NOKIA最新风险管理.ppt

MikkoRouttiDirector,RiskManagementNokiaCorporation,RiskManagement,MainThemesofPresentation,scopeofpresentation:businessrisk(widely)ourphilosophyaboutriskmanagementwherewearetodayonthejourneyofERMhowtodothisinourorganisationbalancebetweenpractical,value-basedandanalytical,fact-basedthinkingwhatkindofmethodsandtoolsweuse(e.g)howdoweandotherscommunicateaboutthis,Itisonethingtosetupamathematicalmodelthatappearstoexplaineverything.Butwhenwefacethestruggleofdailylife,ofconstanttrialanderror,theabiguityofthefactsaswellasthepowerofthehumanheartbeatcanobliteratethemodelinshortorder.,PeterL.Bernstein:AgainsttheGods-TheRemarkablestoryofRisk,“Wearenotjustaddingalloftheseriskstogether.Wearecreatingaprobabilisticviewofhowmuchcapitalisactuallynecessary.”-RickBuy,ChiefRiskOfficer,Enron,“Wereviewhowgooditcanget,wereviewhowbaditcanget,andeveryplaceinbetween.”-RickCausey,EVPandChiefAccountingOfficer,Enron,Whatdoesriskappetitemeaninpractice?,Arewefocusingonopportunity?Isthereaclearviewoftheappetiteforrisk?Istherebalanceinrisksandrewards?(i.e.highrisksvslowrewards)Whereshouldmostofmanagementseffortbedirected?,AGenericBusinessRiskContinuum,Opportunity,Uncertainty,Hazard,ComplianceAndPrevention,OperatingPerformance,StrategicInitiatives,KeyQuestionstoConsider.,Environment,Healthresourcesused,mostoftenpersonneltime;costofdevelopment;productrequirements,whichcanincludebothfunctionalandotherqualitycharacteristics;resourceutilization;andtechnicalconstraints,suchashardwareplatforms,operatingsystemsanduseofparticularsoftwaretools.,GoalandStakeholderPriorities,PrioritiesforgoalsandstakeholdersaredefinedApproximateprioritiesareadequate,RiskIdentification,RiskidentificationrequiresanopenmindTeamworkandeffectivemeetingtechniquesarecriticalThereareseveralchecklistsavailablebutaretheygoodforyou?,IdentificationofpotentialthreatsNeedstobedonefrequentlyRequiresadifferentmentalattitude:notproblemsolvingbutfreeassociation,Techniques:brainstorming,checklists,questionnaires,historydata(lessonslearned,data),criticalpathanalysis,goalreview,RI:Checklistsvs.Brainstorming,ChecklistsProsFastandeasytouseStandardizeresultsCoverabroadareaMaypromptthinkingnewrisksConsCausefatigueDonotencouragecreativityMaybebiasedduetoadifferentdomainDonotencouragefindingsituationspecificrisks,BrainstormingProsFastandeasytouseLeverageslocalexpertiseandinsightKeepsparticipantsactiveDevelopscommitmentConsRequirefacilitationortrainingMeetingdynamicsmaybiasresultsDependentonparticipantsexperience,RiskAnalysis,Understanding(describing)risksRisktrackingtablesRiskinformationformsVisualizationofriskdependenciesRankingofrisksRiskexposure(I.e.,probability*loss)RiskreductionleverageUrgency,RiskAnalysis,RiskclusteringgroupandidentifyappropriatescenariosRiskscenariodevelopmentfillinriskinformationforms,orcompleteRiskitanalysisgraphsRiskprioritizationRankrisks,UnderstandingRisks:RiskTrackingTables,Itemsintrackingtablesmayinclude,IDAreaOriginDescriptionOwner/responsibleDateofmostrecentreviewProbabilityLossimpact,PrioritycurrentprevioustimeonthelistRiskstatusPotentialcontrollingactionsSelectedcontrollingactionsActionStatus,RiskDocumentationGuidelines,TemplatesstandardizecommunicationsUseanapproachthatmatchesyourneedsDevelopapathtorefinetheinformationyouoftenstartwithanabstractdescriptionandadddetailslaterDonotfillininformationthatyoudonotknow:emptyfieldsactasflagstoothersArchivepastdatausefulforlearningfromexperience,RiskPrioritization,Keyattributesinprioritization:Probabilityandlossdeterminehowsevere(=big)theriskisUrgencyindicateswhetheryoustillhavetimetowaitTwomainapproachesforrankingrisks:Expectedvalueofloss=prob(event)*loss(event)RankingthroughtablesordinalrankmultiplicationprearrangedrankingtablesforordinalprobabilityandlossestimatesriskfactorrankingtablesOrdinalscalerankingisadequate,whenusingRiskitParetorankingtechnique,ExpectedValue,SameasRiskExposure:probability*lossRisksthathavethehighestexpectedlossarehighestrisks,e.g.,tworisksthathavepotentialdelays:RiskA:20%*5months=1monthRiskB:50%*3months=1.5monthsRiskBisabiggerriskAcommonlyusedformulaforprioritizingrisks,EffectofNon-linearUtilityFunction,RiskA:2monthdelaywithprobabilityof10%RiskB:8monthdelaywithprobabilityof5%Expecteddelay:A:0.2monthsB:0.4months=controlriskBExpectedutilityloss:A:5UB:3U=controlriskA,Summary,DifferentrisksrequiredifferentattentionFocusonmostimportantoronareasofuncertaintyPrioritizationispronetoestimationbiasesSomeprioritizationmethodshavein-builtbiasesTransparencyandunderstandabilityofprioritizationisimportant:makesureyoucanexplaintheresultstoeverybody,ControllingActionsvs.Reactions,Riskcontrollingactionsareactionstakenbeforetheriskhasoccurred,I.e.,itisproactiveriskmanagementReactionsareactionsthatareperformedaftertheriskhasoccurredRiskmanagementisprimarilyconcernedwithriskcontrollingactions,DefiningRiskControllingActions,BrainstormingOpenorfocusedStrategiesChecklistsRiskelementreviewanalyzeriskelementstoidentifywhatactionscouldbetakenExperiencePersonalexperienceandinsights,AcceptanceAvoidanceProtectionReductionResearchReservesTransfer,RiskControlalternatives,NoriskreducingactionNoimmediateactionistaken,butsomemaybetakenatalatertimeContingencyplanningRecoveryplansaremade,butnofurtheractiontakenReducelossReferstoriskcontrollingactionsthatareusedtomitigatethedamagecausedbyriskRiskavoidanceReferstoactionsthatareaimedatavoidingrisksoccurringReduceeventprobabilityInfluencingriskfactorsandobservingriskmonitoringmetricstoreducetheeventprobability,SelectingRiskControllingActions,Controlhigh-riskscenariosEffectivenessofriskcontrollingactionProjectconstraintsStakeholderpriorityUrgencyofriskcontrollingaction,RiskMonitoringinPractice,DefineandcollectriskmetricswhenapplicableMonitoradditionallychangesinthesituationimpactofriskcontrollingactionspotentialnewthreatschangesinriskanalysisinputdataInitiateriskidentification,riskanalysisorriskcontrolplanningwhennecessary,BuildingupaRiskManagementSystem,Peopleandcompetencies,Process,Methods,Tools,Peopleandcompetenciesformthefoundationofriskmanagement,Processhelpsensuretheirskillsareappliedconsistently,Methodsassurethatriskmanagementisdonewell,Toolsincreaseproductivityandcansometimesdirectpeopleandprocesses,PeopleandCompetence,MotivationExplainwhyriskmanagementpaysoffAuthorizationGivepeoplepowertoperformriskmanagementSkills+knowledge+practice=competenceSupportin-houselearning,Process,MakesurethattheproductdevelopmentprocesshasexplicitpointswhereriskmanagementisaddressedProvidetemplatesforreportsDefinetheriskmanagementprocessanditsoutputsidentifyanalyzecontrolClarifyresponsibilities,Methods,Selectaportfolioofsoundandeasy-to-usemethodsStartsimpleandimproveasyoubecomemoreexperiencedBewareofthebiasesandproblemswiththemethodsyouareusingUsecommonsense-amethodcannotreplicateit,RequirementsforaRiskMgmtMethod,Consistencyofapplication:thereisadefined,repeatableprocess.Consistencyofresults:resultsfromindependentanalysesdonotdiffer.Usability:themethodiseasytolearn,operate,prepareinputfor,andtheoutputisunderstandable.Adaptability:thesystemcanbeappliedtodifferentprojectsandsituations.Completeness:considerationofallrelevantrelationshipsandelementsofriskisgiven.Validity:methodsresultsrepresentswelltherealrisksandsituation.Confidence:methodsoutputisbelievableandmethodusersbelieveinit.Traceability:themethoddocumentstheassumptionsandrationaleusedtoderiveconclusions.Communications:themethodsupportscommunicationaboutrisksbetweenpeopleandorganizations.Feasibility:therequireddataandtimeforapplyingthemethodareavailable.Efficiency:themethodproducesresultswithrelativelyloweffortandtime.Effectiveness:Themethodsresultsinfluencetheproject.Experiencecapture:themethodallowscaptureandanalysisofexperience.,Tools,ToolscanbebestleveragedwhentheorganizationtrulyunderstandsrisksandisfluentinriskmanagementToolcannotcompensateforlackofanalysisorunderstandingTheymayhidetherealissuesTheymaycreatefalseconfidenceIntroducetoolsgraduallyKeyissues:UsabilityTeamwork,ConclusionsonRiskManagementInfrastructure,DeployaportfoliooftechniquesBeawareofassumptionsandproblemswithvario