Analysis of the organization, environment, market, procedures, finance, personnel, IT, etc., in order to define intervention priorities for risk reduction and increase opportunities.
Analysis and decision of the level of risk (financial, reputation, etc.) that the company is willing to take
- and eventually lose - to achieve its objectives.
Upstream preparation to reduce the impact and probability of a risk occurring, and preparation of the company to react effectively when the risk occurs, in order to reduce the impact.
Once decisions have been made, actions implemented, and staff trained, controls allow for a continuous improvement process.