# data[].attributes.body
Up-front planning for contingency is one approach to mitigate risk (Jedd, 2005) and to develop recovery plans in case of unforseen event (Felstead, 2005). According to the PMI (2008) risk management should be done in four steps, three of which have to be done during the early stages of the project: Stage 1= identification of all the possible risks, looking at technical risks, external risks, organisational risks or management risks;
Stage 2 = Risk assessment  to evaluate which ones are acceptable and which ones have to be resourced;
Stage 3 =develop strategies and contingency plans;
Last stage = monitoring all the identified risks.
Felstead (2005) suggested a similar model for risk management: 1.Identify; 2.Evaluate risks; 3.Treat risk; 4.Monitor and review; 5.Communicate and consult.

# data[].attributes.body
1. Communication and consultation with internal and external stakeholders, where practicable, to gain their input to the process and their ownership of the outputs. It is also important to understand stakeholders’ objectives, so that their involvement can be planned and their views can be taken into account in setting risk criteria.
2. Monitoring and review, so that appropriate action occurs as new risks emerge and existing risks change as a result of changes in either the organization’s objectives or the internal and external environment in which they are pursued. This involves environmental scanning by risk owners, control assurance, taking on board new information that becomes available, and learning lessons about risks and controls from the analysis of successes and failures.

# data[].attributes.headline
Official Resources: IS0 31000 - a new globally accepted standard for risk
management together with a new, associated vocabulary in ISO Guide 73

# data[].attributes.subject
Official Resources: IS0 31000 - a new globally accepted standard for risk
management together with a new, associated vocabulary in ISO Guide 73

# data[].attributes.body
ISO, the international body charged with achieving standardization, set out to achieve consistency and reliability in risk management by creating a standard that would be applicable to all forms of risk.

Purpose=to provide a sound basis for decisions on whether risks are acceptable and, if necessary, obtain reliable information how they can be dealt with

The new standard supports a new, simple way of thinking about risk and risk management and is intended to begin the process of resolving the many inconsistencies and ambiguities that exist between many different approaches and definitions.

# data[].attributes.body
What are the merits of using decision-making tools?
What decision-makers are looking for is the optimum solution. To help gain understanding of the various factors that influence possible outcomes, a number of
decision-making tools can be used. One particular decision-making technique is to
use a decision tree; that is a way of representing graphically the decision processes
and their various possible outcomes. They are particularly useful when project
managers have to make a decision about a choice of direction when there are
uncertainties about the results of adopting that option. Checklists can be used to
assess various aspects of a number of proposals to make comparisons between the
different options. The number of criteria and the classifications will be dependant
upon the specific project. However, the greater the number of criteria the more in-depth
the analysis will be.

# data[].attributes.body
In September 1982, three people died in the US after consuming cyanidecontaminated
Tylenol capsules. Testing and the discovery of further strychninelaced
capsules led Johnson & Johnson to recall 31 million products at a cost of
over $100 million. Although sabotage was suspected, no one was charged and
J&J initiated a risk-prevention project that resulted in tamper-proof packaging.
Their response was lauded as a successful case of crisis management
(market share regained in eight months). In February 1986, cyanide-laced
Tylenol killed another woman and fed to the discovery of more contaminated
bottles. These were traced back to specific projects involving changing
production facilities; and another recall followed. Control systems within
the project execution were clearly incapable of preventing such incidents
and therefore the capsule form was abandoned. These recall and project costs
were estimated at over $150 million.
In 1990, sparkling mineral water producer Perrier ordered a product recall as
reports of benzene contamination emerged. To compound the problem,
explanations of the source of the benzene differed: Perrier (US) reported it
was an exclusively North American issue; Perrier (France) stated the source
was a cleaning fluid used on the US bottling line; Perrier (UK) said they had no
idea. Three days after the French announcement, it was established that the
contamination had been caused by a failure of a project to replace charcoal
filters in the technology used to process source water. This project failure proved
to be a significant source of advantage for Perrier's rivals who rapidly gained
much more market share.
Curiously, despite its much more serious human health implications, Johnson &
Johnson's positive and open response to the Tylenol project crisis did little
long-term damage to the product or the parent brand and in the end came to
be recognized as an example of crisis project management 'best practice'.
Conversely, the Perrier project incident resulted in little actual harm to people
but perhaps because of their confused and secretive corporate reaction, US
consumer opinion swung against the brand and their previously dramatic
growth profile ceased

# data[].attributes.body
It is widely recognized that strategic, project and operational failures are all too common:
– Only 28% of IT projects deliver on time and on budget.  More than 25% fail to deliver at all (source - PMI Risk symposium 2005)
– Some make headlines (Wembley Stadium, Denver International Airport, Heathrow Terminal 5 etc), many more are quickly forgotten.

According to the Project Management Institute, projects with a sound risk process can expect a 15% higher success rate than standard projects.
– 17% increase in cost efficiency
– 15% increase in schedule efficiency
– A single averted risk can pay for all risk management activity for that project

Any organization that effectively manages risk will experience significant benefits throughout a number of areas, including:

•  Improved strategic and business planning
•  More effective use of resources
•  Increased ability to deliver on time
•  Reduced costs by limiting legal action or preventing breakages
•  Improved reliability leading to an enhanced reputation
•  An ability to quickly grasp new opportunities
•  Fewer breakdowns, fewer shocks and fewer unwelcome surprises
•  Enhanced communication between Business Units and Departments
•  The ability to reassure key stakeholders throughout the organization
•  The promotion of continuous improvement, leading to higher quality of output
•  A more focussed internal audit programme
•  Robust contingency planning

In simple terms, objectives are more likely to be achieved and damaging things will not happen or are less likely to happen.

http://www.irisintelligence.com/risk-management-explained/why-manage-risk.html

1. Compliance. One of the most important benefits of an effective risk management program is it helps ensure an ASC is in compliance with several key aspects of accreditation, Medicare Conditions for Coverage, and in some states, licensure requirements, says Ms. Hiatt.

2. Identify system and provider weaknesses before an adverse event occurs. "An effective risk management program is an organization's first line of defense in identifying a weakness or system failure before it occurs and in mitigating or reducing any loss after it occurs," says Ms. Hiatt.

3. Mitigation or reduction of potential loss after an event has occurred. Sooner or later, all providers, if they practice long enough, will likely face a significant adverse patient outcome, says Ms. Hiatt. "An effective risk management program is the provider's first line of defense," she says. "If you follow the principles of risk management, you can mitigate collateral losses following an adverse event."

4. Provides a framework to gather data that can be used to improve patient outcomes. "When people think of risk management, they usually think of incidence reports, but risk management is more than that," Ms. Hiatt says. "It's patient satisfaction surveys, patient grievance complaints, and infection investigation tools, just to name a few, and all of these tools are only effective if the organization provides the required education to employees when they are hired and annually thereafter." Educating the organization's employees regarding risk management is also an accreditation requirement.

5. Reduce number, type and severity of adverse events. While no program will prevent every adverse event, the number of events can be reduced if the organization is fully engaged, recognizes the protection afforded to it through risk management, and actively encourages its employees participate in risk management.

http://www.beckersasc.com/asc-accreditation-and-patient-safety/5-tangible-benefits-of-an-effective-risk-management-program.html

# data[].attributes.body
Effect of uncertainty on objectives.

The ISO 31000 definition of risk shifts emphasis from past preoccupations with the possibility of an event (something happens) to the possibility of an effect and, in particular, an effect on objectives. When risk is defined like this, it reveals more clearly that managing risk is, quite simply, a process of optimization that makes the achievement of objectives more likely. Risk treatment is then concerned with changing the magnitude and likelihood of consequences, both positive and negative, to achieve a net increase in benefit. Controls then are the outcomes of risk treatment, whose purpose is to modify risk.

In the past, it has been common for risk to be regarded solely as a negative concept that organizations should try to avoid or transfer to others. However, it is now widely understood that risk is simply a fact of life and is neither inherently good nor inherently bad. To avoid it entirely is to forgo the opportunity of pursuing objectives.

# data[].attributes.body
The principles of effective risk management in ISO 31000 are that it should:
1. Create and protect value;
2. Be an integral part of all organizational processes;
3. Be part of decision making;
4. Explicitly address uncertainty;
5. Be systematic, structured, and timely;
6. Be based on the best available information;
7. Be tailored;
8. Take into account human and cultural factors;
9. Be transparent and inclusive;
10. Be dynamic, iterative, and responsive to change;
11. Facilitate continual improvement of the organization.
The annex also contains the important characteristics of advanced risk management that:
– An emphasis is placed on continual improvement in risk management through the setting of organizational performance goals, measurement, etc.;
– There is comprehensive, fully defined, and fully accepted accountability for risks, controls, and risk treatment tasks;
– All decision making within the organization involves the explicit consideration of risks and the application of risk management to some appropriate degree;
– There is continual communication with external and internal stakeholders, including comprehensive and frequent reporting of risk management performance, as part of good governance;
– Risk management is viewed as central to the organization’s management processes, such that risks are considered in terms of effect of uncertainty on objectives.

# data[].attributes.body
http://www.sciencedirect.com/science/article/pii/S0166497203000336

http://www.sciencedirect.com/science/article/pii/S026378630100045X

http://www.emeraldinsight.com/doi/full/10.1108/10650750610706970

http://www.sciencedirect.com/science/article/pii/S0263786301000801

# data[].attributes.body
There is no widely accepted definition for project-related risk however, we can provide a working definition: “risk is the potential for unwanted negative consequences from project-related event”

Pure and speculative risk:

Pure risks, involving events that will produce the possibility only of loss, and speculative risks that emerge from competitive scenarios and hold the potential for loss or gain.

A pure risk might be the risk that, while undertaking building expansion to an existing facility, a member of the public (a guest) is involved in an accident.

A speculative risk might be the risk associated with developing a new computer-based customer relationship system

Risk enters a project from many different sources. In some instances, it can be organizationally-political. Then there are economic forces (such as fluctuating interest rates or exchange rates). Social issues, especially the environmental ones, are assuming a high profile at present. There is also technology presenting newer and better solutions at a faster and faster rate

Risk Management

First, you must identify risk, determine its consequence, and then seek ways of overcoming it. The consequence of project risk is characterized by the following risk factors.

Project managers need to predict the possible deviations from the plan, to estimate the probability of those deviations occurring, and to determine the consequential damage if they do occur.