Empirical Template
The Empirical Template can be used to prepare information ready to put into Empirical. The fields correlate with the data entry fields in Empirical and can be copied into these in the Empirical System.
Empirical Template Guidance:
| GUIDANCE ON COMPLETING THE FIELDS IN EMPIRICAL | ||
| (a) | Risk Identifier | The 'Risk identifier' is the reference for a risk that is used to identify and access the risk. The information you enter here is a label that will assist when referring to the risk. The format is not constrained but guidance is that using the form ‘Dept-risk number-year ‘ (i.e. Dept-001-2011, Dept-001-2012) is most helpful and allows risks to be shown as current by updating the ‘year’ component of the Risk identifier. n.b. ('Risk Identifier' is also referred to as 'Risk Serial Id' or 'Risk Id' depending on the function being used) |
| (b) | Organisation | Organisation' refers to the area the risk is allocated to. The information relevant to your area is based on the College’s ‘Organisational Entities’. These are drawn from the ‘Building Blocks’ listed by HR at https://www.imperial.ac.uk/admin-services/secretariat/information-for-staff/college-building-blocks/. The area you work in relates to these ‘Organisational Entities’ which can be, for example, a Faculty, Division, Department, Institute, Office, Service, Bureau etc. These will be referred to throughout as ‘Organisational Entities’. |
| (c) | Title | Give the risk a title - this should be brief but meaningful. Try to avoid 'Failure to' type descriptions as these are describing causes and not necessarily the full scope of the risk. It is better to use a conditional format i.e. 'If something happens (or not) then this will result. For example: a better title than 'Failure to manage finances' would be 'Incorrect application of current financial regulations will result in reputational damage and possible prosecution' |
| (d) | Description | Describe the risk here. Include sufficient information to identify the area, scope, causes, consequences and other factors that will describe the risk in a way which is understandable to someone who is not from your area or discipline. Expanding on and explaining the title will assist with this. Remember to include all of the components that constitutes a risk i.e. there will be a set of circumstances that give rise to an event where the risk is realised, there will be one or more causes, and there will be one or more consequences. |
| (e) | Risk Owner | Give the name of the person who owns this risk i.e. who is responsible for managing the risk and ensuring the controls are effective? |
| (f) | Author Name | This defaults to the person who enters the risk on Empirical - can be changed |
| (g) | Risk Type | Risk Type refers to whether the risk is an Opportunity or Threat |
| (h) | Treatment | Treatment describes the approach we are taking to managing the risk. These are: Treat, Transfer, Tolerate or Terminate. |
| (i) | Impact Score | Allocate a score to the Impact / consequences of the risk if it were to be realised i.e. if the risk happens how would you rate the impact / consequences. 1 = low, 10 = high. This score applies to both positive and negative risks (i.e. opportunities (benefits) and threats (costs)) |
| (j) | Likelihood Score | Allocate a score to the Likelihood / probability of the risk being realised i.e. how likely is it that the risk will happen 1 = low, 10 = high. This score applies to both positive and negative risks (i.e. opportunities (benefits) and threats (costs)) |
| (k) | Tolerance Score | The risks within a profile will at some point move to a position where they can be tolerated (accepted). This means they are being effectively managed and do not need the introduction of further controls to improve mitigation. Where the current score for a risk is above the tolerance score then pending controls are introduced to provide measures (mitigations) to reduce the current score. The Tolerance Score is used to indicate the point at which a risk can be tolerated (accepted) so it is appropriate to change the Tolerance Score to reflect this. For Tolerate risks the Current Score should equal or be below the Tolerance Score. For Treat risks with a high current score and a (relatively) low tolerance score it may not be possible to reduce the current score to a low tolerance so the tolerance score should be raised to a higher level to indicate where the Risk becomes tolerable (acceptable) as the mitigations will then be sufficient. |
| (l) | Current Score | The Current Score is the product of multipying the Impact Score by the Likelihood Score - Empirical performs this calculation automatically. For Threat risks the objective is to reduce the Current Score to as low as reasonably practicable, for Opportunity risks we want to increase the Current score as much as reasonably practicable. |
| (m) | Next Review Date | This is the date when the Risk will next be reviewed. This should be at least once a term and more frequently for medium to high level risks. |
| (n) | Current Control description | Current Controls are about what is already in place to manage and mitigate the risk. The ‘Description’ field has a 4000 character limit (which includes spaces). Include sufficient information to explain the control in a way which is understandable to someone who is not from your area or discipline. Often it is not possible to reduce the impact of a risk, but the likelihood of it happening can be reduced. Or in the case of a positive risk the benefits that can be derived from the opportunity can be made more probable If you use acronyms and abbreviations please include the full phrase in the description as this helps give clarity and also assists with searches and analysis. |
| (o) | Pending Control Description | Pending Controls are about what needs to be put in place to improve the management and mitigation of the risk. The ‘Description’ field has a 4,000 character limit (which includes spaces). Include sufficient information to explain the control in a way which is understandable to someone who is not from your area or discipline. If you use acronyms and abbreviations please include the full phrase in the description as this helps give clarity and also assists with searches and analysis. Once a Pending Control is fully implemented then it's Status should be changed to 'Current Control Active'. |
| (p) | Pending Control Review Date | This is the date when the Pending Control will next be reviewed. This should be at least once a term and more frequently for medium to high level risks. |
| (q) | Notes | Use notes to provide information that will help understand, monitor and progress the risk. Include any developments to flag that there may be new or emerging risks, and consider how the risk may influence or be affected by other risks. Notes can be applied to Risks, Current Controls and Pending Controls. |
© Copyright 2012 Imperial College London