Module 6: Risk Frameworks (Advisory)

Module 6 Objective

Same as Module 5

Now we focus on advisory corporate governance regimes that encourage good RM processes

Advisory Risk Frameworks

UK Gov RM Model

The Orange Book (Management of Risk - Principles and Concepts) from UK

• High level guide designed to provide broad-based general guidance on the principles of RM in the public and private sectors

• Includes identification and analysis of risk

• Some advanced guidance:

  Importance of horizon scanning
  (Systematic activity designed to identify indicators of changes in risk)

• Examines how the organization’s RM activities relate to the wider environment in which it functions

Key Principles

…that distinguish it

1. Importance of linking risk to objectives

2. Distinction between the risk and its impact

3. Need of distinguishing inherent and residual risks

4. Prioritization of risks is more important than quantification

5. Risk appetite should be subdivided into corporate, delegated and project

6. Should have a dedicated risk committee

(Read the orange book if have time)

Canadian Gov RM model

The Treasury Board of Canada Integrated Risk Management Framework (2001) form CA

• Decision making framework for public sector

4 Elements of ERM Framework

1. Developing the corporate risk profile

   • Identify risk through environment scanning
     (reviewing internal and external risk factors)
   • Assess current status of RM within the organization
   • Identify organization’s risk profile

2. Establishing and Intergrated Risk Management Function (RMF)

   • Management direction on RM is communicated, understood and applied

   • Implement IMR operation through existing decision making and reporting structures

3. Practicing IRM

   • Apply a common RM process consistently at all levels

   • Integrate results of RM practices into informed decision making and priority settings

   • Ongoing consultation and communication with stakeholders

4. Ensuring continuous RM learning

   • Establish supportive work environment where learning from experience is valued, lessons are shared

   • Results of RM are evaluated to support innovation, learning and continuous improvement

   • Experience and best practices are shared, internally and across government

Key Principles

…that distinguish it

1. Importance of a comprehensive understanding of the organization’s risk profile, appetite and tolerance

2. Focus on RMF and the IRM activities

3. Value of a continuous and supportive learning environment

4. Need to establish the relationship between the organization and its operating environment, revealing the interdependence of individual activities and the horizontal linkage

New revised version “The Framework for the Management of Risk”

Australia & NZ Standard

AS/NZS 4360: best practice RM standard by Standards Australia

Elements of AS/NZA 4260

1. Establish the context (SWOT factors)

2. Risk assessment:
   identify \(\Rightarrow\) analyse \(\Rightarrow\) evaluate

3. Treat Risk

4. Monitor and review

5. Communicate and consult

Key Principles

…that distinguish it

1. Detail on risk analysis for non-financial organization
   (Similar to op-risk for financial org)

2. Recommendation that RM process is formulated into a RM plan

3. Importance of senior managmenet buy in

4. Need for adequate resources being allocated to RM

ISO 31000

Similar to the other guidance that provides generic guidelines without dealing with specific risks or sectors

Step forward from existing standards (more of what is needed for successful ERM) but still not a comprehensive framework

• Lack of key details about how to create in practice a “risk culture”

RAMP

Risk Assessment and Management of Projects (RAMP)

• Developed by IFA and Institute of Civil Engineers
• Primarily concern with capital projects but still relevant for day-to-day business

RAMP Process:
(Key difference with AS/NZS 4360)

• Similar steps as AS/NZS 4260

• Additional steps:

  • Project launch stage and project close down analysis

  • Go/no-go decision step

IRM/AIRMIC/Alarm Standard

Joint work from major RM organization in the UK

• Institute of Risk Management (IRM), Association of Insurance and Risk Managers (AIRMIC), and ALARM The National Forum for Risk Management in the Public Sector

• Similar to COSO with a methodical approach to RM and a structured approach to risk reporting

• Strong focus on the role of a RM champion in the organization

Principles:
(In addition to what’s in the COSO)

1. In-house approach to RM is preferable

2. Internal audit is an important control

3. Clarity over the roles of stakeholders is important

4. Highly structured approach to risk reporting is beneficial