What is integrated risk management?
Integrated risk management (IRM) is a set of practices and processes supported by a risk-aware culture and enabling technologies, that improve decision making and performance through an integrated view of how well an organization manages its unique set of risks.
What is an integrated risk management framework?
Integrated Risk Management framework includes the strategic combination of risk management techniques to manage current and future risks faced by an organization. It defines the specific set of functional activities and processes used to manage risks and describes the accountability and reporting methods that will support the risk management process.
Components of an integrated risk management framework
Risk identification
Identifying the extent and nature of the risks to your organization is key to risk management. By “risk,” we mean any threat or event that could hinder your organization from achieving its goals.
The risk identification process, therefore, begins with understanding your organization’s goals. It should then include all potential risks, threats, and events that could harm its ability to reach those goals, whether they are under your control.
- Who should be involved in identifying risks?
- How much rigor is needed for particular risk identification activities?
- The type of data you must collect and the level of detail that you need.
- How you should document the risks you find for risk assessment purposes.
Risk assessment
Risk assessment is where organizations need to break down and analyze their identified risks. The threat level and how often the risk can occur are often done during this phase.
Risk assessment concentrates on risks that occur after you have assessed for existing controls and any existing risk responses, sometimes referred to as residual risk. On occasion, risk assessments can assess inherent risk: the level of risk before you consider existing controls and any existing risk responses.
During risk assessment you should be asking questions like the ones listed below:
- Who should be involved in the risk assessment?
- How much bandwidth is needed for a specific risk assessment activity?
- What type of information do you need to collect and what level of detail is needed?
- How you should document assessed risks for risk response purposes.
- How will you conduct your third-party risk assessment?
Risk response
Identifying and assessing risks are essentially useless if you aren’t going to meet them with a strategic response. Risk response is the process of selecting and implementing strategies to respond to a specific risk. Usually, you select a basic response strategy. Ideally, your tolerance for a specific risk should decide your risk response.
Whatever action you decide to take it is important to remember that you must have a plan developed for said action. Make sure to create a plan that outlines the specific actions, responsibilities, and timelines of the action. Your risk response strategy should include all the activities to go with the risk response, such as communications and outreach.
When you define your risk response activities within the risk management process, you might want to offer direction in terms of:
- Considering the wider context of the risk, including the business objectives you’ve defined and the outcomes that you expect;
- How stakeholders inside and outside your company will tolerate the risks;
- Your priorities in terms of allocating resources.
Risk communication
Risk communication, a key part of the decision-making process, refers to how you communicate and report information about risks to the appropriate levels of your organization at the right times, to support your decision-makers in their decision-making.
This includes communicating risk information internally to your employees across different operational areas, as well as externally to clients and stakeholders. An important aspect of effective risk management communication is giving your decision-makers enough information so they can contribute to the decision-making process in an informed way.
Risk communication also lets you reuse risk information for other processes, which means you won’t have to conduct multiple risk assessments in the same area for different purposes (say, for auditing, planning, and resource allocation).
As with risk identification and risk assessment, you can use a number of tools and techniques to communicate risk information. You should, however, consider implementing a standardized method to communicate risks.
In defining risk communication activities within the risk management process, you should consider offering information about:
- What type of data do you need to communicate at various stages; that is, what type of information do stakeholders need and want.
- Who the audience is for this information: your employees, your management, external stakeholders.
- How you will communicate the information to the right people.
Risk monitoring
Monitoring your risks is critical to ensure that the information you have about them continues to be relevant. Risk monitoring involves reviewing and monitoring whether your risk profile changes after you implement internal controls.
That means you have to review your risk information regularly so that you can account for the effect that changing circumstances have on your existing risk controls. It also means that you must review your risk responses to assure that you’ve implemented your risk responses effectively and that you are achieving your business objectives. Monitoring risks also enables you to identify improvements that you could make to the risk management process.
In defining risk monitoring activities within the risk management process, you might want to offer information about:
- Who should be involved in monitoring new risks?
- How you should monitor the changes and the level of risks and how you should monitor each risk’s continuing relevance through its life cycle.
- How you should monitor the progress on implementing risk responses.
- How you should monitor the effectiveness of risk responses as it pertains to moving risks toward levels your company can tolerate.