Risk Management - ACostE

Kate Boothroyd FIRMDirector, KB Risk Consulting Limited

Provide education and training for professionals in risk management

Promote technical and ethical good practice in risk management

Provide a professional support network for those working in risk management

What does the IRM do exactly?

2700 members worldwide

IRM – Levels of Membership

Member

Specialist Member

Certificant Member

Affiliate

FIRM

SIRM

CIRM

Fellow

MIRM

What is risk and risk management?

• Risk can be defined as the combination of the probability of an event and its consequences

(ISO/IEC Guide 73)• In all types of undertaking, there is the potential for events

and consequences that constitute opportunities for benefit (upside) or threats to success (downside).

• Risk Management is increasingly recognised as being concerned with both positive and negative aspects of risk.

(IRM Risk Standard 2002)

The Risk Management Process

7

Why Is It Used?

• Key tool towards delivering your business/project objectives successfully

• Greater awareness of the key risks – fewer surprises• Intelligent allocation of risk• Aid decision making process• Common sense• Changing market • Mandatory procedures• Corporate governance - Stock Exchange Listing Rules / good

business practice

What is most of interest to ACostE?

• Not just identification of risks – both threats and opportunities• Better understanding of objectives – what’s important• Planning for risk management so appropriate resources and

approach in place• Assessment

– Qualitative– Quantitative - cost and time modelling through life

• Responses appropriately accounted for• Monitoring and reviewing – end life forecasting

Qualitative assessment

Consider both threat and opportunity

Threats

Very High

High

Medium

Low

Very Low

Impact/Threats

1 2 3 4 5

Impact/Opportunities

5

4

3

2

1

-5 -4 -3 -2 -1

Pro

ba

bil

ity

Very High

High

Medium

Low

Very Low

Opportunities

Quantitative assessment

• Aims to:• Quantify the effect of risks• Predict likely project outcomes• Identify options

• how to respond• Balance response against potential cost• Focus management attention

• priority areas

Contingency is usually arrived from the combination of the following two forms: -

– Estimating Uncertainty: uncertainty associated with possible performance for project or operational work scope in terms of cost and schedule duration.

– Discrete risk: an event, circumstance or condition that may or may not occur, which could influence delivery of project or operational work scope

Contingency

Draw Up Base Programme and Estimate• Establish the base programme and estimate before risk

assessment• All impact assessments must reflect the current baseline

• Assumptions, exclusions, allowances• Constraints

• Note that part of a risk may already be covered within a base estimate or programme

• Response strategies / mitigation actions must be reflected in the base plan – this provides funding for risks should they impact.

• Must map discrete risks across correctly to the base plan – not all risks span all phases

• If this is not done correctly in development of the proposal then funding for the Project will be incorrect

Caveats

• May not be required, appropriate or affordable• Most useful when most difficult• Difficulty in estimating uncertainty• Wags and swags• Not all risks need to be priced in a contingency - probably 80%

can be managed, often by processes that are already in place• Risk management is NOT there to price you out of every project• It should give you the information to help you decide:

• How much to include to pay for the risks you are expected to take

• How much to include in the base plan for management actions

• Whether you want to submit a proposal for the job at all!

Summary

• Recognise the need to ensure that it is fit for purpose• Recognise some of the peculiarities in implementation in different

industries• Remember that it is one tool of many in the management toolbox• Understand that risk management isn’t there to price you out of

every project• Ensure the right people have been involved in the process• Ensure the process has been handed over properly at each stage• Ensure the process is resourced properly from start to finish• Remember that risk management is there to help you make better

decisions, so ensure you use it in the decision making process• Remember that if the process is paid lip service to, it will fail!

www.theirm.org

enquiries@theirm.org