Risk assessment approaches

There are two approaches to risk management—top-down and bottom-up.

In a top-down risk assessment approach, risk scenarios are driven from the management perspective that are related directly to the organization’s business objectives. In this approach, risk scenarios are developed for risk events that directly impact the business goals and objectives. Actions from the top-down risk assessment are easier to have a buy-in from the other stakeholders given these are directed from the senior management. The results of the risk assessment tend to be broader in nature as these are based on the experience of the management team managing multiple businesses and functions.

Here’s an example of a top-down risk assessment for a healthcare organization’s new Electronic Health Record (EHR) system, with the Board of Directors’ (BoD) review of the quarterly revenue results, Ethics & Compliance (E&C), senior management performance...