Risk Register Ciaran Whyte Risk Administrator Planning Strategic

Risk Register Ciaran Whyte Risk Administrator Planning & Strategic Projects Unit January 2011

Agenda • Objectives of Seminar • Why manage risks? • Who should have a risk register? • Risk Management Theory • Risk Register format • Risk Register Intranet Tool • Risk Registers and Coordinators • Examples of managing risks • Risk Assessment Process • Active Risk Management

Objectives of Seminar At the end of the seminar you should • Know why you should create a risk register • Be able to create a risk register • Know how to keep the register up to date • Have an awareness of University risk management practices • Know how to be more successful in risk management

Why manage risks? risk definition “the threat or possibility that an action or event will adversely or beneficially affect an organization's ability to achieve its objectives” KNOWN PROBLEMS Issues POTENTIAL PROBLEMS pro-active management Fire-fighting Damage limitation Costly emergency actions Risks Containment actions Contingency • lower costs • less stressful

Who should have a risk register? Ø Project management teams Ø College / School management teams Ø Administrative Department management teams Ø University senior management teams (SAM / SMT) Ø All groups of people who meet to achieve common objectives • Current problems - Minutes / action items • Future problems - Risk register

Risk Management Theory • past experiences • inputs • focus areas • ignore risks outside control Risk Identification Risk Evaluation Risk Mitigation • determine likelihood or probability of occurrence • determine magnitude of loss or impact Risk Monitoring • avoid • contain • active acceptance • passive acceptance • transfer • chase actions / reassess probability & impact / add new risks • regular reviews of register • quick & simple communication to key stakeholders

Identifying Risks ØWhen you have a plan for the future project tasks - step back and consider the possibility of each task failing to meet timescales / budget / quality objectives - review all assumptions ØWrite down a clear definition of the risk – ‘there is a risk that …. . which will impact. . . ’ ØConsider past experiences - lessons from past projects or other intellectual material - review list with other project managers and key project team members ØConsider all the evidence - requirements and design documents, dependencies, resourcing, status reports ØBrainstorm with key project individuals - facilitated sessions – Delphi technique / SWOT analysis - expert interviews ØFoster open communication within project team - give the team the opportunity to raise risks - don’t shoot messengers! ØIgnore risks over which you have no control - keep within your scope and what is manageable

Evaluating Risks ØDetermine likelihood or probability of occurrence - consider how many times this has been an issue before - use past experience to guide probability - select HIGH / MEDIUM / LOW ØDetermine magnitude of loss and impact - assess impact in terms of scale of consequences should issue arise - assess in relation to scope of area being managed - select HIGH / MEDIUM / LOW

Mitigating Risks Øavoid Øcontain - eliminate the cause - remove task/activity causing risk from plan - add actions to plan to reduce probability (high medium low) - add actions to plan to reduce impact (high medium low) Øactive acceptance - set aside contingency - allocate extra resource or finance - take out insurance Øpassive acceptance - do nothing - accept consequences Øtransfer - pass risk to another party - commercial agreement • is the action appropriate to risk severity? • is cost of action effective enough? • is the action timely enough? • is the action realistic within project context? • is the action agreed by all parties? • is the action owned by a responsible person?

Monitoring Risks Ø be disciplined in ensuring that all actions are completed Ø ensure risk status covered in regular project reports Ø consider new risks as the situation changes Ø Gather feedback from owners of existing risks - changes to probability/impact/trend Ø Review RED risks and assign new actions Ø Review ‘increasing’ trend risks and assign new actions Ø Do NOT review all risks – manage by exception Ø escalate in good time to allow mitigation actions to be improved – don’t wait until it becomes an issue!

Risk Register format Identification Evaluation Mitigation Red - existing controls not working/adequate (to escalate) Amber - existing controls in danger of failing Green - controls are working

Risk Register Intranet Tool - Solution HR/payroll Authorised names/depts Owners – read only access Intranet Risk Register Risk log print-out for meetings Warning messages Coordinators – update access Administrator – total access and Audit reporting

Risk Register Intranet Tool - Roles University / School / Administrative Department Register Owner View all risks ‘owned’ View all risks in register Risk Owner Risk Database Project Manager Manage risks for assigned School or Admin Dept Manage risks for named project Administrator Risk Coordinator • View all University risks • create new project register • School/Dept register restructuring • access control • audit and monitoring • reporting to SAM/SMT/Audit Committee

Risk Registers & Coordinators Administrative Department Code Risk Coordinator Academic Registry ACR Adrian Novis ISS Tony Ollier DRI Chris Talbot School / College Code Risk Coordinator Arts & Humanities AAH Debbie Marshall Catering CAT Les Carmichael Business & Economics BAE Alan Evans Conference Services CON Peter Belcher DACE DAC Judith James Egypt Centre EGY Carolyn Graves-Brown Engineering ENG Steve Davies Estates SOTEAS SOT Adrian Luckman EST Ian Mac. Pherson Finance Health & Human Sciences HHS John Davies FIN Phil Gough HR Law LAW Andrew Beale HRE John Cox Marketing Medicine MED Paul Roberts / Sian Roberts MKT Chris Marshall PSPU PSP Ciaran Whyte Residential Services Niels Jacob RES Gareth Atkinson Safety Office SAF Graham Jones Sport & Physical Recreation SPR Kevin Harrison Student Services STS Sarah Huws-Davies Taliesin Arts Centre TAL Sybil Crouch VC’s Office VCO Martin Lewis University UNI Ciaran Whyte Physical Sciences PHY

Examples of managing risks

Risk Assessment Process Ø Pre-risk assessment checklist q 22 multiple choice questions q A – low risk q B – medium risk q C – high risk q Identifies impacts to administrative functions Ø Risk Assessment Review q Risk assessment checklist q Risk register q DRI summary of finances q Summary presentation (major projects) Ø SMT approval Ø Risk. Assessment@swansea. ac. uk

Active Risk Management Ø track risk actions as part of your status reporting Ø foster a ‘heads-up’ culture as part of tracking to keep looking ahead Ø start all tasks as early as possible to increase mitigation options Ø maintain open and non-threatening communications Ø decriminalise risk within project team – keep a positive attitude! Ø Involve the key project skills in risk management – not just PMs Ø communicate risk information – stakeholders & project team Ø maintain your Project Files– and risk audit trail Risk management provides a – • more efficient and cheaper way of working • less stressful working environment

Conclusions THANK YOU for your time today c. m. whyte@swansea. ac. uk