Risk Management: Explained in 5 Steps

If you want to get serious about risk management, you can't avoid taking a structural approach. A good approach to risk management can already be done in 5 steps. It starts with the comprehensive risk analysis, the definition and implementation of the control measures, the evaluation and, finally, the implementation of the update of the risk analysis.

‍

In short, risk management is a process of successive steps. The process described below can be applied to risk management for projects. However, if it concerns strategic risk management or risk management for programs, the basic process can be further expanded, the basic process described has been further expanded.

Step 1: the comprehensive risk analysis

In the first step, the current state of affairs is provided. To do this, you use an integrated risk analysis. This analysis is performed based on the Risman method and is divided into a number of logical phases.

‍

Determining the purpose of the analysis
The first step is to determine the goal, what the analysis is focused on. In this way, it is possible to determine the “top event” in technical terms. This refers to a situation that is classified as undesirable.

Identifying the risks
The risk analysis also includes identifying the risks based on different perspectives. In this way, an integral picture is created. With each new risk analysis, it is constantly reviewed whether the perspectives to be used are still relevant.

• political/administrative
• financial/economic
• legal/legal
• technical
• organizationally
• geographic/spatial
• societal

Identifying key risks
Various methods are available to determine the most important risks. For this step-by-step plan, we focus on the two most used methods:

• a list of risks, divided into points
• identifying the individual risks, including the chance of occurrence. The consequences of the occurrence of the risks are assessed separately on the basis of numbers.

Mapping out possible control measures

Normally, the following measures are possible:
avoiding. In this situation, measures are taken to reduce the risk of an undesirable situation occurring. It is therefore abolished or avoided.

‍

reducing. When reducing, measures are taken to reduce the cause of the occurrence of a risk or the consequences of a risk. In reducing the risk, effective measures are taken before a certain risk can arise. A consequential measure means that measures are devised and, possibly, preparatory actions are taken that are applied if there is a possibility that a certain risk may arise.

‍

transmit. When a risk is transferred, the cause is not removed, but the handling of the risk is transferred to another party. In many cases, this is chosen when it is expected that a third party can handle the risk better.

‍

accept. Accepting the occurrence of a risk is another option. In many cases, this leads to an increase in costs or an adjustment of an existing schedule.

Step 2: determining the control measures to be taken

After carrying out the risk analysis, a good picture of the most important risks is created and, based on that outcome, it becomes clear which control measures can be taken. The final decision on which measures to apply is made by the management team or project management. The starting point for this is the assessment of whether the intended effect of the proposed measure or effort is acceptable. It is also decided who is ultimately responsible for implementing the control measure (s).

‍
The result is a list of the following points:

• the risk
• the management measure that has been proposed
• the person responsible for implementing the control measure.

Step 3: Implementing the proposed control measures

The implementation of the control measure (s) is the task of the appropriate person (s).

Step 4: Evaluating the chosen control measures

The measures implemented should be evaluated on a regular basis. In this way, it becomes clear whether the established measures have achieved the desired effect.

Step 5: Perform the risk analysis update

The final step is to update the list of risks based on the results of the evaluation from step four. The list of risks was previously compiled in step one based on the risk analysis. The update ensures that it becomes clear which risks are still current and possible new risks are identified and added to the list.

Conclusion

Curious about how ISO2HANDLE can help with risk management? Then feel free to plan a short call with one of our experts.