Paul Hopkin. Fundamentals of Risk Management

Подождите немного. Документ загружается.

194 Risk and organizations

management of tactics, projects and enhancements; •

continuity and monitoring of routine operations. •

An activity is an individual job or task that builds into the processes that deliver stakeholder expec-

tations. The processes themselves are designed and intended to add value to the organization.

Having identiﬁ

ed stakeholder expectations, core processes can then be put in place to ensure

that these expectations are delivered to the level that the organization has decided is appropri-

ate. No organization will be in a position to fully deliver all expectations to the level desired by

all stakeholders. Often, this is because different stakeholder expectations are contradictory.

Weaknesses or gaps in the core processes of the organization are likely to be present, as

follows:

There may be weaknesses related to the development and delivery of strategy. These •

weaknesses will result in the organization failing to retain its position as market leader.

They give rise to a leadership gap.

There may be weaknesses related to the management of projects and product or service •

enhancements. These weaknesses will result in the organization failing to keep up with

competitors. They give rise to a competition gap.

There may be weaknesses related to failure to ensure continuity and monitoring of •

routine operations. These weaknesses will result in the organization failing to maintain

efﬁ

cient operations. They give rise to an efﬁ ciency

gap.

Efﬁ cacious strategy

Business strategy is the statement of what the organization intends to achieve and how it plans

to achieve it, and is based on the strategic decisions about the future of the organization.

Establishing a detailed business strategy enables the organization to deliver its mission, objec-

tives, strategy and plans. The overall objective of risk management input into strategy is to

ensure efﬁ cacious strategy and strategic decisions that will deliver the desired outcomes.

The main risk management input into business strategy is likely to be risk assessment.

This is a critical component for the formation of efficacious strategy. Risk assessment of

the existing strategy and any proposed new strategy should be undertaken. If clear strate-

gic options are present, then a risk assessment of each of the viable options should be

undertaken individually.

Some organizations exist in a very competitive marketplace that is undergoing signiﬁ cant

technological changes. In these circumstances, there are signiﬁ cant risks associated with the

business and huge strategic decisions have to be taken. Often, these decisions are related to

developments in technology that challenge the way in which the organization delivers cus-

Analysis of the business model 195

tomer solutions. Changes in technology can require huge and speculative investment deci-

sions. The investment decisions may be speculative because of untested new technology or

because there are alternative technologies available.

A risk assessment of strategic options needs to be undertaken, including an analysis of stake-

holder expectations, existing customer requirements and existing staff skills, as well as a

strengths, weaknesses, opportunities and threats (SWOT) analysis. The strategic options avail-

able to the company might include joint ventures, outsourcing the work, sub-contracting or

investing in new technologies.

Detailed risk assessment of strategic options will ensure that the board has the best available

information in order to make correct strategic decisions. Events and other circumstances that

could reduce the successful delivery of efﬁ cacious strategy should be identiﬁ ed during the risk

assessment. The organization will then be able to decide the controls that should be put in

place to optimize the likely impact if any of these risks materialize.

Effective processes

Business processes are the means by which the organization will deliver the business strategy.

Processes need to be correctly selected, implemented and controlled to ensure the effective-

ness and efﬁ ciency of operations. Processes should also deliver reliability of ﬁ nancial reporting

and compliance with applicable laws and regulations. The intended outcome is effective, efﬁ -

cient and compliant business processes.

Changes to processes are delivered by projects, and the importance of risk management in

projects will be discussed in a later chapter of this book. When undertaking a project, the

organization needs to be concerned about the risks within the project that could stop it being

delivered on time, within budget and to speciﬁ cation.

However, there is a further consideration related to projects and that is the effectiveness of

enhancements to processes that the project is designed to deliver. There is little beneﬁ t in

having a project delivered on time, within budget and to speciﬁ cation if the required increase

in process effectiveness is not achieved. For example, the installation of a new business soft-

ware system may be undertaken by a successful project, but if the new software system is inad-

equate, or does not deliver all of the additional beneﬁ ts anticipated, then the improvement in

business processes may not have been achieved.

The main risk management inputs into processes and projects will be risk assessment, risk

response enhancement and the review and monitoring activities. The purpose in undertaking

a risk assessment of a project is to identify necessary controls. When these controls have been

implemented, the effectiveness and efﬁ ciency of the controls will need to be reviewed. Overall,

the intention is to ensure that processes and projects are themselves effective and efﬁ cient.

196 Risk and organizations

Efﬁ cient operations

The overall objective of risk management input into operations is to achieve operational efﬁ -

ciency that is protected from unplanned disruption. Disruption of operations is likely to be

caused by a hazard risk materializing. The design of efﬁ cient processes that are free from dis-

ruption will provide the organization with signiﬁ cant competitive advantage or place the

organization in a better position to deliver value for money.

Risk management can have a major impact on the operations of an organization. All stages of

the risk management process are relevant to the continuity of uninterrupted efﬁ cient business

processes. Risk recognition and rating (risk assessment), responding to signiﬁ cant risks,

resourcing controls, reaction planning, reporting on risk and review and monitoring are all

critical inputs. In summary, risk management input into operations needs to be comprehen-

sive if operations are to be efﬁ cient and uninterrupted.

Internal audit also has an important role to play in the delivery of efﬁ cient operations. Internal

auditors frequently refer to the added value that internal audit activities bring. This added value

relates to the evaluation of control activities, especially in relation to operations. Not only should

the operations be effective and efﬁ cient, but the controls that are in place should also be effective

and efﬁ cient. Internal audit activities have a signiﬁ cant role to play in providing the appropriate

risk assurance and providing conﬁ rmation of compliance, where relevant.

Reporting performance

Operational reports indicate how well the strategy is being delivered. Data need to be available

on an ongoing basis, so that management can respond and modify the business processes, as

necessary.

Operational reports also provide information that can be used to prepare reports to stakehold-

ers on the performance of the organization. However, the organization needs to decide what

will be reported and disclosed to stakeholders and the format that will be used for those reports.

To ensure accurate reporting and disclosure, appropriate control activities need to be applied.

In the United States, the Sarbanes–Oxley Act (SOX) sets out duties that are primarily con-

cerned with the accuracy of ﬁ nancial reports to shareholders.

The main risk management input into reporting of performance is the risk assessment of the

reporting lines and the data-handling procedures. The SOX duties have increased the atten-

tion paid to the control of reporting procedures. Section 404 of SOX requires that ﬁ nancial

reports and the ﬁ nancial reporting procedures are attested by external auditors to conﬁ rm that

they are accurate.

Analysis of the business model 197

Aspects of the business model can also be applied to personal objectives and the achievement

of personal success. Many books have been published on the personal traits of highly success-

ful people, and the box below indicates some of the key characteristics exhibited by these high

ﬂ yers.

Personal success

In a recent survey, respondents indicated that the top two drivers for success were: 1)

having a strategic vision; and 2) having written goals. Most people indicated that their

deﬁ nition of success was ‘work that is both challenging and rewarding’. Here are some

key characteristics exhibited by successful people:

clearly identiﬁ ed core values/mission/vision; •

personal deﬁ

nition of success; •

clearly deﬁ

ned, written goals; •

competency in negotiation; •

embracing risk taking;* •

continuous learning. •

* People who are comfortable taking risks typically experience increased autonomy, heightened

self-esteem, a more positive attitude towards life and an increased sense of personal power. Most

successful people recognize that taking risks typically involves personal growth. Those with an

aversion to risk often link risk with failure.

Project risk management

Introduction to project risk management

Projects will be undertaken by organizations for a number of reasons. When alterations to

strategy are being planned, a project or series of projects (programme of work) will often be

necessary in order to implement the revised strategy. Also, improvements to operational proc-

esses will require changes that will be implemented by undertaking a project.

Project risk management should be seen as an extension of conventional project planning.

The main requirements for any project are that it is delivered on time, within budget and to

speciﬁ cation or performance. Risk is often deﬁ ned in terms of uncertainty or deviation from

expected/required outcomes. It is in relation to project risk management that the deﬁ nition of

risk being represented by uncertainty is most relevant. Within project management, variabil-

ity of outcomes is very undesirable. Therefore, the focus of risk management is often on the

reduction in the variability of outcomes and the management of control risks.

There will be uncertainties within any project related to events, conditions and circumstances.

The requirements of project risk management are to identify the events that could give rise to

uncertainty and respond to the event appropriately. The style of risk management most rele-

vant to project risk management is control management.

As well as managing the risks and uncertainties in a project, the project manager should also

be looking for opportunities that may arise when certain developments within the project are

more favourable than expected. Project risk management should take account of these posi-

tive developments and ensure that the structure for managing risks in projects is sufﬁ ciently

ﬂ exible for the opportunities to be recognized and beneﬁ ts obtained.

For example, consider a project of building a new road where one of the bridges can be com-

pleted well ahead of schedule because of favourable ground conditions. There may be an

opportunity to build the beneﬁ t of this early completion into the future project plan, so that

this gain is not lost in the overall timescale for delivery of the ﬁ nal completed project.

198

Project risk management 199

Development of project risk management

Project risk management is a type of control management. Projects relate to the delivery of a

ﬁ nite, speciﬁ c or tactical product such as new:

construction; •

products; •

IT systems; •

technology; •

markets. •

Projects and enhancements are fundamentally important to organizations. Most projects are

undertaken either to keep ahead of competitors or to catch up with them. In the context of risk

management, the project itself may be considered to be a risk reduction exercise that is

designed to achieve speciﬁ

c management objectives. The only purpose in spending money on

business enhancement projects is to achieve a business or value-for-money advantage.

Project risk management is a well-developed discipline, with risk control and (especially)

event management as the risk management activities that are most important. Project risk

management is one of the more sophisticated and successful areas for the application of risk

management tools and techniques.

The requirement for all projects is that they are delivered within the deﬁ

ned cost, time and

quality parameters. Quality is the relationship between speciﬁ cation and performance. Some

projects require that the outcomes comply with a certain speciﬁ cation, such as a new ﬂ oor in

a restaurant that has to be constructed from speciﬁ ed materials. Other projects may require a

desired level of performance, such as specifying the level of slip resistance of the ﬂ oor. Some-

times, both a speciﬁ cation and a performance will be required.

Because of the nature of projects, historical loss data will not usually be available. Accordingly,

project risk management needs to be forward looking in order to anticipate problems before

they arise.

Hazard, control and opportunity risks need to be considered as part of the successful manage-

ment of any project. There are risks to the project that can prevent it being delivered on time

and within budget (hazard risks). There are risks to the project concerning the speciﬁ cation,

performance and quality of the ﬁ nal outcome (control risks). Finally, there are risks to the

project whereby the full range of beneﬁ ts or enhancements are not achieved (opportunity

risks).

200 Risk and organizations

Uncertainty in projects

In order to manage uncertainty in projects, organizations have a range of possible actions they

can take. An organization can decide to adopt one of the following:

Accept the risk or uncertainty. •

Adapt processes and procedures. •

Adopt contingency plans and responses. •

Avoid the risk or uncertainty. •

For low-exposure/low-uncertainty risks, the organization (or project) will usually accept

uncertainty attached to each risk. For high-risk-exposure/low-uncertainty risks, the organiza-

tion will adapt process procedures and introduce controls, including (when appropriate)

insurance. For low-risk/high-uncertainty risks, the organization will adopt appropriate con-

tingency plans and for high-exposure/high-uncertainty risks, the organization will wish to

avoid the uncertainty attached to the risk.

This analysis (the 4As of control (or project) risk management) can also be applied to the

management of uncertainty in general. The 4As of uncertainty management can be compared

to the 4Ts of hazard management and represent a broadly similar approach. Management of

control risks and uncertainty is considered in more detail in Chapter 27 and is illustrated in

Figure 27.1 (page 246).

Project life cycle

Project risk management has become one of the best-developed and respected branches of risk

management. This is not surprising given the dynamic and pressured environment in which

many projects are undertaken. Projects can range from the implementation of a new software

package on a computer system through to the building and commissioning of a substantial

new sports stadium or delivering the Olympic Games in London (2012).

Whatever the size of the project, a number of speciﬁ c stages will always be present. Figure 22.1

illustrates the key stages in the project life cycle. An important additional feature of project risk

assessment is that the requirements of the client should always be of the utmost importance. The

client may be external to the organization, but is sometimes part of the same organization.

Figure 22.1 sets out the project life cycle as having four stages. These are project inception,

project planning, project execution and project closure. The activities within each of these

four stages are listed in the ﬁ gure. It is important to understand the stages in the project life

cycle, so that the risk management inputs into each stage can be planned, executed and the

required beneﬁ ts obtained.

Project risk management 201

Project

lifecycle

Project inception

• Feasibility study

• Outline cost plan

• Appointments

Project closure

• Handover

• Project review

Project planning

• Detailed design

• Scheduling

• Procurement

Project execution

• Construction

• Cost reporting

• Quality check

Figure 22.1 Project life cycle

Reproduced with permission from Feasible.

The risk management process as applied to project management is similar to the standard risk

management process illustrated in Figure 4.1. However, the framework that supports the risk

management process in each case may be quite different, because of the dynamic nature of the

projects.

Each stage of the project life cycle will have signiﬁ cant risk and uncertainty issues embedded

within it. The uncertainty embedded in each stage of the project will include such issues as

deﬁ ning the project precisely, agreeing the timescale and budget and conﬁ rming the per-

formance/speciﬁ cation. There will also need to be arrangements for changes and develop-

ments within the project speciﬁ cation, as well as arrangements for any deviation from

expected circumstances.

Take the example of refurbishing a block of ﬂ ats. There will be a large number of interested

parties, including architects and the principal contractor. External agencies will also need to be

involved, including planning, building regulations requirements, health and safety, environ-

mental protection and the utilities. Successful management of a project of this type will require

the following:

Make risk management part of the project. •

Identify risks early in the project. •

Communicate about risks. •

Consider both threats and opportunities. •

Clarify ownership issues. •

202 Risk and organizations

Prioritize risks. •

Analyse risks. •

Plan and implement risk responses. •

Track risks and associated tasks. •

Opportunity in projects

Projects are undertaken because they represent an opportunity to be embraced or a challenge

that needs to be overcome. Often a number of projects will need to be undertaken at the same

time. A collection of projects of this sort is referred to as a programme.

Good project planning requires arrangements to overcome unexpected events or circum-

stances. This is often referred to as contingency in the budget or timescale. Contingency may

be for additional time to complete a task, or additional costs that may arise to ensure that the

ﬁ nal project deliverable operates to the required speciﬁ cation. As the project develops, any

perceived difﬁ culties will need to be addressed and opportunities to reduce the impact these

difﬁ culties explored.

Very frequently, the speciﬁ cation of a project will change during the course of the work. A well

risk-managed project will take the opportunity of change to speciﬁ cations to provide a greater

level of customer satisfaction, as well as a greater level of income for the organization deliver-

ing the project.

Project risk analysis and management

The Association for Project Management (APM) developed the Project Risk Analysis and

Management (PRAM) Guide in the mid-1990s. The key considerations that underpin the

PRAM approach are set out in Table 22.1. Perhaps one of the most important points made is

that there is often no historical experience speciﬁ c to the project that will enable accurate pre-

diction of the impact of risk-based events. The PRAM Guide provides steps to project risk

management that are broadly consistent with the steps outlined above.

Project risk management 203

Table 22.1 PRAM model for project RM

Project Risk Analysis and Management is a process that enables the analysis and

management of the risks associated with a project

Properly undertaken it will increase the likelihood of successful completion of a

•

project to cost, time and performance objectives

Risks for which there is ample data can be assessed statistically

•

However, no two projects are the same •

Often things go wrong for reasons unique to a particular project, industry or working •

environment

Dealing with risks in projects is therefore different from situations where there is

•

sufﬁ cient data to adopt an actuarial approach

Because projects involve a technical, engineering, innovative or strategic content, a

•

systematic process is preferable to an intuitive approach

Project Risk Analysis and Management (PRAM) has been developed to meet this

•

requirement

The PRAM approach represents a continuous process that can be started at almost any stage

in the life cycle of a project. There are ﬁ ve points in a project where particular beneﬁ t can be

achieved from using the PRAM model:

Feasibility – at this stage the project is most ﬂ exible, enabling changes to be made that •

can reduce the risks at a relatively low cost.

Sanction – the client can view the risk exposure associated with the project and check •

that all steps to reduce/manage the risks have been taken.

Tendering – the contractor can ensure that all risks have been identiﬁ

ed and that risk •

contingency or risk exposure limits have been set.

Post-tender – the client can ensure that all risks have been identiﬁ

ed by the contractor •

and assess the likelihood of programmes being achieved.

During implementation – the likelihood of completing the project to cost and times- •

cale will increase if all risks are identiﬁ

ed and correctly managed.

The box below provides further commentary and advice on the importance of risk manage-

ment in projects. Some important characteristics of risk management in projects, as well as

some of the means of achieving success are discussed.