TOGAF ADM: Top 10 techniques – Part 9: Risk Management

Risk Management in EA

Risks are inevitable in any architecture or business transformation effort, and it is crucial to identify, classify, and mitigate them before embarking on the transformation journey. Effective risk management requires a continuous effort to monitor and track the risks throughout the transformation process, even if the risk triggers are outside the scope of the planners.

It’s worth emphasizing that the Enterprise Architect is responsible for identifying and mitigating risks, but it is within the governance framework that risks are accepted and managed. Therefore, it is necessary to establish a robust governance framework that outlines the roles, responsibilities, and procedures for managing risks.

Effective risk management is a critical component of successful architecture and business transformation efforts. It requires continuous monitoring and tracking of risks and establishing a robust governance framework that outlines the roles, responsibilities, and procedures for managing risks.

There are two levels of risks:

• The initial level of risk is the categorization of risks before determining and implementing mitigating actions.
• The residual level of risk is the categorization of risks after implementing mitigating actions.

Initial Level of Risk

The initial level of risk is the first step in the risk management process and involves identifying and categorizing the risks before any mitigating actions are taken. This step includes identifying the potential risks associated with the transformation effort, assessing their likelihood and impact, and categorizing them based on their severity and priority.

Categorizing risks at the initial level is crucial for determining the appropriate mitigating actions needed to address them effectively. It helps in prioritizing the risks and allocating resources and efforts to mitigate the most critical risks first. Once the risks have been identified and categorized, the next step is to determine and implement mitigating actions.

It’s worth noting that the categorization of risks is not a one-time event, and it should be revisited periodically throughout the transformation effort. As the transformation progresses, new risks may emerge, and the severity of existing risks may change, requiring a reassessment and adjustment of the risk mitigation strategy.

Residual Level of Risk

The residual level of risk refers to the level of risk that remains after mitigating actions have been implemented. It represents the risk that an organization is still exposed to, even after the risk management process has been applied.

Once the mitigating actions have been implemented, the residual level of risk should be reassessed to determine whether the mitigating actions have been effective in reducing the risk to an acceptable level. The residual level of risk should be categorized based on the severity and priority of the remaining risk, and additional mitigating actions may need to be identified and implemented to further reduce the risk.

It’s worth noting that the residual level of risk should also be monitored continuously to ensure that the risk mitigation strategy remains effective. The transformation effort may introduce new risks, or the effectiveness of the mitigating actions may diminish over time. Regular monitoring and reassessment of the residual level of risk can help ensure that the risk management strategy remains effective and that the organization is adequately prepared to manage any risks that may arise during the transformation effort.

Risk Management Process

The process for risk management typically consists of the following activities:

1. Risk classification: This involves categorizing risks based on their severity and priority. The classification helps in prioritizing the risks and allocating resources and efforts to mitigate the most critical risks first.
2. Risk identification: This involves identifying potential risks associated with the transformation effort. The risks can be identified through various means, such as brainstorming, risk workshops, and interviews with stakeholders.
3. Initial risk assessment: This involves assessing the likelihood and impact of the identified risks. The assessment helps in determining the severity of the risks and their potential impact on the transformation effort.
4. Risk mitigation and residual risk assessment: This involves identifying and implementing mitigating actions to reduce the risk to an acceptable level. Once the mitigating actions have been implemented, the residual level of risk should be reassessed to determine whether the mitigating actions have been effective in reducing the risk to an acceptable level.
5. Risk monitoring: This involves continuously monitoring and tracking risks throughout the transformation process. Regular monitoring can help in identifying any new risks that may emerge, determining the effectiveness of mitigating actions, and adjusting the risk mitigation strategy as needed.

By following these activities, an organization can effectively manage risks associated with its architecture or business transformation effort, reduce the likelihood and impact of potential risks, and ensure the success of the transformation effort.

 

Initial Level of Risk Assessment

The guidelines for assessing risk impact and frequency are based on best practices in risk management. These guidelines provide a framework for assessing the severity and likelihood of potential risks, which can help organizations prioritize and allocate resources for risk mitigation.

The impact of a risk can be assessed using criteria such as catastrophic, critical, marginal, and negligible. These criteria provide a clear understanding of the potential financial impact of a risk on the organization.

The frequency of a risk can be assessed using criteria such as frequent, likely, occasional, seldom, and unlikely. These criteria provide an understanding of the likelihood of a risk occurring during the course of the transformation effort.

By combining the impact and frequency of a risk, an organization can categorize risks into different risk levels, such as extremely high risk, high risk, moderate risk, and low risk. This categorization can help organizations prioritize and allocate resources for risk mitigation, with higher-risk areas receiving more attention and resources.

Overall, the use of consistent classification schemes for assessing risk impact and frequency can help organizations effectively manage risks associated with architecture or business transformation efforts, reduce the likelihood and impact of potential risks, and ensure the success of the transformation effort.

Here’s an example of Risk Classification Scheme matrix based on the criteria and frequency mentioned above:

Criteria	Frequent	Likely	Occasional	Seldom	Unlikely
Catastrophic	E	E	H	M	L
Critical	H	H	M	L	L
Marginal	M	M	L	L	L
Negligible	L	L	L	L	L

In this Risk Classification Scheme matrix, the rows represent the impact criteria (catastrophic, critical, marginal, and negligible), and the columns represent the frequency of occurrence (frequent, likely, occasional, seldom, and unlikely). The cells in the matrix represent the intersection of the criteria and frequency, and contain a heuristically-based classification of the risk impact.

For example, a risk with a catastrophic impact that is likely to occur several times over the course of a transformation cycle would be classified as “E” (extremely high risk). Similarly, a risk with a critical impact that is likely to occur sporadically would be classified as “M” (moderate risk).

By using this Risk Classification Scheme matrix to assess the impact and frequency of potential risks, organizations can prioritize and allocate resources for risk mitigation, and ensure the success of their architecture or business transformation efforts.

Residual Level of Risk Assessment – Initial Stage

Here’s an example Residual Risk Assessment matrix:

Risk ID	Risk	Preliminary risks of Effect	Preliminary risks of Frequency	Preliminary risks of Impact	Mitigation
R001	Cyber attack	High	Likely	Catastrophic	Implemented firewall and intrusion detection system
R002	Product recall	Medium	Possible	Major	Implemented quality control measures and increased testing
R003	Supply chain disruption	High	Possible	Critical	Established backup suppliers and implemented supply chain risk management program
R004	Natural disaster	High	Unlikely	Catastrophic	Implemented emergency response plan and conducted regular drills
R005	Key employee loss	Medium	Possible	Major	Implemented succession planning and cross-training programs

After mitigation efforts have been implemented, these risks may be re-assessed and the matrix updated to reflect any changes in the residual risks. The final version of the matrix will provide a clear understanding of the residual risks and the effectiveness of the mitigation measures.

Residual Level of Risk Assessment – Review Stage

The “Initial Action” column describes the specific mitigation measure that was implemented to reduce the initial risk. The “Residual risks of Effect”, “Residual risks of Frequency”, and “Residual risks of Impact” columns describe the remaining risks after the initial mitigation measure has been implemented. The “Further Action” column suggests additional actions that can be taken to further reduce the residual risks. This information can be useful for tracking and monitoring the effectiveness of risk management efforts over time.

Here’s an example Residual Risk Assessment matrix with the requested column names:

Risk ID	Risk	Initial Action	Residual risks of Effect	Residual risks of Frequency	Residual risks of Impact	Further Action
R001	Cyber attack	Implemented firewall and intrusion detection system	Low	Possible	Moderate	Conduct regular vulnerability assessments
R002	Product recall	Implemented quality control measures and increased testing	Low	Unlikely	Minor	Monitor supplier performance and implement continuous improvement
R003	Supply chain disruption	Established backup suppliers and implemented supply chain risk management program	Low	Unlikely	Minor	Regularly review and update supply chain risk management program
R004	Natural disaster	Implemented emergency response plan and conducted regular drills	Medium	Possible	Moderate	Conduct regular emergency response drills and update plan as needed
R005	Key employee loss	Implemented succession planning and cross-training programs	Low	Unlikely	Minor	Regularly review and update succession planning program

 

Summary

Residual Risk Assessment matrix is a useful tool for tracking and monitoring the effectiveness of risk management efforts over time. Once initial risks have been identified and mitigation measures have been implemented, the remaining risks are called residual risks. The Residual Risk Assessment matrix provides a structure for organizing and analyzing residual risks by capturing information on risk ID, risk description, preliminary risks of effect, frequency, and impact, and the mitigation measures taken to reduce the risks. This matrix can be updated as needed to reflect changes in the residual risks and the effectiveness of the mitigation measures. By regularly reviewing and updating the matrix, organizations can ensure that they are taking appropriate actions to mitigate risks and reduce the likelihood and impact of potential events.