Embedding Risk Management to Achieve Strategic and Operational ...

Embedding Risk Management
to Achieve Strategic and Operational Objectives
Rob Kella - Chief Risk Officer

Overview
Managers inherently make decisions about risk everyday
Make decisions visible
Consider risk appetite and tolerance within the governance
limits of the business and then align them with the
achievement of strategic objectives
2

Refuelling

Risk and Assurance at Qantas
Established in March 2006 –
Supporting the Management of Risk
Group
Facilitation
• Border regulation
compliance and risk
management
• National and international
compliance with new
laws and regulations
Environment
and
Fuel Efficiency
• Environmental
compliance and risk
management
• Environmental
improvement programs
(inclusive of fuel and
non-fuel initiatives)
• Climate change
Chief Risk Officer
Group Risk and
Reporting
• Risk management
advisory
• Internal and external
reporting
• Project office
Aviation Medical
Services
• Aviation and
occupational medical
services
• Medical advice
(employees and
passengers)
Internal Audit
• Internal compliance
and control
• Corporate governance
Occupational
Health and
Safety
• Occupational safety
compliance and risk
management
• People safety
improvement program
Security
• Security compliance
and risk management
• Group
security services
• Business resilience
Safety
• Aviation safety
compliance and risk
management
• Oversight of group
aviation safety
standards
4

Why Manage Risk?
Increasing complexity of external risk environment
Continuous pressure to change – cost reduction and increased risk of
doing business
Management demands for more timely risk information
Increasing/changing demands from regulators; evolving compliance
requirements
Re-alignment of governance models within the Group to support business
objectives
5

Know Your Risk Factors and
Their Relationships
Growth of internet
as a sales channel
Rising energy costs
New market segments
Strategic
Low cost carrier models -
unbundling airline Unstable
Regional & global services geographical
Economics
regions
Rapid technology
advancements
Cost competitiveness
Consolidation -
super carriers
Externally driven Credit rating Industrial
Unrestricted
Change
management
relations
Capacity
management
air rights
Domestic &
International
Competition
Cost reduction
programs
Revenue management
Capital expenditure
Pricing/yield
management
Brand
Fleet
management
Financial Supply constraints -
Operational
aircraft delays
Internally driven
Customer service
Maintenance
and reliability
Regulatory
changes -
environment
6
On-going security
challenges
Safety

Pilots on the Flight Deck

Risk Management Framework
What are your
business
objectives?
What will prevent
you from
achieving them?
What are the
high-level causes/
consequences?
Who are the
primary risk
owners?
How do we effectively and efficiently manage risks?
Business
Objectives
/ Drivers
Process
Risks
Strategic Risks
Technology
Risks
Execution Risk
Compliance/
Control
Risks
8
Financial
Risks

The Qantas Approach -
Embedding Risk Management
Structure
Operations
Risk Management done in isolation is not sustainable, you need a
supporting risk management framework
Qantas’ System of Risk Management
Strategy
• Policy
• Leadership/
commitment/
culture
• Alignment with
vision/ objectives/
strategy
• Governance structure
• Specialist risk groups
• Reporting and monitoring
frameworks
• Risk management methodology
• Awareness and capability
• Support
Qantas Group Risk Assessment Guide
Communicate and Consult (refer page 4)
1. Establish the Context
• Define the problem/describe the change
• Identify internal and external stakeholders
• Size the discussion – how many, how big (dollars, people,
aircraft, etc.)
• Determine relevant consequence ratings for this assessment
2. Identify Risks/Hazards
• What can happen – identify list of risks to be managed
• How can it happen – consider possible causes and scenarios
3. Analyse and Evaluate Risks
• Identify existing controls/management strategies
• Rate effectiveness of controls/management strategies
• Describe and rate the worst consequence of the scenario (refer
page 2 )
• Rate the likelihood of the consequence (refer page 3)
• Based on consequence and likelihood ratings assign the risk
level (refer page 3)
• Set priorities
4. Treat and Control Risks
• Identify and assess range of options for treating risk (refer page
4)
• Prepare risk treatment and control action plans: responsibilities,
schedules, expected outcomes, budgets, performance
measures, review process
• Implement plans
• Analyse the effectiveness of the treatment/control and evaluate
residual risk
+ QGRAG supporting materials
Monitor and Review
9

Qantas Group
Risk Assessment Guide
Establish Context
Identify risks and hazards
Analyse and evaluate risks
Treat and control risks
Monitor and review
Ownership and
accountability for
risk management
is paramount
for business
success
10

Airbus A320 On Approach

Supporting Tools
EXAMPLE ONLY
VALUE:
• Quick
snapshot of
key risks
• Risk trends
over time –
focus on risk
indicators
• Enhanced
analysis
12
• Integrated risk
reporting
• Clusters of
risks against
objectives
‘heat-map’

Aircraft in Maintenance Hangar

Key Messages
Understand your risk appetite and risk tolerance (governance model aligns
individual business unit appetite and tolerance with Group appetite)
Risk specialists support and embed risk practices in line management
The business needs to own and manage their risks
Risk management operationalised - need risk KPIs (linkage to outcomes)
‘If you don’t measure it you don’t manage it’
– will reduce waste and re-work
Support through appropriate frameworks and tools
14

Boeing B737-800 on Approach

Ongoing Success Factors
Continued support/advocacy from the top
Promotion and support of a risk culture - Culture that empowers risk ownership
Organisational positioning – Operationalise risks
Organisation that embraces change
Culture that empowers sharing
Structured/disciplined framework and supporting tools
Active monitoring and support
16

Qantas A380 to the Flight Line