风险流程教学教材

1

TheRiskManagementProcessPreparedBy:RusulM.KanonaSupervisedBy:Dr.Lo’aiA.TawalbehArabAcademyforBanking&FinancialSciences(AABFS)Fall2007第一页，共41页。2WhatistheRiskManagementprocess?TheRiskManagementProcessconsistsofaseriesofstepsthat,whenundertakeninsequence,enablecontinualimprovementindecision-making.第二页，共41页。3StepsoftheRiskManagementProcess?

Step1.Communicateandconsult.Step2.Establishthecontext.Step3.Identifytherisks.Step4.Analyzetherisks.Step5.Evaluatetherisks.Step6.Treattherisks.Step7.Monitorandreview.第三页，共41页。4第四页，共41页。5Step1.Communicateandconsult-Communicationandconsultationaimstoidentifywhoshouldbeinvolvedinassessmentofrisk(includingidentification,analysisandevaluation)anditshouldengagethosewhowillbeinvolvedinthetreatment,monitoringandreviewofrisk.第五页，共41页。6-Assuch,communicationandconsultationwillbereflectedineachstepoftheprocessdescribedhere.-Asaninitialstep,therearetwomainaspectsthatshouldbeidentifiedinordertoestablishtherequirementsfortheremainderoftheprocess.-Thesearecommunicationandconsultationaimedat:A-ElicitingriskinformationB-Managingstakeholderperceptionsformanagementofrisk.第六页，共41页。7A-Elicitingriskinformation-Communicationandconsultationmayoccurwithintheorganizationorbetweentheorganizationanditsstakeholders.-Itisveryrarethatonlyonepersonwillholdalltheinformationneededtoidentifytheriskstoabusinessoreventoanactivityorproject.

-Itthereforeimportanttoidentifytherangeofstakeholderswhowillassistinmakingthisinformationcomplete.第七页，共41页。8B-Managingstakeholderperceptionsformanagementofrisk第八页，共41页。9Tipsforeffectivecommunicationandconsultation•Determineattheoutsetwhetheracommunicationstrategyand/orplanisrequired•Determinethebestmethodormediaforcommunicationandconsultation•Thesignificanceorcomplexityoftheissueoractivityinquestioncanbeusedasaguideastohowmuchcommunicationandconsultationisrequired:themorecomplexandsignificanttotheorganization,themoredetailedandcomprehensivetherequirement.第九页，共41页。10Step2.Establishthecontext

providesafive-stepprocesstoassistwithestablishingthecontextwithinwhichriskwillbeidentified.1-Establishtheinternalcontext2-Establishtheexternalcontext3-Establishtheriskmanagementcontext4-Developriskcriteria5-Definethestructureforriskanalysis第十页，共41页。111-Establishtheinternalcontext-Aspreviouslydiscussed,riskisthechanceofsomethinghappeningthatwillimpactonobjectives.Assuch,theobjectivesandgoalsofabusiness,projectoractivitymustfirstbeidentifiedtoensurethatallsignificantrisksareunderstood.Thisensuresthatriskdecisionsalwayssupportthebroadergoalsandobjectivesofthebusiness.Thisapproachencourageslong-termandstrategicthinking.第十一页，共41页。12Inestablishingtheinternalcontext,thebusinessownermayalsoaskthemselvesthefollowingquestions:-Isthereaninternalculturethatneedstobeconsidered?Forexample,arestaffResistanttochange?Isthereaprofessionalculturethatmightcreateunnecessaryrisksforthebusiness?-Whatstaffgroupsarepresent?-Whatcapabilitiesdoesthebusinesshaveintermsofpeople,systems,processes,equipmentandotherresources?第十二页，共41页。132.EstablishtheexternalcontextThisstepdefinestheoverallenvironmentinwhichabusinessoperatesandincludesanunderstandingoftheclients’orcustomers’perceptionsofthebusiness.Ananalysisofthesefactorswillidentifythestrengths,weaknesses,opportunitiesandthreatstothebusinessintheexternalenvironment.第十三页，共41页。14Abusinessownermayaskthefollowingquestionswhendeterminingtheexternalcontext:•Whatregulationsandlegislationmustthebusinesscomplywith?•Arethereanyotherrequirementsthebusinessneedstocomplywith?•Whatisthemarketwithinwhichthebusinessoperates?Whoarethecompetitors?•Arethereanysocial,culturalorpoliticalissuesthatneedtobeconsidered?第十四页，共41页。15Tipsforestablishinginternalandexternalcontexts-Determinethesignificanceoftheactivityinachievingtheorganization'sgoalsandobjectives-Definetheoperatingenvironment-Identifyinternalandexternalstakeholdersanddeterminetheirinvolvementintheriskmanagementprocess.第十五页，共41页。163-Establishtheriskmanagementcontext-Beforebeginningariskidentificationexercise,itisimportanttodefinethelimits,objectivesandscopeoftheactivityorissueunderexamination.-Forexample,inconductingariskanalysisforanewproject,suchastheintroductionofanewpieceofequipmentoranewproductline,itisimportanttoclearlyidentifytheparametersforthisactivitytoensurethatallsignificantrisksareidentified.第十六页，共41页。17Tipsforestablishingtheriskmanagementcontext

•Definetheobjectivesoftheactivity,taskorfunction•Identifyanylegislation,regulations,policies,standardsandoperatingproceduresthatneedtobecompliedwith•Decideonthedepthofanalysisrequiredandallocateresourcesaccordingly•Decidewhattheoutputoftheprocesswillbe,e.g.ariskassessment,jobsafetyanalysisoraboardpresentation.Theoutputwilldeterminethemostappropriatestructureandtypeofdocumentation.第十七页，共41页。184.DevelopriskcriteriaRiskcriteriaallowabusinesstoclearlydefineunacceptablelevelsofrisk.Conversely,riskcriteriamayincludetheacceptablelevelofriskforaspecificactivityorevent.Inthissteptheriskcriteriamaybebroadlydefinedandthenfurtherrefinedlaterintheriskmanagementprocess.第十八页，共41页。19Tipsfordevelopingriskcriteria•

Decideordefinetheacceptablelevelofriskforeachactivity•Determinewhatisunacceptable•Clearlyidentifywhoisresponsibleforacceptingriskandatwhatlevel.第十九页，共41页。205.DefinethestructureforriskanalysisIsolatethecategoriesofriskthatyouwanttomanage.Thiswillprovidegreaterdepthandaccuracyinidentifyingsignificantrisks.Thechosenstructureforriskanalysiswilldependuponthetypeofactivityorissue,itscomplexityandthecontextoftherisks.第二十页，共41页。21Step3.IdentifytherisksRiskcannotbemanagedunlessitisfirstidentified.Oncethecontextofthebusinesshasbeendefined,thenextstepistoutilizetheinformationtoidentifyasmanyrisksaspossible.第二十一页，共41页。22Theaimofriskidentificationistoidentifypossiblerisksthatmayaffect,eithernegativelyorpositively,theobjectivesofthebusinessandtheactivityunderanalysis.Answeringthefollowingquestionsidentifiestherisk:第二十二页，共41页。23Therearetwomainwaystoidentifyrisk:1-Identifyingretrospectiverisks

Retrospectiverisksarethosethathavepreviouslyoccurred,suchasincidentsoraccidents.Retrospectiveriskidentificationisoftenthemostcommonwaytoidentifyrisk,andtheeasiest.It’seasiertobelievesomethingifithashappenedbefore.Itisalsoeasiertoquantifyitsimpactandtoseethedamageithascaused.第二十三页，共41页。24Therearemanysourcesofinformationaboutretrospectiverisk.Theseinclude:•Hazardorincidentlogsorregisters•Auditreports•Customercomplaints•Accreditationdocumentsandreports•Paststafforclientsurveys•Newspapersorprofessionalmedia,suchasjournalsorwebsites.第二十四页，共41页。252-IdentifyingprospectiverisksProspectiverisksareoftenhardertoidentify.Thesearethingsthathavenotyethappened,butmighthappensometimeinthefuture.Identificationshouldincludeallrisks,whetherornottheyarecurrentlybeingmanaged.Therationalehereistorecordallsignificantrisksandmonitororreviewtheeffectivenessoftheircontrol.第二十五页，共41页。26Methodsforidentifyingprospectiverisksinclude:

•

Brainstormingwithstafforexternalstakeholders•Researchingtheeconomic,political,legislativeandoperatingenvironment•Conductinginterviewswithrelevantpeopleand/ororganizations•Undertakingsurveysofstafforclientstoidentifyanticipatedissuesorproblems•Flowchartingaprocess•Reviewingsystemdesignorpreparingsystemanalysistechniques.第二十六页，共41页。27TipsforeffectiveriskidentificationSelectariskidentificationmethodologyappropriatetothetypeofriskandthenatureoftheactivityInvolvetherightpeopleinriskidentificationactivitiesTakealifecycleapproachtoriskidentificationanddeterminehowriskschangeandevolvethroughoutthiscycle.第二十七页，共41页。28Step4.AnalyzetherisksDuringtheriskidentificationstep,abusinessownermayhaveidentifiedmanyrisksanditisoftennotpossibletotrytoaddressallthoseidentified.Theriskanalysisstepwillassistindeterminingwhichriskshaveagreaterconsequenceorimpactthanothers.第二十八页，共41页。29Whatisriskanalysis?Riskanalysisinvolvescombiningthepossibleconsequences,orimpact,ofanevent,withthelikelihoodofthateventoccurring.Theresultisa‘levelofrisk’.Thatis:

Risk=consequencexlikelihood第二十九页，共41页。30ElementsofriskanalysisTheelementsofriskanalysisareasfollows:1.Identifyexistingstrategiesandcontrolsthatacttominimizenegativeriskandenhanceopportunities.2.Determinetheconsequencesofanegativeimpactoranopportunity(thesemaybepositiveornegative).3.Determinethelikelihoodofanegativeconsequenceoranopportunity.4.Estimatethelevelofriskbycombiningconsequenceandlikelihood.5.Considerandidentifyanyuncertaintiesintheestimates.第三十页，共41页。31Typesofanalysis

Threecategoriesortypesofanalysiscanbeusedtodeterminelevelofrisk:•Qualitative•Semi-quantitative•Quantitative.

-Themostcommontypeofriskanalysisisthequalitativemethod.Thetypeofanalysischosenwillbebasedupontheareaofriskbeinganalyzed.第三十一页，共41页。32Tipsforeffectiveriskanalysis•Riskanalysisisusuallydoneinthecontextofexistingcontrols–takethetimetoidentifythem•Theriskanalysismethodologyselectedshould,wherepossible,becomparabletothesignificanceandcomplexityoftheriskbeinganalyzed,i.e.thehigherthepotentialconsequencethemorerigorousthemethodology•Riskanalysistoolsaredesignedtohelprankorprioritiesrisks.Todothistheymustbedesignedforthespecificcontextandtheriskdimensionunderanalysis.第三十二页，共41页。33Step5.EvaluatetherisksRiskevaluationinvolvescomparingthelevelofriskfoundduringtheanalysisprocesswithpreviouslyestablishedriskcriteria,anddecidingwhethertheserisksrequiretreatment.Theresultofariskevaluationisaprioritizedlistofrisksthatrequirefurtheraction.Thisstepisaboutdecidingwhetherrisksareacceptableorneedtreatment.第三十三页，共41页。34RiskacceptanceAriskmaybeacceptedforthefollowingreasons:•Thecostoftreatmentfarexceedsthebenefit,sothatacceptanceistheonlyoption(appliesparticularlytolowerrankedrisks)•Theleveloftheriskissolowthatspecifictreatmentisnotappropriatewithavailableresources•Theopportunitiespresentedoutweighthethreatstosuchadegreethattherisksjustified•Theriskissuchthatthereisnotreatmentavailable,forexampletheriskthatthebusinessmaysufferstormdamage.第三十四页，共41页。35Step6.TreattherisksRisktreatmentisaboutconsideringoptionsfortreatingrisksthatwerenotconsideredacceptableortolerableatStep5.Risktreatmentinvolvesidentifyingoptionsfortreatingorcontrollingrisk,inordertoeitherreduceoreliminatenegativeconsequences,ortoreducethelikelihoodofanadverseoccurrence.Risktreatmentshouldalsoaimtoenhancepositiveoutcomes.第三十五页，共41页。36Optionsforrisktreatment:

identifiesthefollowingoptionsthatmayassistintheminimizationofnegativeriskoranincreaseintheimpactofpositiverisk.1-Avoidtherisk2-Changethelikelihoodoftheoccurrence3-C