Guidelines on Risk Management Practices in Statistical Organizations – 4Th DRAFT 1
Total Page:16
File Type:pdf, Size:1020Kb
Guidelines on risk management practices in statistical organizations – 4th DRAFT 1 GUIDELINES ON RISK MANAGEMENT PRACTICES IN STATISTICAL ORGANIZATIONS 4TH DRAFT January, 2017 Prepared by: In cooperation with: Guidelines on risk management practices in statistical organizations – 4th DRAFT 2 This page has been left intentionally blank Guidelines on risk management practices in statistical organizations – 4th DRAFT 3 TABLE OF CONTENTS EXECUTIVE SUMMARY ............................................................................................................. 5 1. Introduction .............................................................................................................................. 5 2. The value of Guidelines for statistical organisations ................................................................ 5 3. The three surveys to get information and in-depth analysis ................................................... 6 4. Brief summary of the Guidelines’ contents .............................................................................. 7 SECTION 1: RISK MANAGEMENT FRAMEWORK ......................................................................... 9 1. Settling the risk management system .............................................................................. 11 1.1 Definition of risk and risk management ................................................................................ 11 1.2 Risk management mandate and strategy .............................................................................. 14 1.3 Establishing risk management policy .................................................................................... 16 1.4 Risk management approaches .............................................................................................. 20 1.5 Adopting an integrated risk approach connected to statistical quality management ......... 23 2. Risk management resources ............................................................................................... 27 2.1 Risk organizational culture .................................................................................................... 27 2.2 Training .................................................................................................................................. 28 2.3 Delivering roles and responsibilities ...................................................................................... 29 3. Risk management process (see Section 2) ........................................................................... 31 4. Monitoring and reporting ................................................................................................... 32 4.1 Monitoring and review of the framework ............................................................................. 32 4.2 Establishing reporting mechanisms ....................................................................................... 33 SECTION 2: Risk management process .................................................................................... 38 1. Communication and consultation ....................................................................................... 40 1.1 Internal communication ........................................................................................................ 41 1.2 External communication ........................................................................................................ 43 2. Context analysis .............................................................................................................. 45 2.1 Establishing the context ........................................................................................................ 45 2.2 Process mapping .................................................................................................................... 46 3. Risk assessment .............................................................................................................. 48 3.1 Risk identification .................................................................................................................. 49 3.2 Risk analysis and measurement ............................................................................................ 53 3.3 Risk weighting ........................................................................................................................ 57 Guidelines on risk management practices in statistical organizations – 4th DRAFT 4 4. Risk treatment ................................................................................................................... 58 4.1 Risk treatment actions ........................................................................................................... 59 4.2 Risk treatment process .......................................................................................................... 61 5. Monitoring and control ...................................................................................................... 67 5.1 Monitoring and review .......................................................................................................... 67 5.2 Key risk indicators .................................................................................................................. 68 6. Risk based control and audit .............................................................................................. 70 7. Risk management information system ............................................................................... 73 8. Risk management maturity model ...................................................................................... 76 9. Lessons learned ................................................................................................................. 84 9.1 Strengths and weaknesses when implementing a risk management system in NSOs ......... 84 9.2 Cluster 1: Mandate to manage risks and Risk Policy ............................................................. 86 9.3 Cluster 2: Risk management procedure and the role of risk management office ................ 88 9.3 Cluster 3: Risk management integration with other functions ............................................. 89 9.4 Cluster 4: Risk management process ..................................................................................... 91 9.5 Cluster 5: Risk management supporting processes .............................................................. 94 9.6 Risk management integration into ongoing activities ........................................................... 96 SECTION 3: Innovating Risk management in the NSOs (The Agile Vision) ............................ 98 1. Enhancing Existing Risk Management in National Statistical Institutes by Using Agile Principles ............................................................................................................................. 100 1.1 Summary ............................................................................................................................. 100 1.2 - Introduction ....................................................................................................................... 100 1.3 Perceived tensions between traditional Risk Management and Agile ............................... 102 1.4 A future approach to Risk Management in an Agile Environment in NSIs .......................... 104 1.5 Principles .............................................................................................................................. 105 1.6 Conclusion ........................................................................................................................... 109 ACKNOWLEDGEMENTS ........................................................................................................ 116 Guidelines on risk management practices in statistical organizations – 4th DRAFT 5 EXECUTIVE SUMMARY 1. Introduction These Guidelines to implement Risk management in statistical organisations were drafted under the coordination of the UNECE High Level Group for the Modernisation of Official Statistics, by the Modernisation Committee on Organisational Framework and Evaluation (MCOFE), chaired by Jackey Mayda (Statistics Canada). The project has been mainly carried out by a workgroup from the Italian statistical office (ISTAT), led by Fabrizio Rotundi in cooperation with a team coordinated by Prof. Alessandro Hinna from the University of Rome “Tor Vergata”. The Guidelines contain a dedicated section on Agile in Risk management prepared by the “Task team on Risk Management in the context of Agile development”, led by Ben Whitestone and Rich Williams (UK Office for National Statistics). This was added at the request of participants in the Workshop on Risk Management in Geneva on 24-25/4/2016. 2. The value of Guidelines for statistical organisations Risk management comes under the initiatives aimed at modernising the national statistical organisations (NSOs), in that it concerns both organisation and production processes. Actually, Risk management, on the one hand, points at strengthening organisation governance on the whole by supporting the decision-making process when selecting priorities; on the other hand, it points at identifying, analysing and removing the uncertainties that can put obstacles in the way of quality. The Guidelines intend to give NSOs, interested in internally implementing a risk management system, a reference based on the practices developed within the UNECE organisations