Guest Post by Malcolm Peart (first posted on CERM ® RISK INSIGHTS – reposted here with permission)

In project management we can’t always be in control of the environment around us.  We can only forecast rather than predict risk and despite our ‘reasonable’ or even ‘best’ efforts to mitigate risk; shit happens and emergencies ensue!  It’s not just physical emergencies but also those related to time and cost; overbudget or late projects can create an emergency for stakeholders. Perhaps it’s because we tend to look at the ‘big risks’ or the ‘top ten’ after some semiquantitative assessment but then fail to consider that risks can change with time as more information becomes available.  Or, maybe it is because only those risks that can be clearly defined and are ‘likely’ are communicated to the eyes and ears on the ground.  Those low probability, high impact risks can tend to slip under any risk radar.

Then there is the matter of ‘optimism bias’ and a belief that ‘nothing can go wrong’ or that ‘risk only happens to other people’. Or perhaps, it’s just a matter of management not appreciating what is going on and ‘taking their eye off the ball’. [Read more…]

Guest Post by Malcolm Peart (first posted on CERM ® RISK INSIGHTS – reposted here with permission)

“I told you so…” is so often cried after something has gone wrong.  But was that ‘telling‘ stated clearly and unequivocally before things went wrong or was it merely a passing counterview against a probable likelihood based on an alternative possibility.

When a risk manifests itself and takes a grip on a project it’s amazing how quickly hindsight can kick in.  This comes in the form of free advice as to what could have happened to avoid the risk ‘after the fact’. These latter-day soothsayers were, for some reason or other, unprepared to prove their prophetic ability before the fact preferring, it would seem, to go with the flow as an uninvolved observer but officious bystander when all facts are revealed. [Read more…]

Guest Post by James Kline (first posted on CERM ® RISK INSIGHTS – reposted here with permission)

Kevin Curry in an opinion piece for The Hill raised several issues which will ultimately impact the adoption of Enterprise Risk Management (ERM) in government. The article entitled “America’s public sector has a problem –

It’s not getting any Millennials”, makes four points.  These are; 1. the federal government is having trouble hiring Millennials, 2. the federal government has old legacy cyber systems, 3. millennials expect up to date cyber systems and 4. the lack of up to date cyber systems is one of the problems keeping Millennials away.

Since the article does not specifically deal with ERM, one might ask: What is the intersection between the four issues and the adoption of ERM in government?  This article looks at the relationship of this problem with ERM in government. [Read more…]

Guest Post by Robert Pojasek (first posted on CERM ® RISK INSIGHTS – reposted here with permission)

In 2012, ISO’s ‘Joint Technical Coordinating Group’ (JTCG) completed work to provide a high-level structure, text, and common terms and definitions for all future and revised management system standards. All Technical Committees developing management system standards were required to follow Annex SL found in the ISO/IEC Directives, Part 1, Annex SL[i].   

As we approach 2019, it is abundantly clear that the high-level structure mandate has been followed by the Technical Committees with mixed results. All the new and revised management systems used the 10-clause structure and all of them include the same definition of risk and risk management.  However, the way risk management was used in the different management system standards varied considerably. What can an organization learn from this exercise? [Read more…]

Guest Post by Robert Pojasek (first posted on CERM ® RISK INSIGHTS – reposted here with permission)

There are two widely-used risk management standards:

• ISO 31000:2018
• COSO ERM 2017

In my previous blog[i], I presented details on how these risk management standards address the development of a risk-aware culture – a necessary foundation for risk management success. As promised, this blog will address the risk management “process.” This is how the organization addresses specific risks. [Read more…]

Guest Post by Malcolm Peart (first posted on CERM ® RISK INSIGHTS – reposted here with permission)

Can we really manage risk, or do we delude ourselves by going through the prescribed activities of ‘risk management’ giving the illusion that it’s happening?  Is risk management merely a hypocritical ritual and applying some science to fate through statistical mumbo-jumbo, decision trees, and quantitative analyses? [Read more…]

Guest Post by John Ayers (first posted on CERM ® RISK INSIGHTS – reposted here with permission)

Risk Based Informed Decision Making (RIDM) has a risk assessment as input as well as social and other benefits residual risks. This data or information empowers the person to make an informed decision. This following is an example of RIDM. [Read more…]

Guest Post by James Kline (first posted on CERM ® RISK INSIGHTS – reposted here with permission)

In November 2018, the U.S. Global Change Research Program issued Volume II of the Fourth National Climate Assessment Report.  Volume I was issued in 2017.  It deals with the science behind global change.  Volume II deals with the impact of global warming on natural environment, agriculture, energy production, human welfare, and societal impact.  This article discusses the assessments made in Volume II. [Read more…]

Guest Post by James Kline (first posted on CERM ® RISK INSIGHTS – reposted here with permission)

Former Secretary of State Condoleezza Rice PhD.  and Amy B. Zegart PhD.  have written a book called Political Risk: How Businesses and Organizations Can Anticipate Global Insecurity.   It has received good reviews.  Having read the book, I would concur.  It is an important book for those concerned with the increasing volatility and associated risk of the global economy. This piece discusses the relationship between Political Risk and Enterprise Risk Management (ERM). [Read more…]

Cyber security risk is among the most critical risks to the supply chain:

“Cyber and data privacy breaches are perceived to be the largest threat to the stability of transport and logistics, with the sector facing potential breaches of $2 trillion by 2019.”[i]

The reality of a cyber-crime is not if, but when, and how damaging it will  be.  The inevitability of a cyber-attack has forced end-product manufacturers to reassess every element of the end-product manufacturer from product design, outsourcing, and servicing the product. [Read more…]