Forum

Replies

• 

  Beulah Misrole June 25, 2011 0:00

  when I just started out measuring risk performance, I found that 'repeat audit findings' linked to the performance agreements a great starting point.  I annually added more but never have more than 3.  I hope that is of some assistance.

   

   

  Beulah
• 

  Tomasz Szymanowski June 9, 2011 10:37

  One more thought - perhaps you could consider profitability of different (exposed to  risk) areas of activity your organization is involved in.

  What does it mean when such segment is profitable (ROE on accepted level)? From the risk point of view it means that your risk approach in that segment is correct - your risk criteria, rating models, cut-off points reflect well the risk associated with particular segment. If so, perhaps that could be taken as one Risk performance indicator.
• 

  Wency J Keast May 25, 2011 17:38

   

  I identify with the comments made by Chris Shorthouse.  You may have the most qualified, experienced, and hard working Risk Management Department, but the programmes put forward by the Chief Risk Officer may not be accepted by the Corporate Management.  Risk Management involves expenditure in actual capital, e.g. Risk Transfer, Risk Protection, and expenditure in time.  The Firm's management may not be committed to the required resources for either or both areas sufficiently to make this endeavour successful.  So, it is the corporation's own comittment to Risk Management which will determine the performance and value of the Risk Management Department to them.

  That said, John Fraser, Vice President and Chief Risk Officer for Hydro One, and Betty Simkins, Professor of Business and Professor of Finance at Oklahoma State University, have co-authored a book entitled " Enterprise Risk Management", published by John Wiley and Sons, Inc. which is comprehensive with respect to the issues in Enterprise Risk Management for an organization.  Those who have not read it may wish to do so to consolidate many of the thoughts on Risk Mangement that they may already have and gain some new insights.

  I believe the most successful Risk Management team is one that has engaged the committment of the firm's management to good ERM practices.  This involves the so called soft skills of persuasion and diplomacy !  Perhaps the key KPI is the engagement of Senior management.
• 

  Harold Gbinije May 25, 2011 15:09

  Coming from a health and safety background KPIs will include proactive and reactive indicators like;

  Proactive: number of audits conducted, non-conformances issued and closed out, site inspections, actions and completed, risk assessment conducted.

  Reactive: accident stats, reported and investigated.
• 

  Sylver Kyeyune May 25, 2011 13:28

  Martin,

  
  Thanks for the feedback despite the tight schedule...
  Martin Snyman said:

  I have alsoe struggled with this question.  I think the starting point is to clarify what the risk department does.  In our case we provide a project risk service:

  1. Knowledge Transfer: Educate people about Project Risk Management and the systems and processes

  2. Select/establish and maintain risk department processes, systems and software

  3. Generate Reports based on risk registers

  4. Fassilitate the listting of risks and assisting with the update of them.

  5. Fassilitate with the identification of risks

  6. Provide assurance regarding the risk process, systems and tools as well as the the content and appropriate management of the risks and risk registers generated by applying risk management.

   

  For me the most difficult part is risk register section.  Can't expand too much now as I have to go to a meeting.  In Smith & Merrit's book there is a section on performance measurement and the key is that you must select which risks to manage actively ( Risk Department actively involved) and which to either ignore OR leave to Owners to manage.  S&M's measurements then focus on trending realised risks from the set marked for active management vs the ones which has been accepted by virtue of the decission not to manage them actively.

   
• 

  Sylver Kyeyune May 25, 2011 13:25

  Thanks Chris,

  
  These are great pointers and will share my review using the department focused KRIs.

  
  Best

  Chris Shorthouse said:

  The performance of a Risk Department is hard to quantify in traditional terms of output, savings etc. as pro-active risk management should reduce the likelihood of negative outcomes and influence management's strategy and delivery of positive outcomes - but quantifying how much value has been saved or added is problematic.

   

  I'd suggest you look at the following KPIs:

  • Frequency of risk workshops/training provided to risk owners in the business - as this will demonstrate the activity to educate and support managers across the business in effectively managing their risks;
  • Volume of realised 'unexpected' losses - as this may indicate 'gaps' in the risk management activity which should have been identified;
  • Timeliness of risk refreshes - if existing risk registers and mitigation plans are only being refreshed each year then you may need to question the accuracy of the quantification and evaluation of the mitigating controls (especially in light of global economic conditions in the last three years);
  • Qualifications and experience held - this will indicate whether the Risk Department is adequately staffed and also whether training programmes are being completed to remain 'current' and aware of topics in risk management and other related professional fields; and
  • The level of senior management / Executive Committee involvement in the Risk Department - this will ensure that there is senior support for the activities, drive engagement with middle-management and also enable the escalation of risks which cannot be adequately tackled at the operational level.

  I hope these thoughts help and would welcome comments on the points suggested and also on your experience following the review.

   
• 

  Martin Snyman May 25, 2011 12:42

  I have alsoe struggled with this question.  I think the starting point is to clarify what the risk department does.  In our case we provide a project risk service:

  1. Knowledge Transfer: Educate people about Project Risk Management and the systems and processes

  2. Select/establish and maintain risk department processes, systems and software

  3. Generate Reports based on risk registers

  4. Fassilitate the listting of risks and assisting with the update of them.

  5. Fassilitate with the identification of risks

  6. Provide assurance regarding the risk process, systems and tools as well as the the content and appropriate management of the risks and risk registers generated by applying risk management.

   

  For me the most difficult part is risk register section.  Can't expand too much now as I have to go to a meeting.  In Smith & Merrit's book there is a section on performance measurement and the key is that you must select which risks to manage actively ( Risk Department actively involved) and which to either ignore OR leave to Owners to manage.  S&M's measurements then focus on trending realised risks from the set marked for active management vs the ones which has been accepted by virtue of the decission not to manage them actively.

   
• 

  Chris Shorthouse May 25, 2011 12:06

  The performance of a Risk Department is hard to quantify in traditional terms of output, savings etc. as pro-active risk management should reduce the likelihood of negative outcomes and influence management's strategy and delivery of positive outcomes - but quantifying how much value has been saved or added is problematic.

   

  I'd suggest you look at the following KPIs:

  • Frequency of risk workshops/training provided to risk owners in the business - as this will demonstrate the activity to educate and support managers across the business in effectively managing their risks;
  • Volume of realised 'unexpected' losses - as this may indicate 'gaps' in the risk management activity which should have been identified;
  • Timeliness of risk refreshes - if existing risk registers and mitigation plans are only being refreshed each year then you may need to question the accuracy of the quantification and evaluation of the mitigating controls (especially in light of global economic conditions in the last three years);
  • Qualifications and experience held - this will indicate whether the Risk Department is adequately staffed and also whether training programmes are being completed to remain 'current' and aware of topics in risk management and other related professional fields; and
  • The level of senior management / Executive Committee involvement in the Risk Department - this will ensure that there is senior support for the activities, drive engagement with middle-management and also enable the escalation of risks which cannot be adequately tackled at the operational level.

  I hope these thoughts help and would welcome comments on the points suggested and also on your experience following the review.