Embed Size (px)
Citation preview
The Alarm National Performance Model for Risk Management in the Public Services
The Alarm National Performance Model for Risk Management in the Public Services
The comprehensive National Performance Model:
• Measures current performance against a recognised achievement level
• Provides the basis for clear performance indicators
• Acts as a catalyst for improved performance within the organisation
• Informs assurance in corporate governance terms
• Demonstrates current maturity in terms of
- External inspection expectations
- National and international standards
• Allows for comparison with other organisations and learning from best practice through systematic benchmarking
Organisations can use the National Performance Model Assessment Framework to undertake quick “health checks” of their organisation by using the indicators within the summary of progress to come to a conclusion of their current risk management maturity level.
What does good risk management look like in a public service organisation?
The Alarm National Performance Model for Risk Management in the Public Services has been designed to answer that key question. Using the experience and expertise of risk managers, risk consultants and other experts, this performance model maps out risk management maturity, clearly and concisely.
A detailed and comprehensive set of questions have been designed to test current performance against the Assessment Framework. This self-assessment questionnaire has been designed by Alarm’s Benchmarking Special Interest Group and forms the basis of Alarm’s Benchmarking Programme, due to launch in 2010. This document provides an overview of the key areas of the Alarm National Performance Model and Assessment Framework.
Assessment Framework
Risk Management Activity
The National Performance Model breaks down risk management activity into seven strands: five enablers and two focused on results.
Enablers Results
Leadership and management Risk handling and assurance
Strategy and policy Outcomes and delivery
People
Partnership, shared risks and resources
Processes and tools
Risk Management Maturity
The Model tests the extent to which risk management is having a positive effect on the organisation. Risk management maturity is assessed as being at one of five levels:
Level 1 Risk management is engaging with the organisation
Level 2 Risk management is happening within the organisation
Level 3 Risk management is working for the organisation
Level 4 Risk management is embedded and integrated within the organisation
Level 5 Risk management is driving the organisation
This section is concerned with:
• Risk judgements
• Clear direction
• Risk appetite
Assessment Framework
The Alarm National Risk Management Performance Model Assessment Framework is adapted from the EFQM Excellence Model. Alarm also acknowledges, with thanks, the influence of the HM Treasury Self-Assessment Tool: Risk Management Framework (RMAF) on the development of this model.
The questions in this section deal with:
• Information and decision making
• Escalation and reporting systems
• Accountability and management responsibility
The following pages show how each activity within the National Performance Model is assessed:
Leadership and Management Do senior management and the Executive Board support and promote risk management?
For this section, you should have evidence to demonstrate the extent to which the leadership of the organisation:
• Uses risk management to develop effective policies at the policy making stage
• Uses risk management to achieve better outcomes
• Provides clear direction on the management of risk
• Enables unanimity on the key strategic risks
Summary of Behavioural Progress toward Leadership and Management Maturity
Capabilities
People
Strategy& Policy
Partnerships, Shared Risks & Resources
Leadership & Membership
Processes& Tools
Risk Handling& Assurance
Outcomes& Delivery
Innovation & Learning
Results
Level 1Engaging
Senior management are aware of the need to manage uncertainty and risk and have made resources available to improve
Level 2Happening
Board/ Councillors and senior managers take the lead to ensure that approaches for addressing risk are being developed and implemented
Level 3Working
Senior managers take the lead to apply risk management thoroughly across the organisation
Level 4Embedded &
Working
Risk management is championed by the CEO
Level 5Driving
Senior management uses consideration of risk to drive excellence through the business, with strong support and reward for well-managed risk-taking
Typical organisational behaviour associated with each level of maturity
Evidence of maturity level
Self-assessment topicsAreas of risk practice covered by this activity
Key activity being measured
Level 5Driving
Level 1Engaging
Level 4Embedded & Working
Level 2Happening
Level 3Working
The Alarm National Performance Model for Risk Management in the Public Services
The comprehensive National Performance Model:
• Measures current performance against a recognised achievement level
• Provides the basis for clear performance indicators
• Acts as a catalyst for improved performance within the organisation
• Informs assurance in corporate governance terms
• Demonstrates current maturity in terms of
- External inspection expectations
- National and international standards
• Allows for comparison with other organisations and learning from best practice through systematic benchmarking
Organisations can use the National Performance Model Assessment Framework to undertake quick “health checks” of their organisation by using the indicators within the summary of progress to come to a conclusion of their current risk management maturity level.
What does good risk management look like in a public service organisation?
The Alarm National Performance Model for Risk Management in the Public Services has been designed to answer that key question. Using the experience and expertise of risk managers, risk consultants and other experts, this performance model maps out risk management maturity, clearly and concisely.
A detailed and comprehensive set of questions have been designed to test current performance against the Assessment Framework. This self-assessment questionnaire has been designed by Alarm’s Benchmarking Special Interest Group and forms the basis of Alarm’s Benchmarking Programme, due to launch in 2010. This document provides an overview of the key areas of the Alarm National Performance Model and Assessment Framework.
Assessment Framework
Risk Management Activity
The National Performance Model breaks down risk management activity into seven strands: five enablers and two focused on results.
Enablers Results
Leadership and management Risk handling and assurance
Strategy and policy Outcomes and delivery
People
Partnership, shared risks and resources
Processes and tools
Risk Management Maturity
The Model tests the extent to which risk management is having a positive effect on the organisation. Risk management maturity is assessed as being at one of five levels:
Level 1 Risk management is engaging with the organisation
Level 2 Risk management is happening within the organisation
Level 3 Risk management is working for the organisation
Level 4 Risk management is embedded and integrated within the organisation
Level 5 Risk management is driving the organisation
This section is concerned with:
• Risk judgements
• Clear direction
• Risk appetite
Assessment Framework
The Alarm National Risk Management Performance Model Assessment Framework is adapted from the EFQM Excellence Model. Alarm also acknowledges, with thanks, the influence of the HM Treasury Self-Assessment Tool: Risk Management Framework (RMAF) on the development of this model.
The questions in this section deal with:
• Information and decision making
• Escalation and reporting systems
• Accountability and management responsibility
The following pages show how each activity within the National Performance Model is assessed:
Leadership and Management Do senior management and the Executive Board support and promote risk management?
For this section, you should have evidence to demonstrate the extent to which the leadership of the organisation:
• Uses risk management to develop effective policies at the policy making stage
• Uses risk management to achieve better outcomes
• Provides clear direction on the management of risk
• Enables unanimity on the key strategic risks
Summary of Behavioural Progress toward Leadership and Management Maturity
Capabilities
People
Strategy& Policy
Partnerships, Shared Risks & Resources
Leadership & Membership
Processes& Tools
Risk Handling& Assurance
Outcomes& Delivery
Innovation & Learning
Results
Level 1Engaging
Senior management are aware of the need to manage uncertainty and risk and have made resources available to improve
Level 2Happening
Board/ Councillors and senior managers take the lead to ensure that approaches for addressing risk are being developed and implemented
Level 3Working
Senior managers take the lead to apply risk management thoroughly across the organisation
Level 4Embedded &
Working
Risk management is championed by the CEO
Level 5Driving
Senior management uses consideration of risk to drive excellence through the business, with strong support and reward for well-managed risk-taking
Typical organisational behaviour associated with each level of maturity
Evidence of maturity level
Self-assessment topicsAreas of risk practice covered by this activity
Key activity being measured
Level 5Driving
Level 1Engaging
Level 4Embedded & Working
Level 2Happening
Level 3Working
The Alarm National Performance Model for Risk Management in the Public Services
Summary of Behavioural Progress toward Strategy and Policy Maturity
This section is concerned with:
• Risk judgements
• Clear direction
• Risk appetite
• Understanding of key risks
• Accountability and responsibility
• Driving improvement
• Challenge to levels of risk acceptance
• Stakeholder engagement
The questions in this section deal with:
• Information and decision making
• Escalation and reporting systems
Leadership and Management
Do senior management and the Executive Board support and promote risk management?
• Accountability and management responsibility
• Leading risk management implementation
• Stakeholders’ engagement
For this section, you should have evidence to demonstrate the extent to which the leadership of the organisation:
• Uses risk management to develop effective policies at the policy making stage
• Uses risk management to achieve better outcomes
• Provides clear direction on the management of risk
• Enables unanimity on the key strategic risks
• Sets the criteria/ arrangements for the organisation’s appetite for taking risks
• Encourages innovation through well-managed risk-taking
• Supports staff when things go wrong (i.e. avoids a blame culture)
• Ensures clear accountability for managing risk
• Drives implementation of improvements in risk management
• Uses the principles of good governance to manage risks
This section is concerned with:
• A strategic approach to the management of risk and increasing its effectiveness
• Policies
The questions in this section deal with:
• Strategy development
Summary of Behavioural Progress toward Leadership and Management Maturity
Strategy and Policy
Are there clear strategies and policies for risk?
• Risk management policy (including risk appetite)
• Risk management framework and strategy implementation
For this section, you should have evidence to demonstrate the extent to which the organisation has:
• Set a clear direction for the scope and priorities of its risk management
• Set the organisation’s requirements of risk management as part of its overall approach to governance
• Designed and implemented a risk management framework
Level 1Engaging
The need for a risk strategy and risk-related policies has been identified and accepted
The risk management system may be undocumented with few formal processes present
Level 2Happening
Risk management strategy and polices drawn up, communicated and being acted upon
Roles and responsibilities established, key stakeholders engaged
Level 3Working
Risk management principles are reflected in the organisation’s strategies and policies
Risk framework is reviewed, developed, refined and communicated
Level 4Embedded &
Working
Risk handling is an inherent feature of policy and strategy making processes
Risk management system is benchmarked and best practices identified and shared across the organisation
Level 5Driving
Risk management capability in policy and strategy making helps to drive organisational excellence
Level 1Engaging
Senior management are aware of the need to manage uncertainty and risk and have made resources available to improve
Level 2Happening
Board/ Councillors and senior managers take the lead to ensure that approaches for addressing risk are being developed and implemented
Level 3Working
Senior managers take the lead to apply risk management thoroughly across the organisation
They own and manage a register of key strategic risks and set the risk appetite
Level 4Embedded &
Working
Risk management is championed by the CEO
The Board and senior managers challenge the risks to the organisation and understand their risk appetite
Management leads risk management by example
Level 5Driving
Senior management uses consideration of risk to drive excellence through the business, with strong support and reward for well-managed risk-taking
Level 5Driving
Level 1Engaging
Level 4Embedded & Working
Level 2Happening
Level 3Working
Level 5Driving
Level 1Engaging
Level 4Embedded & Working
Level 2Happening
Level 3Working
The Alarm National Performance Model for Risk Management in the Public Services
Summary of Behavioural Progress toward Strategy and Policy Maturity
This section is concerned with:
• Risk judgements
• Clear direction
• Risk appetite
• Understanding of key risks
• Accountability and responsibility
• Driving improvement
• Challenge to levels of risk acceptance
• Stakeholder engagement
The questions in this section deal with:
• Information and decision making
• Escalation and reporting systems
Leadership and Management
Do senior management and the Executive Board support and promote risk management?
• Accountability and management responsibility
• Leading risk management implementation
• Stakeholders’ engagement
For this section, you should have evidence to demonstrate the extent to which the leadership of the organisation:
• Uses risk management to develop effective policies at the policy making stage
• Uses risk management to achieve better outcomes
• Provides clear direction on the management of risk
• Enables unanimity on the key strategic risks
• Sets the criteria/ arrangements for the organisation’s appetite for taking risks
• Encourages innovation through well-managed risk-taking
• Supports staff when things go wrong (i.e. avoids a blame culture)
• Ensures clear accountability for managing risk
• Drives implementation of improvements in risk management
• Uses the principles of good governance to manage risks
This section is concerned with:
• A strategic approach to the management of risk and increasing its effectiveness
• Policies
The questions in this section deal with:
• Strategy development
Summary of Behavioural Progress toward Leadership and Management Maturity
Strategy and Policy
Are there clear strategies and policies for risk?
• Risk management policy (including risk appetite)
• Risk management framework and strategy implementation
For this section, you should have evidence to demonstrate the extent to which the organisation has:
• Set a clear direction for the scope and priorities of its risk management
• Set the organisation’s requirements of risk management as part of its overall approach to governance
• Designed and implemented a risk management framework
Level 1Engaging
The need for a risk strategy and risk-related policies has been identified and accepted
The risk management system may be undocumented with few formal processes present
Level 2Happening
Risk management strategy and polices drawn up, communicated and being acted upon
Roles and responsibilities established, key stakeholders engaged
Level 3Working
Risk management principles are reflected in the organisation’s strategies and policies
Risk framework is reviewed, developed, refined and communicated
Level 4Embedded &
Working
Risk handling is an inherent feature of policy and strategy making processes
Risk management system is benchmarked and best practices identified and shared across the organisation
Level 5Driving
Risk management capability in policy and strategy making helps to drive organisational excellence
Level 1Engaging
Senior management are aware of the need to manage uncertainty and risk and have made resources available to improve
Level 2Happening
Board/ Councillors and senior managers take the lead to ensure that approaches for addressing risk are being developed and implemented
Level 3Working
Senior managers take the lead to apply risk management thoroughly across the organisation
They own and manage a register of key strategic risks and set the risk appetite
Level 4Embedded &
Working
Risk management is championed by the CEO
The Board and senior managers challenge the risks to the organisation and understand their risk appetite
Management leads risk management by example
Level 5Driving
Senior management uses consideration of risk to drive excellence through the business, with strong support and reward for well-managed risk-taking
Level 5Driving
Level 1Engaging
Level 4Embedded & Working
Level 2Happening
Level 3Working
Level 5Driving
Level 1Engaging
Level 4Embedded & Working
Level 2Happening
Level 3Working
The Alarm National Performance Model for Risk Management in the Public Services
Summary of Behavioural Progress toward Partnership, Shared Risks and Resources Maturity
Summary of Behavioural Progress toward People Maturity
Partnerships, Shared Risks and Resources
Are there effective arrangements for managing risks with partners?
Key people are aware of areas of potential risk in partnerships and the need to allocate resources to manage risk
Approaches for addressing risk with partners are being developed and implemented
Appropriate tools are developed and resources for risk identified
Risk with partners and suppliers is well managed across organisational boundaries
Appropriate resources are in place to manage risk
Sound governance arrangements are established
Partners support one another’s risk management capacity and capability
Clear evidence of improved partnership delivery through risk management and that key risks to the community are being effectively managed
This section is concerned with:
• Culture
• Roles and responsibilities
• Skills, training and guidance
• Communications
The questions in this section deal with:
• Risk management culture
• Responsibility
• Skills and guidance - capability
• Communications
People
Are people equipped and supported to manage risk well?
For this section, you should have evidence to demonstrate the extent to which there is:
• A risk-aware culture as opposed to a risk-averse culture at all levels within the organisation
• Responsibilities for risks are allocated to individuals to manage
• There are arrangements to ensure appropriate risk management awareness, knowledge, experience and skills among:
- Governors/ Executive Members
- Senior management
- Staff
Key people are aware of the need to understand risk principles and increase capacity and competency in risk management techniques through appropriate training
Suitable guidance is available and a training programme has been implemented to develop risk capability
A core group of people have the skills and knowledge to manage risk effectively and implement the risk management framework
Staff are aware of key risks and responsibilities
People are encouraged and supported to take managed risks through innovation
Regular training and clear communication of risk is in place
All staff are empowered to be responsible for risk management
The organisation has a good record of innovation and well-managed risk-taking
Absence of a blame culture
This section is concerned with:
• Managing risk to and within partnerships
• Area specific risks
• Shared risks
• Risk faced by the community
• Local resilience
• Partnership guidance
• Joint risk registers
• Resources available to manage risk effectively
The questions in this section deal with:
• Partnerships and shared risks
• Risk finance
• Information and knowledge
• Tools
For this section, you should have evidence to demonstrate the extent to which:
• There are agreed mechanisms for identifying, assessing and managing risks in each key partnership
• There is a common risk language which creates shared understanding of the key partnerships’ risk appetite
• There are appropriate mechanisms for the provision and testing of contingency arrangements
• There are appropriate mechanisms for identifying and addressing the implications of sharing risk amongst those best placed to manage them
Level 5Driving
Level 1Engaging
Level 4Embedded & Working
Level 2Happening
Level 3Working
Level 5Driving
Level 1Engaging
Level 4Embedded & Working
Level 2Happening
Level 3Working
The Alarm National Performance Model for Risk Management in the Public Services
Summary of Behavioural Progress toward Partnership, Shared Risks and Resources Maturity
Summary of Behavioural Progress toward People Maturity
Partnerships, Shared Risks and Resources
Are there effective arrangements for managing risks with partners?
Key people are aware of areas of potential risk in partnerships and the need to allocate resources to manage risk
Approaches for addressing risk with partners are being developed and implemented
Appropriate tools are developed and resources for risk identified
Risk with partners and suppliers is well managed across organisational boundaries
Appropriate resources are in place to manage risk
Sound governance arrangements are established
Partners support one another’s risk management capacity and capability
Clear evidence of improved partnership delivery through risk management and that key risks to the community are being effectively managed
This section is concerned with:
• Culture
• Roles and responsibilities
• Skills, training and guidance
• Communications
The questions in this section deal with:
• Risk management culture
• Responsibility
• Skills and guidance - capability
• Communications
People
Are people equipped and supported to manage risk well?
For this section, you should have evidence to demonstrate the extent to which there is:
• A risk-aware culture as opposed to a risk-averse culture at all levels within the organisation
• Responsibilities for risks are allocated to individuals to manage
• There are arrangements to ensure appropriate risk management awareness, knowledge, experience and skills among:
- Governors/ Executive Members
- Senior management
- Staff
Key people are aware of the need to understand risk principles and increase capacity and competency in risk management techniques through appropriate training
Suitable guidance is available and a training programme has been implemented to develop risk capability
A core group of people have the skills and knowledge to manage risk effectively and implement the risk management framework
Staff are aware of key risks and responsibilities
People are encouraged and supported to take managed risks through innovation
Regular training and clear communication of risk is in place
All staff are empowered to be responsible for risk management
The organisation has a good record of innovation and well-managed risk-taking
Absence of a blame culture
This section is concerned with:
• Managing risk to and within partnerships
• Area specific risks
• Shared risks
• Risk faced by the community
• Local resilience
• Partnership guidance
• Joint risk registers
• Resources available to manage risk effectively
The questions in this section deal with:
• Partnerships and shared risks
• Risk finance
• Information and knowledge
• Tools
For this section, you should have evidence to demonstrate the extent to which:
• There are agreed mechanisms for identifying, assessing and managing risks in each key partnership
• There is a common risk language which creates shared understanding of the key partnerships’ risk appetite
• There are appropriate mechanisms for the provision and testing of contingency arrangements
• There are appropriate mechanisms for identifying and addressing the implications of sharing risk amongst those best placed to manage them
Level 5Driving
Level 1Engaging
Level 4Embedded & Working
Level 2Happening
Level 3Working
Level 5Driving
Level 1Engaging
Level 4Embedded & Working
Level 2Happening
Level 3Working
The Alarm National Performance Model for Risk Management in the Public Services
Summary of Behavioural Progress toward Risk Handling and Assurance Maturity
Risk Handling and Assurance
Are risks handled well and does the organisation have assurance that risk management is delivering successful outcomes and supporting creative risk-taking?
No clear evidence that risk management is being effective
Some evidence that risk management is being effective
Performance monitoring and assurance reporting being developed
Clear evidence that risk management is being effective in all key areas
Capability assessed within a formal assurance framework and against best practice standards
Evidence that risk management is being effective and useful for the organisation and producing clear benefits
Evidence of innovative risk taking
Clear evidence that risks are being effectively managed throughout the organisation
Considered risk taking part of the organisational culture
This section is concerned with:
• Successfully seizing opportunities
• Considered risk-taking
• Supporting innovation
• Challenges to preconceptions of risk
• Assurance of the organisation’s level of compliance against the risk management strategy
The questions in this section deal with:
• Risk handling
• Assurance and performance
For this section, you should have evidence to demonstrate the extent to which risk management-related activity has contributed to:
• Delivering innovation
• Effective anticipation and management of strategic risks
• Effective decision making
• Effective policy making
• Effective handling of cross-cutting issues
• Effective review of business planning and target setting
• Effective management of risks to the public
• Effective risk allocation
• Better management of risks to delivery
• Greater efficiency/ reduced costs
• Information integrity and asset security
Some stand-alone risk processes have been identified and are being developed
The need for service continuity arrangements has been identified
Risk management processes are being implemented and reported upon in key areas
Service continuity arrangements are being developed in key areas
Risk management processes used to support key business processes
Early warning indicators and lessons learned are reported
Critical services supported through continuity plans
A framework of risk management processes in place and used to support service delivery
Robust business continuity management system in place
Management of risk and uncertainty is well-integrated with all key business processes and shown to be a key driver in business success
Processes
Does the organisation have effective risk management processes to support the business?
This section is concerned with:
• Embedding risk management in organisational management processes
• Identification and evaluation criteria
• Risk controls
• Action planning and reporting
• Use of risk management in strategic and financial planning, policy making and review, performance, and project and contract management
• Use of risk management in decision making
• Risk management integration into key business processes
The questions in this section deal with:
• Risk management process overview
• Links to business/ service processes
• Risk context
• Risk identification
• Risk assessment
• Risk response
• Risk reporting and review
• Investigation and root cause analysis
• Service continuity management
For this section, you should have evidence to demonstrate the extent to which risk management contributes to the success of the following business processes in your organisation:
• Policy making
• Performance management
• Governance arrangements
• Financial management;
and the extent to which:
• Risk processes support a lessons learnt culture
• There is an effective business continuity framework in place to support service delivery
Summary of Behavioural Progress toward Processes Maturity
Level 5Driving
Level 1Engaging
Level 4Embedded & Working
Level 2Happening
Level 3Working
Level 5Driving
Level 1Engaging
Level 4Embedded & Working
Level 2Happening
Level 3Working
The Alarm National Performance Model for Risk Management in the Public Services
Summary of Behavioural Progress toward Risk Handling and Assurance Maturity
Risk Handling and Assurance
Are risks handled well and does the organisation have assurance that risk management is delivering successful outcomes and supporting creative risk-taking?
No clear evidence that risk management is being effective
Some evidence that risk management is being effective
Performance monitoring and assurance reporting being developed
Clear evidence that risk management is being effective in all key areas
Capability assessed within a formal assurance framework and against best practice standards
Evidence that risk management is being effective and useful for the organisation and producing clear benefits
Evidence of innovative risk taking
Clear evidence that risks are being effectively managed throughout the organisation
Considered risk taking part of the organisational culture
This section is concerned with:
• Successfully seizing opportunities
• Considered risk-taking
• Supporting innovation
• Challenges to preconceptions of risk
• Assurance of the organisation’s level of compliance against the risk management strategy
The questions in this section deal with:
• Risk handling
• Assurance and performance
For this section, you should have evidence to demonstrate the extent to which risk management-related activity has contributed to:
• Delivering innovation
• Effective anticipation and management of strategic risks
• Effective decision making
• Effective policy making
• Effective handling of cross-cutting issues
• Effective review of business planning and target setting
• Effective management of risks to the public
• Effective risk allocation
• Better management of risks to delivery
• Greater efficiency/ reduced costs
• Information integrity and asset security
Some stand-alone risk processes have been identified and are being developed
The need for service continuity arrangements has been identified
Risk management processes are being implemented and reported upon in key areas
Service continuity arrangements are being developed in key areas
Risk management processes used to support key business processes
Early warning indicators and lessons learned are reported
Critical services supported through continuity plans
A framework of risk management processes in place and used to support service delivery
Robust business continuity management system in place
Management of risk and uncertainty is well-integrated with all key business processes and shown to be a key driver in business success
Processes
Does the organisation have effective risk management processes to support the business?
This section is concerned with:
• Embedding risk management in organisational management processes
• Identification and evaluation criteria
• Risk controls
• Action planning and reporting
• Use of risk management in strategic and financial planning, policy making and review, performance, and project and contract management
• Use of risk management in decision making
• Risk management integration into key business processes
The questions in this section deal with:
• Risk management process overview
• Links to business/ service processes
• Risk context
• Risk identification
• Risk assessment
• Risk response
• Risk reporting and review
• Investigation and root cause analysis
• Service continuity management
For this section, you should have evidence to demonstrate the extent to which risk management contributes to the success of the following business processes in your organisation:
• Policy making
• Performance management
• Governance arrangements
• Financial management;
and the extent to which:
• Risk processes support a lessons learnt culture
• There is an effective business continuity framework in place to support service delivery
Summary of Behavioural Progress toward Processes Maturity
Level 5Driving
Level 1Engaging
Level 4Embedded & Working
Level 2Happening
Level 3Working
Level 5Driving
Level 1Engaging
Level 4Embedded & Working
Level 2Happening
Level 3Working
The Alarm National Performance Model for Risk Management in the Public Services
Outcomes and Delivery
Does risk management contribute to achieving outcomes?
This section is concerned with:
• Risk management efforts making a contribution to successful outcomes
• Learning from best practice and continuous improvement
The questions in this section deal with:
• Risk management contribution to overall performance
• Risk management contribution to specific outcomes
In this section you should have evidence to demonstrate the extent to which risk management action contributes to:
• Successful delivery of improved outcomes for local people/ the community
• Meeting planned financial outcomes
• Increased public confidence that risks are well-managed
• The high reputation of the organisation
• Successful innovation
Summary of Behavioural Progress toward Outcomes and Delivery Maturity
Level 5Driving
Level 1Engaging
Level 4Embedded & Working
Level 2Happening
Level 3Working
No clear evidence of improved outcomes
Limited evidence that risk management is being effective in, at least, the most relevant areas
Clear evidence that risk management is supporting the delivery of key outcomes in all relevant areas
Very clear evidence of very significantly improved delivery of all relevant outcomes and showing positive and sustained improvement
Risk management arrangements clearly acting as a driver for change and linked to plans and planning cycles
Ala
rm N
atio
nal P
erfo
rman
ce M
odel
for
Ris
k M
anag
emen
t in
the
Pub
lic S
ervi
ces
Leve
l 5:
Dri
vin
gS
enio
r man
agem
ent u
ses
cons
ider
atio
n of
risk
to
driv
e ex
celle
nce
thro
ugh
the
busi
ness
, with
stro
ng
supp
ort a
nd re
war
d fo
r wel
l-m
anag
ed ri
sk-ta
king
Ris
k m
anag
emen
t cap
abilit
y in
pol
icy
and
stra
tegy
m
akin
g he
lps
to d
rive
orga
nisa
tiona
l exc
elle
nce
All
staf
f are
em
pow
ered
to
be
resp
onsi
ble
for r
isk
man
agem
ent
The
orga
nisa
tion
has
a go
od
reco
rd o
f inn
ovat
ion
and
wel
l-man
aged
risk
-taki
ng
Abs
ence
of a
bla
me
cultu
re
Cle
ar e
vide
nce
of im
prov
ed
partn
ersh
ip d
eliv
ery
thro
ugh
risk
man
agem
ent a
nd th
at
key
risks
to th
e co
mm
unity
ar
e be
ing
effe
ctiv
ely
man
aged
Man
agem
ent o
f ris
k an
d un
certa
inty
is w
ell-i
nteg
rate
d w
ith a
ll ke
y bu
sine
ss
proc
esse
s an
d sh
own
to
be a
key
driv
er in
bus
ines
s su
cces
s
Cle
ar e
vide
nce
that
risk
s ar
e be
ing
effe
ctiv
ely
man
aged
th
roug
hout
the
orga
nisa
tion
Con
side
red
risk-
taki
ng p
art
of th
e or
gani
satio
nal c
ultu
re
Ris
k m
anag
emen
t ar
rang
emen
ts c
lear
ly a
ctin
g as
a d
river
for c
hang
e an
d lin
ked
to p
lans
and
pla
nnin
g cy
cles
Leve
l 4:
Embe
dded
&
Wor
king
Ris
k m
anag
emen
t is
cham
pion
ed b
y th
e C
EO
The
Boa
rd a
nd s
enio
r m
anag
ers
chal
leng
e th
e ris
ks to
the
orga
nisa
tion
and
unde
rsta
nd th
eir r
isk
appe
tite
Man
agem
ent l
eads
risk
m
anag
emen
t by
exam
ple
Ris
k ha
ndlin
g is
an
inhe
rent
fe
atur
e of
pol
icy
and
stra
tegy
mak
ing
proc
esse
s
Ris
k m
anag
emen
t sys
tem
is
ben
chm
arke
d an
d be
st p
ract
ices
iden
tified
an
d sh
ared
acr
oss
the
orga
nisa
tion
Peo
ple
are
enco
urag
ed a
nd
supp
orte
d to
take
man
aged
ris
ks th
roug
h in
nova
tion
Reg
ular
trai
ning
and
cle
ar
com
mun
icat
ion
of ri
sk is
in
plac
e
Sou
nd g
over
nanc
e ar
rang
emen
ts a
re
esta
blis
hed
Par
tner
s su
ppor
t one
an
othe
r’s ri
sk m
anag
emen
t ca
pabi
lity
and
capa
city
A fr
amew
ork
of ri
sk
man
agem
ent p
roce
sses
in
plac
e an
d us
ed to
sup
port
serv
ice
deliv
ery
Rob
ust b
usin
ess
cont
inui
ty
man
agem
ent s
yste
m in
pl
ace
Evid
ence
that
risk
m
anag
emen
t is
bein
g ef
fect
ive
and
usef
ul fo
r the
or
gani
satio
n an
d pr
oduc
ing
clea
r ben
efits
Evid
ence
of i
nnov
ativ
e ris
k-ta
king
Very
cle
ar e
vide
nce
of
very
sig
nific
antly
impr
oved
de
liver
y of
all
rele
vant
ou
tcom
es a
nd s
how
ing
posi
tive
and
sust
aine
d im
prov
emen
t
Leve
l 3:
Wor
king
Sen
ior m
anag
ers
take
th
e le
ad to
app
ly ri
sk
man
agem
ent t
horo
ughl
y ac
ross
the
orga
nisa
tion
They
ow
n an
d m
anag
e a
regi
ster
of k
ey s
trate
gic
risks
an
d se
t the
risk
app
etite
Ris
k m
anag
emen
t prin
cipl
es
are
refle
cted
in th
e or
gani
satio
n’s
stra
tegi
es a
nd
polic
ies
Ris
k fra
mew
ork
is re
view
ed,
deve
lope
d, re
fined
and
co
mm
unic
ated
A c
ore
grou
p of
peo
ple
have
th
e sk
ills a
nd k
now
ledg
e to
man
age
risk
effe
ctiv
ely
and
impl
emen
t the
risk
m
anag
emen
t fra
mew
ork
Sta
ff ar
e aw
are
of k
ey ri
sks
and
resp
onsi
bilit
ies
Ris
k w
ith p
artn
ers
and
supp
liers
is w
ell m
anag
ed
acro
ss o
rgan
isat
iona
l bo
unda
ries
App
ropr
iate
reso
urce
s in
pl
ace
to m
anag
e ris
k
Ris
k m
anag
emen
t pr
oces
ses
used
to s
uppo
rt ke
y bu
sine
ss p
roce
sses
Early
war
ning
indi
cato
rs a
nd
less
ons
lear
ned
are
repo
rted
Crit
ical
ser
vice
s su
ppor
ted
thro
ugh
cont
inui
ty p
lans
Cle
ar e
vide
nce
that
risk
m
anag
emen
t is
bein
g ef
fect
ive
in a
ll ke
y ar
eas
Cap
abilit
y as
sess
ed w
ithin
a
form
al a
ssur
ance
fram
ewor
k an
d ag
ains
t bes
t pra
ctic
e st
anda
rds
Cle
ar e
vide
nce
that
risk
m
anag
emen
t is
supp
ortin
g de
liver
y of
key
out
com
es in
al
l rel
evan
t are
as
Leve
l 2:
Hap
peni
ngB
oard
/ Cou
ncillo
rs a
nd
seni
or m
anag
ers
take
th
e le
ad to
ens
ure
that
ap
proa
ches
for a
ddre
ssin
g ris
k ar
e be
ing
deve
lope
d an
d im
plem
ente
d
Ris
k m
anag
emen
t stra
tegy
an
d po
licie
s dr
awn
up,
com
mun
icat
ed a
nd b
eing
ac
ted
upon
Rol
es a
nd re
spon
sibi
litie
s es
tabl
ishe
d, k
ey
stak
ehol
ders
eng
aged
Sui
tabl
e gu
idan
ce is
av
aila
ble
and
a tra
inin
g pr
ogra
mm
e ha
s be
en
impl
emen
ted
to d
evel
op ri
sk
capa
bilit
y
App
roac
hes
for a
ddre
ssin
g ris
k w
ith p
artn
ers
are
bein
g de
velo
ped
and
impl
emen
ted
App
ropr
iate
tool
s ar
e de
velo
ped
and
reso
urce
s fo
r ris
k id
entifi
ed
Ris
k m
anag
emen
t pr
oces
ses
are
bein
g im
plem
ente
d an
d re
porte
d up
on in
key
are
as
Ser
vice
con
tinui
ty
arra
ngem
ents
are
bei
ng
deve
lope
d in
key
ser
vice
ar
eas
Som
e ev
iden
ce th
at ri
sk
man
agem
ent i
s be
ing
effe
ctiv
e
Per
form
ance
mon
itorin
g an
d as
sura
nce
repo
rting
bei
ng
deve
lope
d
Lim
ited
evid
ence
that
risk
m
anag
emen
t is
bein
g ef
fect
ive
in, a
t lea
st, t
he
mos
t rel
evan
t are
as
Leve
l 1:
Eng
agin
gS
enio
r man
agem
ent a
re
awar
e of
the
need
to
man
age
unce
rtain
ty a
nd ri
sk
and
have
mad
e re
sour
ces
avai
labl
e to
impr
ove
The
need
for a
risk
stra
tegy
an
d ris
k-re
late
d po
licie
s ha
s be
en id
entifi
ed a
nd
acce
pted
The
risk
man
agem
ent
syst
em m
ay b
e un
docu
men
ted
with
few
fo
rmal
pro
cess
es p
rese
nt
Key
peo
ple
are
awar
e of
th
e ne
ed to
und
erst
and
risk
prin
cipl
es a
nd in
crea
se
capa
city
and
com
pete
ncy
in
risk
man
agem
ent t
echn
ique
s th
roug
h ap
prop
riate
trai
ning
Key
peo
ple
are
awar
e of
ar
eas
of p
oten
tial r
isk
in
partn
ersh
ips
and
the
need
to
allo
cate
reso
urce
s to
m
anag
e ris
k
Som
e st
and-
alon
e ris
k pr
oces
ses
have
bee
n id
entifi
ed a
nd a
re b
eing
de
velo
ped
The
need
for s
ervi
ce
cont
inui
ty a
rran
gem
ents
has
be
en id
entifi
ed
No
clea
r evi
denc
e th
at
risk
man
agem
ent i
s be
ing
effe
ctiv
e
No
clea
r evi
denc
e of
im
prov
ed o
utco
mes
Str
ateg
y &
Pol
icy
Lead
ersh
ip &
M
anag
emen
tP
eopl
eP
artn
ersh
ip, S
hare
d R
isk
& R
esou
rces
Pro
cess
esP
roce
sses
Ris
k H
andl
ing
&
Ass
uran
ceO
utco
mes
& D
eliv
ery
The Alarm National Performance Model for Risk Management in the Public Services
Outcomes and Delivery
Does risk management contribute to achieving outcomes?
This section is concerned with:
• Risk management efforts making a contribution to successful outcomes
• Learning from best practice and continuous improvement
The questions in this section deal with:
• Risk management contribution to overall performance
• Risk management contribution to specific outcomes
In this section you should have evidence to demonstrate the extent to which risk management action contributes to:
• Successful delivery of improved outcomes for local people/ the community
• Meeting planned financial outcomes
• Increased public confidence that risks are well-managed
• The high reputation of the organisation
• Successful innovation
Summary of Behavioural Progress toward Outcomes and Delivery Maturity
Level 5Driving
Level 1Engaging
Level 4Embedded & Working
Level 2Happening
Level 3Working
No clear evidence of improved outcomes
Limited evidence that risk management is being effective in, at least, the most relevant areas
Clear evidence that risk management is supporting the delivery of key outcomes in all relevant areas
Very clear evidence of very significantly improved delivery of all relevant outcomes and showing positive and sustained improvement
Risk management arrangements clearly acting as a driver for change and linked to plans and planning cycles
Ala
rm N
atio
nal P
erfo
rman
ce M
odel
for
Ris
k M
anag
emen
t in
the
Pub
lic S
ervi
ces
Leve
l 5:
Dri
vin
gS
enio
r man
agem
ent u
ses
cons
ider
atio
n of
risk
to
driv
e ex
celle
nce
thro
ugh
the
busi
ness
, with
stro
ng
supp
ort a
nd re
war
d fo
r wel
l-m
anag
ed ri
sk-ta
king
Ris
k m
anag
emen
t cap
abilit
y in
pol
icy
and
stra
tegy
m
akin
g he
lps
to d
rive
orga
nisa
tiona
l exc
elle
nce
All
staf
f are
em
pow
ered
to
be
resp
onsi
ble
for r
isk
man
agem
ent
The
orga
nisa
tion
has
a go
od
reco
rd o
f inn
ovat
ion
and
wel
l-man
aged
risk
-taki
ng
Abs
ence
of a
bla
me
cultu
re
Cle
ar e
vide
nce
of im
prov
ed
partn
ersh
ip d
eliv
ery
thro
ugh
risk
man
agem
ent a
nd th
at
key
risks
to th
e co
mm
unity
ar
e be
ing
effe
ctiv
ely
man
aged
Man
agem
ent o
f ris
k an
d un
certa
inty
is w
ell-i
nteg
rate
d w
ith a
ll ke
y bu
sine
ss
proc
esse
s an
d sh
own
to
be a
key
driv
er in
bus
ines
s su
cces
s
Cle
ar e
vide
nce
that
risk
s ar
e be
ing
effe
ctiv
ely
man
aged
th
roug
hout
the
orga
nisa
tion
Con
side
red
risk-
taki
ng p
art
of th
e or
gani
satio
nal c
ultu
re
Ris
k m
anag
emen
t ar
rang
emen
ts c
lear
ly a
ctin
g as
a d
river
for c
hang
e an
d lin
ked
to p
lans
and
pla
nnin
g cy
cles
Leve
l 4:
Embe
dded
&
Wor
king
Ris
k m
anag
emen
t is
cham
pion
ed b
y th
e C
EO
The
Boa
rd a
nd s
enio
r m
anag
ers
chal
leng
e th
e ris
ks to
the
orga
nisa
tion
and
unde
rsta
nd th
eir r
isk
appe
tite
Man
agem
ent l
eads
risk
m
anag
emen
t by
exam
ple
Ris
k ha
ndlin
g is
an
inhe
rent
fe
atur
e of
pol
icy
and
stra
tegy
mak
ing
proc
esse
s
Ris
k m
anag
emen
t sys
tem
is
ben
chm
arke
d an
d be
st p
ract
ices
iden
tified
an
d sh
ared
acr
oss
the
orga
nisa
tion
Peo
ple
are
enco
urag
ed a
nd
supp
orte
d to
take
man
aged
ris
ks th
roug
h in
nova
tion
Reg
ular
trai
ning
and
cle
ar
com
mun
icat
ion
of ri
sk is
in
plac
e
Sou
nd g
over
nanc
e ar
rang
emen
ts a
re
esta
blis
hed
Par
tner
s su
ppor
t one
an
othe
r’s ri
sk m
anag
emen
t ca
pabi
lity
and
capa
city
A fr
amew
ork
of ri
sk
man
agem
ent p
roce
sses
in
plac
e an
d us
ed to
sup
port
serv
ice
deliv
ery
Rob
ust b
usin
ess
cont
inui
ty
man
agem
ent s
yste
m in
pl
ace
Evid
ence
that
risk
m
anag
emen
t is
bein
g ef
fect
ive
and
usef
ul fo
r the
or
gani
satio
n an
d pr
oduc
ing
clea
r ben
efits
Evid
ence
of i
nnov
ativ
e ris
k-ta
king
Very
cle
ar e
vide
nce
of
very
sig
nific
antly
impr
oved
de
liver
y of
all
rele
vant
ou
tcom
es a
nd s
how
ing
posi
tive
and
sust
aine
d im
prov
emen
t
Leve
l 3:
Wor
king
Sen
ior m
anag
ers
take
th
e le
ad to
app
ly ri
sk
man
agem
ent t
horo
ughl
y ac
ross
the
orga
nisa
tion
They
ow
n an
d m
anag
e a
regi
ster
of k
ey s
trate
gic
risks
an
d se
t the
risk
app
etite
Ris
k m
anag
emen
t prin
cipl
es
are
refle
cted
in th
e or
gani
satio
n’s
stra
tegi
es a
nd
polic
ies
Ris
k fra
mew
ork
is re
view
ed,
deve
lope
d, re
fined
and
co
mm
unic
ated
A c
ore
grou
p of
peo
ple
have
th
e sk
ills a
nd k
now
ledg
e to
man
age
risk
effe
ctiv
ely
and
impl
emen
t the
risk
m
anag
emen
t fra
mew
ork
Sta
ff ar
e aw
are
of k
ey ri
sks
and
resp
onsi
bilit
ies
Ris
k w
ith p
artn
ers
and
supp
liers
is w
ell m
anag
ed
acro
ss o
rgan
isat
iona
l bo
unda
ries
App
ropr
iate
reso
urce
s in
pl
ace
to m
anag
e ris
k
Ris
k m
anag
emen
t pr
oces
ses
used
to s
uppo
rt ke
y bu
sine
ss p
roce
sses
Early
war
ning
indi
cato
rs a
nd
less
ons
lear
ned
are
repo
rted
Crit
ical
ser
vice
s su
ppor
ted
thro
ugh
cont
inui
ty p
lans
Cle
ar e
vide
nce
that
risk
m
anag
emen
t is
bein
g ef
fect
ive
in a
ll ke
y ar
eas
Cap
abilit
y as
sess
ed w
ithin
a
form
al a
ssur
ance
fram
ewor
k an
d ag
ains
t bes
t pra
ctic
e st
anda
rds
Cle
ar e
vide
nce
that
risk
m
anag
emen
t is
supp
ortin
g de
liver
y of
key
out
com
es in
al
l rel
evan
t are
as
Leve
l 2:
Hap
peni
ngB
oard
/ Cou
ncillo
rs a
nd
seni
or m
anag
ers
take
th
e le
ad to
ens
ure
that
ap
proa
ches
for a
ddre
ssin
g ris
k ar
e be
ing
deve
lope
d an
d im
plem
ente
d
Ris
k m
anag
emen
t stra
tegy
an
d po
licie
s dr
awn
up,
com
mun
icat
ed a
nd b
eing
ac
ted
upon
Rol
es a
nd re
spon
sibi
litie
s es
tabl
ishe
d, k
ey
stak
ehol
ders
eng
aged
Sui
tabl
e gu
idan
ce is
av
aila
ble
and
a tra
inin
g pr
ogra
mm
e ha
s be
en
impl
emen
ted
to d
evel
op ri
sk
capa
bilit
y
App
roac
hes
for a
ddre
ssin
g ris
k w
ith p
artn
ers
are
bein
g de
velo
ped
and
impl
emen
ted
App
ropr
iate
tool
s ar
e de
velo
ped
and
reso
urce
s fo
r ris
k id
entifi
ed
Ris
k m
anag
emen
t pr
oces
ses
are
bein
g im
plem
ente
d an
d re
porte
d up
on in
key
are
as
Ser
vice
con
tinui
ty
arra
ngem
ents
are
bei
ng
deve
lope
d in
key
ser
vice
ar
eas
Som
e ev
iden
ce th
at ri
sk
man
agem
ent i
s be
ing
effe
ctiv
e
Per
form
ance
mon
itorin
g an
d as
sura
nce
repo
rting
bei
ng
deve
lope
d
Lim
ited
evid
ence
that
risk
m
anag
emen
t is
bein
g ef
fect
ive
in, a
t lea
st, t
he
mos
t rel
evan
t are
as
Leve
l 1:
Eng
agin
gS
enio
r man
agem
ent a
re
awar
e of
the
need
to
man
age
unce
rtain
ty a
nd ri
sk
and
have
mad
e re
sour
ces
avai
labl
e to
impr
ove
The
need
for a
risk
stra
tegy
an
d ris
k-re
late
d po
licie
s ha
s be
en id
entifi
ed a
nd
acce
pted
The
risk
man
agem
ent
syst
em m
ay b
e un
docu
men
ted
with
few
fo
rmal
pro
cess
es p
rese
nt
Key
peo
ple
are
awar
e of
th
e ne
ed to
und
erst
and
risk
prin
cipl
es a
nd in
crea
se
capa
city
and
com
pete
ncy
in
risk
man
agem
ent t
echn
ique
s th
roug
h ap
prop
riate
trai
ning
Key
peo
ple
are
awar
e of
ar
eas
of p
oten
tial r
isk
in
partn
ersh
ips
and
the
need
to
allo
cate
reso
urce
s to
m
anag
e ris
k
Som
e st
and-
alon
e ris
k pr
oces
ses
have
bee
n id
entifi
ed a
nd a
re b
eing
de
velo
ped
The
need
for s
ervi
ce
cont
inui
ty a
rran
gem
ents
has
be
en id
entifi
ed
No
clea
r evi
denc
e th
at
risk
man
agem
ent i
s be
ing
effe
ctiv
e
No
clea
r evi
denc
e of
im
prov
ed o
utco
mes
Str
ateg
y &
Pol
icy
Lead
ersh
ip &
M
anag
emen
tP
eopl
eP
artn
ersh
ip, S
hare
d R
isk
& R
esou
rces
Pro
cess
esP
roce
sses
Ris
k H
andl
ing
&
Ass
uran
ceO
utco
mes
& D
eliv
ery
Ladysmith HouseHigh StreetSidmouthDevon EX10 8LN
t: 01395 519083f: 01395 517990
