Confidence in Managing Risk Monday 8 November Alan Ross - Zurich Risk Management alan.ross@uk.zurich.com https://www.zurich.co.uk/en/charity-insurance Twitter @ZurichVolSec

Key to Effective Risk Management Keep the process simple Use your purpose, mission or strategic objectives as a starting point; which risks will stop you achieving? Focus on the biggest most significant risks; not everything & anything that might go wrong Involve as many people, voices & opinions in your risk register as is practical Think about risk early on when thinking about innovative projects or partnerships Discuss your risks regularly and feel confident to challenge the risks, their score & controls in place

Risk Register Template No. Cause Effect Controls Risk Rating Action Required Direction of Travel Risk Owner 1 Loss of sensitive data due to poor ICT controls Impact on data subjects Fines Damage to reputation Firewall Pen testing Staff training Info governance policy 25 (High) Review ICT security ↗ IT Manager

Risk Management

Risk Appetite Descriptions Example Organisational Behaviours Risk Averse Preference is for ultra-safe actions that will not result in a loss of reputation or credibility Innovation is avoided unless it’s forced upon us All reasonable steps will be taken to manage the risk; prepared to be bureaucratic and tightly control processes Avoid any action that could lead to a legal challenge or breach of regulatory framework Cautious Preference is for actions that are unlikely to result in a loss of reputation or credibility Innovation is generally avoided, and will only be entered into if all stakeholders are committed, and success is virtually guaranteed Prepared to accept the possibility of only limited financial loss Open Willing to stick our neck out and risk our reputation but only if steps have been taken to reduce the risk Innovation is supported, but only if clear benefits are demonstrated and we are confident in our success Prepared to invest for reward and accept moderate financial losses are possible The likelihood of this risk happening and the consequences are such that we’re happy to live with it Hungry Willing to accept increased scrutiny from stakeholders and a loss of credibility if things go wrong Innovation is pursued, we are willing to break the mould to deliver organisational goals even if failure is a possibility Prepared to invest knowing significant financial losses are possible, or that innovation may fail to deliver the anticipated benefits

Appetite for Different Risk Types Description Reputation Cautious to Open Financial HR – Capability & Capacity Cautious HR – Safety Risk Averse Regulatory / Compliance Environmental Risk Averse to Cautious Performance IT & Infrastructure Innovation

Questions (1) Is the external environment regularly monitored, and by whom? Are risks and controls reviewed frequently enough? Is risk embedded within regular reporting routines? How does risk information get reported to trustees? How often are risks being reviewed and reported on? Who is responsible for reporting risks? What are the most significant 3 or 5 risks surrounding a decision and can they be controlled? Have staff considered all of the significant risks when recommending a decision? Do risk controls seem appropriate for the level of risk? How good have we been at managing these risks in the past? C:\Documents and Settings\chy5484\Local Settings\Application Data\Office\Macros\Ppt_ci\Templates\Pres_blue_on_white.pot 1/18/2019

Questions (2) Are risks managed in line with your organisation's appetite, attitude or tolerance for risk? Do colleagues fully appreciate the impact the risk will have should it happen? Has appropriate analysis been undertaken or specialist advice sought if appropriate? How do we know our controls are working? Does the assessment of the risk seem to be optimistic or pessimistic? Is the risk assessment based on clear data or have staff had to use their judgment (neither of these is necessarily better than the other; both methods can be flawed)? Who completed the risk analysis, an individual or a group? If partners or 3rd parties have a role to play in managing a risk are you confident they will deliver? C:\Documents and Settings\chy5484\Local Settings\Application Data\Office\Macros\Ppt_ci\Templates\Pres_blue_on_white.pot 1/18/2019