Case study: creating an integrated performance and risk framework

In order to better understand performance levels of the RAF and to demonstrate performance to its stakeholders the RAF created a performance framework. The first step was to identify the elements of a performance framework and the areas it needed performance measures for. The RAF adopted a scorecard approach using the four perspectives: outputs, resources, processes/enablers and future capabilities:

The objectives and their performance indicators (PIs) that supported assessments under each of the four scorecard perspectives were developed over time, with each new year seeing a refinement of the previous year’s set. The system now had a set of performance indicators organised in different perspectives with both calculated and subjective assessments triggering traffic lights. These measures were then cascaded down the organisation hierarchy in Air Command (command, group, station).

Once the scorecard element was complete, the next step was to link performance management with risk and issue management. Performance management is about measuring, reporting and making decisions about achieving objectives. Risk management is about identifying and managing the risks to achieving the same objectives. Thus there is a common denominator – an organisation’s objectives.

For example, key objectives are expressed as the delivery of the force elements at readiness (FE@Rs. Performance Management identifies shortfalls between the targets that have been set (eg 10 crew members at 7 days readiness) and the achievement (eg 8 crew members at 7 days readiness).

The shortfall of two crew members is regarded as an issue if is certain and a risk if it is forecast possibility. The potential shortfall, which will be revealed by the performance management process, needs to be identified, assessed and managed as in all good risk management practices.

The RAF's performance management system includes the forecasting of the position in the future, based on extrapolating from the known baseline of the current position. For such forecasting to be realistic, it needs to take into account the known risks and issues, and modify the extrapolation to reflect the assessed most likely impact of the combined effect of these risks and issues. Thus judgements being made within the performance management process cannot be separated from data available from the risk management process. They are inextricably linked.

The Royal Air Force has been carrying out formal risk management for many years. However, unlike a commercial company, the risk focus is not primarily on the financial ‘bottom line’ but rather on the delivery of war-fighting capability.

Key risks for the Royal Air Force are those which impact on war-fighting capability, termed, loosely, ‘operational risk’. Some of these are generated by deliberate decisions shaped by available funding.

For example, limiting the level of spares in inventory to meet budgets raises the risk that equipment will be unavailable because it cannot be serviced. Again providing a reduced/cheaper level of protection for personnel, risks increasing the danger to them in a hostile environment. Over time these risks accumulate and their combined effect may be greater than would be recognised when looking at the individual risks.

Integrating risk management and performance management in a single IT system helped to meet commanders’ need for greater visibility of their ‘operational risks’, and to maintain both an authoritative audit trail of reviews and the current status of ameliorating actions, all to aid their decision making.  It also had to meet governance requirements, however these were considered to be secondary to the prime objective.

The integrated risk and performance management system has therefore been designed to provide both performance and risk information in a manner that allows the performance assessments to be made in the light of the risks that have been recorded. The risk and issue management implementation was a clear success. After an initial 3-month pilot period on selected stations, the system was introduced organisation-wide.

• Ensure you don’t run performance management and risk management in siloes
• Align performance management with risk management
• If possible, create a single IT system to manage and report performance and risks
• Rely on ‘calculated’ metrics as well as ‘subjective’ assessments

Further reading into integrating your performance management and risk management approaches is available through the resources below.

Online articles

The Library provides access to leading business, finance and management journals. These journals are available to logged-in ICAEW members, ACA students and other entitled users subject to suppliers' terms of use.