Categorization of management risk:
Once each event has been evaluated, and been classified as to its probability and impact, the next step is to categorise those events. To do so, the probability factor and impact factor are combined.
A good way of visualising this process is by using the following table:
|
|
Severity of Impact (A = insignificant, E = catastrophic)
|
|
A
|
B
|
C
|
D
|
E
|
|
Likelihood of Occurrence
(1 = rare, 5 = almost certain)
|
1
|
|
|
|
|
|
|
2
|
|
|
|
|
|
|
3
|
|
|
|
|
|
|
4
|
|
|
|
|
|
|
5
|
|
|
|
|
|
In the above example, the particular event has been classified as being likely to occur (4), and the impact of it occurring would be major (D). The combination of the two places the event in the area outlined.
You will see from the above sample that the shaded box falls within the bordered area. The different shadings represent different areas of risk as assessed by the organisation itself.
It is important that organisation sets the various areas of risk, as one organisation may have a totally different tolerance of risk than another.
The risk categories used in this particular example could be classified as follows:
|
Shaded Area
|
Description
|
|
Light
|
An area of relatively low risk. If it can be addressed with simple measures then should do so.
|
|
Medium
|
Areas of medium risk. Should have procedures in place but still not take precedence over addressing areas of high risk.
|
|
Dark
|
Area of high or extreme risk. Should take immediate steps to reduce or eliminate risk regardless of cost.
|
Looking at the above example, the particular event falls within the dark area, representing an area of high / extreme risk. The organisation in this case should take immediate steps to reduce or eliminate the risk involved with this event happening.