Enterprise Risk Management in
DHHS
Erin Baker
Director Human Resources and Workplace Safety
Risk in DHHS: My roles and responsibilities
• Leader: Risk Project Steering Group
• Member of Departmental Executive: oversight of DHHS
enterprise risk management framework and strategic level
risk register; ownership of some strategic risks
• Manager: oversight of business unit risk register
• Mentor: through Risk Network – building a culture of risk
management
In DHHS we manage risk to:
• Increase likelihood of achieving objectives
• Improve quality of services
• Protect staff, assets, property and reputation
• Improve performance consistent with values
• Support better decision making
• Apply our resources more effectively
Where did it all start?
• Frank discussions about how much risk the organisation
wished to pursue
• Having the difficult conversations
• Senior executives stepping outside of their own portfolio and
thinking strategically across the organisation.
DHHS – a journey to risk maturity
1.
2.
3.
4.
What is an enterprise risk management system?
Why did we choose it?
How did we do it?
What are the learnings?
Enterprise risk management (ERM)
ERM supports the achievement of an organisation’s objectives by
addressing the full spectrum of its risks and managing the
combined impact of those risks as an interrelated risk profile.
Principles of ERM
• The same framework applies across, up and down the
organisation
• The framework is tailored to the organisation, owned by its
leaders and integrated into planning, policy and systems
• We know the risks that could impact on achieving our
objectives
• Senior management and governance committees have ‘line of
sight’ to those risks
DHHS ERM Governance Structure
Audit and Risk Committee
Secretary
Departmental
Executive
Groups
Business Units
Performance,
Finance and Risk
Committee
Why ERM for DHHS?
•
•
•
•
•
A ‘mixed business’ with a broad mandate
National health reforms
Framework no longer matched the organisation
Changes to the external environment
Improve our performance
How did we do it?
• Established a project
clear objectives, tight timeframe, plan, governance,
sponsor, dedicated project manager, access to resources
• Gained high level support by engaging leaders to:
– develop and endorse the risk framework
– assess strategic risks
– achieve a common language
– know our risks
Project Objectives
1.
2.
3.
4.
5.
Know our risk profile
Validate and communicate our risk profile
Establish a risk governance system
Develop a risk management culture
Integrate risk management with systems
Objective 1: Knowing our risks
•
•
•
•
DHHS needed an up-to-date risk profile
Criteria linked to strategic objectives
Risk assessment by executive
Produced an initial risk profile – top risks
Objective 2: Communicate and Consult
• Risk assessment workshops for senior management
• Produced a strategic risk profile and group profiles
• Value of communicating and consulting:
– Shared understanding
– Shared language
– Enhanced decision making
Objective 3: Governance System
•
•
•
•
•
Policy, Handbook, Tools
Reporting and escalation
Risk Activity Management Plan
Risk Network
Risk Appetite Statement
Objective 4: Build a Culture of Risk Management
•
•
•
•
Senior management buy-in
Communicate the value of ERM
Managers are key stakeholders
Risk Network – support, mentor, consult
Objective 5: Integrate Risk Management
• Align with business planning cycle
• Integrate policies and processes
What does it look like?
• Risk assessment criteria tailored to our organisation and
linked to our strategic objectives
• Reporting system linked to our ‘risk tolerance’
• Escalation of ‘high’ and ‘extreme’ risks for treatment and
oversight
What are the outcomes?
• Less surprises
• Better planning
• Better communication
• Better decisions
What are the learnings?
• IT systems always take longer than you think
• Know your requirements before you start
• Its OK to start with something simple
What are the next steps?
• Rolling out framework to business units, with support
of Risk Network
• Setting the risk appetite
• Rolling out risk treatment plans
• Automated risk register
• First year of full cycle – business planning, budget,
performance management
• It’s a journey!
Questions?