Risk management Methodology for Enterprise Risk Managenent

Enterprise risk management (ERM) is an organization-wide approach to identify, assess, prioritize, and manage risks that could impact its strategic objectives. It differs from traditional risk management by taking a holistic view of all potential risks, both internal and external, to support better decision-making, resource allocation, and the achievement of organizational goals.
Key components of an ERM program

Governance and Culture:
Establishing an organization-wide risk appetite, company culture, and governance structure.

Strategic Planning:
Aligning risk management with the company's strategic planning, objectives, and goals.
Risk Management Cycle:
A continuous process that includes:

Risk Identification: Recognizing potential risks.

Risk Assessment: Evaluating the likelihood and impact of identified risks.
Risk Response: Developing strategies to manage and mitigate risks.
Control Activities: Implementing and monitoring internal controls.

Monitoring and Continuous Improvement:
Regularly reviewing and adapting the ERM framework to new risks and changing circumstances.
Information, Communication, and Reporting:
Transparently communicating risk information throughout the organization.

Benefits of ERM

Better decision-making: Provides a structured understanding of both threats and opportunities.
Risk management Methodology

1. Risk Management
Presented by You Exec

2. Introduction I
Risk Management
Procedure III
Stakeholders Engagement II
Tools & Practices IV
Table of Contents
›Types of Risk
›Risk Categories
›Risk Identification
›Risk Planning
›Risk Identification
›Risk Assessment
›Risk Monitoring
›Risk Tracking
›Risk Appetite
›Risk Tolerance
›Impact &Probability Analysis
›Risk Mitigation Strategies
›Qualitative Analysis
›Quantitative Analysis

3. Introduction

4. Strategic
›Demand Shortfall
›Customer retention
›Integration problems
›Pricing pressure
›Industry downturn
›JV or partner losses
Operational
›Cost Overrun
›Operational Controls
›Capacity management
›Supply Chain Issues
›Employee Issues incl. fraud
›Bribery and Corruption
›Commodity prices
Hazard
›Macroeconomic
›Political Issues
›Legal Issues
›Terrorism
›Natural disasters
Financial
›Debt and interest rates
›Financial management
›Asset losses
›Goodwill and amortization
›Accounting problems
Types of Risks

5. External Risks
Internal Risks
Strategic Operational Enablers
Governance
Strategic Planning
Ethics & Values
Stakeholder Relations
Demand
Regulatory
Economical
Socio- Political
Environment
Access to Services
Processes
Business Interruption
Emergency Response
People
Financial
Technology
Infrastructure
Internal & External Risks

6. Product Performance
Design
Your text here
Your text here
Your text here
Data Accuracy
Security
Your text here
Your text here
Your text here
Assembly
Tools
Your text here
Your text here
Your text here
Consumer service
Environment
Your text here
Your text here
Your text here
Team work
Product cost
Your text here
Your text here
Your text here
Quality system
Sigma Levels
Your text here
Your text here
Your text here
QualityProject ManagementAll OtherManufacturingSystem/ SoftwareProduct Design
Risk Categories

7. Risk Score by Risk Category
Profitable Growth
Low Price
Develop New product
Leverage Technology
Risk level
Risk Category Financial Financial Operational Operational Strategic Strategic
Risk Sub Category Funding Capacity Capacity Availability
Customer
Retention
Demand
Shortfall
Likelihood 2 3 3 4 5 5
Identification of Risk Categories

8. High
This slide is 100% editable. Adapt
it to your needs and capture
your audience's attention.
Low
This slide is 100% editable. Adapt
it to your needs and capture
your audience's attention.
Medium
This slide is 100% editable. Adapt
it to your needs and capture
your audience's attention.
Risk Severity Dial

9. Stakeholders
Engagement

10. Likelihood
I
m
p
a
c
t
Within Risk Appetite
Exceeding Risk Appetite
L
o
w
M
e
d
iu
m
H
ig
h
Low Medium High
Obtain an estimate of the risk appetite of the
shareholders with the help of the below bar graph.
This will help in assessing the acceptable risk level
Risk Appetite

11. Insignificant
increase
<10% cost increase
10- 20% cost
increase
20- 25% cost
increase
> 25% cost increase
Insignificant fall
in schedule
<7% schedule
slippage
7-10% schedule
slippage
10-15% schedule
slippage
15-20% schedule
slippage
Insignificant scope
decrease
Minor areas of
scope affected
Major areas of
scope affected
Reduction
unacceptable
Project end item
is useless
Barely noticeable
degradation
Only demanding
applications are
affected
Reduction requires
approval
Reduction
unacceptable
Project end item
is unusable
Cost
Schedule
Scope
Quality
0.7 0.2 0.1 0.9 0.5
Very Low Very HighLow Moderate High
Risk Tolerance

12. Likelihood
I
m
p
a
c
t
Business continuity
problems Supplier default
Loss of key partnerships
IT problems
Poor project
management
Product or
service quality
Loss of key managers
Risk Tolerance

13. Risk Management
Procedure

14. Risk Tracking
Risk Planning
Risk Identification
Risk Register
Procedure for Managing Risks
Risk Assessment
Risk Monitoring

15. Low Med High
Very
High
Very
High
1 3 5 R
Show
stopper
High 5 5 15 25 O
Significant
risk
Med 3 3 9 15 Y
Proceed w/
caution
Low 1 1 3 5 G No concern
›Major uncertainties remain
›No or little prior experience or data
›Infrastructure and/or resources not in place
›Some uncertainties remain
›Some experience and data exist
›Infrastructure in place but under-resourced
›Few uncertainties remain
›Significant experience and data exist
›Infrastructure in place and fully
›Performance, quality, cost or safety impacts
resulting in major redesign and program delay
›Performance, quality, cost and/or safety
impacts resulting in minor redesign and
schedule adjustment
›Performance, quality, cost and safety
requirements met within planned schedule
High (5)
Medium (3)
Low (1)
Probability Impact Impact
Likelihood of Detection
A.Detectability is very high
B.Considerable warning of failure before occurrence
C.Some warning of failure before occurrence
D.Little warning of failure before occurrence
E.Detectability is effectively zero
Likelihood of OccurrenceConsequences
1.No. direct effect on operating service level
2.Minor deterioration in operating service level
3.Definite reduction in operating service level
4.Source deterioration in operating service level
5.Operating service level approaches zero
E. Probability of once in many years
D. Probability of once in many operating months
C. Probability of once in some operating weeks
B. Probability of weekly occurrence
A. Probability of daily occurrence
Risk Scoring System
Risk Assessment
Risk Rating Guide

16. Consequences
Likelihood
Insignificant Minor Moderate Major Catastrophic
1 2 3 4 5
- - - - -
- - - - -
- - - - -
- - - - -
A. Almost Certain
B. Likely
C. Possible
D. Unlikely
E. Rare - - - - -
Extreme Risk
Immediate Action where senior
management get involved
High Risk
Management responsibility
Should be specified
Moderate Risk
Managed by specific
responsible person
Low Risk
Managed by
routine process
Risk Assessment (Cont.)

17. Design
Lack of acceptance by
investor of design proposals
50k-500k
Market observation, alternative
designing solutions
Investor
Design
Delays and difficulties in
obtaining opinions and permits
500k-2m
Earlier diagnosis of the situation in local
authorities offices, organization of
meetings preceding designing process
Investor
Design
Conflict among designing
team members
50k-500k
Response of a team leader to all forms
of conflicts – mediation in a team
Designer Office
Design
Overly optimistic assessment
of employee workload
50k-500k
Proposing for employees to work
overtime or ordering of part of work to
another designing team
Designer Office
Design
Incorrect information from
investors and lack of clear
guidance
2m-5m
Application to investor for extension of
time to complete a design due to
additional circumstances
Investor
Time
Acceptance of unrealistic
deadlines in contact
2m-5m
Employment of new employees or
ordering part of work to another party
during a contract
Designer Office
Budget
Underestimation of
design budget
2m-5m
Limiting scope of design to
necessary minimum.
Investor
Type
of Risk
Description of
Risk
H M L
Risk Response
Strategy
Risk
Owner
Probability
Perf. Cost Time
Impact
Risk Register

18. Strategic risk
Performance
Deterioration
Proper assessment of
underlying strategies
2
Detailed
understanding
of the market
Your text here 31/4/2018
John
Smith
Strategic risk
Performance
Deterioration
Proper assessment of
underlying strategies
2
Detailed
understanding
of the market
Your text here 31/4/2018
John
Smith
Strategic risk
Performance
Deterioration
Proper assessment of
underlying strategies
2
Detailed
understanding
of the market
Your text here 31/4/2018
John
Smith
Strategic risk
Performance
Deterioration
Proper assessment of
underlying strategies
2
Detailed
understanding
of the market
Your text here 31/4/2018
John
Smith
Type of
Risk
Outcome
Existing risk treatment
actions in place
Rating
Additional
Resources
Target Date
Person
Responsible
Proposed risk
treatment actions to
mitigate risk
Risk Management Plan

19. Risk Identification
›Schedule overruns
›Tasks omitted from Schedule
›Opportunity to compress
Schedule
Time Cost
›Budget Exceeded
›Unanticipated
›Expenditure
Resources
›Team is under-resourced
›Materials shortage
›Machinery unavailable
›Industrial Action
›Skills gap
Environmental
›Bad weather results in re-work
›Weather delays progress
›Adverse effects occur
›Environmental approvals not
complied with
Scope
›Scope creep
›Scope poorly defined
›Project changes poorly
managed
Communication
›Poor communication
(Stakeholder dissatisfaction)
›Positive & timely
communications (positive
publicity)
Identify
Risks

20. 5 days
After five days no way to schedule
production or track orders
No UPS/ generator,
MD hardware, SPOF SME
Use paper reports for 5 days
then go manual for as many
members as possible
0 days
No production, potential for
bankruptcy, IT non- existent
Metal building, flood zone,
poor maintenance, no perimeter
security, door lock broken
Look for warehouse space,
attempt to salvage
equipment and restart
operation, file bankruptcy
0 days
Degraded operations,
low service levels
Too many SPOF
Best effort shifting of
available staff, temps
30 days before
new deliveries
None until on hard exhausted Single supplier relationship Search for alternatives supplier
30 days in
2 days out
No suppliers, No deliveries Location, design of entrance None
0 hours/power
0 hours/water
Extrusion shuts down, lines cleaned,
waste collected and prepared for
grinder, IT non-existent
Single power feed, no generator
or backup water supply
None
4 hours No call center Mercy of vendor Being in-house
How Long Can You
Do Without?
Impact of Doing Without? Vulnerabilities?
Contingency in case
of a disaster?
Utilities
Equipment
(IT only)
Facility
Personnel
Transportation
System
Vendors
(Sourcing)
Raw Materials
Risk Identification

21. Step 1: Consider
Extreme
Critical
Major
Minor
Regulatory
Non
compliance
Major non
compliance
Warning
Minor non
compliance
What is the consequence of the hazard occurring. Consider
what is the most possible consequence with respect to work
Safety at work
Sickness
Casualty
First aid
Medical
treatment
Step 3: Calculation Risk
1.Take Step 1 rating and select correct column
2.2. Take Step 2 rating and select correct row
3.3. Use the risk score where the two ratings cross on the
matrix below.
H = High, S = Serious, M = Medium, L = Low
Step 2: Consider Likelihood
What is the likelihood of the hazard consequences occurring
in Step1
Almost Is expected to occur in most
Certain Circumstances (once per year)
Likely Will probably occur once (every 5 year)
Possible Event might occur at some time (10years)
Unlikely/
Rare
Event expected to occur only in
exceptional circumstances (20+ years)
L
ik
e
lih
o
o
d
Description of Risk
Risk Analysis
C L Risk Rating
Control Measures
(Detail any existing Controls)
C L Risk Rating
Risk Analysis (with additional controls)Additional Control
(Detail additional to be
implemented Controls)
Risk Analysis – Complex
Min Maj Crit Ext
Almost Certain S(A4) S(A3) H(A2) H(A1)
Likely M(B4) S(B3) H(B2) H(B1)
Possible L(C4) M(C3) S(C2) S(C1)
Unlikely Rare L (D4) M(D3) M(D2) S(D1)

22. 10 10 100
8 9 72
9 6 54
7 7 49
4 8 32
2 10 20
New operating system may be unstable
Communication problems over system issues
We may not have the right requirements
Requirements may change late in the cycle
Database software may arrive late
Key people might leave
Likelihood of Risk
Item Occurring
Impact to
Project if Risk
Item Does Occur
Priority
(Likelihood *
Impact)
Risk Items (Potential Future Problems
Derived from Brainstorming)
Risk Analysis – Simplified

23. Medium Risk
Low Risk
High Risk
Medium Risk
Low Risk
Low Risk
High Risk
Risk Matrix
Use the Risk Matrix during risk
assessment to define the level of
risk by considering the category of
probability or likelihood against
the category of consequence
severity. This is a simple
mechanism to increase visibility of
risks and assist management
decision making.
R
a
r
e
P
o
s
s
ib
le
A
lm
o
s
t

C
e
r
t
a
in
High Risk
Medium Risk
Insignificant Moderate Significant

24. Interface Problems
Mitigate: Test prototype Work around until
help comes
Not solved within 24 hours John
System Freezing
Mitigate: Test prototype
Reinstall OS Still frozen after one hour Louise
User Backlash
Mitigate: Test Demonstration
Increase Staff Support Call from top management Helen
Hardware Malfunctioning
Mitigate: Select Reliable Vendor
Transfer: Warranty
Order replacement Equipment fails Tom
Risk Event Response Contingency Plan Trigger
Who is
responsible
Risk Response Matrix

25. ID
Description
of Risk
Impact Risk Response Risk Level Risk Owner Notes
1 Supplier Delay Pushes Launch
Confirm delivery dates
by Phase 2
High John Add notes here
2 Factory Availability Cost Overruns Stakeholder trip to China High Dave Add notes here
3
Steering Committee
Unavailable
Delay Launch
Marketing
Define Marketing
Plans in March
Low Carey Add notes here
4
5
6
7
8
9
10
11
Risk Tracker

26. 1 2 4
2 3 3
3 1 2
4 4 3
5 5 3
Inadequate Planning
Poor Definition of Scope
Absence of leadership
Poor Cost Estimates
Poor time Estimates
Risk Items
Working on revising the entire project plan
Holding meetings with project customer
and sponsor to clarify scope
Just assigned a new project manager to
lead the project after old one quit
Revisiting cost estimates
Revisiting schedule estimates
Risk Resolution
This Month Last Month # of Months
Monthly Ranking
Risk Item Tracking

27. Tools & Practices

28. Tools & Practices
Qualitative
Analysis
Quantitative
Analysis
Impact &
Probability
Analysis
Risk Mitigation
Strategies

29. Manageable by exchange
against Internal budgets
Increases threaten
viability of project
Require some additional
funding from Institution
Requires Significant additional
funding from Institution
Requires Significant
reallocation of Institutional
funds (or borrowing)
Slight slippage against
internal targets
Delay jeopardizes
viability of project
Slight slippage against key
milestones or published targets
Delay affects key stakeholders –
loss of confidence in the project
Failure to meet key deadlines
in relation to academic year
or strategic plan
Slight reduction in quality/scope,
no overall impact
Project outcomes
effectively unusable
Failure to include certain
‘nice to have’ elements
Significant elements of scope for
functionality will be unavailable.
Failure to meet the needs of a
large proportion of stakeholders
Cost Time Quality
Very Low
Very High
Low
Medium
High
Impact
Risk Impact & Probability Analysis

30. Technical Risks
•Emphasize team support and avoid stand-alone
project Structure
•Increase project manager authority
•Improve problem handling and communication
•Increase the frequency of project monitoring
Cost Risks
•Increase frequency of project monitoring
•Improve communication, project goals
understanding, and team support
•Increase project manager authority
Schedule Risks
•Increase the frequency of project monitoring
•Select the most experienced project manager
3
2
1
Risk Mitigation Strategies

31. Risk Mitigation Plan
Client Management
Identified Risk
Miscommunication with sponsor
or client regarding project
requirement and expectations
Server
Identified Risk
Server is down which causes
project to be slightly delayed due
to application not able to load
Technical
Identified Risk
Popular web browsers may get
an update that will discontinue support
for features used in our development
as we using responsive bootstrap.
Update client more
frequently along the way
with project progress
Perform periodical
check on server status
Monitor any updates on
popular web browser
and / or bootstrap and
make sure all UI design
works as intended on
updated web browsers or
responsive bootstrap

32. (81-100)%
Low
Risk
Moderate
Risk
High
Risk
Extreme Risk Extreme Risk
(61-80)% Minimum Risk
Low
Risk
Moderate
Risk
High
Risk
Extreme Risk
(41-60)% Minimum Risk
Low
Risk
Moderate
Risk
High
Risk
High
Risk
(21-40)% Minimum Risk
Low
Risk
Low
Risk
Moderate
Risk
High
Risk
(1-20)% Minimum Risk Minimum Risk
Low
Risk
Moderate
Risk
High
Risk
Impact 1 2 3 4 5
Probability Negligible Minor Moderate Significant Severe
Project Risk (Threat & Opportunity) Matrix: Any Risk with a probability of over 80% will be treated as a fact and will be addressed in the Project
Management Plan and not in Risk management. Risk Threshold( which risks move forward) in the process and which one will be
Qualitative Risk Analysis

33. Cost Risk

Insufficient funds to
support the bid
ABC 5/31 Cost High .80 4 3.20
Find a partner to
help share costs
Borrow money from
the bank or investor
to fund the effort
Schedule Risk
Insufficient resources
to finish work on time
BMC 6/1 Sched. Low .55 4 2.20
Borrow additional
proposal staff from
another division
Hire additional
proposal staff or
consultants
Risk Score = Probability * Impact
Risk Score values are between
1-4 (with 4 being the highest risk) or red, yellow, green, blue.
Risk Probability values are between
0.1 (Remote Chance) – 1.0 (Certain)
Risk Impact values are between
1 (insignificant) - 4 (Unable to meet objectives)
Risk Title &
Description
Resp.
Due
Date
Cat. Rating Prob. Impact
Total
Score
Mitigation
Actions
Contingency
Plan
Quantitative Risk Analysis