ENTERPRISE RISK MANAGEMENT ISO 31000 - 2009

MOHAMAD HASSAN AK., MAFIS, QIA, CRMP, CRMA

ERM - ISO 31000

RISK ASSESSMENT

Conduct Risk Assessment • Risk Identification • Risk Analysis • Risk Evaluation

Determine Risk Treatment

Agree on ERM Context

Monitor ERM Process

Communicate and Result

ERM PROCESS

Agree on ERM Context

• Establishing the context and defines the context as ‘defining

external & internal parameters to be taken into account when

managing risk, and setting the scope and risk criteria for the risk

management policy’.

• To make sure everyone involved in conducting risk assessment

understands the context and risk criteria (risk capacity, risk

attitude, risk appetite statements, and risk tolerance levels)

• Agree on model or type of Risk Map, the most common ones -

Impact and Likelihood.

Conduct Risk Assessment

•Identify Risk Events

•Develop Risk Universe

Risk Identification

•Causes

•Sources

•Interdependencies

Risk

Analysis

•Assess Risk Universe

•Impact (fin, fin.rep., reputation, environ., safety, legal, etc)

•Likelihood

•Level of Risks

•Prioritize Risk

Risk Evaluation

BAGIAN TIDAK TERPISAHKAN

SEBAGAI BUDAYA ORGANISASI

PRAKTIK TERBAIK DI ORGANISASI

PROSES BISNIS ORGANISASI

1 • KOMUNIKASI DAN KONSULTANSI

2 • PENENTUAN KONTEKS

3 • PENILAIAN RISIKO

4 • RESPON TERHADAP RISIKO

5 •MONITORING DAN REVIEW

PENENTUAN

KONTEKS

PENILAIAN

RISIKO

IDENTIFIKASI

RISIKO

ANALISIS RISIKO

EVALUASI

RISIKO

RESPON RISIKO

MONITORING

& REVIEW

• KONTEKS EKSTERNAL

– Analisis stakeholders

– Kepentingan, sasaran, dan

pengaruh

• KONTEKS INTERNAL

– Dokumen organisasi

– Analisis proses bisnis

– Pengaruh faktor internal:

keuangan, operasional,

teknologi, dsb.

• KONTEKS PROSES

– Harus jelas sasaran dan

parameter digunakan.

– Mulai identifikasi hingga

respon risiko

– Pemilahan kegiatan proses

bisnis

• PENGEMBANGAN

KRITERIA

– Kemungkinan - dampak risiko

– Level/tingkatan risiko

– Risk appetite

IDENTIFIKASI

RISIKO

ANALISIS

RISIKO

EVALUASI

RISIKO

MENGHINDARI

MEMINDAHKAN

MITIGASI MENERIMA

EXPLOITASI

PROSES PEMBELAJARAN DAN ANALISIS

DETEKSI LINGKUNGAN INTERNAL DAN EKSTERNAL

MEMASTIKAN EFEKTIFITAS PENGENDALIAN DAN

RESPON RISIKO

IDENTIFIKASI RISIKO-RISIKO BARU