Fundamentals of Risk Management

Risk assessment
168
of that strategy will be achieved through the tactics employed. Those tactics will be 
designed to improve core processes in the organization, so that the organization is 
using the most effective and efficient core processes.
The boxed example describes an attitude to risk management that sees risk as 
opportunity. This approach to the management of the organization demonstrates 
the desire to embrace the upside of risk.
Upside in projects
It is essential that every organization adopts the correct core processes. A core 
process may be considered as the collection of activities that deliver a specific stake-
holder expectation. This is the meaning of core process that is allocated by business 
process re-engineering (BPR) practitioners.
There is a difference between a process being efficient and effective. An efficient 
process means that there is no disruption and no excess cost. However, the process 
may be the incorrect one for cost-effectively delivering the requirements. Where 
processes need to be improved, a project will normally be undertaken and change 
achieved. In circumstances where a series of projects are required, this is often referred 
to as a programme of work. When a project, or programme of work, is implemented 
by an organization, the desire will normally be to improve the effectiveness and/or 
efficiency of core processes.
By undertaking adequate risk assessment of the intended change, the organization 
should be able to ensure that the project is more successfully delivered on time, 
within budget and to specification. Achieving the upside of risk in the project or 
programme management requires that projects are adequately managed and that 
the correct project or priorities have been selected by the organization.
Often, organizations will undertake a post-implementation review to ensure that 
the benefits expected from the project have been delivered in practice. This review is 
often undertaken by internal audit and is designed to ensure that the project was 
delivered successfully, delivered the benefits that were required and was overall worth-
while. During difficult financial times, it is important that the organization selects 
projects that are not only successful, but represent the best possible allocation of limited 
resources when compared with alternative projects that have not been selected.
Risk management in projects is associated with the implementation of tactics
designed to achieve the strategy. In some organizations, projects that will implement 
tactics are only approved if the project reduces risk. For example, if a particular activity 
could fail because of poor IT systems, the project should be designed to make the 
activity more robust. In doing so, risks will be reduced and it should be possible to 
quantify the benefits that will result from activities that are more efficient because 
of better use of human resources and because of fewer failures of IT systems.
In summary, the benefits of good risk management within projects are that the 
project is more likely to be delivered on time, to budget and at the required quality. 
Risk management activities will assist the delivery of the project and, at the same 
time, help manage a situation when an outcome is different from what was expected 
as the project progresses. This different outcome will demonstrate whether the tactics 

---