Useful risk information | Norman Marks on Governance, Risk Management, and Internal Audit

This is going to be a longer post than normal, so please make sure you have the time to read and consider it.

It includes not only a case study based on a real-life risk-based decision (as if some are not risk-based!), but also a discussion of a “model” for considering all the sources of risk and opportunity when making a decision.

The themes or principles are:

1. The risk practitioner needs to help make the informed and intelligent decisions necessary to achieve enterprise objectives (i.e., success).
2. The risk practitioner needs to ensure decision-makers have the information they need, tailored to each decision.
3. All the significant sources of risk and opportunity (i.e., what might happen) need to be considered together, not individually. Evaluating and treating them individually can lead to sub-optimal decisions.

I would value your thoughts on my approach, how the case study was ‘solved’, and whether future risk management standards/frameworks should address the multi-risk scenario.

There are six sections:

1. Commentary
2. A case study is explained
3. The results of the initial assessment and decision
4. Mitigation and the final assessment
5. Discussion of the process followed
6. Closing thoughts

COMMENTARY

The way I see it, many if not most risk practitioners are too tied up in their own (i.e., insular) thinking, too…