Section 1: Establish risk context.

This section must be completed satisfactorily by the student and it must be relevant to the organization their project is based on.

1. Provide a brief overview of the business or organization you are basing your portfolio on.

• What is the name of the business or organization?
• What is the main focus of the business?
• What role will you assume as you investigate risk for your chosen risk management process/project?

2. Determine the scope of your chosen risk management process/project.

• What does your chosen risk management process/project involve?
• Which departments or work areas are involved in the process?
• Are there any risks the business will not manage (for example, staff retention)?

3. Evaluate organizational requirements and standards for managing risk.

• Which organizational policies and procedures provide input on how you approach your chosen risk management process or project e.g. Risk management, Record keeping etc.?
• Are there any processes you need to follow?
• Attach policies and procedures to this section of your portfolio.

4. What are the legal requirements associated with your chosen risk management process or project?

• Explain the legislation you need to comply with.
• Do any regulations apply?
• Is there the potential for new laws to be introduced or existing ones to be amended or rescinded?
• Which risk management standard/s are used or guide the risk management activities of the business?

5. List the resources available for you to use as you plan, implement and monitor risk.

• Are template documents available to support your risk management process/project?
• Do you have budget allocation or restrictions for the risk management process/project?
• Which employees are available to assist you?
• What other resources are required?

6. Establish objectives and critical success factors for your risk management process or project.

• List two objectives.
• List three critical success factors for the risk management process or project.

7. Identify stakeholders who will be part of the risk management process.

• Who is able to shed light on or assist with risk identification, risk analysis and/or risk control?
• Who is likely to be impacted by an adverse risk event?
• How will each stakeholder provide input to the risk management process (such as identifying possible risks, helping describe their impact and suggesting ways to prevent or mitigate risks)?
• What influence does each stakeholder have on risk management decisions?
• What are the possible issues each stakeholder may have if a risk event occurs (for example, employees will still want to be paid, customers may still need your products or services and banks will still need to be paid for loans etc)?

8. Communicate with relevant stakeholders.

• Who will you communicate to (at least two stakeholders) regarding:
  • Explanation of the risk management process or project?
  • Invitation to assist in risk identification.
• How will you consult with each stakeholder?
• If not already viewed in person by your assessor, attach proof (e.g. draft email, telephone conversation recording, video of meeting etc.) of your explanation of the risk management process/project to the stakeholders.
• If not already viewed in person by your assessor, attach proof of your invitation to stakeholders to assist in the identification of risks (e.g. draft email, telephone conversation recording, video of meeting etc.).

9. Analyse the external environment of your risk management process/project.

• What is the political situation like (e.g. unrest, government support of small business, government policies)?
• What is the current and predicted economic situation (e.g. state of local and other applicable economies, interest rates, exchange rates, employment rates etc.)?
• Are there any social considerations (e.g. changing values, beliefs, attitudes and habits)?
• How are technological advances affecting the business (e.g. internet, RPA, risk control)?
• What are competitors doing?

10.  Establish the strengths and weaknesses within your business that have the potential to create or impact risk.

• Are the current risk management policy/procedures complete and comprehensive?
• What is the state or condition of business’ resources relevant to your risk management process or project?
• How effective are existing communication mechanisms between management and the workforce?
• How loyal are staff?
• What is the size and quality of the customer data base?
• What is the business’ ability to fund or raise funding?
• What is the business’ cashflow situation?
• Are supplier relationships strong and reliable?

Section 2: Identify and analyse risk

1. Plan to discuss risks with invited stakeholders (identified in Section 1).

• Choose a tool or technique to facilitate the group discussion to identify risks within the scope of the risk management process

• List what will be discussed (e.g. identify risks, assess risks, risk treatments, priorities etc.)
• What method and scale will you use to assess the likelihood and severity of the risks?
• What will guide how you prioritise risk (e.g. risk matrix)?
• What are you prepared to negotiate?
• How will you negotiate?
• Explain questioning and listening techniques you will use to elicit opinion and clarify understanding.

2.  Summarise risks.

• Summarise at least three risks identified at the meeting that apply to the scope of your risk management process or project. For each risk:
  • Identify which type of risk it is.
  • Identify who may be responsible for the risk.
  • List at least two potential outcomes should the risk eventuate.
  • What treatment alternatives were discussed?
  • How do the stakeholders want to prioritise the risks?
• If not already viewed in person by your assessor, attach proof of your stakeholder meeting (e.g. video of meeting etc.).

3. Complete the table below to assess the identified risks (using an appropriate scale and stakeholder input).

4. Research risks

• Research each of the identified risks to learn more about the risk and any related risk treatment options (e.g. speak to stakeholders, do an internet search, review best practice examples, check policies and procedures, view past incidents, research technology solutions etc.).

Note: You must access at least two different sources of information.

• Summarise the research done for each identified risk.
• List the options available to you to treat your identified risks.
• Attach proof of your research to this section of your portfolio.

5.  Use digital technology to document and calculate risk (e.g. a risk register). Include the risk, potential outcomes, likelihood, impact/severity, risk calculation, treatment actions and priority of each treatment action.

Note: Risk is calculated (likelihood)x(impact).

Section 3: Implement and monitor risk treatment

1. Complete the action plan below for ONE of your selected risk treatments (in your Risk register in Section 2).

Note: If your business already has an action plan template or other specific documentation requirements, use them instead and attach your work to this section of the portfolio

2. Communicate the action plan to relevant parties (each person responsible for a step in the action plan).

• To who will you communicate?
• How will you communicate (e.g. face-to-face discussion, email)?

Note: If you are basing this assessment on the case study business, you are required to communicate verbally.

• Unless already viewed in person by your assessor, attach proof of your communication to this section of the portfolio (e.g. email with attachment, project schedule, video of team meeting etc.).

3. Implement your action plan and maintain documentation.

• Which step will you implement?

Note: If you are using the case study, assume that one step in your action plan is to request quotes for RPA systems for invoice capturing.

• What are the organisational policy and procedure requirements to implement your chosen step in the action plan (e.g. how many quotes are you required to obtain, should a research report be written etc.)?
• Attach proof of implementation to this section of your portfolio (e.g. request for quotes, research conducted and written into a research report etc.).
• Describe how you maintained the documentation to indicate completion of the step (e.g. marked the action plan as “done”). If this step cannot be completed in the Project Portfolio, attach proof.

4.  Monitor your risk management process or project.

• What data is available?
• Have any new risks emerged?
• Have any incidents been recorded?
• Have you (or other stakeholders) received or provided feedback?

5.  Evaluate your risk management process or project.

• Are you identified risks still relevant?
• Have your risk treatments been successful?
• Are there any new risks?
• How satisfied are stakeholders with your action taken to manage risks?
• Are your selected treatment options still in line with best practice?
• Is any other risk treatment necessary?
• Write a report on the outcomes of the evaluation and attach it to this section of your portfolio. In you report, include:
• a summary of the risk process/project and associated risks and risk treatments
• a summary of the progress of the action plan
• a summary of new risks
• a summary of risks no longer valid
• any additional risk treatments required.