Let's talk about how to rank risk this is applicable to an iso 9001 management
system, an iso 14001 management system and iso 45001 management
system we're going to go through a really simple risk ranking exercise stay tuned.
So welcome back to Best Practice TV, I'm Kobi Simmat, I'm the CEO here we're going
to go through a really basic risk ranking exercise so you can understand
some of the more complex systems out there we're going to keep this really
really simple for you just to understand how to break out risks. Now there's two
things that we obviously start with so the first thing we're going to talk
about with the risks ranking in this risk ranking exercise is frequency or
how many times something could happen, and then the other part of the risk
management exercise is the consequences so when we're ranking risk it's really
really simple obviously the more that it can happen the more frequent it is or it
could happen a lot and obviously the greater the consequences our risk
ranking goes up if that makes sense so we're looking at how what are the
consequences how bad are the consequences and how often more often
more consequence risk ranking if that makes sense.
Higher order of risk now what we do see is people overcomplicating that
exercise you know we might have a score it might be one two three four or five
and then we might be one two three four or five on our frequency consequences or
likelihood we can exchange that frequency here and we can put likelihood.
So that's a really basic way to rank risk so something that's not going to
happen very often and it's got low consequences it's going to be a low risk
down here even if it's consequence is low but it's very often it can be over
here where it's a low risk but more importantly if equally if it's a high
consequence up here we've got frequency not very often but it's a high
consequence our risks it's over here so things that happen a lot and they've got
big consequences obviously the risks sit over here. Now what we can do is we can
actually rub this off we can turn this now into a table if that helps you. So
what we can start to do is we can look at our frequency, we can look at our
consequence and we can draw a risk matrix if you like so when we have
consequences low consequences low frequencies so our scores were he one,
two, three, four and five and one, two, three,
four and five, we can start have these tables, and they can inform our risk so
we've got low risks here at low, low, low, medium, medium, medium, maybe medium, medium
medium, medium now this is very subjective and then we can have maybe
medium and we can start to get high, high high, high, high, high, high and it may be
extreme. Now this starts to give you the opportunity as you identify your risks
to identify each risk and put each risk onto this table and then your risks and
it might be if it's customer related or if it's safety related or environmental
related or information security related, you can start to use this to prioritize
the risks. Obviously risks that get extreme scores
are going to be more important and are going to have more attention put to them
and more resources put to them to manage them than things that are low risk and
so that's when we can start to think about our control so it's all about
prioritizing working out what's important and what's not so important
and using a bit of a simplified version. Now this is just my opinion in terms of
setting up this matrix it's really simple but it's all about thinking about
frequency and all about thinking about consequences and that's how we rank risk.
We'll shoot another video that talks about controlling risk but I want to
give you just a little bit of an introductory insight into that. The intention
is to use controls to use all of the things you're implementing your
organization to reduce your risk we want to reduce obviously the frequency so
we're going to reduce the times that something can happen the number of times
it can happen we want to reduce the consequences and so we can use things
like the hierarchy of control so we've got to pull down the consequence and the
frequency not just one so let us think about what's feasible what's achievable
and what our funding in our resource reserves can afford to do but it's
really simple matrix on risk ranking it's all about supporting your quality,
safety, environment and data security information security
systems and you start to understand what to pay attention to, so paying attention
to important risks and monitoring some of the low risk so that you can stay on top
of it. We hope you enjoyed the video if you liked it comment below if you want a
practical example for your industry, comment below this video hit subscribe
and you will see us next time on Best Practice TV bye for now.