SHRM-CP Functional Area 12: Risk Management

What is the SHRM BASK definition of Risk Management?

• “Risk Management is the identification, assessment, and prioritization of risks, and the application of resources to minimize, monitor, and control the probability and impact of those risks accordingly.”

What does risk management explore?

• How technology can help manage the liability that comes with operating an employment organization

What does risk management address?

• Issues related to employees, customers, clients, the public, and vendors/suppliers

What is risk management?

• The process of managing liabilities related to populations the organization impacts in ways that will protect the employer organization and not be so heavy-handed that the organization can’t function well in performing its mission

What is risk?

• The effect of uncertainty on objectives

• The potential for what could happen, either losing or gaining something of value

What is planning for risk management based on?

• The ability to identify anticpated risks

What is the Jahari Window?

• A model of disclosing relationships by identifying what you know and what you do not know

What are the three categories of risk?

• Preventable Risks

• Strategic Risks

• External Risks

What are preventable risks?

• Internal risks that are controllable and should be eliminated or avoided

• Includes illegal, unethical, or inappropriate actions and breakdowns in operational processes

• Manageable through rule-based compliance approaches

• Best controls involve active prevention such as monitoring operational processes and guiding people’s behaviors and decisions toward desirable norms via policies and training

What are strategic risks?

• Identified and accepted in the process of strategic planning

• Cannot be managed through a rule-based control model

• Necessary to reduce the probability that the assumed risks actually materialize and to improve the employer’s ability to manage or contain the risk events should they occur

What are external risks?

• Generally cannot be prevented from happening

• Organizations should forecast what those risks might be and develop ways in which their impact can be minimized

What perspective leads to the best performance of risk management?

• Enterprise perspective, as looking at risks solely within a department or division won’ot reveal the importance of those risks to the entire organization

What is the International Organization for Standardization (ISO)?

• Based in Geneva, Switzerland

• The world’s largest developer and publisher of international standards

What are the key variables the Department of Homeland Security (DHS) says should be considered?

• Goals and objectives

• Policies and standards

• Scope and criticality of the decision

• Decision-makers and stakeholders

• Decision time frame

• Risk management capabilities and resources

• Risk tolerance

• Availability and quality of information

What are risk criteria?

• Terms of reference

• Used to evaluate the significance or importance of an organization’s risks

• Used to determine whether a specified level of risk is acceptable or tolerable

• Should reflect the organization’s values, policies, and objectives

• Should be based on its external and internal context

• Should consider the views of stakeholders

• Should be derived from standards, laws, policies, and other requirements

What is a moral hazard?

• A situation in which one party gets involved in a risky event knowing that it is protected against the risk and the other party will incur the cost

What is the principal-agent problem?

• The problem of motivating one party (the agent) to act on behalf of another (the principal)

What is a conflict of interest?

• A conflict between private interests and the official responsibilities of a person in a position of trust

What is risk identification?

• The process of recognizing and defining risks

What is risk analysis?

• The systematic process to comprehend the nature of the risk and to determine the level of risk

What does risk assessment involve?

• Evaluating and comparing the level of risk against predetermined standards, target risk levels, or other criteria

What are some tools and techniques for risk identification?

• Brainstorming

• Delphi Technique

• Interviewing

• Root-Cause Analysis

• Checklist Analysis

• Assumption Analysis

• Diagramming Techniques

• SWOT Analysis

• Expert Judgement

What is the Delphi Technique?

• A facilitator distributes a questionnaire to experts and responses are summarized anonymously and circulated among the experts for comments

• Used to achieve a consensus of experts and helps to receive unbiased data, ensuring that no one person will have undue influence on the outcome → helps avoid “group think”

What is SWOT Analysis?

• A structured planning method that evaluates the strengths, weaknesses, opportunities, and threats involved in a project or business venture

What are some popular risk analysis tools?

• Risk Scorecard

• Risk Matrix

What is a risk scorecard?

• Uses eight critical areas to evaluate a given program’s reliability progress

• Each element within a category can be given a risk rating of high, medium, or low (red, yellow, or green) or not evaluated (gray)

• The scorecard weights the elements, normalizes the scores to a 100-point scale, and calculates an overall program risk score and eight risk scores

What are the eight critical areas evaluated in a risk scorecard?

• Reliability requirements and planning

• Training and development

• Reliability analysis

• Reliability testing

• Supply chain management

• Failure tracking and reporting

• Verification and validiation

• Reliability improvements

What is a risk matrix?

• Classifies risks using likelihood and impact on a scale as low, moderate, high, or extreme

• Likelihood: Rare, Unlikely, Possible, Certain

• Impact: Negligible, Marginal, Critical, Catastrophic

What is a risk evaluation system?

• A combination of practices, tools, and methodologies within a risk management system used to measure the potential impacts of risk events on the performance metrics of an organization

What is a Key Risk Indicator (KRI)?

• A measure that indicates how risky an activity is

• Indicates the possibility of a future adverse impact

• Metrics used to monitor identified risk exposures over time

What is a risk register?

• Acts as a central repository for all risks identified by the organization and, for each risk, includes information such as source, nature, treatment option, existing countermeasures, recommended countermeasures, and so on

• A record of information about identified risks

What are upside risks?

• When there is uncertainty about a desirable outcome

What are downside risks?

• When there are possible adverse outcomes

How can risk be managed?

• If the uncertainty is eliminated, making it a certainty

What are the two possible ways of redefining ownership of the problem to reduce risk expoure?

• Sharing the risk

• Transferring the risk

What is sharing the risk?

• Can be done, for example, by entering into a joint-employer relationship with an employment leasing agency, doubling the resources available to combat whatever risk may exist because of having an employee workforce

What is transferring the risk?

• Done by purchasing insurance policies

  • Can lower the potential for financial loss when employees are found to have engaged in inappropriate behaviors

How do you decrease the effect of risk?

• One way is to have employee training programs that can limit the damage or effect/impact of risks

What are the two options that come with deciding to “take no action” on a risk?

• Accept → wait to see how things develop and put out “orange cones” or warnings to identify the risk and make people aware

• Ignore → there is no credence given to the level of risk or the certainty of loss

What is a risk management plan?

• Results from analysis of the circumstances that forsees risks, estiamtes impact, and defines responses to issues

What are tailgate meetings?

• Meetings that typically only last 5 or 10 minutes, usually discussing safety topics

What are the steps of having an emergency response plan?

1. Conduct a risk assessment for the work location

2. Answer hypothetical questions regarding potentially dangerous and hazardous situations

3. Engage key personnel in the development process

4. List the responses that should happen for each emergency you listed

5. Develop a plan

6. Make sure everyone in the workspace knows about the plan and what to do if an emergency happens

What is HR’s involvement in safety risks?

• Develop safety plans

• Routine workplace inspections

• Corrective action oversight

• Employee training

• Insurance company interface

What is HR’s involvement in equipment risks?

• Inclusion in safety plans

• Production line procedures when failure occurs

• Inclusion of protection failure issues in safety plans

What is HR’s involvement in facility risks?

• Provision for action plans in the event of system failures

• Anticipation of security issues

• Preventative measures

What is HR’s involvement in employment risks?

• Establish criteria for screening new hires’ background/behavior issues

• Prepare procedures for handling behavior problems and termination procedures

• Discuss with executives about scenario involving loss of key personnel

What is HR’s involvement in employee-as-agent risks?

• Discuss with or train all managers in the legal agent-relationship definition and how they can represent the organization in community groups

What is HR’s involvement in business risks?

• Ensure essential records backup, including employee, payroll, medical, investigation, and complaint records

• Work with finance and sales/marketing to cover preservation of financial and customer records/orders

• Create a plan to preserve HR records when government agencies audit the organization

What is HR’s involvement in natural distaster risks?

• Develop procedures for reacting to natural disasters with differences based on the type of disaster

What is HR’s involvement in international risks?

• Identify the differences in legal response requirements by country

• Identify the expectations of each country’s customs during disaster responses

What is a key element of disaster recovery?

• Practicing the contingent plan to see whether it will actually work

What is debriefing?

• The process of meeting to discuss what happened during the practice exercise

• Should gather input from individuals as well as the collective input of managers and employees

• An opportunity to be sure all of the communication channels are open and working accurately

How often should formal risk management plans be reviewed (and adjusted, if necessary)?

• At least once per year

Who (or what team) commonly assume the role of risk management oversight?

• The board of directors

What is the idea behind the concept of “continuous improvement” or “kaizen”?

• To strive each day for a little better quality, quantity, and effort