• Home
• News
• Sharing Best Practice
• Members
• What is Risk Management
• About Us
• Contact Us

• Process of Risk Management |
• Legislation

What is Risk Management

WHAT IS RISK MANAGEMENT?

"Risk" is a commonly used word with a meaning that continues to evolve.  The first international standard (published in 2009) on risk management ( ISO 31000) defines risk as  "the effect of uncertainty on objectives".

The change in definition,  from that in NZS 4360 to ISO 31000,  shifts the emphasis from "the event" (something happens) to "the effect" which is the effect of the event on objectives. So, the "risk" isn't the chance of having a fire (for example) but the chance that value will be destroyed and or income flow disrupted (assuming preserving value and income flow was part of the objective).

From both definitions, it can be seen that risk is particular to the objectives of the individual, organisation (or even society at large) and that it arises because those objectives are pursued against an uncertain background. Although the individual or organisation controls their objectives, they cannot fully control or predict the background environment in which they operate and it is this, the background environment, overlaid on the particular objectives, which generates uncertainty and thus risk.

Because risk is directly linked to objectives, it is obvious that risk is not inherently "bad". Many objectives can only be achieved by being willing to accept at least some risk. If risk can be managed effectively, opportunities can be exploited.

Risk is generated by every decision that is made by an individual, organisation or society - small wonder that it is beneficial for individuals, organisations and governments to become increasingly proficient at understanding risks and knowing whether, how and when to "treat" those risks in order to improve the chance of realising objectives.

Risk may be characterised by describing both the effects (referred to as "consequences") and the chance of experiencing those consequences (known as "likelihood"). The level of any particular risk can be expressed by combining the two considerations (i.e. the potential consequence in terms of the objectives, and the likelihood of those consequences being experienced).

If the resulting level of risk is either too high or too low for the entity whose objectives are at risk, then the risk can be treated so as to adjust the size of the consequences and / or the likelihood of experiencing those consequences. By managing risks - which is to say constantly understanding and then if appropriate treating the risks - an individual, organisation or society is more likely to achieve their objectives.

The most common misconception about risk management is that its purpose is to avoid risk. In fact its purpose is to make success more likely. As one commentator put it, "effective risk management allows you to run faster".

HOW  "OBJECTIVES" CREATE RISKS

Example 1 - Living in Wellington

Some people live in Wellington for positive reasons to do with work, lifestyle, climate or being close to the body politic, notwithstanding that about every 500 years or so, they and their city will be subjected to sudden and very high ground accelerations when the Wellington earthquake fault next ruptures as a result of the continual build up of strain through movement of the earth's tectonic plates beneath. The risk that their objectives in living in Wellington could be thwarted by death, injury and massive disruption to day to day life is lessened through building codes, resilient infrastructure, earthquake insurance and personal precautionary behaviours (such as storing a few days food and water and bolting down heavy furniture).

Example 2 - Investing in commercial ventures

Other people invest money in commercial ventures with the objective of generating wealth. They do this knowing that this objective can only be achieved through operating in competitive and regulated environments, establishing and preserving a good reputation and by relying on expensive staff whose capabilities at the time of the decision to proceed, will be unknown as will, for example, future exchange rates, raw material costs and demand for the organisation's products or services. These risks of failure can be reduced by, for example, sound market analysis and strategic planning, good governance, careful staff selection, continual monitoring of the external environment and responding in an agile way to change - in short by understanding and controlling risk.