Risk Management Seminar PPD 30 November 2017

Aims of risk management 01/12/2014 Aims of risk management Department/Institution understands the risks to which it is exposed. Risks are managed proactively and controls put in place. Achievement of objectives is more likely

Some views of risk management Health and Safety only Preventing negative events Documenting every single risk Meaningless numbers Filling out a risk register once a year

A better view of risk management Makes you think ahead about what trying to achieve and how to ensure it happens. Documenting risks makes you think them through and examine core assumptions. Can be used as a tool for appraising key aspects of strategies and business plans. It helps raise profile of concerns. Helpful documentation for decision-making. Fewer shocks and unwelcome surprises. Helps seize opportunities that occur – positive risks

Definitions HEFCE’s definition of Risk: “The threat or possibility that an action or event will adversely or beneficially affect an organisation's ability to achieve its objectives.”

Requirements “HEIs must ensure that there are appropriate arrangements in place to promote effective risk management, control and governance”; this is a condition of the HEFCE grant.

Development of risk management practice Growing area for organisations in all sectors (high profile cases: Co-op, BP, Enron)

Lack of understanding Negative attitudes Behaviours Process 01/12/2014 Common Obstacles Lack of understanding Negative attitudes Behaviours Process

What’s your experience? Take the Risk Management Health-check!

Risk management at Cambridge 01/12/2014 Risk management at Cambridge University Risk Steering Committee and Key Risk Register Risk owners present to Audit Committee Risk emphasis in Internal Audit programme Schools / Non-School institutions Annual planning submissions to include risk register Risk Steering Committee reviews registers Faculties / Departments Documented registers reviewed by School Councils Projects Key part of effective project management

Risk Steering Committee Membership Oversees the RM process as a whole, on behalf of Council Twice yearly reviews of Key Risk Register Annual review of School and NSI registers

University’s Key Risk Register

Risk register – identifying risks and owners Identify key objectives Identify risks – i.e. what might stop you achieving the objectives Identify risk owners (should also be the owners of the objectives)

Risk register - scoring Score likelihood of occurrence and impact to give ‘raw risk’ List mitigating controls Re-score to give ‘residual risk’

Traffic light status 1 to 6 – Low (GREEN traffic light) 7 to 12 – Medium (GREEN or AMBER traffic light) 13 to 20 – High (AMBER or RED traffic light) Over 20 – Very high (RED traffic light)

Traffic light definitions GREEN: The risk is under control and represents no immediate threat or impact. AMBER: The risk has the potential to move to red. It needs managing and close monitoring but there is no immediate threat which would have a significant impact. RED: The risk requires active management. It poses an immediate threat and its impact would be significant.

Risk Appetite The amount and type of risk you are willing to take Risk Appetite labels Guidance on risk appetite

Warning signs Note any risk indicators, or warning signs

Hot off the press… New risk register template Detailed guidance for each section Risk Context Risk Appetite

Example risk register template What’s done well and what’s done poorly in this risk assessment?

01/12/2014 Local example Discussion about experience of risk management in the School of Biological Sciences: Judith Drinkwater, Departmental Administrator, Department of Veterinary Medicine

Observations from School, NSI and Department Risk Registers Key risks identified by some institutions missing from similar institutions’ registers Multiple owners Limited number of people reviewing risks/frequency of review Tweaks only Ranking

Internal Audit Survey 2017 results – best practice The resolution and mitigation of control gaps was an area of significant improvement with 92% of respondents indicating this happens at least most of the time, compared with 63% in prior year. Assessment of risk when new activities are undertaken was identified as a continually improving Departmental activity, with 63 respondents (89%) indicating that risks are assessed at least most of the time

Internal Audit Survey 2017 results – areas of development Local risk registers are noted as in place for the majority of Departments, however the regularity at which they are reviewed varies widely across the University. 42 respondents (58%) indicated that risk registers are reviewed by management at least every six months, compared with 25 respondents (34%) in 2015/16. Several Departments noted risk register reviews are conducted annually in line with their School planning timetable. An opportunity continues to exist to promote awareness of risk management practices, with only 35 respondents (48%) indicating that staff are always made aware of risk management practices within the Department. However, this is an improvement on prior year where only 30 respondents (41%) noted this always occurs. …How well embedded are our risk management practices?

Exercise In groups: Identify one or more risks in your local area 01/12/2014 Exercise In groups: Identify one or more risks in your local area Use one of these as your example Use the risk register template to talk through a risk analysis

Exercise feedback Review each group’s risk analysis Comments 01/12/2014 Exercise feedback Review each group’s risk analysis Comments

Final thoughts… All administrators manage risks Risk management supports achievement of objectives Risk management is a regulatory requirement Keep it simple Keep registers under review

Further information Risk Management web pages: 01/12/2014 Further information Risk Management web pages: http://www.registrarysoffice.admin.cam.ac.uk/audit-regulatory- compliance/risk-management Contact: clara.east@admin.cam.ac.uk or tel. (3)39662 For general information about University Governance see the Governance hub at https://www.governance.cam.ac.uk