Understanding risk management

‘ITIL is the most widely accepted approach to IT service management worldwide’, quotes AXELOS. Using ITIL best practices can help businesses, organizations, and individuals adapt and embrace change, transformation, and growth. The process enables businesses and individuals to maximize value from their digital services, including IT. Aligned to the business strategy, this will help meet customer needs and develop better procedures with service providers.

Research carried out by AXELOS highlighted that ITIL’s best practices is a fundamental element when aligning business requirements and enabling the business or individual to support their core processes.

While the management of risk within ITIL is not a defined process, there is a recognized framework many adopt through the ITIL lifecycle. Risk is defined as ‘a possible event that could cause loss/harm or affect the ability to achieve objectives’. The ITIL Risk Management process helps businesses identify, assess, and prioritize potential business risks. A risk matrix will highlight a potential risk and its threat level.

The risk matrix

A risk matrix is a set of categories that define the probability of a risk occurring. It uses a simple mechanism that categorizes the severity of the risk, i.e. Critical, Marginal, and Negligible. They’re then matched with the probability of that risk occurring, i.e. Definitely, Likely, Possibly, and Unlikely.

So, the matrix lets businesses individually assess each risk, its threat level, and the likelihood of that risk occurring. Using a risk matrix improves the visibility of this potential risk and its threat impact. This helps risk owners and management in their decision-making process.

The risk management process

The main objectives of ITIL’s risk management process are to identify, assess, and control risks that have been identified using a risk matri