Sharing Best Practice • Professional Development Plan

A competent risk management practitioner will understand and be able to describe and evaluate the elements of an organisation's operating frameworks that are necessary to support and integrate effective risk management across the organisation, including:

• mandate
• policies
• delegations and accountabilities
• resources
• competencies
• communications with stakeholders

A competent risk management practitioner will be familiar with key principles which underpin effective risk management, including the role of risk management in:

• creating and protecting value
• decision making
• addressing uncertainty
• anticipating and responding to change
• continual improvement

and with key attributes on which effective risk management depends, including:

• integration of risk management into the overall organisations
• a systematic, tailored, structured and timely approach
• applying best available information
• transparency and inclusiveness
• consideration of human and cultural factors
• dynamic and iterative

1.  Context

A competent risk management practitioner will be able to establish the Context, including:

• articulating the organisation's objectives
• defining the external environment in which the organisation seeks to achieve its objectives, and its external stakeholders
• defining the internal environment in which the organisation seeks to achieve its objectives, and its internal stakeholders
• developing the risk criteria against which to evaluate risks
• identifying the purpose and scope of the particular risk management activity

2.  Communication and consultation

A competent risk management practitioner will understand the role of communication and consultation at various stages of the risk management process and be able to:

• develop a communication plan for both internal and external stakeholders about components of the risk management plan
• devise and implement appropriate methods to communicate with and consult internal and external stakeholders, and others as needed, on components of the risk management activity

3.  Risk identification

A competent risk management practitioner will understand the concept of "risk" and therefore be able to:

• select appropriate risk identification techniques that will reveal sources of risk, potential events, and their causes and consequences
• use information from various sources
• describe risks in an appropriate way
• apply the above skills to identify risks in a selected risk Context

4.  Risk analysis

A competent risk management practitioner will understand the purpose of risk analysis and be able to:

• describe a range of analytical techniques and the type of risk analysis to which each is suited
• recognise and evaluate existing controls
• select a method of combining consequence and likelihood that is appropriate to the purpose of the risk assessment and available information
• analyse risks using selected methods

5.  Risk evaluation

A competent risk management practitioner will be able to evaluate risks against the criteria decided earlier so that decisions can be made about treatment of risks and priorities for treatment.

6.  Risk treatment

A competent risk management practitioner will be able to:

• devise and evaluate treatment options so as to take advantage of opportunities presented by risks, reduce risks or make existing risk controls more reliable
• devise risk treatment implementation plans
• implement risk treatments
• assess new risks arising as a consequence of the risk treatment

7.  Monitoring and review

A competent risk management practitioner will understand the role of both monitoring and review and be able to:

• identify appropriate aspects of each stage of the risk management process that warrant monitoring and devise appropriate methods for doing so (including selecting appropriate methods to report and use the information obtained)
• identify appropriate aspects of each stage of the risk management process that warrant periodic review and devise appropriate methods for doing so (including selecting appropriate methods to express, report and use the information obtained)
• integrate monitoring and review processes into the organisation's assurance programme

A competent risk management practitioner will be able to design or evaluate record-keeping systems that provide transparency and are appropriate for each stage of the risk management process and understand the role such systems are to play in the organisation's risk management activities.