I have also run into issues with trying to define Risk Management operations that are an integrated part of general operations. I believe one answer lies in the definition and general understanding of what a risk is. In ISO 31000 it defines it as the effect of uncertainty on objectives. That is much broader than the traditional threat perspective. In short that definition is more about circumstance than threat. What circumstance would create uncertainty that would reduce the likelihood of objective achievement? Has accountability been assigned for the objective? Does management have adequate oversight of the objective? Are people, process, and technology responsible for achieving the objective aligned effectively? Answers to these questions define the circumstance in which a threat now gains operational meaning. Understanding both the operational circumstance and the threat also facilitates natural setting of the risk appetite and clear indication of the next steps.

The difficult part of this perspective is that we must create standard expectations to measure circumstances against for them to be meaningful. I believe the scale by which to measure these standard circumstance expectations is a maturity scale often unfamiliar to a risk expert who looks to see if a risk is managed or not, rather than how mature the management is. On the other side while maturity is familiar to management, setting expectations of accountability and response to accountability increases scrutiny on the very individual developing the standard. So management tends to resist standards in this area.

With the current external audits perfomed by the Auditor General South Africa the key focus is on risks related to peformance information, having read your articles on www.riskbasedperformance.com my horizon has been broadened in this area and therefore my focus will be to strategically position risk management within our institution.

Thank you.

jasa iklan

www.GlobalPerformanceForum.com
www.MissionDrivenPerformance.com
www.gsmiweb.com

Thx