Week 1
1. Risk definition:
• Uncertainty: A state of having limited knowledge where it is impossible to exactly describe state or future outcome, more than one possible outcome.
• Risk: the effect of uncertainty on objectives.
• Risk owner: Person or entity with the accountability and authority to manage risk.
• Risk management policy: Statement related to risk management
• Hazard: an event, situation or state that may give rise to risk.
• Control measure: an action taken to reduce the frequency or severity of a risk 2. How safe is safe enough?
• Identifying those natural and artificial forces that must be considered to ensure adequate safety and serviceability
• Providing criteria for achieving minimum required levels of structural resistance to these forces.
3. Project success: the project is completed within a finite timescale and budget, and to nominated standard of quality.
4. Project dynamics:
• Time: Baseline schedule, expected, actual time
• Budget: Base cost, delay, adjustment, overrun.
• Quality: Scope, technical standards, benefits.
5. For a project:
• Understand project context
• Identify the hazard
• Find the risk owner
• Identify risks
• Propose control measure for risk
6. Australia/ New Zealand Risk Management Standard (AS/NZS/ISO 31000:2009):
• Provide principles and generic guidelines.
• Can be applied to any type of risk, whatever its nature, whether having positive or negative consequence.
• Universal application across all organization – international.
7. Risk management basics:
• Organizational objectives are influence by internal and external factors, which create uncertainty in achieving those objectives. The effect of this uncertainty is risk to the organization objectives.
• Unlike risk elimination (in military and law enforcement) which seek to remove all risk, risk management is coordinated activities to direct and control an organization with regard to risk.
• Risk management allows for multiple risk responses dependent upon evaluation and analysis of risk
• RISK = Negative impact X Likelihood of occurrence 8. Risk management process:
Systematic application of management policies, procedures and practices to the activities of communicating, consulting, establishing the context and identifying, analysing, evaluating, treating monitoring and review risk.
9. Establish the context:
• Define the basic parameters
• Set the purpose and scope for the risk management
• The context includes the organization’s external and internal environment and the purpose of the risk management activity.
External context: business, social, regulatory, cultural, competive, financial, political, environment, external stakeholders.
Internal context: internal stakeholders, capabilities, resources.
10.Understand the corporate and project risk context as your starting point for the qualitative risk analysis:
+ Many organizations have a risk management policy, identified priority risk categories and corresponding risk management strategies defined in a corporate framework document;
+ Many organizations have a risk management manual and refer to the Au standard as a guide.
+ The overaching risk profile and the key business risk to the organization will be described in this documentation.
11. Identification risk:
Can simple broken down to answering the following question:
• What can happen?
• When and where?
• How and why?
• Who is involved or affected?
The aim is to generate: Risk register.
Range of identification techniques:
• brainstorming
• work breakdown analysis
• historic information
• expert option 12.Risk analysis:
• Develop an understanding of risk: whether risks need to be treated? What is the cost of the treatment?
• Source of information – past records, relevant experience, experiments.
• Techniques – structured interview with experts, use models and simulations.
• Determine the likelihood rating of each risk: (frequency or likelihood of an identify risk occurring)
+ The analysis of risk requires an objective assessment of their frequency of occurring, based on historical events and some assessment of what has changed and may occur into the future.
+ The frequency estimate will vary depending on the period under review for the given project &situation
+ The period under review is dependent on what is the context of the risk analysis.
• Determine the consequence rating: (impact or magnitude of the effect of an identify risk occurring)
+ The consequence of risk actually occurring can be quantified in commercial term, environmental term (contamination of wetland), or social term (loss of amenity)
+ Monetizing all consequence is useful for combining a total impact.
However, some consequence are difficult to monetize.
13. Qualitative analysis:
• Use words or descriptive scale to describe the magnitude of potential risk likelihood and consequences.
• These scale can be adapted or adjusted to suit circumstances, different descriptions used for different risk
• Often used first to obtain general indication
• Later it may be necessary to undertake quantitative analysis on major risk issues.
• Used when level of risk does not justify the time and effort require for fuller analysis or numerical data are inadequate for a quantitative analysis.