...

Sustainability is Our Goals

Overview & Implementation

of Risk Management

PT CARIMAX TECHNOLOGY IND

8 September 2022
Oleh:
Mochamad Nuri
© DeCRA 2016 1
Bagian 1 : Risk Management
Overview

© DeCRA 2016 2
 Quality ? Mutu ?

Quality
Quality Control/ Assurance /
Kendali Mutu Jaminan Mutu
Quality Management / Sustainability
Manajemen Mutu Organisation

3
 What is Risk?
“dampak dari ketidakpastian terhadap pencapaian obyektif”

• Dapat memiliki aspek yang berbeda

Penyimpangan dari yang misalnya keuangan , keamanan ,
Kekurangan informasi yang
diharapkan - positip dan / tujuan lingkungan  
berkaitan dengan suatu
atau negatip peristiwa, konsekuensinya , • Dapat diterapkan pada tingkatan yang
atau kemungkinan berbeda misalnya strategi ,
departemen , proyek
What can go wrong?

Berapa besar Apakah konsekuensinya ?

kemungkinan terjadi ?
comprehensive portfolios ensure your corporate reputation remains secure
RISK MANAGEMENT is NOT about quality!

• Semakin kompleknya :
• Pasar global
• Kompleksitas produk yang semakin besar
• Bisnis Peningkatan
• Politik Resiko
• Ekonomi
• Sosial
• Teknologi
• Peraturan dan Perundangan Meningkatnya
• Lingkungan pentingnya
manajemen resiko
6
Risk is multidimensional

Strategic Risk
Credit Risk Market Risk Investment Risk Liquidity Risk
Operational Risk Regulatory Risk Project Risk

Reputational Risk
7
One can “slice and dice” these multiple dimensions
of risk*
“Specific
Equity Risk Risk”
Trading Risk
Market Risk Interest Rate Risk General
Market
Gap Risk
Currency Risk Risk
Credit Risk
Commodity Risk
Counterparty
Operational Risk
Risk
Risks Transaction Risk
Reputational Issuer Risk
Risk Portfolio
Concentration
Business and Risk Issue Risk
strategic risks

8
 Taking a risk: isn’t all bad
 Risk taking is positive, not implicitly negative.

 We take risks not to avoid harm, but to achieve benefits and

gains.

 Taking controlled, informed risks is a sensible and everyday

essential part of life.

 The higher the risk the higher the reward.

 Without risk there is no progress.

9
Ketidaktepatan mengelola risiko atau tidak adanya manajemen risiko
merupakan akar dari setiap kegagalan perusahaan mencapai
tujuannya

10
 What is Risk Management?

Manajemen risiko adalah metode logis dan

sistematis untuk identifikasi , analisa ,
memperlakukan dan memonitor risiko
pada setiap kegiatan atau proses

11
 What is Risk Management?

Adalah pendekatan yang terstruktur untuk mengelola ketidakpastian.

Pilihannya adalah :
• Menghindari resiko
• Mengurangi resiko
• Transfer resiko
• Menerima atau menyetujui resiko

12
 What is Risk Management?

Sistem manajemen risiko yang baik seharusnya dapat memberikan keyakinan

bahwa dengan penerapan manajemen risiko, organisasi dapat mengurangi

ketidakpastian yang membayangi dalam setiap pengambilan keputusan namun

tetap dapat berinovasi sesuai dengan kapabilitas yang dimiliki.

13
 Evolution of Risk Management
The Past The Present The Future
Risk Management as Risk Management to Risk Management as Business
Compliance Prioritise Problems Optimisation
 Identifikasi masalah • Identifikasi masalah • Identifikasi masalah dan peluang yang potensial
 dirangking • dirangking • Memahami penyebab dan faktor yang berakibat
 Demonstrasikan setiap • Diperiksa jika resiko diatas pada kemungkinan dan konsekuensi.
resiko telah dikendalikan target (kualitatip) • Mengoptimalkan tindakan yang dilakukan
(biasanya melalui • Menerapkan peningkatan dengan mempertimbangkan :
prosedur) pengendalian yang dimulai  Efektivitas pengendalian sekarang dan yang akan di
 Pemantauan dari resiko tertinggi lakukan
 Faktor penyebab
• Memantau penerapannya
 Biaya dan manfaatnya dari tindakan yang akan
dilakukan
 Biaya dan mafaat jika mengambil resikonya
• Tindakan sesuai dengan tingkat resikonya
• Monitor dan feedback
Historically Speaking 2004
2001 The
1993 The title “Chief terrorism of Release of
1950s-1960s 1970s 1980s
Risk Officer” is first used September 11 and COSO ERM
Traditional Risk Risk management Companies begin
by James Lam, at GE the collapse of Integrated
Management gains wider Risk
Capital, to describe a Enron remind the Framework
(“TRM”) acceptance departments,
function to manage “all world that nothing
typically focused
aspects of risk,” including
on insurance risk management, back- is too big for 2009 ISO 31000
collapse published- Principles
1950 office operations, and and Guidelines.
business and financial
planning

1977 1992 2002 2010

Foreign Committee of Sarbanes-Oxley
Corrupt Sponsoring Act of 2002
1920 British Practices Organizations
Petroleum forms Act (“COSO”) 1995 A multi- 2008 BS 31100
Tanker Insurance published which is
(“FCPA”) published disciplinary task force Principles and
Company, Ltd., one Internal
of Standards Guidelines on Risk
of the first captive Control —
insurance Integrated Australia/Standards Management .
companies, Framework New Zealand publishes
beginning a the first Risk
movement that
exploded in the Management
1970s and 1980s. Standard, AS/NZS
4360:1995.
15
Risk Management Standards

1. Risk Management Standard (IRM, ALARM and AIRMIC) U.K.

2. AZ/NZS 4360:2004 Risk Management Standard.
3. COSO Enterprise Risk Management, U.S.
4. Canadian Government Sector Standard.
5. ISO 31000 Risk Management – Guidelines on principles and implementation of
risk management.
6. ISO Guide 73 – Risk Management Vocabulary.
7. BS 31100 Code of practice for risk management.

16
 ISO 31000 : RISK MANAGEMENT GUIDELINES
harmonize risk management processes in existing and future standards, dealing with
specific risks and/or sectors, and does not replace those standards

ISO 27001 ISO 22301 ISO 9001:2015

Quality
OHSAS RISK BASED
INFORMATION BUSINESS AUDIT
SECURITY CONTINUITY Management 18001
MANAGEMENT MANAGEMENT System …………………
OCC. HEALTH &
SYSTEM SYSTEM SAFETY
preservation of strategic and tactical ISO 55001:2014 MANAGEMENT
confidentiality, integrity and capability of the SYSTEM
availability of information organization to plan for
and respond to incidents Asset
and business disruptions Management
in order to continue System
business operations at an
acceptable pre-defined
level ISO 14001:2015
ISO27001:A.14.1
Information Environmental
security aspects of
business continuity Management
management System
Useful guidance on Risk

© DeCRA 2016 18
Evolusi Seri ISO 9000

© DeCRA 2016 19
Bagian 2 : ISO 31000 : 2009

© DeCRA 2016 20
ISO 31000:2009

• ISO 31000:2009, Risk management – Prinsip dan panduan telah dirilis oleh lembaga

standardisasi ISO yang  ditujukan kepada organisasi yang ingin mengelola risiko
secara efektif.
• ISO 31000 memuat prinsip-prinsip dan kerangka kerja serta proses untuk mengelola
segala faktor risiko secara transparan, sistematis dan kredibel.
• Melalui manajemen risiko berbasis ISO 31000:2009 perusahaan dapat
mengembangkan, melaksanakan dan meningkatkan kinerja manajemen risiko
perusahaan sebagai bagian integral dari sistem manajemen perusahaan digunakan
sebagai dasar dalam pengambilan keputusan
• dapat diterapkan untuk setiap jenis organisasi, baik publik, swasta, komunitas,
asosiasi, kelompok atau perorangan
• Pemenuhan akuntabilitas pada setiap tingkatan organisasi yang relevan

21
Family of ISO 31000

• ISO 31000
Risk Management - Principles and Guidelines
• ISO/IEC 31010 *
Risk Management - Risk Assessment Techniques
• ISO/IEC Guide 73
Risk Management - Vocabulary

* ISO 31000 (clause 5.4) refers users to ISO/IEC 31010 for guidance on doing
Risk Assessment (RA)

22
 ISO 31000: Main elements
► Principles: What characteristics should the risk management have to be effective?
► Framework: How to integrate risk management within the organization’s overall management system?
► Process: How to tailor risk management to organization’s practices and business processes, integrate it at the operational
level? How to identify, assess and treat a variety of risks?
Principles Framework Process
(Clause 3) (Clause 4) (Clause 5)

23
11 Principles for Managing Risk

Principles Framework Process

1. Creates and protects value

2. Is an integral part of all organizational processes
3. Is part of decision making
4. Explicitly addresses uncertainty
5. Is systematic, structured and timely
6. Is based on the best available information
7. Is tailored
8. Takes human and cultural factors into account
9. Is transparent and inclusive
10. Is dynamic, iterative and responsive to change
11. Facilitates continual improvement of the organization

24
Principles for Managing Risk

1. Manajemen risiko menciptakan nilai tambah (creates value)

Manajemen risiko berkontribusi terhadap pencapaian nyata objektif dan peningkatan,
antara lain, kesehatan dan keselamatan manusia, kepatuhan terhadap hukum dan
peraturan, penerimaan publik, perlindungan lingkungan, kinerja keuangan, kualitas
produk, efisiensi operasi, serta tata kelola dan reputasi perusahaan.

2. Manajemen risiko adalah bagian integral proses dalam organisasi (an integral
part of organizational processes)
Manajemen risiko adalah bagian tanggung jawab manajemen dan merupakan suatu
bagian integral dalam proses normal organisasi seperti juga merupakan bagian dari
seluruh proses proyek dan manajemen perubahan. Manajemen risiko bukanlah
merupakan aktivitas yang berdiri sendiri yang terpisah dari aktivitas-aktivitas utama
dan proses dalam organisasi.

25
Principles for Managing Risk

3. Manajemen risiko adalah bagian dari pengambilan keputusan (part of decision making)
Manajemen risiko membantu pengambil keputusan mengambil keputusan dengan informasi
yang cukup. Manajemen risiko dapat membantu memprioritaskan tindakan dan
membedakan berbagai pilihan alternatif tindakan. Pada akhirnya, manajemen risiko dapat
membantu memutuskan apakah suatu risiko dapat diterima atau apakah suatu penanganan
risiko telah memadai dan efektif.

4. Manajemen risiko secara eksplisit menangani ketidakpastian (explicitly addresses

uncertainty)
Manajemen risiko menangani aspek-aspek ketidakpastian dalam pengambilan keputusan, sifat
alami dari ketidakpastian itu, dan bagaimana menanganinya.

5. Manajemen risiko bersifat sistematis, terstruktur, dan tepat waktu (systematic,

structured and timely)
Suatu pendekatan sistematis, tepat waktu, dan terstruktur terhadap manajemen risiko memiliki
kontribusi terhadap efisiensi dan hasil yang konsisten, dapat dibandingkan, serta andal.

26
Principles for Managing Risk

6. Manajemen risiko berdasarkan informasi terbaik yang tersedia (based on the best
available information)
Masukan untuk proses pengelolaan risiko didasarkan oleh sumber informasi seperti
pengalaman, umpan balik, pengamatan, prakiraan, dan pertimbangan pakar. Meskipun
demikian, pengambil keputusan harus terinformasi dan harus mempertimbangkan segala
keterbatasan data atau model yang digunakan atau kemungkinan perbedaan pendapat
antar pakar.

7. Manajemen risiko dibuat sesuai kebutuhan (tailored)

Manajemen risiko diselaraskan dengan konteks eksternal dan internal organisasi serta profil
risikonya.

8. Manajemen risiko memperhitungkan faktor manusia dan budaya (takes human and
cultural factors into account)
Manajemen risiko organisasi mengakui kapabilitas, persepsi, dan tujuan pihak- pihak eksternal
dan internal yang dapat mendukung atau malah menghambat pencapaian tujuan
organisasi.
27
Principles for Managing Risk

9. Manajemen risiko bersifat transparan dan inklusif (transparent and inclusive)

Pelibatan para pemangku kepentingan, terutama pengambil keputusan, dengan sesuai dan tepat waktu
pada semua tingkatan organisasi, memastikan manajemen risiko tetap relevan dan mengikuti
perkembangan. Pelibatan ini juga memungkinkan pemangku kepentingan untuk cukup terwakili dan
diperhitungkan sudut pandangnya dalam menentukan kriteria risiko.

10. Manajemen risiko bersifat dinamis, iteratif, dan responsif terhadap perubahan (dynamic, iterative
and responsive to change)
Seiring dengan timbulnya peristiwa internal dan eksternal, perubahan konteks dan pengetahuan, serta
diterapkannya pemantauan dan peninjauan, risiko-risiko baru bermunculan, sedangkan yang ada
bisa berubah atau hilang. Karenanya, suatu organisasi harus memastikan bahwa manajemen risiko
terus menerus memantau dan menanggapi perubahan.

11. Manajemen risiko memfasilitasi perbaikan dan pengembangan berkelanjutan organisasi

(facilitates continual improvement and enhancement of the organization)
Organisasi harus mengembangkan dan mengimplementasikan strategi untuk memperbaiki kematangan
manajemen risiko mereka bersama aspek-aspek lain dalam organisasi mereka.
28
Risk Management Framework:
Mandate and Commitment

Mandate and Commitment

Principles (3)
(4.2)

PLAN
Design of Framework for Managing
Risk (4.3)
ACT DO
Continual Improvement of the Implementing Risk Management
Framework (4.6) (4.4)
CHECK
Monitoring and Review of the
Framework (4.5)

29
 Workshop 1
terms and definitions

10 minutes
Click here to start

30
Bagian 3 : Tahapan manajemen
resiko

© DeCRA 2016 31
 Risk Management Process
• Establish the Context: for strategic, organisational and risk
management and the criteria against which busineess risks will
be evaluated.
• Identify Risk: that could ‘prevent, degrade, delay or
enhance’ the achievement of an organisation’s business and
strategic objectives.
• Analyse Risk: consider the range of potential consequences
and the likelihood that those consequences could occur.
• Evaluate Risks: compare risks against the firm’s pre-
established criteria and consider the balance between potential
benefits and adverse outcomes.
• Treat Risks: develop and implement plans for increasing
potential benefits and reducing potential costs of those risks
identified as requiring to be ‘treated’.
• Monitor and Review: the performance and cost
effectiveness of the entire risk management system and the
progress of risk treatment plans with a view to continuous
improvement through learning from performance failures and
deficiencies.
• Communicate and Consult: with internal and external
‘stakeholders’ at each stage of the risk management process.

Note that: Identify, Analyse and Evaluate Risks

are collectively grouped as ‘Risk Assessment’.
32
33
Establishing the Context

Penetapan konteks (establishing the context)

•Penetapan konteks bertujuan untuk mengidentifikasi dan mengungkapkan sasaran organisasi, lingkungan dimana
sasaran hendak dicapai, stakeholders yang berkepentingan, dan keberagaman kriteria risiko, dimana hal-hal ini
akan membantu mengungkapkan dan menilai sifat dan kompleksitas dari risiko.

•Terdapat empat konteks yang perlu ditentukan dalam penetapan konteks, yaitu konteks internal, konteks
eksternal, konteks manajemen risiko, dan kriteria risiko.

[Link] internal memperhatikan sisi internal organisasi yaitu struktur organisasi, kultur dalam organisasi, dan
hal-hal lain yang dapat mempengaruhi pencapaian sasaran organisasi. 

[Link] eksternal mendefinisikan sisi eksternal organisasi yaitu pesaing, otoritas, perkembangan teknologi, dan
hal-hal lain yang dapat mempengaruhi pencapaian sasaran organisasi. 

[Link] manajemen risiko memperhatikan bagaimana manajemen risiko diberlakukan dan bagaimana hal
tersebut akan diterapkan di masa yang akan datang. 

[Link] pembentukan manajemen risiko organisasi perlu mendefinisikan  parameter yang disepakati bersama
untuk digunakan sebagai kriteria risiko.
34
Establishing the Context

2. Identify the
Internal and
External 3. Identify and
Environment Analyse Relevant
1. Identify the Stakeholders
Organisation and/or
Function Objectives

THE SIX STEPS

TO ESTABLISH
THE CONTEXT

4. Specify the Main

Scope of the Risk
6. Define Key Management
Elements for Activities
Structuring the Risk
Assessment Process
5. Identify Criteria for
Risks
Measurement
and Acceptable Level
of Risks
Establishing the Context
EXTERNAL CONTEXT - EXAMPLES OF SOURCES OF RISK
External Sources Risk issues
of Risk

Economic Market growth, economic cycle, shares & interest rates, capital movement,
regional stability, credit availability & costs, exchange rates

Political and Legislation, regulation, government policy, political involvement, investment,

Regulatory standards & protocols, acceptable practices, intellectual property, societal security

Supply Components, outsourcing, contractors, quality assurance, logistics, costs,

availability
Technology Communications, transportation, hardware, software, security, availability

Competition Resources, skills, funding, market positioning, new entrants

Community Reputation, ethics, partners, practices, stakeholder expectations, activism,

relationships, support,
Establishing the Context

INTERNAL CONTEXT - EXAMPLES OF SOURCES OF RISK

Internal sources of risk Risk issues

Knowledge retention, skills, integrity, loyalty, industrial relations, competency, currency of

People expertise, employment costs, equity, workload management, ethics, demographics, health and
safety

Data/information Integrity, currency, relevance, access, storage, quality, timeliness, security, communication

Strategy Robustness, flexibility, strategic fit, planning capability, implementation, involvement, ownership

Stakeholder Stakeholder needs, segmentation, fulfilment, relationships, service proposition, knowledge &
management understanding

Vision, management capability, innovation, culture, ethics, effectiveness, communication,

Leadership
involvement

Process/product/ Robustness, capability, intellectual property, life cycle, innovation, management controls,
services currency and relevance, quality, efficiency and effectiveness

Business results Business objectives, growth, sustainable development, performance, resilience, sustainability

37
Establishing the Context

Risk Assessment

Risk Identification

Risk Analysis

Risk Evaluation

Risk Treatment

38
RISK IDENTIFICATION

39
 WHAT NEED TO BE IDENTIFIED?
• Identifikasi komprehensif dengan menggunakan proses sistematis yang terstruktur, secara
dalam, luas dan harus mencakup semua risiko, baik risiko yang berada dalam kendali
maupun risiko yang di luar kendali
• Identifikasi dilakukan pada sumber risiko, area dampak risiko, penyebabnya dan potensi
akibatnya.

Risk Identification is critical because what is not identified cannot

be managed

Minimum
Records

Penyebabab
Sumber Kejadian (kapan dan Dampaknya
(bagimana dan
Resiko dimana) (Konsekuensi) mengapa)

An outbreak of People contact with affected

Disease Many people die
Bird Flu epidemic chicken
 STRATEGIC RISK IDENTIFICATION
Strategic risk concerned with where the organisation wants to go, how it plans to get there,
and how it can ensure survival. Strategic risks are generally identified through interviews
with managers and other stakeholders. A structured brainstorming may be conducted to
cover key issues as follow:
KEY ISSUES CONSIDERATION
Objectives How might they not be achieved?
Resources and assets to How might they fail or be lost?
achieve objectives

Critical functions How they might be harmed?

Events that might affect What might be the outcome?

organisations
Sources of risk How might they cause harm?

41
 RISK IDENTIFICATION TOOLS
Kategori Resiko

The Known Risks The Known Unknown Risks The Unknown Unknowns
(Resiko yg diketahui)
(Mengetahui Resiko yang tidak (Tidak mengetahui resiko
• Past Data diketahui) yang tidak diketahui)
• Checklists
• Thinking Prompts • Work System Analysis • Analisa sebelumnya
• Human Error • Pathway Analysis dengan dikombinasikan
Analysis • HAZOPS pemikiran imaginasi
• FMEA
Risk Identification
Key Product / Services
Risk
Activity 1 Activity 2 Activity …

Resources

Resources

Resources
Resources
Activity … Activity … Activity …

Activity … Activity … Activity (n)

43
PAST DATA
Risk can be identified from past records such as:
•Financial statements
Process •Incidents statistics
•Non-compliance or complaints
•Project debriefing reports

Where a loss occurs relatively frequently within

Applicability
organisation or industry wide

A good way of identifying known common

Strength failures

Rare but severe events may be ignored because it

Weakness
has not happened before within the organisation
Corporate Governance.…what are the risks?

© DeCRA 2016 45
© DeCRA 2016 46
© DeCRA 2016 47
Kriteria Resiko - Konsekuensi
Kriteria Resiko - Kemungkinan
Workshop 2

Understanding the organization and its context

Risk Internal & External

Risk Criteria

50
HUMAN ERROR ANALYSIS
A human error is a cause of risk events but not a risk itself. For each task (operation, maintenance,
communication etc) apply error check list below to identify “failure modes and effect”. e.g Clerk
enters incorrect data resulting in incorrect billing.

• Action omitted • Action in wrong direction

• Action too early • Right action wrong object
• Action too late • Wrong action right object
• Action too much • Wrong action wrong object
• Action too little • Information not obtained and/or
• Action too long transmitted
• Action too short • Wrong information obtained/transmitted
Failure Mode Effect Analyis (FMEA)

• FMEA selain mempertimbangkan kegagalan pada produk/jasa,

juga mempertimbangkan
• keterbatasan / kemampuan manufacturing dan assembly,
misalnya : Keterbatasan ruang untuk melakukan assembly,
keterbatasan/ kemampuan mesin
• Keterbatasan/ kemudahan servise dan recycle produk/jasa,
misalnya : ruang untuk akses tooling untuk perbaikan.
Kemampuan diagnostic, klasifikasi material (untuk keperluan
recycle)

52
Failure Mode Effect Analyis (FMEA)
Severity FMEA 3rd [Link]

Source : FMEA Manual (QS 9000)

53
Failure Mode Effect Analyis (FMEA)

Proses FMEA – Tahapan

Source : FMEA Manual (QS 9000)

54
54
Failure Mode Effect Analyis (FMEA) FMEA Detection

55
Failure Mode Effect Analyis (FMEA)

FMEA [Link]

56
Workshop 3
Identifikasi Resiko

Click here to start

57
ANALISA RESIKO

58
 Risk Analysis

Risk Risk Risk

Assessment Management Monitoring

Process
Identification Control It
Level

Share or Activity
Measurement
Transfer It Level

Diversify or
Prioritization Entity Level
Avoid It
 Analisa Resiko

• Kombinasi antara konsekuensi dan kemungkinan untuk menentukan

tingkat risiko, dimana menggambarkan :
• Tipe resiko
• Informasi yang ada
• Dasar dari evaluasi resiko dan keputusan untuk memperlakukan resiko (risk
treatment)

• Harus konsisten dengan kriteria resiko

60
TUJUAN ANALISA RESIKO
• Memberikan informasi lebih lanjut tentang hasil positif dan negatif yang mungkin untuk
meningkatkan kualitas keputusan dalam perencanaan
• Untuk mendapatkan pemahaman yang lebih baik dari faktor-faktor yang akan
mempengaruhi risiko sehingga dampak negatif dapat dikurangi.
• Untuk memprioritaskan risiko paling penting untuk ditangani terlebih dahulu
• Untuk menemukan tingkat risiko yang dibandingkan dengan kriteria keberterimaan.
• Untuk menentukan penganan yang terbaik.
• Untuk melihat beberapa pilihan terbaik sebagai keseimbangan antara risiko positif dan
negatif
• Untuk memenuhi persyaratan peraturan

61
Analisa resiko mempertimbangkan :
• Penyebab dan sumber resiko
• Konsekuensi Positip dan negatip
• Kemungkinan konsekuensi tertentu akan terjadi
• Faktor yang mempengaruhi kemungkinan dan konsekuensi
• Pengendalian yang ada

62
 Root-Cause Analysis
Gejala 1 Solusi 1
Solusi 2
Akar
Gejala 2 masalah Solusi 3
Solusi 4
Solusi
Gejala Solusi 5
terpilih
3 Solusi
Gejala 4 terpilih
Solusi 1 Solusi
Solusi 2 terpilih
Gejala 5 Akar
masalah Solusi 3
Solusi 4
Gejala 6
Solusi 5
63
RISK ANALYSIS AND TYPE OF ANALYSIS

Analisis Kuantitatif
Analisis Kualitatif

skala deskriptif untuk menggambarkan besaran Analisis kuantitatif menggunakan nilai angka (daripada menggunakan
konsekuensi yang potensial dan likelihood skala deskriptif seperti digunakan dalam analisis kualitatif dan semi
bahwa konsekuensi akan terjadi. kuantitatif) baik untuk consequence maupun untuk likelihood, dengan
menggunakan data dari berbagai sumber.
Analisis kualitatif digunakan: Kualitas analisis tergantung pada akurasi dan kelengkapan nilai numerik
•Sebagai suatu aktivitas penyaringan awal yang digunakan.
untuk mengidentifikasi risiko-risiko yang Consequence dapat diestimasi dengan pembuatan model outcome dari
memerlukan analisis yang lebih rinci; suatu atau beberapa peristiwa, atau dengan ekstrapolasi hasil kajian
•Ketika level risiko tidak memungkinkan eksperimen atau data masa lalu.
dilakukannya analisis yang lebih penuh karena
faktor waktu dan sumberdaya; atau Consequence : dinyatakan dalam satuan moneter (mata uang), kriteria
•Ketika data numerik tidak memadai bagi suatu teknik (satuan pengukuran) atau manusia (kematian/ cedera) atau kriteria
analisis kuantitatif lainnya. Dalam beberapa kasus, diperlukan lebih dari satu nilai numerik
untuk menentukan konsekuensi pada waktu, tempat, kelompok atau
situasi yang berbeda.

Likelihood biasanya dinyatakan sebagai probabilitas, frekuensi atau

kombinasi antara paparan dan probabilitas.
64
 CONDUCT RISK ANALYSIS
Likelihood Consequence
Key Objectives Risk Risk Risk Rating
Process Outcome Cause (1-5) (1-5)
(1-25)

Critical path What the process The outcomes of The event that Probability or Outcome or impact of Risk rating or risk score
an event. There can be is the product of
for a system try to achieved? the process that cause or lead to frequency of an more than one multiplying the
life cycle. Key What are the key we do not want the undesirable event to occur. consequence from an likelihood level with the
functions that success criteria for to happen. They risk outcomes. Can be expressed event, can be positive consequence level. It
or negative,
help a system the process? are indicators of qualitatively or qualitative or
helps to determine the
achieves its a process failure. quantitatively level of risk whether it
quantitative. is low, medium, high or
mission. very high
 SAMPLE CONSEQUENCES RANKING
Level Descriptor Description/Impact

1 Insignificant Low financial loss, no injuries

2 Minor Medium financial loss, first aid treatment, on-site

release immediately contained
3 Moderate High financial loss, medical treatment required,
on-site release

4 Major Major financial loss, extensive injuries, loss of

production capability, off-site release with no
detrimental effects
5 Catastrophic Huge financial loss, death, toxic release off-site
with detrimental effect
 SAMPLE LIKELIHOOD RANKING
Level Probability Description

1 Rare May occur only in exceptional circumstances

(e.g. once in 10 years)
2 Unlikely Could occur at some time (e.g. once in 5
years)
3 Possible Might occur at some time (e.g. once a year)

4 Likely Will probably occur in most circumstances

(e.g. monthly)
5 Almost Certain Is expected to occur in most circumstances
(e.g. daily)
 Workshop 4
Analisa Resiko

68
EVALUASI RESIKO

69
Evaluasi Resiko

RISK EVALUATION INVOLVES COMPARING ESTIMATED LEVELS

OF RISK TO DETERMINE THE SIGNIFICANCE OF THE LEVEL AND
TYPE OF RISK TO MAKE DECISIONS ABOUT FUTURE ACTIONS

• Whether a risk needs treatment

• Priorities for treatment
• Which option to choose
• Whether an activity should be undertaken
• Which of a number of paths should be followed
70
 RISK (EVALUATION) CRITERIA
ALARP (As Low as Reasonably Practicable)

Risk reduction measures

are essential whatever
Generally Intolerable Region
their cost
Increasing Individual

and Social Concern

Tolerable Region Residual risk tolerable

(Risk is undertaken only if further risk
Risk

only if a benefit is reduction is impractical

desired)
Broadly
Acceptable Risk reduction not
Region likely to be required

Negligible Risk
How we look at Risk

73
74
 SAMPLE RISK ANALYSIS MATRIX
Likelihood Consequences
Insignificant Minor Moderate Major Catastrophic
1 2 3 4 5
A (5) H H E E E
(Almost Certain)
B (4) M H H E E
(Likely)
C (3) L M H E E
(Moderate)
D (2) L L M H E
(Unlikely)
E (1) L L M H H
(Rare)

E: Extreme Risk, Immediate Action Required H: High Risk, Senior Management Attention
Needed M: Moderate Risk, Management Responsibility Must be Specified, L: Low Risk,
Manage by Routine Procedures
 AN EXAMPLE OF RISK APPETITE LEVEL
All Risk Total
Organisational strategy 100’000 Product design
and stability 10’000
Security exposures 1’000 Time to market
100 restrictions

Asset exposures 10 Customer

exposure

Finished product or service Contract

quality expectation management
Installation and Reliance on suppliers
maintenance activity
Goods are stored Production activities
and transported
Expected Loss Unexpected Loss
76
Workshop 5
Evaluasi Resiko

Click here to start

77
 RISK
TREATMENT
5.4.5

78
 Risk Treatment

1. Menghindari risiko dengan tidak melakukan atau melanjutkan kegiatan

yang menimbulkan risiko (“eliminasi”)
2. Mengambil atau meningkatkan risiko untuk mengejar kesempatan
3. Melepaskan sumber resiko
4. Merubah kemungkinan
5. Merubah konsekuensi
6. Berbagi risiko dengan pihak lain (termasuk kontrak dan pembiayaan
risiko)
7. Mempertahankan risiko

79
79
RISK TREATMENT STRATEGIES

© DeCRA 2016 80
RISK AVOIDANCE/ELIMINATION

• Reduce the probability of occurrence or the impact of the

risk to zero
• Can avoid risk by not undertaking a specific activity or
choosing an alternative path, but may:
• Lose potential benefit
• Often substitute one risk for another
• Impossible to eliminate risk completely

81
 RISK CHANGE/REDUCTION
ADVERSE RISKS CAN BE REDUCED EITHER BY REDUCING THE LIKELIHOOD OF LOSS
OR BY REDUCING THE SEVERITY OF THE EFFECTS. CONTROLS TO REDUCE
NEGATIVE RISKS INCLUDE PREVENTATION, PROTECTION AND DETECTION

Change Probability of Change Consequence

Occurrence
Fire – Separate combustion from ignition Fire – Automatic Sprinkler Systems
sources

Fraud – perform background checks Fraud - Audits

Key Staff – Offer attractive retention Key Staff – Succession Planning

package
RISK SHARING/TRANSFER
CANNOT COMPLETELY “TRANSFER RISK” OR RESPONSIBILITY.
RESIDUAL RISK OR ALTERNATIVE RISK WILL STILL EXIST.

Share the risk with someone else Example of Risk Transfer/Share

The financial burden and/or •Contracting

consequences of the risk •Outsourcing
•Insurance
The level of uncertainty
•Alternative Risk Transfer
Some of the responsibility
RETAINED RISK
RISK THAT REMAIN AFTER CONTROL OR TRANSFER/SHARE IS
THE “RESIDUAL RISK”

• Those risk that can be tolerated

• Those risks not identified
• Residual risks which are not transferred
• Develop recovery plans for residual risk

84
© DeCRA 2016 85
 Hierarchy of Controls

ELIMINATION

SUBSTITUTION
HUMAN
ENGINEERING
INVOLVEMENT

ADMINISTRATIVE

ERP

© DeCRA 2016 86
 RISK (EVALUATION) CRITERIA
ALARP (As Low as Reasonably Practicable)

Risk reduction measures

are essential whatever
Generally Intolerable Region
their cost
Increasing Individual

and Social Concern

Tolerable Region Residual risk tolerable

(Risk is undertaken only if further risk
Risk

only if a benefit is reduction is impractical

desired)
Broadly
Acceptable Risk reduction not
Region likely to be required

Negligible Risk

© DeCRA 2016 87
© DeCRA 2016
88
A simple risk-based control plan (BS 8800)

Risk level Action and time scale

No action nor documentary records needed - but good practice to
Trivial record the assessment
Improvement not mandatory, but record and monitoring required to
Tolerable ensure controls are maintained. Go for cheap improvements where
possible.
Aim to reduce risk but costs of prevention may be limited. Measures
Moderate should be tied to a timetable
Where the risk involves work in progress urgent action should be
Substantial taken otherwise work should not start until the risk has been reduced.
Considerable resources may have to be allocated.
Work should not be started or continued until the risk has been
Intolerable reduced. If it is not possible to reduce risk even with unlimited resources
work has to remain prohibited.

© DeCRA 2016
89
BUSINESS CONTINUITY MANAGEMENT
Why do we need BCM?

SURVIVAL!
• Recovery from a major Incident/Disaster
• Responding to changing environment
Sample Risk Scorecard

Gross risk

Nett risk

Target risk
 Workshop 6
Risk Treatment

92
93
Risk Management Maturity Level
1. Risk management mandated by Board/senior management.
2. Established risk management organization.
3. Risk management policy.
4. Risk management process.
5. Defined method for embedding risk management.
6. Explicit reporting requirements.
7. Type of risk management tools used.
8. Risk management information captured in a consistent way.
9. Frequency of risk management carried out.
10. Organizational activities that include risk management.
11. Risk management being used to support opportunity seeking behaviour.
12. Risk management increased Board confidence in pursuing new opportunities.
13. Process of continual improvement.
 Implementing Risk Management (4.4)

Penerapan Kerangka kerja manajemen resiko Penerapan proses Manajemen Resiko

• Menentukan waktu dan strategi yang tepat • Melaksanakan proses manajemen
• Menerapkan kebijakan manajemen resiko dan proses resiko yang dituangkan dalam kluasa 5
untuk kegiatan organisasi
• Penerapan melalui Rencana
• Memastikan keputusan selaraskan dengan tujuan
Manajemen Resiko
• Memastikan kepatuhan dengan persyaratan hukum dan
peraturan • Di semua tingkat yang relevan dan
• Memberikan pelatihan dan kesadaran fungsi organisasi
• Berkomunikasi dan berkonsultasi dengan pemangku • Integral pada proses organisasi
kepentingan

95
96
 Komunikasi dan Konsultasi

Internal & External Stakeholders

Komunikasi dan Konsultasi dua arah

pada setiap tahapan manajemen resiko

Memastikan variasi Memastikan

Meningkatkan pemahaman harapan pemangku semua orang peduli
pada resiko dan kepentingan akan peranan dan
proses manajemen resiko dipertimbangkan tanggung jawabnya

97
98
IDENTIFIKASI “TOUCH POINT”
(Yang dirasakan oleh Pelanggan)

PELAYANAN
PRIMA
• PROCESS
EXCELLENCE
• PRODUCT
TOUCH
POINT EXCELLENCE
• PLACE EXCELLENCE
• PEOPLE EXCELLENCE

PELANGGAN
 KRITERIA “TOUCH POINT”

 BERSIH
 RAPI
 AMAN
 NYAMAN
 INFORMATIP

Lingkungan Kerja

 HANDAL
 TERAWAT
 AKURAT
 AMAN

Peralatan M – MUST have this

S – SHOULD have this if al all possible
Kategori
& C – COULD have this if it does not affect anything else

prioritas W – WON’T have this time but WOULD like in the future
BLUE PRINT SERVICE
EXCELLENCE
102
103
 Pasen Menunggu Pemanggil Penangan Administra Penyeraha Pembayar
1 Customer Action : Registrasi Farmasi Menunggu
Mendaftar Dokter an an Poli si obat n an
On-Stage Contact
2 Action:              
     
  Admin RS              
     
  Perawat              
     
  Dokter              
     
  Apoteker/Petugas              
     
  Kasir RS              
     
Backstage Contact
3 Action:              
     
  Petugas IT/Database              
     
  Paramedik              
     
  Petugas Gudang Obat              
     
Support Process
4 Action:              
     
  Housekeeping              
     
  Prasarana              
     

CTSE (Critical
Standar (Sub-
Pelayanan to Service MoSCoW Indikator Ekspektasi Prosedur
Standar)
Excellence)

Ability (A1) Must trampil STR valid    

1-5
Attitude (A2) Must Ramah dan empati Survey 5  
skala
1-5
Appearance (A3) Should 5R dan sopan Survey 4 UPI, Checklist
skala
Penanganan Poli
1-5
Attention (A4) Must Responsive Survey 5  
skala

Action (A5) Must cepat dan tepat waktu 3 menit  

Accountability angka
Must Komplain 0   regulasi
(A6) komplain
105
106
BLUE PRINT SERVICE
EXCELLENCE
IDENTIFIKASI “TOUCH POINT”
(Yang dirasakan oleh Pelanggan)

PELAYANAN
PRIMA
• PROCESS
EXCELLENCE
• PRODUCT
TOUCH
POINT EXCELLENCE
• PLACE EXCELLENCE
• PEOPLE EXCELLENCE

PELANGGAN
 KRITERIA “TOUCH POINT”

 BERSIH
 RAPI
 AMAN
 NYAMAN
 INFORMATIP

Lingkungan Kerja

 HANDAL
 TERAWAT
 AKURAT
 AMAN

Peralatan M – MUST have this

S – SHOULD have this if al all possible
Kategori
& C – COULD have this if it does not affect anything else

prioritas W – WON’T have this time but WOULD like in the future
110
111
 Pasen Menunggu Pemanggil Penangan Administra Penyeraha Pembayar
1 Customer Action : Registrasi Farmasi Menunggu
Mendaftar Dokter an an Poli si obat n an
On-Stage Contact
2 Action:              
     
  Admin RS              
     
  Perawat              
     
  Dokter              
     
  Apoteker/Petugas              
     
  Kasir RS              
     
Backstage Contact
3 Action:              
     
  Petugas IT/Database              
     
  Paramedik              
     
  Petugas Gudang Obat              
     
Support Process
4 Action:              
     
  Housekeeping              
     
  Prasarana              
     

CTSE (Critical
Standar (Sub-
Pelayanan to Service MoSCoW Indikator Ekspektasi Prosedur
Standar)
Excellence)

Ability (A1) Must trampil STR valid    

1-5
Attitude (A2) Must Ramah dan empati Survey 5  
skala
1-5
Appearance (A3) Should 5R dan sopan Survey 4 UPI, Checklist
skala
Penanganan Poli
1-5
Attention (A4) Must Responsive Survey 5  
skala

Action (A5) Must cepat dan tepat waktu 3 menit  

Accountability angka
Must Komplain 0   regulasi
(A6) komplain
113
114