Risk And Assurance - Enhancing Professional Competence and Capability
Context
The client is a project focussed organisation in a highly regulated, complex and safety critical sector. Their total spend is more than £2bn p.a., with projects delivered through a number of subsidiary organisations, subject to their own governance and regulations. The central Risk and Assurance functions wanted to answer the question “Do we have the capability to deliver our mission?” and therefore commissioned 2 phases of work to design and then implement a Risk and Assurance Competence Framework.
The Challenge
On engagement with the client a draft competency development framework for risk professionals, based on a development within a different sector, was provided as a starting point. The initial brief was to develop this further to enhance the technical professional skills of the risk and assurance communities within the broader organisation. Through our experience within the sector and complex programme delivery we identified an opportunity to develop a more holistic and value adding framework that would cover all corporate and professional levels and functions as well including the operational environment.
What We Brought
Our 2-person core team was established to create and deliver their capability enhancement, augmented at time with specific expert research capabilities. Throughout the focus was on helping them answer their own question of “Do we have the capability to deliver our mission?”. The team worked closely with an internal client team to develop a structured realistic plan to deliver all phases of the project. The team brought specific expertise in:
- Competence and capability assessment and development
- Research abilities of existing practice
- Expert project, programme and portfolio management theory and practice
- Risk and assurance theory and practice
- Industry specific and detailed regulatory knowledge and experience
- Real world solution development and delivery
- Change management expertise to support effective adoption and use.
Results
- A robust, credible technical competence framework for risk and assurance professionals developed and delivered robust assessment and data collection process developed and delivered
- Implementation of the framework which caused minimal disruption, whilst producing meaningful results
- A full round of assessment that provided the first in detail standardised measure of risk and assurance technical competence across the whole organisation
- Analysis of the data produced, to identify targeted areas for development
- Capability knowledge to best assign people to specific technical challenges
- A methodology for prioritising competencies for development, that would be robust under regulatory and stakeholder scrutiny
- Prioritised areas for capability development identified
- A comprehensive development guide produced, issued and being used by the risk and assessment community
- The conceptual design of a Risk and Assurance Academy using a user centric approach to aide adoption and value add
- Recognition of the quality of the work with the client winning an Association of Insurance and Risk Managers in Industry and Commerce (AIRMIC) award for Risk Management Innovation 2022. (See here).
- The potential for the competence model to be the basis for a future national standard following discussions with several bodies.
“Stuart and Donnie were both highly capable delivery partners on this project. Their breadth of sector knowledge, and experience of developing people and the associated frameworks made the role of client in this project much easier. The quality of service, the thought-provoking challenge provided, and the quality of the deliverables made this a fantastic project.”
- Enterprise Risk Manager
Project Execution (all the detail!)
Process & Approach
Initially we agreed a set of 25 design principles covering what they wanted to achieve and how they wanted to achieve it including the need to ensure the competence model would be future proofed. The design principles allowed us to agree how they would measure capability and competence, how they could and would gather the data, what the data would be used for, what the implications for data protection might be and the human resource and technology requirements.
The client had defined leadership and behavioural competencies which allowed us to focus purely on the strategic, tactical, and technical competencies. We researched existing risk and assurance competencies from a broad range of sources as well as identifying the latest thinking from the leading bodies and experts in the field and then expanded and enhanced from our own experience.
The first draft was tested by sharing with leading specialists, and the feedback was unanimously positive, including comments that the work was class-leading and defined at a level not seen in other professional frameworks.
The framework that ultimately emerged allowed for the definition of common competencies across both risk and assurance, and specific competencies for each specialism. We also provided different definitions depending on ‘status’ e.g., practitioner, manager, executive.
- During the design phase our team also produced several other deliverables including:
- Communication plan and assets to gain internal support and feedback from professionals
- Communications and reports to gain stakeholder support and endorsement
- Definitions for varying levels of competence
- Definitions for assessment of competence, along with an assessment framework and tool
- A roadmap for implementation
- Implications assessment relating to sector specific regulatory requirements.
For the second phase we developed the implementation processes, data and analysis tools, and input into their communications programme, and data protection requirements. We also supported the client in prioritising the competencies for development (together with providing a robust justification) given that there were resource limitations.
To enable ownership by the risk and assurance professionals of their own development, we produced a detailed and extensive development guide. The guide explained how to best drive one’s own development, considering learning preferences and job content. It provided more than 100 public domain development assets, from courses to articles, blog posts, online videos etc. New paragraph