Developing a global risk management framework for UNDP

A tender process to build this risk and resilience framework invited bids from suppliers worldwide, and was awarded to 4C Strategies.

How we did it

We carried out a comprehensive desk review of UNDP processes and documents, followed by interviews with key decision makers including senior management at a national and international level. Based on this analysis, we worked with UNDP to develop a fit-for-purpose enterprise risk management model and policy. During the process, we also identified a need for, and developed, a complete resilience framework with elements of risk, business continuity and crisis management.

Leading by example

As the leading agency for supporting and developing nations in need, UNDP must set an example to its peers, i.e., UN funds and programmes, through the use of best-in-class processes and procedures at local and global operations. Although skilled at taking and managing risk on an individual level, as a collective entity, decisions were often fragmented. Without a holistic overview of the processes and structure in place, risk management was not delivering the expected value, and the organisation was not as resilient as it could, or should, be.

An internal audit by the UNDP Office of Audit and Investigation found that the organisation required a new framework, citing; “This is mainly due to inadequate implementation of the ERM cycle at various levels of the organisation and the breadth of improvements in policy, tools and practices that are needed when compared with internationally recognised standards, good practices of other organisations, and benchmarking studies relating to ERM.”

UNDP needed to put this right, so they started a global tender process to find a company that could deliver a world-class enterprise risk management model. 4C Strategies works with many public organisations at the local, national and international level, including the European External Action Service (EEAS)and the Intergovernmental Panel on Climate Change (IPCC), making us the ideal partner for UNDP.

The 4C team, which was made up of resilience experts with international public and private sector experience, identified three key improvement areas:

1. Accountability
2. Integration
3. Simplicity

“This was a high-priority project within UNDP. The Head of Risk and Continuity Management at UNDP took an active role throughout the project as we interviewed senior management at UNDP headquarters and many of the country offices,” continues Jürisoo.

Risk and resilience framework

One of the major challenges facing the team was how to develop a risk and resilience framework that would function across the board, i.e., for projects in developing countries, economies in transition, and developed economies.

“It was essential for us to develop a framework that tied UNDP’s strategic goals to a structured, systematic and integrated risk management process that could be instilled organisation-wide,” explains Jürisoo. “With a common approach for analysing and reducing risk, validating projects and allocating budgets, fact-based decision-making comes much more into play. Essentially, risk management is a key enabler for project results and transparent dialogue with donors.”

Enterprise Risk Management

To meet the requirements of the internal audit, namely implementing a fit-for-purpose ERM model, the 4C team revised the ERM policies and objectives and brought them in line with ISO 31 000 standards. Risks were categorised and aligned with other relevant parts of the UN system, such as the UN Secretariat. New guidelines were also provided on acceptable risk. Finally, roles and responsibilities were clarified for improved accountability.

Implementing ERM in the organisation

“It’s vital that you think beyond the models and guidelines,” continues Jürisoo. “You also have to develop a systematic method for implementing them. Having worked as a Swedish and EU representative at the UN, I understand the culture and ways of working. I wanted to make sure that ERM and resilience became a bigger part of the UNDP culture in order for them to gain the most benefit from it.”

To ensure ERM became a continuous part of the working process and culture at UNDP, 4C developed a list of recommendations that included:

• Lifting ERM onto the agenda of senior management’s decision-making forums
• Creating clear and easy-to-follow ERM manuals that are easily accessible by staff
• Ensuring out of date documentation is removed
• Applying ERM to relevant initiatives
• Developing and conducting ERM training
• Risk at every level of the organisation

With the ERM and framework implemented, UNDP is able to gain an aggregated understanding of the organisational risk landscape at any given level be it a unique project, nation or the enterprise as a whole. With an aggregated view, it’s possible to analyse trends and identify key risks from different perspectives. Additionally, the financial consequences can be used to estimate and track risk reserves.