What is risk management?
Explore IBM's risk management solution
Subscribe to Security Topic Updates
What is risk management? ↑
S
The risk management process
Risk response strategies and treatment
Limitations and risk management standards
Related solutions
Resources
Take the next step
What is risk management?
Risk management is the process of identifying, assessing and
- -
controlling
-
financial, legal, strategic and security risks to an
organization’s capital and earnings. These threats, or risks, could stem
-
from a wide variety of sources, including financial uncertainty, legal
-
liabilities, strategic management errors, accidents and natural
-
disasters.
-
Why is risk management important?
If an unforeseen event catches your organization unaware, the impact could be minor, such as a small impact on your overhead costs. In a
worst-case scenario, though, it could be catastrophic and have serious ramifications, such as a significant financial burden or even the
closure of your business.
To reduce risk, an organization needs to apply resources to minimize, monitor and control the impact of negative events while maximizing
positive events. A consistent, systemic and integrated approach to risk management can help determine how best to identify, manage and
mitigate significant risks.
Report
Cost of a Data Breach
Get insights to better manage the risk of a data breach with the latest Cost of a Data
Breach report.
[
Related content
Register for the X-Force Threat Intelligence Index
⑨ Review the results
The risk management process Review
·
of results
At the broadest level, risk management is a system of people,
produced by implement
processes and technology that enables an organization to establish
objectives in line with values and risks.
-ing the technique/
A successful risk assessment program must meet legal, contractual, process of risk
internal, social and ethical goals, as well as monitor new technology- met.
related regulations. By focusing attention on risk and committing the
necessary resources to control and mitigate risk, a business protects
itself from uncertainty, reduce costs and increase the likelihood of
business continuity and success.
Three important steps of the risk management process are risk
identification, risk analysis and assessment, and risk mitigation and
monitoring.
Identifying risks
Risk identification is the process of identifying and assessing threats to an organization, its operations and its workforce. For example, risk
identification can include assessing IT security threats such as malware and ransomware, accidents, natural disasters and other
potentially harmful events that could disrupt business operations.
-asselling probability of risk which
Risk analysis and assessment can
occur its outcome
Risk analysis involves establishing the probability that a risk event might occur and the potential outcome of each event. Risk evaluation
compares the magnitude of each risk and ranks them according to prominence and consequence.
response of
process
in
the
implementriskthat may happen
.
X proces regularly
Risk mitigation and monitoring check the
-
=> to business
Risk mitigation refers to the process of planning and developing methods and options to reduce threats to project
=> objectives. A project
team might implement risk mitigation strategies to identify, monitor and evaluate risks and consequences inherent to completing a
specific project, such as new product creation. Risk mitigation also includes the actions put into place to deal with issues and effects of
those issues regarding a project.
Risk management is a nonstop process that adapts and changes over time. Repeating and continually monitoring the processes can help
assure maximum coverage of known and unknown risks.
Risk response strategies and treatment
un
num
There are five commonly accepted strategies for addressing risk. The process begins with an initial
·
consideration of risk avoidance then proceeds to 3 additional avenues of addressing risk (transfer,
spreading and reduction). Ideally, these three avenues are employed in concert with one another as
part of a comprehensive strategy. Some residual risk may remain.
What are the most common responses to risk?
Risk avoidance
Avoidance is a method for mitigating risk by not participating in activities that may negatively affect the organization. Not making an
investment or starting a product line are examples of such activities as they avoid the risk of loss.
Risk reduction
This method of risk management attempts to minimize the loss, rather than completely eliminate it. While accepting the risk, it stays
focused on keeping the loss contained and preventing it from spreading. An example of this in health insurance is preventive care.
Risk sharing
When risks are shared, the possibility of loss is transferred from the individual to the group. A corporation is a good example of risk sharing
—several investors pool their capital and each only bears a portion of the risk that the enterprise may fail.
Transferring risk
Contractually transferring a risk to a third-party, such as, insurance to cover possible property damage or injury shifts the risks associated
with the property from the owner to the insurance company.
Risk acceptance and retention
After all risk sharing, risk transfer and risk reduction measures have been implemented, some risk will remain since it is virtually
impossible to eliminate all risk (except through risk avoidance). This is called residual risk.
Limitations and risk management
standards
Risk management standards set out a specific set of strategic processes that start with the objectives of an organization and intend to
identify risks and promote the mitigation of risks through best practice.
Standards are often designed by agencies who are working together to promote common goals, to help to ensure high-quality risk
management processes. For example, the ISO 31 000 standard on risk management is an international standard that provides principles
and guidelines for effective risk management.
While adopting a risk management standard has its advantages, it is not without challenges. The new standard might not easily fit into
what you are doing already, so you could have to introduce new ways of working. And the standards might need customizing to your
