become-itil-foundation-certified-abhinav-kaiser(www.ebook-dl.com)

4.6.1.2 Risk Analysis
Chapter 4 ■ Service Strategy
After you think you have identified all the risks (which is impossible), add another
column next to the risk to identify the probability that the risk could materialize:
• Datacenter losing power during janitorial activities: Low
• End users losing connectivity to business applications: Medium
• Employees taking sick leave in December: High
Also, you would expound on the potential impact that you identified in the previous
activity—risk identification. There are two ways to analyze an impact: quantitative and
qualitative. In one column, you could quantify the impact by providing numbers for the
impact, such as 100 users impacted and losses amount to $10,000. In the next column,
you can describe the impact in words, the things that cannot be quantified. Such as the
company losing the brand image and facing legal action from customers.
The next item on the agenda to analyze is the mitigation actions. For every identified
risk, you need to come up with a plan to mitigate it. Remember that you cannot avoid all
risks, so you need a concrete plan to handle them when risk events are realized.
4.6.2 Risk Management
Risk management is twofold: pro-active and reactive, with the emphasis being on being
pro-active.
Reactive risk management is straightforward. You have a risk register that lists all the
risks against the mitigation actions. When it happens, whoever is in charge needs to take
mitigation action and see it through the day. Nothing fancy about it, but it’s a necessity.
Pro-active risks can be managed by reviewing the risk register regularly. Basically
in this activity, smart people in the room look at every risk and the probability of it
happening and review if it is still the case. If the probability has changed, the risk register
is updated. It is possible that the janitor tripping over the power line is no longer a risk
one year after it was recorded, as janitors are no longer allowed to enter datacenters.
Perhaps air quality issues where resolved because there is a new technology in place that
automatically sucks all the dust through its ducts, and the air conditioning comes with
improved air purifying filters that ensure 99.99% dust-free air.
Risk management overall is an interesting activity. Although you play the devil’s
advocate, it helps you understand the stability of the service and keeps you better
prepared for the worst to come. As the adage goes, expect the best and plan for the worst.
4.7 Governance
Governance is a way of organizing, amplifying, and constraining power.
—Rebecca MacKinnon
53