Risk Management. Junior Florentville. Medgar Evers College.

Usually, the most common risk management strategies can be subdivided into multi-stage approach in order to obtain a better impression of the underlying risks and thus to increase the probability of mitigating the firm’s risks properly and successfully. Also General Motors Corporation has developed various rules and guidelines to help manage minimize the risks associated with their business and investment operations.

Quantitative risk analysis involves steps, calculations and tools to have a good analysis. The steps involve with this method from (wikibooks n.d) includes: assigning value to assets, Estimating potential loss per threat, Performing a threat analysis and Deriving the overall loss potential per threat. Firstly, in order to assign an accurate value to an asset, all tangible and intangible assets must be identified. For instance a company may have a server and to determine the value of the server, the important of the server to the company and the cost of losing server are factors that helps in determining the value for the server. Secondly, the potential loss per threat should be estimated. If a server is hacked, how much loss will it cost to the company? To know that, the Single Loss Expectancy (SLE) has to be calculated. SLE is the asset value (AV) times the exposure factor (EF). Thirdly, risk analysis have to be performed. In the case of a server being stolen, it has to be determine how many times in a year can it happen. To know this, the Annual Rate of Occurrence (ARO) have to be calculated. Also, the overall loss potential per threat have to be known. The overall loss that can be incur from a stolen server and the probability that a server will be stolen can be derived by calculating the Annual Lost Expectancy (ALE) which is annual rate of

Risk or threat is common and found in various fields of daily life and business. This concept of risk is found in various stages of development and execution of a project. Risks in a project can mean there is a chance that the project will result in total failure, increase of project costs, and an extension in project duration which means a great deal of setbacks for the company. The process of risk management is composed of identifying, assessing, mitigating, and managing the risks of the project. It

This paper discusses three risk analysis methodologies, specifically, MSRAM, OCTAVE, and CRAMM and provides a detailed description of each and how they incorporate risk into a platform for decision makers to use in their endeavors to prevent, protect, mitigate, respond, and in recovery measures as part of the risk assessment and management processes.

1. Risk management plan summarizes risk management approach, list methodologies and processes, defines everyone’s role – definition of risk management plan. NASA was using for the most part qualitative risk assessment process. Launch of the shuttle was allowed as long as aggregate risk remained acceptable. Quantitive method was applied for risk assessment because if the complex procedures (like data gathering) were in place NASA would be buried with paperwork.

RISK ANALYSIS ASSESSEMT METHODS: The methods that will be adopted are Qualitative, Semi-Quantitative and Quantitative. The qualitative assessment uses a descriptive scale to define consequence, probability and level of impact such as high, moderate and low. The Semi-quantitative uses numerical rating/scale for consequence, and probability in combination with a formula. A full quantitative analysis may not be realistic due to insufficient data or information about a system. Quantitative analysis is using measurable, objective data/information to determine asset value, probability of loss and risks associated worth the asset.

Research shows that various risk management tools exist, ranging from the strict minimum to very comprehensive methodological (Harrison 1997). In different countries there are different methods applied in risk management, however the methodology is the same, systems characterization and description, threat and vulnerability identification, risk assessment and recommended

There are different approaches that can be taken when assessing risk. We can use quantitative methods, which deal in exact dollar amounts and figures. Quantitative methods are more concrete, but take longer to assess due to all the factors involved. This method would be more accurate at determining losses for our company which deals in information. You also have qualitative methods, which are more subjective and deal with assigning ratings. For example, you could have a risk rating system with values of

Quantitative risk assessment Measures the risk by relating the probability of the risk occurring to the possible severity of the outcome and then giving the risk a numerical value. The likelihood depends on the control measures of the place, while the severity depends on magnitude of hazard. [4]

develop a methodology for quantifying risks, or should each situation be addressed individually? Can we have both a quantitative and qualitative risk evaluation system in place at the same time?

6. Establish risk thresholds 7. Define risk communications 8. Define risk tracking process Risk Management and Project Selection Techniques Two commonly used project selection techniques are Benefit Measurement Models and Mathematical Models, i.e. (Mathematical Models used for extremely complex projects). In the workplace, Benefit Measurement Models are more often used. Some techniques in this category are: (1) Cost-benefit analysis: Which provide a net gain. Typically, the net gain is proportional to the risk level, i.e. the higher the risk, the higher the gain. (2) Weighted Scoring models: Risk of Incompletion is a factor that needs to be considered when comparing projects, using the Weighted Scoring Model for Risk Management and Project Selection to help you select a project. (3) Cash flow analysis: Takes into account the payback period, AND (4) Time Value of Money: Uses Net Present Value (NPV) and Internal Rate of Return (IRR). Generally, the higher the NPV, the better the project is. There are positive risks in every project that require knowing how to respond to them. Risk Management and Project Selection should also account for positive risks. Risk Identification Risk identification is the process of understanding what potential events might hurt or enhance a particular project. The customary origins

A comprehensive risk management strategy addresses items such as: (1) The scope of the risk management effort, (2) Methods and tools to be used for risk identification, risk analysis, risk mitigation, risk monitoring, and communication, (3) Project-specific sources of risks, (4) How these risks are to be organized, categorized, compared, and consolidated, (5) Parameters, including likelihood, consequence, and thresholds, for taking action on identified risks, (6) Risk mitigation techniques to be used, such as prototyping, simulation, alternative designs, or evolutionary development, (7) Definition of risk measures to monitor the status of the risks, and (8) Time intervals for risk monitoring or reassessment.

Thus, risk management plans help minimize the impact of technical risks in a project. There are several risk management paradigms that project managers can use to manage these risks. In software risk management, Barry Boehm’s risk management paradigm consisted of two sub-processes—risk assessment and risk control (Wallmüller, pp. 5-6). When assessing the risk, project managers need to identify, analyze and prioritize their risks with quantitative measurements, i.e. probability percentages or 1-5 scale. After this sub-process, the manager implements the risk control process where the IT managers can create risk management plans specifying risk reduction measures. In addition to these measures, the plan should include risk resolution and monitoring controls to be used on the project. An example of this paradigm is found on this website,

While reading this case study, the project manager noted that there had to be a lot of research completed before coming up with a risk management plan. Before coming up with a realistic set of guidelines, the organization had to conduct a day to day core risk assessment. They did so by dividing the assessments up into team developed projects, in which eventually led them to the implementation of putting their procedures into place. By definition, risk assessment is a systematic process of evaluating the potential risks that may be involved in a projected activity or undertaking. The team had to identify, evaluate, estimate the main levels of risk involved in this project. Then they had to compare each risk against the

The project manager working with the project team and project client will ensure risks are actively identified, analyzed and managed throughout the life of the project. Risks will be identified as early as possible to minimize their impact. This can be done using several ways like