Attachment J.3 - Risk Management Framework.pdf

Risk Management Framework

DFID’S RISK MANAGEMENT FRAMEWORK

A. Background

1. Our objective is to improve risk management in DFID with a simple systematised system that joins up risk management activity at programme, portfolio and corporate levels, in a way that provides greater assurance, but doesn’t add considerable extra burden or unnecessary process to the business.

2. DFID operates in a complex environment and managing risk is important and something that we all do on a daily basis. It is key to the success of our organisation.

Given the nature of our work we have a high appetite for risk but this does not mean we take risky decisions which could adversely affect our staff or our funds. Being risk aware means accepting an appropriate level of risk in order to achieve our planned objectives.

3. Why do we care about risk? Ultimately it helps us do our jobs better, leading to DFID programmes having a greater impact on improving the lives of the world’s poorest people, enabling DFID to deliver the Government’s new aid strategy1 and four strategic objectives. It enables us to be better prepared for when things wrong; which they will do given the contexts we operate in. To do this we need to be explicit about the uncertainties and challenges we face on a daily basis; including those we deal with internally as well as external issues.

4. It is important that risks are properly assessed and understood; but equally important that they are not exaggerated, and that nervousness or a lack of clarity does not get in the way of good decision-making. Having a risk-averse approach could curb development impact.

5. What does success look like? It means more and more honest conversations about risk. In practice this means staff at all levels can easily articulate seven things: what are their top risks, mitigating actions, risk owner, current status, what’s changed, what risks are on the horizon and therefore what actions or decisions are required? It means being more explicit about the implicit choices we are already making.

6. There are five fundamental principles underpinning improving risk management in

DFID.

• Communication: developing an open and honest culture where risks are discussed openly, internally between colleagues and externally with partners;

1 HM Treasury and DFID ‘UK aid: tackling global challenges in the national interest’ (November 2015)

Communication Evidence

Professional Judgement

Common Language

Smart Rules

• Documentation and Evidence: enabling the information to be referenced by those involved in the programme and providing an ‘audit trail’ demonstrating how risks are managed;

• Professional Judgement: applying training, skills and experience to focus on what are acceptable risks to take in a given context;

• Common Language of risk: to avoid misunderstandings in communication.

• The application of DFID’s Smart Rules: which provide a clear framework for due diligence throughout the programme cycle. See paragraphs 37-39 below.

7. This framework details the key tools we use in DFID to ensure we achieve effective risk management. It also details how the tools are used and the roles and responsibilities of colleagues at each level of the organisation. It provides the minimum standards we expect at each level. You can of course adapt and improve this to meet your own needs.

B. Risk Categories

8. The widely accepted Copenhagen Circles define risk in three categories - contextual, programmatic and institutional. In DFID we refer to six risk categories which can be mapped on to the Copenhagen Circles2.

9. The list is not exhaustive and risks can fit into more than one category. The focus should be on capturing the risk and recognising that risk can, and does happen throughout the programme cycle (described in more detail at section E, below).

2 Generally accepted approach proposed by International Network on Conflict and Fragility, a subsidiary body of the OECD DAC.

External Context

Delivery

Safeguards Operational

Fiduciary Reputational

C: The Process

10. Risk management is an iterative process and risks do not operate in isolation, but interact and impact on each other. DFID’s risk management framework is based on HM Treasury’s process for managing risks (identify, assess, respond, control) and DFID’s delivery model as defined by the Smart Rules (design, mobilisation, delivery, closure).

D: The tools

Risk Appetite

11. Risk appetite is defined by HM Treasury as “the amount of risk to which the organisation is prepared to accept, tolerate or be exposed to at any point in time”3. It is the way we express the limits of risk which can be taken or tolerated depending on the current operating context. It can include the level of exposure which DFID would

3 HM Treasury ‘The Orange Book: Management of Risk – Principles and Concepts’ (2004)

Risk Appetite Due Diligence Risk Registers Central

Assurance Assessment

Documentation Fiduciary Risk Assessment

Risk and Return Anti-Corruption Counter-fraud

Delivery Chain Risk Management

Smart Rules Portfolio Approaches Leadership behaviours & change management tolerate if a threat is realised or how much DFID would actively invest in risk to realise the benefits of an opportunity.

12. Risk appetite can change over a period of time due to circumstances and therefore should be reviewed regularly. The risk appetite should be clearly articulated at the outset of any work to provide direction on how risks can be addressed and managed.

Having an articulated risk appetite will enable teams to be clearer about when to escalate (and delegate) risks. It will also help drive decisions within the programme.

13. Current work in progress on risk appetite includes collecting and sharing examples of risk appetite on different issues (e.g. legislation, staff security, fiduciary risk) and in different contexts. We also need to clarify at what level we set risk appetite – the prevailing view is risk appetite should be set bottom up, at the lowest level (through business cases and annual reviews) with appropriate approvals and aggregation to ask Heads of Department, Directors and above “are you content with this risk appetite?”, whilst recognising some central, top down, direction is sometimes necessary (e.g. DFID has very low risk appetite for breaches of UK legislation).

Risk Registers

14. Risk registers enable risks to be clearly identified, along with how they are going to be dealt with and who is responsible for monitoring and reporting on them. They should be regularly discussed and updated as this enables the sharing of knowledge on risk. The Risk register will change over time, reflecting the changing context and maturity of the programme. It should clearly identify review points.

15. The aim of the Strategic Risk Register is to enable the Departmental Board and

Executive Management Committee (EMC) to identify and manage risks to the delivery of DFID’s objectives: to be clear what are the strategic risks, mitigating actions, risk owner, current status, what’s changed, what risks are on the horizon and therefore what actions or decisions are required. All risk registers, should as a minimum, cover these seven points.

16. Current work in progress on risk registers includes consideration of whether a template should be provided for all staff to use at all levels across DFID, or whether to encourage staff to use existing risk registers provided they include the seven points noted above. Consideration also needs to be given to how to link risk registers at different levels, how to escalate high/severe (red) risks from one level to the next (in a timely manner, without adding extra burden or unnecessary process) and how to delegate or de-escalate risks from a higher to a lower level. An example of the latter might be when the EMC decides to stop tracking a risk on DFID’s Strategic Risk Register, who and how continues to track that risk at Leadership Group/Director level?

Risk Documentation

17. Risks should be assessed on a 5x5 grid (below) by comparing the likelihood and impact of risks. This gives a four tier (red, amber, yellow, green) assessment of risk. Risk appetite can also be captured on the matrix (the dotted line) with those risks in the higher ratings (red, amber) considered for escalation to management for further action.

18. We can use the same 5x5 grid to illustrate inherent (or gross) risk, the impact of mitigating actions, leaving residual (or net) risk, which in the diagram below is below our stated risk appetite (the dotted line).

19. The resulting four categories of risk (red, amber, yellow, green) in the two diagrams above are the same four risk categories that DFID’s Internal Audit Department uses in all their reports (severe, major, moderate, minor).

Individual issue / risk

Definitions

Minor This is an issue / risk that could have a minor effect on the achievement of one or many of the Department’s strategic objectives, or could have a minor effect on the effectiveness or efficiency of the Department’s activities or processes.

Moderate This is an issue / risk that could have a moderate effect on the achievement of one or many of the Department’s strategic objectives, or could have a moderate effect on the effectiveness or efficiency of the Department’s activities or processes.

Major This is an issue / risk that could have a major effect on the achievement of one or many of the Department’s strategic objectives, or could have a major effect on the effectiveness or efficiency of the Department’s activities or processes.

Severe This is an issue / risk that could severely affect the achievement of one or many of the Department’s strategic objectives, or could severely affect the effectiveness or efficiency of the Department’s activities or processes.

20. We plan to transition from the current three risk ratings (low, medium, high) recorded in

ARIES to four risk ratings (minor, moderate, major, severe) to be recorded in all new Business Cases and Annual Reviews in the Aid Management Platform (AMP).

21. Risks should be identified and assessed at all stages of DFID’s programme cycle, from

Operational Plans to Business Cases, from Annual Reviews to Project Completion Reports.

Risk and Return

22. As noted above, HM Treasury defines risk appetite as “the amount of risk that an organisation is prepared to accept, tolerate, or be exposed to at any point in time.”

DFID’s risk appetite is that we will take risk where this is justified by the return. The question DFID is currently exploring is could the Department, by taking more risk, gain greater development return, for the same amount of taxpayers’ money?

23. Risk and return choices are intrinsically linked: higher returns often entail more risk.

The challenge for DFID is to find the right balance of risk and return, in our programmes and across our portfolio. A Risk-Return Guidance Note considers both risk and return;

what we mean by the terms and how they can be assessed, measured and managed.

24. The approach set out in the risk-return Guidance Note makes ‘explicit’ the ‘implicit’ choices we already make when designing, selecting and delivering individual programmes and portfolios of programmes. By using explicit assessments of risk and return in our interventions we can make better decisions and manage our portfolios more effectively.

25. The risk-return tool was piloted by a number of DFID departments across some of their programmes and by one department (DFID Ghana) across their whole portfolio of programmes. The objective is to incorporate a risk-return assessment into all new business cases, annual reviews and project completion reports from the new Financial Year (2017/18).

Delivery Chain Risk Management

26. DFID works with many suppliers and partners to deliver our programme of work.

Attitudes to risk can have a significant effect on the delivery of our work programme and it is important to ensure that risks are being effectively managed by those best placed to do so. DFID is developing its approach to understanding, capturing and managing the risks involved with downstream partners.

27. This work has two stages. Firstly, DFID has begun mapping some of its delivery chains to understand the number and complexity of suppliers involved in a programme, how funds flow to beneficiaries and what administrative costs are incurred. Secondly, these delivery maps are prompting a discussion in DFID about risk transfer: what risks can, should or cannot be transferred, and what the cost-benefits are. This discussion also includes a debate about how DFID sometimes transfers the management of risk to suppliers and partners but still retains the ownership of risk.

Portfolio Approaches to Risk Management

28. DFID’s top 50 programmes (out of 1300+ live programmes) account for 51% of DFID’s portfolio by budget. Better Delivery Department will enable a strategic overview of DFID’s biggest and most complex projects, supporting SROs and their teams delivering these projects, and providing additional assurance to DFID’s Investment Committee and Departmental Board. ICAI is interested in a more risk-based approach to portfolio management in DFID.

29. In practice, this could mean including high/severe (red) or medium/major (amber) risk programmes in the Major Programmes Portfolio inclusion criteria, exploring whether high/severe risk programmes (e.g. humanitarian aid to Syria) are offset by low/minor risk programmes (e.g. programmes in Ghana or Malawi), and offering additional support to SROs responsible for high/severe risk programmes.

Due Diligence

30. DFID’s due diligence framework is designed to obtain a level of assurance of a potential delivery partner’s capacity and capability to deliver DFID programmes. The framework examines the partner’s capacity, systems, policies and processes to provide DFID with a fuller picture of strengths and weaknesses, and of the risks involved in working with that partner. Due diligence assessments cover four pillars that assess a partner’s governance and control, ability to deliver, financial stability and downstream partners. If done properly, a due diligence assessment will be proportionate to the value and assessed risks of the planned intervention and inform the nature of the ongoing partnership. The responsibility for these processes rests with spending teams, and recommendations and actions should be included in delivery plans.

31. Recent experience has shown that in some cases, for a variety of reasons, DFID staff are reluctant to use the due diligence framework or want to contract out this aspect of programme management. A due diligence review is currently underway to assess what’s working, what’s not working and to make recommendations.

Central Assurance Assessments

32. Central Assurance Assessments are due diligence assessments conducted on multilateral partners, such as the World Bank.

Fiduciary Risk Assessments

33. A Fiduciary Risk Assessment evaluates the national Public Financial Management

(PFM) system when financial aid to a partner Government is being provided or considered. It can also help in monitoring partner Government’s PFM reforms and help understand the fiduciary risk environment faced by other development partners.

Anti-Corruption and Counter Fraud

34. DFID’s Anti-Corruption and Counter Fraud strategy explains how DFID implements relevant UK legislation such as the Fraud Act 2006 and the Bribery Act 2010, and the UK Anti-Corruption Plan. The strategy sits above two separate but related work-streams in DFID: ‘Tackling Corruption in Partner Countries’ (anti-corruption) and ‘Protecting our Resources’ (counter fraud). The strategy and those work-streams partly reflect DFID actions in response to recommendations to two ICAI reports in 2011 and 2014.

35. The strategy outlines DFID’s approach to combating corruption and fraud in developing countries, in the UK, internationally and how to protect its resources. It sets out how DFID implements the strategy through communication and awareness, improving staff skills and use of management tools, and clarifies the different roles and responsibilities of staff who deliver the strategy.

36. The anti-corruption and counter fraud agendas are both broad and in some ways quite separate, but there is significant intersection, particularly with regard to in-country risks in the delivery chain which relate to the local corruption environment. Thus, Anti- Corruption and Counter Fraud country strategies sit below the overarching strategy to explain how DFID implements this at a country level. A Counter Fraud Smart Guide explains what staff should look for and what they should do if they suspect fraud.

Smart Rules

37. The Smart Rules provide the operating framework for DFID’s programmes. The Smart rules provide a clear framework for due diligence throughout the programme cycle (design, delivery, learning and closure), define accountabilities for decisions, and set out processes that are compulsory – anything not covered there is not a rule.

38. The Smart Rules include 10 principles and 37 mandatory rules. They are a set of standards that illustrate DFID’s expectations of effective decision making at both the portfolio and programme level at each point of the delivery chain, while providing the space for discretion and professional judgement according to the individual context.

Good practice reference guides (Smart Guides) and practical case studies draw on experience and expertise from across DFID and beyond.

39. Smart Rules 7 says that “The Senior Responsible Owner (SRO) must ensure that a risk assessment is embedded with the business case and that risk throughout the life of the programme is managed within the risk appetite approved within that business case or that changes to the agreed risk are subsequently approved. Smart Rules section 3.2 provides more detail.

Leadership Behaviours and Change Management

40. Further discussion is needed within DFID on what leadership behaviours are needed to create the environment for the system changes described above to embed.

E. DFID’s programme cycle

41. There are many points in the programme cycle where we consider risk and a number of tools already exist to help us do this. To be effective we need to be open and honest

Operational Plan

Business Case

Formal Agreement

Delivery Plan

Annual Review

Project Completion

Review about the risks and uncertainty we face in our work, and articulate them clearly throughout the programme cycle.

42. DFID develops programme portfolios for each business unit or spending department, with Heads of Department accountable for the delivery of Operational Plans. Heads of Department set out their strategic and portfolio priorities in Operational Plans, which must be cleared by Ministers. These Plans include Heads articulating their risk appetite for their portfolio, against which their individual programmes will be assessed and judged.

43. The scoping stage of the Business Case identifies risks and opportunities that could impact on the potential success of the programme. You should consider each of the identified risk categories and capture the information in a risk register. This will enable you to articulate your risk appetite for the programme and be clear about when risks will be escalated.

44. Following business case approval the focus moves to formalising agreements and contractual negotiations. There is an opportunity to build any issues around risk, monitoring, reporting etc. into the final agreements/contracts.

45. The delivery plan flows from the management case of the business case and documents the monitoring approach; risks, issues and delivery challenges; and any priority actions. It integrates risk management strategies as well as tracking risk tolerances or assumptions set out in the business case.

46. Annual reviews examine progress against the business case and part of this is considering how the identified risks have been addressed. If there are significant changes to risk assumptions made in the business case consideration should be given to amending it and seeking re-approval from ministers.

F. Roles and responsibilities

47. We all manage risks at work and in our daily lives and everyone has a distinct role to play. All staff are responsible for managing risks and this is built into our business processes. Managing risks begins at the concept stage of our business process and is considered at each step of the programme cycle through to project completion and lesson learning. This framework aims to bring consistency to our approach to managing risks, building on the good work that already exists across DFID. It details the basic

Design

Mobilisation

Delivery Plan

Annual Review

Smart Rules: Design

Mobilisation

Delivery requirements of good risk management at each level in the organisation and colleagues are encouraged to develop this further to meet their own particular needs and contexts. The framework is not an end in itself; it is there to stimulate dialogue across DFID.