Risk Management Plan Template CHFACommunity …：风险管理计划模板 CHFA社区… .doc

Housing Association Risk Management Plan (template)Version: 5Date: December 2008.Introduction to the Risk Management TemplateThis template is designed to be a practical resource for community housing providers developing their risk management plans. It provides a series of tools that organisations can follow to assist them to identify, analyse and treat their risks. Used together they form a framework for managing risks.However, the process of risk management is as important as the documentation. A thorough, organisation wide risk consultation means that all the key stakeholders can assist in identifying risks. This leads to a more rigorous risk management plan. It also begins the process of embedding risk management by introducing an element of ownership of the plan at all levels of the organisation.The template draws on good practice from a number of sources including:· Australian Institute of Company Directors· Cumberland Housing Co-op Ltd.,· Sapphire Coast Tenancy Scheme · Department of Community Services· Housing Corporation, UK· Standards Australia· Tasmanian GovernmentThe template was developed by Sheryl de Vries and Adam West.The template is available on a CD so that providers can enter their own data in the relevant sections of the document.Table of ContentsVersion Control1. INTRODUCTION41.1 Purpose of the Risk Management Plan61.2 Embedding the risk management Plan61.3 Audience61.4 Who was involved?61.5 Acronyms62. ORGANISATIONAL CONTEXT63. RISK STRATEGY74. RISK DIAGRAM85. IDENTIFY THE RISKS86. ANALYSE THE RISKS117. RISK MANAGEMENT REGISTER (EXAMPLE)138. EVALUATE THE RISKS159. TREAT THE RISKS15APPENDIX A - INTERVIEWS21APPENDIX B - ACRONYMS21APPENDIX C USEFUL LINKS AND RESOURCES21Version control and ApprovalProviders need to have a process for regular board and senior management review and approval of the risk management plan. Tables such as the two below could be attached to the plan to ensure that changes are tracked effectively and that amendments are signed off by the appropriate board or staff members. Document ApprovalThe original of this Risk Management Plan has been endorsed and approved by the Board of Directors at the Board meeting held on:_Signed _Name_Position _Document InformationThis document is stored in a hard copy in the following location:_And electronically in the following location:_Document Changes and reviewsThe author should be advised of any errors, omissions, ambiguities, and requests for change or suggestions for improvementChanges will need to be approved by the officer with delegated authority for endorsing risk management plans in the document approval section, prior to being incorporated into the next version of this document.Table 1VersionAuthorDateDescriptionDocument update, review and distribution listTable 2Document statusDraft RMPDateAuthorJohn Lennon01/06/07Delegated responsibility to endorse / endorsement dateTreasurer endorsed01/07/07Full Board approvalBoard approves RMP 01/08/07UserAll staffCirculated to Internal -All directors, staff, External PMRU/OCH01/03/08Current as at 01/09/04Annual Review date John Lennon01/06/081. Introduction1.1 Purpose of the Risk Management PlanThe purpose of the risk management plan is to allow a housing association to identify and record potential risks.The plan also allows mitigation strategies to be developed and tracked.The document should be updated weekly / fortnightly/ monthly/ quarterly / annually / whenever is necessary, e.g. following an incident of significant impact on the organisations day to day operation.1.2 Embedding the risk management planThe risks identified are risks that the organisations objectives will not be met. Therefore the risk management plan will refer to, and be reviewed against, the organisations strategic, operational and business plans. enter details about how and when these documents will be reviewed1.3 AudienceThis risk management plan is aimed towards the following groups:GroupReasonDirectorsGovernance responsibilityStaffOperational responsibilityOCHRegulatory and funding bodyenter details of other relevant partiese.g. private sector partners to fulfil due diligence requirementstenants to ensure a consistent high quality service1.4 Who was involved?A list of people involved in the initial development of this plan can be found at Appendix A.1.5 AcronymsA list of acronyms used can be found at Appendix B.2. Organisational context It is not possible to avoid risk entirely. To attempt to do so would mean that the organisation would effectively be unable to function. It would also not be able to take advantage of opportunities as they arise. The board should use this heading to describe what their willingness to accept risks is. This should be described in the context of the type of organisation it is. For example:“As a not for profit community housing organisation we have limited financial resources. Our primary responsibility is to our tenants. As recipients of government funding we also have a responsibility to use our resources wisely. These factors mean that the boards attitude to risk is generally cautious.“Alternatively providers may have a more robust approach to risk. For example the board may decide that growth is a key priority and that additional risks may be acceptable to achieve this end. In either case, stating the organisational context and the boards appetite for risk sets the tone for the whole organisation and for the risk management plan in particular.A further statement about the circumstances under which the board would consider taking risks and how they would be evaluated should also be included here.3. Risk strategyThis heading allows providers to outline their risk management strategy. For example:In order to ensure that risks are identified in a consistent manner across the organisation a "Risk Assessment Model" will be applied. This will rank the risks in priority order and those risks considered important to track will be recorded on the "Summary of Risks". Mitigation strategies will be developed, recorded and monitored on a weekly/fortnightly/monthly/quarterly basis by the project manager/ chairperson/ Board / Treasurer of Board. If new major risks are identified these shall be recorded. The "Summary of Risks" will be reported to the project steering committee/ board on a weekly / fortnightly /monthly/quarterly basis. At appropriate times during the course of the project, it may be appropriate to re-assess the risks by applying the "Risk Assessment Model". For example, it would be appropriate to reassess the risks for a large project when it moves from a requirements/evaluation stage into an implementation stage. The following diagram represents the process to be followed:enter a summary of your organisations risk strategy, including information on how risks will be reported to the board4. Risk diagramRISK MANAGEMENT PROCESS AS/NZS 4360 : 2004IDENTIFY THE RISKS What can happen? How can it happen?TREAT THE RISKS Identify options Select the best response Develop risk treatment plan ImplementESTABLISH THE CONTEXT ObjectivesEVALUATE THE RISKS Evaluate risks and opportunities Screen out minor issuesANALYSE THE RISKS Likelihood Consequences Level of risk / significanceMONITORANDREVIEWCOMMUNICATEAND CONSULT5. Identify the risksUse this space to list the main risks you have identified. This work should be carried out in consultation with key stakeholders including staff at all levels of the organisation. In order to help group related risks you may wish to use headings such as the ones in the table below. Please note this is not intended to be a comprehensive list of all the risks a community housing organisations is likely to encounter. It is essential that each provider undertakes the risk identification process for itself.The Office of Community Housing will provide community housing organisations with a preliminary risk assessment and a registration report through the Performance Based Registration system. This should be used as a source of identified risks and priorities. enter summary information on the main risks you have identified for your organisation. Change the risks headings if necessaryInternalExternalFinancial management, for example:· Viability / liquidity· Fraud control· Reducing / insufficient income streams· Income loss· Poor cost control· Insurances not kept up to dateFunding, for example:· Changes in funding agreement· Shortfalls in funding programsHuman Resources, for example:· Succession planning· Poor staff supervision and performance appraisal· Staff turnover/ headhunted by competitor · Excessive work load and poor staff morale / staff burn-out · Difficulties in recruiting suitable staffRegulatory environment, for example:· Changes in regulatory framework· Negative registration reports· No internal systems to proactively manage all the factors that drive the performance of the organisationProperty management, for example:· Inappropriate stock· Contractors fail to perform maintenance contract / Poor response time by contractors · Stock transfer liabilities · Asbestos· Aging / poor quality stockReputation, for example:· Public and community perception of the Association· Negative comments from press or politiciansLegislation compliance, for example:· Privacy Act- · Corporations Act / relevant Incorporation legislation· Anti-discrimination / Disability Services Act· OHS· Meeting tax requirementsCompetition, for example:· Losing opportunities to grow· Other providers· Unexpected rapid growthCorporate governance, for example:· Lack of appropriately skilled board members· Volunteer / board member burn out · Board turnover· Board fails to appraise CEO performance· Conflict on the board· Conflicts of interest not managed effectively· Difficulty recruiting to the board· Directors insurance not kept up to date· Policies and procedures not reviewed· Board lacks a value based framework Partnerships, for example:· Risks from failed partnership arrangements· Risk of conflict with partnersHousing management, for example:· Poor arrears control· Increasing proportion of tenants with complex needs· Duty of care to tenants is not met· Tenants / Applicants grievances and appeals· Tenants mix unbalancedNatural disasters, for example:· Flood, hail storms etc· Lacks a business continuity plan Information technology, for example:· IT not sufficient for expanded organisation· IT not able to produce registration monitoring data· IT performance date disaster recovery plan 6. Analyse the risksHow to complete the table:Header: The plan should be reviewed and updated regularly. The register can either be overwritten or the amended page can be added to the existing plan thus showing the changes made over time.Reference:Each entry should be given a reference so that it can be linked to a more detailed report or risk treatment plan (if any)Risk: Brainstorm the possible risks. These could be split into internal and external risks. Once the list has been developed it is suggested that it is reduced to a manageable number no more than 20 risks.Risk likelihood:Decide the range of risk. In this case 1 = lowest probability, 5 = highest probabilityRisk consequences:Decide the range. In this case 1 = lowest risk, 5 = highest riskLevel of risk:Level of risk could be an addition or a multiplier. In this case it is a multiplier of risk likelihood times risk consequence. However anything with a 5 on risk consequence will be monitored.Control adequacy: The current controls used: OK satisfactory, MON monitor, some concerns or! Unsatisfactory action needed Risk status: Is the risk # increasing rapidly, # hh increasing, $ h decreasing rapidly, $ ii decreasing i or - staying the same?HA priorityA priority ranking should be given to the key risks. This should take into account all other factors, including the likelihood and impact of the risk, whether the risk is increasing or decreasing and how effective the current controls are. This information should be used to compile a list of principal risks.Enter your data on the risk register spreadsheet on the CD. Refer to risk register instruction sheet on CD for further guidance7. Risk management register (example)Function/activityGENERALCompiled by:M. BIGGS (EO)Date:1ST FEB 2007Reviewed by:BOARDDate Reviewed 23 FEB 2007Date of next review:23 MARCH 2007Refer-enceThe risk what can happen and how.Risk likeli-hoodRisk conce-quencesRisk scoreControl ade-quacyRisk statusHA Priority(rank 1 20)StrategiesResponsi-bilityFinancial management06/01Cash flow / liquidity difficulties2510OK -181. Review planned maintenance timetable to ensure that work is spread evenly throughout year2. EO to report on liquidity ratios to board quarterly.1. EO2. EO06/02Rent arrears blow out 3412MONh161. EO to review arrears with housing workers weekly2. Report to board monthly3. Additional training for staff on arrears control4. Review arrears policy to ensure earlier action1. EO2. EO3. EO4. EO06/03Stock transfer properties hard to let leading to low rental income and high vandalism4416!h61. Analyse existing waiting list and transfer lists2. Re negotiate capital contribution3. Review allocations policy for these properties4. Conduct detailed risk assessment on whether to accept future stock transfers1. Senior housing manager2. EO3. Senior housing manager4. EOProperty management06/11Properties discovered to be in very poor condition after handover3412!hh141.scope prior to handover and get necessary work done2. get agreement from OCH / Housing NSW to do additional works if discov