Process-oriented Risk Analysis is a methodology used to identify, analyze, and manage risks within different processes of an organization. Instead of performing a general risk analysis, a process-oriented risk analysis aims to identify risks that may arise when performing the process.

July 5, 2024

1. Define a purpose and objective with the Risk Analysis

The first step is establishing why the Risk Analysis is being carried out. Is it to improve safety, reduce costs, or improve quality?

Specify what is to be achieved by the Risk Analysis, how the result will be managed, and by whom.

2. Create an understanding for the process

A process-oriented Risk Analysis assumes that the process in question has already been mapped. If the process is not mapped, it should be mapped. You can read more about how to map a process by clicking here.

It is only when the process is visualized and describes why it exists, who does what, and how we do it that we have all the details to make a good risk analysis.

3. Collect data

To prepare for a Risk Analysis, we should look at historical data. We should ask ourselves questions such as:

• What has happened in connection with the process in the past?
• Are there any discrepancies?
• Are there complaints?
• Are there negative events we should take into account?

An identified non-conformity is a risk with a 100% probability of occurrence. Has anything changed in the process, and is the probability the same now?

4. Identiy risks

The best way to identify risks is to bring more perspectives into the work. Sitting in a workshop with different representatives helps us to get a representative picture of the risks. In the workshop, we place the risks in the process model and then draw the relationship “Addresses” to the activities, business objects, or resources the risk affects.

Sometimes, it can be difficult to distinguish between problems and risks in a process. Therefore, it can be helpful to indicate the title of the risk with “Risk of…”.

5. Assessing the risks

Once all risks are identified and addressed to the right parts of the process, it is time to assess them. The most common method is to determine the probability of the risk occurring and the consequences if it happens. It is possible to create fields in 2c8 Apps with predefined values, e.g. 1-5 or 1-10. The product of probability and consequence is called risk value.

As there is often a cross-assessment between risks in a process, seeing them in a table outside the model is beneficial.

6. Set responsibilities and create an action plan for managing risks

In 2c8 Apps, you can create fields to indicate consequence and probability. You can also create a field for responsibility. This field indicates who is responsible for developing actions that reduce the risk value of the hazard. It is often difficult to eliminate risk completely, but there is a lot we can do to prevent it from happening or having major consequences.

7. Follow-up on Risk Management

Often, risk management, i.e., developing measures, implementing them, and evaluating them, is a longer process. One advantage is that we can already set a new date for a workshop further ahead in the risk analysis. Then, we can go through the action work and hopefully lower the risk assessment. On this occasion, it may also be that new risks have emerged that need to be evaluated, analyzed, and managed for the next Risk Analysis workshop. All in a continuous improvement wheel.