1. Confidence in Managing Risk
Monday 8 November
Alan Ross - Zurich Risk Management

2. Key to Effective Risk Management
Keep the process simple
Use your purpose, mission or strategic objectives as a starting point; which risks will stop you achieving?
Focus on the biggest most significant risks; not everything & anything that might go wrong
Involve as many people, voices & opinions in your risk register as is practical
Think about risk early on when thinking about innovative projects or partnerships
Discuss your risks regularly and feel confident to challenge the risks, their score & controls in place

4. Risk Register Template
No.
Cause
Effect
Controls
Risk Rating
Action Required
Direction of
Travel
Risk Owner 1
Loss of sensitive data due to poor ICT controls
Impact on data subjects
Fines
Damage to reputation
Firewall
Pen testing
Staff training
Info governance policy 25
(High)
Review ICT security ↗
IT Manager

5. Risk Management

6. Risk Appetite Descriptions
Example Organisational Behaviours
Risk Averse
Preference is for ultra-safe actions that will not result in a loss of reputation or credibility
Innovation is avoided unless it’s forced upon us
All reasonable steps will be taken to manage the risk; prepared to be bureaucratic and tightly control processes
Avoid any action that could lead to a legal challenge or breach of regulatory framework
Cautious
Preference is for actions that are unlikely to result in a loss of reputation or credibility
Innovation is generally avoided, and will only be entered into if all stakeholders are committed, and success is virtually guaranteed
Prepared to accept the possibility of only limited financial loss
Open
Willing to stick our neck out and risk our reputation but only if steps have been taken to reduce the risk
Innovation is supported, but only if clear benefits are demonstrated and we are confident in our success
Prepared to invest for reward and accept moderate financial losses are possible
The likelihood of this risk happening and the consequences are such that we’re happy to live with it
Hungry
Willing to accept increased scrutiny from stakeholders and a loss of credibility if things go wrong
Innovation is pursued, we are willing to break the mould to deliver organisational goals even if failure is a possibility
Prepared to invest knowing significant financial losses are possible, or that innovation may fail to deliver the anticipated benefits

7. Appetite for Different Risk Types
Description
Reputation
Cautious to Open
Financial
HR – Capability & Capacity
Cautious
HR – Safety
Risk Averse
Regulatory / Compliance
Environmental
Risk Averse to Cautious
Performance
IT & Infrastructure
Innovation

8. Questions (1)
Is the external environment regularly monitored, and by whom?
Are risks and controls reviewed frequently enough?
Is risk embedded within regular reporting routines? How does risk information get reported to trustees?
How often are risks being reviewed and reported on?
Who is responsible for reporting risks?
What are the most significant 3 or 5 risks surrounding a decision and can they be controlled?
Have staff considered all of the significant risks when recommending a decision?
Do risk controls seem appropriate for the level of risk? How good have we been at managing these risks in the past?
C:\Documents and Settings\chy5484\Local Settings\Application Data\Office\Macros\Ppt_ci\Templates\Pres_blue_on_white.pot
1/18/2019

9. Questions (2)
Are risks managed in line with your organisation's appetite, attitude or tolerance for risk?
Do colleagues fully appreciate the impact the risk will have should it happen? Has appropriate analysis been undertaken or specialist advice sought if appropriate?
How do we know our controls are working?
Does the assessment of the risk seem to be optimistic or pessimistic?
Is the risk assessment based on clear data or have staff had to use their judgment (neither of these is necessarily better than the other; both methods can be flawed)?
Who completed the risk analysis, an individual or a group?
If partners or 3rd parties have a role to play in managing a risk are you confident they will deliver?
C:\Documents and Settings\chy5484\Local Settings\Application Data\Office\Macros\Ppt_ci\Templates\Pres_blue_on_white.pot
1/18/2019