EAC No. 0017
An Integrated Risk Management Framework
EAC 0017
Revision Page
|
Item |
Rev. No. |
Rev. Date
|
Date of Updating |
Signature |
|
|
|
|
|
|
EAC 0017
List of Effective Pages
|
Item |
Title |
Pages |
Dated |
|
EAC 00 |
|
|
|
EAC 0017
TABLE of CONTENTS
ITEM
|
TITLE |
|
|
General
|
|
|
Introduction |
|
|
Purpose
|
|
|
Applicability
|
|
|
Key Concepts |
|
|
Integrated Risk Management Framework |
|
|
Element
1: Developing the Corporate Risk Profile |
|
|
Element
2: Establishing an Integrated Risk Management Function |
|
|
Element 3: Practicing
Integrated Risk Management |
|
|
Element
4: Ensuring Continuous Risk Management Learning |
|
|
APPENDIX 1 Shared
Leadership--Suggested Roles and Responsibilities |
General
1. Introduction
1.1 The Integrated
Risk Management Framework strengthening decision-making in the civil aviation
interest and placing more emphasis on consultation and communication.
Similarly, it respects core civil aviation service values such as honesty,
integrity and probity at all levels, and contributes to improved results by
managing risk proactively. Integrated risk management also supports a
whole-of-government view grounded in rational priority setting and principles
of responsible spending.
1.2 The need for more
affordable and effective civil aviation authority combined with trends towards
revitalizing human resources capacity and redesigning service delivery are
dramatically affecting the structure and culture of civil aviation organizations.
The faster pace and need for innovation, combined with significant risk-based
events from computer failures to natural disasters, has focused attention on
risk management as essential in sound decision-making and accountability.
1.3 Responding to the
need to strengthen risk management as a priority on the ECAA agenda, the
results highlighted the need for a common understanding of risk management and
a more corporate, systematic approach. Informed by knowledge and experience,
the ECAA and its partners collaborated on the development of an Integrated Risk
Management Framework.
1.4 This Framework is
designed to advance the development and implementation of modern management
practices and to support innovation throughout the civil aviation Service. It provides
a comprehensive approach to better integrate risk management into strategic
decision-making.
1.5 The Framework
provides an organization with a mechanism to develop an overall approach to
manage strategic risks by creating the means to discuss, compare and evaluate
substantially different risks on the same page. It applies to an entire
organization and covers all types of risks faced by that organization (e.g.,
policy, operational, human resources, financial, legal, health and safety,
environment, reputational).
2. The purpose: The purpose
of the Integrated Risk Management Framework is to:
- provide guidance to advance
the use of a more corporate and systematic approach to risk management;
- contribute to building a
risk-smart workforce and environment that allows for innovation and
responsible risk-taking while ensuring legitimate precautions are taken to
protect the public interest, maintain public trust, and ensure due
diligence; and
- Propose a set of risk
management practices that departments can adopt, or adapt, to their
specific circumstances and mandate.
3. Applicability
3.1 Application of
the Framework is designed to strengthen management practices, decision-making
and priority setting to better respond to civil aviation' needs. Moreover,
practicing integrated risk management is expected to support the desired
cultural shift to a risk-smart workforce and environment. More specifically, it
is anticipated that implementation of the Framework will:
- support the ECAA
responsibilities by ensuring that significant risk areas associated with
policies, plans, programs and operations are identified and assessed, and
that appropriate measures are in place to address unfavorable impacts and
to benefit from opportunities;
- improve results through more
informed decision-making, by ensuring that values, competencies, tools and
a supportive environment form the foundation for innovation and
responsible risk-taking, and by encouraging learning from experience while
respecting parliamentary controls;
- strengthen accountability by
demonstrating that levels of risk associated with policies, plans,
programs and operations are explicitly understood, and that investment in
risk management measures and stakeholder interests are optimally balanced;
and
- Enhance stewardship by
strengthening public service capacity to safeguard people, government
property and interests.
3.2 Integrated risk
management respects and builds on core civil aviation service values. Outcomes
of applied integrated risk management must be ethical, honest and fair; respect
laws, government authorities and departmental policies; and result in prudent
use of resources.
3.3 The Integrated
Risk Management Framework responds to the Modernization of Comptrollership
which highlights a new guiding philosophy for comptrollership. This new
philosophy combines a strong commitment to four key elements: performance
reporting (financial and non-financial); sound risk management; the application
of an appropriate system of control and reporting; and values and ethics. In identifying
as a priority the strengthening of risk management across the Public Service,
the report stressed the need for:
- "... executives and
employees [to be] risk attuned--not only identifying but also managing
risks ...";
- "... matching more
creative and client-driven decision making and business approaches with
solid risk management..."; and
- "... creating an
environment in which taking risks and the consequences of doing so are
handled within a mature framework of delegation, rewards and
sanctions."
3.4 The Framework
builds on existing risk management practices, reflects current thinking, best
practices and the value of well-recognized principles for risk management. It
is linked with other federal risk management initiatives across civil aviation
community, including recent efforts to strengthen internal audit and increase
focus on monitoring. Risk management frameworks are also being developed in
areas such as legal risk management and the precautionary approach.
3.5 Management Challenges: The challenge for
the civil aviation Service is to approach risk management in a more integrated
and systematic way that includes greater emphasis on consultation and
communication with stakeholders and the public at large. In meeting this
challenge, the civil aviation Service can fulfill its increased responsibility
to demonstrate sound decision-making. Integrated risk management requires
looking across all aspects of an organization to better manage risk.
Organizations that manage risk organization-wide have a greater likelihood of
achieving their objectives and desired results. Effective risk management
minimizes losses and negative outcomes and identifies opportunities to improve
services to stakeholders and the public at large.
3.6 A systematic,
integrated but adaptable approach to risk management requires an organization
to build capacity to address risk explicitly, to increase the organization's
and stakeholders' confidence in its ability to achieve its goals. It
contributes to better use of time and resources, improved teamwork and
strengthened trust through sharing analyses and actions with partners. In
emphasizing the need for more active and frequent consultation and risk
communication, an integrated approach to risk management leads to shared
responsibility for managing risk. It also increases confidence in the
organization's process, and improves public and stakeholder understanding of
trade-offs.
3.7 Developing a Risk-Smart Workforce and
Environment
Application of the
Integrated Risk Management Framework, in conjunction with related risk
management activities, will support a cultural shift to a risk-smart workforce
and environment in the civil aviation Service. Such an environment is one that
supports responsible risk management, where risk management is built into
existing organizational structures, and planning and operational processes. An
essential element of a risk-smart environment is to ensure that the workplace
has the capacity and tools to be innovative while recognizing and respecting
the need to be prudent in protecting the civil aviation interest and
maintaining civil aviation services trust.
3.8 Key
Concepts
There are three critical concepts that are cornerstones of the Integrated
Risk Management Framework: risk, risk management and integrated risk
management. These concepts are elaborated on below
Risk: Refers to the uncertainty that surrounds future events and outcomes. It is
the expression of the likelihood and impact of an event with the potential to
influence the achievement of an organization's objectives.
The phrase
"the expression of the likelihood and impact of an event" implies
that, as a minimum, some form of quantitative or qualitative analysis is
required for making decisions concerning major risks or threats to the
achievement of an organization's objectives. For each risk, two calculations
are required: its likelihood or probability; and the extent of the impact or
consequences
Risk management: Is a systematic approach to setting the best course of action under
uncertainty by identifying, assessing, understanding, acting on and
communicating risk issues?
Risk
management is about making decisions that contribute to the achievement of an
organization's objectives by applying it both at the individual activity level
and in functional areas.
Integrated risk management: Is a continuous, proactive and systematic process to understand,
manage and communicate risk from an organization-wide perspective. It is about
making strategic decisions that contribute to the achievement of an organization's
overall corporate objectives.
An
Integrated Risk Management Framework: The Integrated Risk Management Framework provides
guidance to adopt a more holistic approach to managing risk. The application of
the Framework is expected to enable employees and organizations to better
understand the nature of risk, and to manage it more systematically.
3.9 An
Integrated Risk Management Framework
The Integrated Risk
Management Framework provides guidance to adopt a more holistic approach to
managing risk. The application of the Framework is expected to enable employees
and organizations to better understand the nature of risk, and to manage it
more systematically.
Four Elements and Their Expected Results
3.9 Four Elements and Their Expected Results
Element 1: Developing
the Corporate Risk Profile
- the organization's risks are
identified through environmental scanning;
- current status of risk
management within the organization is assessed; and
- The organization's risk
profile is identified.
Element 2:
Establishing an Integrated Risk Management Function
- management direction on risk
management is communicated, understood and applied;
- approach to operationalize
integrated risk management is implemented through existing decision-making
and reporting structures; and
- Capacity is built through
development of learning plans and tools.
Element 3: Practicing
Integrated Risk Management
- a common risk management
process is consistently applied at all levels;
- results of risk management
practices at all levels are integrated into informed decision-making and
priority setting;
- tools and methods are
applied; and
- Consultation and
communication with stakeholders is ongoing.
Element 4: Ensuring
Continuous Risk Management Learning
- a supportive work
environment is established where learning from experience is valued,
lessons are shared;
- learning plans are built
into an organization's risk management practices;
- results of risk management
are evaluated to support innovation, learning and continuous improvement;
and
- Experience and best practices
are shared, internally and across government.
Element 1:
Developing the Corporate Risk Profile
- the organization's risks are
identified through environmental scanning;
- current status of risk
management within the organization is assessed; and
- The organization's risk
profile is identified.
An organization can
expect three key outcomes as a result of developing the corporate risk profile:
|
2.1
External and Internal Environment
- Through
the environmental scan, key external and internal factors and risks
influencing an organization's policy and management agenda are identified.
Identifying major trends and their variation over time is particularly
relevant in providing potential early warnings. Some external factors
to be considered for potential risks include:
- Political: the influence of
international governments and other governing bodies;
- Economic: international and
national markets, globalization;
- Social: major demographic
and social trends, level of stakeholders engagement; and
- Technological: new
technologies.
- Internally, the following factors
are considered relevant to the development of an organization's risk
profile:
- the
overall management framework
- governance
and accountability structures;
- values
and ethics;
- operational
work environment;
- individual
and corporate risk management culture and tolerances;
- existing
risk management expertise and practices;
- human
resources capacity;
- level
of transparency required; and local and corporate policies,
- Procedures
and processes.
- The
environmental scan increases the organization's awareness of the key
characteristics and attributes of the risks it faces. These include:
- type of risk: technological,
financial, human resources, health, safety;
- source of risk: external
(political, economic, natural disasters); internal (reputation, security,
knowledge management, information for decision making);
- what is at risk: area of
impact/type of exposure (people, program results, materiel, real
property); and
- Level of ability to control
the risk: high (operational); moderate (reputation); low (natural
disasters).
- An
organization's risk profile identifies key risk areas that cut across the
organization (functions, programs, systems) as well as individual events,
activities or projects that could significantly influence the overall
management priorities, performance, and realization of organizational
objectives.
- The
environmental scan assists the department in establishing a strategic
direction for managing risk, making appropriate adjustments in decisions
and actions. It is an ongoing process that reinforces existing management
practices and supports the attainment of overall management excellence.
2.2
Assessing Current Risk Management Capacity
- In
assessing internal risk management capacity, the mandate, decision-making
structures, planning processes, infrastructure, and human and financial
resources are examined from the perspective of risk. The assessment
requires an examination of the prevailing risk management culture, risk
management processes and practices to determine if adjustments are
necessary to deal with the evolving risk environment.
- Furthermore,
the following factors are considered key in assessing an organization's
current risk management capacity:
a. individual factors (knowledge,
skills, experience, risk tolerance, propensity to take risk);
b. group factors (the impact
of individual risk tolerances and willingness to manage risk);
c. organizational
factors (strategic direction, stated or implied risk tolerance); as well as
d. External factors (elements
that affect particular risk decisions or how risk is managed in general).
2.3 .1 an awareness
and understanding of the current risk tolerances of various stakeholders is a
key ingredient in establishing the corporate risk profile. The environmental
scan will identify stakeholders affected by an organization's decisions and
actions, and their degree of comfort with various levels of risk. Understanding
the current state of risk tolerance of interest groups, suppliers, as well as
other civil aviation departments will assist in developing a risk profile and
making decisions on what risks must be managed, how, and to what extent. It
will also help identify the challenges associated with risk consultations and
communication.
2.3
.2 Risk tolerances can be determined through
consultation with affected parties, or by assessing stakeholders' response or
reaction to varying levels of risk exposure. Risk tolerances may change over
time as new information and outcomes become available, as societal expectations
evolve and as a result of stakeholder engagement on trade-offs. Before
developing management strategies, a common approach to the assessment of risk
tolerance needs to be understood organization-wide.
2.3
.3 Determining and communicating an
organization's own risk tolerance is also an essential part of managing risk.
This process identifies areas where minimal levels of risk are permissible, as
well as those that should be managed to higher, yet reasonable levels of risk.
3. Element 2:
Establishing an Integrated Risk Management Function
- management direction on risk
management is communicated, understood and applied;
- approach to operationalize
integrated risk management is implemented through existing decision-making
and reporting structures; and
- Capacity is built through
development of learning plans and tools.
- To
ensure that risk management is integrated in a rational, systematic and
proactive manner, an organization should seek to achieve three related
outcomes:
|
3.1 Strategic Risk
Management Direction
·
The establishment and communication of the organization's
risk management vision, objectives and operating principles are vital to
providing overall direction, and ensure the successful integration of the risk
management function into the organization. Using these instruments can
reinforce the notion that risk management is everyone's business.
·
It is essential that management provides a clear
statement of its commitment to risk management and determines the best way to
implement risk management in its organization. This includes establishing a
corporate focus and communicating internal parameters, priorities, and
practices for the implementation of risk management. To reinforce the corporate
focus on risk management, organizations may dedicate a small number of
resources to provide both advisory and challenge functions, and to specifically
integrate these responsibilities into an existing unit (for example, Corporate
Planning and Policy, Comptrollership Secretariat, Internal Audit).
·
In establishing the strategic risk management direction,
internal and external concerns, perceptions and risk tolerances are taken into
account. It is also imperative to identify acceptable risk tolerance levels so
those unfavorable outcomes can be remedied promptly and effectively. Clear
communication of the organization's strategic direction will help foster the
creation and promotion of a supportive corporate risk management culture.
·
Objectives and strategies for risk management are
designed to complement the organization's existing vision and goals. In
establishing an overall risk management direction, a clear vision for risk
management is articulated and supported by policies and operating principles.
The policy would guide employees by describing the risk management process,
establishing roles and responsibilities, providing methods for managing risk,
as well as providing for the evaluation of both the objectives and results of
risk management practices.
3.2
Integrating Risk Management into Decision Making
3.2 .1 Effective risk
management cannot be practiced in isolation, but needs to be built into
existing decision-making structures and processes. As risk management is an
essential component of good management, integrating the risk management
function into existing strategic management and operational processes will
ensure that risk management is an integral part of day-to-day activities. In
addition, organizations can capitalize on existing capacity and capabilities
(e.g., communications, committee structures, existing roles and
responsibilities, etc.)
3.2
.2While each organization will find its own way
to integrate risk management into existing decision-making structures, the
following are factors that may be considered:
- aligning risk management
with objectives at all levels of the organization;
- introducing risk management
components into existing strategic planning and operational processes;
- communicating corporate
directions on acceptable level of risk; and
- Improving control and
accountability systems and processes to take into account risk management
and results.
3.2
.3 The integration of risk management into
decision-making is supported by a corporate philosophy and culture that
encourages everyone to manage risks. This can be accomplished in a number of
ways, such as:
- seeking excellence in
management practices, including risk management;
- having senior managers
champion risk management;
- encouraging innovation,
while providing guidance and assistance in situations that do not turn out
favorably;
- encouraging managers to
develop knowledge and skills in risk management;
- including risk management as
part of employees' performance appraisals;
- introducing incentives and
rewards; and
- Recruiting on risk
management ability as well as experience.
3.3
Reporting on Performance
3.3.1 The development of
evaluation and reporting mechanisms for risk management activities provides
feedback to management and other interested parties in the organization and
government-wide. The results of these activities ensure that integrated risk
management is effective in the long term. Some of these activities could fall
to functional groups in the organization responsible for review and audit.
Responsibility may also be assigned to operational managers and employees to
ensure that information affecting risk that is collected as part of local
reporting or practices is incorporated into the environmental scanning process.
Reporting could take place through normal management channels (performance
reporting, ongoing monitoring, appraisal) as part of the advisory and challenge
functions associated with risk management.
3.3
.2 Reporting facilitates learning and improved
decision-making by assessing both successes and failures, monitoring the use of
resources, and disseminating information on best practices and lessons learned.
Organizations should evaluate the effectiveness of their integrated risk
management processes on a periodic basis. In collaboration with departments,
the Egyptian civil aviation authority will review the effectiveness of the
Integrated Risk Management Framework and make the necessary adjustments to
ensure sustained progress in building a risk-smart workforce and environment.
3.4 Building
Organizational Capacity
3.4 .1 Building risk management
capacity is an ongoing challenge even after integrated risk management has
become firmly entrenched. Environmental scanning will continue to identify new
areas and activities that require attention, as well as the risk management
skills, processes, and practices that need to be developed and strengthened.
3.4
.2 Organizations need to develop their own
capacity strategies based on their specific situation and risk exposure. The
implementation of the Integrated Risk Management Framework will be further
supported by the Treasury Board of Canada Secretariat, which, through a centre
of expertise, will provide overall guidance, advice and share best practices.
3.4 .3 to build capacity for
risk management, there needs to be a focus on two key areas: human resources,
and tools and processes at both the corporate and local levels. The risk
profile will identify the organization's existing strengths and weaknesses
vis-à-vis capacity. Areas that may require attention include:
3.5 Human Resources
- building awareness of risk
management initiatives and culture;
- broadening skills base
through formal training including appropriate applications and tools;
- increasing knowledge base by
sharing best practices and experiences; and
- Building capacity,
capabilities and skills to work in teams.
3.6 Tools and Processes
- developing and adopting
corporate risk management tools, techniques, practices and processes;
- providing guidance on the
application of tools and techniques;
- allowing for development and/or
the use of alternative tools and techniques that may be better suited to
managing risk in specialized applications; and
- Adopting processes to ensure
integration of risk management across the organization.
4. Element 3:
Practicing Integrated Risk Management
- a common risk management
process is consistently applied at all levels;
- results of risk management
practices at all levels are integrated into informed decision-making and
priority setting;
- tools and methods are
applied; and
- Consultation and communication
with stakeholders is ongoing.
·
Implementing an integrated risk management approach
requires a management decision and sustained commitment, and is designed to
contribute to the realization of organizational objectives. Integrated risk
management builds on the results of an environmental scan and is supported by
appropriate corporate infrastructure.
·
The following outcomes are expected for practicing
integrated risk management:
|
4.1 A
Common Process
·
A common, continuous risk management process assists an
organization in understanding, managing and communicating risk. Continuous risk
management has several steps. Emphasis on various points in the process may
vary, as may the type or extent of actions considered, but the basic steps are
similar. In the exhibits that follow, Exhibit 1 illustrates an example of a
continuous risk management process that focuses on an integrated approach to
risk management.
Exhibit 1: A Common Risk Management
Process
Internal and external communication and continuous learning improve
understanding and skills for risk management practice at all levels of an
organization, from corporate through to front-line operations. The process
provides common language; guides decision-making at all levels, and allows
organizations to tailor their activities at the local level. Documenting the
rationale for arriving at decisions strengthens accountability and demonstrates
due diligence.
The common risk management process and related activities are:
a) Risk Identification: Identifying Issues, Setting Context
- Defining the problems or
opportunities, scope, context (social, cultural, scientific evidence,
etc.) and associated risk issues.
- Deciding on necessary
people, expertise, tools and techniques (e.g., scenarios, brainstorming,
and checklists).
- Performing a stakeholder
analysis (determining risk tolerances, stakeholder position, and
attitudes).
b)
Risk Assessment
Assessing Key Risk Areas
- Analyzing context/results of
environmental scan and determining types/categories of risk to be
addressed, significant organization-wide issues, and vital local issues.
Measuring Likelihood and Impact
- Determining degree of
exposure, expressed as likelihood and impact, of assessed risks, choosing
tools.
- Considering both the
empirical/scientific evidence and public context.
Ranking Risks
- Ranking risks, considering
risk tolerance, using existing or developing new criteria and tools.
c)
Responding to Risk
Setting Desired Results
- Defining objectives and
expected outcomes for ranked risks, short/long term.
Developing Options
- Identifying and analyzing
options--ways to minimize threats and maximize opportunities--approaches,
tools.
Selecting a Strategy
- Choosing a strategy,
applying decision criteria--results-oriented, problem/opportunity driven.
- Applying, where appropriate,
the precautionary approach/principle as a means of managing risks of
serious or irreversible harm in situations of scientific uncertainty.
Implementing the Strategy
- Developing and implementing
a plan.
d)
Monitoring and Evaluation
Monitoring, Evaluating and Adjusting
- Learning, improving the
decision-making/risk management process locally and organization-wide,
using effectiveness criteria, reporting on performance and results.
Organizations may vary the basic steps and supporting tasks most suited to
achieving common understanding and implementing consistent, efficient and
effective risk management. A focused, systematic and integrated approach
recognizes that all decisions involve management of risk, whether in routine
operations or for major initiatives involving significant resources. It is
important that the risk management process be applied at all levels, from the
corporate level to programs and major projects to local systems and operations.
While the process allows tailoring for different uses, having a consistent
approach within an organization assists in aggregating information to deal with
risk issues at the corporate level.
4.2
Integrating Results for Risk Management into Practices at all Levels
The results of risk management are to be integrated both horizontally and
vertically into organizational policies, plans and practices. Horizontally, it
is important that results be considered in developing organization-wide
policies, plans and priorities. Vertically, functional units, such as branches
and divisions, need to incorporate these results into programs and major
initiatives.
In practice, the risk assessment and response to risk would be considered
in developing local business plans at the activity, division or regional level.
These plans would then be considered at the corporate level, and significant
risks (horizontal or high-impact risks) would be incorporated into the
appropriate corporate business, functional or operational plan.
The responsibility centre providing the advisory and "corporate
challenge" functions can add value to this process, since new risks might
be identified and new risk management strategies required after the roll-up.
There needs to be a synergy between the overall risk management strategy and
the local risk management practices of the organization.
Each function or activity would have to be examined from three standpoints:
- its
purpose: risk management would look at decision-making, planning, and
accountability processes as well as opportunities for innovation;
- its
level: different approaches are required based on whether a function or
activity is strategic, management or operational; and
- the
relevant discipline: the risks involved with technology, finance, human
resources, and those regarding legal, scientific, regulatory, and/or
health and safety issues.
4.3
Tools and Methods
At a technical level, various tools and techniques can be used for managing
risk. The following are some examples:
- risk
maps: summary charts and diagrams that help organizations identify,
discuss, understand and address risks by portraying sources and types of
risks and disciplines involved/needed;
- modeling
tools: such as scenario analysis and forecasting models to show the range of
possibilities and to build scenarios into contingency plans;
- framework
on the precautionary approach: a principle-based framework
that provides guidance on the precautionary approach in order to improve
the predictability, credibility and consistency of its application across
the federal government;
- qualitative
techniques: such as workshops, questionnaires, and self
-assessment to identify and assess risks; and
- Internet
and organizational Intranets: promote risk awareness and
management by sharing information internally and externally.
Exhibit 2 provides an example of a risk management model. In this model,
one can assess where a particular risk falls in terms of likelihood and impact
and establish the organizational strategy/response to manage the risk.
Exhibit 2: A Risk Management Model
In developing methods to provide guidance on risk management, the different
levels of readiness and experience in a department, as well as variations in
available resources need to be recognized. Therefore, methods need to be
flexible and simple using clear language to ensure open channels of
communication.
Several practical methods that could be used to provide guidance are:
- a
managers' forum: where risks are identified, proposed actions are
discussed and best practices are shared;
- an
internal risk management advisory function: dedicated to risk
management, either as a special unit or associated with an existing
functional unit; and
- Tool
kits: a collection of effective risk management tools such as checklists,
questionnaires, best practices.
4.4
Communication and Consultation
·
Communication of risk and consultation with interested
parties are essential to supporting sound risk management decisions. In fact,
communication and consultation must be considered at every stage of the risk
management process.
·
A fundamental requirement for practicing integrated risk
management is the development of plans, processes and products through ongoing
consultation and communication with stakeholders (both internal and external)
who may be involved in or affected by an organization's decisions and actions.
·
Consultation and proactive employee engagement will
assist in bridging gaps between statistical evidence and perceptions of risk.
It is also important that risk communication practices anticipate and respond
effectively to business concerns and expectations.
·
Risk communication involves a range of activities,
including issue identification and assessment, analysis of the civil aviation
environment (including stakeholder interests and concerns), development of
consultation and communications strategies, message development, working with the
media, and monitoring and evaluating commenced dialogue.
·
Within the civil aviation community, it is expected that
consultation activities, including those related to risk management, will be
undertaken in a manner that is consistent with the ECAA Communications Policy.
5. Element 4:
Ensuring Continuous Risk Management Learning
- a supportive work
environment is established where learning from experience is valued,
lessons are shared;
- learning plans are built
into an organization's risk management practices;
- results of risk management
are evaluated to support innovation, learning and continuous improvement;
and
- Experience and best
practices are shared, internally and across organization.
Continuous learning is fundamental to more informed and proactive
decision-making. It contributes to better risk management, strengthens
organizational capacity and facilitates integration of risk management into an
organizational structure. To ensure continuous risk management learning, pursue
the following outcomes:
|
5.1
Creating a Supportive Work Environment
·
A supportive work environment is a key component of
continuous learning. Valuing learning from experience, sharing best practices
and lessons learned, and embracing innovation and responsible risk-taking
characterize an organization with a supportive work environment. An
organization with a supportive work environment would be expected to:
Promote
learning
- by fostering an environment
that motivates people to learn;
- by valuing knowledge, new
ideas and new relationships as vital aspects of the creativity that leads
to innovation; and
- By including and emphasizing
learning in strategic plans.
5.2
Learn from experience
- by valuing experimentation,
where opportunities are assessed for benefits and consequences;
- by sharing learning on past
successes and failures; and
- by using "lessons
learned" and "best practices" in planning exercises.
5.3
Demonstrate management leadership
- by selecting leaders who are
coaches, teachers and good stewards;
- by demonstrating commitment
and support to employees through the provision of opportunities,
resources, and tools; and
- By making time, allotting
resources and measuring success through periodic reviews (e.g., learning
audits).
5.4
Building Learning Plans in Practices
5.4.1 Since continuous learning contributes significantly to increasing
capacity to manage risk, the integration of learning plans into all aspects of
risk management is fundamental to building capacity and supporting the
strategic direction for managing risk.
5.4.2 As part of a unit's learning strategy, learning plans provide for the
identification of training and development needs of each employee. Effective
learning plans, reflecting risk management learning strategies, are linked to
both operational and corporate strategies, incorporate opportunities for
managers to coach and mentor staff, and address competency gaps (knowledge and
skills) for individuals and teams. The inclusion of risk management learning
objectives in performance appraisals is a useful approach to support continuous
risk management learning.
5.5
Supporting Continuous Learning and Innovation
5.5.1In implementing a continuous learning approach to risk management, it
is important to recognize that not all risks can be foreseen or totally
avoided. Procedures are paramount to ensure due diligence and to maintain
public confidence. Goals will not always be met and innovations will not always
lead to expected outcomes. However, if risk management actions are informed and
lessons are learned, promotion of a continuous learning approach will create
incentives for innovation while still respecting organizational risk
tolerances. The critical challenge is to show that risk is being well-managed
and that accountability is maintained while recognizing that learning from
experience is important for progress.
5.5.2 In addition to demonstrating accountability, transparency and due
diligence, proper documentation may also be used as a learning tool. Practicing
integrated risk management should support innovation, learning, and continuous
improvement at the individual, team and organization level.
5.5.3 An organization demonstrates continuous learning with respect to risk
management if:
- an appropriate risk
management culture is fostered;
- learning is linked to risk
management strategy at many levels;
- responsible risk-taking and
learning from experience is encouraged and supported;
- there is considerable
information sharing as the basis for decision-making;
- decision-making includes a
range of perspectives including the views of stakeholders, employees and
citizens; and
- Input and feedback are
actively sought and are the basis for further action.
5.6 Conclusion
a.
The Integrated Risk Management Framework advances a more
systematic and integrated approach for risk management. By focusing on the
importance of risk communication and risk tolerance, it looks outside the
organization for the views of Canadians. Internally, it emphasizes the
importance of people and leadership and the need for departments and agencies
to more clearly define their roles. The Framework provides a tool that helps
organizations communicate a vision and objectives for management of risk based
on government values and priorities, lessons learned best practices and
consultation with stakeholders.
b.
The Framework is a fundamental part of the federal
management agenda and Modern Comptrollership. It is designed to support the
optimization of resource allocation and responsible spending, paramount for
achieving results. It also builds on public sector values, knowledge management
and continuous learning for innovation. The Integrated Risk Management
Framework is the first step in establishing the foundation for more strategic
and corporate integrated risk management in departments and in government. In
the future, the Framework will be supported by tools and guidance documents as
well as complemented by other risk management initiatives.
c.
The Egyptian civil aviation authority intends to work
closely with departments and agencies in implementing the Integrated Risk
Management Framework and in tracking progress toward building a risk-smart
workforce and environment in the Public Service.
Appendix1
Shared
Leadership--Suggested Roles and Responsibilities
In moving toward an integrated risk management function, everyone has a
role to play. Combining shared leadership with a team approach will help contribute
to the success of integrated risk management throughout the organization.
Suggested roles and responsibilities that could be considered by the different
parties involved in integrated risk management are outlined below.
The Egyptian
civil aviation authority
- communicating and explaining
the Integrated Risk Management Framework;
- providing guidance, training
and a centre of expertise in support of the Integrated Risk Management
Framework;
- providing Treasury Board,
other central agencies with risk management information and advice
appropriate to their responsibilities; and
- Periodically examining and
evaluating the effectiveness of the Integrated Risk Management Framework,
tracking progress and reporting on best practices.
Deputy Heads or Equivalent
- setting the tone from the
top that systematic and integrated risk management is valuable for
understanding uncertainty in decision-making and for demonstrating
accountability to stakeholders;
- determining the best way to
implement the Integrated Risk Management Framework in their organization;
- ensuring that a supportive
learning environment exists for risk management, including sensible risk
taking and learning from experience;
- ensuring, from a corporate
perspective, that risks are prioritized, and that appropriate risk
management strategies are in place to respond to identified risks; and
- Ensuring the capacity to
report on the performance of the risk management function (i.e., knowing
how well the department or agency is managing risk).
Senior Management
- integrating risk management
into overall departmental strategy and management frameworks;
- providing managers and
employees with learning opportunities and training to build competencies;
and
- Allocating resources for
investment in more systematic risk management.
Managers
- considering risk as a part
of their decision-making process; and
- Ensuring there is
appropriate ongoing operational and corporate-related risk management
action, planning, training, control, monitoring and documentation.
Functional Advisors and Specialists
- ensuring that policy and
related advice, guidance and assistance is in line with central agency and
departmental policies on risk management and senior management's
objectives;
- helping managers identify
and assess risk and the effectiveness, efficiency and economy of existing
measures to manage risk; and
- Helping managers design and
implement tools for more effective risk management.
Review, Internal Audit
- Reporting to the Deputy Head
on the department's or agency's performance under the Integrated Risk
Management Framework.
All Public Suppliers
- staying aware of and
attentive to risk management issues;
- risk-smart behaviors and
outcomes--considering limitations, key risk areas and fundamental rules to
understand risks they can and cannot take (i.e., understanding where there
is allowance for honest mistakes and where prudence is paramount); and
- Documenting decisions and
supporting information.