21/11/2013
1
Risk Management at NCFERisk Management at NCFE
The Risk Management JourneyThe Risk Management Journey
Graeme WalkerDirector of Business ServicesDirector of Business Services
21/11/2013
2
The journeyThe journey
“The NCFE journey has been one ofunprecedented growth in the last fewyears, in a heavily regulated marketplace,y y g pwhere risk management has played a bigpart in driving that commercial growth”p g g
21/11/2013
3
I want to tell you a story…….I want to tell you a story…….
• May 2008…..disaster strikes
• Business unprepared
• Close to business collapse
21/11/2013
4
What is NCFEWhat is NCFE
• An “Exam Board”
• Fastest growing
• 600,000 learners
High technolog dependence• High technology dependence
• An Amazon
21/11/2013
5
The way we used to manage riskThe way we used to manage risk
• No Board visibility
• An operational risk register
• Back ups – occasionally
Part time risk strategic risks• Part time risk strategic risks
• Some insurance
• and….
• ……not much else
21/11/2013
6
IT risks – DR and BCPIT risks DR and BCP
• Get the basics done first
• The first practical things to fixThe first practical things to fix
• A back up strategy
• Replication, replication, replication
• Full Business Continuity Plans
• And lots of exercise
21/11/2013
7
I have seen the lightI have seen the light
• Its not a cost
• Strategic risk management has clear commercial benefits
• Risk management helped NCFE win 2 major national contractswin 2 major national contracts
21/11/2013
8
A wise man saidA wise man said
• Growing recognition at NCFE of the strategic significance
• If you want to get something past your Board mention risk
• Risk management adds value
21/11/2013
9
Help I need somebody……helpHelp I need somebody……help
• How did we professionalise NCFE’s approach
• Business Continuityy
• The IRM
• Training courses
C lt t• Consultants
• An investment
21/11/2013
10
How we are going to do thisHow we are going to do this
• Set up Audit and Risk Committee
• Created Terms of Reference
• Internal audit
C lt h• Culture change
21/11/2013
11
Do it this wayDo it this way
• Risk Management Policy
• External pressure - OFQUAL conditions of recognitiong
• Company wide visibility
• Microsoft Dynamics – practical steps
21/11/2013
12
A new Risk Register is bornA new Risk Register is born
• A video not a snapshot
• More sophisticated impact and likelihood scoring
• Regular review
21/11/2013
13
Pictures as well as wordsPictures as well as words
21/11/2013
14
It will never happen…..will it ?It will never happen…..will it ?
21/11/2013
15
But if it did………..But if it did………..
21/11/2013
16
Management TeamworkManagement Teamwork
• Now getting beyond the basics
• Risk Attitude
Making risk part of management• Making risk part of management
• Decision making framework
21/11/2013
17
Now involve the whole BoardNow involve the whole Board
• To influence strategic decisions
• Board balanceBoard balance
• Difference between Exec an Non ExecNon Exec
21/11/2013
18
I can’t tolerate thatI can t tolerate that
• A new level of sophistication
• Still a work in progressStill a work in progress
21/11/2013
19
Tolerance directly impacts strategyTolerance directly impacts strategy
STRATEGIC THEMES Comments Current performance Target performanceDate
Worst tolerable outcome Best realistic outcome Key Risk Indicators
Engaged staffRetention of skilled and committed staff (through staff survey)
87% Is current performance tolerable for next year? If not, what is the worst tolerable outcome?
How aggressive is your target? Could it realistically be even better?
1st Staff Survey2nd Attrition rates 2nd Productivity rates
Improving the capability of staff (through training / education / etc)
Is current performance tolerable for next year? If not, what is the worst tolerable outcome?
How aggressive is your target? Could it realistically be even better?
1st No. and type of training courses made available
Valued customersImproving the satisfaction of existing customers (through customer survey
53% Is current performance tolerable for next year? If not, what is the worst tolerable outcome?
How aggressive is your target? Could it realistically be even better?
1st Customer survey
Growth and development?% increase in new customers through organic growth (market share)
6% Is current performance tolerable for next year? If not, what is the worst tolerable outcome?
How aggressive is your target? Could it realistically be even better?
1st Demonstrable measure of position in market share2nd No. of complaints / other service quality measures
?% increase in capability and skills through acquisition (moving NCFE into 'premiership)
* Is this to do with new products / to extend out of vocational courses or just to expand what you already do?* Is this also about % increase in new customers through acquisition
Is current performance tolerable for next year? If not, what is the worst tolerable outcome?
How aggressive is your target? Could it realistically be even better?
Maintain profit margin at * Which means growing with no 27% Is current performance tolerable How aggressive is your target? 1st Normal financial tracking / p gapproximately 27%
g gdrop or gain in efficiency* Is this before or after tax?
pfor next year? If not, what is the worst tolerable outcome?
gg y gCould it realistically be even better?
gmanagement measures
RegulatoryMaintain or reduce number no. of Ofqual complaints to keep Ofqual AAA rating
Is current performance tolerable for next year? If not, what is the worst tolerable outcome?
How aggressive is your target? Could it realistically be even better?
* No. of adverse events occurring* Time taken to report to Ofqual (efficiencies)* Media interest
Improve relationship with Ofqual Is current performance tolerable How aggressive is your target? * No of complaints from OfqualImprove relationship with Ofqual Is current performance tolerable for next year? If not, what is the worst tolerable outcome?
How aggressive is your target? Could it realistically be even better?
No. of complaints from Ofqual* No. of compliments from Ofqual
21/11/2013
20
Risk affects key decisionsRisk affects key decisions
• Pension liability
• Investment strategy
• Property acquisition
B dgets• Budgets
• Product development
• ……and……
21/11/2013
21
Current risks – full circleCurrent risks full circle
• IT back on the agendaIT back on the agenda
• Cyber risks
• Physical security
21/11/2013
22
What we’ve learnedWhat we ve learned
• Risk management adds value
• Risk management isRisk management is commercial
• Involve everyone• Involve everyone
• It influences the Board
• Its been a vital part of the development of the company
21/11/2013
23
Comments and questionsComments and questions