For example, what classes of risks are causing the most problems? This may
point us in a strategic direction for change. Are there any changes in the risk
levels? Are some business units going beyond the risk appetites or thresholds
set for them by management? Is the information on the risks being monitored?
Monitoring can happen in several ways, but one popular way to present it, if
you are using enterprise risk management software, is through a risk dash-
board. Risk dashboards can be presented at multiple levels based on the
target audience, including C-level executives, risk managers, or even line of
business owners. The information contained within the dashboards can be
aggregated to track and monitor multiple risk elements or can present only
the risk information that a given role needs to monitor or is interested in.
Risk monitoring frequency depends on many things, but here are a few to
consider:
Priority of the risk (“high priority risks could be updated or monitored
daily or weekly, depending on the impact”)
Company or regulatory policy (“all risks are reviewed every quarter”)
Frequency of new information (“earthquake” (no new information) vs.
“product development timeline” (new information after each R&D team
meeting))
Analyzing What Went Wrong: When Risk Becomes Reality ......................
A certain proportion of risks are going to become loss events: That’s just how
life works. Products are delayed, some sales are lost, a new competitor steps
in on the scene, or a key component for our product is stuck in customs
somewhere.
Enterprise risk management can help you understand and better manage a
loss event. By analyzing this incident and reviewing what went wrong, you
can see whether the risk could have been prevented or its impact reduced if
certain measures had been taken sooner. By analyzing and managing these
incidents in a systematic way, you have the opportunity to avoid additional
problems in the future.
With incident analysis, you look at factors like:
What went wrong?
What caused the problem to occur?
Was this a risk that was even being tracked?
Chapter 2: Risky Business: Turning Risks into Opportunities 57
