Paul Hopkin. Fundamentals of Risk Management

Подождите немного. Документ загружается.

184 Risk and organizations

Monitoring and review

Is there sufﬁ cient monitoring of performance using appropriate measurements?

•

Does the board challenge planning assumptions when and where appropriate? •

Does the board demonstrate the ability to respond rapidly to changes? •

Is there a mentality that demands continuous improvement in performance? •

Does the board assess ﬁ nancial and other controls and seek assurance on •

compliance?

Performance and impact

Is there a satisfactory level of attendance at board, committee and other meetings?

•

Are board decisions and actions fully recorded and actions tracked and conﬁ rmed? •

Are the established targets and agreed performance indicators evaluated and assessed? •

Is the impact of board decisions and actions evaluated in a timely manner? •

Is there an emphasis on accuracy, honesty and open reporting to external agencies • ?

The course of action will result in some outputs, and these need to be evaluated in terms of the

impact that is achieved. When evaluating the effectiveness of the board, the impact of its deci-

sions is the ultimate test. The level of impact can then be evaluated against the vision, mission

and objectives of the organization.

Table 19.3 continued

Stakeholder expectations

Range of stakeholders

Organizations will have a wide range of stakeholders, some of whom may indeed be unwanted

as far as the organization is concerned. For example, if a distribution company wishes to build

an extension to its depot, local residents may want to object to it. The local residents are stake-

holders in the operation of the company, even though the owner of the company may not wish

to acknowledge that fact. ISO Guide 73 deﬁ nes a stakeholder as a ‘person or group concerned

with, affected by, or perceiving themselves to be affected by an organization’.

There will be a wide range of stakeholders in a typical sports club and these will include the

following:

supporters; •

players; •

staff; •

ﬁ nanciers; •

sponsors; •

suppliers. •

Stakeholders may have contradictory expectations of the organization. For example, staff will

seek pay that is as high as possible. This would be in opposition to the requirements of ﬁ nan-

ciers, who want the club to be as proﬁ

table as possible. It is part of the role of management to

balance the conﬂ

icting interests of different stakeholders and implement actions that provide

the best balance between conﬂ icting stakeholder expectations.

For organizations in different sectors, the range of stakeholders will be different. For govern-

ment agencies, the general public will be a major stakeholder. Speciﬁ c groups within the

general public will be stakeholders in different agencies, depending on the purpose of each

185

186 Risk and organizations

particular agency. For organizations that have signiﬁ cant environmental interests or expo-

sures, a different range of stakeholders would need to be considered. For some energy compa-

nies, environmental pressure groups are often unwelcome stakeholders. There may be a

substantial conﬂ ict between a mining company that wishes to extract minerals and the local

population who do not want heavy industrial activities taking place in the area.

Depending on the nature of the stakeholder, questions should be asked about the risk aware-

ness of the organization, the activities that are designed to achieve risk improvement and risk

governance arrangements within the organization. Relevant stakeholders are entitled to receive

information on the risk proﬁ le of the organization. They are also entitled to information on

the arrangements for risk improvement and the metrics that are in place to monitor risk per-

formance. Finally, stakeholders are entitled to information on the risk appetite of the organi-

zation and the arrangements for incorporating risk into the development of strategy.

The box below provides an example of how stakeholders will have different expectations of an

organization. Sometimes, these expectations will be contradictory. Even if they are not contra-

dictory, it is helpful for one group of stakeholders to have an understanding of the expecta-

tions of the other groups.

Stakeholders in a theatre

Assume that a theatre is seeking to involve all stakeholders in its activities. This will

extend to consideration of the objectives of performers at the theatre, including artistes

and actors. There needs to be a distinction between the objectives of the performer and

the requirements of the audience. For example, an established musician may wish to

promote a new album, but the audience will want to hear the established favourites

from previous ones.

The performer will have the best chance of presenting a successful show if the starting

point is an evaluation of audience expectations, followed by an evaluation of the

expectations of the theatre. The performer can then plan the speciﬁ c content of the

show to be consistent with those expectations as well as taking account of his or her

professional and personal objectives. The theatre may encourage this approach and

recognize the performer as a stakeholder, but encourage the performer to consider

other stakeholders and their expectations.

Stakeholder dialogue

Dialogue with stakeholders should be based on a mutual understanding of the objectives of

the organization. The board is responsible for ensuring that the dialogue is satisfactory.

Stakeholder expectations 187

Although speciﬁ c members of the organization may have the day-to-day responsibility for

communications with particular groups of stakeholders, the board will retain overall respon-

sibility. Table 20.1 provides a summary of the information that should be provided to share-

holders of a company. This information will focus on the provision of accurate ﬁ nancial

data.

The level and nature of dialogue with stakeholders will depend on the particular interests of

the stakeholder in the operations of the organization. The supporters of a sports club will

require different information than the banks that are providing the necessary ﬁ nancial support

for the club.

To obtain the fullest picture of the risks facing an organization, analysis of stakeholders and

their expectations is necessary. The identiﬁ cation of stakeholder expectations is one output

from the external evaluation stage of the business cycle. Different stakeholders may have

expectations that are contradictory or even mutually exclusive in terms of the demands placed

on the organization.

Table 20.1 Data for shareholders

General

A clear statement of strategy and vision

•

Corporate proﬁ le and principal markets •

Financial data

Annual report and ﬁ nancial statements

•

Archived ﬁ nancial information for the past three years •

Corporate governance and CSR

Information related to compliance with Combined Code

•

Information on the company CSR policies •

Shareholder information

Shareholder analysis by size and constituent

•

Information on directors’ share dealings •

Relevant news

Access to all news releases and presentations

•

Developments that might affect the share value •

188 Risk and organizations

Stakeholders and core processes

Core processes deliver stakeholder expectations and they are related to the internal and exter-

nal context of the organization. Therefore, a risk can be deﬁ ned as an event with the potential

to impact the fulﬁ lment of a stakeholder expectation. This approach has the advantage that

both internal and external stakeholders can be identiﬁ ed, together with their short-term,

medium-term and long-term expectations. Figure 20.1 provides a graphical illustration of the

relationship between stakeholder expectations and the core processes of the organization. The

ﬁ gure illustrates that the core processes of an organization can be strategic, tactical and opera-

tional. This classiﬁ cation of core processes as strategic, tactical and operational is acknowl-

edged in British standard BS 31100 when it discusses risk management perspectives. Strategic

perspectives set the future direction of the business; tactical perspectives are concerned with

turning strategy into action by achieving change; and operational perspectives are related to

the day-to-day operations of the organization, including people, information security, health

and safety and business continuity.

Mission statement

Strategic or business plan

(and annual budget)

Strategic

TacticalOperational

Core processes

Internal

evaluation

Corporate objectives Stakeholder expectations

External

evaluation

Inuence Processes to

deliver business

model

(Figure 21.1)

Figure 20.1 Importance of core processes

Stakeholder expectations 189

An approach based on stakeholder expectations has many advantages. It facilitates a full and

thorough validation of the core processes of the organization in relation to the expectations that

each stakeholder places on each core process. An important aspect of managing an organization

is balancing the various stakeholder expectations. There are dangers inherent in achieving this

balance, and a risk identiﬁ cation process based on analysis of stakeholder expectations is the

most robust way of ensuring that these dangers are recognized, analysed and minimized.

The analysis of stakeholder expectations is also one of the fundamental requirements of the

business process re-engineering (BPR) approach. The stakeholders in the current and future

activities of the organization can be identiﬁ ed. The expectations of each stakeholder in relation

to each stated objective and the corporate mission can then be evaluated. Shared expectations

will emerge and the core processes of the organization can then be deﬁ ned (or reﬁ ned) spe-

ciﬁ cally in terms of the delivery of these shared expectations.

Although the analysis of stakeholder expectations can be one of the most robust ways of iden-

tifying risks, there are implications in terms of the time and effort required for this approach

to be successful. BPR can be a very time-consuming exercise, when undertaken thoroughly.

Stakeholders and strategy

It has been clearly established and demonstrated by research that incorrect risk management

decisions related to strategy can destroy more value for an organization than incorrect risk man-

agement decisions associated with the operations or projects undertaken by the organization.

Strategic processes, therefore, need to be the most robust processes in the organization, and

indeed this will be required by major stakeholder groups. Such stakeholders include ﬁ nanciers

and other shareholders who are interested in the long-term success of the organization.

Strategic core processes for a sports club may include the building of a new stadium. This would

be a signiﬁ cant investment that will require substantial support from ﬁ nanciers. In order to

secure support, the club will need to be aware of the expectations of the ﬁ nanciers and ensure

that the plans for the new stadium and the ﬁ nancial arrangements that will be put in place fulﬁ l

the necessary stakeholder expectations. The construction phase of acquiring a new stadium will

be a signiﬁ cant project for the club, with a different range of stakeholders to consider.

Stakeholders and tactics

Tactical stakeholders of an organization may be very different from those who are concerned

with the organization’s operations.

190 Risk and organizations

If the tactics of an organization involve improvements to products, investment in new pro-

duction techniques, response to technological changes or other developments that require a

project, then ﬁ nance is likely to be required. This means that ﬁ nancial bodies are likely to be

key stakeholders in projects and similar tactical changes. Other stakeholders in projects may

include building contractors and providers of other specialist professional support, such as

architects.

The importance of employees in the implementation of tactics should not be underestimated.

Staff will also have an interest in operational issues and be major stakeholders in the organiza-

tion’s operations. If changes to work practices or product features are to be successfully incor-

porated into the operations of the organization, then the support of staff is vitally important

and good communication with them is essential.

Stakeholders and operations

There may be many stakeholder groups involved in the operational activities of an organiza-

tion. To continue with the example of a sports club, fans will be major stakeholders in a large

number of different aspects of the club’s activities. One of the primary concerns of fans will be

good results on the pitch. They will also be interested in other operational aspects, including

the arrangements for buying tickets, transport and access arrangements, as well as the facilities

provided within the stadium.

Pharmaceutical companies are generally large organizations with a very diverse range of

stakeholders. In particular, a pharmaceutical company producing a critical medication has

an obligation to ensure a constant availability of that medication for all its patients. Patients

should be viewed by the pharmaceutical company as important stakeholders who have

expectations regarding the availability and effectiveness/efﬁ cacy of the medication that has

been prescribed.

The stakeholder groups that have an interest in the operational activities of an organization

are likely to be customers, suppliers and others that may be affected by disruption to the

normal efﬁ cient operation of the organization. For example, customers are likely to be affected

if a hazard risk were to materialize. Likewise, suppliers are stakeholders in the organization

and they will suffer if the organization is disrupted to the extent that their supplies/produce/

components/service are no longer required.

Other stakeholder groups that are likely to be affected by hazard risks will also have an interest

in the continuity of the activities of the organization. For ﬁ nancial organizations such as banks,

customers would be immediately affected if critical IT systems fail.

Corporate governance models require the involvement of stakeholders and adequate

stakeholder dialogue. In several countries, employees are recognized as stakeholders in

Stakeholder expectations 191

the organization to the extent that employee representation on the board may be manda-

tory. The box below considers the position in some European countries.

Employee representation on the board

Board-level employee representation involves employee representatives who sit on the

supervisory board, board of directors or similar structures in companies. These

employee representatives are directly elected by the workforce, or appointed in some

other way, and may be employees of the companies, ofﬁ cials of organizations

representing those employees, or individuals considered to represent the employees’

interests in some way.

Board-level representation also differs from other types of indirect participation such

as works councils in that it attempts to provide employee input into overall company

strategic decision making rather than focusing on information and consultation on

day-to-day operational matters at the workplace.

In most cases in western Europe, employee representatives are in the minority, and

board-level participation is associated with the obtaining of information and

understanding and the expression and exchange of opinions, views and arguments

about an enterprise’s strategy and direction. In a few cases, however, when employee

representatives are equal in number to those of shareholders or other parties, issues of

control, veto and real inﬂ uence over company strategy – sometimes known as

‘co-determination’ – come into play.

Analysis of the business model

Simpliﬁ ed business model

In order to place risk management within the context of business operations, it is necessary to

consider a simpliﬁ ed business model. Figure 21.1 sets out the basic elements of a business

model in simple terms. The ﬁ rst stage for an organization is to decide the strategy that it is

seeking to deliver. The strategic aims will be determined by considering the mission statement

of the organization, the corporate objectives and the stakeholder expectations. The organiza-

tion should establish a strategy that is capable of delivering the mission statement of the organ-

ization. In other words, the strategy of the organization needs to be efﬁ cacious.

Having established the overall strategy, the processes that will deliver it need to be identiﬁ ed.

For many organizations, the processes that are already in existence will be sufﬁ cient. However,

if the strategy requires changes to processes or the introduction of new processes, then projects

or programmes of work will be required. The processes introduced by the organization should

be effective in that they are the correct processes to deliver the desired outcomes in the most

cost-effective manner.

The operations of the organization will need to be efﬁ cient in that they deliver the required

and anticipated outputs at the lowest cost with least disruption. The operations of the organi-

zation are the day-to-day operations that build into the processes that deliver the overall strat-

egy for the organization. In relation to operations, the desired state of the organization is the

continuity of normal efﬁ cient operations with no unplanned disruption.

Figure 21.1 sets out the stages that are described above. The strategy can be seen as ‘where the

organization wants to be’. Review of the operations of the organization will collect informa-

tion on ‘where the organization is now’ and the tactics deﬁ ne ‘how the organization will get

there’. This is a three-stage business model that has events at its centre. In many circum-

stances, these events will represent risks that could materialize. The other component of this

simple business model is the reporting of the results of operations.

192

Analysis of the business model 193

4. Events

(what happens along the way)

5. Results of Operations

(how well the organization is doing)

2. Operations

(where the organization is now)

1. Strategy

(where the organization wants to be)

• Efcacious strategy

• Three-year strategic plan

• Annual budget

• Efcient operations

• No disruption or failure

• Competitive advantage

3. Tactics

(how the organization will get there)

• Effective processes

• Programme design

• Project management

Impact or

Attach

Support or

Deliver

Figure 21.1 Simpliﬁ ed business model

Actions and events can be good, bad or routine, and enable the organization to monitor what

progress is being made against the business strategy, projects and operations. These actions

and events impact the organization and its ability to sustain efﬁ cacious, effective, efﬁ cient and

compliant business operations and core processes.

Identiﬁ cation of strategy will require an approach based on opportunity management. Deliv-

ery of tactics, often by way of projects, will require attention to uncertainties and management

of control risks will be important. Delivery of effective and efﬁ cient operations will require

particular attention to the successful management of hazard risks.

Core business processes

A core process is one that is fundamental to the continued success (or even existence) of the

organization. Core processes ensure that the organization is able to achieve the mission and

corporate objectives and fulﬁ l stakeholder expectations. Each core process creates value and is

designed to deliver one or more of the stakeholder expectations.

There are three basic types of core process as set out in Figure 20.1 (page 188). These are proc-

esses designed, implemented and managed to ensure the following:

development and delivery of strategy; •