2.2.3.2 Risk Management Process

Risk Management Process

Figure 2.7 depicts a risk management process. While it may not be necessary to walk through each discrete step in this process for every risk an agency faces, this process is helpful for understanding how to incorporate risk into TAM.

• The process starts with establishing the context for risk management. In the case of risk management for a TAMP, the context is largely defined through other TAMP development steps.
• The second step involves identifying the risks that affect the assets in the TAMP. Ideally, in this step the agency considers the full set of asset-related risks, even those that may appear insignificant.
• The third step, risk analysis, involves identifying the cause of the risk, the outcomes or consequences (impact), and the likelihood of the risk occurring.
• The fourth step, risk evaluation, entails prioritizing and ranking risks.
• Fifth, the address risks step is the response the agency takes to the risk. DOTs can choose to tolerate the risk or treat the risk in some manner.
• The left side of the figure shows a continuous communication and consultation activity. Agencies need to communicate the risks to both internal and external stakeholders, as well as monitor and review the risks.
• The right side of the figure shows an iterative monitoring and review process. Once the risks are identified, analyzed, and a mitigation plan is in place agencies need to monitor the risks and update the risk management documentation accordingly.
• More on risk monitoring and management is discussed in Chapter 6 Monitoring and Adjustment.
• This process is generally consistent with ISO Standard 31000, as well as FHWA’s requirements for state DOTs to assess risks to NHS assets in developing a TAMP.