A Formalised Approach to the Management of Risk

Abstract

Observations made while working with industry and government organisations have shown a number of issues with the implementation of current risk management best practice. A major issue in many cases is the lack of pragmatism associated with the risk management process and the need for a more formalised approach to risk management. In this paper, the authors propose and validate a multi-view approach to defining the processes required to carry out risk management. The formalised approach proposed includes a definition of risk, an ontology, a set of processes, and a pragmatic methodology, which shows an application of these processes enabling pro-active management of change. The ability of the processes to be applied to different types of risk has been demonstrated through a case study highlighting health and safety issues. Within the current engineering and economic climate this logical approach provides a visualisation which is consistent, repeatable, view based, and pragmatic.

Information security risk management terminology and key concepts

“…A notation based on the Unified Modelling Language (UML) was chosen to visualise the concept diagram. Brownsword and Setchi (2011) also use the UML to depict their RM ontology and in the SID Information Framework (TMF 2019) UML class diagrams are used to visualise the relationships between business entities, so it seems an appropriate choice.…”