Integrated Risk Management - Queen's University

1 Integrated Risk Management Andrew Graham Implementation Guide 1 Integrated Risk Management : Implementation Guide Andrew Graham Website: ~grahama/ E-Mail: Andrew Graham researches, teaches and writes public sector Management , financial Management , Integrated risk Management and governance. He teaches at Queens University School of Policy Studies as well as its Industrial Relations Centre and the Canadian Police College. He is a research associate of The Conference Board of Canada, having completed a variety of studies on strategic planning, financial and human resource Management and risk Management He has recently published the first textbook on managing public money, entitled, Canadian Public Sector Financial Management , available through McGill-Queens press at Mr.

2 Graham teaches in both the graduate and professional development programs at Queens and elsewhere. He also has writes extensively, now writing a regular column on Management issues, Briefly Noted for the Public Management , a periodical of the Institute of Public Administration of Canada. Mr. Graham has focused much of his academic work, combined with his considerable experience in complex organizational Management , in risk Management . He has participated in several studies on implementing risk Management in business and government for the Conference Board of Canada. He regularly teaches risk Management workshops at the Canadian Police College and the Industrial Relations Centre, Queens University . He presents to conferences on a regular basis on risk as well as the governance of risk.

3 An Assistant Deputy Minister for 14 years in the federal government with over 30 years of service, he has experience in line operations (Warden of Kingston Penitentiary), leading a complex regional operations, and a number of policy and corporate leadership roles, including Senior Deputy Commission of the Correctional Service of Canada. He has extensive corporate Management experience, including having served as the ADM, Corporate Services of Agriculture and Agri-Food Canada. 2 Integrated Risk Management : Implementation Guide 3 Integrated Risk Management : Implementation Guide Table of Contents 1. Using this Guide Who this Guide is For What the Guide Does No One Size Fits All You Set the Pace Risk is Not Scary: It is Essential Organization of the Guide 2.

4 The Business Case Why IRM? What This Section Does External Drivers for Implementing IRM A Brief History of Risk Why Risk Management ? Defining Risk and Risk Management Why Manage risks ? Are You Risk Fit? How To Convince Your Organization to IRM on Board Some Winning Strategies 3. How an IRM Systems Works What this Section Does A Systematic Approach to Risk Management The Risk Management Model Linking Risk Management and Business Operations and Planning Identifying the risks Informs How You Will use Risk Listening to the Silence: A Special Challenge Ignoring Your Shop Floor at Your Peril Risk In Bundles: Categories of Risk Characteristics of Integration 4. Implementation What This Section Does The Questions to Ask and Answer The Key Decisions Guiding the Implementation of IRM To Pilot or not to Pilot A Phased Approach The Steps in Implementation Take a Sound Time Perspective 4 Integrated Risk Management : Implementation Guide Creating a Risk Management Policy The Role of Leadership Assigning Responsibilities Sample Implementation Plan Idea Marketplace.

5 Some Leading and Learning Practices in Implementing IRM o Focus on Culture o Risk Championship o Risk Tolerances o Communications o Teams and Committees o Develop and Use a Common Language Set o Establishing a Corporate Risk Management Function o Communicating Risk Management Performance o Guidance o Training o Tools and Techniques for Putting Risk Management into Practice Appendix: Sample Integrated Risk Management Policies 5. Using Risk Tools What This Section Does Certain Maxims About Process Risk Assessment Making Risk Assessment Real Risk Ranking and Evaluation Risk Tolerances and Risk Appetite o What is Risk Tolerance? o How Do You Establish Risk Tolerances? o Creating a common Grid o Using Key Organizational Objectives o Use What You Already Have o Seek Out Industry Standards o Trial and Error Risk Evaluation Formats Analysis and Evaluation o Setting Priorities: Risk Maps and Decision-Making Risk Registers and Summary Reports Risk Reports A Closing Comment about Forms 6.

6 Managing the risks : An Overview of Strategies What This Section Does General Approaches o Low Impact/Low Probability o High Impact/High Probability 5 Integrated Risk Management : Implementation Guide o High Impact/Low Probability o Low Impact/High Probability Risk Mitigation Strategies Tolerating Risk of Self-Insurance Prevention Reduction Control Transfer Prepare Risk Management and Good Governance 7. Risk Communications and Reputation Protection What This Section Does The Risk Communications Conundrum Building Credible Risk Communications Risk Communications Failures Determinants of Reputation Risk Managing Reputation Risk o Assess o Evaluate o Close Gaps o Monitor o Find an Organizational Locus Planning Your Communications Approach 8.

7 Risk Resources and Sources Websites Books Articles Standards 9. Questions and Answers 6 Integrated Risk Management : Implementation Guide Section 1: Using this Guide Who Is the Guide For? This guide is intended for anyone interested in implementing Integrated risk Management (from now we will call it IRM here you can call it by whatever title works for you) in their organization, be it a private company, a voluntary organization or a governmental unit or department. It is designed to focus as much as possible on the steps needed to convince an organization that it needs IRM, to show one prototype of a risk assessment and mitigation process that can be readily adapted and to address the issues of aligning the organization, getting in place the governance and training to sustain IRM over time.

8 The people that are involved in these processes are the target audience. Therefore, they could be: Senior managers trying to determine the benefits and best ways to start, Operational managers trying to demystify IRM for themselves and their staff, Line staff trying to figure out what the consultants, staff responsible for implementation and their bosses are talking about, and Staff and managers charged with implementing IRM. The focus therefore is on managers, both those involved in the operational side of the organization and those involved in various staff and control functions, such as finance, strategic planning and human resources. IRM only works when all are involved and there is effective buy-in on all sides. What the Guide Does In a sense, the various sections will have different benefits depending on the perspective that the reader brings to bear.

9 In addition, there is a logical set-up that reflects the need to lay out the entire implementation picture. That always starts with what you want to achieve, not how. Consequently, there is a section that deals with what some would call the theory of risk and Integrated risk Management . One of the reasons for doing this is to ensure that you get the Integrated into Integrated , gets all the inter-connecting elements in place. Hopefully, there will be enough useful material for those involved in this to use when making their own presentations. For that reason, take-out boxes will also have useful quotations or points to remember. Much of the challenge in implementing IRM is the selling of it. One of the challenges in outlining the implementation of IRM is that it has two faces: A focus on developing an organized approach that involves the Integrated part of the title: this means setting up a policy, a governance structure, building linkages to existing business process and assigning responsibilities, and 7 Integrated Risk Management : Implementation Guide Idea Source: What s That?

10 Throughout the Guide you will see text boxes with the heading Idea Source. These are ideas, tips and good quotations picked up from many interviews and discussions that the author has gathered over the course a much research in this area. They are designed to give you quick ideas, vignettes or key messages that will assist in explaining IRM, defining the key points or using a much needed argument to make your point. Some of the quotations will not be attributed as they were part of research projects in which anonymity was promised. A focus on the substantive elements of risk Management itself: notions of risk and what it is and is not, risk assessments, risk tolerances, risk mitigation and monitoring. This guide will address both elements in detail.