Identifying risks We identify risks by generating a comprehensive list of threats and opportunities based on events that might affect the achievement of departmental priorities. To identify risks, we undertake a comprehensive scan of our operating environment, identify the causes of risks and assess how risks affect the achievement of priorities. Identify the sources of risk, areas of impacts and whether the source is within our control. Analyse the causes of risk, the consequences and existing controls in place to modify the risk. Evaluate by using the results of the analysis to make decisions about the department’s appetite for the risk and whether additional actions are needed to reduce the risk’s likelihood or impact. Information sources and methods to identify and assess Examples of information sources and methods to identify, analyse and evaluate include: Source Description Source Description Corporate history Individuals’ experiences and Stakeholder analysis Considers from records to understand what stakeholders’ perspectives happened in the past Interviews Data collection with individuals Process analysis Analyse processes to and/or focus groups and identify opportunities to gathering local intelligence improve Surveys/ Data from internal and external Other organisations Similar experiences and questionnaires customers and stakeholders knowledge PESTLE: Political, Economic, Possible (often extreme) Environmental Scenario planning analysis Sociological, Technological, future states to anticipate Environmental how threats and opportunities might develop SWOT: Strengths, Weaknesses, Opportunities, Threats Planning Monitoring of risk while reviewing Existing risk registers risk levels, controls – strategic and performance against objectives, and actions performance indicators and operational expected outcomes Writing a risk description A good risk description will:
Identifying risks We identify risks by generating a comprehensive list of threats and opportunities based on events that might affect the achievement of departmental priorities. To identify risks, we undertake a comprehensive scan of our operating environment, identify the causes of risks and assess how risks affect the achievement of priorities. Identify the sources of risk, areas of impacts and whether the source is within our control. Analyse the causes of risk, the consequences and existing controls in place to modify the risk. Evaluate by using the results of the analysis to make decisions about the department’s appetite for the risk and whether additional actions are needed to reduce the risk’s likelihood or impact. Information sources and methods to identify and assess Examples of information sources and methods to identify, analyse and evaluate include: Source Description Source Description Corporate history Individuals’ experiences and records to understand what happened in the past Stakeholder analysis Considers from stakeholders’ perspectives Interviews Data collection with individuals and/or focus groups and gathering local intelligence Process analysis Analyse processes to identify opportunities to improve Surveys/ questionnaires Data from internal and external customers and stakeholders Other organisations Similar experiences and knowledge Environmental analysis PESTLE: Political, Economic, Sociological, Technological, Environmental SWOT: Strengths, Weaknesses, Opportunities, Threats Scenario planning Possible (often extreme) future states to anticipate how threats and opportunities might develop Planning – strategic and operational Monitoring of risk while reviewing performance against objectives, performance indicators and expected outcomes Existing risk registers risk levels, controls and actions Writing a risk description A good risk description will:
Info-Sheet-Identifying-and-Describing-Risks.docx