The model of risk-based management in public authorities is presented in the paper. The essence of process approach is defined and implemented in modeling in order to reflect modern requirements of quality management in the organizations. The principles of risk-oriented management are formulated in the paper to identify the strategy of process approach to the management in the public authority institutions. Finally, the detailed model of risk-oriented management of governmental bodies is described in the present paper.
The activity of any organization is exposed to multiple risk factors due to the high level of uncertainty of the external environment. Some risk factors or conditions can trigger the implementation of specific risk on their own, others – only in combination with other risk factors.
The concept of Risk Management (RM) is not new. On the one hand, RM is well known approach to improve effectiveness of enterprise – Enterprise Risk Management (ERM). On the other hand, it mainly used in financial sector of economy in the form of restrictions or on the dangerous production in the form of technology of production.
At the same time all potential of the risk management is not fully demanded yet. For example, in public sector there are lots of opportunities to apply RM for. Taking into account the specific features of this area we would like to propose its adjusted shape – risk-oriented management. In this case risk management is implemented in the standard organizational form of management where typical procedures are added with risk-based approach. goal of any organization, in the case of public authorities the goal is to satisfy particular public demand and to provide public service.
It is possible to identify the main processes of public administration in the modeling of which it is advisable to apply business engineering: – public policy; – adopting regulatory legal acts; – development of target-oriented program; – implementation of the control and supervision over the implementation of the established normative legal acts of the mandatory rules of conduct; – purchases for state needs; – issuing of permits (licenses) for carrying out certain activities to legal entities and individuals; – permitting registration of acts, documents, rights, objects; – price and tariff setting; – granting documents for citizens and legal entities; – granting of rights of use of natural resources and so on.
The technology of business engineering is integrated environment for all
subsystems of management not only in business but also in public administration.
The task for Russian managers here is not only reproduce old European and
American technologies of management but implement technologies of the future
in their practice. First of all we are talking about management of electronic
restricting of processes which taking place in the organizations [
The models of government agencies in the form of companies, which provide public services supported by appropriate tools should become a part of information system of “electronic government”. This model then provides the opportunity to observe accurate and complete picture of organization of any activity for its managers and citizens-clients. The opportunity to have integrated knowledge about all system of processes and its goals and strategies is reaching by special ways of information organization and special software. 3
Despite the variety of approaches and tools the concept of process approach is vague currently in Russia. This is due to several reasons. The first reason is the fact that present culture of quality management, which is based on process approach, is only beginning to develop in our country.
The second one – the activity of consulting companies, which promote the process approach, interpret it in their own way and confuses the understanding of this approach for managers. The main goal for these companies is subsequent sale of expensive software of business processes modeling and automatization (for example, BPMS, ERP).
The third reason is lack of training for top-level managers in the field of
quality management systems and process management [
Analyzing the risk factors in relation to the processes, in which they originate, and/or that they might affect, risk manager may develop the system of risk management and thus reduce the probability of the risk and reduce the damage caused by the residual risk. The essence of risk-oriented approach to management in public authority institutions is to understand what in the first place prevents the organization to achieve strategic goals, and to find the best way to mitigate negative effects.
In order to effective risk management the organization at all levels must
satisfy the following principles, according to Standard GOST R ISO 31000-2010 [
The risk management recognizes the capabilities, perceptions and intentions of people outside and within the organization that may contribute to or impede the achievement of the organization’s objectives; 9. The risk management is transparent and takes into account the interests of stakeholders. Appropriate and timely involvement of stakeholders and, in particular, decision-makers at all levels of the organization ensure that risk management is at the appropriate level and meet modern requirements. This allows interested parties to be properly represented and to be sure that their opinions are taken into account in the process of establishing risk criteria; 10. The risk management is dynamic, iterative and responsive to changes. The risk management is continuously detects changes and react to them. As soon as the external or internal event is taking place, context or knowledge are changing, the monitoring and reviewing of risks are held, new risks are emerging, some risks are changing, other ones are disappearing; 11. The risk management facilitates continual improvement of the organization.
The organization should develop and implement strategies for improving the perfection of risk management in conjunction with its other aspects. The risk-oriented approach is based on the system of risk management, which consists of five steps:
2. Analysis and evaluation of risks; 3. Management of risks; 4. Monitoring of risks; 5. Culture of risk management in the organization.
Taking into account the main steps of the system of risk management the basic parts of risk-oriented management can be formulated as: 1. Identification and approval of the key risks list of the public authorities and their owners; 2. Development of measures for management of key risks of the public authorities together with the risk owners and their inclusion in the plan and budget of the organization; 3. Actualization of the identified risks and the risk management activities of the governmental institution on an annual basis; 4. Appointment of coordinators of risk management system; 5. Organization of training of risk management for stuff; 6. Approval of the Risk Management Policy.
According to the Eduard Pfister the evaluation of risks on the basis of the
probability of their occurrence and the extent of any resulting damage together with
the subsequent derivation of suitable measures forms is the starting point for
operative risk and opportunity management [
Compliance with the rules described above will create the risk-based management model, which bears the preventive character and which uses proactive monitoring tools and risk assessment, in the public authority institutions.
In order to be effective a risk-oriented thinking is implemented in this model
throughout the organization that is the identification of possible risks and
minimization their negative impact [
The concept of risk-based thinking previously expressed through
requirements for planning, analysis and improvement. The understanding of its
environment and identification of risks as the basis of the planning are required from
the organization nowadays. This reflects the application of risk-based thinking
in planning and implementation of the quality management system processes
and will assist in determining the scope of documented information [
One of the key objectives of the quality management system is that it acts as a prevention tool. The concept of preventive action is expressed through the use of risk-based thinking.
Not all of the quality management system processes have the same level of
risk in relation to the organization’s ability to achieve its objectives, and the
impact of uncertainty is not the same for organizations. In accordance with the
requirements of ISO 9001 the organization is responsible for the use of risk-based
thinking and the action in relation to risk, including the feasibility of registering
and maintaining a documented information as evidence of the identification of
organization’s risks [
In order to formalize and control the effectiveness of risk management system the following forms of documentation of processes and results of risk management might be used:
The following principles should be taken into account when implementing a riskbased approach in the public authorities: – setting strategic objectives for the risk management (instead of simple process management); – reliance on sufficient data for management decision-making and better risk management. This involves the use of not only its own resources, which certainly are basic, but significant amount of external sources; – centralization of data as part of the centralized risk management – a compulsory condition for achieving results; – integrated use of various control tools for assessing progress in reaching the goals of organization: starting from the mechanisms of self-assessment of their risks and the results to external audit by the stakeholders; – “mirror” system of evaluation of the goal fulfillment, which involves the availability of the results for both the public and the departments of the executive bodies; – relevance of performance indicators of the goal fulfillment, which is achieved through a balance of quantitative and qualitative indicators.
The activity of the public authority requires operational control and
comparison of plans with actual results [
Finalizing process approach to the risk-oriented management in the public authorities the following graphic model is presented in Figure 1.
As can be seen the input ‘Public Demand’ is transforming to output ‘Satisfied Public Demand’ by operational interaction between Key, Managing and Supporting processes. At the same time the risk-based management is implemented in the model by three components: Risk Management Infrastructure, Risk Management Process and Risk Management Culture. Risk Management Process itself is the risk management system with four first steps. The fifth step is separate and presented in more details as isolated component. As reflected in Figure 2 all three parts of risk-oriented management approach are influencing Key processes of public authority institution, which has main goal to provide public service by several functions. This graphic version of present model is one of possible representations of becoming more and more popular nowadays risk-oriented approach to management in the organizations. The new detailed models are coming in the future. The more uncertain future becomes the more risk-based approach in business and public authorities is demanded.
The paper [
The effort to integrate risk management throughout the organization and tying risk processes together through RM will separate adaptable and responsive organizations from stagnate ones. Many agencies have succeeded in meeting compliance requirements through the completion of risk assessments within individual silos, or at assessing a specific risk area that crosses multiple functions (i. e. IT across an agency), but few have accomplished the integration of a risk management system throughout the organization and its management. Nevertheless, as risk-oriented approach in management continues to evolve in the federal sector, agencies and their various stakeholders will benefit as a whole over time.