It’s Not How Big it is – It’s How You Use it!

Peter Andrews

Business Support Manager

Royal Borough of Windsor & Maidenhead

Three Questions

1. How do we asses our organisation’s general RM performance?

2. How do we compare that to other organisations?

3. How do we begin to measure the influence RM is having on service provision?

What does Mature RM look like?

And how far is my organisation away from that?

- We need an excellence model

Audit Commission Scoring

4• Formal identification of risks• Mapping of risks to internal

controls and to budgets and resource allocations

• Risk register, which is reviewed and updated

• Monitoring the effectiveness of the internal controls through key indicators

• Changing behaviour and resources allocation in response to clarifying risks

• Comparison with peer authorities• Involvement of members in

determining key risks and response

3• Formal identification of risks• Mapping of risks to internal

controls• Risk register in place which is

reviewed and updated• Monitoring the effectiveness of

the internal controls through key indicators

• Changing behaviour and resources allocation in response to clarifying risks.

• Involvement of members in determining key risks and response

Existing Models – The NHS Standard

The NHS Standard

STANDARD

An independently assured risk management system is in place that conforms to the principles contained in AS/NZS 4360:1999 and which meets NHS and other requirements in respect of managing risks, hazards, incidents, complaints and claims.

RISK MANAGEMENT

Self Assessment

RESPONSE % Board level responsibility for risk management is clearly defined and there are clear lines of individual accountability for managing risk throughout the organisation, leading to the Board. INFORMATION COMMENTS

CRITERION 1

Examples of Verification Risk management strategy has been

approved by the Board Job descriptions for executive directors and

senior managers Job descriptions for specialist risk

management advisers Risk management organisational chart Assurance Framework in place Terms of reference for the audit committee Minutes of the audit committee Terms of reference of the Board sub-

committee(s) responsible for overseeing risk management

Minutes of the Board sub-committee(s) responsible for overseeing risk management

Minutes of the Board Copies of correspondence or minutes of

meetings of the executive directors with responsibility for risk management

Audits/checks of compliance with risk management objectives, clinical and non-clinical

Risk Maturity Matrix – HMT Model Level 1 Awareness &

Understanding Level 2 Implementation planned & in progress

Level 3 Implementation in all key areas

Level 4 Embedded & improving

Level 5 Excellent capability established

Leadership: do senior management and Members support and promote risk management?

Top management are aware of need to manage uncertainty & risk and have made resources available to improve

Senior Managers & Members take the lead to ensure that approaches for addressing risk are being developed and implemented

Senior Managers act as role models to apply risk management consistently and thoroughly across the organisation

Top down commitment with embedding and integrating risk management as routine business practice

Senior Managers reinforce and sustain risk capability, organisational & business resilience and commitment to excellence. Leaders invited to speak at conferences about their success

Risk Strategy & Policies: Is there a clear risk strategy and risk policies?

Policies and strategies reviewed against risk principles

Risk management principles are reflected in the organisation's policies & strategies & communicated effectively

Risk policies & strategies are communicated effectively and made to work through a framework of processes

Risk handling is an inherent feature of all policies and strategy making processes

Risk management capability in policy & strategy making is reviewed and improved. Role model status

People: Are people equipped and supported to manage risk well?

Key people are aware of the need to assess and manage risks and they understand risk concepts and principles

Suitable guidance is available and a training programme has been implemented to develop risk capability

A core group of people have the skills & knowledge to manage risk effectively

People are encouraged and supported to be more innovative. Regular training is available for people to enhance their risk skills

All staff are risk aware and capable of using basic risk skills, tools & techniques

Partnerships & Resources: Are there effective arrangements for managing risks with partners and are there appropriate supporting resources?

Key people are aware of areas of potential risk with partnerships, suppliers and management of significant resources and understand the need to agree approaches to manage these risks

Approaches for addressing risk with partners and when managing assets and financial and other resources are being developed and implemented

Risk with partners is managed consistently for all key areas and across organisational boundaries

Sound governance arrangements established, partners & suppliers selected on basis of risk capability & compatibility

Information integrity and asset security are assured. Financial and other resources effectively managed. Organisation regarded as a role model

Processes: Do the organisation's processes incorporate effective risk management?

Some stand-alone risk processes have been identified

Recommended risk management processes are being developed

Risk management processes implemented in key areas. Risk capability self assessment tools used in some areas

Risk metrics are collected. Risk management standards applied in some areas

Management of risk & uncertainty is well integrated with all business processes. State of the art tools & methods are used. Selected as a benchmark site by other organisations

1. No evidence 2. Satisfactory 3. Good 4. Very good 5. Excellent Risk Handling: Are risks handled well?

No clear evidence that risk management is being effective

Limited evidence that Risk management is being effective in at least most relevant areas

Clear evidence that Risk management is being effective in all relevant areas

Very clear evidence that Risk management is being very effective in all areas

Excellent evidence that Risk management is being highly effective in all areas and improvement is being pursued

Outcomes: Does risk management contribute to achieving outcomes?

No clear evidence of improved outcomes

Limited evidence of improved outcome performance consistent with improved risk management

Clear evidence of significant improvements in outcome performance demonstrated by measures including, where relevant, stakeholders' perceptions

Very clear evidence of very significantly improved performance for all relevant outcomes and showing positive and sustained improvement

Excellent evidence of markedly improved outcome performance which compares favourably with other organisations employing best practice

Benchmarking - A Risk Maturity Matrix• Leadership: do senior management and Members

support and promote risk management? • Risk Strategy & Policies: Is there a clear risk

strategy, and risk policies? • People: Are people equipped and supported to

manage risk well? • Partnerships & Resources: Are there effective

arrangements for managing risks with partners and are there appropriate supporting resources?

• Processes: Do the organisation's processes incorporate effective risk management?

• Risk Handling: Are risks handled well? • Outcomes: Does risk management contribute to

achieving outcomes?

Performance Indicators & AlarmThe Cost of Risk

• External Insurance Premiums - Current Annual Cost• Annual Contribution to Insurance Fund - Average for past 3

years• External Claims Handling - Current Annual Cost• Internal Claims Handling - Current Annual Cost• Insurance Administration - Current Annual Cost• Departmental/Business Unit Excess Charges - Previous

Years Totals• Cost of Sickness - Previous Years Total• Health Retirement Costs Caused by Work Related Incidents

- Previous Years Totals• Risk Management Unit - Current Annual Cost• Risk Management Control Funding - Current Budget• External Consultancy Risk Management - Previous Years

Costs

Cost of Risk PI’s

• Cost of Risk Management Unit and Control Funding as a % of the total Cost of Risk

• Cost of Risk as a % of the Revenue Budget

• Cost of Risk per 1,000 Population• Cost of Risk per Full Time Equivalent

Employee

Risk Management PI’s• Cost of Risk Management as a % of the Total Cost of

Risk• Cost of Risk Management as a % of the Insurance Costs• Cost per Risk Management Day Provided• Cost of Risk Management per Claim Settled at 0• Cost of Risk Management per Claim Settled below £500• Cost of Risk Management by Variation in Reported

Claims Year on Year• Highways Slips/Trips Cost per Mile of Footpath Length• Highways Pothole Claims Cost per Mile of Road Length• Social Services EL Lifting Claims per FTE Employee• Social Services EL Lifting Claims by Number as a % of

Number of Reported Accidents

What do we want RM to achieve?

• Make better decisions

• Support improvement to services

Performance Measurement

What do we want to measure?

• Capabilities

• Results

Capabilities

• INPUTS• No. of staff actively involved in RM• % of staff/managers trained in period• No. of Risk Assessment workshops in period• No of positive responses to staff surveys• No of Members attending RM training courses

• OUTPUTS• %of Cabinet reports with Risk Assessment • % of services Risk Assessed• % of Risk Register reviewed in last quarter

Results

• OUTCOMES• Case Study Examples of good RM + successful

outcome or innovation due to RM• In projects – % of green traffic lights versus red• Performance of Corporate PI’s• Basket of Key PI’s