Department ofFinance
ImplementingtheCommonwealth
RiskManagementPolicy–Guidance
2016
ResourceManagementGuide211
DepartmentofFinance
CommercialandGovernmentServices
978-1-925205-46-6(Print)
978-1-925205-45-9(Online)
CopyrightNotice
Content
ThisworkiscopyrightandownedbytheCommonwealthofAustralia.
WiththeexceptionoftheCommonwealthCoatofArms,thisworkislicensedunderaCreativeCommons
Attribution3.0Australialicence(CCBY3.0) (
Thisworkmustbeattributedas:“CommonwealthofAustralia,DepartmentofFinance,Commercialand
GovernmentServices,“ImplementingtheCommonwealthRiskManagementPolicy–Guidance”.
UseoftheCoatofArms
ThetermsunderwhichtheCoatofArmscanbeusedaredetailedonthefollowingwebsite:
Contactus
Inquiriesregardingthelicenceandanyuseofthisworkarewelcomeat:
CommercialandGovernmentServices
DepartmentofFinance
OneCanberraAvenue,ForrestACT2603
Email:
Contents
Introduction...... 4
PolicyElements...... 6
Elementone-Establishingariskmanagementpolicy...... 7
Elementtwo-Establishingariskmanagementframework...... 9
Elementthree-Definingresponsibilityformanagingrisk...... 12
Elementfour-Embeddingsystematicrisk
managementintobusinessprocesses...... 14
Elementfive-Developingapositiveriskculture...... 16
Elementsix-Communicatingandconsultingaboutrisk...... 19
Elementseven-Understandingandmanagingsharedrisk...... 21
Elementeight-Maintainingriskmanagementcapability...... 23
Elementnine-Reviewingandcontinuouslyimproving
themanagementofrisk...... 26
Appendix...... 30
AppendixA-Glossaryofterms...... 31
AppendixB-Examplesoftypicalriskmanagementrolesand responsibilities...... 35
Introduction
PurposeofthisGuide
ThisGuideprovidespracticaladvicetoassistCommonwealthofficialsin
implementingtherequirementsoftheCommonwealthRiskManagementPolicy.1
TheGuideisdesignedtobeusedasalearningresourceandisnotmandatory. Itisimportantthatentitiesdevelopriskmanagementframeworksandsystems thataretailoredtotheneedsoftheirorganisation.Entitiesmayelecttoadapt
theconceptscontainedinthisGuidetosuittheirspecificneedsorusealternative
methodologies.
ThemandatoryelementsoftheCommonwealthRiskManagementPolicyare repeatedinthisGuideintheboxesatthebeginningofeachelement.
Whatisriskmanagement?
Riskistheeffectofuncertaintyonobjectives.Riskisthepossibilityofaneventor activitypreventinganorganisationfromachievingitsoutcomesorobjectives.
Riskmanagementistheactivitiesandactionstakentoensurethatan organisationisconsciousoftherisksitfaces,makescoordinatedandinformed decisionsinmanagingthoserisksandidentifiespotentialopportunities.
Whatarethebenefitsofriskmanagement?
•improvedabilitytoidentify,evaluate,andmanagethreatsandopportunities
•improvedaccountabilityandbettergovernance
•bettermanagementofcomplexandsharedrisks
•improvedfinancialmanagement
•improvedorganisationalperformanceandresilience
•confidencetomakedifficultdecisions
•decreasedpotentialforunacceptableorundesirablebehaviourssuchas fraudandharassment.
1TheCommonwealthRickManagementPolicyandsection16ofthePGPAActsetoutaframeworkthat
encourageCommonwealthentitiestoengagewithrisk,demonstrateinnovativethinkingandestablishand5
maintainappropriatesystemsofriskoversightandinternalcontrol.
PolicyElements
Elementone-Establishingarisk managementpolicy
CommonwealthRiskManagementPolicy
Anentitymustestablishandmaintainanentityspecificriskmanagement
policythat:
a. definestheentity’sapproachtothemanagementofriskandhowthis approachsupportsitsstrategicplansandobjectives
b. definestheentity’sriskappetiteandrisktolerance
c.containsanoutlineofkeyaccountabilitiesandresponsibilitiesfor
managingandimplementingtheentity’sriskmanagementframework
d. isendorsedbytheentity’saccountableauthority.
Thekeyelementsofanentity’sriskmanagementpolicy
Overviewoftheapproachtoriskmanagement
Entitiesareencouragedtoincludeintheirriskmanagementpolicyastatement
ofintenttoembedriskmanagementintotheirdecisionmakingandperformance managementprocesses.Theinclusionofariskphilosophystatementorkey principlescanbeusefulinconveyingtoofficialsthetoneforriskmanagement
intheentity.
Riskappetiteandtolerance
Riskappetiteistheamountofriskanentityiswillingtoacceptorretainin ordertoachieveitsobjectives.Riskappetiteisusuallysetoutinastatementor seriesofstatementsthatdescribetheentity’sattitudetowardrisktaking.
Risktoleranceisthespecificlevelofrisktakingthatisacceptableinorder toachieveaspecificobjectiveormanageacategoryofrisk.Risktolerance representsthepracticalapplicationofriskappetiteandwillbemosteffective whenitiseasilyunderstoodbyallofficials.
Ariskappetiteandtolerancestatementprovidesofficialswithanunderstanding oftheentity’sacceptablerisklevelsforallsignificantriskcategories.Incases whereriskappetiteislow,thisstatementprovidesguidancetoofficialsonwhat decisionstheycannotmake.Wheretheentityispreparedtotakeincreased levelsofrisk,astatementreflectingthisempowersofficialstomakeacceptable risk-baseddecisions.
Risktolerancestatementsoftenincludequantitativemeasurestoenable monitoringandreview.ForexampleanentitywithalowriskappetiteforIT systemoutagesmaydefinetheirrisktoleranceasnomorethanfivedaysof systemoutagesperannum.
Whiletheinclusionofariskappetiteandtolerancestatementinarisk managementpolicycanbeusefulinsettingthetoneforrisktakingintheentity, thismaynotalwaysbepracticalduetothelevelofdetailrequired.Insuch circumstances,itmaybemorepracticaltorefertoitorlinktootherdocument/s detailingtheentity’sriskappetiteandtolerance.
Keyaccountabilitiesandresponsibilities
Whiletheaccountableauthorityisultimatelyresponsibleformaintainingsystems ofriskoversight,managementandinternalcontrol,anentity’sriskmanagement policycanbeausefulmeansofcommunicatingmorespecificriskmanagement responsibilitiestoofficials.Asidefromthoserequirementssetoutinelement
threeoftheCommonwealthRiskManagementPolicy,thinkaboutwhatadditional responsibilitiesandaccountabilitiesyouwouldliketocommunicate.
Astatementnotingthatallofficialsintheentityareresponsibleformanaging riskcanbeausefulwayofcommunicatingtostaffthatitisnotjusttherisk managementareathatisresponsibleformanagingrisk.
Accountableauthorityendorsement
Akeyroleofthepolicyistoprovideaclearandmeaningfulmandatefortheentity’s riskmanagementframework.Itiscriticalthattheaccountableauthorityunderstands andendorsesthepolicyasthissignifiestoallofficialstheexpectationthatthepolicy isanessentialpartoftheirday-to-daywork.
Awrittenstatementorpersonalmessagefromtheaccountableauthority(orsenior leadership)thatsummarisestheentity’sriskmanagementpolicycanalsoeffectively andclearlyexpresstheintentionsandrequirementsoftheorganisation.Theway
inwhichsuchmessagesaredistributedandpublicisedarealsoimportantfactorsin howsuccessfullyriskmanagementissuesarecommunicated.2 Optionscaninclude circulationthroughtheentity’sinternalnetwork,publicationssuchasnewsletters,
displaysincorridorsandliftsandmakingitavailableexternallyviatheinternet.
Practicaltips
•Undertakeregularreviewstoensuretheentity’sriskmanagement
policyandriskappetiteremainalignedwithriskprocesses.
•Linktheentity’sriskmanagementpolicytootherelementsoftherisk managementframeworksuchasmoredetailedproceduresandguidance material.
•Includeavisionarystatementintheriskmanagementpolicythatincludes whattheentityisseekingtoachievethroughgoodriskmanagementand keygoalsfortheriskmanagementprograminthefuture.
82StandardsAustralia,SA/SNZHB436:2013RiskManagementGuidelines–CompaniontoAS/NZSISO
31000:2009,p31
Elementtwo-Establishingarisk managementframework
CommonwealthRiskManagementPolicy
Anentitymustestablishariskmanagementframeworkwhichincludes:
a. theoverarchingriskmanagementpolicy
b. anoverviewoftheentity’sapproachtomanagingrisk
c.howtheentitywillreportriskstobothinternalandexternalstakeholders d. theattributesoftheriskmanagementculturethattheentityseeksto
develop,andthemechanismsemployedtoencouragethis
e. anoverviewoftheentity’sapproachtoembeddingriskmanagementinto
itsexistingbusinessprocesses
f.howtheentitycontributestomanaginganysharedorcrossjurisdictional
risks
g. theapproachformeasuringriskmanagementperformance
h. howtheriskmanagementframeworkandentityriskprofilewillbe
periodicallyreviewedandimproved.
i.Theriskmanagementframeworkmustbeendorsedbytheentity’s
accountableauthority.
Designingariskmanagementframework
Ariskmanagementframeworkisasetofcomponentsthatsupporttheconsistent andsystematicmanagementofriskinanentity.Eachentityneedstodetermine itsownriskmanagementframeworkthatisthebestfitfortheentity’spurpose, structureandsize.
Anentity’sriskmanagementframeworkismosteffectivewhenitisaligned withotherbusinessprocesses.Keyamongsttheseincludetheentity’s:
•corporateplan
•managementanddecisionmaking
•governanceandassurancearrangements
•changeandbusinessimprovementprograms
•operationalprogramplanning,management,andreportingrequirements. Whileariskmanagementframeworksetsthefoundationforriskmanagement,
itistheentity’sriskculturethatwillultimatelydeterminehoweffectiveitisin
changingthebehaviourofofficials.
Thekeyattributesofagoodriskmanagementframework
•Itisfit-for-purposeandtailoredtotheneedsoftheentity.
•Itiswellunderstood,consistentlyapplied,integratedandcentralisedacross theentity.
•Itdetailstherequiredactionsfordesigning,implementing,monitoring,and reviewingriskmanagementintheentity.
•Itisusedbyofficialsaspartoftheirday-to-daydecisionmaking.
Thereisnostandardformatorstructureforariskmanagementframework.
Thenatureoftheworkcarriedoutbyeachentitywilldeterminethedesignand sophisticationofitsriskmanagementframework.However,frameworkelements usedbymanyentitiesincludethoseillustratedbelow.
RiskManagementPolicy
Overviewof theentity’s approachtorisk management
Riskappetiteand risktolerance
Key accountabilities and responsibilities
EmbeddingRiskManagement
Management ofShared andCross
Jurisdictional
Risks
Risk Management Reporting
MeasuringRisk Management Performance
RiskReview and Evaluation
PositiveRiskCulture
Practicaltips
•Includeadocumentmapintheriskmanagementframeworktoclarify
anddifferentiatebetweenpolicy,guidanceandprocessdocuments.
Thisavoidsconfusion.
•Structuredocumentsintoalogicalhierarchy;separatedintostrategic andoperationallevelguidance.
•Providetrainingandongoingsupporttoofficialssothattheyareawareof, andunderstand,theentity’sriskmanagementframework.
•Makeiteasyforofficialstoaccesstheframeworkcontent,forexample, throughtheentity’sintranetandotherinternalnetworks.
•Reviewandupdatetheentity’sframeworkpromptlyafterrestructuresor
changesinoperatingenvironment.
•Regularlyreviewtheentity’sriskmanagementframeworktoensurethatall classesorcategoriesofrisktowhichtheentitymaybeexposedarebeing consideredandmanaged.
Elementthree-Defining
responsibilityformanagingrisk
CommonwealthRiskManagementPolicy
Withintheriskmanagementpolicy,theaccountableauthorityofanentitymust
definetheresponsibilityformanagingriskby:
a. definingwhoisresponsiblefordetermininganentity’sappetiteand
toleranceforrisk
b. allocatingresponsibilityforimplementingtheentity’sriskmanagement
framework
c.definingentityrolesandresponsibilitiesinmanagingindividualrisks.
Keyresponsibilitiesformanagingrisk
Responsibilityfordeterminingriskappetiteandtolerance
Thismayinclude:
•thepersonwhoisultimatelyresponsiblefordeterminingriskappetite andtolerance(usuallytheaccountableauthorityworkingwiththesenior executive)
•specificresponsibilitiesfordeveloping,approving,monitoringandadjusting anentity’sriskappetiteandtolerance.
Responsibilityorimplementingtheriskmanagementframework
Thismayinclude:
•design
•publication
•reviewoftheentity’sriskmanagementframework
Theseresponsibilitieswillbemosteffectivewheretheyareclearlydefined, effectivelycommunicatedandassignedtoaspecificpersonorteam
Responsibilityformanagingindividualrisks
Responsibilitiesthatmaybedefinedinclude:
•Riskowners.Accountableformanagingaparticularrisk
•Controlowners.Responsibleformaintainingtheeffectivenessofmeasures
tomodifyrisk
•Risktreatmentowners.Responsibleforimplementingstrategiesincases wheretherisklevelisunacceptableaftercontrolsareapplied
Guidancecanbeprovidedonhowtodischargetheseresponsibilitiesandhow
riskandcontrolownerscanbestinteractsothatrisksareactivelymanagedwithin agreedtolerances.
Entitiesareencouragedtoincludeastatementintheirriskmanagement frameworkthatallofficialsatalllevelsoftheentityareresponsibleformanaging risk.Theseresponsibilitiesincluderiskswithinanindividual’sareaofcontroland whole-of-entityandsharedrisks.
Examplesofsometypicalriskmanagementresponsibilitiescanbefoundat
AppendixB.
Practicaltips
•Documenttheentity’sriskprocesses,includingguidelines,sothat theaccountableauthorityandallotherseniorofficialsunderstandtheir responsibilitiesforoverseeingtheentity’sriskmanagementprocessesand keyrisks.
•Ensurethatofficialsunderstandanybusinessrisksthattheyown,how theserisksrelatetoandmayimpactontheentity’senterpriserisks,and theirrolesinmanagingrisk.
•Developclearandconsistentriskregistertemplateswhich,when completed,maketheriskmanagementresponsibilitiesofeachofficial clearandeasilyupdatedasrequired.
•Makeriskmanagementakeycompetencyandresponsibilityofallofficials.
Incorporateriskmanagementresponsibilitiesintojobdescriptions,duty
statementsandperformanceagreements.
Elementfour-Embedding systematicriskmanagementinto businessprocesses
CommonwealthRiskManagementPolicy
Eachentitymustensurethatthesystematicmanagementofriskisembedded inkeybusinessprocesses.
Opportunitiestoembedriskmanagement
Successfullyembeddingriskmanagementintoanentity’sbusinessprocessesis challengingandthoughtprovoking.Itrequiresanapproachtailoredtotheentity’s corporateobjectives,operatingenvironmentandcontext.Ausefulapproach
toembeddingriskmanagementcanbetoestablishshortandlong-termplans forembeddingriskmanagement.Thesecanthenbecommunicatedtokey stakeholders.
Embeddingriskmanagementtakestime,butthereareanumberofopportunities toachievequickwinsinthefollowingareas:
•Governance.Anentity’sgovernancefunctionhasanumberofkeyrisk
managementroles.Theseincludehelpingtointegrateriskmanagement
intostrategy,establishingriskappetitethroughtheentity’sriskmanagement policy,definingriskmanagementrolesandresponsibilities,benchmarking, andreviewinghowriskismanagedwithintheentity.
•Corporateplanning.Assessingandmanaginganentity’senterpriserisks isanintegralpartofanentity’scorporateplanningframework.Anentity’s strategicobjectivescanbethestartingpointofanyriskidentificationprocess.
•Changemanagement.Changemanagementpoliciesandinstructions
mayincludetherequirementforariskassessmentofallsignificantchange
activities.
•Projectsandprograms.Projectandprogramimplementationinvolves constantlyidentifyingandmanagingrisk,suchassharedriskincomplex projectsandriskinterdependenciesbetweenprojects.Thiscouldallow individualprojectriskstobeaggregatedtoprovideaprogramandportfolio view.
•Auditandassuranceprograms.Clearlyunderstandinganentity’srisk profileenablestheprioritisationofanentity’sauditandassuranceactivities. Theoutcomeofinternalandexternalauditactivitiesmayinfluencethedesign ofanentity’scontrolframework.
•Organisationalresilience.Increasingorganisationalresilienceallows entitiestoresistbeingaffectedbyaneventorincreasestheirabilitytoreturn toanacceptablelevelofperformanceinanacceptableperiodoftimeafteran eventhasoccurred.3
Alignmentwithspecialistriskcategories
Specialistriskcategoriesoftenhavetheirownlegislation,standards,compliance andreportingobligations.Entitiesmayalsohavespecialistprogramsand processesincluding:
•businesscontinuityanddisasterrecovery
•fraudcontrol
•workplacehealthandsafety
•protectivesecurity
Whileaspecialistprogrammayleadtoanincreasedfocusandmanagementof theserisks,specialistprogramsmaybenefitfrombeingconnectedtotheentity’s overarchingriskmanagementframeworktoensureconsistency.Thiscanbe achievedbyadoptingcommonterminologyandprocessesacrossallprograms.
Practicaltips
•Usetheentity’sriskmanagementpolicyanditsaccountableauthority instructionstolinktheriskmanagementframeworktoothercorporate frameworksandprocesses.
•Reflecttheentity’sriskappetiteandtolerancesintheentity’sinternal controlframeworkanddelegationarrangementsinareassuchasfinance, procurement,businesscontinuityandhumanresources.
•Assistbusinessunitownerstoembedriskmanagementintotheiractivities byprovidingcommonrisktoolsandtemplatesthatcanbeincorporated
intotheirdocumentsandprocesses.
•Usechangesorrestructuresintheentityasanopportunitytoembedrisk managementinbusinessprocessesorfunctions.
•Includeeasy-to-useriskmanagementtoolsandtemplatesintocorporate andbusinessplanningdocumentationandprocesses.
•Communicatequickwinsassoonastheyoccur.Highlighthowembedding riskmanagementintobusinessprocessesresultedininnovativeoutcomes orotherbenefitstotheorganisationthroughidentifyingandtreatingrisks.
3ASISSPC.1-2009AmericanNationalStandard,OrganisationalResilience:Security,Preparednessand
Elementfive-Developingapositive
riskculture
CommonwealthRiskManagementPolicy
Anentity’sriskmanagementframeworkmustsupportthedevelopmentofa positiveriskculture.
Characteristicsofapositiveriskculture
Apositiveriskcultureexistsinanentitywhenofficialsunderstandtherisksfacing theirentityandconsistentlymakeappropriaterisk-baseddecisions.Apoorrisk cultureisoftenevidencedbyofficialsbeingignorantoftheentity’srisks,being excessivelyriskaverseoroverconfident.
Apositiveriskculturegenerallyincludesthefollowingattributes:
•leaders,managersandsupervisorsconsistentlyandpositivelydemonstrate anddiscusstheimportanceofmanagingriskappropriately
•theentity’sriskmanagementframeworkisintegraltoitsoperatingmodel
•officialsarecomfortabletalkingopenlyandhonestlyaboutrisk,using
commonlyunderstoodrisktermsandlanguage
•officialsunderstandandagreetheneedandvalueofeffectiverisk
management
•officialsownandmanageriskandproactivelyseektoinvolveothersas
appropriate
•officialsownandmanagecomplexandsharedriskswithothers
•incentivesreinforceappropriaterisk-relatedbehaviour
•officialsarecomfortableraisingconcernswithauthorityfiguresandthose
beingchallengedrespondpositively
•theentityhasasupportiveenvironmentforescalatingriskissueswiththe seniorexecutive.
Whyisapositiveriskcultureimportant?
Cultureismorethanjustcomplyingwithyourentity’sriskmanagementframework. Thebehavioursandattitudestoriskarejustasimportantastheframework.
Decisionsareoftenmade,andrisksmanaged,withoutcompleteinformation,with inadequateresourcesandagainstcompetingpriorities.Inthesecircumstancesa strongriskculturewillsupportthepropermanagementofrisk.
Howtoinfluenceriskculture
Abriefdescriptionoftheinfluencersofriskculture,andsomeexamplesof
desirableanddetrimentalriskbehavioursareprovidedbelow.
RiskcompetenceThecollectiveriskmanagementcompetenceoftheentity
Desirablebehaviours / •Proactivesharingofbestpractice
•Consultingwithothersoften
Detrimentalbehaviours / •Reluctancetolearnfrompastmistakes
•Followingtheherd
Organisation’sriskenvironment
Howtheorganisationalenvironmentisstructuredandwhatisvalued
Desirablebehaviours / •Adheringtoriskmanagementpolicies,processesand procedures
•Listeningtoothers
•Involvingriskprofessionalsinimportantriskdecisions
Detrimentalbehaviours / •Reluctancetoescalaterisks
•Minimisingrisks,optimismbias
•Cuttingcorners
Motivation
Thereasonswhypeoplemanageriskthewaythattheydo
Desirablebehaviours / •Innovatingandchangingpoorpractices
•Takingpersonalaccountabilityformanagingrisks
•Admittingtomakingmistakes
Detrimentalbehaviours / •Shootingthemessenger
•Avoidingresponsibility
•Rewardingexcessiverisktaking
Relationships
Howpeopleintheentityinteractwithothers
Desirablebehaviours / •Openandhonestdialogueregardingrisks
•Constructiveresponsetochallenge
Detrimentalbehaviours / •Inadequatechallengeofexcessiverisktaking
•Yieldingtoinappropriatepressurefromothers
Indeterminingtheriskbehaviourstheywilldisplay,officialsareoftenguidedby theaccountableauthorityandtheentity’sexecutives.Keyelementsinclude:
•Rolemodels.Influentialindividualswholeadbyexample.Therisk managementbehaviourstheydisplayguideothers.Itcanbeusefultoassign accountabilityoftheentity’sriskculturetoavisibleseniorexecutivesponsor.
•Explicitmessages.Duringrecruitmentandinduction,andthroughouttheir careers,officialsareprovidedwithmanyinstructionsandguidelinesthatwill influencehowtheyviewandmanagerisk.
• Incentives.Themannerinwhichofficialsarerewardedandrecognised.
Howtheseincentivestakeintoaccountriskmanagementbehaviourswill indicatehowriskmanagementisvalued.
• Symbolsandactions.Thedailyactionsofleaderswillbenotedbyofficials
andmirrored.
Measuringriskculture
Itmaytakeyearsforanentitytodevelopandmaintainapositiveriskculture. Anentity’sriskculturecanbemonitoredandformallyassessedthroughstaff surveysorconsultations.
Practicaltips
• Identifyandprioritisekeybehaviourstoinfluenceandshapeapositive
riskculture.
•Encourageallofficialsinmanagementrolestocommunicateregularlywith
theirteamsaboutthevalueofgoodriskmanagement.
•Identifyandconnectanetworkofriskchampionsacrosstheentitythatcan encouragepositiveriskbehavioursthroughtheirrole,personalexperience orreputation.
•Rewardandrecognisepositiveriskmanagementbehaviourbothpublicly andthroughtheentity’sperformancemanagementprocesses.Positive reinforcementofsuccessfulriskmanagementapproachesandoutcomes maintainsmomentumandpromotesgoodriskmanagementpractices.
•Whereanentityacceptsanoptimallevelofrisk,thismayresultinthatrisk beingrealised.Treattheseeventsasopportunitiestoreview,learnand improvethemanagementofsimilarrisks.
•Inestablishingamorepositiveriskculture,focusonchangingattitudes andbehavioursratherthanjustimplementingnewpoliciesand procedures.
•Apositiveriskcultureisnotasingleactivity.Prioritisethekeyrisk managementbehavioursyouwishtochangeandimplementpractical measurestoinfluenceandshapethesefirst.
Elementsix-Communicatingand consultingaboutrisk
CommonwealthRiskManagementPolicy
Eachentitymustimplementarrangementstocommunicateandconsultabout
riskinatimelyandeffectivemannertobothinternalandexternalstakeholders.
Howtocommunicaterisk
Communicatingriskinformationwithstakeholdersisimportant,asitmaintains confidenceandtrustanddevelopsacommonunderstandingoftheentity’srisks. Externalstakeholderssuchasministers,othergovernmententities,suppliersand thewidercommunitymayneedanopportunitytocommunicatetheirviewsand feelinvolvedindecisionmakingwhereappropriate.
Developariskcommunicationplan
Ariskcommunicationplancanbeaneffectivewayofdocumentinganentity’s
approachtocommunicatingrisk.Whendevelopingariskcommunication plan,considerbothexternalandinternalreportingrequirements.Tominimise duplication,riskinformationprovidedincorporatereportingmaybeusedtoinform seniorexecutiveswhencompletingannualreportingtasks.
Ariskcommunicationplancanbetailoredforeachindividualentityandmay includeinformationon:
•theattitudeandapproachtomanagingrisk
•theriskprofile
•individualrisks
•specificcontrolresponsibilities.
Anentity’sriskprofileisakeytoolforinformingseniorexecutivesandstakeholders
ontheprioritiesandmanagementofriskandmaybedevelopedatacorporate levelaswellasatbusinessunitandbranchlevels.Clearcommunicationofthe entity’srisksreliesondevelopingqualityriskprofilesthatprovideacompleteview ofkeyrisks.
Buildacultureofopenriskcommunication
Allofficialsareresponsibleforcommunicatingriskandsharingriskinformation
withintheentityandwithexternalstakeholdersasappropriate.
Opencommunicationrequirestimetodevelopandreliesonofficials acknowledgingthatgoodriskcommunicationprovidesanopportunitytoinnovate andimproveperformance.
Aspartofeffectivecommunication,entitiesareencouragedtoprovideregular, candidbriefingsonkeyrisks,threatsandopportunities.Whereappropriate, significantissuescanthenbeescalatedtotheaccountableauthorityand/or minister.
Considercommunicationrequirements
Entitiesareencouragedtouseriskcommunicationtoidentify,assessandprovide
informationonthemonitoringofrisksagainstthecorporateobjectivesofthe
entity.Thismaybealignedwithotherreportingframeworks.
Whencommunicatingaboutrisk,askyourselfthefollowingquestions:
•Whatneedstobecommunicated?
•Whoneedstoknow?
•Whatisthetimeframe?
•Willterminologybeanissue?
•Whatisthemostacceptableformatwhenpresentinginformation?
•Whatanalysishasbeenperformedtoproviderobustnesstothedata?
•Whatfollow-upactionisneeded?
Riskcommunicationiscriticaltoensurethattheentity’sriskmanagement processesareconsistentlyimplemented atalllevels.Operationalriskreporting toseniorexecutivesismosteffectivewhenitoccursatregularintervals throughouttheyear.
Practicaltips
• Tailorthestructureandcontentofriskreportsfortheaudience,the natureoftherisksbeingreportedandthecircumstances.
•Developtemplatesforriskassessmentsthatcaptureenoughinformation tosupporttheriskassessmentprocess.
•Workwithkeystakeholderstoshareriskprocessesandterminologyand standardisetheseasmuchaspossible.
•Beflexibleinadoptingstrategiestocommunicateriskinformationto officials.
•Examplesincludeinternalentitynews,policyawarenessprograms, internalriskforumsandnewsletters,ariskmanagementintranet
page,questionnairesandsurveys,participationinwebinars,facilitated workshops,focusgroups,externalworkinggroupsandforums.4
•‘Dashboards’whichhighlightareasofconcernoropportunitycanquickly andeffectivelyconveyinformationtoseniorexecutivestoenablethemto focusonkeyissues.
4AS/NZSHandbook327-2010,CommunicatingandConsultingaboutRisk,providesfurtherinformation aboutmattersthatneedtobeconsideredwhenplanningcommunicationandconsultation.
Elementseven-Understanding andmanagingsharedrisk
CommonwealthRiskManagementPolicy
Eachentitymustimplementarrangementstounderstandandcontributetothe managementofsharedrisks.
Characteristicsofsharedrisk
Sharedrisksarethoserisksthatextendbeyondasingleentity,requiringhigh levelsofcooperationbetweenstakeholderstoeffectivelyunderstandandmanage thoserisks.Stakeholdersoftengobeyondgovernmenttoincludeotherpartners, suchasindustry,thewidercommunityandacrossjurisdictions.
Sharedriskisacrucialelementofprogram/policydeliveryandfailingtoidentify andmanagetheserisksoftenimpactsabroadrangeofstakeholders.
Itisthereforeimportantthatentities,incollaborationwiththeirstakeholders, cooperatetoidentifyandmanagerisks,developclearrolesandresponsibilities formanagingtheserisksandagreetooutcomes.
Aspectstoconsiderinmanagingsharedrisk
Visibilityoftherisk.Proactiveandcomprehensiveinformationexchangeis essentialtofullyidentifythenatureandseverityofrisks,monitortheirstatusand managethepotentialrealisationofrisks.
Controlsandtreatments.Responsibilityforimplementingandmanaging specificcontrolsandtreatmentprogramsmaybeallocatedordispersedacross separateentities.Thisinvolvescollaborativeapproachestodesigning,deploying, monitoringandreportingtheeffectivenessofcontrolsandtreatments.
Exposuretoconsequencesandeffects.Whenariskisrealised,asharedrisk mayimpactanumberofentitiesandthewidercommunity.Wherepracticable, entitiesareencouragedtoestablishmechanismstoappropriatelysharethe burdenoftheriskexposure.Thiscanbeachievedthroughpooledorcollaborative responsecapabilities,definingfinancialexposuresexplicitlyingovernance arrangements,orthroughagreeingintegratedtreatmentplans.
Documentingthemanagementofsharedrisks
Documentingsharedrisksisgoodgovernance,improvesunderstandingof complexrelationshipsandclarifiestheextentofknowledgeofsharedrisksata pointintime.
Whendefininghowanentitymanagessharedrisk,guidancetoofficials
mayinclude:
•ameaningfuldefinitionofsharedriskintheentity’sriskmanagementpolicy theconceptofsharedrisk,andthearrangementsformanagingit,intoproject orprogrammanagementframeworksandprocesses
•examplesofsharedrisksthatarerelevanttotheentity
•alistofthoseintheentitylikelytoberesponsibleformanagingsharedrisk
•protocolsforestablishingmechanismstocollaborativelymanagesharedrisks
•anidentificationofthemechanismsandprotocolstobeusedforrecording, monitoringandreportingonmanagingsharedrisk,bothinternallyand externally.
Collaborativeresilience
CommonsharedriskswithintheCommonwealthincluderiskswhichthreaten thesafetyandsecurityofentitiesandtheservicestheyprovide.Thesemay includenaturaldisasters,actsofterrorism,andinfrastructureormarketfailures. SignificantopportunitiesexistforCommonwealthentitiestocollaborateinorder toenhancetheirindividualandcollectiveresiliencetosuchrisks.
Entitiesareencouragedtoworkwithstakeholderstobetterunderstand commonthreats,sharedvulnerabilitiesandtooptimisetheircollectiveability
toprevent,manageandrecoverfromdisruptiveevents.Communitiesofpractice, peerentitiesorthoseincloseproximitytooneanothercanbeformedto
encouragethis.
Practicaltips
• Establishmemorandaofunderstandingwithpartnerstoformalisean agreedunderstandingofresponsibilitiesandexpectationsformanaging sharedrisk.
•Developsharedriskregistersandprofileswithkeypartnersandhold regularcollaborativeriskassessmentworkshopswithrepresentativesof thesepartnerstoencourageparticipantstolookbeyondtheirownentity’s viewoftherisk.
•Educateofficialsontheirresponsibilitytoidentifyandcontributeto
managingsharedrisks.
•Theentity’sriskregisterandriskprofiletemplatescanbeenhancedby documentingthecontrolsandcontrolownersformonitoringsharedrisk. Forexample,ensurethatriskcontrolsmanagedfromoutsidetheentityare notedandmonitored.
•Ensuresharedrisksarelinkedtogovernancearrangementssuchas
interdepartmentalcommitteesorestablishedjointarrangements.
•Provideguidancetoofficialsonopportunitiestoconsidersharedriskas
partofcontractualarrangementsortheadministrationofgrants.
Elementeight-Maintainingrisk managementcapability
CommonwealthRiskManagementPolicy
Eachentitymustmaintainanappropriatelevelofcapabilitytobothimplement
theentity’sriskmanagementframeworkandmanageitsrisks.
Determiningtheappropriatelevelofriskmanagement capability
Whendetermininganappropriatelevelofriskmanagementcapability,consider theseverityoftherisksbeingmanagedandtheimportanceorprofileofthe objectivestheymayaffect.Thelevelofriskmanagementcapabilityinanentity maybemeasuredagainstthepotentialcostoftherisks,shouldtheyberealised, andtheentity’sriskappetiteandtoleranceforthoserisks.
Maintaininganappropriatelevelofriskmanagementcapabilitydoesnot necessarilymeanowningitexclusivelyinanentity.ManyCommonwealthentities facecommonriskchallengesandcanthereforesharethespecialistcapabilities neededtomanagethem.Forexample,thespecialistexpertiserequiredto analyseparticularnaturesofriskcanbesharedbypeerentitiesascanthe lessonslearned.
Capabilitiesthatcanhelpanentitymanagerisk
Risksystemsandtools
Theriskmanagementframeworksandriskprofilesofentitieswillvarygreatlyin complexityandscale.Riskprocessesandtoolscanbetailoredaccordinglyand mayrangeincomplexityfromsimplespreadsheetstodedicatedenterpriserisk managementsoftware.
Someofthefunctionsprovidedbyrisksystemsandtoolsinclude:
•integratedstorageofriskinformationandriskprofiles
•analysisofriskinformation,includinganalyticssuchas‘causalfactor’
analysisandkeyriskindicatormonitoring
•riskinformationdisseminationandsharing,includingriskstatusreportsand riskandcompliancedashboards
•automationofriskprocessesworkflows.
Risksystemsandtoolswillbemosteffectivewhentheyareappropriatetothe entity’sneeds,wellmaintainedandcomplementedbytrainingandworkplace support.Iftheyareoverlycomplextheywillbeunderutilised.Iftheyare inadequate,theywillnotprovidethefunctionalitydesiredorsupportefficient workprocesses.
Peoplecapability
Buildingthecapabilityofanentity’sofficialsiscriticalasitensuresaconsistent approachtomanagingriskacrosstheentity.Equippingofficialstoeffectively manageriskmayinclude:
•clearlydefinedriskresponsibilitiesandaccountabilities
•riskcompetencyacquiredthroughlearninganddevelopment,mentoringand experience
•accesstorelevantcommunicationsandinformationaccess
•peersupportandcollaborationmechanisms
•riskmanagementaspartofthestaffinductionprogram
•ongoingriskmanagementtraining
•recognitionandreward
•riskmanagementbeingintegratedintoofficials’performanceagreements.
Learninganddevelopmentopportunitieswillbemosteffectivewheretheyare tailoredtothecurrentcompetencylevelofofficialsandtheriskmanagement requirementsoftheirrole.Theappropriatelevelofriskcompetenceamong officialswillvarysignificantlybetweendifferentrolesandlevels.
Toidentifytheentity’sriskmanagementtrainingneeds,entitiescan:
1. determineandcompiletheriskmanagementcompetencyrequirementsof theirworkforce
2. undertakeaskillsanalysistodeterminetheircurrentlevelofcapability.
Comparingthesewillprovideaclearunderstandingofcompetencyneedsin ordertodevelopaprioritisedlearninganddevelopmentprogram.
Managingriskinformation
Thequalityandavailabilityofinformationonriskneedstobeaccurateandreadily availabletoensurethatrisksaresuccessfullyassessed,monitoredandtreated acrosstheentity.Accesstoreliableriskinformationallowsrisktobemeasured andcommunicatedtobothinternalandexternalstakeholders.
Riskinformationwillbemostreliablewhereitis:
•basedonestablisheddatasetsorbenchmarks
•consistentacrosstheorganisation
•unambiguousandprovidesabalancedviewoftherisk
•sufficientlyenduringtoallowcomparisonofrisksovertime
•generatedandprocessedefficiently.
Buildingeffectiveriskmanagementprocesses
Anentity’sriskmanager,orriskmanagementteam,cansupportthedevelopment
ofgoodriskprocessesthrough:
•developingafit-for-purposeriskmanagementpolicyandprocessesin
theentity
•supportingseniorexecutivesbycoordinating,compilingandpresentingclear andconciseriskinformationabletobeusedinplanninganddecisionmaking
•ensuringthereareeasilyaccessiblesystemsandprocessesinplaceto
enableallofficialstosystematicallymanageriskintheirday-to-daywork
•supportingbusinessunitstoimplementtheriskmanagementprocess
•ensuringriskmanagementprocessesareappliedconsistentlyacross theentity
•developingandimplementinganappropriateriskcommunicationstrategy
•identifyingtheneedsforskillsdevelopmentandspecifictraininginrisk
managementacrosstheentity
•developingandmaintainingariskreportingframeworktoenable
regularreportingofkeyrisks,andthemanagementofthoserisks,tosenior management.
Practicaltips
•Thinkholisticallyaboutthecapabilitiestheentityneedstoeffectively manageriskincludingpeople,processes,systems,andinformation. Conductacapabilityneedsanalysistodetermineandprioritiserisk managementcapabilitygaps.
•Provideappropriateriskandriskmanagementawarenesstrainingto officialsbothinitiallyandonaregularbasisasarefresher.Includean overviewoftheentity’sriskmanagementframeworkintheinduction programandhighlightthecapabilitiesofficialscandrawontohelpthem managerisk.
•Identify,trainandconnectriskchampionsdrawnfromdiversepartsofthe entity.Thesechampionscanhelpspreadriskmanagementgoodpractice andinfluencebehaviours.
•Identifyopportunitiestodevelopskillsthroughmoreinformallearning methodssuchasregularlunchtimediscussionsessionsoropportunitiesfor peopletolearnthroughpracticalexperience.
•Whenconsideringtheacquisitionordevelopmentofrisktoolsorsystems,
ensuretheentityidentifiesafit-for-purposesolution.
•Sharecasestudiesandlessonslearntbasedonpreviousexperiencesin theentitywhereverpossible.
Elementnine-Reviewing andcontinuously improvingthemanagementofrisk
CommonwealthRiskManagementPolicy
Eachentitymustreviewitsrisks,itsriskmanagementframeworkandthe applicationofitsriskmanagementpracticesonaregularbasis,and implementimprovementsarisingoutofsuchreviews.
Reviewingthemanagementofrisk
Asanentity’senvironment,objectivesandcapabilitieschangeovertime,
sodoitsrisks,itsriskappetiteanditsexposuretoexistingrisks.Toensurenew risksareidentified,andexistingrisksremainappropriatelymanaged,entities needtocontinuouslyreviewtheirriskmanagementframeworkandtherisks beingmanaged.
Effectiveriskmanagementprogramsrequireregularreviewandevaluation mechanisms,bothformalandinformal.Thisguideswhethertheentity’s approachtoriskmanagementisconsistentwithitsobjectives,ensuresthat theriskmanagementframeworkiscontinuouslyimprovedandthatgoodrisk managementpracticeisrecognisedandrewarded.Thesemechanismsalso
provideassurancetotheaccountableauthorityontheefficiency,effectiveness andrelevanceoftheentity’sapproachtoriskmanagement.
Toassesstheperformanceofanentity’sriskmanagementframework,threekey
aspectscanbeconsidered:
•Valueadd.Thedegreetowhichriskmanagementiscontributingtothe achievementoftheentity’sobjectivesanditseffectivenessinidentifyingand managingrisk.
•Maturity.Whethertheriskmanagementframeworkisfitforpurposeforthe
entityandrepresentstheappropriateapplicationofbetterpractice.
•Compliance.Theextentandtheconsistencyoftheapplicationoftherisk managementframeworkinpracticeacrosstheentity.
Reviewinganentity’sapproachtomanagingrisk,andtheperformanceofitsrisk
managementframework,hasfourkeysteps:
1. reviewtheentity’sriskmanagementframework
2. reviewcompliancewithandtheapplicationoftheframework
3. reviewtheentity’sriskprofile
4. reviewindividualrisksandthecontrolsthatareinplacetomanagethem.
Howtoreviewtheriskmanagementprogram
Ongoingreviewandevaluationofanentity’sriskmanagementframework,
programandpracticeoccursatthreelevels.
Regularcheckingand
1monitoring
Management
2review
3
Independent
review
Levelone–Regularcheckingandmonitoring
Thefirstlineofresponsibilityformanagingriskistheday-to-daydecisionsof officialsinallrolesandatalllevels.Accordingly,thisiswherethefirstlineof reviewalsolies.Individualswillchoosetoacceptorrejectrisksonagivenday foravarietyofreasons–someappropriateandinformed,andsomenot.
Aprocessofongoingdiscussionaboutrisk,andworkgroupandpeermoderation isimportanttoensureaconsistentapproach.
Relevantissuesforconsiderationincludetheaccuracyandeffectivenessofthe riskregister,whethertheconsequencesandimpactlevelsofindividualrisksare stillrelevantandtheeffectivenessofcontrolsandtreatments.
Leveltwo–Managementreview
ReinforcingtheLevelOnereview,managementreviewofbothriskassessment andcontrolsformsthenextlevelofreview.Managementreviewofthese decisions,behavioursandactionsfulfilstworolessimultaneously:
•monitoring,correctingerrorsormisjudgments
•buildingriskmanagementcapability,competenceandconfidence.
Tofulfilthisroleeffectively,managersareencouragedtounderstandthecontext, objectivesandbusinessoftheentity,itsriskmanagementframework,anditsrisk appetiteandtolerances.
Thesereviewswillbemosteffectivewhentheyareregularandseenasroutine,
andundertakenonaprogramedbasis.Reviewsmaybeplannedtotarget highriskprocesses,butalsosamplebroadlyacrosstheentityanditsservice providers.Whereissuesareidentified,determineiftheyarespecifictoan individualriskorriskdecisionmaker,orsystemicintheentity.
Oncedetermined,theissueisaddressedwithfindingsandcorrective
actionsdocumented.
Levelthree–Independentreview
Independentreviews,suchasaudits,canprovidealevelofassurancethata comprehensiveriskmanagementframeworkandprocessisinplaceand implementedeffectively.6
Independentreviewalsobringsafreshperspective,andcanidentifywherean entity’sframeworklacksalignmentwithitsorganisationalobjectives,opportunities forimprovementinprocesses,andinstancesofnon-compliance.
Independentreviewscanbeusefulinidentifyingopportunitiestoenhance consistencyacrosstheentityincludingmoreeffectivewaysofmanagingsimilar risks,orcategoriesofrisk,fromanentity-wideperspective.
6AdviceonthescopeandplanningofauditsandotherformsofassuranceisgivenintheHB158-2010
28DeliveringAssuranceBasedonISO31000:2009,RiskManagementPrinciplesandGuidelines.
Practicaltips
• Establisharigorousprocessof‘nearmiss’orincidentreporting,analysis andreview. Thisallowsanentitytosharelessonslearntdealingwithissues, crises,problemsandsuccesses.
•Reviewtheentity’sapproachtomanagingriskanditsriskmanagement frameworkatregularintervals.Entitiesareencouragedtoconducta comprehensiveannualreviewasasensiblebenchmark.
•Ensurethattheseniorexecutivescheduletimetodiscussanddebate theentity’sriskprofile.Thismayincludetherollingreviewofindividual risksindetail,acompletereviewoftheentityriskprofile,andoccasional
opportunitiestoconsidertheentity’srisksfromafresh‘cleansheetofpaper’
perspective.
•Constantlymonitortheongoingeffectivenessofcontrols.Develop performancemeasuresforeachsignificantcontroltosupportconsistentand reliablemonitoringandreporting.
•Includeriskissuesintheentity’sannualauditplan,commissioning
independentreviews,orthroughpeerreviewprogramswithotherentities.
•Alignthereviewandoversightofriskmanagementwithsimilarbusiness processesandgovernancearrangements.Inparticular,reviewtherelevance oftheriskmanagementframeworkeachtimetheentity’scorporateplanning processesarerevised.
•Considerarangeofinformationsourceswhenreviewingtheentity’srisks andtheeffectivenessofitsriskmanagementframework.Thesecaninclude insurancedata,benchmarkingdata,internalauditoutcomes,internal reviews,financialperformancedata,losseventinformationoranecdotal feedback.
•Benchmarktheentity’sriskmanagementperformanceagainstitspeersand
meetregularlywithcounterpartsinotherentitiestoexchangegoodpractice.
•Ensurethatriskmanagementactivitiesaretraceable.Intherisk managementreviewprocess,recordsprovidethefoundationfor improvementsinmethodsandtools,aswellastheoverallprocess.7
7SA/NZSHB436:2013RiskManagementGuidelines–CompaniontoAS/NZSISO31000:2009,p87.
AppendixA-Glossaryofterms
TermDefinitionAccountableauthority / Thepersonorgroupofpersonswhohasresponsibilityfor,andcontrol
over,aCommonwealthentity’soperations.
Seealso:
Finance’sglossary of resource management terms
Auditandrisk committee / Anindependentcommitteethatprovidesassuranceandadviceon theentity’soperationsincludingtheeffectivenessoftheentity’srisk managementframework.Commonwealthentitiesmayhaveaseparate auditandriskcommittee.
Australian/New ZealandRisk Management Standard(AS/NZS ISO31000) / AS/NZSISO31000hasbeendevelopedasagenericandflexible standardthatisnotspecifictoanygovernmentorindustrysector. TheStandardidentifieselementsorstepsintheriskmanagement
processthatcanbeappliedtoawiderangeofactivitiesatanystageof implementation.ItreplacedAS/NZS4360on6November2009.
Commonwealthentity / ACommonwealthentityisa:
a.DepartmentofState;or
b.ParliamentaryDepartment;or c.listedentity;or
d.bodycorporateestablishedbyalawoftheCommonwealth
Seealso:
Finance’sglossary of resource management terms
Consequence / Outcomeorimpactofaneventthatmaybeexpressedqualitatively
orquantitatively.Therecanbemorethanoneconsequencefromone event.Consequencecanbepositiveornegative.Consequencesare consideredinrelationtotheachievementofobjectives.
Control / Ameasuretomodifyrisk.Controlsaretheresultofrisktreatment. Controlsincludeanypolicy,process,device,practiceorotheractions designedtomodifyrisk.
Corporate
Commonwealthentity / ACommonwealthentitythatisabodycorporateandlegallyseparate fromtheCommonwealth.
Seealso:
Finance’sglossary of resource management terms
Enterprise-widerisk management(ERM) / Alsoknownasentity-wideorintegratedriskmanagement.An integratedapproachtoassessingandaddressingallrisksthatthreaten achievementoftheentity’sstrategicobjectives.ThepurposeofERMis tounderstand,prioritise,anddevelopactionplanstomaximisebenefits andmitigatetoprisks.
TermDefinition
Entityrisk managementpolicy / Adocumentcontainingtheoverallintentionsanddirectionofan entityrelatedtoriskmanagement.
Event / Theoccurrenceorchangeofaparticularsetofcircumstances. Theeventcanbecertainoruncertain.Theeventcanbea singleoccurrenceoraseriesofoccurrences.
Exposure / Extenttowhichanentityissubjecttoanevent.
Externalcontext / Externalenvironmentinwhichtheentityseekstoachieveits objectives.Externalcontextcaninclude:cultural,political, legal,regulatory,financial,technological,economic,natural andcommercialenvironmentwhetherinternational,national, regionalorlocal,aswellastheperceptionofexternal stakeholdersandkeydriversandtrendshavinganimpacton theobjectivesoftheentity.
Hazard / Asourceofpotentialharmorasituationwithapotentialto causeloss.
Internalaudit / Independent,objectiveassuranceandconsultingactivity designedtoaddvalueandimproveanentity’soperationsand accomplishitsobjectivesbybringingasystematic,disciplined approachtoevaluateandimprovetheeffectivenessofrisk management,control,andgovernanceprocesses.
Internalcontext / Internalenvironmentinwhichtheentityseekstoachieveits objectives.Internalcontextcaninclude:capabilitiesunderstood intermsofknowledge;informationsystems,decision
makingprocesses;policies;perceptions,valuesandculture;
governancestructures.
Internalcontrol / Anyprocess,policy,device,practiceorotheractionswithin
theinternalenvironmentofanorganisationwhichmodifiesthe
likelihoodorconsequencesofarisk.
KeyRiskIndicators
(KRI) / Measuresandmetricsthatrelatetoaspecificriskand demonstrateachangeinthelikelihoodorconsequenceofthe riskoccurring.
Non-corporate
Commonwealthentity / ACommonwealthentitythatisnotabodycorporateandis legallypartoftheCommonwealth.
Seealso:
Finance’sglossary of resource management terms
Resilience / Adaptivecapacityofanentitytoresistbeingaffectedbya
riskevent.
TermDefinition
Risk / Theeffectofuncertaintyonobjectives.Aneffectisadeviation fromtheexpected—positiveand/ornegative.Riskisoften expressedintermsofacombinationoftheconsequencesofan event(includingchangesincircumstancesorknowledge)and theassociatedlikelihoodofoccurrence.
Riskacceptance / Theinformeddecisiontotakeaparticularrisk.Riskacceptance canoccurwithoutrisktreatmentorduringtheprocessofrisk treatment.Risksacceptedaresubjecttomonitoringandreview.
Riskaggregation / Theconsiderationofrisksincombination.
Riskanalysis / Theprocesstocomprehendthenatureofriskandtodetermine thelevelofrisk.
Riskanalysisprovidesthebasisforriskevaluationand decisionsaboutrisktreatment.
Riskappetite / Theamountofriskanentityiswillingtoacceptorretainin ordertoachieveitsobjectives.Itisastatementorseriesof statementsthatdescribestheentity’sattitudetowardrisk taking.
Riskassessment / Theprocessofriskidentification,riskanalysisandrisk
evaluation.
Riskcapacity / Theamountandtypeofriskanorganisationisabletosupport
inpursuitofitsobjectives.
Riskevaluation / Theprocessofcomparingthelevelofriskagainstriskcriteria. Riskevaluationassistsindecisionsaboutrisktreatment.
Riskevent / Ariskeventoccurswhentheconditionsfortheexistenceofthe riskcometogetherwithatriggeringactionwhichleadstothe creationofanevent(canbeeitherapositiveornegativeevent). Riskeventsleadtomeasurableeffectswhichmayleadtoother effectsandeventuallyleadtoanundesirableconsequence.
Riskidentification / Theprocessoffinding,recognisinganddescribingrisks.
Riskidentificationinvolvestheidentificationofrisksources,risk
events,theircausesandtheirpotentialconsequences.
Riskidentificationcaninvolvehistoricaldata,theoretical analysis,informedandexpertopinionsandstakeholder’s needs.
Riskmanagement / Coordinatedactivitiestodirectandcontrolanorganisationwith regardtorisk.
TermDefinition
Riskmanagement framework / Asetofcomponentsthatprovidethefoundationsand organisationalarrangementsfordesigning,implementing, monitoring,reviewingandcontinuallyimprovingrisk managementthroughouttheorganisation.
Riskmanagement plan / Adocumentwithintheriskmanagementframeworkspecifying theapproach,themanagementcomponentsandresourcesto beappliedtothemanagementofrisk.
Managementcomponentstypicallyinclude:procedures, practices,assignmentofresponsibilitiesandsequenceof activities.
Riskmanagement process / Thesystematicapplicationofmanagementpolicies, proceduresandpracticestothetasksofcommunicating, establishingthecontext,identifying,analysing,evaluation, treating,monitoringandreviewingrisk.
Riskoversight / Thesupervisionoftheriskmanagementframeworkandrisk managementprocess.
Riskowner / Apersonwiththeaccountabilityandauthoritytomanagearisk andanyassociatedrisktreatments.Sometimesreferredtoas
aRiskSteward.
Riskprofile / Adescriptionofanysetofrisks.Thesetofriskscancontain thosethatrelatetothewholeorganisation,partofthe organisationorasotherwisedefined.
Riskreporting / Aformofcommunicationintendedtoaddressparticularinternal orexternalstakeholderstoprovideinformationregardingthe currentstateofriskanditsmanagement.
Risktolerance / Thelevelsofrisktakingthatareacceptableinorderto
achieveaspecificobjectiveormanageacategoryofrisk.Risk tolerancedefinesthelimits(quantifiablewherepracticable)that supporttheentity’sriskappetite.
Sharedrisk / Ariskwheremorethanoneentityisexposedtoorcan
significantlyinfluencetherisk.
Treatment / Atreatmentisaproposedcontrol,yettobeimplemented.The termcanalsobeusedtorefertotheprocessofselectionand implementationofmeasurestomodifyrisk.
AppendixB-Examplesoftypical riskmanagementrolesand responsibilities
Thetablebelowidentifiessomecommonaccountabilitiesandresponsibilitiesfor
managingriskinanentity.Theseareexamplesandmaynotapplytoallentities.
GroupTypicalriskmanagementresponsibilitiesAccountable authority / •Determineandarticulatetheentity’sriskappetiteand
tolerance.
•Establishandmaintainanappropriatesystemofinternal controlsfortheentity.
•Championtheentity’sriskmanagementframework,ensuring itisappropriate,implementedandcontinuouslyevolvingto reflectthechangingenvironment.
•Approvetheentity’senterpriseriskprofile.
•Endorsetheapproachtomanagingsignificantandcriticalrisk
areas.
•Discusstheentity’skeyriskswiththeresponsibleminister.
•Understandtheimpactoftheentity’sevolvingriskprofileonits abilitytoachieveitsobjectives.
Executive management committees / •Reviewrecommendationsfromtheentity’sauditandrisk committee(s)andotherassuranceandreviewactivitiesand implementimprovementsasrequired.
•Supporttheaccountableauthorityindeterminingtheentity’s
riskappetiteandtolerance.
•Reviewtheperformanceoftheriskmanagementframework.
•Understandandchampiontheentity’sriskmanagement framework,ensuringitisappropriateandcontinuallyevolving toreflectthechangingenvironment.
•Reviewandmaintainoversightoftheentity’senterpriserisk profile.
GroupTypicalriskmanagementresponsibilities
Auditandrisk committees / •Provideindependentassuranceoftheeffectivenessofthe entity’sriskmanagementframework.
•Monitortheimplementationoftheriskmanagementprogram againsttheendorsedimplementationstrategyorplan.
•Reviewanentity’sinternalcontrolstructuresandadvise whetherkeycontrolsareappropriateandareoperating effectively.
•Reviewcompliancewithanentity’sriskmanagementpolicy
andprograms.
•Provideadvicetotheaccountableauthoritytoassistthemin meetingtheirexternalaccountabilityobligations,including statutoryandfiduciaryduties.
•Reviewthecontentofreportsofinternalandexternalaudits
toidentifymaterialthatisrelevanttotheentity,andadvisethe accountableauthorityaboutgoodpractices.
•Monitorandunderstandthepotentialimplicationsofemerging risksontheentity’sriskprofileanditsabilitytoachieveits objectives.
Seniorexecutives / •Modelgoodriskmanagementbehaviours.
•Contributetothedevelopmentoftheentity’senterpriserisk profile.
•Reviewbusinessunitriskprofiles.
•Reviewandassessthecurrentandplannedapproachto
managingsignificantandcriticalriskareas.
•Ensuretheriskmanagementframeworkisimplementedin individualbusinessunits/branches.
•Supportofficialswhoengagewithriskinanappropriateand
informedmanner,regardlessoftheoutcome.
•Contributetothedevelopmentoftheentity’sriskprofileand understandtheeffectofemergingrisksontheentity’sabilityto achieveitsobjectives.
Managersand supervisors / •Identify,reviewandmanagetherisksandriskprofilesfortheir
businessunits.
•Identifyandmonitoremergingrisksandunderstandtheimpact
theymayhaveontheriskprofileoftheirbusinessunit.
•Ensureofficialsareawareoftheentity’sriskmanagement
frameworkintheirdecisionmaking.
•Recogniseriskmanagementbehaviours(positiveornegative)
withintheirteams.
•Communicateriskinformationwithbothinternalandexternal stakeholders.
GroupTypicalriskmanagementresponsibilities
Riskmanager/
adviser/team / •Coordinatetheimplementationoftheriskmanagement framework.
•Promoteconsistentandaccurateriskmanagementpractice
througheffectiveriskmanagementplanning.
•Facilitate,challengeanddriveriskmanagementcapability withintheentity.
•Reporttotheseniormanagementgroup,executive managementteamandauditcommitteeorboardatregular intervals.
Riskowners / •Maintainresponsibilityformonitoringaspecificrisk.
•Understandtheriskstheyarechargedwithandbesufficiently seniortoinfluencetheirmanagement.
•Understandandinterprettheentity’sriskappetiteand
toleranceasitappliestotheirrisks.
•Recordanddocumenttheriskinappropriateriskregisters.
•Activelymonitortheriskcontexttounderstandandrespondto anychanges.
•Challengetheeffectivenessofcontrols.
•Communicateandreportontheriskatregularintervals.
Riskchampions / •Officialswholeadtheircolleaguesbymodellinggoodrisk
behaviours.
•Leadriskactivities,initiativesandassessmentsandencourage
effectiveriskmanagementintheirarea.
•Networkwithotherriskchampionstosharegoodpracticeand buildskillsandcapability.
Controlowners / •Responsibleformaintainingcontrolsandcontributingto treatmentprograms.
•Activelymonitorthecontinuedviability,relevanceand
effectivenessofthecontrolortreatmentprogram.
•Informtherelevantriskownerwhentheeffectivenessofthe
controlortreatmentisatrisk.
Allofficials / •Recognise,communicateandrespondtoexpected,emerging orchangingrisks.
•Contributetotheprocessofdevelopingriskprofilesfortheir
branch/businessunit.