Risk Framework –

Country wise
Contents
1. UK
2. Canada
3. Australia / NZ
4. Others
UK
UK Gov RM Model
 The Orange Book (Management of Risk - Principles and Concepts) from UK
 High level guide designed to provide broad-based general guidance on principles of RM
 Includes identification and analysis of risk
 Importance of horizon scanning (Systematic activity designed to identify indicators of changes in risk)
 Examines how the organization’s RM activities relate to the wider environment in which it functions

4
UK Gov RM Model
Key Principles

1. Importance of linking risk to objectives

2. Distinction between the risk and its impact
3. Need of distinguishing inherent and residual risks
4. Prioritization of risks is more important than quantification
5. Risk appetite should be subdivided into corporate, delegated and project
6. Should have a dedicated risk committee

5
Canada
Canadian Gov RM model
Elements of ERM framework

1. Developing the corporate risk profile

 Identify risk through environment scanning (reviewing internal and external risk factors)
 Assess current status of RM within the organization
 Identify organization’s risk profile

2. Establishing and Integrated RM Function (RMF)

 Management direction on RM is communicated, understood and applied
 Implement IMR operation through existing decision making and reporting structures

7
Canadian Gov RM model
Elements of ERM framework

3. Practicing IRM
 Apply a common RM process consistently at all levels
 Integrate results of RM practices into informed decision making and priority settings
 Ongoing consultation and communication with stakeholders

4. Ensuring continuous RM learning

 Establish supportive work environment where learning from experience is valued, lessons are shared
 Results of RM are evaluated to support innovation , learning and continuous improvement
 Experience and best practices are shared, internally and across government

8
Canadian Gov RM model
Key Principles

1. Importance of a comprehensive understanding of organization’s risk profile , appetite and tolerance

2. Focus on RMF and the IRM activities
3. Value of a continuous and supportive learning environment
4. Need to establish the relationship between the organization and its operating environment , revealing the
interdependence of individual activities and the horizontal linkage

9
Australia / NZ
Australia & NZ Standard
AS/NZS 4360: best practice RM standard by Standards Australia

Elements of AS/NZA 4260:

1. Establish the context (SWOT factors)
2. Risk assessment: identify analyze evaluate
3. Treat Risk
4. Monitor and review
5. Communicate and consult

11
Australia & NZ Standard
AS/NZS 4360: best practice RM standard by Standards Australia

Key Principles

1. Detail on risk analysis for non-financial organization (Similar to op-risk for financial org)
2. Recommendation that RM process is formulated into a RM plan
3. Importance of senior management buy in
4. Need for adequate resources being allocated to RM

12
Others
ISO 31000
 Similar to the other guidance that provides generic guidelines without dealing with specific risks or sectors

 Step forward from existing standards (more of what is needed for successful ERM) but still not a
comprehensive framework

 Lack of key details about how to create in practice a “risk culture”

14
RAMP
Risk Assessment and Management of Projects (RAMP)
 Developed by IFA and Institute of Civil Engineers
 Primarily concern with capital projects but still relevant for day-to-day business

RAMP Process:
 Similar steps as AS/NZS 4260
 Additional steps:
 Project launch stage and project close down analysis
 Go/no-go decision step

15
IRM/AIRMIC/Alarm Standard
 Institute of Risk Management (IRM), Association of Insurance and Risk Managers (AIRMIC), and ALARM The
National Forum for Risk Management in the Public Sector
 Similar to COSO with a methodical approach to RM and a structured approach to risk reporting
 Strong focus on the role of a RM champion in the organization

Principles:
1. In-house approach to RM is preferable
2. Internal audit is an important control
3. Clarity over the roles of stakeholders is important
4. Highly structured approach to risk reporting is beneficial

16