Why a Good Portfolio Risk Assessment Matters
Understanding the essentials of a good Portfolio Risk Assessment is critical for any organization. These assessments are vital in navigating the complex landscape of risks and opportunities that organizations face. No organization functions in a vacuum. All agencies operate in a context, have to make assumptions about the current and future events, and develop actions to address them in and through their portfolio. The primary purpose of those actions is twofold. First, take advantage of the opportunities. Second, minimize or mitigate the impact of harmful impacts.
To do this effectively, organizations carry out portfolio risk assessments. These are enterprise-level exercises that take a systems approach to developing analytical frameworks that identify both exogenous and endogenous risks in a systemic and systematic manner.
When done properly, portfolio risk assessments help increase the likelihood of positive effects and decrease the likelihood of negative effects on the project portfolio.
There are many different ways of designing and implementing portfolio risk assessments. Different agencies tailor them to their needs, legal requirements, and organizational culture. In addition, consultants conducting risk assessments draw on a broad range of tools, methodologies, and resources. Hence, my goal is not to compare and contrast these differences. Rather, I seek to identify those essential elements that should be integrated into all portfolio risk assessments to make them effective and useful. Take a look at the nine key elements I have come up with for your consideration.
Organizational Features in Portfolio Risk Assessment
The assessment should explore all the contextual, legislative, and policy issues that affect the project portfolio positively or negatively. Under this element, the assessment also analyzes internal communication channels, stakeholder management, and decision-making mechanisms and practices. The degree to which management control functions are data-driven is also gauged. Legislative compliance is another area to look at.
Budget Formulation: A Key Element in Portfolio Risk Assessment
How does an organization formulate, implement, report on, and control budgets? What are the specific processes and policies? How inclusive are these processes? These are important questions. The assessment teams would also want to know how well different units of an organization coordinate their budgeting exercises. For instance, organizations need to have staff with the requisite capacity to be able to perform these functions effectively. This is the stage at which the assessment team will look at budget execution, asset management, and reporting procedures and practices.
Procurement Processes and Portfolio Risk Assessment
All agencies have procurement departments. The assessment looks at the extent to which the organization follows and complies with the applicable procurement laws and regulations, bidding processes, approved technical requirements, and contracts management and oversight mechanisms. Effective organizations need to have internal monitoring mechanisms to track procurements. Procurement policies and practices must be based on the principles of impartiality, equal access, and legislative compliance.
Information Technology’s Role in Portfolio Risk Assessment
The role of information technology in portfolio management cannot be overestimated. On the one hand, the risk assessment reviews a range of technical areas, such as general controls, disaster recovery and backup procedures, as well as physical security and application controls. On the other hand, organizations are challenged on the degree of implementation of their digital transformation strategy, if they have one. In addition, the organization’s policies and practices related to cybersecurity, privacy and confidentiality, and protection of personally identifiable information will be scrutinized.
Human Resources: An Integral Part of Portfolio Risk Assessment
For organizations to function effectively, they need to have effective HR policies and procedures. One aspect of the assessment covers staff recruitment, remuneration, retainment, and other related areas. No less important is the extent to which organizations are able to support the professional development of their employees to retain or attract talent. Equal opportunities and zero tolerance to harassment and other types of discrimination must be integrated to ensure a level playing field fo all.
Internal Control in Portfolio Risk Assessment
Additionally, a review of the internal control environment, risk assessment, information and communication, and monitoring activities is also very important. The risk assessment gauges risks related to policies, approvals, verifications, and reconciliations. This is through verifying the degree to which have been interspersed within functional areas.
Fraud and Mismanagement in Portfolio Risk Assessment
Many organizations seek to understand the likelihood of fraud and related risks. In this regard, it is important to assess where, when, how, and why fraud can take place in an organization. Then, the assessment team would review internal and external fraud risks the project portfolio exposed to. There are different types of fraud, and they are related to financial
reporting, misappropriation of assets, corruption, nepotism and favoritism, violation of the organization’s ethical rules, and the like. These broad categories include specific fraudulent schemes related to contracting, payments, and other areas. Factors related to fraud risks include incentives, opportunity, and rationalization to commit fraud.
Analysis and Interpretation
Once the assessment team completes a detailed review of all areas, it goes on to analyze each identified risk in greater detail. Risks will then be under different headings. This includes as operational, programmatic, financial, reputational, and others. Each risk is under categories as low-, medium-, or high-level risk. This is important because the categorization paves the way for corresponding response strategies and recommendations. At a more advanced level, some assessment teams go so far as to assess the degrees of probability vs. possibility in relation to each risk.
Risk Mitigation Plan
The portfolio risk assessment only makes sense if the organization is able to develop a risk mitigation plan and act on it. The plan should include a broad range of actions (including management decisions, capacity development efforts, HR actions, etc.) to address the identified risks. Ideally, all these actions must be time-bound and measurable. It is the responsibility of senior managers to assign specific departments and individuals to each action point.
Summary
No organization is immune to an array of programmatic, contextual, or internal risks. Instead of turning a blind eye to potential risks, successful and agile organizations plan and execute portfolio risk assessments as both a preventative and a capacity development measure.
When supported by leadership, organizations are able to remove major programmatic, operational, or financial roadblocks that stymie their development. With this, regular portfolio risk assessments nurture an organizational culture grounded in the principles of equity, accountability, and high impact. If your organization has never done one, now is the time to consider it! Until next time, you are up to date.