Risk Management

<seo metakeywords="itil risk management, risk management itil, itil risk management process, risk management process" metadescription="Risk Management: ITIL process definition - subprocesses - Additional information on ITIL Risk Management." />

DE - ES - Risk Management

ITIL Risk Management: Overview

Process Objective: To identify, assess and control risks. This includes analysing the value of assets to the business, identifying threats to those assets, and evaluating how vulnerable each asset is to those threats.

Part of: Service Design

Process Owner: Risk Manager

ITIL Risk Management: Process Definition

ITIL Risk Management

Risks are addressed within several processes in ITIL V2 and ITIL V3; there is, however, no dedicated Risk Management process. ITIL V3 calls for “coordinated risk assessment exercises”, so at IT Process Maps we decided to assign clear responsibilities for managing risks, which meant introducing a specific Risk Management process as part of the ITIL® Process Map V3.

Having a basic Risk Management process in place will provide a good starting point for introducing best-practice Risk Management frameworks like M_o_R (as recommended in the ITIL V3 books).

The following sub-processes are part of ITIL Risk Management:

Sub-Processes

Business Impact and Risk Analysis

Process Objective: To quantify the impact to the business that a loss of service or asset would have, and to determine the likelihood of a threat or vulnerability to actually occur. The result of the "Business Impact and Risk Analysis" is the Risk Register, a prioritized list of risks which must be subsequently addressed.

Assessment of Required Risk Mitigation

Process Objective: To determine where risk mitigation measures are required, and to identify Risk Owners who will be responsible for their implementation and ongoing maintenance.

Risk Monitoring

Process Objective: To monitor the progress of counter measure implementation, and to take corrective action where necessary.

ITIL Terms: Risk Management

Business Impact and Risk Analysis

The Business Impact Analysis (BIA) identifies Vital Business Functions (VBFs) and their dependencies. These dependencies may include suppliers, people, other business processes, services etc.. The Risk Analysis identifies threats and vulnerabilities to business assets, and indicates how vulnerable each asset is to those threats.

Process and Asset Valuation

An estimate of the value a process or other asset represents for the business. This value is an important input for Risk Analysis.

Risk Management Policy

The Risk Management Policy describes and communicates the organization’s approach to managing risk. Most importantly, it defines how risk is quantified and who is in charge of specific risk management duties.

The Risk Management Policy is maintained by the Risk Manager role, but to be effective it needs the backing of senior management.

Risk Register

The Risk Register is a tool used by the Risk Management process to keep an overview of identified risks and corresponding counter measures. The Risk Register is sometimes referred to as the Risk Log.

Additional Information on Risk Management

ITIL Roles

Risk Manager - Process Owner

The Risk Manager is responsible for identifying, assessing and controlling risks.

This includes analysing the value of assets to the business, identifying threats to those assets, and evaluating how vulnerable each asset is to those threats.

Downloads

Overview ITIL Risk Management

Use the following links to open the process overview of Risk Management showing the most important interfaces: ITIL Risk Management (.JPG) ITIL Risk Management (.PDF)

ITIL Risk Management at a glance