Business Risk Assessment and Management Process

Risk assessment and management should be an integral part of an organization's life cycle asset management. It is a vital part of any business plan for all infrastructure owners and managers.

The types of risks assessed should include:

• Commercial business risks (asset creation, contracting out, etc.)
• Customer expectations and political implications of failing to meet these expectations
• Product and service delivery failures covering quality, quantity and degree of failure
• Capital investment and maintenance risks (risks to the organization of not undertaking a specific capital project or maintenance).

The graphic below illustrates the process for evaluating and reviewing risk:

Risk Policy

How risk is assessed and managed by the organization.

Risk policies range from the individual asset to the entire network or system of assets - called the "whole of business" risk.

Best appropriate practice includes:

Corporate-wide business risk assessment and management policy and processes, covering all forms of business risk, including:

• Strategic business risks
• Regulatory risks
• Asset failure risks
• Operator errors
• Corporate knowledge loss
• External risks, including:
  • Power failure
  • Floods, bushfires, earthquakes, cyclones and other acts of Nature
  • Occupational health and safety.

Risk Identification

The assessment looks at how the organization identifies risk across the entire life cycle, including income generation.

Best appropriate practice includes:

That risk is assessed uniformly across all business units for all asset types and service delivery.

Risk Quantification

How the organization assesses the risk it faces (using simple point score type methods and economic "cost of consequence" scoring) and the likelihood of the risk events occurring.

Best appropriate practice includes:

A staged business risk assessment including basic, intermediate and advanced, as deemed relevant, for example:

• Level 1 Risk Assessment - using a basic point score system to rank risk (for example, 1 - 9)
• Level 2 Risk Assessment - using a broader range of point score to more robustly rank risk (for example, 1 - 500)
• Level 3 Risk Assessment (Advanced) - using estimated economic costs of the full probable range of the consequences of failure on the organization and the community.

Risk Analysis

How the organization evaluates its risk reduction options and how business risk exposure is reported internally and externally.

Best appropriate practice includes:

All risk reduction opportunities are judged against the "do nothing" option.

Risk Reduction Management Program

How the organization ensures that risks are managed and how it monitors this activity.

Best appropriate practice includes:

Risk reduction strategies are adopted in the Asset Management Plan. They focus on either reducing the risk to the organization or on reducing the consequence of failure, or a combination of both.

The strategies use a "business case" approach, that is, an economic cost benefit basis for the business.