Risk Management Procedure

Introduction

1.  The following sections provide guidance to Faculties, Divisions, SIDs and Departments on the procedure for identifying, managing, controlling and reviewing their risks and the production of risk registers using a standard format and terminology that allows alignment of Faculty, SID and Departmental risks using a common format.  This also provides for the escalation of risks to the appropriate level.

The Risk Management Cycle

2. The four fundamental steps of the risk management cycle are:

• Step 1: Risk Identification
• Step 2: Risk Measurement
• Step 3: Risk Mitigation
• Step 4: Review & Monitoring

Step 1: Risk Identification

3.  Senior managers are generally well aware of the opportunities and threats faced by their organisation.  However, these are not always recognised or understood by others in the organisation.  Consequently, the actions required to realise the opportunities and minimise the threats may not be implemented and monitored to best effect.  Additionally, there may be others within the organisation that may be aware of other opportunities or threats but are unsure or unable to raise them to an appropriate level.

4. After a decade of risk management at Imperial College the consistent feedback from departments is that openly sharing and discussing the known opportunities and threats at management meetings adds value by: 

• Identifying or clarifying opportunities and/or threats
• Clarifying generally known opportunities or threats such that ownership and control of the risk is clear.

5. Discussion of opportunities and threats during management meetings:

• Socialises the issues and gains buy-in from colleagues affected
• Gains agreement of the appropriate actions to address the issues to maximise the opportunities and minimise the threats. 
• Identifies who should undertake those actions and by when
• Allows monitoring of progress to mitigate the risk

6. It can thus be seen that the identification and mitigation of opportunities and threats is a normal management activity conducted both by individual managers and in conjunction with others during management meetings.  The explicit identification of those opportunities and threats allows them to be quantified and the efficacy of measures taken to manage them assessed.  During the planning round Departments naturally consider their strategic objectives and the resources and measures necessary to achieve them.  This is the essence of risk management and it is thus appropriate that risk registers are updated in conjunction with the planning round process.

Risk description
7. In describing risks, care should be taken to avoid simply stating the converse of the objectives, or identifying impacts that might arise as a result of the risk. A statement of risk should ideally encompass the cause of the impact and the impact on the objective. Please see the simple example below and consider whether or not they are risks.

Example

Objective: to travel by train from A to B and arrive for a meeting at a specified time.

8. Risks should be identified at a level where a specific impact can be identified and actions to address the risk can be determined. Once identified, risks should be assigned to an owner who is the person with the accountability and authority to be best placed to manage the risk and has responsibility for ensuring that the risk is properly managed and monitored.

9. The most effective means of identifying risks (both opportunities and threats) is to hold an open discussion with colleagues. This is best done in groups of a manageable size by department, section, business area or system and should typically consider the threats and opportunities associated with the Department/Group’s objectives.

10. Each activity performed (e.g. management process, research objective, experimental procedure) should be considered and the risks identified. Consideration in the following contexts may be helpful:

• Consider against College Risk Register and College Strategic Objectives
• Consider whether Faculty/Division/Department has responsibility for component parts of College/Faculty risks
• Opportunities and threats to achievement of Faculty/SID/Department objectives
• Open discussion of departmental/group opportunities and threats  with colleagues
• Examination of trends
• Analysis of last year’s problems/issues
• Awareness of new initiatives, agendas and regulations
• The impact of change of operating environment or processes
• Areas of Shared Risk (e.g. Joint ventures, supply chain, service providers)

The table below gives examples of categories in which it may be helpful to consider risk.

11. Each major risk identified should be recorded in Empirical

Step 2: Risk Measurement

12. The principles below apply to both opportunities and threats but the controls for an opportunity risk will be targeted at maximising the impact and increasing the likelihood that the opportunity is realised, whereas controls for a threat risk will be targeted at minimising the impact and reducing the likelihood that it is realised.

13. Open consideration of opportunities and threats has the potential to highlight a large number of risks of differing importance. As a result, it is necessary to score the risks in terms of Impact on the owning organisation, should the opportunity or threat be realised, and the Likelihood of the risk being realised. This enables the relative importance of each risk to be assessed and ranked.

14. It is important that the output of the risk assessment exercise is recorded in the College’s risk management tool Empirical

15. This allows a consistency of approach and definition that enables information to be gathered from any level of the College using common definitions and understanding.

16. It is probable that the uncontrolled (raw) risk will already have been mitigated, thus what is being assessed and recorded is the residual risk with some current controls already in place, and these controls should be recorded in Empirical

17. After consideration of the effectiveness of the current controls, risks should be Evaluated,
 on a 10 by 10 matrix in terms of:

1. The impact if the risk came about – what would be the consequence if the risk occurred?  The benefit or loss of the potential impact of the risk.
2. The likelihood (probability) of the risk occurring.

18. Truly objective assessment of risks is almost impossible and, although the tables below provide guidance, it is inevitable that assessment of the severity and likelihood is, in practice, subjective.  However, experience demonstrates that, with open discussion, over time there is a high degree of convergence and consistency of scoring. Remember, the objective of the score is to identify the most significant risks and assess the direction of travel (is the desired outcome improving or worsening) over time.  It is probably not helpful or value adding to be overly concerned as to whether the score is absolutely correct.

Assessment Criteria

19. The following tables propose criteria for assessing an appropriate score for an opportunity or threat.  The Objective Assessment Criteria provide guidance on the criteria for assessing risk.  There may be one or more impacts and the tables suggest possible criteria; it is only necessary for any one of the criteria at a particular level to be met.  In order to provide greater flexibility the 5 levels of impact are further subdivided.

Criteria for assessing Impact

20. Empirical will plot all risks on the matrix below and determine whether the risk is Red, Amber or Green

Level of Risk

Opportunity Risk

Score ranges:  Green = 64 and above; Amber  26 to 63; Red 0 to 25

Threat Risk

 Score ranges: Green = 0 to 25; Amber - 26 to 63; Red = 64 and above

21. Only Major risks need to be documented on the risk register. Major is defined as any Red or Amber Risk or any Green risk with an impact or likelihood score of 7 or above as this implies that either rigorous controls are required to manage the likelihood of a significant impact or there is an expectation of a significant number of minor events.

22. Risks then need to be addressed depending on:

These timescales apply unless something happens or changes that may affect the risk or its controls or if the risk is realised, in which case the situation needs review.

Step 3: Risk Mitigation:

Inherent Risk, Residual Risk

23. Inherent risk is the exposure arising from a specific risk before action has been taken to control (manage) it. Whereas residual risk is the exposure arising from an individual risk after action has been taken to reduce it to an acceptable level. For all practical purposes Risks identified on risk registers are considered to be residual risks; where some initial  controls are already in place.  In some circumstances these initial controls may be considered insufficient, in which case further controls will be required.

Risk Tolerance

24.  Unless terminated (we cease doing it!) it is not normally practicable to completely mitigate a risk.  It is normal that there is some possibility that a threat risk will come about or an opportunity risk will not be realised; the purpose of risk management is to reduce the consequence and/or likelihood of this occurring to an acceptable level. This ‘acceptable level’ is the level at which the risk is tolerated.

26. When considering opportunities, we need to consider how much resource we are prepared to expend  to obtain the benefits of the opportunity.  In considering threats we need to consider what appropriate mitigation should be in place to reduce the impact and/or the likelihood of the threat being realised.  This aids identification of our level of tolerance for each risk and it is helpful to attribute a score to this.  Opportunity risks below tolerance and threat risks above tolerance require further mitigation to move the risk to an acceptable level.

27. In considering an acceptable level of tolerance, risk owners should take account of the guidance provided in documents such as College financial regulations, procurement guidelines, health and safety regulations and by our ethical standards and policies as well as proportionality and value for money.

28. As discussed in Paragraphs 24 -27 above the tolerance for each risk will vary but as a general guide it is for consideration that opportunity risks might be tolerated at a score of above 64 and threat risks at a score below 25 but risk owners should vary these scores to take account of the actual circumstances pertaining.  For example it may be that some opportunity or threat risks are largely beyond their ability to directly control, (e.g. a change to government policy) resulting in a high tolerance score.

29. If an opportunity risk is scored at or above tolerance or a threat risk at or below tolerance then the controls currently in place are sufficient to manage the risk (i.e. actions already in place).

30. Opportunity risks assessed as being below tolerance or threat risks assessed as being above tolerance will need to be ‘Treated’ with further control measures to mitigate the risk. These should be recorded in Empirical and an action owner and timescale assigned to ensure the controls are implemented.  In order to ensure that action owners are aware of their responsibilities, Empirical will require the action owner to accept that they own the action.

Basic strategies

31. Treating or Controlling Risk It is usually possible to control a risk to an acceptable level and this is achieved by building control mechanisms into operational activities. Whichever strategy is adopted it is important that the controls are proportionate and cost effective. Where the decision is taken to mitigate a risk by introducing control measures it is also important that the operation is not impeded by over controlling in an attempt to completely eliminate a threat risk or realise an opportunity.

32. Transferring or sharing the Risk: Some risks can be transferred to another body or organisation e.g. insurance, contractual arrangements, outsourcing, partnerships etc.  Realistically, transferring all of a risk is extremely difficult to achieve effectively and is often confused with action ownership (where the risk is owned by entity A (who feels the pain if the risk comes about) but action to mitigate or control the risk lies with entity B.  If the risk is Transferred then care needs to be taken that the risk is actually transferred.  However, some risks (e.g. reputation) cannot be transferred.  It is important that how (to whom) the risk has been transferred. e.g. insurance, is recorded.

33. Tolerating or Accepting the Risk: It is rarely possible or economically desirable to remove all risks entirely and, unless Terminated, all risks will eventually be accepted at some level.  In addition, there are some risks over which we have little or no control and some for which any management actions would be prohibitive in terms of resource; yet for valid reasons we will continue with the activity. The important point is that these risks are identified, clearly understood and monitored.  This option is frequently accompanied by a contingency plan for dealing with the impact that will arise if the risk is realised.

34. Terminating or Avoiding the Risk: Although unusual, it may be that a particular risk cannot be adequately controlled or transferred and the consequence or likelihood of such a risk being realised is such that it cannot be accepted. In this case the only course of action may be to eliminate the risk by ending all or part of a particular activity.  In some instances this may involve temporary suspension of an activity until the likelihood and/or impact of the risk has reduced for external reasons.

Risk Owners

35. Every risk must have a nominated owner who is the person with the accountability and authority to be best placed to manage the risk. See RM Management Responsibilities: Risk Owner

Step 4: Review and Monitoring

36. Although the procedures and principles of both the College and Faculty/Department risk registers are similar their tempo varies due their differing drivers.  In the case of the College risk register the primary driver is to assure College Council, for the annual report of accounts, that the College is identifying and managing all material risks; whereas in the case of Faculties and Departments it is more appropriate that the risk register is updated in conjunction with the planning round, when departments are naturally considering the opportunities and threats they face.

College Risk Register

37. As identified the paragraph above, the College risk register requires updating prior to the annual report of accounts. Thus the College risk register needs to be updated, for consideration by the Risk Committee in October.

Review Process:

38. The review process commences in August with a Horizon Scanning meeting chaired by the College Secretary.  The meeting discusses any opportunities or threats that may have emerged since the last review and considers whether the previous risks are still appropriate.  The meeting also reviews whether the risk owners remain appropriate and whether the controls should be updated.

39. From this meeting a revised draft risk register is developed and reviewed by the President’s Executive Group, during September, who will also discuss each risk with the risk owners articulating their view as to whether the severity of the risk is improving or worsening, and whether the mitigations are sufficient. The outcome of this is then reviewed by the President’s Board and reported to the Risk Committee in October.

40. The revised College risk register will then be distributed to Heads of Department.

41. The College risk resister will also be reviewed by the President’s Executive Group and President’s Board in February/March each year.

 Faculty Department/SID Risk Registers

42. The value added by risk management has several dimensions. 

• Firstly, the open discussion of opportunities and threats and the controls required to best manage those enables wider understanding, ownership and management of these issue.  This is most effectively achieved by discussion during normal department meetings. 
• Secondly, the clear articulation of the opportunities and threats faced by the department and the controls required to manage those opportunities and threats allows easy and consistent delivery of these in a broad range of scenarios from say, visits by President, Provost or Faculty Dean to the role played by individual members of the department in contributing to departmental goals.
• Thirdly, analysis of opportunities and threats, by the risk management department, allows identification of common themes and potential systemic issues, which can then be appropriately addressed.
• Finally, the sharing of that information broadens the knowledge of the College as a whole and facilitates improved management of similar issues.

43. Department risk registers are not merely operational subordinates of the College risk register but are considerations of the strategic opportunities and threats at department level.  However, these may be informed by the College risk register which should be considered early during department’s consideration of opportunities and threats.

44. During the planning round process departments naturally consider their strategic opportunities and threats and it is thus appropriate that departments update their risk register in conjunction with the planning round process.  In order to identify common, systemic and emerging risks, Risk Management will extract all risks from Empirical six weeks after completion of the planning round for analysis and provide this to senior management three weeks later.

45. As some risks are dynamic and warrant updating more frequently than annually, the above process is repeated in November for analysis early in the New Year.