1 IDENTIFY RISK ASSESS RISK MANAGEMENT PROCESS REVIEW

1 IDENTIFY RISK ASSESS RISK MANAGEMENT PROCESS REVIEW CONTROLS CONTROL RISK

RISK MANAGEMENT PROCESS WRITE YOUR SUBTITLE HERE IDENTIFY RISK ASSESS RISK REVIEW CONTROLS CONTROL RISK 2

RISK MANAGEMENT PROCESS WRITE YOUR SUBTITLE HERE IDENTIFY RISK REVIEW CONTROLS ASSESS RISK CONTROL RISK 3

RISK MANAGEMENT PROCESS WRITE YOUR SUBTITLE HERE The company identifies and defines potential risks that may negatively IDENTIFY RISK ASSESS RISK influence a specific company process The risk is then further evaluated after determining the risk's overall likelihood of occurrence combined or project. with its overall consequence. Following up on both the risks and the During this step, companies assess overall plan to continuously monitor their highest-ranked risks and track new and existing risks. develop a plan to alleviate them using REVIEW CONTROLS CONTROL RISK specific risk controls. 4

RISK MANAGEMENT PROCESS WRITE YOUR SUBTITLE HERE ASSESS RISK IDENTIFY RISK REVIEW CONTROLS CONTROL RISK 5

RISK MANAGEMENT STRATEGIES 6 LIKELIHOOD WRITE YOUR SUBTITLE HERE CERTAIN Low Moderate High Extreme LIKELY Low Moderate High Extreme POSSIBLE Low Moderate High UNLIKELY Low Moderate RARE Low Low Low INSIGNIFICANT MINOR SIGNIFICANT MAJOR CATASTROPHIC SIGNIFICANCE

RISK ASSESSMENT MATRIX 7 LIKELIHOOD WRITE YOUR SUBTITLE HERE CERTAIN LOW MODERATE HIGH EXTREME LIKELY LOW MODERATE HIGH EXTREME POSSIBLE LOW MODERATE HIGH UNLIKELY LOW MODERATE RARE LOW LOW LOW INSIGNIFICANT MINOR SIGNIFICANT MAJOR CATASTROPHIC SIGNIFICANCE

RISK ASSESSMENT MATRIX 8 WRITE YOUR SUBTITLE HERE Green marketing is a practice whereby companies seek to go above and. 3 Green marketing is a practice whereby companies seek to go above and. High 2 Green marketing is a practice whereby companies seek to go above and. High Medium Green marketing is a practice whereby companies seek to go above and. Medium Low 1 Green marketing is a practice whereby companies seek to go above and. Low RISK LIKELIHOOD # RISK MITIGATION DESCRIPTION PLAN RISK CONSEQUENCE Risk Level: Low Medium High

RISK ASSESSMENT MATRIX 9 WRITE YOUR SUBTITLE HERE Incidental Minor Serious Major Catastrophic RISK LIKELIHOOD Frequent Occasional Seldom Remote Unlikely CONSEQUENCE/SEVERITY

RISK METER SLIDE 10 WRITE YOUR SUBTITLE HERE MIDDLE LOW HIGH RISK

11 Y F I T EN ID M AG E AN M REPORT E R SU EA RISK MANAGEMENT FRAMEWORK MO NIT OR

12 CONTROL RISK During this step, companies assess their highest-ranked risks and develop a plan to alleviate them using specific risk controls. IDENTIFY RISK The company identifies and defines potential risks that may negatively influence a specific company process or RISK MANAGEMENT FRAMEWORK ASSESS RISK The risk is then further evaluated after determining the risk's overall likelihood project. of occurrence REVIEW CONTROLS Following up on both the risks and the overall plan to continuously monitor and track new and existing risks. combined with its overall consequence.

RISK ASSESSMENT MATRIX 13 WRITE YOUR SUBTITLE HERE POSSIBLE LIKELY ALMOST CERTAIN LOW LOW LOW MEDIUM MEDIUM MAJOR LOW MEDIUM HIGH EXTREME RARE UNLIKELY INSIGNIFICANT LOW MINOR LOW MODERATE STRUCTURE Green marketing is a practice whereby companies seek to go above.

14 IN-DEPTH MODEL VALIDATION G ST IN TE BA COMPLEXITY & MATERIAL SCORING CK INDEPENDENT PLAUSABILITY TESTS CORRECTIVE ACTION ASSESSMENT VALIDATION REPORT RE S SU ST EA Y TE K M NC RIS ISTE NS CO RISK MANAGEMENT

MONITOR & REVIEW TREAT RISK EVALUATE RISK ANALYZE RISK IDENTIFY RISK ESTABLISH THE CONTEXT RISK MANAGEMENT PROCESS 15 WRITE YOUR SUBTITLE HERE RISK ASSESSMENT

INSTITUTIONAL RISK MATURITY 16 WRITE YOUR SUBTITLE HERE STRUCTURE NAIVE AWARE DEFINED MANAGED ENABLED Has not yet developed Scattered silo based Risk management Enterprise wide risk Risks taken on an an approach for risk approach to risk strategy and policies in management approach informed basis. management. place and communicated considering risk at Risk management is Risks are a nuisance, Mitigate risks as they across the organization. highest level but could used to help manage would rather avoid the become relevant. be further enabled in multiple aspects of the decision making. institution. talk of them.

Document the risks and related events and bring 17 together risk management related data in a risk register that includes risk description, severity Provide up to date information on risk management and impact, consequences, risk rating, mitigation across the enterprise, including risk-control assessments, near-misses, remediation statuses, successes, failures and trends. Drill-down at finer levels of detail on specific risks. REVIEW CONTROLS IDENTIFY RISK MANAGEMENT PROCESS plan and related emerging issues. ASSESS RISK Assess and measure identified risks using a set of criteria that includes impact, likelihood, Leverage on established risk management frameworks to define a set of controls that mitigate those risks. Develop assessment plans to evaluate and ensure effectiveness of the controls, and assign to owners based on roles and responsibilities. CONTROL RISK controllability, and other determinants. Prioritize the risks and assist managers in determining which risks need to be addressed first.

RISK MANAGEMENT WRITE YOUR SUBTITLE HERE REPORTS AND DOCS ID RIS TIF K IC AT IO EN N RISK TRACKER CLASSIFICATION AND ASSESSMENT RISK MITIGATION CATION N O I T G A T IN N E RT M U EPO C DO ND R A RISK MANAGEMENT WORKFLOW HA AN ZA AL RD YS IS N A L RE K P S I R ON I T C U D 18

RISK MANAGEMENT MODEL HIGH Close monitoring MEDIUM Risk may be LOW IMPACT WRITE YOUR SUBTITLE HERE required Requires monitoring and management Intensive management accepted, but Management requires recommended required monitoring Risk acceptable, Acceptable risk requires Managed regulation LOW MEDIUM LIKELIHOOD HIGH 19

ENTERPRISE RISK MANAGEMENT WRITE YOUR SUBTITLE HERE PHASE 1: ASSESSMENT PHASE 2: PLANNING PHASE 3: COORDINATION PHASE 4: IMPLEMENTATION Focus area: Leadership and governance Focus area: Standards Focus area: Integrating independent risk management activities Focus area: Integrating independent internal control activities 20