Risk Management
<seo metakeywords="itil risk management, risk management itil, itil risk management process, risk management process" metadescription="Risk Management: ITIL process definition - subprocesses - Additional information on ITIL Risk Management." />
ITIL Risk Management: Overview
Process Objective: To identify, assess and control risks. This includes analysing the value of assets to the business, identifying threats to those assets, and evaluating how vulnerable each asset is to those threats.
Part of: Service Design
Process Owner: Risk Manager
ITIL Risk Management: Process Definition
Risks are addressed within several processes in ITIL V2 and ITIL V3; there is, however, no dedicated Risk Management process. ITIL V3 calls for “coordinated risk assessment exercises”, so at IT Process Maps we decided to assign clear responsibilities for managing risks, which meant introducing a specific Risk Management process as part of the ITIL® Process Map V3.
Having a basic Risk Management process in place will provide a good starting point for introducing best-practice Risk Management frameworks like M_o_R (as recommended in the ITIL V3 books).
The following sub-processes are part of ITIL Risk Management:
Sub-Processes
- Business Impact and Risk Analysis
- Process Objective: To quantify the impact to the business that a loss of service or asset would have, and to determine the likelihood of a threat or vulnerability to actually occur. The result of the "Business Impact and Risk Analysis" is the Risk Register, a prioritized list of risks which must be subsequently addressed.
- Assessment of Required Risk Mitigation
- Process Objective: To determine where risk mitigation measures are required, and to identify Risk Owners who will be responsible for their implementation and ongoing maintenance.
- Risk Monitoring
- Process Objective: To monitor the progress of counter measure implementation, and to take corrective action where necessary.
ITIL Terms: Risk Management
- Business Impact and Risk Analysis
- The Business Impact Analysis (BIA) identifies Vital Business Functions (VBFs) and their dependencies. These dependencies may include suppliers, people, other business processes, services etc.. The Risk Analysis identifies threats and vulnerabilities to business assets, and indicates how vulnerable each asset is to those threats.
- Process and Asset Valuation
- An estimate of the value a process or other asset represents for the business. This value is an important input for Risk Analysis.
- Risk Management Policy
- The Risk Management Policy describes and communicates the organization’s approach to managing risk. Most importantly, it defines how risk is quantified and who is in charge of specific risk management duties.
- The Risk Management Policy is maintained by the Risk Manager role, but to be effective it needs the backing of senior management.
- Risk Register
- The Risk Register is a tool used by the Risk Management process to keep an overview of identified risks and corresponding counter measures. The Risk Register is sometimes referred to as the Risk Log.
Additional Information on Risk Management
ITIL Roles
- Risk Manager - Process Owner
- The Risk Manager is responsible for identifying, assessing and controlling risks.
- This includes analysing the value of assets to the business, identifying threats to those assets, and evaluating how vulnerable each asset is to those threats.
Downloads
Overview ITIL Risk Management
|
Use the following links to open the process overview of Risk Management showing the most important interfaces: |
|
