Summary of Enterprise Risk Management

Session 4: Risk / Event Identification

Incidents (events) affect the implementation of the achievement of objectives and strategies of the company.

Type of events?

• Internal
• External

Simply, incident can bring to both positive result or negative result – always risks and opportunities.

What can possibly go wrong?

• Risk identification is the first but most important step in risk management: What can possibly go wrong?!
• Risks that are not identified cannot be managed (Opportunities are leaving for those who have well prepared)

How to ident risk?

• Looking backward
  • statistical analysis – look for trend, learn from history
• Looking forward
  • brainstorming (by small group and/or large group of individuals)
    • Expert Knowledge
    • Delphi Technique
    • Scenario analysis

Now, let look more deeper into the analysis methodologies.

Process Flow Analysis

• List tasks in the process, and for each task list all the possible events
• this method is good for risk identification , and cost assessment

Event Tree Analysis

• there is/are initial event(s) and sub-events before reaching the outcome(s)
• limitation / weakness of this method:
  • (1) must ident the subject/topic ;
  • (2) doesn’t show the cost of consequence;
  • (3) rely on historical info to assist the analysis of frequency of the outcome(s)

Bow Tie Analysis

• Demonstrate an event (incident) as a hazard
• Upstream : the potential causes (threats) and preventive control measures
• Downstream: the potential outcome (consequences) and the mitigation recovery measures

Scenario analysis

• Base case
• Worst case
• Best case

Risk identification must take place at all levels of the organization.

No matter what types of risk identification are used, one must be remember: risk identification must take place at all levels of the organization.

In the lesson, the tutor used the “Bhopal Disaster” as an example to emphasize this point.

Pitfalls when conducting risk identification or making decisions

• “Empty-suit problem” (expert problem)
  • someone who is authority but actually he/she has not much difference from general population, but we need to follow their opinions (or instructions)
• “Black Swan”
  • outlier is “always” existing – unexpected situation
  • we believe that the future will resemble the past – misleading to wrong decision
• Normalization of deviance
  • accustomed to deviation – “不合理”合理化

How to counter? (Prevent or reduce deviance?)

• Never use past success to redefine acceptable performance
• Prevent group-thinking

Session 5: Risk Assessment

Risk Assessment = Risk Analysis -> Risk Evaluation

• Risk Analysis : likelihood x potential impact
• Risk Evaluation : prioritize for the risk response and the allocation of resources

Pitfall of risk perception and decisions

1. problem of induction
   • belief that the future will resemble the past – do not consider “black swan effect”
2. confirmation bias
   • choose to believe / prefer evidence that supports your beliefs
     • search for what you want
     • recall information that support you
     • use “all means” to test and demonstrate that your thinking is correct
     • disregard the “real, useful” information
3. cognitive dissonance
   • when two contradictory information come, the mental stress make people to change their action slightly, but usually their belief will change also well, until they find a new balance (comfort zone)
4. illusion of control
   • someone believes that they have the “ability” to control the result
5. self-attribution bias
   • someone belief that the positive outcomes are because of their contribution, but for the negative outcomes, they will blame for others
6. impact of steroid levels on risk behavior (e.g testosterone, cortisol)