Risk management

Example of risk assessment: A NASA model showing areas at high risk from impact for the International Space Station

Risk management is the identification, evaluation, and prioritization of risks (defined in ISO 31000 as the effect of uncertainty on objectives) followed by coordinated and economical application of resources to minimize, monitor, and control the probability or impact of unfortunate events[1] or to maximize the realization of opportunities.

Risks can come from various sources including uncertainty in financial markets, threats from project failures (at any phase in design, development, production, or sustainment life-cycles), legal liabilities, credit risk, accidents, natural causes and disasters, deliberate attack from an adversary, or events of uncertain or unpredictable root-cause. There are two types of events i.e. negative events can be classified as risks while positive events are classified as opportunities. Several risk management standards have been developed including the Project Management Institute, the National Institute of Standards and Technology, actuarial societies, and ISO standards.[2][3] Methods, definitions and goals vary widely according to whether the risk management method is in the context of project management, security, engineering, industrial processes, financial portfolios, actuarial assessments, or public health and safety.

Strategies to manage threats (uncertainties with negative consequences) typically include avoiding the threat, reducing the negative effect or probability of the threat, transferring all or part of the threat to another party, and even retaining some or all of the potential or actual consequences of a particular threat, and the opposites for opportunities (uncertain future states with benefits).

Certain aspects of many of the risk management standards have come under criticism for having no measurable improvement on risk; whereas the confidence in estimates and decisions seem to increase.[1] For example, one study found that one in six IT projects were "black swans" with gigantic overruns (cost overruns averaged 200%, and schedule overruns 70%).[4]


A widely used vocabulary for risk management is defined by ISO Guide 73:2009, "Risk management. Vocabulary."[2]

In ideal risk management, a prioritization process is followed whereby the risks with the greatest loss (or impact) and the greatest probability of occurring are handled first, and risks with lower probability of occurrence and lower loss are handled in descending order. In practice the process of assessing overall risk can be difficult, and balancing resources used to mitigate between risks with a high probability of occurrence but lower loss versus a risk with high loss but lower probability of occurrence can often be mishandled.

Intangible risk management identifies a new type of a risk that has a 100% probability of occurring but is ignored by the organization due to a lack of identification ability. For example, when deficient knowledge is applied to a situation, a knowledge risk materializes. Relationship risk appears when ineffective collaboration occurs. Process-engagement risk may be an issue when ineffective operational procedures are applied. These risks directly reduce the productivity of knowledge workers, decrease cost-effectiveness, profitability, service, quality, reputation, brand value, and earnings quality. Intangible risk management allows risk management to create immediate value from the identification and reduction of risks that reduce productivity.

Risk management also faces difficulties in allocating resources. This is the idea of opportunity cost. Resources spent on risk management could have been spent on more profitable activities. Again, ideal risk management minimizes spending (or manpower or other resources) and also minimizes the negative effects of risks.

According to the definition to the risk, the risk is the possibility that an event will occur and adversely affect the achievement of an objective. Therefore, risk itself has the uncertainty. Risk management such as COSO ERM, can help managers have a good control for their risk. Each company may have different internal control components, which leads to different outcomes. For example, the framework for ERM components includes Internal Environment, Objective Setting, Event Identification, Risk Assessment, Risk Response, Control Activities, Information and Communication, and Monitoring.


For the most part, these methods consist of the following elements, performed, more or less, in the following order.

  1. identify, characterize threats
  2. assess the vulnerability of critical assets to specific threats
  3. determine the risk (i.e. the expected likelihood and consequences of specific types of attacks on specific assets)
  4. identify ways to reduce those risks
  5. prioritize risk reduction measures


The International Organization for Standardization (ISO) identifies the following principles of risk management:[5]

Risk management should:

  • create value – resources expended to mitigate risk should be less than the consequence of inaction
  • be an integral part of organizational processes
  • be part of decision making process
  • explicitly address uncertainty and assumptions
  • be a systematic and structured process
  • be based on the best available information
  • be tailorable
  • take human factors into account
  • be transparent and inclusive
  • be dynamic, iterative and responsive to change
  • be capable of continual improvement and enhancement
  • be continually or periodically re-assessed
Other Languages
čeština: Risk management
한국어: 위험관리
Bahasa Indonesia: Manajemen risiko
íslenska: Áhættustýring
lietuvių: Rizikos valdymas
Bahasa Melayu: Pengurusan risiko
Nederlands: Risicobeheer
svenska: Riskhantering
Türkçe: Risk yönetimi
українська: Ризик-менеджмент
Tiếng Việt: Quản lý rủi ro
中文: 风险管理