Corporate Risk Management Strategy

Risk Management Strategy is an integrated business process that incorporates all of the Risk Management processes, activities, methodologies and policies adopted and carried out in an organization. The Risk Management strategy sets the parameters for the entire Risk Management and is usually released by the executive management of an organization.

As depicted in the diagram of The Risk Process, Risk Management Strategy consists of two processes, one setting the framework for the entire Risk Management and the other setting the communication channels in the organization.

It is essential for Risk Management to become part of the organization’s culture. Therefore communicating and creating awareness of relative issues across the organization at each step of the Risk Management process are very important.

Communication should by all means involve an open discussion with all stakeholders with efforts focused on consultation and development of common understanding, rather than on a one way flow of information from the decision maker to the other stakeholders.

Risk Management can and will be enhanced by parties and individuals understand each other’s perspectives and who are consulted in a timely fashion, where appropriate. Stakeholders, like every human being, tend to make judgments about risk based on their perceptions. These can vary due to differences in values, needs, assumptions, concepts and concerns, as they relate to the risks or the issues under discussion. Since the views of stakeholders can have a significant impact on the decisions made, it is important that possible variations in their perceptions of risk be identified, recorded and addressed in the decision making process. In the long term, ENISA will contribute to the generation of qualitative criteria aiming at the creation of balanced estimations about assessed risks among various experts using various methods and tools.

External communication and consulting by specialized consultants, as well as exchange of information and cooperation with other organizations should also be planned and implemented on a regular basis. The exchange of this knowledge and experience can prove extremely helpful for addressing issues related to both the risks and the process to manage these risks, leading thus to a view on risks that is free from subjective estimations. Furthermore, involving external personnel in such activities contributes towards the renewal of available know-how and risk perception.

By establishing the framework for the management of risks, the basic parameters within which risks must be managed are defined. Consequently, the scope for the rest of the Risk Management process is also set. It includes the definition of basic assumptions for the organization’s external and internal environment and the overall objectives of the Risk Management process and activities. Although the definition of scope and framework are fundamental for the establishment of Risk Management, they are independent from the particular structure of the management process, methods and tools to be used for the implementation.

In order to define an efficient framework it is important to:

• understand the background of the organization and its risks (e.g. its core processes, valuable assets, competitive areas etc.);
• evaluate the Risk Management activities being undertaken so far;
• develop a structure for the Risk Management initiatives and controls (countermeasures, security controls etc.) to follow.

This approach is useful for:

• clarifying and gaining common understanding of the organizational objectives;
• identifying the environment in which these objectives are set;
• specifying the main scope