EEA and Norway Grants
Programme risk management
Inger K. Stoll, Head of Communication, Reporting and
Evaluation, Financial Mechanism Office
March 2013
1
Results and risks
What is Results Based
Management (RBM)
RBM is a management strategy
by which all actors,
contributing directly or
indirectly to achieving a set of
results, ensure that their
processes, products and
services contribute to the
achievement of desired results
(outputs, outcomes and
impact)
What is a result and a risk?
In the context of the Grants:
A result is the output,
outcome or impact of a
development intervention
A risk is an event that may
occur and impede the
objective
2
KEY CONCEPTS
Results achievement
Beneficiary oriented
Managing for results and reduced risks
3
Risks
• Risks are an expression of uncertainty
• Risks are events that may occur, and if they occur,
have harmful or negative effects on the achievement
of results
• Risks are closely related to the results and should
consequently be analysed against the results
framework of a programme
• Risk analyses strengthen the basis for choosing
realistic objectives and level of ambitions
4
Risk management
process in 11 steps
Establish strategy and processes
1. Develop a strategy for integrating risk
management in results management
2. Establish risk leadership integrated in results
management
Analysis, actions and follow-up on several
levels
3. Identify objectives
4. Identify critical success factors
(assumptions)
5
Risk management
process in 11steps
5. Identify risks
6. Assess and prioritise the risks, in terms of
likelihood and consequence; high – medium – low
7. Decide risk tolerance
8. Define and assess risk response
9. Response to residual risk
6
10. Mitigate and manage risks
11. Dialogue and Report
FMO’s risk management strategy :
http://www.eeagrants.org/
7
Risk management
levels
Total Grants
Country
Programme
Projects
Risk strategy at each level, according to roles and responsibilities
8
Steps 1 & 2: Establish risk
strategy and leadership
• Risk management system in place
• Programme Operator must actively take
leadership at programme and project levels
• Assign roles at each level
• Also keep an eye on national level risks, and
mitigate where possible
9
Step 3: Identify objectives
at all levels, example
Objective (impact)
Widespread improvements in societ or a sector
Gender equality and work-life balance promoted
Outcome(s)
Intermediate effects on target groups and systems
Gender pay gap reduced
Outputs
Products and services delivered
1. Wage negotiations are gender sensitive. 2. Training is carried out.
Activities
Tasks transforming inputs to outputs.
1. Present statistics on gender wage differences
2. Train trade unions and employers associations in g. pay gap reduction
Inputs
Financial, human and material resources
Budget: X € , Input from DPP (y people z €), Resources from local institutions
10
Step 3. Identify objectives at
all levels
Example – Renewable Energy
Objective (pre-defined)
Expected outcome(s)
(pre-defined)
Outputs
More energy
efficient RES in
place
Types of
projects
•Modernised
RES
infrastructure
•R&D on RES
•Feasibility of
RES mapped out
in relation to
local conditions
Increased share of
renewable energy in
energy use
Increased awareness of and
education in renewable
energy solutions
Increased renewable
energy production
X policies at local
and regional level
to stimulate RES
developed
•Training in RES
planning
competence
•Plans/policy
development
100 MW capacity
RES constructed
and in operation
•Windmills
•Solar systems
•Hydropower
•Bioenergy
X awareness
raising
programmes at
local level
carried through
X training courses in
RES provided to
officials at local and
regional level
•Awareness
raising
campaigns at
local level
•Training
courses for
officials at
regional level
•Train the
trainers
•Training
courses for
officials at
regional level
11
Step 4: Identify assumptions
• Assumptions are the necessary positive
conditions that allow for a succesful
cause-and-effect relationship between
the different levels of results.
• Assumptions are critical success factors.
• Assumptions are formulated after the
objectives, to ensure results chain
realism
12
Step 4: Identify assumptions
at all levels
Objective (impact)
Widespread improvements
in society or a sector
Assumptions
Outcome(s)
Intermediate effects on
target groups and systems
Assumptions
Outputs
Products and services
delivered
Assumptions
Activities
Tasks transforming inputs
to outputs
Assumptions
Inputs
Financial, human and
material resources
Assumptions
13
Step 4: Assumptions
An example
• Outcome: Participation
in local election
increases from 63% in
2012 to 75% in 2016.
• Output: Voters
registration increases
from 70% in 2012 to
90% in 2016.
• Assumption: Voting
centres are operational
and in place on voting
day.
14
Step 5: Identify risks
• Risk identification is done in all phases of a
programme, but early identification gives the
best effect.
• Normally requires several contributers.
• If a critical assumption is likely to occur but
not certain, it may represent a risk.
• Risks are expressed as negative statements in
relation to achievement of the desired result.
15
Step 5. Risk identification
• Identify the risk, monitor, manage and try to
influence. A risk register can be useful.
• There might be a perceived conflict of interest
regarding sharing information of risks.
• Keep in mind: Always document your risk
identification, analysis and mitigation
16
Identification of a risk
An example
Impact (Objective)
Assumptions
Risks
Voting centres are
operational and with all
logicistics in place
on voting day.
Voting material is not
available in all local
languages.
Outcome
Participation in local
election increases from
63% in 2012 to 75% in
2016.
Output
Voters registration
increases from 70% in 2012
to 90% in 2016.
Activities
Inputs
17
Risk categories
It is common to group the risks in categories.
FMO uses nine broad risk categories:
• Policy and politics
• Governance: Institutional, management,
transparency and accountability
• Corruption and procurement issues
• Socio-cultural and gender equity,
minorities, Roma, rights and values
18
Risk categories
•
•
•
•
•
Financial issues
Economic issues
Environmental and climate issues
Technical and technological issues
Role of DPPs and project partners
NB – Other risk categories are also relevant
19
Risk dimensions
Each risk category consists of certain risk dimensions
Example Governance category:
• Adequate competence and capacity is not
available
• Supportive legal framework conditions are not
in place
• The control systems are not sufficient
20
Step 6: Assess and prioritise
the risks
A risk analysis contains an assessment of the
risks in terms of
• Probability or likelihood of the occurence of
the risks
• Consequences or impact if the event occurs
The risk assessment is a forward-looking
exercise; it should take into account the whole
agreement period - and beyond - to ensure
sustainability of the results
21
Risk probability and consequence
22
Risk Analysis
Medium
“Black Swan”
Low
Probability
High
High risk
Killer assumption
Low
Medium
High
Consequence
23
Narrative risk summary
• The risk rating is accompanied by a narrative
assessment highlighting the major risks
identified.
• All the high or substantial risk ratings are
named as major risks
Keep in mind: Distinguish probability and
consequence
24
Step 7: Risk tolerance levels
Risks are inevitable.
It is not an aim to avoid risks at all costs.
A higher risk may be acceptable in contexts
where the expected impact and benefits
are higher than the potential risks.
25
7. Risk tolerance
• Decide and document what level of risk you
accept
• Communicate the risk appetite
26
8. Define and assess
risk response
• Identify mitigating actions (including
conrols) and assess their impact
• Decide on mitigating actions
• Re-assess to conclude on residual risk
27
Step 9: Response to
residual risk
• Decisions regarding tolerance of major
residual risks can be divided in the folllowing
strategies:
Avoid/terminate: Redesign programme or
terminate the programme or parts of it.
Transfer/share: Share risk with other
partners (ex DPPs) or pass the impact of
the risk to third part (e.g. via an
insurance policy)
28
9. Response to residual risk…
Accept/tolerate: Accept the risks without any
mitigating actions, but monitor and
manage if the risk level increases
29
Step 10: Mitigate and manage risks
• Reduce, prevent, mitigate
• Establish a system for risk monitoring and
handling.
• During implementation it is good practice to
incorporate the mitigating measures in the
regular work plan of the programme or
projects, assign staff members responsible for
actions and resources required.
30
Mitigation and management
• Assess the implementation progress of the
mitigating measures, manage and report.
• Identify any new risks or changes in
circumstances and add to your risk registry
and work plan.
• Sometimes we need to redesign our risk
mitigation strategy and actions.
31
Risk mitigation
32
Step 11:Reporting and dialogue
• The programme risk management will be
reported in the Annual Programme Report
and in the NFP’s Annual Strategic Report
• The risk picture and the possible mitigating
actions will be a central element in the
dialogue between donors, beneficiaries and
the FMO
33
Risks to achievment of outcomes
• At the programme level, the FMO bases its
risk assessment on the Programme Proposal,
the Annual Programme Report the Annual
Strategic Report from the NFP and the
dialogue. EU analyses are also used.
• The FMO especially focuses on likelihood and
consequence of risks to achievement of the
outcomes = output to outcome review
34
Results for the beneficiaries
• We are interested in achieving results for the
beneficiaries, e g the higher level objectives,
and correspondingly interested in the higher
level risks
We are in it together!
35