DOC

FSC Risk Management Process

By Jeanette Sanders,2014-12-17 18:58
6 views 0
FSC Risk Management Process

    Foundation Service Centre (FSC) Foundation Service Centre

     - Risk Management Process

    (Insert logo here)

    Foundation Service Centre

Foundation Service Centre (FSC) - Risk Management

    Process

    Draft Document v1.0

Author: Matt Sealby

    Owner: Andy Kirby

    Client: YHGfL

    Document Number: 26

    Document Version: d1.0

    Document Date: 19/05/2006

    108174087.doc; Page 1; of 12; 17/12/2010;

    Foundation Service Centre (FSC) Foundation Service Centre

     - Risk Management Process

Table of Contents

    1. Change Control Information .................................................................................................................. 2 1.1. Record of Changes ............................................................................................................................ 2 2. Introduction ............................................................................................................................................ 3 2.1. Nature of Risk .................................................................................................................................... 3 2.2. Scope ................................................................................................................................................ 3 2.3. Objectives .......................................................................................................................................... 3 2.4. Types of Risk ..................................................................................................................................... 4

    2.4.1. Strategic Risk ............................................................................................................................................ 4

    2.4.2. Programme / Project Risk .......................................................................................................................... 4

    2.4.3. Operational Risk........................................................................................................................................ 4 3. Risk Management Process .................................................................................................................... 5 3.1. Risk Identification .............................................................................................................................. 5

    3.1.1. Categorisation of risks ............................................................................................................................... 5 3.2. Risk Assessment ............................................................................................................................... 6 3.3. Risk Evaluation .................................................................................................................................. 7 3.4. Planning ............................................................................................................................................ 7

    3.4.1. Strategies and Plans ................................................................................................................................. 8 3.5. Management of Risks ........................................................................................................................ 8

    3.5.1. The Risk Manager ..................................................................................................................................... 8

    3.5.2. Risk Management Implementation Plan ..................................................................................................... 9

    3.5.3. Risk Reviews and Reporting ...................................................................................................................... 9

    3.5.4. The Risk Register ...................................................................................................................................... 9

    3.5.5. Closing a Risk ......................................................................................................................................... 10 4. Roles and Responsibilities .................................................................................................................. 11 5. Customer Risk Management ............................................................................................................... 11 6. Appendices........................................................................................................................................... 12 6.1. Appendix A - The Risk Management Process Flowchart ................................................................. 12

1. Change Control Information

1.1. Record of Changes

Release Revision Summary of Changes Changes

    No. Date Marked?

    No d1.0 19/05/2006 First draft

    108174087.doc; Page 2; of 12; 17/12/2010;

    Foundation Service Centre (FSC) Foundation Service Centre

     - Risk Management Process

2. Introduction

    Risk Management is used to identify, analyse, monitor and control risks to the successful outcome of the YHGfL objectives.

    The [Manager - decide who] has overall responsibility for risk management, including procedures that ensure that new risks are identified, captured and progressed, and that extant risks have owners and monitored action plans. A risk register containing details of the risks and plans for their ongoing management will be set up and maintained.

    Risk Management shall include all parties who have inputs to YHGfL, including YHGfL staff, LEA representatives and Supplier representatives.

2.1. Nature of Risk

    Risks are events which can occur at any time and which could adversely affect YHGfL’s objectives, i.e. increased costs, reduced quality of service and increasing numbers of Incidents.

    For individual risks there are opportunities to develop preventative strategies which reduce or eliminate the probability of the risk occurring, or which mitigate the impact of the risk should it occur. There are also opportunities to develop fallback strategies to be implemented should the risk occur. (Please refer to the FSC Service Continuity Plan [hyperlink/location].)

    Choosing to do nothing may be the best strategy in some instances. For example if a mitigating action costs too much, it might be neither sensible nor cost effective to deal with it.

2.2. Scope

    The Risk Management Framework covers YHGfL, the FSC and supported programmes and projects.

    Risk Management will increase awareness of risks across the YHGfL and ensure that appropriate strategies are in place well in advance of any risks occurring, and that the reasons for the selection of particular strategies are understood.

    The process and the approach to Risk Management are described in detail below.

2.3. Objectives

The objectives of Risk Management are to ensure that:

    ; All risks are identified and actions to counter or minimise them are put in place ; Risk Management actions are organised as an effective management plan across all

    YHGfL activities

    ; The overall risk to success diminishes progressively and rapidly

    ; Should a risk become an issue, that it is managed in such as way as to minimise the

    impact on YHGfL

    ; Prioritisation of individual risks is undertaken

2.4. Types of Risk

    108174087.doc; Page 3; of 12; 17/12/2010;

    Foundation Service Centre (FSC) Foundation Service Centre

     - Risk Management Process

There are three broad types of risk:

; Strategic

    ; Programme / Project

    ; Operational

    Where partners and / or suppliers are involved it's essential to have shared understanding of risks and agreed plans for managing them.

2.4.1. Strategic Risk

    This covers threats to the overall success of YHGfL, including its ability to deliver services to its Customers.

2.4.2. Programme / Project Risk

    This is the collection of threats to the management of the programme or project and hence to the achievement of the programme or project objectives within cost and time. These are usually dealt with at the Programme or Project level and it is likely that the Programme or Project Manager will manage these on a day-to-day basis. However, if there is a risk identified within a programme or project that has an impact outside of it, it must be escalated to the YHGfL risk register.

2.4.3. Operational Risk

    This covers ongoing risk to service delivery, which could include anything from major disaster to minor technical breakdown. Nominated risk owners manage these risks on a day-to-day basis.

    108174087.doc; Page 4; of 12; 17/12/2010;

    Foundation Service Centre (FSC) Foundation Service Centre

     - Risk Management Process

3. Risk Management Process

    The Risk Management process comprises five main steps. These are performed as an ongoing activity.

; Identification and documentation of potential risks

    ; Assessment of risks

    ; Evaluation of risks

    ; Planning. This includes the preparation and implementation of risk prevention, mitigation

    and fallback strategies

    ; Management of risks, including monitoring, reviewing and closing risks

    These steps are part of an iterative process and are described more fully in the sections below.

3.1. Risk Identification

    The risks that might impact upon YHGfL may be identified via the various reports and meetings, which occur as part of normal Service Management activities. All parties within YHGfL are responsible for the identification and management of risk, and experience drawn from previous projects should be applied. Specific techniques such as brainstorming may also be used.

    Risks can be found in any area of YHGfL activities and at any point in the lifetime of projects that it is involved with.

    At the end of this process, there should be a list of most or all of the risks currently facing YHGfL or likely to face it in the near future.

3.1.1. Categorisation of risks

    Assigning risks to a category can be useful in deciding the appropriate areas within YHGfL for the ownership and management of risks. Categorisation should be flexible and should match the requirements of YHGfL. They may include some or all of the following:

    Category Description

    Infrastructure Relating to computer networks, and power supply systems.

    Economic Relating to economic factors such as interest rates, exchange

    rates, inflation.

    Legal & Regulatory Relating to regulatory legislation (e.g. RIPA).

    Political Relating to possible political constraints.

    Financial Relating to the availability of finance or the allocation of

    financial resources.

    Fraud or theft Relating to unproductive loss of resources.

    Policy Relating to the appropriateness and quality of policy decisions.

    Reputation Relating to the reputation of YHGfL and consequential effects.

    Technology Relating to the use of technology.

    Cultural Relating to the ability to make a cultural change within YHGfL.

    Governance Relating to programme or project procedures and controls.

    Benefits Management Relating to the achievement of benefits.

    Resource Management Relating to the availability of people, skills and accommodation.

    Customer Relationships Relating to external partners and customers.

    108174087.doc; Page 5; of 12; 17/12/2010;

    Foundation Service Centre (FSC) Foundation Service Centre

     - Risk Management Process

    It is essential that the captured risks be matched, wherever possible, against the activities being undertaken to deliver services. This allows meaningful impact assessments to be performed and assists in improving the accuracy of assessments.

3.2. Risk Assessment

    Not all risks should be treated equally. When a risk has been identified, it must be assessed to determine:

; Its possible causes

    ; The probability of it occurring and expected outcomes

    ; The impact should it occur

    ; Its relationship to other risks and its ability to set off a ‘chain-reaction’ of other issues. For

    example, losing a member of a development team can lead to a chain reaction including

    work delays and cost overruns

    Risks are firstly assessed based on the probability that they will occur and the impact should they occur. The assessment relies upon the expert judgement of YHGfL staff and past experience from similar projects.

The Probability of a risk occurring is expressed as:

Likelihood Rating Likelihood Description

    High (H) Risk is more likely to occur than not: 50%-80% probability

    Medium (M) The risk may occur: 20%-50% probability

    Low (L) The risk is unlikely to occur: Less than 20% probability

    If the risk is assessed as having a probability of greater then 80%, then it should be treated as a certainty and not a risk, added to the Service Plan and the appropriate action taken.

The Impact of a risk should it occur is expressed as:

Impact Rating Impact Description

    High (H) Significant timescale, cost or performance / SLA difficulties

    Medium (M) Affects target timescales, costs or performance / SLAs

    Low (L) Minimal impact

    The overall risk rating or risk severity is determined by combining the probability with the impact, as shown below.

Overall Risk Probability

    Rating (Severity) Low Medium High

    Low 3 3 2

    Impact Medium 3 2 1

    High 2 1 1

    ; For severity 1 risks a mitigation strategy and fallback / contingency plan are required. ; For severity 2 risks a mitigation strategy is required.

    ; For severity 3 risks a monthly review of the risk is required.

    108174087.doc; Page 6; of 12; 17/12/2010;

    Foundation Service Centre (FSC) Foundation Service Centre

     - Risk Management Process

The priority of each risk is documented in the Risk Register.

    The frequency of overall risk rating on the above matrix can be increased or reduced according to YHGfL requirements. For example it could be decided that only risks assessed as being High probability and High impact should have an overall severity rating of 1.

3.3. Risk Evaluation

    Rank each risk according to its potential impact on YHGfL and then assess each risk to determine its level of acceptability. A potential problem becomes a more critical risk for one or both of two reasons:

1. The problem is more likely to occur than other problems. For example, feature

    creep is more likely to cause problems in a development project than a faulty

    compiler.

    2. The problem will cause more disruption than other problems if it does occur.

    For example, losing email messages is generally more critical than slow email.

    At the end of the evaluation the following should be documented in the risk register:

    ; The outcome of the risk assessment and evaluation process for each risk added ; The risks that require active, or more active, management

    ; For each risk, the amount of disruption to YHGfL should it occur

3.4. Planning

    Risk management plans help reduce, contain, and control risks in a cost-effective and efficient manner. Planning and resources should be concentrated on the most critical risks. Each strategy to manage risk should also have a contingency plan in the event the original strategy does not work.

    Typically there are four types of strategy adopted in the reduction of risk. These may be deployed in any combination.

Transfer to a third party (e.g. Supplier)

    Avoid In situations where the risk is largely with a Customer for example, it

    is possible to avoid it

    Mitigate reducing impact and / probability by, for example:

     redefine scope or requirements

     modify plans to break dependencies or introduce contingency

     re-negotiate performance criteria

     limit through contract

     introduce additional activities or expertise

     remove unreliable supplier

     insure

    Absorb accept the risk

    For each risk, the strategy must be decided, an owner identified and the necessary actions agreed and then put into effect. It is important to ensure that the full cost of risk reduction measures are understood and included in any financial planning. This cost must be compared to the estimated risk value and a judgement made on the merits of trying to avoid the risks impact.

    108174087.doc; Page 7; of 12; 17/12/2010;

    Foundation Service Centre (FSC) Foundation Service Centre

     - Risk Management Process

    When a viable risk reduction strategy is agreed and the plans and budgets have been adjusted, the probability and impact figures may be reduced accordingly. However, where a rdrd party is involved and the risk is to be transferred or avoided, its acceptance by the 3 3rdparty should not be assumed. Until the 3 party has accepted the risk, the impact of the risk to YHGfL should not be reduced.

3.4.1. Strategies and Plans

    When risks have been assessed and evaluated, the risk owner shall develop plans to contain and manage them. Several approaches are possible:

    ; It may be possible to modify the affected activity in order to eliminate or reduce the risk

    while maintaining the objectives. This possibility is always to be favoured and should be

    examined rigorously for Priority 1 and 2 risks.

    ; Where the risk is irreducible, it may be possible either to modify the requirement or

    subject the activity to closer monitoring and control.

    ; Where risks remain, an acceptable balance should be sought between the effect on cost

    and schedule on the one hand, and YHGfL objectives on the other. To achieve this, it

    may be necessary to reallocate resources between tasks or consider the use of

    alternative techniques and strategies.

    ; For Priority 2 and 3 risks, provided that the risk or the proposed corrective action do not

    imply failure to maintain service levels, then awareness of the risk and closer monitoring

    may be adequate.

    Once confirmed, the prevention, mitigation and fallback strategies for each risk, together with the trigger criteria for the fallback strategy, shall be documented in the risk register. The YHGfL Management Team should incorporate preventative and mitigation actions in the service plans.

3.5. Management of Risks

    As risks change through time the Risk Register must be continually monitored, reviewed, and updated. New risks may be identified as more information becomes available. Existing risks may be eliminated through the effectiveness of the risk management actions or be updated as new information becomes available. Risk owners are responsible for monitoring their own risks between reviews.

3.5.1. The Risk Manager

    It is the responsibility of the YHGfL Risk Manager to manage and coordinate all risk management activities. The Risk Manager's objectives are to:

; Reduce the total risk ownership of YHGfL.

    ; Monitor risk exposure and report on it as required.

In order to do this the Risk Manager must:

; Ensure that the Risk Register is set up and maintained

    ; Ensure that risk management actions are integrated into YHGfL service planning,

    including finances

    ; Ensure that risk owners are managing their allocated risks effectively ; Ensure that processes are in place to capture new risks

    108174087.doc; Page 8; of 12; 17/12/2010;

    Foundation Service Centre (FSC) Foundation Service Centre

     - Risk Management Process

; Authorise risk closure

    The Risk Manager does not set the impact or probability, but may assign an overall severity based on these values.

    Where there is a dispute over impact, probability or overall severity, the Risk Manager should log this dispute and escalate to the YHGfL Management Team.

3.5.2. Risk Management Implementation Plan

The Risk Management Implementation Plan must contain:

    ; A definition of the process by which risks are identified, submitted, assessed, evaluated,

    planned and managed throughout their lifetime

    ; A list of the YHGfL risk owners

    ; An overview of the workshops or meetings to be undertaken in support of risk

    management

    ; A list of standard risk management documents / templates to be used and where they

    are located

    ; Details of any training required in support of risk management

    ; Details of how risk management will be launched within YHGfL

    ; A plan for the collection of existing risks

    ; The risk register

    ; An overall status summary of the risk facing YHGfL. This can be expressed in any

    number of ways, including Red, Amber, Green (RAG rating), or High, Medium, Low.

It should also provide:

    ; The structure of the risk register (this is particularly important if a nested structure is

    adopted, with parts of the risk register being decomposed for close management) ; Details of tools and techniques to be used in support of the risk management process ; Details of the review and reporting cycle

3.5.3. Risk Reviews and Reporting

    The Risk Manager will issue a monthly risk report to the YHGfL Management Team.

    The Risk Review Board will meet monthly to review the risk report and the risk register, and recommend any additional action to be taken in support of individual risks, or changes to actions currently being taken.

    As part of the risk assessment and evaluation phases, the Risk Manager will circulate risks identified as being severity 1 to the YHGfL Management Team.

3.5.4. The Risk Register

    The Risk Register lists all the identified risks, the results of their analysis and evaluation, and information on managing them. Information on the status of the risk is also included.

    New risks should be added to the Risk Register as soon as they are identified.

    The risk register includes some or all of the following fields for each risk:

    108174087.doc; Page 9; of 12; 17/12/2010;

    Foundation Service Centre (FSC) Foundation Service Centre

     - Risk Management Process

Field Name Notes

    Risk ID A unique reference within the register.

    Date Raised The date the risk was raised.

    Date Last Reviewed The last time the risk was reviewed.

    Date Closed The date the risk was closed.

    Risk Title The title of the risk.

    Revision Number A number denoting the version of the risk. This number

    will be incremented each time action tracking

    information is added to the risk.

    Risk Description The description of the risk.

    Impact Description Description of the impact the risk's occurrence may

    have.

    Possible Causes Provide a brief list of the possible causes of the risk.

    Associated Risks Refer to any other risks to which the risk is linked.

    Owner (individual) The named individual responsible for managing an

    individual risk for YHGfL or for monitoring a risk which

    is owned by another organisation. The named

    individual must be appropriately empowered to

    manage the risk effectively.

    Probability Rating The probability of the risk occurring; High, Medium or

    Low.

    Impact Rating The impact of the risk should it occur; High, Medium or

    Low.

    Overall Risk (Severity) The overall severity of the risk based upon its

    Rating probability and impact scores.

    Trigger Event The event that will trigger the risk and turn it into an

    issue.

    Mitigating Action or Risk Summary of the strategy to reduce probability or Management Strategy impact of risk.

    ; If a risk is to be transfered - to whom?

    ; If a risk is to be avoided - how?

    ; If a risk is to be mitigated - how?

    ; If a risk is to be absorbed - why?

    Fallback or Contingency Strategies to be adopted if the planned mitigating Plans actions fail or cannot be executed.

    Status 'Open' or 'Closed' (Closed risks are retianed for audit

    purposes).

    Action Tracking Review Current status, current assessment, actions Notes completed, results achieved, actions in hand, actions

    planned.

    Risk Category The category of the risk within the register.

3.5.5. Closing a Risk

Risks are cleared when the risk owner recommends closure of a risk and the YHGfL

    Management Team is satisfied that the circumstances of the risk no longer apply.

Closed risks will be identified as closed for one month, and then will be removed from the

    main Risk Register and archived.

4. Roles and Responsibilities

    108174087.doc; Page 10; of 12; 17/12/2010;

Report this document

For any questions or suggestions please email
cust-service@docsford.com