A Practical Approach to
Risk Management
Financial Management Institute,
Toronto Chapter
February 17 2010
Corinne Berinstein, BPT, MBA, MHSC, CA, CFI
Health Audit Services Team
Ontario Internal Audit Division
1
Contact Info:
Corinne Berinstein, BPT, MBA, MHSC, CA, CFI, Certificate in Risk
Management (Canadian Health Care Association
Senior Audit Manager
Health Audit Services Team
Ontario Internal Audit Division
Province of Ontario
Office: 416-327-7798
eMail: corinne.berinstein1@ontario.ca
2
Basic Concepts
3
Outline

Objectives of today’s session

Basic principles, concepts, definitions

A simple framework

Stocking your toolkit – education, job aids, templates

What are you going to do back in the office?

Q &A’s

A case – Let’s practice!
4
Objectives

Give you a practical approach, framework and tools so
you can start implementing ERM when you get back to
the office.

Share some lessons learned. Share some tips and tricks.

Practice concepts and tools with a case study so that you
practice
5
Why do we need Risk Management?
The only alternative to risk management is crisis management --- and
crisis management is much more expensive, time consuming and
embarrassing.
JAMES LAM, Enterprise Risk Management, Wiley Finance © 2003
Without good risk management practices, government cannot manage its
resources effectively. Risk management means more than preparing for
the worst; it also means taking advantage of opportunities to improve
services or lower costs.
Sheila Fraser, Auditor General of Canada
6
Why bother with RM?

Increase risk awareness – What could affect the
achievement of objectives? What could change? What
could go wrong? What could go right?

Increase understanding of risk – sensitivities. What
makes my risks increase/decrease/disappear?

Promote a “healthy” risk culture – It’s safe to talk about
risk. Open and transparent.

Develop a common and consistent approach to risk across
the organization. Not intuition-based.
7
Why bother with RM?

Allows intelligent “informed” risk-taking.

Focuses efforts –helps prioritize. Top 10 list. Or top 3.
Or…

Is proactive…. not reactive – Prepare for risks before they
happen. Identify risks and develop appropriate risk
mitigating strategies.

Improve outcomes – achievement of objectives
(corporate, clinical, etc)

Really comes to down to simple good management

Enables accountability, transparency and responsibility

And maybe even mean survival
8
Basic principles, concepts, definitions
A risk is ANYTHING that may affect the
achievement of an organization’s objectives.
It is the UNCERTAINTY that surrounds future
events and outcomes.
It is the expression of the likelihood and impact of
an event with the potential to influence the
achievement of an organization’s objectives.
9
Threats and opportunities
Threat – a risk that may HINDER the achievement of objectives
Opportunities - a risk that may HELP in the achievement of objectives

Interest rates

Foreign exchange rates

Supply of service/product/resources

Demand/uptake for service/product/resources

The economy

The weather

The stock market
10
Interactive Session #1 – 10 minutes
 Introduce yourselves to others at your table
 Pick 1 risk – discuss it as both a threat and
an opportunity
 Report to the large group. Pick a
spokesperson.
11
Definition of ERM
“… a process, effected by an entity's board of
directors, management and other personnel, applied
in strategy setting and across the enterprise,
designed to identify potential events that may affect
the entity, and manage risks to be within its risk
appetite, to provide reasonable assurance regarding
the achievement of entity objectives.”
Source: COSO Enterprise Risk Management – Integrated Framework. 2004.
The Committee of Sponsoring Organizations of the Treadway Commission (COSO)
12
Enterprise vs Integrated Risk Management
 Similarities:
 Formal process
 Consistent and systematic
 Includes projects, programs,
operations
 Is embedded in key processes
such as strategic planning,
budgeting, project planning,
evaluation, etc
 Must be driven and supported by
Leadership
 Adds value to decision-making
 Differences:
Enterprise-wide:
 Is organizational-centric
Success is defined as
implementation over the entire
organization
Integrated:
Take a systems-focus
May actually create risks for
individual organizations
13
Enterprise Risk Management
h
is
bl
ta
Evaluate
Communication
& Learning
Id
e
nti
fy
Division
Level
Es
r
nito
o
M
Assess
Periodic Summary Analysis & Report
Communication
& Learning
Ide
nti
fy
I
d
e
nti
fy
Assess
Assess
h
is
bl
ta
Communication
& Learning
Es
Evaluate
h
is
bl
ta
Assess
r
nito
Mo
Es
Communication
& Learning
Ide
nti
fy
I
d
e
nti
fy
Evaluate
h
is
bl
ta
Evaluate
h
is
bl
ta
Communication
& Learning
r
nito
Mo
Es
r
nito
Mo
Es
Evaluate
Branch
Level
r
nito
Mo
Assess
Periodic Summary Analysis & Report
Es
h
is
bl
ta
Communication
& Learning
Ide
nti
fy
Ide
nti
fy
Evaluate
h
is
bl
ta
Communication
& Learning
Assess
r
nito
Mo
Es
Ide
nti
fy
Evaluate
h
is
bl
ta
Communication
& Learning
Assess
r
nito
Mo
Es
Ide
nti
fy
Evaluate
h
is
bl
ta
Communication
& Learning
Assess
r
nito
Mo
Es
Ide
nti
fy
Evaluate
h
is
bl
ta
Communication
& Learning
Assess
r
nito
Mo
Es
Evaluate
Unit or
Project
Level
r
nito
Mo
Assess
14
Integrated Risk Management
Communication
& Learning
Id
e
nti
fy
Level
h
is
bl
ta
Evaluate
System
Es
r
nito
o
M
Assess
Periodic Summary Analysis & Report
Communication
& Learning
Ide
nti
fy
I
d
e
nti
fy
Assess
Assess
h
is
bl
ta
Communication
& Learning
Es
Evaluate
h
is
bl
ta
Assess
r
nito
Mo
Es
Communication
& Learning
Ide
nti
fy
I
d
e
nti
fy
Evaluate
h
is
bl
ta
Evaluate
h
is
bl
ta
Communication
& Learning
r
nito
Mo
Es
r
nito
Mo
Es
Evaluate
Regional
Level
r
nito
Mo
Assess
Periodic Summary Analysis & Report
Es
h
is
bl
ta
Communication
& Learning
Ide
nti
fy
Ide
nti
fy
Evaluate
h
is
bl
ta
Communication
& Learning
Assess
r
nito
Mo
Es
Ide
nti
fy
Evaluate
h
is
bl
ta
Communication
& Learning
Assess
r
nito
Mo
Es
Ide
nti
fy
Evaluate
h
is
bl
ta
Communication
& Learning
Assess
r
nito
Mo
Es
Ide
nti
fy
Evaluate
h
is
bl
ta
Communication
& Learning
Assess
r
nito
Mo
Es
Evaluate
Organizational
Level
r
nito
Mo
Assess
15
Risk Management Basics

Risk (uncertainty) may affect the achievement of
objectives.

Effective mitigation strategies/controls can reduce
negative risks or increase opportunities.

Residual risk is the level of risk after evaluating the
effectiveness of controls.

Acceptance and action should be based on residual risk
levels.
INHERENT
16
Slide 16
A Simple Framework
Step 1
Establish
Objectives
Step 2
Identify
Risks &
Controls
Step 3
Assess
Risks &
Controls
Step 4
Evaluate
& Take
Action
Step 5
Monitor
&
Report
Communicate, learn, improve
17
Risk Management is critical to ALL levels of decisions
UNCERTAINTY
Strategic Decisions
Stra
tegic
Decisions transferring
strategy into action
Prog
ramm
e
Stra
tegic
m
gra
Pr o
me
Decisions required for
implementation
Pr o
ject
&O
per
a
tion
al
ject
Pr o
al
tion
a
r
pe
&O
The HM Treasury’s The Orange Book
Decisions can be categorized into three types. The amount of risk (uncertainty) varies
with the type of decisions. Most decisions are concerned with implementation.18
The relationship between IRM & MOHLTC’s Complex Risk
Environment
External Risk Environment
re L a
gu ws
la &
tio
ns
ial
Political
Outcomes
nc
Fina
St
r
Po ateg
lic ic
y /
Communication
& Learning
Inf
Te orma
ch
no tion
log
y
Assess
rm
ati
on
Human
Resources
e
Th nom
o
Ec
y
LHINs
e ra
Op
n
tio
al
S
ex tak
pe eh
ct o l d
at e
io r
ns
Leg
Com al/
plian
ce
Ot
h
nis er
trie
s
er- s
rtn on
Pa izati
n
ga
Or
l
na
io
a t ce
iz an
a n rn
rg e
O Gov
Communication
& Learning
Ide
n
tify
t
en
ym
Pa ty &
fer bili e
ns nta
c
Tra ccou rnan
A o ve
G
Inf
o
h
is
bl
ta
tor
i
n
Mo
Es
Mi
MOHLTC
Risk Environment
Evaluate
Capacity
Communication
& Learning
ic n
bl tio
Pu cep
r
Pe
MOHLTC Extended
Enterprise
Corporate Governance
Requirements
19
Categorizing Risk – Comprehensive
1.
Political or Reputational Risk
2.
Financial Risk
3.
Service Delivery or Operational Risk
4.
People / HR Risk
5.
Information/Knowledge Risk
6.
Strategic / Policy Risk
7.
Stakeholder Satisfaction / Public Perception Risk
8.
Legal / Compliance Risk
9.
Technology Risk
10.
Governance / Organizational Risk
11.
Privacy Risk
12.
Security Risk
13.
Equity Risk
14. Patient Safety
NEW
20
Slide 20
Risk Prioritization – likelihood and impact
Likelihood of a risk event occurring

Very High: Is almost certain to occur

High: Is likely to occur

Medium: Is as likely as not to occur

Low: May occur occasionally

Very Low: Unlikely to occur
Risk Impact: Level of damage that
can occur when a risk event
occurs

Very High: Threatens the success of
the project

High: Substantial impact on time, cost
or quality

Medium: Notable impact on time,
cost or quality

Low: Minor impact on time, cost or
quality

Very Low: Negligible impact
21
Slide 21
Third dimension for rating risks - proximity

Immediate – now

Less than 6 months

Between 6-12 months

Between 12 – 24 months

Between 24 – 36 months

More than 36 months
22
Risk rating
…Combining impact and likelihood
RISK PRIORITIZATION MATRIX
5
RISK
IxL
IMPACT
4
RISK
IxL
3
2
RISK
IxL
1
1
2
3
4
LIKELIHOOD
Slide 23
5
23
Risk reporting and communications
Risk Level
Critical Risk
High Risk
Moderate Risk
Low Risk
Action and Level of Involvement Required
 Inform Chief Executive Officer and Board of Directors
 Immediate action required
 Inform Chief Executive Officer
 Strategy Team involvement/attention is essential to manage risks
– provide report to Board as appropriate
 Management mitigation and ongoing monitoring required
 Inform relevant Strategy Team members
 Accept, but monitor risks
 Manage by routine procedures within the program and site
24
25
Key Risk Indicators (KRIs) are linked to
strategy, performance and risk
Strategy & objectives
Risk
Cause
Consequence
KRI
Performance
KRIs need to be linked to strategy, objectives and target performance
levels, with a good understanding of the drivers to risk.
26
EXAMPLES OF KRIs
Human resource
• Average time to fill vacant
positions
• Staff absenteeism /sickness
rates
• Percentage of staff appraisals
below “satisfactory”
Age demographics of key
managers
Information Technology
• Systems usage versus
capacity
• Number of system upgrades/
version releases
• Number of help desk calls
Finance
• Daily P&L adjustments (#,
amt)
• Reporting deadlines missed
(#)
• Incomplete P&L sign-offs (#,
aged)
Legal/compliance
• Outstanding litigation cases
(#, amt)
• Compliance investigations (#)
• Customer complaints (#)
Audit
• Outstanding high risk issues
(#, aged)
• Audit findings (#, severity)
• Revised management action
target dates (#)
Risk management
• Management overrides
• Limit breaches (#, amt)
27
Measure and report RM implementation progress
• Advanced capabilities to identify, measure, manage all risk exposures within
tolerances
Excellent
Strong
• Advanced implementation, development and execution of ERM parameters
• Consistently optimizes risk adjusted returns throughout the organization
•
•
•
•
•
•
Adequate
•
•
Weak
Clear vision of risk tolerance and overall risk profile
Risk control exceeds adequate for most major risks
Has robust processes to identify and prepare for emerging risks
Incorporates risk management and decision making to optimize risk adjusted
returns
Has fully functioning control systems in place for all of their major risks
May lack a robust process for identifying and preparing for emerging risks
Performing good classical “silo” based risk management
Not fully developed process to optimize risk adjusted returns
• Incomplete control process for one or more major risks
• Inconsistent or limited capabilities to identify, measure or manage major risk
exposures
Source: Standard & Poor
28
Progress to Date – ERM Report Card
Quality of Care and Patient Safety
Corporate Governance
Operation & Business Support
Reputation and Public Image
Human Resources and Staff Relations
Financial Resources
Information Systems and Technology
Physical Assets
Legal and Regulatory
Environmental Health and Safety
Policies
Standards
29
An Approach to Risk Management

Establish centralized support

Develop a standardized framework

Provide education and coaching

Ensure ministry-wide implementation

Embed IRM into all major processes including strategic
planning and resource allocations decisions

Enable our stewardship role
30
The Approach

Incorporates risk information into the strategic directionsetting, making decisions that consider established risk
tolerance levels.

Takes a systems approach to managing risk at the
strategic, operational and project levels which is
continuous, proactive and systematic.

Fosters a working culture that values learning, innovation,
responsible risk-taking and continuous improvement.
31
Your toolkit – education, job aids, templates

We wanted to add value not work. We developed forms
and templates.

So we developed and delivered educational sessions –
usually attended by all team members. Included risk 101
and then time for the team members to discuss how to
apply concepts to their work.

We assisted teams in actual risk assessments. Sometimes
we used voting software.

We trained the trainer.
32
A Process for Embedding IRM
HAST Sessions
Risk 101
Presentation
Es
r
nito
Mo
h
is
bl
ta
Ide
nti
fy
Evaluate
Communication
& Learning
Assess
Management IRM
Planning Meeting
Risk Assessment
Workshop
Es
Communication
& Learning
Ide
nti
fy
Evaluate
h
is
bl
ta
r
nito
Mo
Components
Participant Outcomes
Introduction – Integrated Risk Management
Understanding of risk management process
Introduction to basic risk concepts and terminologies
Understanding of how risk management is relevant to their day-to-day
work
Introduction to the MOHLTC’s Integrated Risk
Framework
Knowledge of IRM in MOHLTC
Status of IRM in MOHLTC
(Most effective when followed-up with facilitated risk
assessment workshop or application to actual project)
Planning
Commitment to IRM implementation in area or stream of work
Discuss best way to implementation IRM in area
Risk management roles and responsibilities clearly defined
Proposed IRM implementation plan presented for area
Review of IRM roll-out; timelines , deliverables, related forums
Clarify roles & responsibilities for risk management
Commitment to continuous risk communication & learning
Facilitated Training – Identification of risks &
mitigation strategies
Hands-on experience allowing assimilation of consistent risk
management techniques
Identification of objectives
Hands-on practice of IRM process, enabling application of risk
management principles and tools to work
Brainstorming and identification of risks to meeting
objectives (for project, branch, initiative, etc. )
Greater understanding of work and inter-dependencies
Identification of source, mitigation strategies, ownership
and residual risk for each ‘risk category’
Assess
Risk Prioritization
& Voting
Workshop
Es
Communication
& Learning
Ide
nti
fy
Evaluate
h
is
bl
ta
M
or
onit
Risk follow-up
Session
Es
h
is
bl
ta
Ide
nti
fy
Evaluate
Communication
& Learning
Assess
Review of risks, mitigation strategies, ownership, residual risk to their
work in a seamless manner
Review of risks, mitigation strategies and ownership
Unbiased risk prioritization and identification of high risks
Anonymous voting on the impact and probability of each
risk
Enables application of complete risk management process to every
day work
Prioritization of risks on ‘heat map’
Discussion of mitigation strategies for high priority risks
Assess
r
nito
Mo
Facilitated Training – Assessment of mitigation
strategies & prioritization
Monitoring & Review
Review of risks and status
Review of risks six months after initial assessment
Continuous improvement
Review mitigation strategies and residual risks
33
IRM RISKS AND CONTROLS
The following table describes the risks and mitigating controls and related information. As controls are implemented or changed, their status will be updated.
Risk Rating Impact = significant, moderate or minor (S, M, m) and Likelihood = high, medium or low (H, M, or L)
Responsible Org &
Name (Implement /
ID Number Operate)
Risk
Category: Financial
None in this category
Category: Equity
None in this category
Category: Service Delivery or Operational
064
Person A
055 – Insufficient knowledge transfer
102 – Conflicting management
instructions
065
Person B
056 – Lack of communication (Serious
service delivery issues)
352 – Different business and IT
processes (incident management)
Control
Risk
Rating
(Impact)
Risk
Rating
(likelihood) Date Required Status
Update impacted policies and procedures M
for integration into knowledge support tools.
Harmonizing policies and procedures (e.g.,
access procedures – X has one and Y has
one – there needs to be one
process/policy/procedure).
M
31-Mar-09
Refer to Privacy
Action Plan Work on
Ongoing Operations
Commitments
Report
(a) IT incident and Triage (harmonization M
between IT and Business).
(b) X and Y need to develop an incident
management process/service to deal with
issues that arise during service delivery.
Roles and responsibilities need to be
defined in both organizations: from a
stewardship perspective on the ministry
side, and from a service delivery/reporting
perspective on the agency side. The
process/service ensures that incident/issues
are communicated as per agreement
requirements; well tracked and reported.
M
31-Mar-09
(a, b) Refer to
ongoing Operations
IRM document
34
35
36
37
The Cyclist and the Risk Manager
38
Interactive Session #2 – 15 minutes
 Identify risks that the cyclists faces in
cycling to work.
 Report back.
39
Risk Factors – the cyclist
.
40
Risk Factors – the weather, the road, visibility, the
bike, the lock
.
41
Risk Factors – the driver
.
42
Risks
Threats:
Opportunities:

Death

Exercise

Head Injury

Sunlight

Injury

Reputation

Reputation

Financial

Financial

Role model

Damage to the bike

Environment

Sunburn/frost bite
43
Mitigation Strategies for threats

Death, head injury, other injury – helmet, bright clothes, lights, bell,
CANbike course, obeying traffic laws, positive attitude, anger
management course

Reputation – great outfit, change of wrinkle-free clothes, shower,
time management

Financial – high quality locks, “beater”, stopping at stop signs

Damage to the bike – regular maintenance, avoiding pot holes

Sunburn/frost bite – sunscreen, mittens, hats, token/change

Dehydration- filled water bottle
44
ERM/IRM can be complex and messy
45
Keep it simple
46
Back at the office

Why is the organization interested in RM? What are they hoping
will be achieved with its implementation?

Who is doing what? Roles & responsibilities must be clearly
defined. Make sure Leadership supports RM and uses RM results to
make decisions. Everyone is a risk manager. Make sure that all risks
have owners and the responsibilities for mitigation are assigned

How will it be implemented? What is your framework? What is the
common language? How will risks be measured and reported?

Where will you start? Choices could be where you can most easily
succeed or where it is needed the most or where interest is high.

When will it be implemented? It is a journey not a destination; 3-5
years for complete roll-out; how often will risks be assessed; when
will mitigation plans be implemented and monitored; when will risks
be reported.
47
Ask questions and develop your approach

Do we understand our major risks? Do we know what is causing our
risks to increase, decrease or stay the same?

Have we assessed the likelihood and impact of our risks?

Have we identified the sources and causes of our risks?

How well are we managing our risks?

Are we trying to prevent the downside risks from happening? Or are
we trying to simply recover from them?

Who is accountable for these risks?

How do we talk about risk? Do we have a common language across
branches, across divisions, across the ministry, across the OPS, across
the health care system?

Are we taking too much risk? Or not enough risk?

Are the right people taking the right risks at the right time?

What’s our culture? Are we risk adverse or are we risk-takers? Or are
we somewhere in between?
48
TAKE SMALL BITES………. IRM IMPLEMENTATION
49
Questions?
50
The case - You are responsible for Risk Management
for:

Case 1 – The Pan Am Games 2015

Case 2 – The provincial response to the next Pandemic

Case 3 – The extension of Hwy 404

Case 4 – The rescue efforts in Haiti

Case 5 – Human Resources in the Ontario Public Services

Case 6 – A big teaching hospital in Toronto
51
The case

Consider the 13 categories of risk

Identify top 5 threats (downside) and top 5opportunities (upside)

Propose mitigation strategies

Discuss how the following risk factors would affect your assessment:
 Economy
 Demographics
 Weather
 Technology
 Timing of events such an election
 Others
52
Questions?
53