NDIA Accountability Project

This project is in DRAFT

Risk Management Trial Site Workshop

‹ PrevPage 1 of 15 · Source p. 12Next ›

Risk Management

Trial Site Workshop

[redacted — s22(1)(a)(ii)]

Page 238 of 292

Session Outline

  • Overview - 30 mins
  • Workshop - 90 mins

What is Risk?

“Risk is the effect of uncertainty on objectives”

AS/NZS ISO31000:2009

Page 240 of 292

WIIFM??

  • Enable you to make risk informed management decisions
  • Assist planning and implementation of full scheme rollout in Tasmania
  • Ops Division can understand risks and direct activities to address either common risks across trial sites or a significant risk for a trial site.

Types of Risk

  • Strategic Risk
  • Operational Risk
  • Financial Risk
  • Security Risk
  • Safety Risk
  • Project Risk
  • Compliance Risk
  • Reputational Risk

A risk is a risk is a risk — the only thing that differs is the context

Page 242 of 292

Risk v Issues

  • Issue Management (Today)

    1. Reactive
    2. Limited options
    3. Consumes more effort that risk management

  • Risk Management (Tomorrow)

    1. Focuses on future events
    2. Proactive, disciplined
    3. Reduces decision making uncertainty
    4. Increases potential mitigation options

Page 243 of 292

Risk Identification

  • Where to start??

  • Focused on identifying:

    • What can happen (events/incidents)
    • What the causes would be
    • What the consequences would be if the risk eventuates
    • What controls do we currently have in place and how effective are they

  • Remember — risks are potential events and need to be captured as such

Risk Identification

• A convenient way to capture risk is to consider Risk Breakdown Categories based upon activities:

  • Service Delivery — assessment & planning

  • Engagement and Funding — participants, providers, sector, broader community, finance

  • Administration and Support — staffing, accommodation, IT

Risk Identification

  • Remember:
    • Need to be specific; not broad statements (e.g. ‘not meeting bilateral targets’)
    • Causes are not risks (e.g. ‘lack of planners’)
    • Consequences are not risks (e.g. ‘State gov’t loses confidence in the Agency’)

Risk Assessment

  • The Agency has a risk matrix in place to assist in assessing the Likelihood of a risk occurring and the Consequences of the risk if realised

  • Simply, risk likelihood is the chance of a risk being realised given the controls are in place

  • Basically, risk consequences are what will happen if the risk is realised.

  • Likelihood and Consequence ratings are used to calculate the Overall Impact of the risk.

Risk Treatment Strategies

  • Avoid (i.e. avoid the event leading to a risk)
  • Mitigate (develop a plan to reduce likelihood and/or consequences)
  • Share (share risk with another party)
  • Retain (accept the risk)

The NDIA’s risk guidance material provides guidance on when risks can be retained or when impacts need to be reduced

Risk Management Plan

  • Assess current activities such as documents, policies and systems to manage the risk (‘controls’)

  • Consider what new activities, if any, need to be implemented to manage the risk (‘treatments’)

  • Capture the ‘who’, ‘what’ and ‘when’.

Activity

• We will now work through your risks by: • Agreeing on a risk breakdown structure • Identifying your risks • Identify plans for these risks

Next steps

  • Have an updated register completed by end of March

  • Your risk champion will update your site’s risk register on a quarterly basis in partnership with the Risk and Assurance team.

  • [redacted — s22(1)(a)(ii)] Operation Division’s risk champion will use these to inform the division’s risks

Page 251 of 292

Thanks

  • Thanks for your attendance
  • Please feel free to contact us if you have any questions