1. Risk Management Seminar
PPD
30 November 2017

2. Aims of risk management
01/12/2014
Aims of risk management
Department/Institution understands the risks to which it is exposed.
Risks are managed proactively and controls put in place.
Achievement of objectives is more likely

3. Some views of risk management
Health and Safety only
Preventing negative events
Documenting every single risk
Meaningless numbers
Filling out a risk register once a year

4. A better view of risk management
Makes you think ahead about what trying to achieve and how to ensure it happens.
Documenting risks makes you think them through and examine core assumptions.
Can be used as a tool for appraising key aspects of strategies and business plans.
It helps raise profile of concerns.
Helpful documentation for decision-making.
Fewer shocks and unwelcome surprises.
Helps seize opportunities that occur – positive risks

5. Definitions HEFCE’s definition of Risk:
“The threat or possibility that an action or event will adversely or beneficially affect an organisation's ability to achieve its objectives.”

6. Requirements
“HEIs must ensure that there are appropriate arrangements in place to promote effective risk management, control and governance”; this is a condition of the HEFCE grant.

7. Development of risk management practice
Growing area for organisations in all sectors (high profile cases: Co-op, BP, Enron)

8. Lack of understanding Negative attitudes Behaviours Process
01/12/2014
Common Obstacles
Lack of understanding
Negative attitudes
Behaviours
Process

9. What’s your experience?
Take the Risk Management Health-check!

10. Risk management at Cambridge
01/12/2014
Risk management at Cambridge
University
Risk Steering Committee and Key Risk Register
Risk owners present to Audit Committee
Risk emphasis in Internal Audit programme
Schools / Non-School institutions
Annual planning submissions to include risk register
Risk Steering Committee reviews registers
Faculties / Departments
Documented registers reviewed by School Councils
Projects
Key part of effective project management

11. Risk Steering Committee
Membership
Oversees the RM process as a whole, on behalf of Council
Twice yearly reviews of Key Risk Register
Annual review of School and NSI registers

12. University’s Key Risk Register

13. Risk register – identifying risks and owners
Identify key objectives
Identify risks – i.e. what might stop you achieving the objectives
Identify risk owners (should also be the owners of the objectives)

14. Risk register - scoring
Score likelihood of occurrence and impact to give ‘raw risk’
List mitigating controls
Re-score to give ‘residual risk’

15. Traffic light status 1 to 6 – Low (GREEN traffic light)
7 to 12 – Medium (GREEN or AMBER traffic light)
13 to 20 – High (AMBER or RED traffic light)
Over 20 – Very high (RED traffic light)

16. Traffic light definitions
GREEN:
The risk is under control and represents no immediate threat or impact.
AMBER:
The risk has the potential to move to red. It needs managing and close monitoring but there is no immediate threat which would have a significant impact.
RED:
The risk requires active management. It poses an immediate threat and its impact would be significant.

17. Risk Appetite The amount and type of risk you are willing to take
Risk Appetite labels
Guidance on risk appetite

18. Warning signs
Note any risk indicators, or warning signs

19. Hot off the press… New risk register template
Detailed guidance for each section
Risk Context
Risk Appetite

20. Example risk register template
What’s done well and what’s done poorly in this risk assessment?

21. 01/12/2014
Local example
Discussion about experience of risk management in the School of Biological Sciences: Judith Drinkwater, Departmental Administrator, Department of Veterinary Medicine

22. Observations from School, NSI and Department Risk Registers
Key risks identified by some institutions missing from similar institutions’ registers
Multiple owners
Limited number of people reviewing risks/frequency of review
Tweaks only
Ranking

23. Internal Audit Survey 2017 results – best practice
The resolution and mitigation of control gaps was an area of significant improvement with 92% of respondents indicating this happens at least most of the time, compared with 63% in prior year.
Assessment of risk when new activities are undertaken was identified as a continually improving Departmental activity, with 63 respondents (89%) indicating that risks are assessed at least most of the time

24. Internal Audit Survey 2017 results – areas of development
Local risk registers are noted as in place for the majority of Departments, however the regularity at which they are reviewed varies widely across the University. 42 respondents (58%) indicated that risk registers are reviewed by management at least every six months, compared with 25 respondents (34%) in 2015/16. Several Departments noted risk register reviews are conducted annually in line with their School planning timetable.
An opportunity continues to exist to promote awareness of risk management practices, with only 35 respondents (48%) indicating that staff are always made aware of risk management practices within the Department. However, this is an improvement on prior year where only 30 respondents (41%) noted this always occurs.
…How well embedded are our risk management practices?

25. Exercise In groups: Identify one or more risks in your local area
01/12/2014
Exercise
In groups:
Identify one or more risks in your local area
Use one of these as your example
Use the risk register template to talk through a risk analysis

26. Exercise feedback Review each group’s risk analysis Comments
01/12/2014
Exercise feedback
Review each group’s risk analysis
Comments

27. Final thoughts… All administrators manage risks
Risk management supports achievement of objectives
Risk management is a regulatory requirement
Keep it simple
Keep registers under review

28. Further information Risk Management web pages:
01/12/2014
Further information
Risk Management web pages:
compliance/risk-management
Contact: or tel. (3)39662
For general information about University Governance see the Governance hub at