风险管理流程PPT课件

-,1,TheRiskManagementProcess,PreparedBy:RusulM.KanonaSupervisedBy:Dr.LoaiA.TawalbehArabAcademyforBanking&FinancialSciences(AABFS)Fall2007,-,2,WhatistheRiskManagementprocess?,TheRiskManagementProcessconsistsofaseriesofstepsthat,whenundertakeninsequence,enablecontinualimprovementindecision-making.,-,3,StepsoftheRiskManagementProcess?Step1.Communicateandconsult.Step2.Establishthecontext.Step3.Identifytherisks.Step4.Analyzetherisks.Step5.Evaluatetherisks.Step6.Treattherisks.Step7.Monitorandreview.,-,4,-,5,Step1.Communicateandconsult,-Communicationandconsultationaimstoidentifywhoshouldbeinvolvedinassessmentofrisk(includingidentification,analysisandevaluation)anditshouldengagethosewhowillbeinvolvedinthetreatment,monitoringandreviewofrisk.,-,6,-Assuch,communicationandconsultationwillbereflectedineachstepoftheprocessdescribedhere.-Asaninitialstep,therearetwomainaspectsthatshouldbeidentifiedinordertoestablishtherequirementsfortheremainderoftheprocess.-Thesearecommunicationandconsultationaimedat:A-ElicitingriskinformationB-Managingstakeholderperceptionsformanagementofrisk.,-,7,A-Elicitingriskinformation-Communicationandconsultationmayoccurwithintheorganizationorbetweentheorganizationanditsstakeholders.-Itisveryrarethatonlyonepersonwillholdalltheinformationneededtoidentifytheriskstoabusinessoreventoanactivityorproject.-Itthereforeimportanttoidentifytherangeofstakeholderswhowillassistinmakingthisinformationcomplete.,-,8,B-Managingstakeholderperceptionsformanagementofrisk,-,9,Tipsforeffectivecommunicationandconsultation,Determineattheoutsetwhetheracommunicationstrategyand/orplanisrequiredDeterminethebestmethodormediaforcommunicationandconsultationThesignificanceorcomplexityoftheissueoractivityinquestioncanbeusedasaguideastohowmuchcommunicationandconsultationisrequired:themorecomplexandsignificanttotheorganization,themoredetailedandcomprehensivetherequirement.,-,10,Step2.Establishthecontext,providesafive-stepprocesstoassistwithestablishingthecontextwithinwhichriskwillbeidentified.1-Establishtheinternalcontext2-Establishtheexternalcontext3-Establishtheriskmanagementcontext4-Developriskcriteria5-Definethestructureforriskanalysis,-,11,1-Establishtheinternalcontext-Aspreviouslydiscussed,riskisthechanceofsomethinghappeningthatwillimpactonobjectives.Assuch,theobjectivesandgoalsofabusiness,projectoractivitymustfirstbeidentifiedtoensurethatallsignificantrisksareunderstood.Thisensuresthatriskdecisionsalwayssupportthebroadergoalsandobjectivesofthebusiness.Thisapproachencourageslong-termandstrategicthinking.,-,12,Inestablishingtheinternalcontext,thebusinessownermayalsoaskthemselvesthefollowingquestions:-Isthereaninternalculturethatneedstobeconsidered?Forexample,arestaffResistanttochange?Isthereaprofessionalculturethatmightcreateunnecessaryrisksforthebusiness?-Whatstaffgroupsarepresent?-Whatcapabilitiesdoesthebusinesshaveintermsofpeople,systems,processes,equipmentandotherresources?,-,13,2.Establishtheexternalcontext,Thisstepdefinestheoverallenvironmentinwhichabusinessoperatesandincludesanunderstandingoftheclientsorcustomersperceptionsofthebusiness.Ananalysisofthesefactorswillidentifythestrengths,weaknesses,opportunitiesandthreatstothebusinessintheexternalenvironment.,-,14,Abusinessownermayaskthefollowingquestionswhendeterminingtheexternalcontext:Whatregulationsandlegislationmustthebusinesscomplywith?Arethereanyotherrequirementsthebusinessneedstocomplywith?Whatisthemarketwithinwhichthebusinessoperates?Whoarethecompetitors?Arethereanysocial,culturalorpoliticalissuesthatneedtobeconsidered?,-,15,Tipsforestablishinginternalandexternalcontexts-Determinethesignificanceoftheactivityinachievingtheorganizationsgoalsandobjectives-Definetheoperatingenvironment-Identifyinternalandexternalstakeholdersanddeterminetheirinvolvementintheriskmanagementprocess.,-,16,3-Establishtheriskmanagementcontext,-Beforebeginningariskidentificationexercise,itisimportanttodefinethelimits,objectivesandscopeoftheactivityorissueunderexamination.-Forexample,inconductingariskanalysisforanewproject,suchastheintroductionofanewpieceofequipmentoranewproductline,itisimportanttoclearlyidentifytheparametersforthisactivitytoensurethatallsignificantrisksareidentified.,-,17,TipsforestablishingtheriskmanagementcontextDefinetheobjectivesoftheactivity,taskorfunctionIdentifyanylegislation,regulations,policies,standardsandoperatingproceduresthatneedtobecompliedwithDecideonthedepthofanalysisrequiredandallocateresourcesaccordinglyDecidewhattheoutputoftheprocesswillbe,e.g.ariskassessment,jobsafetyanalysisoraboardpresentation.Theoutputwilldeterminethemostappropriatestructureandtypeofdocumentation.,-,18,4.DevelopriskcriteriaRiskcriteriaallowabusinesstoclearlydefineunacceptablelevelsofrisk.Conversely,riskcriteriamayincludetheacceptablelevelofriskforaspecificactivityorevent.Inthissteptheriskcriteriamaybebroadlydefinedandthenfurtherrefinedlaterintheriskmanagementprocess.,-,19,TipsfordevelopingriskcriteriaDecideordefinetheacceptablelevelofriskforeachactivityDeterminewhatisunacceptableClearlyidentifywhoisresponsibleforacceptingriskandatwhatlevel.,-,20,5.Definethestructureforriskanalysis,Isolatethecategoriesofriskthatyouwanttomanage.Thiswillprovidegreaterdepthandaccuracyinidentifyingsignificantrisks.Thechosenstructureforriskanalysiswilldependuponthetypeofactivityorissue,itscomplexityandthecontextoftherisks.,-,21,Step3.Identifytherisks,Riskcannotbemanagedunlessitisfirstidentified.Oncethecontextofthebusinesshasbeendefined,thenextstepistoutilizetheinformationtoidentifyasmanyrisksaspossible.,-,22,Theaimofriskidentificationistoidentifypossiblerisksthatmayaffect,eithernegativelyorpositively,theobjectivesofthebusinessandtheactivityunderanalysis.Answeringthefollowingquestionsidentifiestherisk:,-,23,Therearetwomainwaystoidentifyrisk:1-IdentifyingretrospectiverisksRetrospectiverisksarethosethathavepreviouslyoccurred,suchasincidentsoraccidents.Retrospectiveriskidentificationisoftenthemostcommonwaytoidentifyrisk,andtheeasiest.Itseasiertobelievesomethingifithashappenedbefore.Itisalsoeasiertoquantifyitsimpactandtoseethedamageithascaused.,-,24,Therearemanysourcesofinformationaboutretrospectiverisk.Theseinclude:HazardorincidentlogsorregistersAuditreportsCustomercomplaintsAccreditationdocumentsandreportsPaststafforclientsurveysNewspapersorprofessionalmedia,suchasjournalsorwebsites.,-,25,2-IdentifyingprospectiverisksProspectiverisksareoftenhardertoidentify.Thesearethingsthathavenotyethappened,butmighthappensometimeinthefuture.Identificationshouldincludeallrisks,whetherornottheyarecurrentlybeingmanaged.Therationalehereistorecordallsignificantrisksandmonitororreviewtheeffectivenessoftheircontrol.,-,26,Methodsforidentifyingprospectiverisksinclude:BrainstormingwithstafforexternalstakeholdersResearchingtheeconomic,political,legislativeandoperatingenvironmentConductinginterviewswithrelevantpeopleand/ororganizationsUndertakingsurveysofstafforclientstoidentifyanticipatedissuesorproblemsFlowchartingaprocessReviewingsystemdesignorpreparingsystemanalysistechniques.,-,27,Tipsforeffectiveriskidentification,SelectariskidentificationmethodologyappropriatetothetypeofriskandthenatureoftheactivityInvolvetherightpeopleinriskidentificationactivitiesTakealifecycleapproachtoriskidentificationanddeterminehowriskschangeandevolvethroughoutthiscycle.,-,28,Step4.Analyzetherisks,Duringtheriskidentificationstep,abusinessownermayhaveidentifiedmanyrisksanditisoftennotpossibletotrytoaddressallthoseidentified.Theriskanalysisstepwillassistindeterminingwhichriskshaveagreaterconsequenceorimpactthanothers.,-,29,Whatisriskanalysis?Riskanalysisinvolvescombiningthepossibleconsequences,orimpact,ofanevent,withthelikelihoodofthateventoccurring.Theresultisalevelofrisk.Thatis:Risk=consequencexlikelihood,-,30,ElementsofriskanalysisTheelementsofriskanalysisareasfollows:1.Identifyexistingstrategiesandcontrolsthatacttominimizenegativeriskandenhanceopportunities.2.Determinetheconsequencesofanegativeimpactoranopportunity(thesemaybepositiveornegative).3.Determinethelikelihoodofanegativeconsequenceoranopportunity.4.Estimatethelevelofriskbycombiningconsequenceandlikelihood.5.Considerandidentifyanyuncertaintiesintheestimates.,-,31,TypesofanalysisThreecategoriesortypesofanalysiscanbeusedtodeterminelevelofrisk:QualitativeSemi-quantitativeQuantitative.-Themostcommontypeofriskanalysisisthequalitativemethod.Thetypeofanalysischosenwillbebasedupontheareaofriskbeinganalyzed.,-,32,TipsforeffectiveriskanalysisRiskanalysisisusuallydoneinthecontextofexistingcontrolstakethetimetoidentifythemTheriskanalysismethodologyselectedshould,wherepossible,becomparabletothesignificanceandcomplexityoftheriskbeinganalyzed,i.e.thehigherthepotentialconsequencethemorerigorousthemethodologyRiskanalysistoolsaredesignedtohelprankorprioritiesrisks.Todothistheymustbedesignedforthespecificcontextandtheriskdimensionunderanalysis.,-,33,Step5.Evaluatetherisks,Riskevaluationinvolvescomparingthelevelofriskfoundduringtheanalysisprocesswithpreviouslyestablishedriskcriteria,anddecidingwhethertheserisksrequiretreatment.Theresultofariskevaluationisaprioritizedlistofrisksthatrequirefurtheraction.Thisstepisaboutdecidingwhetherrisksareacceptableorneedtreatment.,-,34,RiskacceptanceAriskmaybeacceptedforthefollowingreasons:Thecostoftreatmentfarexceedsthebenefit,sothatacceptanceistheonlyoption(appliesparticularlytolowerrankedrisks)TheleveloftheriskissolowthatspecifictreatmentisnotappropriatewithavailableresourcesTheopportunitiespresentedoutweighthethreatstosuchadegreethattherisksjustifiedTheriskissuchthatthereisnotreatmentavailable,forexampletheriskthatthebusinessmaysufferstormdamage.,-,35,Step6.Treattherisks,RisktreatmentisaboutconsideringoptionsfortreatingrisksthatwerenotconsideredacceptableortolerableatStep5.Risktreatmentinvolvesidentifyingoptionsfortreatingorcontrollingrisk,inordertoeitherreduceoreliminatenegativeconsequences,ortoreducethelikelihoodofanadverseoccurrence.Risktreatmentshouldalsoaimtoenhancepositiveoutcomes.,-,36,Optionsforrisktreatment:identifiesthefollowingoptionsthatmayassistintheminimizationofnegativeriskoranincreaseintheimpactofpositiverisk.1-Avoidtherisk2-Changethelikelihoodoftheoccurrence3-Changetheconse