Standardization (ISO) in its recent carried out document ISO/IEC Guide 73 Risk Management . organisations will be in a discipline and there are many and varied position to report that they are in views and descriptions of what risk compliance. • objective for risk management In view of the rapid developments in this Importantly.

management of risk as part of their job Its objective is to add maximum description. overall objectives. Risk Risk can be defined as the combination of negative aspects of risk. It marshals the thus promoting operational efficiency at understanding of the potential upside and all levels. downside of all those factors which can affect the organisation. Risk Management Risk management is a central part of any It must be integrated into the culture of organisation’s strategic management. present and in particular.1 External and Internal Factors probability of success. and reduces both The risks facing an organisation and its the probability of failure and the operations can result from factors both uncertainty of achieving the organisation’s external and internal to the organisation. operational. hazard. future. throughout the organisation with each The focus of good risk management is the manager and employee responsible for the identification and treatment of these risks. It supports accountability. It is the organisation with an effective policy the process whereby organisations and a programme led by the most senior methodically address the risks attaching to management. It increases the 2. sustainable value to all the activities of the performance measurement and reward. Risk Management is increasingly recognised as being concerned with both positive and 2.Therefore this the probability of an event and its standard considers risk from both consequences (ISO/IEC Guide 73). It and internal drivers and therefore overlap should address methodically all the risks the two areas. focused on prevention and mitigation of harm. financial. it is generally recognised potential for events and consequences that that consequences are only negative and constitute opportunities for benefit (upside) therefore the management of safety risk is or threats to success (downside). assigning responsibility across the portfolio of all activities. It must translate the their activities with the goal of achieving strategy into tactical and operational sustained benefit within each activity and objectives.They can be categorised surrounding the organisation’s activities past. further into types of risk such as strategic. In all types of undertaking. 1. perspectives. there is the In the safety field. organisation. etc. Risk management should be a continuous The diagram overleaf summarises examples and developing process which runs of key risks in these areas and shows that throughout the organisation’s strategy and some specific risks can have both external the implementation of that strategy. 2 A Risk Management Standard .

ALARM.2.1 Examples of the Drivers of Key Risks © AIRMIC. IRM: 2002 3 .

2 The Risk Management Process The Organisation’s Strategic Objectives Risk Assessment Risk Analysis Risk Identification Risk Description Risk Estimation Modification Risk Evaluation Formal Audit Risk Reporting Threats and Opportunities Decision Risk Treatment Residual Risk Reporting Monitoring Risk management protects and adds value to the organisation and its stakeholders through supporting the organisation’s objectives by: • providing a framework for an use/allocation of capital and resources organisation that enables future activity within the organisation to take place in a consistent and • reducing volatility in the non essential controlled manner areas of the business • improving decision making. planning • protecting and enhancing assets and and prioritisation by comprehensive and company image structured understanding of business activity. volatility and project • developing and supporting people and opportunity/threat the organisation’s knowledge base • contributing to more efficient • optimising operational efficiency 4 A Risk Management Standard .2.

These concern the long-term consistent and co-ordinated processes and strategic objectives of the organisation.1 Risk Identification • Financial . as well as the • Knowledge management . data categorised. protection. sovereign and political risks.These concern development of a sound understanding of its the effective management and control of the strategic and operational objectives.This the organisation and the effects of external requires an intimate knowledge of the factors such as availability of credit. In-house ‘ownership’ of the risk management process is essential. area power failures. environmental. The objective of risk description is to • Operational . Risk Assessment Risk Assessment is defined by the ISO/ analysis and risk evaluation.These concern the effective Risk identification sets out to identify an management and control of the finances of organisation’s exposure to uncertainty. External factors might include the unauthorised use or abuse of intellectual Risk identification should be approached property. knowledge resources. an in-house which include: approach with well communicated. 3.The confronted with as it strives to deliver its risk description table overleaf can be used strategic objectives. Business activities and decisions can be Whilst risk identification can be carried classified in a range of ways.They tools (see Appendix. exchange rates. All associated volatility related to these health & safety. reputation 4. have been identified and all the risks • Compliance . including factors critical to its success and the protection and communication thereof. • Strategic . interest rate movement and the legal. IRM: 2002 5 . to facilitate the description and assessment © AIRMIC. Risk Analysis 4. page 14) is likely to be can be affected by such areas as capital more effective. ALARM. foreign organisation. IEC Guide 73 as the overall process of risk (See appendix) 4. social. consumer protection.2 Risk Description and changes in the physical environment.These concern such issues as flowing from these activities defined. for example. the production. Internal factors might significant activities within the organisation be system malfunction or loss of key staff. environment in which it exists. political and cultural other market exposures. and in a methodical way to ensure that all competitive technology.These concern the day-to. availability. the market in which it operates. trade activities should be identified and descriptions. legal and regulatory changes. by using a table. threats and opportunities related to the achievement of these objectives. display the identified risks in a structured day issues that the organisation is format. employment practices and regulatory issues. examples of out by outside consultants.

Risk Treatment & Primary means by which the risk is currently managed Control Mechanisms Levels of confidence in existing control Identification of protocols for monitoring and review 8. It is important to probability of each of the risks set out in the incorporate risk management at the table.3. Different organisations will find that quantitative or qualitative in terms of the different measures of consequence and probability of occurrence and the possible probability will suit their needs best. type. Nature of Risk Eg. operational.The use of a well designed structure detail. 4. description and assessment may be categorised as strategic. operational.of risks. knowledge or compliance 4. strategic. medium or low (see table 4. consequences both in terms assessing consequence and probability as high. of threats (downside risks) and medium or low is quite adequate for their opportunities (upside risks) may be high. financial.3. Risk Tolerance/ Loss potential and financial impact of risk Appetite Value at risk Probability and size of potential losses/gains Objective(s) for control of the risk and desired level of performance 7.2.1). 6 A Risk Management Standard . Stakeholders Stakeholders and their expectations 5. matrix gives them a better evaluation. Quantification of Risk Significance and Probability 6. their size. needs and can be presented as a 3 x 3 matrix. Potential Action for Recommendations to reduce risk Improvement 9. semi.1 Table . it should be possible to prioritise the conceptual stage of projects as well as key risks that need to be analysed in more throughout the life of a specific project.3. Risk estimation can be quantitative.Risk Description 1.2 and 4. For example many organisations find that For example. medium or low but requires Other organisations find that assessing different definitions in respect of threats and consequence and probability using a 5 x 5 opportunities (see tables 4. By considering the consequence and tactical. Probability may be high. Name of Risk 2. consequence. project/ process. number and dependencies 3.3 Risk Estimation Examples are given in the tables overleaf. Scope of Risk Qualitative description of the events. Strategy and Policy Identification of function responsible for developing strategy Developments and policy 4. Identification of the risks associated is necessary to ensure a comprehensive risk with business activities and decision making identification.3).

Threats Estimation Description Indicators High Likely to occur each year Potential of it occurring several times (Probable) or more than 25% chance within the time period (for example - of occurrence.Table 4. IRM: 2002 7 . Medium Likely to occur in a ten Could occur more than once within the (Possible) year time period or less time period (for example .ten years). Has occurred recently. Is there a history of occurrence? Low Not likely to occur in a Has not occurred.3.3. (Remote) ten year period or less than Unlikely to occur. © AIRMIC. some external influences. ALARM. 2% chance of occurrence. than 25% chance of Could be difficult to control due to occurrence.2 Probability of Occurrence . ten years).1 Consequences .Both Threats and Opportunities High Financial impact on the organisation is likely to exceed £x Significant impact on the organisation’s strategy or operational activities Significant stakeholder concern Medium Financial impact on the organisation likely to be between £x and £y Moderate impact on the organisation’s strategy or operational activities Moderate stakeholder concern Low Financial impact on the organisation likely to be less that £y Low impact on the organisation’s strategy or operational activities Low stakeholder concern Table 4.

3. 5. Risk estimated risks against risk criteria which evaluation therefore.4 Risk Analysis methods and treatment efforts. 8 A Risk Management Standard . (See Appendix. it is necessary to compare the concerns of stakeholders.Opportunities Estimation Description Indicators High Favourable outcome is Clear opportunity which can be relied (Probable) likely to be achieved in on with reasonable certainty.3 Probability of Occurrence . page 14. current management processes. 4. socio. Risk Evaluation When the risk analysis process has been economic and environmental factors. year of 25% to 75% chance Opportunities which may arise over and of occurrence. The result of the risk analysis process can Accountability helps to ensure that be used to produce a risk profile which ‘ownership’ of the risk is recognised and gives a significance rating to each risk and the appropriate management resource provides a tool for prioritising risk allocated. legal requirements.5 Risk Profile decreased or reapportioned.Table 4. A range of techniques can be used to analyse risks. primary control procedures in place and for examples).This ranks each identified techniques risk so as to give a view of the relative importance. 4. etc. indicates areas where the level of risk control investment might be increased. risk should be accepted or treated. term or less than 25% Opportunity for which the likelihood of chance of occurrence. Low Some chance of favourable Possible opportunity which has yet to be (Remote) outcome in the medium fully investigated by management.These can be specific to This process allows the risk to be mapped upside or downside risk or be capable of to the business area affected.The risk decisions about the significance of risks to criteria may include associated costs and the organisation and whether each specific benefits. completed. is used to make the organisation has established. Medium Reasonable prospects of Opportunities which may be achievable (Possible) favourable results in one but which require careful management. success is low on the basis of management resources currently being applied. describes the dealing with both. above the plan. to be one year or better than achieved in the short term based on 75% chance of occurrence.

human rights. health and safety and budgets) and the environment. consequences other areas may have on them Increasingly stakeholders look to • have performance indicators which allow organisations to provide evidence of them to monitor the key business and effective management of the organisation’s financial activities.2 External Reporting Business Units should: A company needs to report to its • be aware of risks which fall into their area stakeholders on a regular basis setting out of responsibility. ALARM. taken The Board of Directors should: • report systematically and promptly to • know about the most significant risks senior management any perceived new facing the organisation risks or failures of existing control • know the possible effects on shareholder measures value of deviations to expected performance ranges Individuals should: • ensure appropriate levels of awareness • understand their accountability for throughout the organisation individual risks • know how the organisation will manage a • understand how they can enable crisis continuous improvement of risk • know the importance of stakeholder management response confidence in the organisation • understand that risk management and • know how to manage communications risk awareness are a key part of the with the investment community where organisation’s culture applicable • be assured that the risk management • report systematically and promptly to process is working effectively senior management any perceived new • publish a clear risk management policy risks or failures of existing control covering risk management philosophy and measures responsibilities 6. forecasts employment practices. 6.1 Internal Reporting • have systems which communicate Different levels within an organisation need variances in budgets and forecasts at different information from the risk appropriate frequency to allow action to be management process. progress towards non-financial performance in such areas as objectives and identify developments community affairs. the possible impacts these its risk management policies and the may have on other areas and the effectiveness in achieving its objectives. IRM: 2002 9 . © AIRMIC. which require intervention (e. Risk Reporting and Communication 6.g.

10 A Risk Management Standard . generally considered to be the provision of Cost effectiveness of internal control relates funds to meet the cost of implementing risk to the cost of implementing the control treatment (as defined by ISO/IEC Guide compared to the risk reduction benefits 73.particularly risk management which: management responsibilities for risk • protects the interests of their stakeholders management • ensures that the Board of Directors • the processes used to identify risks and discharges its duties to direct strategy. should of risk management should be clearly stated be reported together with the steps taken and be available to the stakeholders. Risk Treatment Risk treatment is the process of selecting The risk analysis process assists the effective and implementing measures to modify the and efficient operation of the organisation risk. NOTE: In this standard. see page 17). their potential to benefit the organisation. 7.Good corporate governance requires that The formal reporting should address: companies adopt a methodical approach to • the control methods . or in the system itself. Any system of risk treatment should The proposed controls need to be provide as a minimum: measured in terms of potential economic • effective and efficient operation of the effect if no action is taken versus the cost organisation of the proposed action(s) and invariably require more detailed information and • effective internal controls assumptions than are immediately • compliance with laws and regulations.They will need extends further to. etc. to deal with them. Risk financing is not control measures. expected. risk transfer. risk control/mitigation. available. risk financing Effectiveness of internal control is the refers to the mechanisms (eg insurance degree to which the risk will either be programmes) for funding the financial eliminated or reduced by the proposed consequences of risk. risk financing. build how they are addressed by the risk value and monitor performance of the management systems organisation • the primary control systems in place to manage significant risks • ensures that management controls are in • the monitoring and review system in place place and are performing adequately Any significant deficiencies uncovered by The arrangements for the formal reporting the system. Risk treatment includes as its major by identifying those risks which require element. but attention by management. risk to prioritise risk control actions in terms of avoidance. for example.

it should be or not to implement the risk control recognised that some losses or elements of a measures. It should be remembered intended that organisations are dynamic and operate in dynamic environments. loss will be uninsurable eg the uninsured Compliance with laws and regulations is costs associated with work-related health. Monitoring and Review of the Risk Management Process Effective risk management requires a Changes in the organisation and the reporting and review structure to ensure environment in which it operates must be that risks are effectively identified and identified and appropriate changes made to assessed and that appropriate controls and systems. risks © AIRMIC. ALARM. The loss to be One method of obtaining financial expected if no action is taken must also protection against the impact of risks is be estimated and by comparing the through risk financing which includes results. 8. An organisation must safety or environmental incidents. management can decide whether insurance.Firstly. which understand the applicable laws and must may include damage to employee morale implement a system of controls to achieve and the organisation’s reputation. Changes in the • the procedures adopted and information organisation and the environment in which gathered for undertaking the assessment it operates must be identified and were appropriate appropriate modifications made to systems. This has to be calculated some flexibility where the cost of reducing with some accuracy since it quickly a risk may be totally disproportionate to becomes the baseline against which cost that risk. responses are in place. not an option.There is only occasionally be established. However. IRM: 2002 11 . Regular audits of policy and standards compliance should be Any monitoring and review process should carried out and standards performance also determine whether: reviewed to identify opportunities for • the measures adopted resulted in what was improvement. the cost of implementation has to compliance. • improved knowledge would have helped The monitoring process should provide to reach better decisions and identify assurance that there are appropriate controls in what lessons could be learned for place for the organisation’s activities and that future assessments and management of the procedures are understood and followed. effectiveness is measured.

for • how unacceptable risks should be managed Health and Safety. in evaluating its system of internal should set out its approach to and appetite control: for risk and its approach to risk • the nature and extent of downside risks management.To work effectively. The Structure and Administration of Risk Management 9.2 Role of the Board for promoting risk awareness within their The Board has responsibility for operations.3 Role of the Business Units organisation This includes the following: • allocation of appropriate resources for • the business units have primary training and the development of an responsibility for managing risk on a day- enhanced risk awareness by all to-day basis stakeholders. 9. they should introduce risk determining the strategic direction of the management objectives into their business organisation and for creating the • risk management should be a regular environment and the structures for risk management-meeting item to allow management to operate effectively. an audit risk analysis committee or such other function that suits • business unit management should ensure the organisation’s way of operating and is that risk management is incorporated at capable of acting as a ‘sponsor’ for risk the conceptual stage of projects as well as management.1 Risk Management Policy The Board should. a reprioritise work in the light of effective non-executive committee.The policy should also set acceptable for the company to bear within out responsibilities for risk management its particular business throughout the organisation. throughout a project 12 A Risk Management Standard . consideration of exposures and to This may be through an executive group. • the company’s ability to minimise the Attaching to the risk management process probability and impact on the business is an integrated set of tools and techniques • the costs and benefits of the risk and for use in the various stages of the business control activity undertaken process. the risk • the effectiveness of the risk management management process requires: process • commitment from the chief executive and • the risk implications of board decisions executive management of the organisation • assignment of responsibilities within the 9. it should refer to any legal reality requirements for policy statements eg. as a minimum. • the likelihood of such risks becoming a Furthermore. An organisation’s risk management policy consider. • business unit management is responsible 9.

ALARM. product/service management. In within the organisation through the practice. to a full scale risk in the risk management process management department.The same clear definition is • preparing reports on risk for the board also required for those involved in the audit and the stakeholders and review of internal controls and 9.4 Role of the Risk Management management processes across an Function organisation Depending on the size of the organisation • providing assurance on the management the risk management function may range of risk from a single risk champion. Internal Audit • building a risk aware culture within the should ensure that the professional organisation including appropriate requirements for independence and education objectivity are not breached. a part time • providing active support and involvement risk manager.g. etc • primary champion of risk management at In determining the most appropriate role strategic and operational level for a particular organisation. those involved in risk including contingency and business management should have their roles in co- continuity programmes ordinating risk management policy/strategy clearly defined. and auditing the risk development projects.6 Resources and structures for business units Implementation • designing and reviewing processes for risk The resources required to implement the management organisation’s risk management policy • co-ordinating the various functional should be clearly established at each level of activities which advise on risk management management and within each business unit. management audit committee. • establishing internal risk policy and 9. Internal Audit’s role may include strategy and budget processes. It should be some or all of the following: highlighted in induction and all other • focusing the internal audit work on the training and development as well as within significant risks. © AIRMIC. IRM: 2002 13 .The role of the • facilitating risk identification/assessment Risk Management function should include and educating line staff in risk the following: management and internal control • setting policy and strategy for risk • co-ordinating risk reporting to the board. they may have.5 Role of Internal Audit facilitating the risk management process.9. as identified by operational processes e. The role of Internal Audit is likely to differ Risk management should be embedded from one organisation to another. issues within the organisation In addition to other operational functions • developing risk response processes.

(Tel + 44 (0) 20 8996 9001) 14 A Risk Management Standard . Political.Weaknesses. British Standards can be obtained from BSI Customer Services. London W4 4AL. Appendix Risk Identification Techniques . Social. 10. Risk Analysis Methods and examples Techniques .examples • Brainstorming Upside risk • Questionnaires • Market survey • Business studies which look at each • Prospecting business process and describe both the • Test marketing internal processes and external factors • Research and Development which can influence those processes • Business impact analysis • Industry benchmarking • Scenario analysis Both • Risk assessment workshops • Dependency modelling • Incident investigation • SWOT analysis (Strengths. Economic.Threats) • Auditing and inspection • Event tree analysis • HAZOP (Hazard & Operability Studies) • Business continuity planning • BPEST (Business. Opportunities. 389 Chiswick High Road.Technological) analysis • Real Option Modelling • Decision taking under conditions of risk and uncertainty • Statistical inference • Measures of central tendency and dispersion • PESTLE (Political Economic Social Technical Legal Environmental) Downside risk • Threat analysis • Fault tree analysis • FMEA (Failure Mode & Effect Analysis) On the following pages are extracts from the document PD ISO/IEC Guide 73: 2002 reproduced with the permission of British Standards Institution under licence number 2002SK/0313.

EX8 2AY Telephone 01395 223399 Facsimile 01395 223304 Email admin@alarm.alarm-uk. The Institute of Risk Management 6 Lloyd’s Avenue.org www. Telephone 020 7709 9808 London EC3N 3AX Facsimile 020 7709 0716 Email enquiries@theIRM.org ALARM The National Forum for Queens Drive.co.uk.airmic. Insurance and Risk Managers London EC3N 3AX Telephone 020 7480 7610 Facsimile 020 7702 3752 Email enquiries@airmic.com The Association of 6 Lloyd’s Avenue.com This publication is available from the above organisations for download from their respective websites free of charge.theirm.com www. Exmouth Risk Management in the Public Sector Devon.uk www. Please contact the individual associations if you wish to purchase more copies of this Risk Management Standard in printed form .