Management challenges in Modernisation Processes (Bucharest, 17 March 2016)

Transcription

1 ESS Modernisation Workshop Management challenges in Modernisation Processes (Bucharest, 17 March 2016)

2 Agenda Change Management: From the Approach to the Process Risk Management Framework and Process Focus on Integration with Quality in Statistics Risk Management in action: Institutional Practices and on-going Projects Page 2

3 Reactions to Change People going through change experience a variety of emotional and cognitive states that take up some time. Transitions typically progress through a cycle of reasonably predictable phases within the Self-efficacy process that is a key cognitive process identified by the psychological social theory for the analysis of human behavior, aiming at efficiently guiding the individual cognitive, social, emotional and behavioral sub-abilities to fulfill specific purposes. Self-efficacy INTERNALIZATION, AND LEARNING DENIAL CONSOLIDATION SHOCK! DEPRESSION TESTING LETTING GO Time Page 3

4 STATE POTENTIAL CHANGE DERAILERS CRITICAL SUCCESS FACTOR SHOCK DENIAL DEPRESSION POOR FOLLOW TROUGH TESTING CONSOLIDATION INTERNALIZATION AND LEARNING Poor Vision of the Future. Cultural Resistance to Change. Lack of a sponsor/commitment Lack of recognition for the need to continuously change. Excessive Bureaucracy. Lack of Competencies. Poor follow through. Lack of access to technology. Lack of time. Lack of performance metrics. Lack of Synergy. Lack of commitment to funding and/or resources. Lack of knowledge/learning in a change process. Lack of training. Managers must follow a specific behavior to make change successful and overcome barriers: Identifying the opportunities and threats that require attention (Sense making); Identifying what needs to be done to move towards a better future (Visioning); Communicating the vision (Sense giving); Promoting shared sense of direction (Aligning); Removing obstacles and creating the conditions to empower people to change (Enabling); Recognizing the concerns of those affected by the change (Supporting); Demonstrating that they are prepared to change their behavior (Sustaining the change). Stakeholder Collaboration, Empowerment, and Engagement Addressing stakeholders systematically and iteratively, planning and monitoring and correcting for changes. Performing change with rather than to people, ensuring those impacted by the change see the need for change. Formalize Philosophy and Policy of Change Management Providing strong sponsorship for leadership, resources, and support of the change initiative. Establishing a culture for change management by writing policies or incorporating change statements into the vision and mission. Building a common change vocabulary. Time for Acceptance into the Change Life Cycle Framework Building in flexibility. Allocating time into the project/program to ensure that the foreseen or emergent resistance will not impact the project schedule. System Alignment with the Change Initiative Creating a clear description and measures for a successful future state. Ensuring all supporting systems work effectively and efficiently together. Scaling change management activities to the extent, complexity, and speed of the change. Identifying, Selecting, and Developing Change Management Competencies Changing management competency program. Developing employees. Focus for the Change Initiative Building communication assets: models, methods, and requirements methods. Clearly communicating the change vision early outlining the benefits and impacts of the change. Ensuring that the organization s leaders actively communicate throughout the change process. Providing opportunities for dialogue and true representation to promote a sense of ownership. Monitoring and measuring the effectiveness of the communications. Develop and Deploy Change Management Measurement Processes and Tools Measuring the success of change and determining what existing organizational indicators are in place for measuring change. Capturing and sharing lessons learned retaining them in a knowledge management repository. Page 4

5 Change is GOOD (!?!) Before embarking on organizational change, it is important to assess: What do we want to achieve with this change? How will we know that the change has been achieved? Who is affected by this change? How will they react to it? How much of this change can we achieve ourselves? What parts of the change do we need help with? Page 5

6 Organizational Change Change must be realistic, achievable and measurable and change efforts should be geared and managed to improve performances and align people, processes and culture with changes due to different culture, risktaking, risk-aversion, openness to change, innovation, etc.. Managing changes not only helps organization ensure that the transition being implemented is successful, it also helps managers diagnose risks with the transition, before they become unbearable. Change management : is a comprehensive, cyclic and structured approach to transitioning individuals and organizations from a current to a desired future state; helps organizations drive their strategy through portfolio, program, and project management; offers a standardized method that efficiently evaluates the potential positive and negative impact of change; aims at applying a systematic approach that helps "the change" be successful supporting the individuals involved, addressing resistance and developing knowledges. Page 6

7 Change Process Theories Among the others, some theories embrace the holistic approach to change: 1. Teleological: organizations are purposeful and adaptive, and change is an unfolding cycle of goal formulation, implementation, evaluation and learning. 2. Dialectical, focusing on conflicting goals between different interest groups and explaining stability and change in terms of comparison between the opposing entities. 3. Life cycle, change is a process that progresses through a necessary sequence of cumulative stages, each of them contributes to the final outcome. 4. Evolutionary: change proceeds through a continuous cycle of variation, selection and retention. All those theories view change as a series of interconnected events, decisions and actions, but the sequence of stages whose direction is constructed is considered in a different way: Teleological and Dialectical theories: change trajectories is predetermined, but goals and steps taken to achieve goals can be changed at the will of those involved in the change process. The McKinsey 7S model belongs to this kind of theories. Life cycle and Evolutionary theories: change is a predetermined process that unfolds over time in a specified direction. These theories include the Kotter's integrative model. Page 7

8 Change and Risk Management Standards ITIL V.2 & V.3 (Information Technology Infrastructure Library) and COBIT V. 4.1 & 5.0 (Control OBjectives for Information and related Technology) aren t formal standards but frameworks for good practice in IT Service Management. These describes processes, procedures, tasks not organization-specific but applicable for an integrated strategy to maintain a suitable level of quality and competency in the Service support processes optimizing risk levels and resource use. ISO/IEC 20000:2011 (ITSM IT Service Management) & ISO/IEC 27001:2013 define a set of requirements against which an organization can be independently audited and, if they satisfy those requirements, focusing on goals rather than outputs, can be certificated. They establish high-level objectives for change management to ensure the implementation of strategies through actions for mitigating risks associated with ineffective controls. The PMI s standard illustrates how portfolio, program, and project management help organizations develop the effective practice of change management so that strategy can be executed reliably and effectively, and: sets the practices, processes and disciplines to guide executives in managing change providing practitioners from different fields such as organizational development or human resource management; describes the change life cycle framework that reflects the portfolio, program and project management process and its purposes and demonstrates resilience resulting from unforeseen changes. Page 8

9 Change Life Cycle Framework Process model of change are based on teleological and dialectical theories. The model conceptualizes the change management as a purposeful, structured but often discussed process that comprises 7 core activities: 1. Formulating the change consists of: Identifying/clarifying need for change; Assessing readiness for change; Delineating scope of change 2. Planning the change by defining the change approach and planning stakeholder engagement as well as transition and integrating people, processes, technologies, structures, and cultural issues into the overall portfolio, program, or project plan. 3. Implementing the change by preparing the organization for change, mobilizing the stakeholders, and delivering project outputs. Planning, implementation, and transition processes are overlapping due to change implementation is an iterative process. 4. Managing the change transition by transitioning the outputs into business operations, measuring the adoption rate and the outcomes and benefits, and adjusting the plan to address discrepancies. 5. Sustaining the change on an ongoing basis through: Ongoing communication, consultation, and representation of stakeholders; Conducting sense-making activities; Measuring benefits realization. 6. Communicating the change. Managers should give sufficient attention to communication and other issues, such as: establishing different goals and priorities; trust; motivation and commitment; support for those who will be affected by the change. 7. Learning from the experience helps people s modify their behavior in order to improve performances. Page 9

10 Change, Risk and Project Management Change management is interconnected with Risk management: Innovation requires risks so every change strategy comes with its own levels of risk; changes can be made less risky if they are adequately reviewed, assessed, and coordinated adopting a proper risk management process. The relationship between Risk and Change management is characterized as having circular nature: RM is a part of the wider cycle of CM as well as CM is a component of the RM s cycle. Risk Management identifies criticalities in changing processes and plans fitting response activities to minimize risk of failure both during and post implementation phases. Starting point Risk Management Process risk/criticality detection Response action planning = CHANGE PLANNING Change Management acts as a subsystem of Risk Management; the actions aiming at reducing the likelihood of incoming risky events are themselves changes. Change Management Change impact assessment Change risk reduction («understanding and controlling the exposure to hazards») Criticality reduction/ elimination Organization improvement (next point) Project management aligns the organization s components through the implementation of: Portfolio management that optimizes, oversees and selects concurrent organizational initiatives and Program management that defines a set of expected benefits and their transition into the business. Page 10

11 Risk Definitions and Standards Risk is the effect of uncertainty on objectives, where an effect is a deviation from what is expected (positive and/or negative), often expressed in terms of a combination of the consequences of an event (including changes in circumstances) and the associated likelihood of occurrence. [AS/NZS 4360:1999, ISO 31000:2009, ISO Guide 73:2009, definition 1.1, COSO ERM IF/IC 2004]. Among the others (more than 60!), main used standards are: COSO Model 2004/2013 that defines Enterprise Risk Management... a process effected by an entity s board of directors and management, applied in strategy setting and across the enterprise, designed to identify potential events that may affect the entity, and manage risk to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives. The Co.SO. Model is a multidimensional standard upon which a Risk Management system stands. It develops along three sides of the cube: 1) Objectives; 2) Organization; 3) Process ISO 31000:2009: Risk Management Principles and Guidelines ISO/IEC 31010:2009: Risk assessment techniques ISO TR 31004:2013: Guidance for the implementation of ISO 31000:2009 AS/NZS4360:2004: Australia/New Zealand Risk Management Standard Page 11

12 Risk Complexity Risk Profile is the set of risks that could affect all or part of an organization. It results from a comprehensive process that: concerns risk information from several sources; reflects recommendations from managers; envisages a risk questionnaire, revised guidelines, clearer definitions of risk sources and communication strategy. Risk Profile takes into account: Risk Appetite, which could be expressed either qualitatively or quantitatively, maybe in terms of ranges, and explored going through the impacts of past events and the reactions of key stakeholders (customers, employees, regulators,..). Risk Attitude. (Existing Risk Profile). If an organization is particularly effective in managing certain types of risks, it may be willing to take on more risk in that category, conversely, it may not have any appetite in that area. Risk Acceptance, which refers to the maximum potential impact of a risk event that an organization could withstand. Often, appetite will be well below acceptance. Risk Perception, which describes how people perceive risks according to their values and interests Risk Tolerance, which is the level of variation that the entity is willing to accept around specific objectives. Risk Retention considers stakeholders conservative return expectations and a very low appetite for risk-taking. Page 12

13 Risk perception analysis in ISTAT ISTAT launched a survey on risk perception involving Top and Executive Managers, carried out trough a questionnaire: composed of about 70 questions and divided into four sections: 1. Internal control environment and organizational culture; 2. Objectives of the organization and Risk Management; 3. Identification and classification of risk factors; 4. "Cataloging" risks investigating four dimensions: I. the risk perception compared to the activities of each manager; II. the risk perception in the Institute as a whole; III. the maturity of the control environment in the structure leaded by each manager; IV. the maturity of the control environment in the Institute as a whole Page 13

14 The Risk Management System ISO 31000:2009 According to the ISO 31000:2009, Risk Management refers to the architecture used to manage risks. This architecture includes Principles, Framework, and Process. Page 14

15 Top-down and Bottom-up approaches Three different approaches can be followed in managing risks: A. Top-Down-approach: the decision making process is centralized at a government body-level. This approach can put in place in 2 ways: a) Full top-down: the business units risks are listed at department level so heads of units cannot add risks themselves; b) Prevailing top-down: the corporate risk register comes from a detailed operational risk register. B. Bottom-Up approach: the decision making process is located at management level. Operational risks are identified by any staff member while performing his/her daily work, in order to encourage the staff to be more active in defining non-conformities. C. Mixed approach: the board entity states the criteria (top-down) by which the heads of unit identify and manage risks (bottom-up). Risks may be viewed and assessed at any level of the organization. The selected RM approach impacts on the Hierarchy of Risks. Page 15

16 Risk Hierarchy The hierarchy of risks is related to the different levels of risks: 1. Enterprise Risks, strategic and significantly impacting on the organization. Management them is crucial for the long term viability. They are assessed and treated by the Executive Managers, responsible for monitoring their implementation. Examples are: Regulatory and compliance risks, global financial shocks, aging consumers and workforce, emerging markets. 2. Operational Risks, impacting on a program's objectives and/or outcomes; they are assessed and managed by the line managers. In considering them, they should take into account the enterprise ones. Examples are: Inappropriate skills mix; resources reduced due to budget cuts; outputs not delivered on time; poor quality outputs. 3. Project Risks, impacting on the project objectives and outcomes. They are managed by the project risk manager and where appropriate will be addressed as part of the Project Management Framework. Examples are: Project scope poorly defined; Resources not available when required; Quality requirements not clearly specified. Page 16

17 Roles and Accountabilities 1) All staff are responsible for an effective management of risks including identification of any potential risks; 2) Risk management is driven by the organizational units; 3) An Office is dedicated to the coordination of the management process and risk analysis, "impartial" with respect to other structures, supporting the highest level of decision making; 4) The Risk Manager is responsible for: collaborating with Top Management both in identifying high risk areas related to strategic and business processes and in planning treatments to mitigate corporate risks; 5) The Risk Committee defines the Risk Management policy; it is coordinated by the Risk Manager and composed by the top managers operating in the most risky areas; 6) Chief Statisticians and Governing body define the strategies based on the information coming from the RM System; 7) The Internal Auditing is responsible for reporting to the Governance on the adequacy of the RM process and the compliance of the mitigating actions. Page 17

18 Risk Management Framework Integrated with Quality of Statistics Statistical risks are events that potentially could impact on production processes and/or integrity and quality of statistical data. Ex. statistics that are not considered by users as fit for purpose which includes, but is not limited to, time series that are not coherent (Planned changes to systems, processes, methods, data & resources availability or quality). At operational level, statistical risks can be identified separately by Risk Management and then integrated into the Quality management framework because of their close connection: a) Quality management assesses if the original requirements (ISO 9001:2015) are met or corrective actions need to be implemented; b) Risk management identifies threats that can effect Quality objectives. The Australian Bureau of Statistics (ABS) has instigated better quality management practices by the risk management strategy to mitigate the Statistical Risk that one or more of the statistical process components fail to meet the quality standard expected or the data integrity requirement. This strategy is based on the risk assessment through the quality gates composed of: Placement, Roles, Actions, Evaluation, Tolerance, Quality Measures (ex. frame size, n. units, units rotated in/out of a sample). The RM integrated approach has been developed as a part of the Internal Control Framework which comprises different kind of risks (Strategic, Statistical, Change, Operational & Compliance, Financial, Work Health & Safety) associated with Statistical Risk Appetite. Page 18

19 ISTAT s Risk Management System: From the project to the process Project launched Analysis and comparison of practices and models Identification of appropriate approach Establishing ISTAT s RM model Approach trial Pilot and rollout of risk management approach RM training and dissemination Experimental phase Creation of a risk registers Risk assessment RM training and dissemination Experimental phase Revision of a risk registers Identification of risk treatments RM training and dissemination Full implementation Integration w/ operational planning Risk treatments monitoring Information System start up The project developed following some parallel but related paths: Developments From the bottom-up to the top-down vision Adapting model to Risk of Corruption Cooperation in International projects Dissemination 1. Organization: Both the President and the Directorate general endorsed and sponsored the project. A business unit was involved in implementing and coordinating risk management system 2. Training and dissemination program in order to improve management culture and promote a common language and understanding throughout the organization 3. All Risk Management process has been implemented 4. Information System has been developed to support the process 5. Change of perspective: Bottom-up/Top-down mixed approach Page 19

20 ISTAT s Risk Management - Bottom-up & Top-Down approaches From 2015 on, the previous bottom-up approach is being integrated with a top-down one in order to enhance quality and significance of the information contained in the registers. Organizational risks are identified by accountable managers and then gathered in strategic categories (corporate risks), in order to be assessed, treated and monitored. Corporate risk selection considers: Ability to monitor a risk treatments through specific indicators; Organizational sustainability; Quality of the Cross-cutting risk treatments; Belonging to priority intervention areas. The risks were assessed by the same personnel who identified them with the C&RSA method to measure likelihood (occurrences in the last 12 months) and impact a) Organization (delay, extra workload); b) Reputation, c) Higher costs. According with the Top-Down perspective, risks have been dramatically decreased from 359 events of the experimental phase, to 111 in 2015; about 18% are "Corporate". Also the Risk treatments have been reduced, from 450 (2013) to 128 measures (2015); about 19% are associated with Corporate risks, monitored by proper output and performance indicators. Page 20

21 Risk Management Institutional Activities: ESS 2020 Vision In 2015, the Committee for the European Statistical System implemented the strategic directions ESS Vision 2020 to redesign by 2020 the statistical production methods through a system based on the use of new data sources, standardized methods for the statistical production process, interoperability and reuse of data and tools. According to this Vision: Risk identification, analysis and management help NSIs anticipate and remove the obstacles that may prevent the achievement of the strategic objectives. Three levels of risks associated with the ESS Vision 2020 have been identified: 1. Risks associated with implementation of the ESS Vision 2020 whose common strategic undertaking requires: capability; financial information; ownership and commitment; communication within the system and with the stakeholders. 2. Portfolio management risks, associated with the projects portfolio as a whole. 3. Project related risks identified in implementing the ESS projects portfolio. These refer to the specific "business" or "infrastructural" categories of the ESS Vision. 1. Lack of common understanding on the strategic aims 4. Lack of coherence among national and ESS modernization programmes 5. Different maturity of national statistical systems regarding the ESS aims 6. Underestimation of the role of communication in implementing ESS Wrong identification of dependencies among projects in the portfolio 15. Affordability of the portfolio 16. Lack of timely availability of skills and human resources 19. Different legislative systems/lack of common EU legislation 20. Lack of a precise cost-benefit assessment 21. Improper project management Page 21

22 UNECE s project for developing Risk Management practices among NSOs Template Dec 14 Benchmark analysis May 15 Tuning practices Nov 15 Guidelines Apr 16

23 From the Surveys towards the Guidelines In 2015 survey has been carried out to analyze to what extent Risk management systems are adopted among NSOs and international organizations members of UNECE in order to define criteria for identifying best practices. The main points highlighted by the data analysis were: - corporate risks lower than operational ones; - the occorrrunces of corporate risks varies depending on the risk policy (top-down vs bottom-up approach) - statistical risks are the majority, followed by organizational risks - other risks related to: financial, ITC, reputational, security 13 countries were selected as the most interesting practices for an in-depth analysis according to some Items representing consistent sets of significant features for analysis and Parameters to allocate the countries among the Low-Medium-High levels. The analysis has allowed the identification of the Risk Management practice most suitable to the NSOs that is described in the Guidelines. Page 23

24 Thank you for your attention!!! Fabrizio ROTUNDI Page 24