Security - Telenor

Erik Wisløff (39) works in the
field of risk management at
Telenor R&D. Prior to this he
worked in the security domain
at AIRMATCOMNOR.
erik-dagfinn.wisloff@telenor.com
Telektronikk 3.2000
Telenor’s Risk Management Model
ERIK WISLØFF
Introduction
Telenor defines risk as “the possibility of loss
caused by threats or unwanted events” [1]. However,
risk is a fuzzy, abstract and highly subjective
concept that is inherently difficult to measure
and sometimes next to impossible to come
to terms with.
One reason for the difficulties in understanding
risk is the fact that risk comes from a variety of
sources: political, cultural, financial, legal, technical,
environmental, competitive and personal
framework. Another reason is that one risk may
be a business requirement in one context, but a
threat to the same business requirement in a different
context.
Good risk management will improve the competitive
edge of a business, product or service.
The improved competitive edge comes from better
project management, fewer nasty surprises,
fewer accidents, lower costs while at the same
time improving quality, meeting deadlines,
meeting budgets, better customer communication,
etc. Consultancy firms, hoping to land a
“hefty contract with lots of money attached”,
are quick to point to these benefits of risk management.
Small wonder, then, that some people view risk
management more as magic than science, and
are deeply suspicious of the claims that risk
managers promote. Risk management is neither
science nor magic. Risk management is a repeatable
business process that systematically examines
all the various products, processes, business
surroundings and business objectives at all levels
of the company. No more, no less.
What is Risk Mmanagement
in Telenor?
Telenor defines risk management as the business
process of managing risks by identifying, analysing
and controlling costs related to risks. The
rewards of an on-going risk management regime
include
• Better knowledge of the risks one faces;
• Better understanding of the interaction
between the business and its environment;
• Better understanding of the business’ critical
success factors.
This understanding could be used in many ways.
For instance, it is difficult to cost justify loss
reduction measures unless one knows the risks
one faces. In addition, it is equally difficult to
select reasonable risk financing strategies without
knowing the risks one faces. Selecting a reasonable
risk balance between different products,
services or branches is impossible without a
realistic understanding of the business environment.
Discontinuing a product or service without
regard to the business’ critical success factors
could turn into a nightmare. Thus, knowledge
and understanding lead to an improved competitive
edge and the benefits mentioned in the introduction.
However, risk management must be
an on-going business process in order to harvest
the benefits.
Risk management is a flexible business process.
You can use risk management to manage risks
associated with a single product or service or to
manage aggregate business risks.
The primary goal of risk management in Telenor
is to minimise the aggregate risk cost, which is
the sum of all individual risk costs in the business.
The first challenge is to balance future
costs caused by an unwanted incident against
costs of attempting to prevent the incident from
happening in the first place. The next challenge
is to balance all the individual risks and costs in
such a way that the grand total is minimised.
The optimal protection level point, as a risk
manager sees it, is the lowest point in the curve
labelled “total costs”. This is illustrated in Figure
1.
A secondary goal is quite simply to identify risks
and then selectively “fixing any unacceptable
problems”. This is typically a support activity in
the business process of managing aggregate risk
exposure. It is a necessary activity, but it quickly
turns into an isolated series of suboptimalisations.
However, this is also an important step
towards developing a mature risk management
oriented business attitude.
Telenor’s Risk Management
Model
Telenor’s risk management model illustrates the
business process of managing risks. The risk
management model is based on a refinement of
the classical ‘analyse – act – evaluate’ cycle. As
65