Risk and Impact definition?

Fredizz · Newbie Joined: Sep 22, 2006 Posts: 11

Is there any difference in the way you define and measure the risk and the impact?
How would you define the difference between them if there is one?
Is there a way to "calculate" them, so i would be able to implement it in my organisation.

fighter · Posted: Wed Sep 27, 2006 12:43 pm Post subject:

Fredizz,

Impact is the step by step analysis of the Risk involved in the change.

Impact can be impact on no of users, Configuration Item likely to be impacted by the change, Implementation complexity & Change Complexity, If the change tested, Backout is tested to name a few...

You can grade them from the scale of 1 - 10 .... the higher the grade the higher the risk..

Hope it helps..

Vimzie!!

m_croon · Posted: Wed Sep 27, 2006 4:11 pm Post subject:

Fredizz · Newbie Joined: Sep 22, 2006 Posts: 11

So if i understand quite well, you mean that the impact description will define the level of the risk, for example:

(Impact description) number of users affected + metal of application affected+availability affected+....=Risk level (high, medium,small)

So risk description=impact description, am i correct?

m_croon · Posted: Thu Sep 28, 2006 4:35 am Post subject: Re: Impact and risk definition?

fighter · Posted: Thu Sep 28, 2006 12:03 pm Post subject:

I agree with m_croon

Cannot put it any better!

Fredizz · Newbie Joined: Sep 22, 2006 Posts: 11

That's perfectly clear, my next question will be, are those 2 values linked or tighted together or rather, can their value differ?

Can you give an example whether risk will be high and the impact low
and the impact high but the risk low?

and then i'll promise i'm done with this subject...

fighter · Posted: Thu Sep 28, 2006 6:34 pm Post subject:

Ok think about this scenario..

You have software for your organisation no of users is only 10 and revenue is $100K each day on these system and Availability is 24*7.

Impact on no of users 10. which is quite low.

Impact on Revenue is $100k each day

The over all risk is high here...

There might be a internal HR system which ever user accesses lets say 10000 and the revenue generated out of the system is $0. Ofcourse there are other values the system generates.

The risk on this system is low..

Hope this helps!

Vimzie!!

Fredizz · Newbie Joined: Sep 22, 2006 Posts: 11

Ok, that make sense, however you'll agree that most likely if the impact is high then the risk should be in most of the cases high too.

fighter · Posted: Thu Sep 28, 2006 8:28 pm Post subject:

Yes Fredizz, you are right.. In most cases if the impact is high, risk is high as well...

Vimzie!

UKVIKING · Posted: Fri Sep 29, 2006 10:18 pm Post subject:

Risk and Impact will not necessary follow the same scale.

So a High Risk High Impact may occur as well as a Low Risk High Impact and everything in between

The fire analogy was pretty good.

Use Impact as the effect on the users
Use Risk to determine the chance of Impact happening as well as any consequences.

I will use the water balloon scenario.

You have 10 water balloons. You are tossing them one at a time from your apartment

To the fellow walking below, there is a chance of the baloon IMPACTing on him

To the person dropping the balloon, there is RISK of getting caught and getting the crap beat out of you by the fellow below or your parents .... grin
_________________
John Hardesty
ITSM Manager's Certificate (Red Badge)

Change Management is POWER & CONTROL. /....evil laughter


Create an account	Home · Topics · Downloads · Your Account · Submit News · Top 10


Logos/trademarks property of respective owner. Comments property of poster. Rest © 2004 Itil Community for Service Management & Foundation Certification. SV Site source copyright (c)2003, and is Free Software under the GNU / GPL licence. All Rights Are Reserved.