Consolidation of risks in RIMIKSX

The result of the risk consolidation and identification is a list of the identified risks, the so-called risk inventory. In addition to the verbal designation of the respective risks, an initial rough assessment of their impact on the company should also be recorded.

It is desirable to have risk inventories available for corporate management not only at the operational level, but also at the level of the company. For this purpose, the individual inventories must be consolidated. This is all the easier if the risks are similar. For this purpose, risk management provides a standardized selection of risk areas and, where applicable, risks.

However, the risks cannot be standardized one hundred percent. It should be deliberately permitted to name the risks individually to be able to address the problem areas as specifically as possible. This is the only way to ensure that risks can also be managed in a targeted manner and that appropriate risk management measures can be provided.

This makes consolidation of risks more difficult. The preparation of the risk inventories to one of the next levels takes place in various steps. First, the risks are adjusted in their relevance by means of a transition matrix. For example, an operational risk with relevance 4 at the enterprise level is a risk with a deeper relevance.

Then, the risks are listed and sorted by relevance. Similar and/or identical risks can be grouped together, with the higher relevance being entered in the “new” inventory. Systematic risks, i.e., risks that occur more than once, must be reassessed in terms of relevance. For this purpose, the individual inventories are used as a basis of information. The risk controlling department assesses the relevance in combination and documents this in a comprehensible manner in the risk inventory. Planning risks can be reassessed since the aggregated values are available (see Aggregation).