风险管理流程

1TheRiskManagementProcessPreparedBy:RusulM.KanonaSupervisedBy:Dr.Lo’aiA.TawalbehArabAcademyforBanking&FinancialSciences(AABFS)Fall20072WhatistheRiskManagementprocess?TheRiskManagementProcessconsistsofaseriesofstepsthat,whenundertakeninsequence,enablecontinualimprovementindecision-making.3StepsoftheRiskManagementProcess?Step1.Communicateandconsult.Step2.Establishthecontext.Step3.Identifytherisks.Step4.Analyzetherisks.Step5.Evaluatetherisks.Step6.Treattherisks.Step7.Monitorandreview.45Step1.Communicateandconsult-Communicationandconsultationaimstoidentifywhoshouldbeinvolvedinassessmentofrisk(includingidentification,analysisandevaluation)anditshouldengagethosewhowillbeinvolvedinthetreatment,monitoringandreviewofrisk.6-Assuch,communicationandconsultationwillbereflectedineachstepoftheprocessdescribedhere.-Asaninitialstep,therearetwomainaspectsthatshouldbeidentifiedinordertoestablishtherequirementsfortheremainderoftheprocess.Thesearecommunicationandconsultation-:aimedatA-ElicitingriskinformationB-Managingstakeholderperceptionsformanagementofrisk.7A-Elicitingriskinformation-Communicationandconsultationmayoccurwithintheorganizationorbetweentheorganizationanditsstakeholders.-Itisveryrarethatonlyonepersonwillholdalltheinformationneededtoidentifytheriskstoabusinessoreventoanactivityorproject.-Itthereforeimportanttoidentifytherangeofstakeholderswhowillassistinmakingthisinformationcomplete.8B-Managingstakeholderperceptionsformanagementofrisk9Tipsforeffectivecommunicationandconsultation•Determineattheoutsetwhetheracommunicationstrategyand/orplanisrequired•Determinethebestmethodormediaforcommunicationandconsultation•Thesignificanceorcomplexityoftheissueoractivityinquestioncanbeusedasaguideastohowmuchcommunicationandconsultationisrequired:themorecomplexandsignificanttotheorganization,themoredetailedandcomprehensivetherequirement.10Step2.Establishthecontextprovidesafive-stepprocesstoassistwithestablishingthecontextwithinwhichriskwillbeidentified.1-Establishtheinternalcontext2-Establishtheexternalcontext3-Establishtheriskmanagementcontext4-Developriskcriteria5-Definethestructureforriskanalysis111-Establishtheinternalcontext-Aspreviouslydiscussed,riskisthechanceofsomethinghappeningthatwillimpactonobjectives.Assuch,theobjectivesandgoalsofabusiness,projectoractivitymustfirstbeidentifiedtoensurethatallsignificantrisksareunderstood.Thisensuresthatriskdecisionsalwayssupportthebroadergoalsandobjectivesofthebusiness.Thisapproachencourageslong-termandstrategicthinking.12Inestablishingtheinternalcontext,thebusinessownermayalsoaskthemselvesthefollowingquestions:-Isthereaninternalculturethatneedstobeconsidered?Forexample,arestaffResistanttochange?Isthereaprofessionalculturethatmightcreateunnecessaryrisksforthebusiness?-Whatstaffgroupsarepresent?-Whatcapabilitiesdoesthebusinesshaveintermsofpeople,systems,processes,equipmentandotherresources?13.Establishtheexternalcontext2Thisstepdefinestheoverallenvironmentinwhichabusinessoperatesandincludesanunderstandingoftheclients’orcustomers’perceptionsofthebusiness.Ananalysisofthesefactorswillidentifythestrengths,weaknesses,opportunitiesandthreatstothebusinessintheexternalenvironment.14Abusinessownermayaskthefollowingquestionswhendeterminingtheexternalcontext:•Whatregulationsandlegislationmustthebusinesscomplywith?•Arethereanyotherrequirementsthebusinessneedstocomplywith?•Whatisthemarketwithinwhichthebusinessoperates?Whoarethecompetitors?•Arethereanysocial,culturalorpoliticalissuesthatneedtobeconsidered?15Tipsforestablishinginternalandexternalcontexts-Determinethesignificanceoftheactivityinachievingtheorganization'sgoalsandobjectives-Definetheoperatingenvironment-Identifyinternalandexternalstakeholdersanddeterminetheirinvolvementintheriskmanagementprocess.16Establishtheriskmanagementcontext-3-Beforebeginningariskidentificationexercise,itisimportanttodefinethelimits,objectivesandscopeoftheactivityorissueunderexamination.-Forexample,inconductingariskanalysisforanewproject,suchastheintroductionofanewpieceofequipmentoranewproductline,itisimportanttoclearlyidentifytheparametersforthisactivitytoensurethatallsignificantrisksareidentified.17Tipsforestablishingtheriskmanagementcontext•Definetheobjectivesoftheactivity,taskorfunction•Identifyanylegislation,regulations,policies,standardsandoperatingproceduresthatneedtobecompliedwith•Decideonthedepthofanalysisrequiredandallocateresourcesaccordingly•Decidewhattheoutputoftheprocesswillbe,e.g.ariskassessment,jobsafetyanalysisoraboardpresentation.Theoutputwilldeterminethemostappropriatestructureandtypeofdocumentation.184.DevelopriskcriteriaRiskcriteriaallowabusinesstoclearlydefineunacceptablelevelsofrisk.Conversely,riskcriteriamayincludetheacceptablelevelofriskforaspecificactivityorevent.Inthissteptheriskcriteriamaybebroadlydefinedandthenfurtherrefinedlaterintheriskmanagementprocess.19Tipsfordevelopingriskcriteria•Decideordefinetheacceptablelevelofriskforeachactivity•Determinewhatisunacceptable•Clearlyidentifywhoisresponsibleforacceptingriskandatwhatlevel.20.D