Risk Management Process
Risk management process
MoR's risk management process is a cycle of identify, assess, plan and implement, with communication running throughout and review feeding back into the next cycle. The exam tests the purpose of each step, the inputs and outputs, and the quality of risk descriptions and response plans.
The steps
- Identify: find, recognise and describe risks, including threats and opportunities. A good description uses cause-event-effect: because of X, event Y may occur, leading to Z.
- Assess: estimate probability and impact, then evaluate against appetite, tolerance or threshold; prioritise and aggregate.
- Plan: select responses. For threats, common options are avoid, reduce, transfer and accept; for opportunities, exploit, enhance, share and reject. Define actions, owners, dates and success criteria.
- Implement: carry out response actions, monitor risk, update information and escalate when thresholds are crossed.
- Communicate: share risk information with stakeholders in a form they can use.
- Embed and review: check that the process is working and improving.
Worked example
A risk is described as supplier failure. That is too vague. Reframed: because the sole supplier has no tested continuity plan, a fire at its plant may halt component supply, leading to a four-week delay and 200k extra cost. Assessment scores probability 3 and impact 4. The plan includes qualifying a second supplier (reduce), insurance for extra cost (transfer) and a contingency stock buffer (reduce). The risk owner monitors triggers monthly.
Traps
- Writing a cause or an effect as the risk itself.
- Choosing responses before assessing the risk.
- Leaving actions without owners or dates.