Risk management concepts definitions

Question

I am trying to define some concepts of risk management and I am having some trouble. I am using definitions from ISO 73:2009 and from "A. Avizienis, J-C Laprie, B. Randell, and Landwehr. Basic concepts and taxonomy of dependable and secure computing."

I would like to use the concept of dependability, but link it with hazards and not service failures. Is it correct to write the following?

A risk is defined as the effect of uncertainty on objectives. It is often associated with events, their likelihood, and their consequences. Wether they are positive or negative.

A hazard is a source of potential harm. It can have the potential to give rise to a risk.

A service delivered by a system is its behavior as it is perceived by its user. Correct service is delivered when the service implements the system function.

A service failure, or simply failure, is an event that occurs when the service delivered by the system deviates from correct service.

The dependability of a system is the ability to avoid service failures that are more frequent and more severe than is acceptable.

The goal of risk assessment is to minimize hazards by reducing the risk of service failure and therefore to increase the system dependability.

Answer 1

The goal of risk assessment is to minimize hazards by reducing the risk of service failure and therefore to increase the system dependability.

I think some of this statement is flawed. First, the risk assessment is the analysis of the hazards in play and the likelihood and impact of service failure. Risk treatment is the process of reducing or exploiting a risk.

Hazards just exist. I do not think one minimizes hazards. You either put it in play or you don't. For example, a frozen pond has some degree of hazard, based on the depth of ice over the pond. If you don't put the hazard in play, i.e., you choose to not walk on it, then you avoid any risk the hazard provides...but the hazard remains in full force and effect.

I think maybe this is better: "The goal of risk treatment is to reduce the risk of service failure and, therefore, increase the system dependability."

Answer 2

I would amend the hazard and risk definitions.

A hazard is something that is undesirable.

A risk is the potential occurrence of a hazard at some point in the future. It has two dimensions, the probability of it occurring (which can be modeled statistically), and the impact in the event it does occur. Glen Alleman writes very knowledgeably on the subject Herding Cats, Glen Alleman's blog

You can mitigate a risk (i.e. reduce its probability and/or impact) in various ways depending what it is, and you can put in place risk response plans to say what you will do in the event that the risk occurs (i.e the hazard actually hits your project/service).

You could describe potential service failures in terms of the specific risks occurring, causing a service failure. For example, there is a 0.001% risk that our main data centre will have a major outage on any given day, leading to a complete service failure.

Answer 3

Assuming we are referring to 'project risk management' a 'risk' is typically and event or condition that would impact on project objectives - and there is a move to move away from classifying opportunities as risk, as people often find this confusing.

also, a hazard is not the same as a risk - a hazard is harmful but usually foreseeable - where as risk denotes uncertainty (chance of failure or chance of danger) - hope this helps you to sort out your definitions

Answer 4

The following definition and explanation of a risk is from the Risk Register User Guide -

What is a risk?

Before looking at risk management, we need to understand what a risk actually is. The PMBOK gives a good definition - “an uncertain event or condition that, if it occurs, has a positive or negative effect on one or more project objectives such as scope, schedule, cost, or quality.”

When describing risks, we usually want to know the cause, the affected area, and the consequences. Let’s look at the example risk given in the PMBOK - “due to the forecast of high winds in our area, there is a risk that the roof of the barn will blow off causing our cattle feed to be ruined and loss of our livestock”. Here we see the cause (high winds), the affected area (barn roof), and the consequences (loss of livestock).

Let’s look at another example, this one perhaps more familiar. “Due to ongoing support demands, there is a risk that the Senior Programmer will be shifted from the project, causing a delay in the schedule”. Here we see the cause (ongoing support), the affected area (the Senior Programmer) and the consequences (a delay in the schedule).