Measuring an Organisation's Risk Appetite

One of the questions I need to answer in my dissertation is: What is UNDP's risk appetite?

Initial reading from Gambir Bhatta's "Don't do something, stand there! Revisiting the Issue of Risks in Innovation in the Public Sector":

Each organization’s appetite or tolerance for risks is unique and will vary according to any one (or combination) of several variables but may be conceived of as in: the extent of its legal mandate including any fuzzy boundaries around it; the intractability of the problem it is dealing with; the strategy(ies) it pursues to meet the mandate; its degree of access to relevant information; its organizational culture; the management style of its leaders although it could be argued that over time, this will tend to settle at a level that is determined by the organizational culture rather than the leaders’ styles); the responsible minister’s own risk appetite; and the organization’s age.

Notationally, this could be framed as:

Departmental Risk Appetite

{RAd = f(M1, M2, S, Ia, OC, MS, MRAt-1, OA, e}

where M1 is organizational mandate, M2 is degree of problem intractability, S is strategy, Ia is degree of access to relevant information, OC is organizational culture, MS is manager’s style, MRAt-1 is minister’s risk appetite (which itself is also a function of the collective risk appetite of government, and of the perception of severity of risk but lagged because it generally takes time to diffuse to departmental level), OA is age of organization, and e is the error term.

Link: http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.174.4005&rep=rep1&type=pdf.

Re-acquaintance with Risk Management

'Not having enough knowledge on risk management' is one of my biggest risk for my thesis. Interestingly, I had a little discussion with Alec and Dennis whether this is a worry, issue or risk... (which is really confusing me right now!).

To manage this worry/issue/risk (of not having sufficient knowledge) I realise I need to read about risk management on a deeper level. I have read some books on risk management process for my module assignments, but this is the first time I'm approaching a book to understand the underlying philosophy of risk management.

To start with, I picked up a small undaunting thin book entitled "Exploiting Future Uncertainty: Creating Value from Risk" by David Hillson.
---
A question on the first chapter directly caught my attention:

Can we prove a link between risk management practice and improved bottom-line outcomes? (Hillson, 2010)

This directly relates to the question I am trying to answer for my thesis:

How can UNDP improve its risk management practice to contribute towards achieving (country) programme outcomes?

Before I can correlate risk management practice and outcomes in the UNDP context, I need to know first if it is possible to relate risk management to results! Well, at least Hillson is convinced so. These are some insights from the first chapter of the book:

• "If we track performance, we should be able to see if there is any link between our ability to manage risk and success rate."
• From experience over time, it can be demonstrated that as risk management maturity and competence increases, so does success.
• It cannot be ascertained that investing in risk management correlates with lack of problems. But it can be measure how successful risk management creates additional value through maximising opportunities.

Sounds promising, I'm excited to read on!

---

HILLSON, D. 2010. Exploiting future uncertainty : creating value from risk, Farnham, Surrey, England ; Burlington, Vt., Gower.

A New Beginning

Okay... so I got feedback from my supervisor regarding my thesis outline. Although a lot of questions have been raised after our discussion, (I think) at least he approves the direction I'm headed! So hopefully this will keep the ball rolling. So now I'm confident in putting my research question up... here goes...

---
INTRODUCTION

International development programmes and projects exist in a climate of significant uncertainties (Ika et al., 2010, Khang and Moe, 2008, Kwak and Dewan, 2001). The United Nations Development Programme (UNDP) environment, in particular, deals with multifaceted organisational structures, wide-ranging mandates, numerous stakeholders, controlled resources and limited capacities (Terzi and Posta, 2010, Browne, 2011).

Concerned with the agency’s risk responsiveness, in its 2008-2011 Strategic Plan, UNDP advocated organisation-wide efforts on improving its risk management capabilities (UNDP, 2008). UNDP recognises the value of efficiently managing threats and calculatingly pursuing opportunities to achieve development results (UNDP, 2008). Concurrently, UNDP also acknowledges the challenge of integrating the practice of systematic risk management into its culture; especially in its country offices (Terzi and Posta, 2010).

In the context of improving programme outcomes, this research work attempts to provide recommendations for increasing risk management maturity. This study explores the extent of current risk management practices on selected UNDP Country Programmes.

RESEARCH QUESTION and OBJECTIVES

Question: How can UNDP improve its risk management practice to contribute towards achieving country programme outcomes?

Objectives:
1. To profile the risk management maturity levels of selected UNDP Country Programmes.
2. To find relationship between risk management maturity and programme outcomes.
3. To highlight areas of vulnerabilities in the current risk management practice.
4. To provide recommendations for increasing risk management capability.

---
References

BROWNE, S. 2011. The United Nations Development Programme and System, Abingdon, Oxon ; New York, Routledge.

IKA, L. A., DIALLO, A. & THUILLIER, D. 2010. Project management in the international development industry: The project coordinator's perspective. International Journal of Managing Projects in Business, 3, 61-93.


KHANG, D. B. & MOE, T. L. 2008. Success criteria and factors for international development projects: A life‐cycle‐based framework. Project Management Journal, 39, 72-84.

KWAK, Y. H. & DEWAN, S. Risk management in international development projects. Proceedings of the Project Management Institute Annual Seminars & Symposium, 2001 Nashville, Tenn, USA.

TERZI, C. & POSTA, I. 2010. Review of Enterprise Risk Management in the United Nations System: Benchmarking Framework. Available: http://www.unjiu.org/data/reports/2010/en2010_4.pdf [Accessed 01 February 2012].

UNDP. 2008. UNDP strategic plan 2008-2011: Accelerating global progress on human development. Available: www.undp.org/execbrd/word/dp07-43Rev1.doc [Accessed 01 February 2012].

18 Feb 2012 Tutorials

Questions for my questions...! Today's tutorials raised a lot of questions. But at least I somehow found some possible routes through the fuzziness of this research. I'm putting my current research question in a separate post.

Here I am just highlighting the inputs and questions I got from my supervisors:

Dennis:

1. UNDP Risk Management Process -- should risk retirement be included?
2. Step 4 and 5 in the ERM cycle (Action and Monitoring & Reporting) can be the potential focus of my research
3. Should the research be limited to CMM to risk management? Perhaps a more cohesive approach?
4. Can programme outcomes be related to risk management level? - There is a possibility that research will be inconclusive. There is a latency in between risk management implementation and seeing the programme outcomes.
5. A possible approach to the project is to look at parallels. Is the success of risk management in other industries transferable to the UNDP context?

Eddie:

1. What is UNDP's appetite for risk?
2. True commitment/implementation to risk management in UNDP might be nil!
3. Look into Prince2 strategies, UNDP has put in a lot of effort in 'benefits strategy'. Now UNDP is starting on 'risk strategy'... Look into this.
4. Perhaps a more cohesive approach to risk management? Balanced scorecard approach, taking into account benefits, quality, configuration etc?

Alec:

1. Possible approach for research is to look at end results, lessons learned and see where risk management could have been applied. Track back... reverse engineering(?)
2. Is the UNDP risk management framework fit for its purpose? How is it different from the framework of corporations? Is it the same?
3. What is so special about the risk management framework in UNDP?
• If the same, how can it be applied more efficiently?
• If different, how can the framework be tailored to the context of UNDP
4. Is there a discernible outcome where risk management is applied (or not applied?) in UNDP projects?
• If not, why not? Is it because risk management is not properly applied or is it because the framework/method doesn't work?
5. Suggest to first conduct study/research on risk management and the risk management framework of UNDP
• But! prioritise what data is publicly available, and what data should  be asked from Eddie.
• Availability of data is crucial!

Augh!!! I'm not sure if my research is getting fuzzier or clearer. So much questions to answer... so much work to do! 

UNDP Country Programming

UNDP Country programming cycle (UNDP, 2011)

---
UNDP 2011, National Implementation by Government of UNDP Supported Projects: Guidelines and Procedures.

Mapping UNDP

I do some scratch-work on loose bits of paper... just trying to make sense of things. I'm taking pictures of them and documenting it here in my blog so I can refer back to them (just in case if I mistakenly throw them away).

I found this today... I actually did this 2-or-3 weeks back. I found it quite useful. 

Cleaner version of the above picture.

Rethinking Project Management

Whilst browsing through relevant literature, I found this article, an easy read, about the fragmentation of approaches in project management research.

http://ojs.acadiau.ca/index.php/ASAC/article/viewFile/662/571

My colleague is doing research on rethinking project management in the development sector. My focus is not on rethinking PM, but it is an insightful read that may be useful to my thesis as well.