Risk Assessment - Revision history

User at 15:46, 19 December 2022

2022-12-19T15:46:03Z

User at 17:32, 11 November 2022

2022-11-11T17:32:29Z

User: The LinkTitles extension automatically added links to existing pages (https://github.com/bovender/LinkTitles).

2021-02-06T18:05:10Z

The LinkTitles extension automatically added links to existing pages (https://github.com/bovender/LinkTitles).

User at 19:47, 19 March 2020

2020-03-19T19:47:03Z

User at 19:42, 19 March 2020

2020-03-19T19:42:43Z

User at 19:41, 19 March 2020

2020-03-19T19:41:33Z

User at 18:29, 19 March 2020

2020-03-19T18:29:07Z

User at 18:06, 19 March 2020

2020-03-19T18:06:33Z

User at 20:02, 25 September 2019

2019-09-25T20:02:19Z

User: Created page with "'''Content Coming Soon'''"

2019-01-05T14:29:41Z

Created page with "'''Content Coming Soon'''"

New page

'''Content Coming Soon'''

← Older revision		Revision as of 15:46, 19 December 2022
Line 72:		Line 72:


−	The core difference between the two [[business continuity]] tools is that Business Impact Analysis (BIA) does not directly focus on the likelihood of events, rather, it assumes worst-case scenarios. The differences that stem from this are summarised in the table below.	+	The core difference between the two [[Business Continuity Management (BCM)\|business continuity management]] tools is that Business Impact Analysis (BIA) does not directly focus on the likelihood of events, rather, it assumes worst-case scenarios. The differences that stem from this are summarised in the table below.

	[[File:BIA_Risk_Assessment_Difference.png\|400px\|The Difference Between Risk Assessment and BIA]]<br />		[[File:BIA_Risk_Assessment_Difference.png\|400px\|The Difference Between Risk Assessment and BIA]]<br />

@@ Line 1: / Line 1: @@
-'''[[Risk]] Assessment''' is a [[process]] to identify potential hazards and analyze what could happen if a hazard occurs. A [[Business Impact Analysis (BIA)|business impact analysis (BIA]]) is the process for determining the potential impacts resulting from the interruption of time sensitive or critical [[Business Process|business processes]].<ref>Defining Risk Assessment [https://www.ready.gov/risk-assessment Ready.Gov]</ref>
+'''[[Risk]] Assessment''' is a [[process]] to identify potential hazards and analyze what could happen if a hazard occurs. A [[Business Impact Analysis (BIA)|business impact analysis (BIA]]) is the process for determining the potential impacts resulting from the interruption of time-sensitive or critical [[Business Process|business processes]].<ref>Defining Risk Assessment [https://www.ready.gov/risk-assessment Ready.Gov]</ref>
 Broadly speaking, a risk assessment is the combined effort of:
-*identifying and analyzing potential (future) events that may negatively [[impact]] individuals, assets, and/or the environment (i.e. risk analysis); and
+*identifying and analyzing potential (future) events that may negatively impact individuals, assets, and/or the environment (i.e. risk analysis); and
 *making judgments "on the tolerability of the risk on the basis of a risk analysis" while considering influencing factors (i.e. risk [[evaluation]]).
 Put in simpler terms, a risk assessment determines possible mishaps, their likelihood and consequences, and the tolerances for such events.[1] The results of this process may be expressed in a quantitative or qualitative fashion. Risk assessment is an inherent part of a broader risk [[management]] [[strategy]] to "introduce [[control]] measures to eliminate or reduce" any potential risk-related consequences.<ref>A broad definition of Risk Assessment [https://en.wikipedia.org/wiki/Risk_assessment Wikipedia]</ref>
@@ Line 26: / Line 26: @@
 == Performing an Effective Risk Assessment<ref>Conducting a Risk Assessment [https://www.assp.org/news-and-articles/2019/02/12/conducting-a-risk-assessment assp.org]</ref> ==
-Once you have gathered the [[Data|data]] and set the scope for a risk assessment project, the process moves on to conducting the risk assessment itself. Risk assessment serves many purposes for an [[Organization|organization]], including reducing [[Operational Risk|operational risks]], improving safety performance and achieving objectives.  While many individuals are involved in the process and many factors come into play, performing an effective risk assessment comes down to three core elements: risk identification, risk analysis and risk evaluation.
+Once you have gathered the [[data]] and set the scope for a risk assessment project, the process moves on to conducting the risk assessment itself. Risk assessment serves many purposes for an [[organization]], including reducing [[Operational Risk|operational risks]], improving safety performance and achieving objectives.  While many individuals are involved in the process and many factors come into play, performing an effective risk assessment comes down to three core elements: risk identification, risk analysis and risk evaluation.
 *Risk Identification: To effectively address the hazards and risks within a workplace, you must first properly identify them. When conducting risk identification, the ISO 31000-2018 [[standard]] recommends that safety professionals and [[Stakeholder|stakeholders]] examine a wide variety of factors, including:
 **Tangible and intangible sources of risk
@@ Line 66: / Line 66: @@
 Risk assessments recognize all of the risks that have the potential to impact the organization’s operations. It calculates both the impact and the forward likelihood of potential events. A risk assessment is therefore greatly concerned with the possible causes of disruption, from which likelihood is then derived. It’s a valuable tool for recognizing threats and taking action to minimize risks to an acceptable level.
-[[Business]] [[Impact Analysis]] (BIA) assesses the amount your organisation stands to lose (or perhaps even gain) under defined circumstances. The analysis assumes worst-case scenarios and involves understanding the type and rate of expected loss under fixed conditions. BIA is used to recognise the magnitude of financial and operational impacts that derive from disruptions. It enables you to understand how your business would cope during downtime and calculate Recovery Time Objectives (RTOs) for your services.
+[[Business]] Impact Analysis (BIA) assesses the amount your organisation stands to lose (or perhaps even gain) under defined circumstances. The analysis assumes worst-case scenarios and involves understanding the type and rate of expected loss under fixed conditions. BIA is used to recognise the magnitude of financial and operational impacts that derive from disruptions. It enables you to understand how your business would cope during downtime and calculate Recovery Time Objectives (RTOs) for your services.
@@ Line 72: / Line 72: @@
-The core difference between the two [[Business Continuity|business continuity]] tools is that [[Business Impact Analysis (BIA)]] does not directly focus on the likelihood of events, rather, it assumes worst-case scenarios. The differences that stem from this are summarised in the table below.
+The core difference between the two [[business continuity]] tools is that Business Impact Analysis (BIA) does not directly focus on the likelihood of events, rather, it assumes worst-case scenarios. The differences that stem from this are summarised in the table below.
 [[File:BIA_Risk_Assessment_Difference.png|400px|The Difference Between Risk Assessment and BIA]]<br />
@@ Line 87: / Line 87: @@
 == See Also ==
-[[Governance]]<br />
+*[[Governance]]
-[[Corporate Governance]]<br />
+*[[Corporate Governance]]
-[[IT Governance]]<br />
+*[[IT Governance]]
-[[Risk Analysis]]<br />
+*[[Risk Analysis]]
-[[Risk Assessment Framework (RAF)]]<br />
+*[[Risk Assessment Framework (RAF)]]
-[[Risk Management]]<br />
+*[[Risk Management]]
-[[Risk Management Framework (RMF)]]<br />
+*[[Risk Management Framework (RMF)]]
-[[Information Technology Risk (IT Risk)]]<br />
+*[[Information Technology Risk (IT Risk)]]
-[[Enterprise Risk Management (ERM)]]<br />
+*[[Enterprise Risk Management (ERM)]]
-[[Risk IT Framework]]<br />
+*[[Risk IT Framework]]
-[[Risk Based Testing]]<br />
+*[[Risk Based Testing]]
-[[Risk-Adjusted Return]]<br />
+*[[Risk-Adjusted Return]]
-[[Risk-Adjusted Return on Capital (RAROC)]]<br />
+*[[Risk-Adjusted Return on Capital (RAROC)]]
-[[Risk Matrix]]<br />
+*[[Risk Matrix]]
-[[Risk Maturity]]<br />
+*[[Risk Maturity]]
-[[Risk Maturity Model (RMM)]]<br />
+*[[Risk Maturity Model (RMM)]]
-[[Risk Mitigation]]<br />
+*[[Risk Mitigation]]
-[[Operational Risk]]<br />
+*[[Operational Risk]]
-[[Operational Risk Management (ORM)]]<br />
+*[[Operational Risk Management (ORM)]]
-[[Architectural Risk]]
+*[[Architectural Risk]]
 == References ==
 <references/>

@@ Line 1: / Line 1: @@
-'''Risk Assessment''' is a process to identify potential hazards and analyze what could happen if a hazard occurs. A [[Business Impact Analysis (BIA)|business impact analysis (BIA]]) is the process for determining the potential impacts resulting from the interruption of time sensitive or critical [[Business Process|business processes]].<ref>Defining Risk Assessment [https://www.ready.gov/risk-assessment Ready.Gov]</ref>
+'''[[Risk]] Assessment''' is a [[process]] to identify potential hazards and analyze what could happen if a hazard occurs. A [[Business Impact Analysis (BIA)|business impact analysis (BIA]]) is the process for determining the potential impacts resulting from the interruption of time sensitive or critical [[Business Process|business processes]].<ref>Defining Risk Assessment [https://www.ready.gov/risk-assessment Ready.Gov]</ref>
 Broadly speaking, a risk assessment is the combined effort of:
-*identifying and analyzing potential (future) events that may negatively impact individuals, assets, and/or the environment (i.e. risk analysis); and
+*identifying and analyzing potential (future) events that may negatively [[impact]] individuals, assets, and/or the environment (i.e. risk analysis); and
-*making judgments "on the tolerability of the risk on the basis of a risk analysis" while considering influencing factors (i.e. risk evaluation).
+*making judgments "on the tolerability of the risk on the basis of a risk analysis" while considering influencing factors (i.e. risk [[evaluation]]).
-Put in simpler terms, a risk assessment determines possible mishaps, their likelihood and consequences, and the tolerances for such events.[1] The results of this process may be expressed in a quantitative or qualitative fashion. Risk assessment is an inherent part of a broader risk management strategy to "introduce control measures to eliminate or reduce" any potential risk-related consequences.<ref>A broad definition of Risk Assessment [https://en.wikipedia.org/wiki/Risk_assessment Wikipedia]</ref>
+Put in simpler terms, a risk assessment determines possible mishaps, their likelihood and consequences, and the tolerances for such events.[1] The results of this process may be expressed in a quantitative or qualitative fashion. Risk assessment is an inherent part of a broader risk [[management]] [[strategy]] to "introduce [[control]] measures to eliminate or reduce" any potential risk-related consequences.<ref>A broad definition of Risk Assessment [https://en.wikipedia.org/wiki/Risk_assessment Wikipedia]</ref>
@@ Line 13: / Line 13: @@
 *Determine whether a control program is required for a particular hazard.
 *Determine if existing control measures are adequate or if more should be done.
-*Prevent injuries or illnesses, especially when done at the design or planning stage.
+*Prevent injuries or illnesses, especially when done at the [[design]] or planning stage.
 *Prioritize hazards and control measures.
 *Meet legal requirements where applicable.
@@ Line 27: / Line 27: @@
 == Performing an Effective Risk Assessment<ref>Conducting a Risk Assessment [https://www.assp.org/news-and-articles/2019/02/12/conducting-a-risk-assessment assp.org]</ref> ==
 Once you have gathered the [[Data|data]] and set the scope for a risk assessment project, the process moves on to conducting the risk assessment itself. Risk assessment serves many purposes for an [[Organization|organization]], including reducing [[Operational Risk|operational risks]], improving safety performance and achieving objectives.  While many individuals are involved in the process and many factors come into play, performing an effective risk assessment comes down to three core elements: risk identification, risk analysis and risk evaluation.
-*Risk Identification: To effectively address the hazards and risks within a workplace, you must first properly identify them. When conducting risk identification, the ISO 31000-2018 standard recommends that safety professionals and [[Stakeholder|stakeholders]] examine a wide variety of factors, including:
+*Risk Identification: To effectively address the hazards and risks within a workplace, you must first properly identify them. When conducting risk identification, the ISO 31000-2018 [[standard]] recommends that safety professionals and [[Stakeholder|stakeholders]] examine a wide variety of factors, including:
 **Tangible and intangible sources of risk
 **Threats and opportunities
@@ Line 43: / Line 43: @@
 *Risk Evaluation: As the final step of risk assessment, risk evaluation calls on safety professionals to examine the results of the risk analysis and compare them to established risk criteria in order to determine where additional controls may be required and what those controls might be. As noted, bow-tie risk analysis is a technique for risk evaluation that has gained traction in the safety profession because it provides a more holistic view of risk and paints a picture of a specific hazardous event. The bow-tie analysis is centered around a potential incident, examining its causes, the preventive controls in place, the mitigative controls if it were to occur and the consequences of the incident.
 The benefit of a bow-tie analysis is the ability to better visualize a specific hazardous event, how it could occur, the consequences and how those consequences could be prevented or mitigated. Such an analysis does not, however, usually include a risk scoring mechanism, nor does it reflect the effectiveness of controls.  Regardless of the method, keep in mind that risk-based decision-making should take into account the wider context as well as the actual and perceived consequences to internal and external stakeholders.
-*Risk Communication: Threaded throughout all steps of the risk assessment process is a fourth element, equally crucial to effective risk management – risk communication.  Safety professionals must keep in mind that they must communicate the risks identified, analyzed and evaluated during the assessment to all involved so that everyone has a comprehensive understanding of the existing risks and how they can best be prevented or mitigated to achieve organizational objectives. Taking these steps enables all involved to have a comprehensive understanding of the hazards and risks that exist within facilities and processes, the consequences of the hazards present, and how those can be prevented or mitigated to protect workers’ health and safety.
+*[[Risk Communication]]: Threaded throughout all steps of the risk assessment process is a fourth element, equally crucial to effective risk management – risk communication.  Safety professionals must keep in mind that they must communicate the risks identified, analyzed and evaluated during the assessment to all involved so that everyone has a comprehensive understanding of the existing risks and how they can best be prevented or mitigated to achieve organizational objectives. Taking these steps enables all involved to have a comprehensive understanding of the hazards and risks that exist within facilities and processes, the consequences of the hazards present, and how those can be prevented or mitigated to protect workers’ health and safety.
@@ Line 66: / Line 66: @@
 Risk assessments recognize all of the risks that have the potential to impact the organization’s operations. It calculates both the impact and the forward likelihood of potential events. A risk assessment is therefore greatly concerned with the possible causes of disruption, from which likelihood is then derived. It’s a valuable tool for recognizing threats and taking action to minimize risks to an acceptable level.
-Business Impact Analysis (BIA) assesses the amount your organisation stands to lose (or perhaps even gain) under defined circumstances. The analysis assumes worst-case scenarios and involves understanding the type and rate of expected loss under fixed conditions. BIA is used to recognise the magnitude of financial and operational impacts that derive from disruptions. It enables you to understand how your business would cope during downtime and calculate Recovery Time Objectives (RTOs) for your services.
+[[Business]] [[Impact Analysis]] (BIA) assesses the amount your organisation stands to lose (or perhaps even gain) under defined circumstances. The analysis assumes worst-case scenarios and involves understanding the type and rate of expected loss under fixed conditions. BIA is used to recognise the magnitude of financial and operational impacts that derive from disruptions. It enables you to understand how your business would cope during downtime and calculate Recovery Time Objectives (RTOs) for your services.
@@ Line 72: / Line 72: @@
-The core difference between the two [[Business Continuity|business continuity]] tools is that Business Impact Analysis (BIA) does not directly focus on the likelihood of events, rather, it assumes worst-case scenarios. The differences that stem from this are summarised in the table below.
+The core difference between the two [[Business Continuity|business continuity]] tools is that [[Business Impact Analysis (BIA)]] does not directly focus on the likelihood of events, rather, it assumes worst-case scenarios. The differences that stem from this are summarised in the table below.
 [[File:BIA_Risk_Assessment_Difference.png|400px|The Difference Between Risk Assessment and BIA]]<br />
@@ Line 79: / Line 79: @@
 Whereas Business Impact Analysis can be conducted unescorted by risk assessment, risk assessment can’t reasonably occur without some form of BIA: risk assessment should use BIA to quantify and prioritise the risks it finds.
-The ‘siloing effect’ of ISO and other standards that are being adopted by organisations worldwide can result in confusion. Business continuity managers are faced with the artificial exclusivity demanded by compliance on the one hand and the overlapping integrated reality that is business.
+The ‘siloing effect’ of ISO and other standards that are being adopted by organisations worldwide can result in confusion. Business continuity managers are faced with the artificial exclusivity demanded by [[compliance]] on the one hand and the overlapping integrated reality that is business.
-ISO 22317 provides best practises for the BIA process, without reiterating any of the points in ISO 22301. However, as it provides information from a generalist perspective, practitioners may find that they need to create a workable roadmap or use business continuity software that is more appropriate to the size and scale of their organization.
+ISO 22317 provides best practises for the BIA process, without reiterating any of the points in ISO 22301. However, as it provides information from a generalist perspective, practitioners may find that they need to create a workable [[roadmap]] or use business continuity [[software]] that is more appropriate to the size and scale of their [[organization]].

← Older revision		Revision as of 19:47, 19 March 2020
Line 1:		Line 1:
−	A '''Risk Assessment''' is a process to identify potential hazards and analyze what could happen if a hazard occurs. A [[Business Impact Analysis (BIA)\|business impact analysis (BIA]]) is the process for determining the potential impacts resulting from the interruption of time sensitive or critical [[Business Process\|business processes]].<ref>Defining Risk Assessment [https://www.ready.gov/risk-assessment Ready.Gov]</ref>	+	'''Risk Assessment''' is a process to identify potential hazards and analyze what could happen if a hazard occurs. A [[Business Impact Analysis (BIA)\|business impact analysis (BIA]]) is the process for determining the potential impacts resulting from the interruption of time sensitive or critical [[Business Process\|business processes]].<ref>Defining Risk Assessment [https://www.ready.gov/risk-assessment Ready.Gov]</ref>

	Broadly speaking, a risk assessment is the combined effort of:		Broadly speaking, a risk assessment is the combined effort of:

@@ Line 1: / Line 1: @@
-A risk assessment is a process to identify potential hazards and analyze what could happen if a hazard occurs. A [[Business Impact Analysis (BIA)|business impact analysis (BIA]]) is the process for determining the potential impacts resulting from the interruption of time sensitive or critical [[Business Process|business processes]].<ref>Defining Risk Assessment [https://www.ready.gov/risk-assessment Ready.Gov]</ref>
+A '''Risk Assessment''' is a process to identify potential hazards and analyze what could happen if a hazard occurs. A [[Business Impact Analysis (BIA)|business impact analysis (BIA]]) is the process for determining the potential impacts resulting from the interruption of time sensitive or critical [[Business Process|business processes]].<ref>Defining Risk Assessment [https://www.ready.gov/risk-assessment Ready.Gov]</ref>
 Broadly speaking, a risk assessment is the combined effort of:
@@ Line 87: / Line 87: @@
 == See Also ==
 [[Risk Analysis]]<br />
 [[Risk Assessment Framework (RAF)]]<br />

@@ Line 16: / Line 16: @@
 *Prioritize hazards and control measures.
 *Meet legal requirements where applicable.
@@ Line 53: / Line 60: @@
 *Review and discuss control options with workers to ensure that controls are feasible and effective.
 *Use a combination of control options when no single method fully protects workers.

← Older revision		Revision as of 20:02, 25 September 2019
Line 1:		Line 1:
−	~~'''Content Coming Soon'''~~	+	A risk assessment is a process to identify potential hazards and analyze what could happen if a hazard occurs. A business impact analysis (BIA) is the process for determining the potential impacts resulting from the interruption of time sensitive or critical business processes.<ref>Defining Risk Assessment [https://www.ready.gov/risk-assessment Ready.Gov]</ref>
		+
		+
		+	== The Importance of Risk Assessment<ref>Why is Risk Assessment Important? [https://www.ccohs.ca/oshanswers/hsprograms/risk_assessment.html CCOHS]</ref> ==
		+	Risk assessments are very important as they form an integral part of an occupational health and safety management plan. They help to:
		+	*Create awareness of hazards and risk.
		+	*Identify who may be at risk (e.g., employees, cleaners, visitors, contractors, the public, etc.).
		+	*Determine whether a control program is required for a particular hazard.
		+	*Determine if existing control measures are adequate or if more should be done.
		+	*Prevent injuries or illnesses, especially when done at the design or planning stage.
		+	*Prioritize hazards and control measures.
		+	*Meet legal requirements where applicable.
		+
		+
		+	== See Also ==
		+	[[Risk Analysis]]<br />
		+	[[Risk Assessment Framework (RAF)]]<br />
		+	[[Risk Management]]<br />
		+	[[Risk Management Framework (RMF)]]<br />
		+	[[Information Technology Risk (IT Risk)]]<br />
		+	[[Enterprise Risk Management (ERM)]]<br />
		+	[[Risk IT Framework]]<br />
		+	[[Risk Based Testing]]<br />
		+	[[Risk-Adjusted Return]]<br />
		+	[[Risk-Adjusted Return on Capital (RAROC)]]<br />
		+	[[Risk Matrix]]<br />
		+	[[Risk Maturity]]<br />
		+	[[Risk Maturity Model (RMM)]]<br />
		+	[[Risk Mitigation]]
		+
		+
		+	== References ==
		+	<references/>