About the Intstitute of Risk Management (IRM

Contents

Section 9: Informing Risk Decisions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 The Company’s Risk Matrix. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Breaching Explicit Risk Tolerance Levels. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Defining the Company’s Risk Tolerance .............................................................................. 34 Likelihood of Crisis .................................................................................................. 35 Company Loss Exceedance Probability ............................................................................... 36 Section 10: Risk Mitigation Actions ...................................................................................... 37 Threat-specific Mitigation for Catastrophic Risks ...................................................................... 37 Threat-specific Mitigation for Strategic Risks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 Resilience-strengthening ............................................................................................ 37 Monitoring Other Risks .............................................................................................. 38 Section 11: Conclusions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Bibliography ........................................................................................................... 40 Appendix A: Science in Scenarios ........................................................................................ 42 Scenario A - Trade Dispute: United States vs European Union. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 Scenario B - Geopolitical Conflict: Pakistan vs India ................................................................... 43 Scenario C - Cyber Attack: Contagious Malware Infestation ............................................................ 44 Scenario D - Natural Catastrophe: Floods Damage Key Facility. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 Scenario E - Pandemic: Highly Infectious Influenza Virus .............................................................. 46 Scenario F - Governance: Equal Pay Movement ....................................................................... 47

About the Institute of Risk Management (IRM)

The IRM is the leading professional body for Enterprise Risk Management (ERM). We drive excellence in managing risk to ensure organisations are ready for the opportunities and threats of the future. We do this by providing internationally recognised qualifications and training, publishing research and guidance and setting professional standards.

For over 30 years our qualifications have been the global choice of qualifications for risk professionals and their employers. We are an independent, not for profit body, with members working in all industries, in all risk disciplines and in all sectors around the world.