Page 1 Recording of this session via any media type is strictly prohibited. Page 1 Extended Enterprise Risk Managing Risk in Complex 21 st Century Organisations

Page 2 Recording of this session via any media type is strictly prohibited. Richard Anderson Chairman, Institute of Risk Management Carolyn Williams Technical Director, Institute of Risk Management

Page 3 Recording of this session via any media type is strictly prohibited. What to Expect An introduction to the Institute of Risk Management The context of the Institute’s thought leadership work An overview of the Institute’s current work on managing risk in complex organisations Some ideas on how to understand and approach your own complex organisation

Page 4 Recording of this session via any media type is strictly prohibited. “Are you a charlatan?” "someone who professes knowledge or expertise that they do not have"

Page 5 Recording of this session via any media type is strictly prohibited. What does a good risk manager need? Technical knowledge RM frameworks and processes, standards, techniques etc Sector knowledge Context and best practice RM in your sector Professional knowledge How other business functions operate and how RM interacts with them Organisational knowledge How your own organisation works, culture Self knowledge Communication skills, influencing, negotiating, questioning….

Page 6 Recording of this session via any media type is strictly prohibited. IRM Thought Leadership Focus o Enterprise risk management o Professional competence, qualifications and training o Emerging and potentially widespread risk o Interface between risk management and other disciplines

Page 7 Recording of this session via any media type is strictly prohibited. IRM Thought Leadership

Page 8 Recording of this session via any media type is strictly prohibited. IRM Thought Leadership

Page 9 Recording of this session via any media type is strictly prohibited.

Page 10 Recording of this session via any media type is strictly prohibited. Outcomes Joint endeavour Multiple Economic and Social Environments

Page 11 Recording of this session via any media type is strictly prohibited. Joint endeavour Multiple Economic and Social Environments Outcomes Principal contractor Agents Customer Supplier 1GovernmentSub contractor RegulatorSupplier 2Supplier 3RegulatorCloud IT provider Labour

Page 12 Recording of this session via any media type is strictly prohibited. Multiple Economic and Social Environments Outcomes Principal contractor Agents Customer Supplier 1 Government Sub contractor Regulator Supplier 2 Supplier 3 Regulator Cloud IT provider Labour Joint endeavour

Page 13 Recording of this session via any media type is strictly prohibited. Joint endeavour Multiple Economic and Social Environments Outcomes Principal contractor Agents Customer Supplier 1 Government Sub contractor Regulator Supplier 2 Supplier 3 Regulator Cloud IT provider Labour

Page 14 Recording of this session via any media type is strictly prohibited.

Page 15 Recording of this session via any media type is strictly prohibited.

Page 16 Recording of this session via any media type is strictly prohibited. © 2012 Centre for Health Enterprise 16 Complex systems A complex system is one in which even knowing everything there is to know about the system is not sufficient to predict precisely what will happen. Complex systems cannot be controlled – only influenced. Simple systems behave more like complex systems when under stress.

Page 17 Recording of this session via any media type is strictly prohibited. A complex system…..

Page 18 Recording of this session via any media type is strictly prohibited. 18

Page 19 Recording of this session via any media type is strictly prohibited. © 2012 Centre for Health Enterprise 19 Paradox: not susceptible to logical analysis Chaos & Paradox Volatility Uncertainty Complexity Ambiguity VUCA!

Page 20 Recording of this session via any media type is strictly prohibited. Managing in a world of complex risks “Cunning plans” have no place in managing complex risks Look for knowledge: either elsewhere or develop it yourselves Ground esoteric research in the fine detail of what you need for your organisation Leverage the expertise of others Share the risks and rewards

Page 21 Recording of this session via any media type is strictly prohibited. Single enterprise or joint endeavour?

Page 22 Recording of this session via any media type is strictly prohibited.

Page 23 Recording of this session via any media type is strictly prohibited. Creating order from disparate parts of the Risk Management world to be found in any organisation, let alone multiple organisations…

Page 24 Recording of this session via any media type is strictly prohibited. Outcomes Joint endeavour Multiple Economic and Social Environments The Social Dynamics of the extended enterprise Extent of Shared Values Allocation of Incentives Relative Power Regulatory Influence

Page 25 Recording of this session via any media type is strictly prohibited. What can we manage?

Page 26 Recording of this session via any media type is strictly prohibited.

Page 27 Recording of this session via any media type is strictly prohibited.

Page 28 Recording of this session via any media type is strictly prohibited.

Page 29 Recording of this session via any media type is strictly prohibited.

Page 30 Recording of this session via any media type is strictly prohibited. Assurance and the risk manager Scale of the problem: Simple  Them  Complex Nature of the issue Operational  Strategic Approach Tools for Risk Management  Conversations in risk

Page 31 Recording of this session via any media type is strictly prohibited. Two RM disciplines that need to be “extended” throughout the EE Risk Appetite and Tolerance Risk Culture

Page 32 Recording of this session via any media type is strictly prohibited. Risk Appetite Level Propensity to take risk Propensity to exercise control Strategic Tactical Project/ Operational Measurement Stakeholder Value Risk Metrics Control Metrics Risk Taking Exercising Control Delegation Escalation

Page 33 Recording of this session via any media type is strictly prohibited. So what does this mean in practice? A B t0t0 t1t1 Performance Time Current direction of travel for performance A B t0t0 t1t1 Performance Time Where you might get to if everything goes right D C Where you might get to if everything goes wrong A B t0t0 t1t1 Performance Time D C Risk Universe t0t0 t1t1 Performance Time Tolerance t0t0 t1t1 Performance Time Appetite

Page 34 Recording of this session via any media type is strictly prohibited. Six components

Page 35 Recording of this session via any media type is strictly prohibited. Risk Data

Page 36 Recording of this session via any media type is strictly prohibited. Risk Capability A function of 1.Capacity (how much you can carry?); and 2.Maturity (how much can your people cope?)

Page 37 Recording of this session via any media type is strictly prohibited. IRM Risk Culture Framework IRM’s risk culture framework looks at component parts making up an organisation’s risk culture How will I react? How will I respond in recognition of other competing needs? What will I do? What will we do? Our overall risk culture Risk Culture Organisational Culture Behaviours Personal Ethics Personal Predisposition to Risk

Page 38 Recording of this session via any media type is strictly prohibited. Risk culture aspects model Risk Culture Tone at the Top Risk Leadership Dealing with Bad News Governance Accountability Transparency Decisions Informed Risk Decisions Reward Competency Risk Resources Risk Skills With thanks to Alex Hindson

Page 39 Recording of this session via any media type is strictly prohibited. © 2012 Centre for Health Enterprise 39 Relationships & behaviours Draw on widely diverse perspectives Adopt open enquiring mindset Go out of your way to make connections Tasks & ideas Be Clear Be Curious Be Courageous Invest in promoting values Establish compelling vision Embrace uncertainty Distribute leadership & decisions Leadership in complex systems

Page 40 Recording of this session via any media type is strictly prohibited. Conversations in risk management You CEO EE Partners Suppliers Clients IP owner Back Office

Page 41 Recording of this session via any media type is strictly prohibited. Management campaign Take Stock Participants Common Purpose Relative Power Roles Values Rewards Culture Appetite Target Operating Model Rules of engagement Desired outcomes Governance Information sharing Risk Management Gap Analysis Shortfalls from TOM Route map to achievement Address information asymmetries Next steps Action Implement Check Implement Check Implement Check Assurance Confirmation Harvest benefits Share lessons Desired Outcomes

Page 42 Recording of this session via any media type is strictly prohibited. Some questions for the board How complex is our business operating model? What additional risks does complexity pose? Do we understand the risk tolerance associated with the complexity? How do we manage these risks? How do we get helpful risk information? How do we get sufficient assurance on our risk management investment?

Page 43 Recording of this session via any media type is strictly prohibited. We use our knowledge, skills and experience, combined with proven tools, techniques and approaches, which we leave behind for them to carry on using long after we have finished, to transform their business. As a consequence they will face the future with more familiarity, they will feel more confident about their current position and they will be organised to go forward into these uncertain futures. This means that we must work with our organisations to re- imagine how they manage themselves, to make sure that they know where they are on important matters and to be confident that they know how to address uncertain futures. I passionately believe that we can make uncertain futures much more manageable...

Page 44 Recording of this session via any media type is strictly prohibited. The bottom line

Page 45 Recording of this session via any media type is strictly prohibited. Next steps Consultation document available May 2014 Final version to be published September 2014 Executive summary/overview/questions for the board Concepts, governance and assurance Practical tools, techniques and case studies

Page 46 Recording of this session via any media type is strictly prohibited. Extended enterprise: Managing risk in complex 21 st Century organisations o Complex systems analysis o Shared value models o Innovation o Standards and assurance o Changing models in the public sector o Leadership v management o Risk management competencies o IT and the cloud o Communication and governance

Page 47 Recording of this session via any media type is strictly prohibited. For more information:

Page 48 Recording of this session via any media type is strictly prohibited. Please complete the session survey on the RIMS14 mobile application.