Risk management is a discipline firmly rooted in organizational management, and particularly in business management. Regulations are often addressed to business operators, which need to implement them through their managerial structures.

Risk management provides tools for structured thinking about the future and for dealing with the associated uncertainty. Implementing risk management in an organization, or in a regulatory authority, gives decision makers tools that enable rational choices, taken on the basis of the information available, no matter how limited it may be. To illustrate the rationale for implementing a risk management framework, we refer to the basic tenet of project management, which describes the interdependence of the following parameters: a project’s budget, the quality of the end product, and the time available for its completion.

A change in any of these parameters for a given project will necessitate changes in the other two. If a project manager shortens the time required for the project’s completion, for example, this will either make it more expensive or compromise its quality, or both. If a project manager cuts the project’s budget, it will either take longer to complete the project, or the quality of the end product will be poorer. Finally, if the quality requirements of the end product are raised, more time or money, or both, will be required to complete the project.

We can present the general concept of risk management in a similar manner, only in this case we need to focus on the interdependence between the following parameters: the payoff from the activities associated with a risk, the cost of the safety measures, and the potential impact of the risk. The interdependence of these parameters is illustrated below in the risk management triangle.

The anticipated payoff does not have to be expressed in monetary terms; we use this expression to refer to the degree to which the objectives and goals of a business or regulator are achieved. For example, the anticipated payoff for a business can be an improvement in client support services, while for a regulator, the payoff can be the benefits to human health from reducing the level of greenhouse gas emissions.

Access to the current status of our work on risk management in regulatory frameworks...