What is Risk Management?
by Sarah Harvey / October 11th, 2017
Why is Risk Management Important to Business?
Humans are constantly considering risk, even when we don’t realize it. Risk management is our response to the possibility of suffering harm or something going wrong…and things go wrong all the time! Car accidents, stolen wallets, unexpected bad weather, burnt dinners. The list could go on and on. We are programmed to manage risk. So, how does risk management translate into business?
We believe that the success and operability of your organization depends on how well you manage your unique risks. Risk management is critical to your organization. Risk management is the process of identifying, assessing, mitigating, and controlling threats to an organization. These threats could stem from financial uncertainty, legal liabilities, management, accidents, or natural disasters. Because of the growing information security-related threats, companies’ risk management programs are under intense scrutiny from industry and governing bodies. Protecting digital assets like protected health information, cardholder data, personally identifiable information, intellectual property, or financial statements is a top priority.
What Should My Risk Management Program Look Like?
Risk management programs consist of performing risk analyses, conducting risk assessments, documenting policies and procedures, building an internal audit program, and creating an actionable risk management plan. All of these elements create a strategy for mitigating your organization’s unique risk.
- A risk analysis identifies the threats and analyzes the vulnerabilities of an organization. This is a very factual process that includes asset characterization, threat identification, vulnerability identification, control analysis, likelihood determination, impact analysis, risk determination, control remediation, and results documentation. At the end of a risk analysis, you want to have a list of what critical assets you’re trying to protect, the risks your organization is facing, and what your organization is doing to limit vulnerabilities.
- A risk assessment is a systematic process for evaluating existing controls and assessing their adequacy against the potential operational, reputational, and compliance threats identified in a risk analysis. A risk assessment should include: conducting a risk assessment survey, identifying risks, assessing the importance and likelihood of risk, creating a risk management plan, and then implementing that plan.
- Your risk management plan means nothing if it isn’t documented in your policies and procedures. We strongly believe that if something is not written down, it’s not happening. These policies and procedures should define how you mitigate identified risks, and then be effectively communicated to all employees.
- According to the Institute of Internal Auditors, “the role of internal audit is to provide independent assurance that an organization’s risk management, governance, and internal control processes are operating effectively.” An internal audit is conducted objectively and designed to improve and mature an organization’s business practices. An internal audit program provides objective insight into an organization’s culture, policies, procedures, improves efficiency of operations, evaluates risk and protects assets, assesses controls, and ensures relevant regulatory compliance.
Still have questions about risk management? For more information on KirkpatrickPrice’s risk assessment services and how we can help, contact us using the form below.
More Risk Management Resources
Risk Management 101 Webinar Series
5 Important Risk Management Best Practices
The First Step in Vendor Compliance Management: Risk Assessments
Today, I’m asked to talk about risk and risk management a little bit and to provide some useful, helpful tips on risk. Many times, people’s eyes glaze over when you say “risk management” and they’re wondering why in the world we would want to talk about risk. Let me tell you: risk is your best friend because you’re doing it all the time, whether you know it or not.
Risk, by definition, is the response to possibly suffering harm or loss or something that can go wrong. Take for instance, you’re doing risk management. My example is the thing that wakes you up in the middle of the night that’s not your dog that has to go out or your significant other that really wants to talk to you, but it’s something that bothers you at work. You know that. It’s something that comes out of the back of your mind, often between the hours of one and three in the morning.
