Risk management and Investigation

1. Risk management and Investigation Peter Roberts peroberts@csu.edu.au

2. Session Overview 1 What is risk management? 2 How to do risk management 3 How CSU staff can use risk management

3. What is Risk Management Contents • The notion of risk • Defining risk management • The objectives of risk management • Organisational responsibilities and obligations in risk management

4. What is risk? • Common language understanding • Formal ‘The chance of something happening that will have an impact upon objectives’ • Represents a rational response to dealing with an unknowable future • Can be measured in terms of likelihood and consequence

5. Risk management Definition ‘The culture, processes and structures that are directed towards the effective management of potential opportunities and adverse effects” • Treadway, COSO and Cadbury • Australian /New Zealand Risk Management Standard 4360:1999.

6. Risk Management Objective ‘To enable business operations to be conducted within an environment of acceptable loss’ Process ‘The systematic application of management policies,procedures and practices to the tasks of establishing the context, identifying analysing, evaluating, treating monitoring and communicating risk’ The ‘Why?’ of risk management

7. Professional/Organisational overview Professional reasons • common language • rationality, consistency Organisational reasons • legal, ethical, business responsibilities • safety, fraud control, insurance, disaster recovery

8. Professional reasons for risk management • Standard 4360:1999 imposes a common language on key terms which is universally accepted in public and private enterprise • encourages to think rationally • promotes consistency in decisions • assists in defending key decisions

9. Organisational reasons for risk management • Organisational Legal Obligations • contracted • legislated • Other Organisational Responsibilities • ethical • self-regulated agreements

10. Organisational Legal Obligations • Contractual • employment agreements • Legislated • OH&S & EEO • environmental • Myriad of other regulatory statutes • Use words like ‘reasonable’

11. Corporate Ethical Responsibilities Includes a range of socially based expectations, including: • fairness • internal self regulation • industry self regulation • maintaining industry standards

12. The result Risk management provides a proactive contribution to: • contracted, legislated and ethical compliance • increased revenue • reduced costs • positive ethical climate within the organisation

13. The ‘how’ of risk management

14. Australian /New Zealand Risk Management Standard 4360:1999 1) establish the context 2) identify risks 3) analyse risks 4) evaluate and prioritise risks 5) treat (or recommend treatments) for risks • Consult and communicate at each stage • Monitor and Evaluate at each Stage and loop back to earlier stages if necessary

15. Establishing the context • strategic context • organisational context • risk management context

16. Establishing the context (cont) • Start with objectives • ‘The chance of something happening that will have an impact upon objectives’

17. Establishing the context (cont) To define the objective, consider: • what do we do? • how do we do it? • who are our customers/stakeholders? • what do they want? • what does all this mean to us?

18. Establishing the context (cont) Three key elements: 1 what is/are our objectives? 2 what activities need to be completed to achieve the objectives 3 what resources are available for use to perform the activities which will lead to the successful achievement of the objectives?

19. Establishing the context (cont) • Develop risk evaluation criteria based upon policy, goals, objectives, stakeholder interests • operational • technical • financial • legal • social humanitarian

20. Identifying risks/threats Link all customers/stakeholders to: • objectives • activities • resources

21. Identifying risks/threats (cont) • Identify what can happen to threaten the the process or system being analysed and how that threat may occur • Then list all those risks/threats

22. Assessing risks/threats • Quantitatively • historical data • statistical information on incidents • surveys • Qualitatively • determine likelihood • determine consequence

23. Assessing risks - rating the impact • Disastrous - achieving the objective may not be attainable. May be forced to discontinue or transfer function • Critical - Will produce difficulties beyond the capacity of existing resources. May require additional resources or funding to restore/achieve minimum function • Serious - Will produce difficulties to function that can be readily absorbed by current resources • Minor - Anything less than above

24. Assessing risks - rating likelihood • Definite - almost certain to occur • Probable - distinct possibility of occurring in the time given • Possible - likely to occur over an extended period of time • Remote - more likely not to occur • Improbable - very unlikely to occur

25. Presenting the risks • Can use a matrix - one provided in papers • Can develop different kinds of ratings for different circumstances • Can apply numerical values to the ratings - this helps when prioritising a large number of risks • Can use a risk register

26. Treating risks • Identify treatment options • Evaluate treatment options • Recommend treatment options • Prepare treatment plan • Implement treatment plan

27. Developing/implementing a risk management program Appendix B of the Standard • Step 1- Support of senior management • Step 2 - Develop organisational policy • Step 3 - Communicate policy • Step 4 - Manage risks organisationally • Step 5 - Manage risks at work unit level • Step 6 - Monitor and review

28. Who should be involved • horizontal spread - as many different functions as necessary • vertical spread - as many levels of the organisation as possible • skill spread • external stakeholders • consultants?

29. Revisit key elements of Standard 1) establish the context 2) identify risks 3) analyse risks 4) evaluate and prioritise risks 5) treat (or recommend treatments) for risks • Consult and communicate at each stage • Monitor and Evaluate at each Stage and loop back to earlier stages if necessary

30. Establishing CSU context Three key elements: 1 what is/are our objectives? 2 what activities need to be completed to achieve the objectives 3 what resources are available for use to perform the activities which will lead to the successful achievement of the objectives?

31. CSU context (cont) Develop risk evaluation criteria based upon policy, goals, objectives, stakeholder interests • amount lost • damage to reputation of organisation • threat to health, safety, security These criteria feed into the risk assessment process

32. Identifying risks • Identify what can happen to threaten the the process or system being analysed and how that risk may occur • Then list all those risks

33. Assessing risks • Quantitatively • historical data, internal audit reports • files • statistical information on incidents • Qualitatively • determine likelihood • determine consequence

34. Treating risks • Identify treatment options • Evaluate treatment options (cost, effectiveness) • Recommend treatment options • Prepare treatment plan • Implement treatment plan

35. Other governance processes • Cross linkage with other governance processes. Each of these organisational policies need to be integrated with each other:eg • Corporate planning • Physical security • Computer security • Internal audit • Organisational ethics • Anti-corruption activity

36. Any comments?