Transcription

Risk ManagementPlan Template

Risk Management PlanFiscal Year 20XXINSERT YOUR ORGANIZATION’S NAMEHEREApproved by the Board of DirectorsDATEThis publication was created by Meliora Partners, Inc., in the performance of the U.S. Department of Health and Human Services,Administration for Children and Families, Office of Community Services Grant Number 90ET0430. Any opinion, findings, conclusions, orrecommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the U.S. Department ofHealth and Human Services, Administration for Children and Families. Prepared for the Risk Management – An Organizational “Flu Shot,” May11, 2011.

OverviewThis document consists of the three sections listed below. Page numbers have not been included.The length cannot be predicted of any of the sections into which information will be placed.Also, the number of Risk Mitigation Tracking Worksheets, Reports, and Corrective Action Plansto be included is also unpredictable.Risk AssessmentMethodsAnticipating VulnerabilityResponses to RiskMitigation StrategiesImplementation ResponsibilitiesMonitoringEvaluation of successCorrective actionThis document has been laid out as a series of worksheet for completing tasks necessary todevelopment of a Risk Management Plan. Users should feel free to expand the basic format ofany worksheet in ways that make elements of the plan easier to understand and apply.This publication was created by Meliora Partners, Inc., in the performance of the U.S. Department of Health and Human Services,Administration for Children and Families, Office of Community Services Grant Number 90ET0430. Any opinion, findings,conclusions, or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views ofthe U.S. Department of Health and Human Services, Administration for Children and Families.This publication was created by Meliora Partners, Inc., in the performance of the U.S. Department of Health and Human Services,Administration for Children and Families, Office of Community Services Grant Number 90ET0430. Any opinion, findings, conclusions, orrecommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the U.S. Department ofHealth and Human Services, Administration for Children and Families. Prepared for the Risk Management – An Organizational “Flu Shot,” May11, 2011.

Risk AssessmentThe risk management process begins with determination of the range of risks faced by yourorganization. It is very important to acknowledge and record the methods you used to identifyrisks and the assumptions you made in assessing the organization’s vulnerability to them.Experience carrying out your risk management plan is likely to highlight mistakes andweaknesses in your methods and assumptions. You will want to revisit and update them at thebeginning of each planning cycle. As the webinar quote from Donald Rumsfeld warns us: wewant to turn as many unknowns as possible into knowns.MethodsIn this section you should describe the risks you have identified, the techniques you used to makethose identifications, and the category to which each risk belongs. This task can be simplified byusing the following matrix to document your results. Add as many rows as needed.Possible Identification Methods might include:Risk categories might include:Program monitoring dataInsurance claims historyAudit and monitoring reportsAccident reportsEmployee focus groupsList RisksEmployment practicesFinancial management practicesPersonal injuryProperty damageIdentification Technique(s) or MethodsRisk CategoryJust TAB through the end of the last row to add more rows.This publication was created by Meliora Partners, Inc., in the performance of the U.S. Department of Health and Human Services, Administrationfor Children and Families, Office of Community Services Grant Number 90ET0430. Any opinion, findings, conclusions, or recommendationsexpressed in this material are those of the author(s) and do not necessarily reflect the views of the U.S. Department of Health and HumanServices, Administration for Children and Families. Prepared for the Risk Management – An Organizational “Flu Shot,” May 11, 2011.

Risk Assessment - 2Anticipating VulnerabilityThe next step is to document the assumptions you have made about your organization’svulnerability to risks. The Risk Matrix explained in the webinar provides a useful first step inassessing both the likelihood a risk will occur and the severity of the consequences.You can simplify this task by inserting the Vulnerability to Risk worksheet in your plan inthis section.The table below will help you to go about that process systematically. Transfer list of risks you have identified from the previous page. Note factors you considered relative to the likelihood of the risk occurring. Note factors you considered relative to the severity of the consequences should the riskoccur. Estimate what it might cost to take steps to limit or reduce the consequences of this risk. Estimate a range of costs the organization might have to absorb if it takes no remedialaction.RisksLikelihoodSeverityCostThis publication was created by Meliora Partners, Inc., in the performance of the U.S. Department of Health and Human Services,Administration for Children and Families, Office of Community Services Grant Number 90ET0430. Any opinion, findings, conclusions, orrecommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the U.S. Department ofHealth and Human Services, Administration for Children and Families. Prepared for the Risk Management – An Organizational “Flu Shot,” May11, 2011.

Risk Assessment - 3Relative VulnerabilityBased on your analysis of vulnerability to the risks you identified above, place each of the risks in what you judge to be the correctcell in the matrix below. This will help you draw conclusions about the relative urgency of responding to these his publication was created by Meliora Partners, Inc., in the performance of the U.S. Department of Health and Human Services, Administration for Children and Families, Office of CommunityServices Grant Number 90ET0430. Any opinion, findings, conclusions, or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the U.S.Department of Health and Human Services, Administration for Children and Families. Prepared for the Risk Management – An Organizational “Flu Shot,” May 11, 2011.

Responses to RiskThe response section of your plan contains the strategies you will use to lessen your exposure to risks. You need to describe thestrategies and identify the person(s) responsible for putting those strategies in place.Risk – Copy into the first column the list of risks you ended up with in the previous section.Mitigation Strategies – In this column list all of the strategies you will carry out to lessen each risk.Implementation Responsibility – List the position responsible for carrying out each risk mitigation strategy. Include employeenames if you wish.RiskMitigation StrategiesImplementation ResponsibilityThis publication was created by Meliora Partners, Inc., in the performance of the U.S. Department of Health and Human Services, Administration for Children and Families, Office of CommunityServices Grant Number 90ET0430. Any opinion, findings, conclusions, or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the U.S.Department of Health and Human Services, Administration for Children and Families. Prepared for the Risk Management – An Organizational “Flu Shot,” May 11, 2011.

MonitoringThe last phase of risk management consists of systematic follow-up on the mitigation strategiesyou have chosen. You will develop plans to collect and analyze data about instances when yourstrategies have not worked. You will describe the corrective action steps to be taken to makeyour strategies more effective.EvaluationA template for a Risk Mitigation Tracking Worksheet is attached to this plan. A form shouldbe created to monitor all mitigation strategies. Those forms should be enclosed behind this page.This publication was created by Meliora Partners, Inc., in the performance of the U.S. Department of Health and Human Services, Administrationfor Children and Families, Office of Community Services Grant Number 90ET0430. Any opinion, findings, conclusions, or recommendationsexpressed in this material are those of the author(s) and do not necessarily reflect the views of the U.S. Department of Health and HumanServices, Administration for Children and Families. Prepared for the Risk Management – An Organizational “Flu Shot,” May 11, 2011.

Risk Mitigation Tracking WorksheetMitigation strategy being monitored:Documents monitored ( )Application documentsClient filesLocationIndicator Code KeyReplace the numbers in the top row with the warning signs for this risk mitigation strategy youare tracking.Recopy the matrix if you need to list more elements. Place the copy below the first matrix.In each column, list specific types of mitigation errors you want to track.Key1234512345Mitigation Exceptions IdentifiedWhat has been monitored?Identifier1Monitor Annie BahdiSignature2Sample size34Position56Quality Control SpecialistReceived by78Date91012/29/18DateThis publication was created by Meliora Partners, Inc., in the performance of the U.S. Department of Health and Human Services, Administration forChildren and Families, Office of Community Services Grant Number 90ET0430. Any opinion, findings, conclusions, or recommendations expressed in thismaterial are those of the author(s) and do not necessarily reflect the views of the U.S. Department of Health and Human Services, Administration forChildren and Families. Prepared for the Risk Management – An Organizational “Flu Shot,” May 11, 2011.

Monitoring - 3Corrective ActionWhen your tracking data shows a pattern of ineffectiveness, you need to develop a Corrective ActionPlan to restore your strategy’s effectiveness.A corrective action plan need not be complicated. It will be focused on the causes of the reducedeffectiveness of the specific mitigation strategy you have evaluated.A corrective action plan is a more narrowly focused version of a mitigation tracking process. It has thesame basic components:Risk Management Corrective Action PlanCAA NameFiscal YearRiskStrategyResponsibleDateCauses identifiedin analysisCause to becorrectedSpecific success indicatorsthat you will trackA list of strategies1.2.3.Mechanisms for reportingresults to top management andthe boarda.b.c.a.b.c.a.b.c.This template can be copied to create a corrective action plan.This publication was created by Meliora Partners, Inc., in the performance of the U.S. Department of Health and Human Services, Administration forChildren and Families, Office of Community Services Grant Number 90ET0430. Any opinion, findings, conclusions, or recommendations expressed in thismaterial are those of the author(s) and do not necessarily reflect the views of the U.S. Department of Health and Human Services, Administration forChildren and Families. Prepared for the Risk Management – An Organizational “Flu Shot,” May 11, 2011.

Risk Management Planning Worksheet TemplatesThe attached worksheets can be printed separately to complete specific tasks in theplanning process.In most cases, the completed worksheets can be inserted into a finished plan.Worksheets included: Risk Identification Worksheet Anticipating Vulnerability Worksheet Responding to Risk Worksheet Risk Mitigation Tracking Worksheet Corrective Action PlanThis publication was created by Meliora Partners, Inc., in the performance of the U.S. Department of Health and Human Services, Administration forChildren and Families, Office of Community Services Grant Number 90ET0430. Any opinion, findings, conclusions, or recommendations expressed in thismaterial are those of the author(s) and do not necessarily reflect the views of the U.S. Department of Health and Human Services, Administration forChildren and Families. Prepared for the Risk Management – An Organizational “Flu Shot,” May 11, 2011.

Indicators of Risk

Indicators of Possible RiskGeneralPersonal injuryBusinessFinancialProperty damageOperationalEmployment practicesStrategicFraudLegalIllegal activityEconomicReputationPolitical

Indicators of Possible RiskInstructionsUse this worksheet as a brainstorming device to identifyrisks that your organization may be facing. Keep in mind:Risk is “any uncertainty about a future event thatthreatens your organization's ability to accomplishits mission.”BUT - Not all risks are negative; positive changes can beunsettling if you haven’t prepared for themRisk is also “the effect of uncertainty on objectives” Not all risks are financial, as you can see form thecategories suggested on the worksheet Insurance is a solution for some risks, but not for all ofthem Attention to detail and sound policies and procedures canreduce or eliminate many risks, although it is good to beaware that they exist BEWARE the risks you are not aware of: the “UnknownUnknowns”

Responding to Risk

Responding to Risk WorksheetCAA NameAction for Community Mobilization and EmpowermentFiscal Year 2010Complete the matrix below for all of the risks you plan to address.RiskList the risks you have selectedMitigation StrategiesList each of the mitigation strategies you have chosen for eachrisk. You can list them all in one cell, or create new rows for eachone.1.Implementation ResponsibilityInsert here the positions (and individualnames, if you like) of who will beresponsible to carry out these strategies1.This publication was created by Meliora Partners, Inc., in the performance of the U.S. Department of Health and Human Services, Administration for Children and Families, Office of Community Services GrantNumber 90ET0430. Any opinion, findings, conclusions, or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the U.S. Department of Health andHuman Services, Administration for Children and Families. Prepared for the Risk Management – An Organizational “Flu Shot,” May 4, 2011.

Responding to Risk WorksheetSAMPLE WORKSHEETComplete the matrix below for all of the risks you plan to address.RiskMitigation StrategiesList the risks you have selectedList each of the mitigation strategies you have chosen for each risk.You can list them all in one cell, or create new rows for each one.Ineligible LIHEAP applicantsapproved2. Clearly define eligibility criteriaTrain program staff on intake requirements and procedures3. Monitor for warning signsInsufficient cash flow2. Print monthly profit and loss (P&L) statements for allaccounts to identify those that are negative/at loss3. Track and analyze warning signs on negative accountsImplementation ResponsibilityInsert here the positions (andindividual names, if you like) of whowill be responsible to carry out thesestrategiesLIHEAP CoordinatorIntake center managersAccountantFinance DirectorThis publication was created by Meliora Partners, Inc., in the performance of the U.S. Department of Health and Human Services, Administration for Children and Families, Office of Community Services GrantNumber 90ET0430. Any opinion, findings, conclusions, or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the U.S. Department of Health andHuman Services, Administration for Children and Families. Prepared for the Risk Management – An Organizational “Flu Shot,” May 4, 2011.

Risk ManagementCorrective ActionPlan

Risk Management Corrective Action PlanCAA NameAction for Community Mobilization and EmpowermentRiskFiscal Year 2010StrategyResponsibleDateCauses identifiedin analysisCause to becorrectedSpecific success indicatorsthat you will trackCorrective Actions1.2.3.Mechanisms for reportingresults to top management andthe boarda.b.c.a.b.c.a.b.c.This publication was created by Meliora Partners, Inc., in the performance of the U.S. Department of Health and Human Services, Administration forChildren and Families, Office of Community Services Grant Number 90ET0430. Any opinion, findings, conclusions, or recommendations expressed in thismaterial are those of the author(s) and do not necessarily reflect the views of the U.S. Department of Health and Human Services, Administration forChildren and Families. Prepared for the Risk Management – An Organizational “Flu Shot,” May 4, 2011.

EXAMPLERiskInsufficient cash flowResponsible Accountant Causes identified in analysis Cause to becorrectedStrategy Analyze accounts P&LDate 1/17/2010Purchases being made without approved Purchase OrderReimbursement claims returned by funder because not signedOne reimbursement claim submitted 12 days after due dateLack of approved Purchase OrdersCorrective Actions1. Review purchasing policiesand procedures with programmanagers2. Review monthly expensesagainst budgets with programmanagers3. Continue monitoring forinvoices without POSpecific success indicatorsthat you will tracka. Pre-test on proceduresb. Post-test on proceduresc. 60-day procedures post-testd.a. Note meetings on planningcalendarb. Publish written responses toquestions raisedc. Work with programmanagers to correct overspendinga. As per mitigationimplementation planMechanisms for reportingresults to top management andthe boardMonthly internal controlreport: Finance Director toExecutive DirectorThis publication was created by Meliora Partners, Inc., in the performance of the U.S. Department of Health and Human Services, Administration forChildren and Families, Office of Community Services Grant Number 90ET0430. Any opinion, findings, conclusions, or recommendations expressed in thismaterial are those of the author(s) and do not necessarily reflect the views of the U.S. Department of Health and Human Services, Administration forChildren and Families. Prepared for the Risk Management – An Organizational “Flu Shot,” May 4, 2011.

Risk MitigationTracking Worksheet

Risk Mitigation Tracking WorksheetMitigation strategy being monitored:Documents monitored ( )Application documentsClient filesLocationIndicator Code KeyReplace the numbers in the top row with the elements of this risk mitigation strategy you are tracking.Recopy the matrix if you need to list more elements. Place the copy below the first matrix.In each column, list specific types of mitigation errors you want to track.Key1234512345Mitigation Exceptions IdentifiedWhat has been monitored?IdentifierMonitor NameSignature1Sample size2Annie Bahdi34567Position Quality Control SpecialistReceived by8DateDate9106/6/16This publication was created by Meliora Partners, Inc., in the performance of the U.S. Department of Health and Human Services, Administration for Children andFamilies, Office of Community Services Grant Number 90ET0430. Any opinion, findings, conclusions, or recommendations expressed in this material are those of theauthor(s) and do not necessarily reflect the views of the U.S. Department of Health and Human Services, Administration for Children and Families. Prepared for theRisk Management – An Organizational “Flu Shot,” May 11, 2011.

Risk Mitigation Tracking WorksheetSAMPLE WORKSHEETMitigation strategy being monitored:Ineligible applicants approvedDocuments monitored ( ) Application documentsClient filesLocationWashington CountyIndicator Code KeyReplace the numbers in the top row with the elements of this risk mitigation strategy you are tracking.Recopy the matrix if you need to list more elements. Place the copy below the first matrix.In each column, list specific types of mitigation errors you want to track.KeySocial Security #Income VerifiedUtility Service DocsShut-off NoticeIntake Worker12Some adultsSome childrenLess than 90 daysOver 6 months agoNo documentOverdue billInitials3None for childrenNo self-declarationNo billNot in applicantnameOver 60 days old4Applications forUnsigned selfdeclarationMiscalculatedUnsigned Inc. WksNo income wksDocs viewed notlistedDocs copies not infile56789What has been monitored?Identifier1-23451-67892-12342-9876Total ErrorsMonitor NameSignatureSS#1, 323Mitigation Exceptions IdentifiedLIHEAP applicationsSample size 37Income14,734,56Annie BahdiAnnie BahdiAward not yetcreditedUtility212Shutoff Worker2ABCABC1LMNLMN2 136Position Quality Control SpecialistReceived by Jerilyn Hughes78DateDate9106/6/166/10/16This publication was created by Meliora Partners, Inc., in the performance of the U.S. Department of Health and Human Services, Administration for Children andFamilies, Office of Community Services Grant Number 90ET0430. Any opinion, findings, conclusions, or recommendations expressed in this material are those of theauthor(s) and do not necessarily reflect the views of the U.S. Department of Health and Human Services, Administration for Children and Families. Prepared for theRisk Management – An Organizational “Flu Shot,” May 11, 2011.

Vulnerability ToRisk Worksheet

Vulnerability to Risk WorksheetUse the matrix below to:1) Make an initial assessment of individual risks2) Establish an initial location of risks relative to each otherThe matrix allows you to locate risk against two variables:1) Likelihood increases as you go up a column2) Severity of loss increases as you go right in a rowThe matrix is color-coded to illustrate the relative degree of risk.List individual risks you have identified in the cell of Table 1 that best represents your sense of itsseriousness. You may place more than one risk in a cell. They will expand as needed.Document the assumptions you have made about both the likelihood and the severity of the risk, shouldit occur, in Table 2.Based on an example in http://en.wikipedia.org/wiki/Risk management. This publication was created by Meliora Partners, Inc., in the performance of the U.S. Department of Health and HumanServices, Administration for Children and Families, Office of Community Services Grant Number 90ET0430. Any opinion, findings, conclusions, or recommendations expressed in this material are thoseof the author(s) and do not necessarily reflect the views of the U.S. Department of Health and Human Services, Administration for Children and Families. Prepared for the Risk Management – AnOrganizational “Flu Shot,” May 11, 2011.

Vulnerability to Risk WorksheetTable 1: Assumptions Made About Risk Likelihood and Severity1.2.3.4.List the risks you have identified in the first columnIn the second column, note factors you think will affect/determine the likelihood of this risk occurringIn the third column, note factors you think will affect/determine the severity of the consequences if this risk occursIn the 4th column list costs you think will be associated with reducing organizational vulnerability to this risk to acceptablelevelsRiskLikelihoodSeverityCostsBased on an example in http://en.wikipedia.org/wiki/Risk management. This publication was created by Meliora Partners, Inc., in the performance of the U.S. Department of Health and HumanServices, Administration for Children and Families, Office of Community Services Grant Number 90ET0430. Any opinion, findings, conclusions, or recommendations expressed in this material are thoseof the author(s) and do not necessarily reflect the views of the U.S. Department of Health and Human Services, Administration for Children and Families. Prepared for the Risk Management – AnOrganizational “Flu Shot,” May 11, 2011.

Vulnerability to Risk WorksheetTable 2: Risk Estimation MatrixPlace each of the risks in what you judge to be the correct cell in the matrix below, based on your analysis of vulnerability to therisks you identified above. This will help you draw conclusions about the relative urgency of responding to these nLikelyPossibleUnlikelyRareThe colors in the Vulnerability Matrix suggest the relative overall threat to organizational well-being from the combination oflikelihood and severity.LowModerateHighExtremeBased on an example in http://en.wikipedia.org/wiki/Risk management. This publication was created by Meliora Partners, Inc., in the performance of the U.S. Department of Health and HumanServices, Administration for Children and Families, Office of Community Services Grant Number 90ET0430. Any opinion, findings, conclusions, or recommendations expressed in this material are thoseof the author(s) and do not necessarily reflect the views of the U.S. Department of Health and Human Services, Administration for Children and Families. Prepared for the Risk Management – AnOrganizational “Flu Shot,” May 11, 2011.

Vulnerability to Risk WorksheetExampleNegligibleMarginalCertainMisplaced receiptsSmashed fingerLikelyFlat tireMinor playground accidentCriticalCatastrophicHouse too tightPossibleWater-damaged filesMajor playground accidentBuilding fireAccounting server hackedUnlikelyAccounting server hackedDeath in bus accidentRareTornado Hurricane FloodBased on an example in http://en.wikipedia.org/wiki/Risk management. This publication was created by Meliora Partners, Inc., in the performance of the U.S. Department of Health and HumanServices, Administration for Children and Families, Office of Community Services Grant Number 90ET0430. Any opinion, findings, conclusions, or recommendations expressed in this material are thoseof the author(s) and do not necessarily reflect the views of the U.S. Department of Health and Human Services, Administration for Children and Families. Prepared for the Risk Management – AnOrganizational “Flu Shot,” May 11, 2011.

Risk Management Planning Worksheet Templates The attached worksheets can be printed separately to complete specific tasks in the planning process. In most cases, the completed worksheets can be inserted into a finished plan. Worksheets included: Risk Identification Worksheet Anticipating Vulnerability Worksheet