If your business is to demonstrate risk management,
As specified by the law and international standards,
You must demonstrate risk analysis.
Risk analysis involves developing an understanding of the risk.
Risk analysis provides an input to risk evaluation and to decisions on whether risks need to be treated, and on the most appropriate risk treatment strategies and methods.
Risk analysis can also provide an input into making decisions where choices must be made and the options involve different types and levels of risk.
Risk analysis involves consideration of the causes and sources of risk, their positive and negative consequences, and the likelihood that those consequences can occur.
Factors that affect consequences and likelihood should be identified.
Risk is analyzed by determining consequences and their likelihood, and other attributes of the risk.
An event can have multiple consequences and can affect multiple objectives.
Existing controls and their effectiveness and efficiency should also be taken into account.
The way in which consequences and likelihood are expressed and the way in which they are combined to determine a level of risk should reflect the type of risk, the information available and the purpose for which the risk assessment output is to be used.
These should all be consistent with the risk criteria. It is also important to consider the interdependence of different risks and their sources.
The confidence in determination of the level of risk and its sensitivity to preconditions and assumptions should be considered in the analysis, and communicated effectively to decision makers and, as appropriate, other stakeholders.
Factors such as divergence of opinion among experts, uncertainty, availability, quality, quantity and ongoing relevance of information, or limitations on modelling should be stated and can be highlighted.
Risk analysis can be undertaken with varying degrees of detail, depending on the risk, the purpose of the analysis, and the information, data and resources available.
Analysis can be qualitative, semi-quantitative or quantitative, or a combination of these, depending on the circumstances.
Consequences and their likelihood can be determined by modelling the outcomes of an event or set of events, or by extrapolation from experimental studies or from available data.
Consequences can be expressed in terms of tangible and intangible impacts.
In some cases, more than one numerical value or descriptor is required to specify consequences and their likelihood for different times, places, groups or situations.
To test this within your business, select 1 traveller and 1 trip.
Now demonstrate all the above, as it applies to that specific traveller and that specific journey.
Now apply it to 10 travellers and 10 business trips.
Is the risk analysis, clear, documented, unique and specific to each traveller and trip?
If not, you don’t have adequate evidence to demonstrate travel risk management, in addition to having an inadequate system of risk analysis.
To learn more about business travel risk management and your obligations,
Visit www.isitsafe.travel .
Next, in this series on travel risk management, we examine risk evaluation, step 5 of 7 required for travel risk management.
Safe work systems and enterprise risk management, inclusive of business mobility and travel.