1

Chapter 4 Business Risk Assessment

Notes by MS

2

Business risk assessment refers to the assessment of risks and opportunities affecting the achievements of the organizational goals and objectives.Business risk assessed at three levels. Business risk assessment at all three levels is essential to identify the THREATS, OPPORTUNITIES and ALTERNATIVES for action to achieve the organizational goal and objectives: Strategic: guidance for a time period of 5 to 10 years

and assessment performed by senior management. It is usually limited to assessment i.e. Identification, Measurement and prioritization of risk.

Chapter 4 Business Risk Assessment

3

Project/Program/Process: for current period of organizational activity. Project manager or process owner is responsible for initial assessment and monitoring or may also share with an oversight committee. It is a mixture/blend of risk assessment in the planning phase and risk management in the implementation phase.

Operational: in everyday operations like health and safety issues. This performed by supervisory level or by individuals or work team tasked with a particular management.It is usually focuses on risk management i.e. standard workplace risks and hazards have been already identified in strategic process of assessment; the task is to manage risk to get the job done.

Chapter 4 Business Risk Assessment

4

Strategic Risk Assessment 1. Understanding of overall goals and objectives by

examining of fundamental documents and classification of indentified goals and objectives into SHORT, MEDIUM and LONG TERMS issues.

2. Choosing of strategic risks that are likely to be of greatest importance:

◦ Operational risk is that entity will not meet its operational goals and objectives.

◦ Fiscal risk is that deficiencies in expenditure control and revenues will adversely affect agreed-up outcomes or objectives.

◦ Reputation risk is that some action by the entity will impair the ability to reach its goals and objectives.

◦ Other strategic risk, such as Policy, Regulatory etc.

Chapter 4 Business Risk Assessment

5

3. Definition of various important and relevant environments and uncertainties:

◦ Political / Government◦ Technological ◦ Legal and Regulatory ◦ Competitors ◦ Customers, Constituents and stakeholders◦ Physical ◦ Markets ◦ Suppliers◦ Economic/Financial

Chapter 4 Business Risk Assessment

6

4. Creation of series of matrices …… environments (step 3) X identification based on time (step 1)

5. Using of various creative processes such as brainstorming, imagine scenario of possible threats and opportunities for each cell of matrix. Thinking outside the box as much as possible.

6. Combining of the risk assessment for various goals and objectives for each of the three time horizon to get a composite strategic risk assessment.

Chapter 4 Business Risk Assessment

7

Project Risk Assessment It uses a different method to identifying risk and opportunity. The method can be one or combination from the following:

◦ Exposure analysis based on assets involved◦ Environmental analysis based on study of

changes ◦ Threats scenario by exploring various narrative

scenarios under numbers of different conditions, especially for catastrophic events and frauds

Chapter 4 Business Risk Assessment

8

Observation or/and measurement of risk is a difficult subject, therefore, risk factors are used that are either observable or measurable characteristics of conditions at risk.

A standard set of risk factors and criteria should be established to measure and rank projects according to their perceived risk.

Each project, program or process to be formally assessed for risk should be scored by the project initiator with the established risk factors based on understanding of the project, program or process and the perception of risk as described.

Chapter 4 Business Risk Assessment

9

Procedure of Project Risk Assessment ◦ Identify Risk: use one or more methods to identify

risk i.e. Exposure, Environmental and/or Threat analysis.

Chapter 4 Business Risk Assessment

10

Measure Risk/Develop Alternatives:◦ Read each factor and sub-criteria for familiarization with aim of each.◦ Consider the project, program or process using each of the

factors/criteria.◦ Score each factor for the project, etc. on a scale of 1 to 5 (lowest to

highest) based on your subjective assessment of the strength/weakness or presence/absence of the criteria.

◦ Sum the scores for the each factor and divide by the number of factors to get the average score.

◦ High risk score are those with an average of 4.25 or more. Low risk scores are those with an average score less than 2.25. These are starting figures that can be adjusted for experience.

◦ Analyze high-risk areas and develop alternatives i.e. controls and other risk management techniques, to deal with each of the high risk components.

◦ Price out the alternatives and compare risk and cost.

Chapter 4 Business Risk Assessment

11

Control design: choose the most cost-effective controls within reasonable prudence and organizational tolerance for accepting risk.

Risk Management: monitor risk and hazards, making adjustments to the project plan as necessary to meet changing conditions.

Chapter 4 Business Risk Assessment

12

Operational Risk Management Operational risk is the day to day mitigation of safety and health risks of employees performing their jobs.

Operational risk also covers visitors and temporary workers in the workplace and risk to general public due to operations.

The focus of operational risk is on risk management. Risk assessment usually done by a specialist involved in workplace risk:

◦ Health Risk ◦ Safety Risk◦ Environmental Risk

Chapter 4 Business Risk Assessment