EEA

EEA and
and Norway
Norway Grants
Grants
Programme
Programme risk
risk management
management

Inger
IngerK.
K.Stoll,
Stoll,Head
HeadofofCommunication,
Communication,Reporting
Reportingand
and
Evaluation,
Evaluation,Financial
FinancialMechanism
MechanismOffice
Office
March 2013
March 2013

1
 Results and risks

What is Results Based What is a result and a risk?

Management (RBM)
RBM is a management strategy In the context of the Grants:
by which all actors,
A result is the output,
contributing directly or
outcome or impact of a
indirectly to achieving a set of
development intervention
results, ensure that their
processes, products and
services contribute to the A risk is an event that may
achievement of desired results occur and impede the
(outputs, outcomes and objective
impact)
2
 KEY CONCEPTS

Results achievement

Beneficiary oriented

Managing for results and reduced risks

3
 Risks
• Risks are an expression of uncertainty
• Risks are events that may occur, and if they occur,
have harmful or negative effects on the achievement
of results
• Risks are closely related to the results and should
consequently be analysed against the results
framework of a programme
• Risk analyses strengthen the basis for choosing
realistic objectives and level of ambitions

4
 Risk management
process in 11 steps
Establish strategy and processes
1. Develop a strategy for integrating risk
management in results management
2. Establish risk leadership integrated in results
management
Analysis, actions and follow-up on several
levels
3. Identify objectives
4. Identify critical success factors
(assumptions) 5
 Risk management
process in 11steps
5. Identify risks

6. Assess and prioritise the risks, in terms of

likelihood and consequence; high – medium – low

7. Decide risk tolerance

8. Define and assess risk response

9. Response to residual risk

6
10. Mitigate and manage risks
11. Dialogue and Report

FMO’s risk management strategy :

http://www.eeagrants.org/

7
 Risk management
levels

Total Grants

Country
Programme

Projects

Risk strategy at each level, according to roles and responsibilities

8
Steps 1 & 2: Establish risk
strategy and leadership
• Risk management system in place
• Programme Operator must actively take
leadership at programme and project levels
• Assign roles at each level
• Also keep an eye on national level risks, and
mitigate where possible

9
Step 3: Identify objectives
at all levels, example
Objective (impact)
Widespread improvements in societ or a sector
Gender equality and work-life balance promoted

Outcome(s)
Intermediate effects on target groups and systems
Gender pay gap reduced
Outputs
Products and services delivered
1. Wage negotiations are gender sensitive. 2. Training is carried out.
Activities
Tasks transforming inputs to outputs.
1.Present statistics on gender wage differences
2. Train trade unions and employers associations in g. pay gap reduction
Inputs
Financial, human and material resources
Budget: X € , Input from DPP (y people z €), Resources from local institutions
10
 Step 3. Identify objectives at
all levels
Example – Renewable Energy
Increased share of
Objective (pre-defined) renewable energy in
energy use

Expected outcome(s) Increased renewable Increased awareness of and

energy production education in renewable
(pre-defined) energy solutions

More energy X policies at local 100 MW capacity X awareness X training courses in

Outputs efficient RES in and regional level RES constructed raising RES provided to
place to stimulate RES and in operation programmes at officials at local and
developed local level regional level
carried through
•Modernised •Windmills
Types of RES •Training in RES
projects planning •Solar systems •Awareness •Training
infrastructure
competence •Hydropower raising courses for
•R&D on RES campaigns at officials at
•Plans/policy •Bioenergy local level regional level
•Feasibility of
development
RES mapped out •Train the •Training
in relation to trainers courses for
local conditions
11 officials at
regional level
Step 4: Identify assumptions

• Assumptions are the necessary positive

conditions that allow for a succesful cause-
and-effect relationship between the
different levels of results.
• Assumptions are critical success factors.
• Assumptions are formulated after the
objectives, to ensure results chain realism

12
Step 4: Identify assumptions
at all levels
Objective (impact) Assumptions
Widespread improvements
in society or a sector

Outcome(s) Assumptions
Intermediate effects on
target groups and systems
Outputs Assumptions
Products and services
delivered
Activities Assumptions
Tasks transforming inputs
to outputs

Inputs Assumptions
Financial, human and
material resources 13
Step 4: Assumptions
An example
• Outcome: Participation
in local election
increases from 63% in • Assumption: Voting
2012 to 75% in 2016. centres are operational
and in place on voting
• Output: Voters day.
registration increases
from 70% in 2012 to
90% in 2016.

14
Step 5: Identify risks

• Risk identification is done in all phases of a

programme, but early identification gives the
best effect.
• Normally requires several contributers.
• If a critical assumption is likely to occur but
not certain, it may represent a risk.
• Risks are expressed as negative statements in
relation to achievement of the desired result.

15
Step 5. Risk identification

• Identify the risk, monitor, manage and try to

influence. A risk register can be useful.

• There might be a perceived conflict of interest

regarding sharing information of risks.

• Keep in mind: Always document your risk

identification, analysis and mitigation
16
 Identification of a risk
An example

Impact (Objective) Assumptions Risks

Outcome
Participation in local
election increases from
63% in 2012 to 75% in
2016.
Output Voting centres are Voting material is not
Voters registration operational and with all available in all local
increases from 70% in 2012 logicistics in place languages.
to 90% in 2016. on voting day.

Activities
Inputs
17
Risk categories

It is common to group the risks in categories. FMO

uses nine broad risk categories:
•Policy and politics
•Governance: Institutional, management,
transparency and accountability
•Corruption and procurement issues
•Socio-cultural and gender equity, minorities,
Roma, rights and values
18
Risk categories

• Financial issues
• Economic issues
• Environmental and climate issues
• Technical and technological issues
• Role of DPPs and project partners

NB – Other risk categories are also relevant

19
Risk dimensions

Each risk category consists of certain risk dimensions

Example Governance category:
•Adequate competence and capacity is not
available
•Supportive legal framework conditions are not
in place
•The control systems are not sufficient

20
Step 6: Assess and prioritise
the risks

A risk analysis contains an assessment of the risks

in terms of
•Probability or likelihood of the occurence of the
risks
•Consequences or impact if the event occurs
The risk assessment is a forward-looking exercise; it
should take into account the whole agreement
period - and beyond - to ensure sustainability of the
results
21
Risk probability and consequence

22
 Risk Analysis

High risk
Killer assumption

“Black Swan”

Low Medium High

Consequence

23
 Narrative risk summary

• The risk rating is accompanied by a narrative

assessment highlighting the major risks
identified.
• All the high or substantial risk ratings are
named as major risks

Keep in mind: Distinguish probability and

consequence
24
 Step 7: Risk tolerance levels

Risks are inevitable.

It is not an aim to avoid risks at all costs.

A higher risk may be acceptable in contexts

where the expected impact and benefits
are higher than the potential risks.
25
 7. Risk tolerance

• Decide and document what level of risk you

accept
• Communicate the risk appetite

26
 8. Define and assess
risk response
• Identify mitigating actions (including
conrols) and assess their impact

• Decide on mitigating actions

• Re-assess to conclude on residual risk

27
 Step 9: Response to
residual risk
• Decisions regarding tolerance of major residual
risks can be divided in the folllowing strategies:
 Avoid/terminate: Redesign programme or
terminate the programme or parts of it.
 Transfer/share: Share risk with other
partners (ex DPPs) or pass the impact of
the risk to third part (e.g. via an
insurance policy)

28
 9. Response to residual risk…

 Accept/tolerate: Accept the risks without any

mitigating actions, but monitor
and manage if the risk level
increases

29
 Step 10: Mitigate and manage risks

• Reduce, prevent, mitigate

• Establish a system for risk monitoring and
handling.
• During implementation it is good practice to
incorporate the mitigating measures in the
regular work plan of the programme or
projects, assign staff members responsible for
actions and resources required.

30
 Mitigation and management

• Assess the implementation progress of the

mitigating measures, manage and report.
• Identify any new risks or changes in
circumstances and add to your risk registry
and work plan.
• Sometimes we need to redesign our risk
mitigation strategy and actions.

31
Risk mitigation

32
 Step 11:Reporting and dialogue

• The programme risk management will be

reported in the Annual Programme Report and
in the NFP’s Annual Strategic Report

• The risk picture and the possible mitigating

actions will be a central element in the
dialogue between donors, beneficiaries and
the FMO

33
 Risks to achievment of outcomes

• At the programme level, the FMO bases its risk

assessment on the Programme Proposal, the
Annual Programme Report the Annual
Strategic Report from the NFP and the
dialogue. EU analyses are also used.
• The FMO especially focuses on likelihood and
consequence of risks to achievement of the
outcomes = output to outcome review

34
 Results for the beneficiaries

• We are interested in achieving results for the

beneficiaries, e g the higher level objectives,
and correspondingly interested in the higher
level risks

We are in it together!

35