Understanding the risk profile of the organization is an essential first step in managing it. Use of data and metrics is essential for making the subject more tangible and retaining management and staff attention to the issues at large.

Traditionally, risk management had been viewed as consisting of separate and distinct elements. They have been recognized to include risk identification, assessment and/or measurement, and mitigation or control. Although the process has always been continuous, it was often viewed to require formal and orderly risk identification reviews, followed by analysis, then a focus on controls. Today, rates of change in technology and business processes have accelerated to such a point that separate analyses are too often out of date before they are even completed. Thus, the need for continuous and dynamic reviews is more evident today than ever before. Fortunately, advancements in technology, frequent reporting, and interactive systems will support a more timely response.

This principal entails the building block strategies for moving toward dynamic risk profiling and management.

Effective operational risk management begins with each employee having an understanding of the potential benefits and harm in each risk faced. This requires a process at a sufficiently detailed and specific level for identifying and evaluating new risks on a continuous basis (e.g. independent risk assessment, control self-assessment, process analysis).