Managing Risk Across the Enterprise A Guide for State Departments of Transportation NCHRP Project 08-93

Project Objectives Produce a guide Provide a framework Develop tools Assist implementation Demonstrate benefits Build on previous research 2NCHRP 08-93

Research Method Literature review Examination of international guides Analysis of ISO Interviews with state practitioners Extensive state examples Review of private sector practice Demonstration of advanced tools NCHRP

Findings ERM Provides documented benefits Is applicable to state transportation agencies Builds credibility, transparency Supports decision making Complements performance Provides consistency and continuity in services Minimizes threats, capitalizes on opportunities NCHRP

What Do We Mean by Risk? “Risk is the positive or negative effects of uncertainty or variability upon agency objectives.” It includes Uncertainty Variability Threats Opportunities 5NCHRP 08-93

Risk Management Defined “Risk management is the cultures, processes and structures that are directed towards the effective management of potential opportunities and threats.” 6NCHRP 08-93

Definition of the Process “The risk management process is the systematic application of policies, procedures, and practices to the identification and management of uncertainty or variability upon achievement of agency objectives.” Think of dynamically “managing risks” instead of risk management 7NCHRP 08-93

Why the Third Pillar? Asset and performance management drive performance Risk management is an enabler It identifies, mitigates uncertainty to objectives 8 Asset Management Performance Management Risk Management Strategic Objectives NCHRP 08-93

Why Manage Risk? Risks are inevitable If something is inevitable, it’s irresponsible to ignore it We practice either risk management or crisis management 9NCHRP 08-93

Additional Benefits Builds public trust Explicitly recognizes uncertainty that faces objectives Capitalizes on opportunities 10NCHRP 08-93

MAP-21 Requirements Measures for states to assess: IHS and NHS pavements NHS bridges Performance of IHS and NHS Risk-based asset management plans Safety measures to achieve: Serious injuries per vehicle mile travelled Fatalities per vehicle mile travelled Number of serious injuries Number of fatalities 11NCHRP 08-93

Expansion of Risk Management Risk management used to be a specialty area for controlling insurance costs Now it is a much broader architecture for enhancing corporate competencies Risk management required for publicly traded corporations It is a basic competency for Australian agencies 12NCHRP 08-93

The Guide: Formalizing Risk We all generally manage risks now Generally, however, application of risk is episodic or limited to specific projects or tasks The guide will support agencies in developing a systematic, comprehensive enterprise risk management program 13NCHRP 08-93

Guide Based on ISO 14 Establish the Context Manage Risks Identify Risks Analyze Risks Evaluate Risks Communicate and Consult Monitor and Review ISO risk process ISO is International Organization of Standards Based on earlier Australian framework Adopted across Europe and U.S. Guide adopts ISO framework NCHRP 08-93

Elements of the Guide Base Enterprise Risk Management in policy Give staff the tools Create ongoing process to actively manage risks 15 Process Tools Policies NCHRP 08-93

Managing Risk at All Levels Guide explains how to cascade risk management to all levels of organization Enterprise Program Project Activity 16NCHRP 08-93

Responsibilities Assigned Strategic Risks CEO, Senior Staff, Commission Program Risk Program Managers such as Safety, Pavement, Bridge, IT Project Risks Major Project Managers Activity Risks Activity managers such as winter operations, data collection, maintenance functions 17NCHRP 08-93

Provide Policy Basis Policy rationale: Reduce public harm Improve decisions Increase transparency, credibility All to understand, manage risks Develop, update, report risk registers 18NCHRP 08-93

Tools for Risk Identification Provides strategies to identify risks Risks come in many forms Guide helps to identify, categorize risks This feeds understanding of risks 19NCHRP 08-93

Risk Analysis Tools 20 Provides scales for scoring the likelihood and consequence of risks Creates common scoring system so disparate risks can be compared NCHRP 08-93

Cascades Risk Process Explains how to cascade a process to assess and monitor risks at all levels Provides feedback loops to leadership to manage all enterprise risks 21NCHRP 08-93

State of the Practice Two chapters illustrate application Critical review of state of practice Examples of risk applied to typical business areas NCHRP

Advanced Tools Risk registers Delphi Variability Simulator Monte Carlo Decision Trees NCHRP

Risk Registers Summarizes risk registers Explains their use Illustrates their benefits NCHRP

Scenario Forecast Risks Illustrates forecasting risk Capitalizes on simple Excel functions NCHRP

Monte Carlo Simulation Allows advanced analysis of randomness and variability NCHRP

Decision Trees Compares and graphically presents possible outcomes of different choices NCHRP

Conclusion Guide provides a comprehensive framework Quick Guide provides a brief summary Chapters provide a “get started” roadmap Advanced tools support more mature practitioners NCHRP