Fundamentals of Risk Management

Risk assessment considerations
121
An important consideration for organizations is whether the risk assessment process 
should be undertaken on a top-down and bottom-up basis. In other words, will sen-
ior management lead the risk assessment process in the organization with the infor-
mation being passed downwards for validation, or will a series of risk assessment ex-
ercises be undertaken starting at operational level? Table 10.1 provides examples of 
the advantages and disadvantages of undertaking a top-down risk assessment exer-
cise. A top-down risk assessment exercise will tend to focus on risks related to strat-
egy, tactics, operations and compliance (STOC) in that order.
Table 10.2 provides examples of advantages and disadvantages of undertaking a 
bottom-up risk assessment exercise. As with so many aspects of a successful enterprise 
risk management initiative, the organization should decide the risk assessment pro-
tocols and procedures that are most suitable. If it is a choice between top-down and 
bottom-up, the organization should decide whether visible senior management support 
for the risk management initiative is more important than the greater involvement of 
operational people. A bottom-up risk assessment exercise will tend to focus on risks 
identified as compliance, hazard, control and opportunity in that order.
For most organizations, a combination of top-down and bottom-up risk assess-
ments will be undertaken with the risk manager collecting information from as many 
stakeholders as possible. Often, the main constraint in undertaking a bottom-up 
exercise is the greater time commitment that is required from the risk management 
department to attend and/or facilitate a series of risk assessment exercises.
TAbLE 
10.1
Top-down risk assessment
advantages 
Disadvantages 
Likely to result in an enterprise-wide 
approach – the risks at the top will have 
impacts throughout the business 
Senior managers and directors tend to 
be more focused on risks external to 
the organization 
The most significant strategic risks for 
the organization can be captured quickly 
and there will be a manageable number 
Limited awareness of internal 
operational risks or interdependencies 
of risks within the business 
Shows risk management buy-in from the 
top, resulting in acceptance of risk 
management activities at all levels 
Danger that the approach becomes too 
superficial, because senior managers 
believe they can manage crises 
Since it originates from the top, there is 
likely to be consistent methodology 
throughout the organization 
New risks emerging from the 
operational activities of the organization 
might not be fully identified 

---