Risk management

Risk management is the identification, evaluation, and prioritization of risks (defined in ISO 31000 as the effect of uncertainty on objectives) followed by coordinated and economical application of resources to minimize, monitor, and control the probability or impact of unfortunate events or to maximize the realization of opportunities.

Definition

A widely used vocabulary for risk management is defined by ISO Guide 73:2009, "Risk management. Vocabulary." In ideal risk management, a prioritization process is followed whereby the risks with the greatest loss (or impact) and the greatest probability of occurring are handled first, and risks with lower probability of occurrence and lower loss are handled in descending order. In practice the process of assessing overall risk can be difficult, and balancing resources used to mitigate between risks with a high probability of occurrence but lower loss versus a risk with high loss but lower probability of occurrence can often be mishandled.

Method

For the most part, these methods consist of the following elements, performed, more or less, in the following order.

• Identify, characterize threats
• Assess the vulnerability of critical assets to specific threats
• Determine the risk (i.e. the expected likelihood and consequences of specific types of attacks on specific assets)
• Identify ways to reduce those risks
• Prioritize risk reduction measures based on a strategy

Principles of risk management

The International Organization for Standardization (ISO) identifies the following principles of risk management:

• Risk management should create value.
• Risk management should be an integral part of organizational processes.
• Risk management should be part of decision making.
• Risk management should explicitly address uncertainty.
• Risk management should be systematic and structured.
• Risk management should be based on the best available information.
• Risk management should be tailored.
• Risk management should take into account human factors.
• Risk management should be transparent and inclusive.
• Risk management should be dynamic, iterative and responsive to change.
• Risk management should be capable of continual improvement and enhancement.

See also

• Enterprise risk management
• Financial risk management
• ISO 31000
• Risk assessment
• Risk Management Plan
• Risk management tools

Risk management

• 
  ISS impact risk
• 
  Risk in Banking