Risk Management and Organizational Strategies

This assignment requires you to apply a risk management tool to assess the level of operation of a specific risk. The focus is on evaluating whether an organization's strategies for addressing this risk are sufficient and effective in achieving positive outcomes. You are expected to utilize a framework or methodology provided in your course materials or external resources to conduct the assessment.

1
RISK MANAGEMENT
Student’s name
Subject
Date

2
Question 1
What are the five steps for implementation of the AS/NZS ISO 31000:2009 Risk
Management – Principles and Guidelines? Explain.
The AS/NZS ISO 31000:2009 Risk Management refers to a set of standards that are
set to guide organizations in the process of establishing risk management strategies. Risk
management is one of the most important aspects that all organizations should be concerned
with. When an organization lacks strategies or addressing all the risks that it is involved in, it
becomes vulnerable to events that may cause major problems in its operations. The
occurrence of such events can affect the organization, its shareholders, and customers among
other organizational stakeholders. In order to ensure that people are protected from the
negative effects that might occur due to the occurrence of these risk events, organizations are
required to abide by the set risk management standards. These standards help to ensure that
the organizations have established risk management strategies that are highly effective and
thus capable of preventing the existing risks from occurring (Young, T. 2007).
The implementation of these standards is a process that all organizations require to
understand. In order to implement them, the first step is changing the means through which
risk is viewed. This can be identified as the process of making changes in the paradigm for
both risk and risk management. The approach taken in the process of identifying and
addressing the organizational risks is of significant importance. The second step is ensuring
that the framework the organization utilizes in establishing risk management strategies is
capable of addressing both the internal and the external organizational contexts. With this
regard, the organizational systems and processes should be assessed to ensure that all aspects
are included in the risk management framework that the organization is using (Rudzki, R. &
Trent, R. 2011).

3
The third step is the evaluation stage where the organization should assess and ensure
that its treatment of risks is effective. The goals, benchmarks, and targets should be assessed
to ensure that they are completely effective. The other step is developing a plan in which the
process of managing risks should commence. The plan should help in providing the means
through which implementation of the risk management strategy should take place effectively.
The fifth step should be the establishment of a process through which the process of risk
management should proceed on without fail. This step is important because the lack of a solid
plan that will help the organization ensure that all risks are addressed at all times is a major
problem that might result in the occurrence of a risk event in future (Reason, J. 2016).
Outline the difference between the Act, Regulations, and Codes of practice
The Act, is simply a law that all individuals and organizations are required to obey.
The failure to obey the law has significantly thorough consequences like fines or jail terms
from processes of litigation of the organization. With this regard, therefore, the organizations
have the responsibility and legal requirement to ensure that they fully comply with the act. It
is also on the basis of the fact that the codes of risk management and standards are
established. Regulations, on the other hand, refer to a set of rules that determines the process
of risk management in an organization. The organization can establish its own regulations
while at the same time the federal government has a number of regulations which it required
addressed fully. Regulations guide how a certain process is carried out in an organization.
The aspect of establishing risk management strategies in the organization while conforming
to certain set standards is a process. The regulations guide how this process takes place
(Pandian, C. 2007).
The code of practice of any organization refers to the means through which that
organization operates according to its culture. It is simply the acceptable way of behaviour in

4
any organization. If for example, the organization ensures that at all times, a risk mitigation
strategy is established, its code of practice defines the reasons why this risk mitigation
strategy is important and the individuals who have the responsibility of establishing the
strategy. With this regard, therefore, the organizational code of practice defines the means
through which that organization should operate (Theodore, M. 2013).
What are your organization's policies and procedures regarding risk management?
From my organization, certain set procedures are followed in order to ensure that it
remains fully capable of mitigating the occurrence of any risk that might possibly occur. In
order to ensure that a plan to address this aspect is in place, the organization begins by
making a general assessment of the possible risks that it may have, whose occurrence could
lead to major problems in its operations. This process helps in ensuring that there is no risk
event that may surprise the organization by its occurrence. After all the risks that affect the
organization have been determined, the other important aspect of consideration is the
establishment of mitigation strategies through which these risks will be addressed. The
organization establishes the strategies that it will utilize to mitigate these risks and ensure that
even in their occurrence, it cannot be negatively affected (Frank, A. 2007).
After implementing the solution to these risks, the organization then establishes a
process to determine the effectiveness of the mitigation strategies. This process helps to
ensure that the strategies established are effective in mitigating the defined risks. Over time,
changes occur in the organization, which also make differences in the initially established
risks. In order to ensure that the organization does not become vulnerable to new risks due to
the changes that occur, the process of risk assessment and mitigation solution establishment is
made regular. The organizations, therefore, carry out the risk assessment and solution

5
generation regularly, an aspect that makes it capable of eliminating any form of risk that
might occur and cause negativities (Greggory, 2005).
How might you adjust your risk management to incorporate disabled
employees/customers?
In an organization, disables employees and customers are more vulnerable to the
occurrence of certain events compared to healthy and fully capable individuals. Regarding
safety, for example, the standards of risk mitigation are focussed on individuals that are fully
capable and able, an aspect that exposes disabled individuals. With this regard, important
changes can be made to these standards so that the risk mitigation strategies that an
organization implements in its process of operation can include even the disabled individuals.
Adjusting the standards of risk mitigation and the organizational regulations to include the
categories of disabled employees and customers could help to ensure that the risk
management plan of the organization is fully inclusive of all individuals including the
disabled people. With this regard, therefore risk mitigation plans should fully include all
individuals (Melton, T. 2007).
What steps will you need to take to monitor your risk management plan?
The activity of monitoring the risk management plan is important since it helps an
individual or an organization to determine whether the plan in place is effective. In order to
ensure that I fully manage to monitor my risk management plan, an assessment of the
effectiveness of the plan is important. With this regard, the monitoring process involves the
process of regular assessment of whether the organization can suffer negative impact after the
occurrence of a risk, despite the existing risk mitigation strategies. When there is regular
assessment, it is easy to identify any form of ineffectiveness and thus improvement changes
are made. To monitor my risk management plan, therefore, I will use the general step of

6
regular assessment on how the organization operates and its risk mitigation strategies. These
strategies can help in ensuring that all individuals remain in complete capability and
effectiveness (Grady, 2010).
How would you communicate your risk management plan to the relevant stakeholders?
The risk management plan is important for all stakeholders of the organization, mostly
because the occurrence of any risk even within that organization significantly impacts them.
With this regard, therefore, the risk management plan is important to consider and
communicate to the stakeholders. The most appropriate way through which I would
communicate the risk management plan is through a general meeting where all the relevant
stakeholders are invited. Within this meeting, important information would be passed to
include all the individuals that have any form of interest in the operations of the club and
those that are interested in how the club is able to perform.
Question 2
Risk Scenario
For a short duration of time, I have been an employee in a marketing organization,
which involves in the activities of marketing products from through the use of the internet
among many other platforms. For this short duration of time that I have been an employee in
the organization, I have managed to realize a large number of organizational problems which
can cause the organization to experience significant negative consequences on their
operations. To begin with, the organization hired new employees but did not organize any
form of training and development program which could help in equipping the newly hired
employees with marketing skills to increase their effectiveness within the organization. With
regard to this organizational problem, the risk that I identified which the organization is
vulnerable to, is the risk of employee ineffectiveness. This risk has the capability of making

7
the organization less effective in its operation, less capable in addressing the organizational
issues and even completely unable to remain profitable. This section of the paper is addressed
in reference to this organizational risk (Alberts, C. & Dorofee, A. 2003).
What part/s of the legal framework will impact on this risk?
The legal framework regarding organizational risks aims at protecting the interests of
organizational stakeholders like investors, who only invest their funds and money with an
aim of gaining returns. It also aims to protect consumers of the products and services that the
organization offers, to avoid having them exploited through the services and products that the
organization offers them. With regard to this risk, the legal framework that has an impact on
it is the need for the organization to deliver quality as the agreement between it and the
clients require. Any contract that is binding between two parties is recognized by law. When
the organization agrees to make adverts for any client, quality of the service is of paramount
importance. With the occurrence of this risk, however, quality of the services provided would
be compromised (Khatta, 2008).
What standard applies presently?
The standards that presently apply are the standards which involve quality of the
adverts that the organization makes. A high-quality work helps the organization to manage to
maintain a high level of effectiveness in all the operations that it involves in. clients of the
organization have one major requirement, which involves the quality of work that the
organization provides. With this regard, therefore, the standards that concern quality of the
services that the organization offers its clients are the standards that apply with regard to this
risk.
What areas does your risk address? (i.e. commercial relationships)

8
This risk addresses a large number of areas. To begin with, it addresses the area of the
commercial aspect of the organization. When the employees become ineffective, the
organization attains the general problem of operational ineffectiveness. This aspect reduces
the number of clients willing to work with the organization, an aspect that affects its
commercial section significantly. The other area that this work addresses is the area of
employee satisfaction. An employee can only be fully satisfied when he or she is able to carry
out the give duties and roles within the organization effectively. When the ability to be
effective in the contribution that any employee makes in the organization is limited, however,
that employee becomes less satisfied (
There are different types of risk, including legal, financial and safety risk. Which one/s
do you think to apply in your case?
Risks can be grouped into different types. In the case of the occurrence of this risk,
however, the financial category is the most appropriate to group this risk. This is because the
risk of an organization’s inability to ensure that employees are fully equipped with the skills
that they need to carry out their roles and duties effectively reduces the ability of that
organization to be profitable and regarded as appropriate. With this regard, therefore, the risk
of lowly skilled employees and organizational ineffectiveness with regard to quality service
delivery is financial.
Who is responsible for this risk?
In general, any major problem that the organization may have can be blamed on the
organization’s management. To be specific, however, the problem of employee training and
development can specifically be pointed on the organization’s human resource department.
This department plays the role of dealing with all matters regarding employees within the

9
organization. With this regard, therefore, the human resource department of the organization
is responsible for addressing this risk (Lee, E. & Jones, D. 2004).
Who are your external and internal stakeholders? What are their objectives?
The stakeholders refer to the specific individuals in an organization that can be
affected by the occurrence of the risk. The internal stakeholders who will be directly affected
by this risk include the organizational investors since the decrease in organizations gains will
also decrease their gains and the organizational employees, who are likely to be pressured to
do better after their ineffectiveness is realized. The objectives of these stakeholders are to
improve the effectiveness of the organization in order to increase their gains. The external
stakeholders, on the other hand, refer to the stakeholders that are affected by the
organization’s risk occurrence indirectly. With regard to this risk, these are the clients or
customers of the organization. The ineffectiveness of the organization’s employees affects
them negatively since they are less capable of maintaining effectiveness.
Review any political, legal, social, economic or technological changes that will influence
you. Create a SWOT analysis of these below.
The risk of employee ineffectiveness has the capability of being influenced by a large
number of factors. Due to this reason, there are a number of the important aspect that should
be put into consideration, when an assessment of the possible organizational changes that
may impact it is being considered. The technological changes, for example, might require
employees to increase their skills. The economic changes can also require organizational
skills to be more competitive, in order to attract the few available clients. From the SWOT
analysis of this aspect, the main strength of this is the fact that the organization has the ability
to detect these changes and adjusting to their requirements. The main weakness is the fact
that the organization has less competitive employees, who are not highly trained. The

10
opportunity is that the organization can improve significantly when employee training
strategies are established. The threat is that other organizations have highly capable
employees, thus increasing competition for the organization (Pritchard, P. 2000).
Outline how critical success factors will influence this case?
The critical success factors refer to the factors that are significantly important to
consider. All organizations require establishing certain important factors that will help in
ensuring that individuals manage to remain completely effective in the activities that they
involve in. the critical success factors of the organization will influence this risk by
establishing a requirement to create strategies through which it can be mitigated. This aspect
is important because when the risk continues unchecked, it has the ability to cause the
organization not to develop effectively.
Using the stakeholders identified earlier, identify how you would communicate and
consult with each party changes?
Communicating any changes to all the relevant organizational stakeholders is
important. A memo is the most appropriate method to utilize in communicating any changes
to these stakeholders over time. A meeting can also be organized to serve the same purpose
after a short period of time.
What other research would you need to do in this case?
Research on how the organization is proceeding is of paramount importance to the
organization. It is through it that the organization can manage to ensure that it is proceeding
to the right direction and that it is highly appropriate for the operations that it involves in.
additional research that is important and appropriate is the research on the means through
which the organization can train the employees effectively while avoiding any form of

11
ineffectiveness in the training. This research could help in ensuring the organization remains
completely effective in the employee training activity (Rausand, 2011).
In this next section, you may choose to complete a risk assessment form internal to your
organisation.
Risk Matrix
Consequences Level of Risk
Complete financial
breakdown
Major Financial problem
Moderate financial problem
Minor Financial Problem
Negligible financial
problem
organizational
ineffec-
tiveness
employee
ineffec-
tiveness
Customer
dissatis-
faction
Employee
dissatis-
faction
Decreased
number of
customers
Likelihood
What is the likelihood of this problem arising again? What are the possible
consequences of this risk?

12
After a solution to an employee, ineffectiveness has been implemented in the
organization, there is a low possibility of the problem arising again. This is because the
trained employees will have the skills they need to carry out their duties and roles in the
organization. The possible consequences of this risk include the organizational decreased
effectiveness in its operations, poor coordination and the lack of organizational effectiveness.
Evaluate and prioritize risks for treatment? What risk priority would you consider?
The first priority action of this risk is the training of the newly employed employees
in the organization. This is the group of individuals that have significantly low skills in the
organizational marketing activities. The other priority is to increase the skills of the rest of the
employees through further training. I would consider this risk priority because it has the
ability to maintain effectiveness and ensure that the organization manages to attain a high
level of effectiveness on how it operates (Waters, 2011).
What opportunities do you think there are in your case? How can these opportunities
be used?
In this case, the organization has a large number of opportunities to exploit. The first
opportunity is that of increasing employee training, which will help in ensuring that
individuals remain effective in the activities that they involve in. The second opportunity is
that of attracting more clients from the high level of organizational effectiveness. These
opportunities can be used in increasing the effectiveness of the organization and thus
increasing its gains.
Based on your assessment and research list the ways in which you can minimise the
risk.
I can utilize a number of ways to minimize risk. To begin with, I can at least establish
a number of regular training programs which will ensure that any organizational employee is

13
equipped with the necessary skills and capabilities before working for the organization. I can
also increase the requirements of organizational employees when interviews are being held,
in order to ensure that I only employ the highly skilled and qualified employees who do not
need any further training (Anderson, T. 2006).
Choose the risk option that you believe is correct. Which one is it?
Since it is difficult to ensure and determine whether a new recruit into the
organization has all the skills needed until an assessment is made, the most appropriate risk
option is the training option where the newly employed employees are passed through
training sessions to equip them with the skills they need in order to operate effectively in the
organization.
Briefly, explain the risk action plan for this assessment.
The risk action plan outlines the plan of the action that should be taken to address a
certain risk. For this assessment, the risk action plan is establishing risk strategies that will
help in ensuring that all organizational employees obtain the skills that they need in order to
remain highly effective and beneficial in the activities that they involve in.
What documentation and records do you think you will need to maintain and file
before, during and after the action plan is implemented? Why?
Documentation, especially one that involves activities that are beneficial and highly
appropriate is significantly important. Before implementing the risk mitigation plan, a
documentation of the intended skills for the employees is appropriate. During the process of
the implementation, a documentation of this process is appropriate. After the implementation,
a documentation of the changes observed is appropriate. These documentations are important
because they can help to guide any other similar process (Boulder, F., Slavin, D. & Löfstedt,
R. 2007).

14
You need to be able to implement the action plan. What do you need to do? Briefly,
outline how you will implement each step.
The action plan is as explained significantly important. The first step of the
implementation is an employee assessment to determine the necessary and missing skills. The
second step is making a plan on how these employees will be equipped with the necessary
skills. The third step is the training of the employees following the plan established earlier.
The other step is the assessment of employee skills to determine whether they have improved.
The other steps are the assessment of the general organizational improvement changes
obtained.
How often will you communicate with stakeholders?
Communicating with stakeholders is of paramount importance. In order to ensure that
they are all informed of all the processes that are in progress, I will ensure that I communicate
with them when the action plan is in its initial stage when it is in progress and after it is
complete. In these stages, I will explain the progress of the action plan, its aims and its
achievements to these stakeholders (Frenkel, M., Hommel, U., Rudolf, M. & Dufey, G.
2005).
How will you evaluate your case? Develop a tool that you can use to perform this task.
Case evaluation will help in understanding the situation and determining whether the
solution intended is capable of producing the required results. The risk analysis matrix tool
can be utilized to assess and determine the level of operation of this risk. This tool has the
capability of determining whether the organizational strategies of addressing the risk in
question are sufficient in providing positive and the intended result. I will, therefore, utilize
this tool to evaluate my case (Hull, J. 2015).

15
References
Alberts, C. & Dorofee, A. 2003. Managing information security risks : the OCTAVE
approach. Boston: Addison-Wesley.
Anderson, T. 2006. Perspectives on strategic risk management. Køge, Denmark Herndon,
VA: Copenhagen Business School Press.
Bouder, F., Slavin, D. & Löfstedt, R. 2007. The tolerability of risk : a new framework for risk
management. London Sterling, VA: Earthscan.
Frank, A. 2007. IT assurance guide : using COBIT. Rolling Meadows, Ill: IT Governance
Institute.
Frenkel, M., Hommel, U., Rudolf, M. & Dufey, G. 2005. Risk management : challenge and
opportunity. Berlin New York: Springer.
Grady, J. 2010. System management : planning, enterprise identity, and deployment. Boca
Raton: CRC Press/Taylor & Francis.
Greggory, K. 2005. The owner's role in project risk management. Washington, DC: National
Academies Press.
Hull, J. 2015. Risk management and financial institutions. Hoboken, New Jersey: John Wiley
& Sons, Inc.
Khatta, R. 2008. Risk management. New Delhi: Global India Publications.
Lee, E. & Jones, D. 2004. Landslide risk assessment. London: Thomas Telford.
Melton, T. 2007. Project management toolkit : the basics for project success. Amsterdam
Boston: IChemE/Butterworth-Heinemann.

16
Pandian, C. 2007. Applied software risk management : a guide for software project
managers. Boca Raton, Fla: Auerbach Publications, Taylor & Francis Group.
Pritchard, P. 2000. Environmental risk management. London: Earthscan Publications.
Rausand, M. 2011. Risk assessment : theory, methods, and applications. Hoboken, N.J: J.
Wiley & Sons.
Reason, J. 2016. Managing the risks of organizational accidents. Abingdon, Oxon:
Routledge, Taylor & Francis Group.
Rudzki, R. & Trent, R. 2011. Next level supply management excellence your straight to the
bottom line roadmap. Ft. Lauderdale, Fla: J. Ross Pub.
Theodore, M. 2013. Portofolio, program and project managemnet in the pharaceutical and
biotechnology industries. Hoboken, N.J: Wiley.
Waters, C. 2011. Supply chain risk management : vulnerability and resilience in logistics.
London Philadelphia, PA: Kogan Page.
Young, T. 2007. The handbook of project management : a practical guide to effective
policies, techniques and processes. London: Kogan Page.

17