Best Practices in Risk Management-Coordinated Conclusions from PMN and KPMG

April 1999

Table ofContents

• I Introduction
• II Coordinated Conclusions

I Introduction

This report summarizes our coordinated conclusions from our respective studies: Review of Canadian Best Practices in Risk Management (PMN) and Best Practices in Risk Management: Private and Public Sectors Internationally (KPMG).

We report our conclusions, and recommendations as answers to key questions of interest:

• Does the drive toward a more systematic management of risk make sense?
• Did the studies of best practices in other organizations produce helpful results?
• Are there clear benefits?
• Is there a definitive point where one should start in establishing new management of risk initiatives?
• What else is important in starting initiatives?
• Was anything learned that will help address federal public sector barriers/needs?
• What else has been learned from the best practice studies?

II Coordinated Conclusions

DOES THE DRIVE TOWARD A MORE SYSTEMATIC MANAGEMENT OF RISK MAKE SENSE?

• It makes a lot of sense!
• Strong challenges have been launched (though new visions for regulation and comptrollership , and taken up by many others around the world).
• Strong case can be made that it will support other new visions such as knowledge management.
• Strong change imperatives have been created (eg. through resource restraint, people replaced by systems, the global pace of change, etc.) which affect both the public and private sectors.

DID THE STUDIES OF BEST PRACTICES IN OTHER ORGANIZATIONS PRODUCE HELPFUL RESULTS?

• The Best Practice Studies should prove very helpful:
• Canadian and International Best Practices are very similar and most of the best practices are considered very applicable to the Federal public sector. For example: senior management commitment and workshops and training facilitate a cultural shift; commitment from the top, communication, and using committees and teams helps foster a supportive work environment; workshops, teaming and training contribute to easily understood methods; and senior management commitment and communicating risk support accountability.
• Important insights were gained on key issues such as: benefits, where and how to start initiatives, and how to address the barriers/needs identified by the report on status of Risk Management Implementation in Federal Departments.

ARE THERE CLEAR BENEFITS?

• Most assuredly, but some faith is also required
• Precisely measuring benefits is a still-evolving aspect of managing risk and participating organizations did not yet have methodologies to share. However, organizations are currently satisfied with their management of risk investments, based on the general overall quality of results, and management's perceptions of value-added.
• Perceived benefits include:
• Improved probability of achieving objectives.
• Improved financial and operating management.
• More comprehensive assessment of risks and planning options.
• Fewer BIG surprises and better contingency planning.
• Builds trust through sharing analyses and process with Partners.
• Enhanced Public, Stakeholder understanding of trade-offs and confidence in organization's process.

IS THERE A DEFINITIVE POINT WHERE ONE SHOULD START IN ESTABLISHING NEW MANAGEMENT OF RISK INITIATIVES?

• Definitely, there are two key points:

1. Commitment and Vision from the top is the first pre-requisite
   • Face to face workshops to develop Management Team support was a suggested Best Practice for developing this as was Promoting an Organizational Philosophy that says Everyone is a Risk Manager
2. After the first pre-requisite, implement in stages with a combination of organizational-wide and targeted area initiatives
   • 1/3 or less of the organizations interviewed were starting with organizational-wide risk initiatives. Most are first concentrating on developing a competency in risk management for a specific discipline (e.g., planning).

WHAT ELSE IS IMPORTANT IN STARTING INITIATIVES?

• The Best Practices Suggest:
• Clearly define risk. It will be important to explain how to implement an approach where the definition of risk includes the definition of harm and opportunity.
• Develop simple, common language to facilitate understanding and communication.
• Multi-disciplinary teams to share risk attitudes and horizontal issues.
• Targeting "Natural Fit" areas first to achieve early success.
• "Learning by Doing" approach to training.
• Risk/Control Assessment Sessions.
• Set up a dedicated department, team or centre to act as the process and technical resource base for risk management within the organization.
• Must allocate ongoing resources, start with adequately funded
• Internal Audit is a useful resource.
• Make it part of the normal management process.

WAS ANYTHING LEARNED THAT WILL HELP ADDRESS FEDERAL PUBLIC SECTOR BARRIERS/NEEDS?

• YES, we believe so.
• Regarding the barrier of changing the "minimizing risk" cultural attitude:
• Many of the best practices in each study are considered helpful in addressing cultural change beginning with Commitment from the Top, and Promoting an Organizational Philosophy that sees Everyone as a Risk Manager.
• Clearly Defining Risk will provide the platform to help people understand issues such as minimization vs. aversion vs. risk-taking. This will also provide a platform to address the related issues of support for risks taken and low risk thresholds at the political level.
• Regarding the need to reconcile "Technical Risk" and "Outrage".
• Risk communication (identified as a best practice in both studies) can build awareness and understanding of both risk types within those functional groups traditionally sensitive to only one of these types of risk.

WHAT ELSE HAS BEEN LEARNED FROM THE BEST PRACTICE STUDIES?

• Risk Management should be a continuous, dynamic process, tailored to each organization.
• A Risk Management Policy or Framework is key to clarifying roles and responsibilities.
• Risk communications should promote open discussions as risk management plans are implemented and when events do not turn out as planned.
• Priorization of the best practices, such as those that help address cultural change in the federal public service context, should be possible as a next step, with Advisory Committee involvement.
• There are excellent tools, techniques and methodologies to support Risk Management (eg. risk mapping, risk scenario planning, quantitative analysis software, etc.).
• The Best Practices Framework was easily understood by the responding organizations and may be further refined to be used as a starting point for developing Federal Government management of risk guidance.