Insights Risk Resilience
Total Page:16
File Type:pdf, Size:1020Kb
Insights Risk Resilience ISSUE 01 / APRIL 2016 When Standards MatterMatter. Insights 22 Intro ISSUE 01 / APRIL 2016 They say that there is nothing more important than being fully equipped with the right knowledge, expertise, and resources to provide your customers satisfactory products and/ or services. But what is more important is the recognition of the dedication and hard work your 28 organization invests day-in and 10 day-out to not only meet customer expectations, but also exceed them. Everyday PECB is one step closer 34 to our vision of a world where best practices are widely disseminated, accessible, affordable, known and used. Our mission to enhance the accessibility of standards, compliance and education for people and organizations by 04 Why Risk Resilience? reducing the certification costs and widening the range for education and certification programs is 06 Risk Assessment in project Management gradually being accomplished. We will continue our journey to 10 Information Security in Banks and Financial Institutions support worldwide professionals that want to differentiate themselves, and follow best 14 Replacing OHSAS 18001 what will ISO 45001 Bring? practices based on internationally recognized standards. 18 Are You Metting Customer Expectations? Eric Lachapelle 22 Social Engineering and Risk From Cyber-Attacks CEO at PECB 14 28 Risk Assessment in Different Disciplines 30 Business Continuity with Cybersecurity 32 The Weakest Link in Information Security 34 News Flash 18 35 What’s Happening on Twitter In recent years, a rapid Before entering such market, it is very important to understand the needs, rules and strategies increase in foreign which help you to grow and increase profitability. An effective risk management strategy is a must. It means identification of project’s strength, weaknesses, opportunities and threats. These strate- investment, imports and gies are crucial for upcoming organizations’ events and activities; hence to ensure success, the Why world trade is occurring. potential problems should be handled or avoided. Achieving such objectives depends on prepara- As the economy is tion, evaluation and results of your strategic plan and goals. becoming more integrated, As an international certification body, PECB recognizes the importance of risk management pro- competitive and complex, cesses by presenting commitment and knowledge to risk management best practices and regu- Risk organizations find latory framework. It enables society to make better educated risk decisions through creating a themselves confronting culture of risk awareness. We do this first in our internal processes of every service that we provide, but also by providing professionals updated crucial information, through articles, infographics, international competitors. In whitepapers and webinars to help them increase their professional development entirely for free. response, many businesses Resilience Considering that our company is highly focused on making internationally recognized best prac- are increasingly looking tices accessible for everyone, we always involve professionals, webinar participants and readers for new opportunities in in our projects such as webinars, articles, and other informative campaigns. The main focus of our ? international market. projects is to address the essentials of the risk management newest topics and guide professionals when encountering issues related to their field. 4 | PECB Insights / APRIL, 2016 PECB Insights / APRIL, 2016 | 5 The necessity on reacting to risks may Methodologies such as SWOT analysis, Delphi Techniques, and Stakeholder analysis, RISK ASSESSMENT be critical and it involves the following: to mention a few, may be useful, but should be meaningful and time-efficient to the project in terms of execution, resource allocation and decision making. • Recognizing defensive and proac- tive actions to avoid risks or to Nowadays, one of the major complexities faced by Project Managers is the difficulty reduce its effects, of not covering a general risk register to refer to when identifying the project risk. For • Initiating further analysis to de- purposes of managing the execution of the project risk management, all project risks IN PROJECT MANAGEMENT crease insecurity through moni- should be recorded in the risk register, which is an exhaustive list of all risks identi- toring and measurement of key fied, their root causes and consequences, and what were the actions taken to address metrics. it. This should be updated constantly throughout the lifecycle of the project. the calculation applied to present either a single number or ABOUT RISK ASSESSMENT AND PROJECT sets of patterns that will explain the impact and probability of The benefits of performing risk assess- The process of identifying risks must engage all project team members so they can analyzed risks. ment in project management include contribute in adding details and take part in the risk assessment process, while at the MANAGEMENT Experience has revealed that qualitative analysis typically reduction to project risk exposure, same time, manage and align the project’s scope, critical tasks, resources and time- leads to a primary level of quantitative analysis, as the latter precise and clear decision making on lines. In addition, when risks are fully assessed, a risk treatment plan is developed and project is a set of inter-connected tasks intended present statistical evidence to the former, given its descrip- key issues within every project phase, should illustrate the level of risk which can be managed for the project, to achieve to attain a certain goal, with a particular series of tive nature of detailing risks. and clearer definition of risks related to its objectives and optimize resource utilization, preferably in costs. Risk can also be resources, within a fixed duration and cost. Given The risk evaluation stage includes both identification and particular projects with the risk assess- identified by competent specialists and professionals as well, which in this case are that each project tasks have specific timelines analysis of project risks and assists the project team in mak- ment approach. project managers. and deliverables, there are always uncertainties ing decisions to address the analyzed risks. The illustration Aconsidered as risks that are expected to happen and will af- shows the relationship between the impact and probability, fect the project’s success. which is also known as a Risk Map (or heat map). Risk Map IDENTIFYING PROJECT Risk comprises two factors: the probability of its occurrence, analyzes values that are plotted across this chart based on and the consequences if it does so. their risk levels, which is the output of risk analysis. With the In order to enable the analysis of risks related with a project, project’s risk criteria featured on the map, the project man- RISKS- A CLOSER LOOK the process of a project risk assessment and management is ager and his/her team are given a good visual on which risks required. If the processes are undertaken appropriately, it will should be given further attention. With mitigation strategies Identifying project risks marks is a raise the probability of successful completion of a project to planned, based on evaluated risks, having an effective risk challenging start for project managers performance, cost and time goals. The overall process of man- management framework implementation and risk treatment and his/her team, particularly in the aging uncertainties, which affects the achievement of project plans may not necessarily indicate the completion of risk project’s planning phase. The Project objectives, involves two activities: Risk Assessment and Risk treatment. Instead, it effectively minimizes the impact and it charter, which marks a formal statement Management. allows clear decisions to be made. of initiating a certain project, is a good springboard to identify risk sources and factors as the identification stage gener- Monitor effectiveness of Develop action plan A B IR Inherent Risk Level ally covers three things to identify: RISK ASSESSMENT - IN A NUTSHELL current mitigation plan and monitor progress RR Residual Risk Level TR Target Risk Level Risk analysis settles on obtaining a deeper understanding on The external which project tasks, outputs, or events would influence its context (e.g. the success. This requires project managers experience, knowl- 5 Critical project’s impact edge of the project, and critical thinking to decide on what Inherent to its external strategies should they embark, from where tactics and activi- 01 clients and ties will be based upon. 4 market) Performing risk analysis features two options a project man- Major ager can use depending on the identified risk source and its RISK ASSESSMENT AND PROJECT MANAGEMENT degree of detail: qualitative and quantitative analysis. Residual The internal 3 context (e.g. the MAKING A GOOD PAIR FOR PROJECT SUCCESS Qualitative analysis uses a descriptive set of attributes to Impact key deliverables qualify potential consequences and the possible chances that Siginfluence and controls at The process of risk assessment updates and enhances the project’s risk profile, will occur. This approach, by practice, will need further expla- strategic, tactical reflected in its project risk criteria, risk register, and risk treatment plans, done on a 2 02 nation to justify a risk’s position in this type of assessment, Target scheduled basis within the project timeline. albeit an easy practice to assert