The bow tie focuses on a multitude of causes and impacts of a risk. It also includes controls and their effectiveness. This is a powerful tool for analysing risks further and in some cases reporting too.

Every organisation is different and places different emphasis on their reasons for existing. Some organisations will have a stronger focus on Reputation, whilst others will be focused on profit. It is up to the board, the strategy and objectives as well as the risk manager to determine the importance or emphasis to be placed. 

Whilst risk appetite is the amount of risk that the company has decided is acceptable to meeting it’s objectives, the risk tolerance highlights risks that will depend much on performance, targets, how much more risk the board feels the company can take, how well we are managing other risks and how much the opportunity is worth. 

Whilst data recovery and evacuation are a major concern and form part of business continuity, the main focus is to ensure the continuation of the business and its services to an acceptable level (to the company and customers) during and after an incident in order to work towards full recovery thereafter. 

With broken logic, a schedule risk analysis will have minimal impact on dates. Additionally, constraints, a risk will not be able to move a date in the schedule if it hits, again, having minimal impact on the overall schedule. These are just two key factors of ensuring a successful schedule risk analysis is undertaken. 

A risk maturity model should be bespoke to the organisation. It should provide a number of benefits including a way to measure progress and success of the risk management program, benchmarking with other companies or even internal benchmarking between facilities or departments. It also provides a roadmap of how to achieve the aspirations set by the board. 

There are many cases in which a company with no formal risk framework, policy or procedures has managed risks well. Many organisations have a very effective and positive risk culture which enables free flowing communication across the organisation allowing decisions to be made based on risk. In most cases, Risk Culture is a better indicator of effective risk management than policies and procedures. 

Companies who experiences an incident but who had business continuity plans, found that they recovered not only to previous levels but far exceeded these levels along with companies who had not even experiences an incident. Investor confidence (perception that the company can withstand any event) in the company, reputation and resilience are all factors in why they achieved such performance. 

Many projects are insured for the duration of the project (2 years) however the majority of projects are significantly delayed. By the point of needing to extend the insurance cover, the premiums are usually costly. Schedule risk analysis, provides a more accurate view of the schedule (6 months delay?) allowing to secure reasonable premiums upfront for the potential delay. 

If all your risks are green, you are not taking enough risk and will probably go out of business. It's impossible for an energy company who work in a safety sensitive industry to have no amber/red risks. To be competitive, they have to take big risks which come with high reward. Risk Management is not  about avoiding all risks. It's about taking more informed & intelligent risks.