|
IN THIS SECTION: |
definitionsSomeone once said: “The great thing about standards is that there are so many to choose from.” The risk management field is no different in this respect than any other area of management where standards proliferate. In this section we highlight some of the most important terms in the field of risk management and provide examples of how these are defined in some of the more important or well known reference materials. Where there are multiple definitions we provide a commentary on the distinctions but it is up to the reader to determine which definition best aligns with their own needs. riskview definitions The chance of something happening that will have an impact on objectives
Source: AS/NZS 4360:2004
Source: ISO/IEC GUIDE 73:2002
Source: ISO/IEC Guide 51:1999
Source: HM Treasury, The Orange Book, 2004
Source: HM Treasury, The Green Book
Source: HSE – 5 steps to risk assessment, INDG163(rev2), revised 06/06
Source: Society for Risk Analysis
Source: USA - Office of Hazardous Materials Safety
We like the AS/NZ focus on the impact on objectives. The inclusion of ‘probability’ in the ISO/IEC definition and the Green Book is too restrictive. The Orange book has a better balance and emphasises the upside as well as the downside. Ideally a definition of “risk” should distinguish clearly between the concept of a “risk event” and that of a “risk measure”. The AS/NZ definition comes closest to doing this. operational riskview definitions The risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events.
Basel Committee (2004)
Unsurprisingly, given the history in the financial services sector, focus is on the downside. risk analysisview definitions Systematic process to understand the nature of and to deduce the level of risk.
AS/NZS 4360:2004 Systematic use of information to identify sources and to estimate the risk.
ISO/IEC GUIDE 73:2002 Systematic use of available information to identify hazards and to estimate the risk. ISO/IEC Guide 51:1999 A detailed examination including risk assessment, risk evaluation, and risk management alternatives, performed to understand the nature of unwanted, negative consequences to human life, health, property, or the environment; an analytical process to provide information regarding undesirable events; the process of quantification of the probabilities and expected consequences for identified risks Society for Risk Analysis. With the exception of the Society for Risk Analysis, which over-complicates the definition, there is good agreement here. risk assessmentview definitions The overall process of risk identification, risk analysis and risk evaluation. AS/NZS 4360:2004 Overall process of risk analysis and risk evaluation. ISO/IEC GUIDE 73:2002 Overall process comprising a risk analysis and a risk evaluation. ISO/IEC Guide 51:1999 The evaluation of risk with regard to the impact if the risk is realised and the likelihood of the risk being realised. HM Treasury, The Orange Book, 2004 The process of establishing information regarding acceptable levels of a risk and/or levels of risk for an individual, group, society, or the environment. Society for Risk Analysis (Or risk characterization) is determination of risk context and acceptability, often by comparison to similar risks. USA - Office of Hazardous Materials Safety
General agreement that this is to do with the process. The Orange Book focuses on ‘evaluation’ which is part of the process in the other definitions. risk identificationview definitions The process of determining what, where, when, why and how something could happen. AS/NZS 4360:2004 Process to find, list and characterize elements of risk.
ISO/IEC GUIDE 73:2002 Recognizing that a hazard exists and trying to define its characteristics. Often risks exist and are even measured for some time before their adverse consequences are recognized. In other cases, risk identification is a deliberate procedure to review, and it is hoped, anticipate possible hazards. Society for Risk Analysis
The AS/NZ definition is the simplest and most elegant. risk evaluationview definitions Process of comparing the level of risk against risk criteria.
AS/NZS 4360:2004 Process of comparing the estimated risk against given risk criteria to determine the significance of the risk.
ISO/IEC GUIDE 73:2002 Procedure based on the risk analysis to determine whether the tolerable risk has been achieved. ISO/IEC Guide 51:1999 A component of risk assessment in which judgements are made about the significance and acceptability of risk. Society for Risk Analysis The introduction of the concept of risk criteria is helpful. Any subsequent judgements about ‘tolerability’ and ‘significance’ need the existence of the criteria to be meaningful. risk criteriaview definitions Terms of reference by which the significance of risk is assessed. n.b. Risk criteria can include associated cost and benefits, legal and statutory requirements, socioeconomic and environmental aspects, the concerns of stakeholders, priorities and other inputs to the assessment. AS/NZS 4360:2004 Terms of reference by which the significance of risk is assessed. n.b. Risk criteria can include associated cost and benefits, legal and statutory requirements, socio-economic and environmental aspects, the concerns of stakeholders, priorities and other inputs to the assessment. ISO/IEC GUIDE 73:2002
The introduction of the concept of risk criteria is helpful. Any subsequent judgements about ‘tolerability’ and ‘significance’ need the existence of the criteria to be meaningful. risk treatmentview definitions Process of selection and implementation of measures to modify risk.
AS/NZS 4360:2004 Process of selection and implementation of measures to modify risk.
ISO/IEC GUIDE 73:2002 The process of selecting and implementing measures to modify the risk. Risk treatment includes as its major element, risk control/mitigation, but extends further to, for example, risk avoidance, risk transfer, risk financing, etc. AIRMIC/ALARM/ IRM, Risk Management Standard: 2002
Not much disagreement here residual riskview definitions Risk remaining after implementation of risk treatment. AS/NZS 4360:2004 Risk remaining after risk treatment. ISO/IEC GUIDE 73:2002 Risk remaining after protective measures have been taken. ISO/IEC Guide 51:1999 The remaining risk after management has taken action to alter the risk’s likelihood or impact. COSO, Enterprise Risk Management – Integrated Framework, 2004 The exposure arising from a specific risk after action has been taken to manage it and making the assumption that the action is effective. HM Treasury, The Orange Book, 2004
Broad agreement but the Orange Book’s explicit point about assumed effectiveness of the planned risk treatment is a valuable enhancement. risk managementview definitions The culture, processes and structures that are directed towards realizing potential opportunities whilst managing adverse effects. AS/NZS 4360:2004 Coordinated activities to direct and control an organization with regard to risk. NOTE Risk management generally includes risk assessment, risk treatment, risk acceptance and risk communication. ISO/IEC GUIDE 73:2002 The process whereby organisations methodically address the risks attaching to their activities with the goal of achieving sustained benefit within each activity and across the portfolio of all activities. AIRMIC/ALARM/ IRM, Risk Management Standard: 2002 All the processes involved in identifying, assessing and judging risks, assigning ownership, taking actions to mitigate or anticipate them, and monitoring and reviewing progress. HM Treasury, The Orange Book, 2004 Is the systematic application of policies, practices, and resources to the assessment and control of risk affecting human health and safety and the environment. Hazard, risk, and cost/benefit analysis are used to support development of risk reduction options, program objectives, and prioritization of issues and resources. A critical role of the safety regulator is to identify activities involving significant risk and to establish an acceptable level of risk. Near zero risk can be very costly and in most cases is not achievable. USA - Office of Hazardous Materials Safety Process that involves assessing the risks that arise in your workplace, putting sensible health and safety measures in place to control them and then making sure they work in practice. Health & Safety Executive
The emphasis on monitoring and review of the system, explicit in the Orange Book and implicit in the HSE one, is an important and valuable enhancement to the other definitions. risk management frameworkview definitions Set of elements of an organization’s management system concerned with managing risk.
AS/NZS 4360:2004 enterprise risk management view definitions A process, effected by an entity’s board of directors, management and other personnel, applied in strategy setting and across the enterprise, designed to identify potential events that may affect the entity, and manage risk to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives. COSO, Enterprise Risk Management – Integrated Framework, 2004
To our mind this is not materially different from ‘risk management’ definitions tolerable riskview definitions Risk which is accepted in a given context based on the current values of society. ISO/IEC Guide 51:1999 risk appetite view definitions The broad-based amount of risk a company or other entity is willing to accept in pursuit of its mission (or vision). COSO, Enterprise Risk Management – Integrated Framework, 2004 The amount of risk that an organisation is prepared to accept, tolerate, or be exposed to at any point in time. HM Treasury, The Orange Book, 2004 hazardview definitions Source of potential harm. AS/NZS 4360:2004 Potential source of harm. n.b. The term hazard can be qualified in order to define its origin or the nature of the expected harm (e.g. electric shock hazard, crushing hazard, cutting hazard, toxic hazard, fire hazard, drowning hazard). ISO/IEC Guide 51:1999 Anything that may cause harm, such as chemicals, electricity, working from ladders, an open drawer etc. HSE – 5 steps to risk assessment Is the inherent characteristic of a material, condition, or activity that has the potential to cause harm to people, property, or the environment. USA - Office of Hazardous Materials Safety
Good agreement here impactview definitions Result or effect of an event.
COSO, Enterprise Risk Management – Integrated Framework, 2004
See consequence consequenceview definitions Outcome or impact of an event.
AS/NZS 4360:2004 Outcome of an event.
ISO/IEC GUIDE 73:2002 A consequence is the direct effect of an event, incident or accident. It is expressed as a health effect (e.g., death, injury, exposure), property loss, environmental effect, evacuation, or quantity spilled. USA - Office of Hazardous Materials Safety
Important points are: the link between consequence/impact and an ‘event’; the fact that there can be multiple consequences; and that consequences should be related should be related to the entity objectives . likelihoodview definitions Used as a general description of probability or frequency. n.b. Can be expressed qualitatively or quantitatively. AS/NZS 4360:2004 The possibility that a given event will occur.
COSO, Enterprise Risk Management – Integrated Framework, 2004 Is expressed as either a frequency or a probability. Frequency is a measure of the rate at which events occur over time (e.g., events/year, incidents/year, deaths/year, etc.). Probability is a measure of the rate of a possible event expressed as a fraction of the total number of events (e.g., one-in-a-million, 1/1,000,000, or 1×10 3). USA - Office of Hazardous Materials Safety
The AS/NZ definition is simple and correct. The other definitions suffer from a common problem associated with the interpretation of ‘probability’. At best, it is misleading, at worst it is mathematically incorrect. frequencyview definitions A measure of the number of occurrences per unit of time. AS/NZS 4360:2004 probabilityview definitions A measure of the chance of occurrence expressed as a number between 0 and 1. AS/NZS 4360:2004 Extent to which an event is likely to occur.
ISO/IEC GUIDE 73:2002
The AS/NZ definition is mathematically correct. The ISO definition confuses matters by introducing qualitative measures that are more at home under ‘likelihood’. eventview definitions Occurrence of a particular set of circumstances.
AS/NZS 4360:2004 Occurrence of a particular set of circumstances.
ISO/IEC GUIDE 73:2002 An incident or occurrence from internal or external sources that affects achievement of objectives.
COSO, Enterprise Risk Management – Integrated Framework, 2004 |
We shouldn't be afraid to take risks, even if that means risking failure... Tony Blair |
