OVERVIEW
What is it?
The EC defines a risk as 'Any event or issue that could occur and adversely impact the achievement of the Commission's political, strategic and operational objective. Lost opportunities are also considered as risks' (European Commission, 2018. Risk Management in the Commission. Implementation Guide [2018-2019 Edition]). In other words, risk is a potential problem which might happen but has not yet.
Risk management refers to the 'continuous, proactive and systematic process of identifying, assessing and managing risks in line with the accepted risk levels, carried out at every level of the Commission to provide reasonable assurance as regards the achievement of the objectives' (European Commission, 2018. Risk Management in the Commission. Implementation Guide [2018-2019 Edition]). It comprises a set of techniques to ensure proactive management of potential problems and to mitigate the possible negative effects arising from risks which have materialized.
What can it be used for?
A risk management strategy increases the likelihood of achieving objectives efficiently and effectively. Anticipating risks will help in:
- making more reasoned decisions (justifying why certain decisions were taken, what risk factors were considered, etc.);
- improving efficiency (aligning risk levels and resource and control system allocations);
- reinforcing the reliability of management systems (ensuring key risks have been taken into consideration and that internal control systems have been adequately reinforced).
When can it be used?
Risk management is particularly relevant in the design phase (identification and formulation) of an intervention, when the risk management response and plan are defined. The risk management plan (and mitigation measures, if any) will become part of the intervention implementation.
Who can use it?
- Everyone involved in each activity's performance should assess and manage the risks associated with it.
- Different actors should intervene at different hierarchical levels as appropriate. In the INTPA context, this can include government counterparts and implementing partners.
What are its strengths?
- Allows time and resources to be saved when begun early in the design phase, as critical risks may be immediately assessed and an intervention whose risks cannot be mitigated can be promptly discarded.
What are its limitations?
- Risks are not always easy to identify and assess in a systematic, objective way; risk analysis is often based on subjective judgement, and different stakeholders may have different sensibilities and levels of risk acceptance.
- Risk management should, whenever possible, be sustained by evidence, taking into account lessons to be learned in similar contexts and interventions.
PRACTICAL APPLICATION
Key elements
Risk management follows a five-step approach, summarised in Figure 1.
...
The technical assessment of risk is a mandatory exercise and, as such, must always be performed. However, in open conflict situations or contexts of political volatility or fragility – which are not uncommon settings for INTPA interventions ––risk tolerance may, within clearly defined limits, be a higher priority than assessment of the impact and likelihood of risks. The reputational risks linked to avoidance option, for example, can be deemed of higher value than financial risks.
Requirements
Data/information. Risks need to be identified to the greatest extent possible: a deep knowledge of context and stakeholders as well as lessons from the past are key inputs. The starting point is often a literature review (context and sector analysis, lessons learned from previous interventions, recent evaluations, etc.), followed by more focused assessments.
...
- Risk management embraces all intervention domains and management aspects – strategic decision-making, activity planning, operational effectiveness and efficiency, protection of assets and information, business continuity and staff management. Across all domains and aspects, the same basic question applies: Are the mitigation measures sufficient to reduce risk to an acceptable level?
- Risks (and assumptions) stem from the logic of an intervention. Hence, assessing and managing risks is an iterative process that can affect the design and the expected results. As necessary, such possible impacts need to be reflected in the intervention logic. Monitoring arrangements are critical in this regard.
EU RESOURCES
- The European Commission (EC), DG INTPA. Tools and Methods Series, Guideline N.7 2017: Budget Support Guidelines (Annexe 7, Risk Management Framework, Pages 45-49).
...
