Latest News

Lessons Learned Report for ICT-enabled Initiatives

Fri, 13 Nov 2020 03:52:26 GMT

Extracts from “2018-19 Lessons Learned Report for ICT-enabled Initiatives”
Published by the State of Queensland (Queensland Health), November 2019

Key Foundational Themes

Good practices identified from the review

Initiatives strongly aligned with governance and organisation policies, strategies and goals. Initiatives documented the alignment of program or project vision, aims and objectives with Government and Departmental priorities and strategies
Demonstrated effective stakeholder engagement to help analyse, segment and appropriately engage the right people at the right time, with active management of critical stakeholder issues
Risk management is a focus and standing item on Governance committees for oversight and management
Effective planning of project structure and resource requirements as part of the initial stages of a project lay a foundational platform for success
Engagement between the project team and governance bodies of an initiative through gated assurance activity, lessons learned, and subsequent action plans support a platform for success.

Top three themes identified for potential improvement

Management control:

Resource management:

Risk management:

Key Theme - Stakeholder Engagement & Communications

Key findings

There is no common understanding among stakeholders of the program or project scope, objectives, outcomes, critical success factors, roles and responsibilities, and/or delivery approach.
Program or project success definition or criteria (based upon program or project objectives), does not consider the effects of the project or program on the stakeholders (internal or external), culture or processes.
Stakeholders have expressed confusion and misinterpreted the Red, Amber and Green RAG status within the program or project report.
Insufficient consultation and engagement with stakeholders in multiple stages of the project or tranches of the program have resulted in a lack of stakeholder buy in.
Program or project has engaged late with governance stakeholders for investment and assurance, both internal and external to the agency based on a lack of knowledge and understanding of the processes.
Lack of continuous communication of program or project progress to relevant stakeholders, as well as ensuring the information is distributed to all levels (supervisor to personnel).
Stakeholder engagement and communication strategy and plan are not documented or properly tailored and shared with all stakeholders.
Highlighted variation in competence with how the programs or projects develop and manage the stakeholder management strategy and planning activities.
Highlighted concerns on how the relationships with other Departments, across Division within the Department of Health as well as HHSs are managed.
Highlighted concerns on how the program or project’s stakeholders were kept informed.
Highlighted concerns on how effective the delivery of the strategy and/or the plan was communicated to stakeholders.

Key lessons

Ensure communication activities are well resourced and located within the program/project.
Identify and understand the business’s key stakeholders and their information and engagement needs.
Tailor communications for specific audiences – a one size fits all approach is never as effective.
To minimise change fatigue on a lengthy change journey, be innovative and do not over-communicate – try to confine communications to points when there is something new and useful to say, rather than being locked in to regular output cycles that may lead to
scrambling for content.
Survey stakeholders regularly to test and refine communication activities.
The communication of operational changes should focus on “what does this mean for me?”.
Identify staff from different levels of the business to support the project/program life cycle at each stage.
Develop relationships with senior leaders, meet regularly, provide meaningful updates and seek their input to solutions.
Check in with the business regularly to test the effectiveness of engagement tools.
Impact assessments are not a one-time activity – they need to be done at various points during a program/project life cycle, to varying degrees of details.
Ensure tight management of review and approval processes within the business, as well as timely production of detailed operational information, so that staff can be properly trained before deployment.
Consider whether business needs require dedicated staff to manage post-implementation training and maintain training materials.
Consider a change champion model for major change initiatives to deliver training and ensure consistency while also taking account of the local context.
Training needs to be delivered “just in time” so that staff can apply the learning soon after completing training.
The business’s role in receiving and managing the new operating model must be clearly articulated and agreed.
Ensure that skills transfer from the program/project to business is well planned and delivered.

Improving the Enterprise Wide Management of Business Risks

Fri, 13 Nov 2020 02:15:36 GMT

Enterprise Risk Management of Business Risks

Enterprise Risk Management (ERM), as a credible and valued business activity, has gained currency in recent years and is now widely accepted. Many businesses however have difficulty identifying, assessing and documenting the extensive range of risks that they face. Management struggle to implement a framework to identify the risks that they must assess in the day-to day operation of their businesses and also maintain focus on strategic business risks. In addition, the development of new business strategies and successful execution of these often fail due to an inability to fully understand the risks involved.

The key to successfully implementation of an ERM program across an organisation is getting the balance right between ‘micro’ operational risks – many of which are still important – and key strategic business risks. A bottom-up analysis of risks by line management and risk managers will often only focus on operational risks. These risks – whilst important to identify, mitigate and manage – do not always give rise to significant financial loss or business impairment. The risks which do, however, are often left to be managed at board or executive level for larger organisations or with the business owner in private enterprises.

It is important to implement an approach to ERM that does not omit key business risks and ensures critical business risks are elevated to the appropriate level in an organisation – usually board and executive level – in a transparent and structured manner.

Strategic Risk Management Toolkit

Success in effectively identifying and managing business risks usually requires organisations to progressively implement the following:

Establishment of a Risk Management Strategy.This document will encompass the organisation’srisk appetite, risk management processes, rolesand responsibilities for the management ofbusiness risks;
Establishment of an organisational rhythm for theidentification, assessment and management ofbusiness risks. This should include half yearly orannual risk management workshops with boardsand executives. For organisations implementingERM for the first time there will be an initial seriesof workshops to identify key business risks;

Incorporating risk management assessments intostrategic planning, business planning andinvestment approval processes;
Developing and implementing comprehensive, yetfor ‘fit for purpose’, risk management reporting.

The 52 Risks® Framework

Notwithoutrisk uses its own unique, innovative framework - 52 Risks® - to assist organizations identify,assess and manage their business risks. 52 Risks®comprises 17 Strategic Risks, 16 Financial Risks and 19Operational risks (refer Table 1. below). All potential business risks will map to one of these risk categories.

It provides a high-level, end-to-end framework that enables organizations to understand and determine their risk profile. In addition, organizations can, on an ongoing basis, measure and manage changes in its risk profile. The risks can be internal or external, short,medium or long term.

52 Risks® is a methodology that can assist all organisations – no matter how large or small - to compile the definitive list of strategic, financial and operational risks that can impact them.

The framework enables both a top-down and bottom-up analysis of key strategic, financial and operational risks. By systematically working through each risk category, a core list of key business risks can be identified for further investigation. Very low risk categories can be discarded early in the top down approach, leaving a relevant list of risk categories to be explored and assessed further.

Information on existing, known risks from management reports, financial reports, audit reports and any previous risk assessments undertaken can identify key business risks and build a risk profile of theorganisation. This bottom up analysis can leverage off the understanding within the organization about key business risks

Notwithoutrisk Consulting Risk Advisory Services

Notwithoutrisk Consulting can assist boards and executives with the following:

Establishment of an ERM framework and governance;
Preparation of a Risk Management Strategy document;
An initial assessment of key business risks using the 52 Risks® framework;
Facilitate workshops on specific categories of strategic, financial or operational risks;
Development of risk registers; and
Development of risk management reporting.

About the Author

Notwithoutrisk Consulting, founded by former Chief Risk Officer, Peter Deans, is an Australian based firm. It offers a range of strategy, business and risk advisory services to banks & financial institutions, corporate and government clients.

Contact Details

Peter Deans, Director

+61 402 222 193

pdeans@notwithoutrisk.com