MikkoRouttiDirector,RiskManagementNokiaCorporationRiskManagementMainThemesofPresentationscopeofpresentation:businessrisk(widely)ourphilosophyaboutriskmanagementwherewearetodayonthejourneyofERMhowtodothisinourorganisationbalancebetween"practical,value-basedandanalytical,fact-based"thinkingwhatkindofmethodsandtoolsweuse(e.g)howdoweandotherscommunicateaboutthis"Itisonethingtosetupamathematicalmodelthatappearstoexplaineverything.Butwhenwefacethestruggleofdailylife,ofconstanttrialanderror,theabiguityofthefactsaswellasthepowerofthehumanheartbeatcanobliteratethemodelinshortorder." PeterL.Bernstein:AgainsttheGods -TheRemarkablestoryofRisk“Wearenotjustaddingalloftheseriskstogether.Wearecreatingaprobabilisticviewofhowmuchcapitalisactuallynecessary.”--RickBuy,ChiefRiskOfficer,Enron“Wereviewhowgooditcanget,wereviewhowbaditcanget,andeveryplaceinbetween.”--RickCausey,EVPandChiefAccountingOfficer,EnronWhatdoesriskappetitemeaninpractice?Arewefocusingonopportunity?

Isthereaclearviewoftheappetiteforrisk?

Istherebalanceinrisksandrewards?

(i.e.highrisksvslowrewards)Whereshouldmostofmanagement’seffortbedirected?AGenericBusinessRiskContinuumOpportunityUncertaintyHazardComplianceAndPreventionOperatingPerformanceStrategicInitiativesKeyQuestionstoConsider...EnvironmentHealth&safetySupplychainSoftwareProductcreationRISKUNIVERSEHowdoesriskmanifestitself?–Fortune1000GroupAnalysis

Onehundred(10%)oftheFortune1000companiessufferedalossofover25%ofshareholdervaluewithinonemonthCostOverrunsAccountingirregularitiesManagementineffective-nessSupplyChainIssuesCompetitivePressureM&AIntegrationProblemsMis-

alignedProductsCustomerPricingPressureLossof

Key

CustomerSupplierProblemsR&DDelaysCustomerDemandShortfall%oftop100RegulatoryProblemsStrategicOperationalFinancialHazardForeign

Macro-

Economic

IssuesInterest

Rate

Fluct-

uationHigh

Input

Comm-

odity

PriceLaw-

suitsNaturalDisasters58%31%6%0%PrimaryCauseofStockDrop(#ofCompanies)Source:Compustat,MercerManagementConsultinganalysisNote:Therewerealso5stockdropsforwhichtheprimarycausecouldnotreliablybedetermined.These5stockdropsarenotdepicted.

MercerManagementConsultingRiskManagementVisiontotakesuchrisksthatwillenablecompanytoprofitablygrowthebusinesshaveathoroughunderstandingofthoserisksandresponsesrequiredforsuccessaimistosystematicallycapitaliseon,controlandmanageriskinbusinessratherthaneliminateit.Ensurerisksareproperlyanalysed,prioritisedandmanagedwhentakingmajorbusinessdecisions.EnsurethatkeyriskshavearesponsibleownerTomanageeventsthatmayaffectcustomers,employees,thefinancialpositionofNokiaanditsbrand.ComplywithregulatoryandlegalrequirementsDriversforincreasedriskawareness

businessneedsstakeholderawarenessrecentcrisis(Worldcom,Enron,Tycoetc)complianceissuesTurnbull/UKKontraG/GermanyNetherlandsSarbanes-Oxley:USAfoodforthought:doinvestorsappreciatesystematicriskmanagement–theypenalizeyouifyoumiss!BuildingupaRiskManagementSystemPeopleandcompetenciesProcessMethodsToolsPeopleandcompetenciesformthefoundationofriskmanagementProcesshelpsensuretheirskillsareappliedconsistentlyMethodsassurethatriskmanagementisdonewellToolsincreaseproductivity…andcansometimesdirectpeopleandprocessesObjectivesofRiskManagementControlAllprojectshaverisksandsomeriskswilloccurRMisaninvestmentintothefuture:ItisoftencheapertoavoidapotentialproblemthanfixanoccurredoneIfyouonlyfixproblemsastheysurface,theflowoffutureproblemswillcontinuetokeepyoubusyRMimprovespredictabilityandcontrolofprojectsUnderstandingKnowwheretherisksareandfocusonessentialriskareasConsistentunderstandingofrisksthroughouttheorganizationLearnfromtherisksthatoccurredWhatisRisk?Riskisamany-facetedConceptslipperydrivingconditions(rain,snow)acaraccidentuntreatedpersonalinjuries,damagedvehiclestreatmentofinjuries,purchaseofanewcarmedicalcosts,permanentinjuryeffects,higherinsurancepremiumsTheneteffectofpain,losttimeandexpensesasfeltbyindividualsRiskfactor:somethingthatinfluencesrisksRiskevent:

occurrenceoftheriskRiskoutcome:immediateimpactofriskeventRiskReaction:

reactiontotheriskRiskeffects:

effectsofriskUtilityloss:perceivedvalueofeffectsbystakeholdersWhatisRiskAretheserisks?Frequent,butuncertainsmallproblems(e.g.,somedayswillbelosttosickleave)Almostcertainevents(e.g.,somerequirementswillchange)Risksthatdonoteffectyourproject(e.g.,HWbudgetisexceeded)Technicallyyes,but..Toominortoreceivespecialfocus,tobemanagedby“normal””managementconsiderthemproblemsdelegatethemtosomeoneelseProjectview:

fallingshortofgoalsScopeofRiskManagementFinancialview:varianceRiskManagementPain(Risk)Gain(Opportunity)UncertaintyImpactDefinitionsofProbabilityClassicprobabilityFutureoutcomesaredecomposedintoatomic,equallyprobablecomponentsFrequency-basedprobabilityRatioofacertaineventinaninfiniteseriesofidenticaltrialsSubjectiveprobabilityAperson’ssubjectivebeliefofthelikelihoodofaneventoccurrenceTimeframeandRiskTimeframe(orurgency)actuallyanattributeofriskandcontrollingactionPeoplehavestrongbiasesfornear-termrisksWaitingmaybuyinformationandnewsolutionsDefinitionof"Risk"Riskisafuzzyconcept:beclearonwhatyoumeanRiskisnotthesameasaproblem:probability=1problemsolving––toolateRiskisrelativetostakeholdersandtheirexpectationsTheright-levelofabstractioniscritical…anditdependsonthesituationVOCABULARY:exampleG-GoalandstakeholderreviewAprocessstepinriskmanagement.Thestatedgoalsoftheworkingentity(BusinessUnit,Productprogram,BusinessGroup,Functionetc.)arereviewedandrefined.Stakeholders'associationswiththegoalsareanalyzedM-MitigationStrategyAstrategythatisusedtolowertheprobabilityand/orutilitylossofriskscenariosO-Objective-Agoalthathasanachievable,well-definedtargetlevelofachievement.R-RiskAnyuncertaintythataffectstheobjectivesandachievementofoptimumresult.Apossibility(probabilityoflessthan1)ofloss,thelossitself,oranycharacteristic,objectoractionthatisassociatedwiththatpossibility.RiskManagementRiskmanagementreferstoasystematicandexplicitapproachusedforidentifying,analyzingandcontrollingrisk.Theriskmanagementprocessproducestwomainoutputs:UnderstandingaboutrisksControllingactionsRiskmgmtprocessUnderstandingofrisksControllingactionsInformationaboutthesituationRiskmgmtmethodsProjectcontext,goals,andplansRiskManagementProcessRiskManagementMandateGoal&StakeholderReviewRiskIdentificationRiskControl&controlplanningRiskMonitoringRiskAnalysisgoalsandstake-holdersresponsibilitiesandscopeforriskmgmtlistofpotentialrisksdocumented,prioritizedrisksselectedcontrollingactionsNeedfornewriskmgmtcycleRiskMgmtProcess-outputsRiskManagementMandateDefinethescope,detail,authorityandfrequencyofriskmanagementinaspecificprojectScopeanddetail:whatrisksmustbemanagedandatwhatlevelofdetailAuthority:whoisresponsible,whoparticipates,whatresourcesareavailableFrequency:howoftenshoulditbedoneStakeholders:whoseriskswillbemanagedCommunicating

RiskInformationTopManagementBusinessUnitsProjectsMANDATERISKSSummaryMandateisusedtoclarifytherolesandresponsibilitiesinriskmanagementMandateisgivenbytheprojectownerstotheprojectmanagerWhentheriskmanagementinfrastructureisinplace,manyaspectsoftheriskmanagementmandateareeasytodefineGoalReview:DefinitionofRiskUncertaintyassociatedwithreachingthe

objectives.Riskhastwomain

attributes:Impact:somedamage(“pain”)uncertainty:thereisuncertaintyaboutwhetherthelosswilloccurRiskUncertaintyImpactDefinitionofRiskUncertaintyassociatedwithreachingthe

objectives.ProbabilityImpactgoalsorexpectations:withoutthemthedefinitionoflossis

vagueordoesnotexiststakeholder:goalsandexpectationsareassociatedtosomeinterestedparty,apersonoranorganizationRiskUncertaintyImpactGoalStakeholderStakeholdersandGoalsStakeholderisanyindividual,group,ororganizationwhocanaffect,orbeaffectedby,theprocessoritsresultsStakeholderscanbe,e.g.,LinemanagementCustomer(s)Partners,suppliersandvendorsOtherprogramsorunitsPersonnelSocietyItisimportanttoknowthemainstakeholdersandtheirinterestsGoalscanbefoundusuallyinthefollowingareas:schedule;resourcesused,mostoftenpersonneltime;costofdevelopment;productrequirements,whichcanincludebothfunctionalandotherqualitycharacteristics;resourceutilization;andtechnicalconstraints,suchashardwareplatforms,operatingsystemsanduseofparticularsoftwaretools.GoalandStakeholderPrioritiesPrioritiesforgoalsandstakeholdersaredefinedApproximateprioritiesareadequateRiskIdentificationRiskidentificationrequiresanopenmindTeamworkandeffectivemeetingtechniquesarecriticalThereareseveralchecklistsavailable………butaretheygoodforyou?IdentificationofpotentialthreatsNeedstobedonefrequentlyRequiresadifferentmentalattitude:notproblemsolvingbutfreeassociationTechniques:brainstorming,checklists,questionnaires,historydata(lessonslearned,data),criticalpathanalysis,goalreviewRI:Checklistsvs.BrainstormingChecklistsProsFastandeasytouseStandardizeresultsCoverabroadareaMaypromptthinkingnewrisksConsCausefatigueDonotencouragecreativityMaybebiasedduetoadifferentdomainDonotencouragefindingsituationspecificrisksBrainstormingProsFastandeasytouseLeverageslocalexpertiseandinsightKeepsparticipantsactiveDevelopscommitmentConsRequirefacilitationortrainingMeetingdynamicsmaybiasresultsDependentonparticipantsexperienceRiskAnalysisUnderstanding(describing)risksRisktrackingtablesRiskinformationformsVisualizationofriskdependenciesRankingofrisksRiskexposure(I.e.,probability*loss)RiskreductionleverageUrgencyRiskAnalysisRiskclusteringgroupandidentifyappropriatescenariosRiskscenariodevelopmentfillinriskinformationforms,orcompleteRiskitanalysisgraphsRiskprioritizationRankrisksUnderstandingRisks:RiskTrackingTablesItemsintrackingtablesmayincludeIDAreaOriginDescriptionOwner/responsibleDateofmostrecentreviewProbabilityLossimpactPrioritycurrentprevioustimeonthelistRiskstatusPotentialcontrollingactionsSelectedcontrollingactionsActionStatusRiskDocumentationGuidelinesTemplatesstandardizecommunicationsUseanapproachthatmatchesyourneedsDevelopapathtorefinetheinformationyouoftenstartwithanabstractdescriptionandadddetailslaterDonotfillininformationthatyoudonotknow:emptyfieldsactasflagstoothersArchivepastdatausefulforlearningfromexperienceRiskPrioritizationKeyattributesinprioritization:Probabilityandlossdeterminehowsevere(=big)theriskisUrgencyindicateswhetheryoustillhavetimetowaitTwomainapproachesforrankingrisks:Expectedvalueofloss=prob(event)*loss(event)RankingthroughtablesordinalrankmultiplicationprearrangedrankingtablesforordinalprobabilityandlossestimatesriskfactorrankingtablesOrdinalscalerankingisadequate,whenusingRiskitParetorankingtechniqueExpectedValueSameasRiskExposure:probability*lossRisksthathavethehighestexpectedlossarehighestrisks,e.g.,tworisksthathavepotentialdelays:RiskA:20%*5months=1monthRiskB:50%*3months=1.5monthsRiskBisabiggerriskAcommonlyusedformulaforprioritizingrisksEffectofNon-linearUtilityFunctionRiskA:2monthdelaywithprobabilityof10%RiskB:8monthdelaywithprobabilityof5%Expecteddelay:A:0.2monthsB:0.4months=>controlriskBExpectedutilityloss:A:5UB:3U=>controlriskA010203040506070012345678DelayUtilitylossversion0.02SummaryDifferentrisksrequiredifferentattentionFocusonmostimportantoronareasofuncertaintyPrioritizationispronetoestimationbiasesSomeprioritizationmethodshavein-builtbiasesTransparencyandunderstandabilityofprioritizationisimportant:makesureyoucanexplaintheresultstoeverybodyControllingActionsvs.ReactionsRiskcontrollingactionsareactionstakenbeforetheriskhasoccurred,I.e.,itisproactiveriskmanagementReactionsareactionsthatareperformedaftertheriskhasoccurredRiskmanagementisprimarilyconcernedwithriskcontrollingactionsDefiningRiskControllingActionsBrainstormingOpenorfocusedStrategiesChecklistsRiskelementreviewanalyzeriskelementstoidentify

whatactionscouldbetakenExperiencePersonalexperienceandinsightsAcceptanceAvoidanceProtectionReductionResearchReservesTransferRiskControlalternativesNoriskreducingactionNoimmediateactionistaken,butsomemaybetakenatalatertimeContingencyplanningRecoveryplansaremade,butnofurtheractiontakenReducelossReferstoriskcontrollingactionsthatareusedtomitigatethedamagecausedbyriskRiskavoidanceReferstoactionsthatareaimedatavoidingrisksoccurringReduceeventprobabilityInfluencingriskfactorsandobservingriskmonitoringmetricstoreducetheeventprobabilitySelectingRiskControllingActionsControlhigh-riskscenariosEffectivenessofriskcontrollingactionProjectconstraintsStakeholderpriorityUrgencyofriskcontrollingactionRiskMonitoringinPracticeDefineandcollectriskmetricswhenapplicableMonitoradditionallychangesinthesituationimpactofriskcontrollingactionspotentialnewthreatschangesinriskanalysisinputdataInitiateriskidentification,riskanalysisorriskcontrolplanningwhennecessaryBuildingupaRiskManagementSystemPeopleandcompetenciesProcessMethodsToolsPeopleandcompetenciesformthefoundationofriskmanagementProcesshelpsensuretheirskillsareappliedconsistentlyMethodsassurethatriskmanagementisdonewellToolsincreaseproductivity…andcansometimesdirectpeopleandprocessesPeopleandCompetenceMotivationExplainwhyriskmanagementpaysoffAuthorizationGivepeoplepowertoperformriskmanagementSkills+knowledge+practice=competenceSupportin-houselearningProcessMakesurethattheproductdevelopmentprocesshasexplicitpointswhereriskmanagementisaddressedProvidetemplatesforreportsDefinetheriskmanagementprocessanditsoutputsidentifyanalyzecontrolClarifyresponsibilitiesMethodsSelectaportfolioofsoundandeasy-to-usemethodsStartsimpleandimproveasyoubecomemoreexperiencedBewareofthebiasesandproblemswiththemethodsyouareusingUsecommonsense--amethodcannotreplicateitRequirementsforaRiskMgmtMethodConsistencyofapplication:thereisadefined,repeatableprocess.Consistencyofresults:resultsfromindependentanalysesdonotdiffer.Usability:themethodiseasytolearn,operate,prepareinputfor,andtheoutputisunderstandable.Adaptability:thesystemcanbeappliedtodifferentprojectsandsituations.Completeness:considerationofallrelevantrelationshipsandelementsofriskisgiven.Validity:method’sresultsrepresentswelltherealrisksandsituation.Confidence:method’soutputisbelievableandmethodusersbelieveinit.Traceability:themethoddocumentstheassumptionsandrationaleusedtoderiveconclusions.Communications:themethodsupportscommunicationa