4 Defining Risk Assessment Criteria
Bruce Lyon
Brown & Brown
4.1 Introduction
Before operational risks can be assessed, an organization must first establish and define the risk criteria from which to measure and score. Such criteria must be clearly defined and communicated by an organization to consistently evaluate operational risks and make proper risk‐based decisions. A number of existing risk criteria measures are available; however, it is essential that an organization carefully select and/or develop its own risk criteria to reflect its values, goals, industry setting, and overall culture.
In the risk evaluation stage, established risk criteria are compared to the results of the risk analysis to determine if the risks are acceptable. The following terms and their definitions taken from the ISO Guide 73/ANSI Z690.1‐2011, Vocabulary for Risk Management standard are presented to provide an understanding of their use:
- 3.3.1.3 Risk Criteria: Terms of reference against which the significance of a risk (1.1) is evaluated.
- 3.6.1 Risk Analysis: Process to comprehend the nature of risk (1.1) and to determine the level of risk (3.6.1.8).
- 3.7.1 Risk Evaluation: Process of comparing the results of risk analysis (3.6.1) ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access