- Welcome to lesson 24,
Explain Elements of the Risk Management Program.
In lesson 24.1 we're gonna discuss
Fundamental Risk Concepts.
Now, if I asked you what risk was, what would you say?
Well, most people would say,
"Ah, the fact that something bad would happen."
But in fact, we're gonna define risk
as the uncertainty of outcome.
The more risky something is
the less certain we are of the outcome.
Outcome could be good, outcome could be bad,
but risk is really broadly defined as uncertainty.
Now, risk or uncertainty is assessed
by evaluating the combination of the likelihood
of something happening and the impact if it does happen.
That the impact could be positive or negative, right?
You put money maybe in the stock market
in a retirement fund, right?
Because you're hoping to have a really good,
solid financial requirement.
If you are very risk adverse,
you don't like a lot of uncertainty,
maybe you're putting it into CDs or treasury bills.
If you are pretty comfortable with risk, right?
You may go, "Oh, I wanna go into emerging markets
or new companies."
Less certainty, but maybe a better return.
So your outcome could be positive or negative.
But generally in an organization,
risk is studied from the perspective
of a negative outcome or consequences.
It'd be awesome if the positive thing happened,
but we're really concerned with is, okay,
but what if it doesn't work out?
What would be the negative outcome or consequence?
The negative risk is also a function
of likelihood and impact.
The likelihood or probability
of the chance of a particular risk event occurring,
and impact being the measure of the magnitude of harm.
So likelihood and impact.
Now, there are a number of factors
that influence likelihood and impact.
Threat, the vulnerability, the control strength,
the risk volatility, the risk velocity, and cascading risk.
The threat could be adversarial.
We've talked a lot about our adversarial threats,
or they could be non-adversarial.
Where non-adversarial means
we don't really have an opponent.
But non-adversarial could be, for example,
a weather related issue.
Vulnerabilities are inherent or unmitigated weaknesses.
The control strength is how strong our controls,
and how much work factors required to bypass
or get through our controls.
Then we have risk volatility,
which is the variance of conditions,
and risk velocity, which is the speed of impact.
If this thing happened, how fast would it happen?
And then cascading risk
is all about a chain reaction of events.
So we've already talked about threats
and vulnerabilities and controls.
Let's talk a little bit about velocity and volatility.
Volatility describes the extent to which the level of risk
is likely to change over time.
So low-risk volatility means that the level of risk
is relatively stable and it's predictable over time.
But high-risk volatility means that the level of risk
is likely to fluctuate significantly over time.
Risk velocity means how fast an exposure
can impact an organization.
Now, risk velocity is the time that passes
between the occurrence of an event
and the point at which the organization
first feels its effect.
When the velocity is low,
there's time to detect and respond.
But when the velocity is very high,
detection and response are much more challenging
because you have such a small, small window.
And then cascading risk is a principle
that often risks are linked and failing to address one risk
could cause a chain reaction or a cascade.
Cascading risk is divided into three categories.
Parallel risk, serial risk, and mixed risk.
Where mixed risk refers to the combination
of parallel and serial.
So parallel is things happening at the same time.
Serial is one after another.
Mixed risk is really the combination of the two.
Now, many organizations have what's known
as a risk appetite statement,
and very often it is a compliance requirement.
Risk appetite is the level of risk
that an organization is comfortable engaging in,
but it's never just one level of risk
because there's all kinds of different risks, right?
There is strategic risk, compliance risk,
cybersecurity risk, capital risk, financial risk,
transactional risk, ESG risk, and the list goes on and on.
So generally, a risk appetite will be determined
for each of those different risk categories.
So again, there are multiple categories of business risk,
including strategic, reputational, operational,
financial, compliance, ESG, capital, and resilience.
Now, the board of directors or equivalent
will determine the risk appetite on a per category basis,
and then they'll publish the risk appetite statement
for use by the organization.
And it is really, really useful
because that lets management know the level of risk
that the organization is willing to take
in these different areas.
Remember, the level of uncertainty.
Now, there tends to be three risk appetite approaches.
Expansive, conservative, and neutral.
Expansive risk appetite indicates a willingness
to take on a high degree of risk
in pursuit of significant gains.
Now, that might be investing in new ventures,
pursuing aggressive strategies,
or taking on significant debt.
Conservative risk appetite indicates a preference
for more low-risk activities,
and a focus on preserving money, preserving wealth,
and minimizing losses.
A neutral risk appetite
falls somewhere in between expansive and conservative,
with a focus on balancing risk
and reward in pursuit of long-term stability and growth.
And of course, the organization's strategic objectives.
Now, these will be determined on a per risk category basis.
So it is very likely an organization
could be expansive one area, conservative in another area,
and neutral yet in other areas.
Risk management implies that actions are being taken
to either mitigate the impact of an unfavorable outcome,
and, or enhance the likelihood of a positive outcome.
Now, every organization really has to manage risk, right?
And they manage risk in alignment
with their strategic objectives,
their compliance and legal requirements,
and their risk appetite.
Now, risk tolerance is an acceptable variation
in outcomes related to specific performance measures.
There's a lot of confusion about risk tolerance.
Sometimes it gets conflated with risk appetite.
Risk tolerance always refers
to when we have specific performance measures about risk,
how much variation or variance can we have in that measure
that we'll accept.
And that my friends brings us to a 3-Second Challenge.
Five challenge questions, three seconds each.
Let's do it.
The probability that an event will occur. One, two, three.
That's the likelihood, and that's gonna be important
when we start doing our risk assessments.
Number two, uncertainty of outcome.
What is that? One, two, three.
And that is risk.
Number three, measuring the magnitude of harm.
One, two, three. That's impact.
Number four, how fast an exposure
can impact an organization.
One, two, three. That's gonna be velocity.
I always think a roadrunner going through velocity.
And number five, risk appetite approach
that indicates a preference for low-risk activities.
One, two, three.
And that's gonna be a conservative approach.
Let's do a Security-in-Action.
Put our knowledge into use about a risk appetite statement.
You recently learned that the non-profit you work for
doesn't have a risk appetite statement.
Now you'd like to approach management
and explain the benefits.
So what might you tell them?
Okay, so you're working for a non-profit,
doesn't have a risk appetite statement,
you'd love the guidance
that a risk appetite statement could provide.
So you wanna approach management and explain the benefits.
And my question to you is, what might you tell them
about a a risk appetite statement?
Go ahead and put me on pause
and jot down some notes about the benefits.
Well, a risk appetite statement provides a framework
for decision-making and risk management strategies.
And some of the benefits include,
it provides clarity and direction,
it supports our risk management activities,
so we can say, okay, "We can do X, Y, Z,"
because this is the risk appetite in a particular level.
And it demonstrates transparency from the top down
and says, "This is what we're willing to do,"
and it builds trust, right?
Because at the top we've said,
"This is what we're willing to do,
and we're gonna allow you to implement
to these various risk appetite levels."
It's great having a risk appetite statement.
A lot of organizations don't.
If yours doesn't, you may wanna follow up on this.
Doing so would be Security-in-Action.
There's your word cloud.
Make sure you've got these really foundational concepts down
before moving on.
But when you're ready, I'll see you the next lesson.