3. Video Pembelajaran - Penyusunan Risk Register

Summary

This training video provides an in-depth guide to compiling an operational risk register for an organization, in line with regulations from the Ministry of ATR BPN. It covers the process of identifying risks, structuring them in a risk register, and implementing mitigation strategies. The video explains how to use risk identification methods, categorize risks, and assess impacts. It also outlines how to assign risk ownership, evaluate likelihood, and determine the severity of potential consequences. Emphasis is placed on using structured frameworks like the 5Y method and the risk analysis matrix to effectively manage and mitigate risks.

Takeaways

• 😀 The goal of the material is to help learners compile an organization's operational risk register accurately.
• 😀 The risk register format follows the provisions outlined in the Regulation of the Minister of ATR BPN No. 3 of 2022.
• 😀 Risk identification involves determining objectives, activities, and selecting crucial activities tied to risks with no adequate controls.
• 😀 Risks are identified through four perspectives: network, outcome, people, and goods.
• 😀 A risk statement must begin with the word 'potential,' emphasizing that the risk has not occurred yet.
• 😀 Risks should be linked to objectives or business processes and sorted by priority based on their relevance.
• 😀 Risk causes are identified using the 5Y method, and causes should be prioritized according to their frequency and internal or external origins.
• 😀 Impacts of risks should refer to the impact criteria defined in the regulation, focusing on performance or financial loss.
• 😀 Risk owners are assigned to internal units, with only one risk owner per risk, and these individuals are responsible for mitigation strategies.
• 😀 Likelihood of risks is measured based on historical data, frequency of occurrences, or expert judgment, and should be recorded on a risk map.
• 😀 Risk management strategies include transferring, mitigating, or avoiding risks depending on their size and impact on the organization.

Q & A

What is the main objective of compiling an organization's operational risk register?

The main objective is to compile an organization's operational risk register based on applicable provisions, ensuring risks are identified and mitigated appropriately to minimize impact on the organization's goals.

What are the main topics and indicators for learning outcomes related to the risk register?

The main topics include understanding the risk register format, compiling it accurately, identifying risks, and determining appropriate mitigation strategies. Learning indicators focus on the ability to compile an operational risk register based on existing regulations.

How should risks be identified during the risk identification process?

Risks should be identified by first determining the objectives and periods of work units, followed by selecting activities critical to achieving the target. Activities that are crucial and lack adequate control should be prioritized for risk identification.

What are the four job perspectives used in identifying risks?

The four job perspectives include: 1) Network (e.g., infrastructure, communication), 2) Outcome (e.g., reports, reputation), 3) People (e.g., consumers, employees), and 4) Goods (e.g., products, machines).

What is the significance of using the '5Y' method in identifying risk causes?

The '5Y' method is used to determine the root causes of a risk event. It involves asking 'Why?' multiple times to drill down to the underlying cause, helping to identify both internal and external factors contributing to the risk.

How should the impact of a risk be evaluated?

The impact of a risk should be evaluated based on criteria set by regulations. It must reflect the significance of the risk, such as a decrease in performance (e.g., a 10% drop if a target was 100%) or financial loss. Only the most significant impact should be considered.

What role do risk owners play in the risk register?

Risk owners are responsible for managing specific risks within the organization. They are typically the heads of relevant units (e.g., Regional Office or Land Office) and ensure that mitigation actions are carried out and monitored.

What is the risk analysis matrix, and how is it used?

The risk analysis matrix is used to assess the likelihood and impact of risks. It employs a scale from 1 to 5, where each risk is assessed based on its probability of occurrence and the potential severity of its impact.

How are mitigation strategies classified in the risk management process?

Mitigation strategies are classified into four types: 1) Risk acceptance (small or insignificant risks), 2) Risk transfer (e.g., insurance), 3) Risk mitigation (e.g., training or procedures), and 4) Risk avoidance (e.g., halting certain activities to prevent large risks).

What is the purpose of including a 'residual risk' in the risk register?

The 'residual risk' represents the level of risk remaining after mitigation actions have been implemented. It helps track the effectiveness of risk management efforts and shows the risk level after controls are applied.