Fundamentals of Risk Management

Risk classification 
systems
short-, medium- and long-term risks
Although it is not a formalized system, the classification of risks into short, medium 
and long term helps to identify risks as being related (primarily) to operations, tactics 
and strategy, respectively. This distinction is not clear-cut, but it can assist with
further classification of risks. In fact, there will be some short-term risks to strategic 
core processes and there may be some medium-term and long-term risks that could 
impact operational core processes. Also, there is always the requirement to ensure 
compliance in operations, tactics and strategy. For most organizations, the attitude 
to compliance risks is based on the desire to minimize this type of risk.
A short-term risk has the ability to impact the objectives, key dependencies and 
core processes, with the impact being immediate. These risks can cause disruption to 
operations immediately when the event occurs. Short-term risks are predominantly 
hazard risks, although this is not always the case. These risks are normally associated 
with unplanned disruptive events, but may also be associated with cost control in
the organization. Short-term risks usually impact the ability of the organization to
maintain effective and efficient core processes that are concerned with the continuity 
and monitoring of routine operations. There is a need to mitigate short-term risks.
A medium-term risk has the ability to impact the organization following a (short) 
delay after the event occurs. Typically, the impact of a medium-term risk would not 
be apparent immediately, but would be apparent within months, or at most a year 
after the event. Medium-term risks usually impact the ability of the organization to 
maintain effective and efficient core processes that are concerned with the manage-
ment of tactics, projects and other change programmes. These medium-term risks are 
often associated with projects, tactics, enhancements and other developments. There 
is a need to manage these medium-term risks.
A long-term risk has the ability to impact the organization some time after the 
event occurs. Typically, the impact could occur between one and five years (or more) 
after the event. Long-term risks usually impact the ability of the organization to 
maintain the core processes that are concerned with the development and delivery
of effective and efficient strategy. These risks are related to strategy, but they should