Eliminate the risk- most effective- not necessarily most cost effective

 Eliminate the risk- most effective- not necessarily most cost effective

Pure Risk

 

·         Only opportunity for loss

 

Speculative Risk

 

·         uncertainty that could be loss or gain

 

Hazards

 

·         items that contribute to the perils that result in risk- actions that increase risk

 

Triggers

 

·         items that are indicators of hazards

 

Risk Appetite

 

·         the amount of risk acceptance by an organization- changes within an organization or across perils

 

Risk identification

 

·         identify business locations and critical processes- Determine potential hazards

 

R=(TV)C

 

·         R- risk
T- threat
V- vulnerability
C- consequence
(T*V)- likelihood

 

Risk Registry

 

·         Summary of identified risks and their ranking

 

Risk Management

 

·         Identified
Assessed
Mitigation plan developed
Monitored

 

Risk avoidance
Risk control
Risk transfer
Risk acceptance
Risk financing

 

·         5 Primary ways to mitigate and treat risk

 

Risk Avoidance

 

·         Eliminate the risk- most effective- not necessarily most cost effective

 

Risk Control

 

·         Reduce or manage risk to within acceptable means- includes prevention, preparedness, mitigation, and response- can be administrative or engineered

 

Risk Transfer

 

·         Passing risk to a third party- insurance, contracts, outsourcing- does not eliminate the risk just cover cost

 

Risk Acceptance

 

·         The organization has determined risk controls not warranted or too costly- assumes risk of loss

 

Risk Financing

 

·         Establish fund to cover future potential loss- form of self insurance (high deductible)

 

ASIS

 

·         includes assessment of resilience of each asset to each threat

 

NFPA

 

·         requires the assessment of national and international cascading effects

 

ISO 31000

 

·         risk management standard- enterprise risk management framework- integrates risk management into entire organization- requires communication and consultation with all stakeholders