Preparation of a Risk Register
Preparation of a Risk Register
A risk register is defined in the ISO Guide 73 as the “document used for recording
risk management
process
for identified
risks”. The end result of the risk assessment process is duly completed risk identification and analysis sheets
that contains more detailed information relating to each risk identified and analyzed.
The purpose
of the risk register
is to facilitate ownership and
management of each risk. Typically, the risk register covers the significant risks facing the organization or the
project. It will record
the results of the risk assessment related to the
process, operation, location, business
unit or project under consideration.
All sheets should be summarized in a single spread-sheet called the Risk Register Most of the information needed to complete the register is already completed in the risk
identification and analysis sheets.
The risk identification and analysis sheets become attachments
to the register to provide more information.
Development and Implementation of
Risk Treatment Action Plans
Risk treatment involves identifying the range of options for risks, assessing
these options and the preparation
and implementation of treatment plans. A key outcome of the risk evaluation process is a list of those risks requiring further treatment, as determined by
the overall level of the risk against the organization’s risk tolerance levels. However, not all risks with require treatment as some may be accepted by the organization and
only
require occasional monitoring throughout the period.
The risks that fall outside of the organization’s risk tolerance levels are those which pose a
significant potential
impact
on the ability of the organization to achieve set objectives. The
purpose of treating risks is to minimize or eliminate the potential impact the risk may
pose to the achievement of set
objectives.
Treating risks involves
the
following key steps, each of which are covered in detail
in this section:
a)
Identify risk
treatment options,
b)
Conduct
a cost-benefit
analysis,
c)
Assign risk ownership,
d)
Prepare
risk treatment plans,
e)
Identify risk treatment
options.
Each of these steps
is explained below:
Identify risk treatment
options
Risk treatment design should be based on a comprehensive understanding of how
risks arise. This includes understanding not only the immediate causes of an event but also the
underlying factors that influence whether the proposed treatment will
be effective.
The following
are
the common treatment
options available;
Ø Avoid (also Terminate) the risk
– change the business process or objective so as to
avoid the risk,
Ø Change the likelihood (also Treat) – undertake actions aimed at reducing the
probability of
the risk occurring,
Ø Change the consequence (also Treat) – undertake actions aimed at reducing the impact of the risk,
Ø Share (also
Transfer) the risk
–
transfer the ownership and liability to a third party(e.g.
insurance),
Ø
|
Conduct a cost-benefit analysis
Consideration should be given to the cost of the treatment as compared to the likely
risk reduction that will result.
For
example, if the only
available treatment option would cost in excess of $100 to implement and the cost impact of the risk is only $50, it may
not be advisable. In order to understand the costs and benefits associated with each risk treatment
option, it is necessary to conduct a cost-benefit analysis as
follows;
Ø Define, or breakdown the risk into its elements by drawing up a flowchart or list of inputs, outputs, activities and
events,
Ø Calculate, research or estimate the cost and benefit associated with each
(include if possible direct,
indirect, financial and
social
costs and benefits)
Ø Compare the
sum of the costs with the sum
of the benefits.
Assign risk ownership
Allocate responsibility to risks according to the nature/category of
the risks and action needed to take treatment plans. The risk owner nominated assumes responsibility for developing and completing
effective Risk
Treatment Action-plans. The risk owner should be
a senior staff member or
manager with sufficient technical knowledge about the risk and/or risk
area for
which
treatment is required.
The risk owner may
delegate responsibility (but not accountability) to his/her subordinates.
Table below presents an example on how to assign risk ownership to different levels of management,
depending
on risk category:
Table : Example on Assigning Risk Ownership
|
Risk type
|
Risk owner
|
|
Strategic
|
Accounting Officer
|
|
Human resources
|
Director
of Human Resource
and Administration
|
|
Finance/Budget
|
Chief
Accountant
|
|
Health
and Safety
|
Director
of Human Resource
and Administration
|
|
Reputational
|
Accounting Officer/ Public Relations Officer
|
|
IT and Systems
|
IT Manager
|
Complete Risk
Treatment Action Plans
The
successful implementation of the risk treatment require an effective management
system that specified the
methods chosen, assign responsibilities and individual accountabilities for
actions, allocate
resources to risk treatments, and monitor them against specified criteria.
Linking the risk treatment option with daily implementation
of strategic/operational
activities will maximize the potential for curbing the risks identified.
Comments
Post a Comment