When Managing Risk, Get Your Priorities Straight

Source: AICPA CPA Insider

The following includes excerpts, reproduced with permission, from an article by Robert Torok, CA.

Most organizations prioritize risk based on some combination of likelihood and impact, with those perceived as high in both dimensions being given the highest priority. Of course, that assumes organizations can define the basis on which impact will be measured and what the various gradations from low to high even mean. The next challenge lies in assigning the correct priority to those risks seen as high in one dimension but low in the other. The typical result in such cases is some ‘middling' placement on a typical risk map.

But an equal consideration when prioritizing risk should be the degree of independence of a given risk. At one extreme is the stand-alone risk, which can be assessed and actions taken essentially in isolation. But these circumstances are rare indeed. At the other extreme there are risks that correlated with others closely, thus spawning a web-like network of actions and reactions. At a minimum, organizations must seek to identify those plausible combinations of events that could cause serious adverse consequences and then identify actions that might prevent or mitigate more than one risk.

Unfortunately, most traditional risk management approaches overlook one key factor: Management's ability – or lack thereof – to influence or control either the impact or likelihood of a given risk. The benefit of considering management's influence over each dimension of the matrix is that it can deliver “quick wins” – the mitigation of risks that can be managed with relative ease while avoiding the waste of resources against those risks that cannot be prevented or mitigated ahead of time.

For the complete article, read “Risk Management – Setting Priorities by Likelihood and Impact.”

From AICPA CPA Insider, March 28, 2011, http://www.CPA2biz.com.