|
Risk
Management Framework
Adopted
17 February 2016
The risk
management control system encompasses a number of elements that together
facilitate an effective and efficient risk assessment, enabling HBRC to
consider a variety of strategic, operational, financial, and commercial
risks. These elements include:
a. Policies
and procedures
Many of
the organisational risks are managed through policies and plans adopted by
the Council. These include Regional Plans developed according to
relevant legislation, their associated implementation plans, and policies or
protocols specific to a particular issue. The policies adopted by Council are
implemented and communicated through the Chief Executive to staff.
Written procedures support the policies were appropriate.
b. Reporting
Comprehensive
reporting is designed to communicate the monitoring of key risks and their
controls. Decisions to rectify problems are generally made by staff,
but may be at the direction of Council where a significant potential risk is
identified.
c.
Annual and 10 year planning and budgeting.
The
annual and 10 year planning and budgeting processes are used to set
objectives, a performance framework through which to monitor progress towards
achieving those objectives, develop and communicate work programmes, and
allocate resources. A number of the work programmes are designed
specifically to mitigate strategic risks. Progress towards meeting
annual and 10 year plan objectives is monitored regularly.
d. Risk
management framework
This
framework helps to facilitate the identification, assessment and ongoing monitoring
of risks to which HBRC is exposed. The framework is formally reviewed
in accordance with the timelines set out in Table 1 below, with all existing
risks reviewed and new and emerging risks added.
e.
Risk review programme.
The risk
review programme is an important element of the risk management
process. Apart from its normal programme of work, each member of the
executive management team is responsible for the review of the effectiveness
of the risk management framework within HBRC as set out in Table 1.
Table 1: Risk Management Allocation
|
Responsible Group
|
Decisions areas
|
Frequency
of review/reporting
|
|
Council
(through Finance, Audit and Risk Sub Committee)
|
·
Organisation
risk profile
·
Top
10 residual risks
·
Top
10 controls
·
Significant
new or emerging risks
·
Governance
risks
|
Six
months
Six
months
Six
months
As
they arise
Six
months
|
|
Chief
Executive (together with Exec Managers)
|
· Review
and monitoring Organisational risks including controls
· New
and emerging risks reporting to Council
|
6
monthly
As
they arise
|
|
Group
Managers (together with 3rd tier managers)
|
·
Review
and monitoring of:
- Risks
associated with Group’s risks including controls
- New
and emerging risks within group
|
6
monthly
As
they arise
|
|
Staff
|
· Effective
management of operational risks through implementation of controls
· Reporting
new or emerging risks as they arise
|
Ongoing
As
they arise
|
f.
Internal audit.
An
internal review of risks may be requested by Council or commissioned by the
Chief Executive from time to time as they deem appropriate. Such an
external review may cover the risk framework and all of the risks to which
HBRC is exposed, or may be restricted to specific risks or aspects of
risk. This internal audit function may be contracted to an external
provider.
g. Audit of
HBRC’s Long Term Plans and Annual Plans
These
audits are carried out by Audit NZ on behalf of the Controller and Auditor
General.
Risk
management is a continual process and is conducted across the Council’s
operations. Staff should continually apply this process when making business
decisions and in day to day management.
The key
process steps within the Council’s risk management procedures are:
1. Communicate
2. Establish
the context
3. Identify
risks
4. Analyse
risks
5. Evaluate
risks
6. Treat
risks
7. Monitor
and review
Table 2: Risk Management Process
Step1: Communicate
and consult
It is
important that Council regularly receives updates on the implementation of
its Risk Management Policy in public. This signals to its external
stakeholders and the general public the key risks that the organisation has
recognised, and what mitigation measures are in place to effectively manage
these risks. I also provides a transparent insight into the level of
risk the organisation recognises associated with individual goals and
objectives.
Public
ratepayers have the opportunity to comment and/or submit on the level of risk
associated with Councils activities through consultation process.
Step 2: Establish
the context
Establishing
the risk management context is a key step in the risk management process.
HBRC
activities involve the management of a range of risks. The range
includes risks with a very low likelihood but very high potential consequence
to the organisation and Hawke’s Bay community. There are also
risks with high likelihood but low consequence. The risk framework is
designed to identify and manage risks with the potential significant
financial, regulatory and operational capability consequences. Day to
day risks are expected to be managed by HBRC staff who have experience and
expertise in the ongoing management of such risks.
Establishing
the risk management context takes into account the goals, objectives,
strategies, scope and sets the parameters of the risk management process.
Step 3: Identify
Risks
Risk
identification is a key step in ensuring all the risks are identified and
listed. The identified risks will determine the “what”,
“why”, and “how” things can happen as a basis for
further analysis. These risks can derive from different sources.
Sources of Risk
Sources
of risk have the potential to create:
·
People
risks e.g. health and safety.
·
Local
government risks e.g. reputation/ image, legislative.
·
Organisational
management risks e.g. loss of service, financial
·
Environmental
risks.
Each
risk identified will be entered into the Council’s risk register by the
Risk Manager.
Step 4: Analyse
Risk
After
risks are identified it is important to adequately describe them. The key to
describing the risks include:
·
What
is the event? (e.g. Negative media publicity)
·
The
cause of the event? (e.g. Breakdown in communication)
·
The
impact of the event. (e.g. Reputational damage which leads to rate
payers/stakeholder dissatisfaction)
Risk
analysis aims at understanding the level of significance of a risk by
assessing its likelihood and consequences and taking into account the
processes and controls to mitigate it.
Inherent
risk level (Gross risk) would exist if the controls did not work as they were
intended. Residual risk level is the leftover risk after applying identified
controls effectively and risk treatment.
The aim
of controls is to reduce risk to an acceptable level, within the
Council’s risk management process. When evaluating the effectiveness of
controls, factors to consider are the consistency of application,
understanding of control content and documentation of the control.
Furthermore, the evaluation of the control process can include:
·
Control
self-assessment
·
Internal
Audit reviewing the effectiveness of controls
·
External
audit reviewing the effectiveness of controls
The
likelihood ratings identify how likely, or often, a particular event is
expected to occur, these are shown in Table 3 below. The descriptors are not
a mandatory category requirement, but act as a guide to assist in ranking the
probability in line with the nature of each risk.
Table 3: Likelihood of occurrence
Name
|
Full
Description
|
|
Almost
Certain
|
Occurrence
of the event within this 10-yearly LTCCP may be credibly regarded as a
‘real possibility’ i.e. the probability of occurrence is
greater than non-occurrence. Documented and frequent incidents.
Is likely to occur more than once in this 10-year LTCCP period.
|
|
Likely
|
Occurrence
of the event within this 10-yearly LTCCP may be credibly regarded as a
‘real possibility’ i.e. the probability of occurrence is
similar to non-occurrence. Documented and regular incidents. Is
likely to occur once in this 10-year LTCCP period.
|
|
Unlikely
|
Occurrence
of the event within this 10-yearly LTCCP would be considered as having some
potential to occur – ie, a reasonable probability of occurrence over time,
but less than the probability of non- occurrence. Documented but
infrequent incidents. Has less than 50% chance of occurrence in this
10-year LTCCP period.
|
|
Highly
Unlikely
|
Whilst
possible, occurrence of the event within this 10-yearly LTCCP would be
regarded by most people as unlikely i.e. the probability of non-occurrence
is somewhat larger than occurrence. Documented but few
incidents. Has less than 10% chance of occurrence in this 10-year
LTCCP period.
|
|
Rare
|
It is
not expected that the event would occur within this 10-yearly LTCCP.
Occurrence of the event would probably be regarded as unusual - (the
probability of occurrence is quite small). Has less than 1% chance of
occurrence in this 10 year LTCCP period.
|
The consequence descriptors in Table 4 indicate the
level of possible consequences for a risk.
Tables 4:
Consequence Rating
|
2.1
Financial Consequences
|
|
Level
1
|
Value
of investment(s) decreases by 30%.Loss of cash flow/income or increase in
unplanned expenditure of $5m over Note: Language to be appropriate
for all sections of council
|
|
Level
2
|
Value
of investment(s) decreases by 20%.Loss of cash flow/income or increase in
unplanned expenditure of $3m over
|
|
Level
3
|
Value
of investment(s) decreases by 10%.Loss of cash flow/income or increase in
unplanned expenditure of $2m over
|
|
Level
4
|
Value
of investment(s) decreases by 5%.Loss of cash flow/income or increase in
unplanned expenditure of $1m over
|
|
Level
5
|
Value
of investment(s) decreases by 3%.Loss of cash flow/income or increase in
unplanned expenditure of $0.5m over
|
|
No
Financial Impact
|
No
measurable financial impact
|
|
2.2
Stakeholder/Reputation
|
|
Level
1
|
Extreme
dissatisfaction and loss of confidence. Central government
investigation and/or statutory management installed. Regulatory
action resulting in major prosecution and conviction of council (eg - fine
of >$100k).Note: ‘Stakeholder’ means clients, public,
industry groups (such as forestry/agriculture), local government bodies,
lobby groups, or Iwi.
|
|
Level
2
|
Major
loss of stakeholder confidence. Extensive stakeholder dissatisfaction
expressed through media resulting in a long period of negative coverage
(>2 months). Widespread, unified, coordinated revolt by consent
holders and/or ratepayers against fees/conditions. Regulatory action
resulting in moderate prosecution and conviction of council (eg -
$25-$100k)
|
|
Level
3
|
2-3
stakeholders sectors dissatisfaction expressed through media resulting in a
long period of negative coverage (>2 months). Central Government
impose statutory sanctions. Regulatory action resulting in
prosecution but no conviction.
|
|
Level
4
|
Single
stakeholder sector express dissatisfaction through media for up to one
month. Central Government – CEO MFE directed by Minister to
make enquiries. Individual(s) express dissatisfaction through media or
directly.
|
|
Level
5
|
Individual(s)
express dissatisfaction through media or directly. Individual(s)
refuse to pay fees/rates as a stand against council activities. No
significant impact on stakeholders or image
|
|
No
Impact
|
No significant
impact on stakeholders or image
|
|
2.3
Operational Capability
|
|
Level
1
|
Event
results in management diversion from strategic objectives for a period of
> 2 months. Delivery of LTCCP outcomes across work area
significantly affected for greater than six months. Critically
detrimental effects on stakeholders. Long term loss of capability
(>2 months).Event results in management diversion from strategic
objectives for a period of <2 months.
|
|
Level
2
|
Event
results in management diversion from strategic objectives for a period of
<2 months. Delivery of LTCCP outcomes across work area
significantly affected for up to six months. Moderate detrimental
effects on stakeholders. Event results in loss of operational
capability for up to 2 months. Event results in management diversion
from strategic objectives for a period of a few days.
|
|
Level
3
|
Event
results in management diversion from strategic objectives for a period of a
few days. Delivery of LTCCP outcomes across work area significantly
affected for up to one month. Minor detrimental effects on
stakeholders. Event affects limited efficiency or effectiveness of
service. Managed internally.
|
|
Level
4
|
Event
affects limited efficiency or effectiveness of service. Managed
internally. Moderate staff morale problems resulting in some staff
resignations but managed through minor restructuring.
|
|
Level
5
|
Event
causes minor disruption felt by limited small group of stakeholders.
Minor staff morale impact resulting in minor dissention but managed over a
short period of time.
|
|
No
impact
|
No
impact on operational capability
|
|
|
|
Step 5: Evaluate
Risk
After
the likelihood and consequence factors have been determined, the level of
risk is calculated using the Likelihood of occurrence (Table 1) and
Consequence Rating (Table 2).
Raw Risk
= the likelihood of an event occurring X the consequence of such an event
Table
Five: Risk Assessment Matrix
The
final outcome is a risk rating. The risk rating enables definition between
those risks that are significant and those that are of a lesser significance.
Table 5: Risk rating
|
Comparative
Levels of Risk
|
|
E
|
Extreme
Risk
|
Immediate
action required to manage risk
|
|
H
|
High
Risk
|
Senior
management attention to manage risk
|
|
M
|
Medium
Risk
|
Management
responsibility must be specified and risk controls reviewed
|
|
L
|
Low
Risk
|
Managed
by routine procedures
|
|
I
|
Insignificant
Risk
|
Examine
where un-needed action can be reduced
|
Once the
impact has been assessed according to the relative risk level it poses, it is
then possible to target the treatment of the risk exposure, by beginning with
the highest level risks (Extreme risks) and identifying the potential
mitigation measures to reduce the risk to a level acceptable to the
organisation (risk appetite).
Initially,
the Raw Risk needs to be calculated, so the likelihood and consequences need
to be considered as if there were no controls or events in place to prevent
or mitigate the risk occurrence.
Step 6:
Treat Risks
Risk
treatment involves determining possible treatment options to determine the
most appropriate action for managing the risks identified.
Treatment
options are required where the current controls are not mitigating the risk
within defined tolerance levels as determined by the first step (defining the
context). This is called the treatment plan.
This
process may include consideration of a range of options, each will have a
different cost and provide a different level of certainty. The Finance,
Audit and Risk Sub-committee will need to consider the options and recommend
which they believe to be the most appropriate.
Once the
Raw Risk is determined it is possible to investigate the current systems and
processes starting with the highest ranked risk. Then formulate an
action plan to:
1. Reduce
the likelihood or;
2. Reduce
the consequence identified
Treatment options:
Treatment
options could involve applying existing or implementing additional controls.
Furthermore, treatment options can involve one or more of the following:
1. Accept
Risk
– Accept risk and consider options for treatment
2. Reduce
Risk
- Either
reduces the likelihood that a risk occurs, or minimises the negative
consequences if it does occur.
3. Transfer/Share
Risk
– Pass
the risk in part or whole to others (insurance or third party).
4. Retain
Risk
– Retain
the risk after evaluating its impact which is found to be minimal.
When
determining the preferred treatment option consideration should be given to
factors such as cost and potential effectiveness (Cost benefit analysis).
Treatment Actions:
Once the
treatment option is identified each emerging risk should be assigned a
treatment action.
·
The
treatment action should contain at a minimum the following: The cost of the
action.
·
Assigned
responsibility to a person/position.
·
A
due date (if appropriate), and;
·
Monitoring
and reporting requirements.
Progress
of the treatment action should be recorded in the risk register.
Note:
Risk Mitigation processes may involve work streams determined through the
Resource Management Act and/or Annual or Long Term plan processes.
These sort of projects are particularly relevant to HBRC strategic goals.
Residual Risk:
Residual
risk level is the risk left after the risk treatment process has been
implemented and controls applied. Residual risk needs to be monitored and
reported on a regular basis to identify changes in any performance level.
Step 7: Monitor and
review
Risks
are constantly changing due to the Council’s operating landscape.
Therefore, risks must be monitored and reported on a regular basis to ensure
they are current.
Furthermore,
risk owners and treatment action owners have key risk, control review and
updated responsibilities to ensure the information pertaining to those risks
are current. Also the Council’s risk register should undergo a six
monthly review to ensure all information captured are current.
The
effectiveness of the Council’s risk management framework also needs to
be monitored and reviewed six monthly. This review process will help refine
the Council’s risk management framework to facilitate continuous
improvement and overall risk maturity
|
