How to carry out your risk analysis

A risk assessment starts with knowing what you are going to assess and ends with a report senior management can understand. In between, you identify the risks, rate them and measure how much your controls reduce them.

This practical guide is an extract of the GlobalSuite Solutions methodology that many customers already use. It is written for risk managers who want to bring order to their assessments, and it is told by a consultant working through a real case: the Financial Management process in their organisation.

How it works

Each section opens with the questions worth asking and ends with a challenge for your own company. First you draw the dependency tree, then you list risks and rate them from 1 to 5 for likelihood and impact, and finally you score how effective your controls are.

What's in the guide

1. ElementsHow to start from the org chart to list areas, services and processes, and arrange them in a dependency tree down to the level of detail you need.
2. Risk assessmentThe four steps in the example: choose the approach, set inherent risk on five levels, measure the effect of controls and calculate residual risk.
3. ControlsWhy they don't all mitigate equally, and which criteria measure their effectiveness: whether they have an owner, whether they are automated and how often they run.
4. ResultsHow to prepare the report for your managers, with the residual risks above the acceptable level and a comparison of inherent and residual risk.
5. ConclusionsWhy it pays to see every risk type on a single map and to use KRIs as an early warning signal.

Where GlobalSuite® fits

The example is worked through in GlobalSuite®. The Inventory gathers the elements and arranges them in the dependency tree, and the interactive table filters which processes have risks above the moderate level. The "Element Risks" and "Risks vs. Acceptable Risk Level" charts used in the presentation come straight from the tool.