Strategic Risk Management in Practice

Abstract

Contemporary risk management methodologies are typically used for identification and prioritisation of strategic risks. The International Risk Management standard, ISO 31000:2009, is the world-wide basis for best practice in strategic level risk processes. However, due to the qualitative and subjective nature of strategic risk, its analysis requires a more nuanced approach than that used in more tactical or operational settings and this paper discusses the need to understand the range and nature of strategic threats, and how to represent risk assessments. As such, a particular focus of this work is on how to incorporate best practices in strategic risk analysis, and operations research into the design and application of strategic risk management in the Defence context. A number of steps are recommended incorporating international risk management best practices within the context and uncertainties unique to strategic risk management for Defence (as opposed to tactical or engineering risk management).