ICAEW.com works better with JavaScript enabled.

Case study: creating an integrated performance and risk framework


Published: 15 Jan 2013 Updated: 20 Sep 2022 Update History

Exclusive content
Access to our exclusive resources is for specific groups of students and members.

Many organisations run their performance management approaches and risk management approaches separately. The Royal Air Force (RAF) wanted to ensure that they were integrated and that an assessment of their performance led to a reflection on the risks and issues. In turn, risks and issues might have an impact on future performance and therefore have to be taken into account when assessing performance.

Creating a performance framework

In order to better understand performance levels of the RAF and to demonstrate performance to its stakeholders the RAF created a performance framework. The first step was to identify the elements of a performance framework and the areas it needed performance measures for. The RAF adopted a scorecard approach using the four perspectives: outputs, resources, processes/enablers and future capabilities:

Reporting scorecard

The objectives and their performance indicators (PIs) that supported assessments under each of the four scorecard perspectives were developed over time, with each new year seeing a refinement of the previous year’s set. The system now had a set of performance indicators organised in different perspectives with both calculated and subjective assessments triggering traffic lights. These measures were then cascaded down the organisation hierarchy in Air Command (command, group, station).

Aligning the performance framework with risk assessments

Once the scorecard element was complete, the next step was to link performance management with risk and issue management. Performance management is about measuring, reporting and making decisions about achieving objectives. Risk management is about identifying and managing the risks to achieving the same objectives. Thus there is a common denominator – an organisation’s objectives.

For example, key objectives are expressed as the delivery of the force elements at readiness (FE@Rs. Performance Management identifies shortfalls between the targets that have been set (eg 10 crew members at 7 days readiness) and the achievement (eg 8 crew members at 7 days readiness).

The shortfall of two crew members is regarded as an issue if is certain and a risk if it is forecast possibility. The potential shortfall, which will be revealed by the performance management process, needs to be identified, assessed and managed as in all good risk management practices.

The RAF's performance management system includes the forecasting of the position in the future, based on extrapolating from the known baseline of the current position. For such forecasting to be realistic, it needs to take into account the known risks and issues, and modify the extrapolation to reflect the assessed most likely impact of the combined effect of these risks and issues. Thus judgements being made within the performance management process cannot be separated from data available from the risk management process. They are inextricably linked.

The Royal Air Force has been carrying out formal risk management for many years. However, unlike a commercial company, the risk focus is not primarily on the financial ‘bottom line’ but rather on the delivery of war-fighting capability.

Key risks for the Royal Air Force are those which impact on war-fighting capability, termed, loosely, ‘operational risk’. Some of these are generated by deliberate decisions shaped by available funding.

For example, limiting the level of spares in inventory to meet budgets raises the risk that equipment will be unavailable because it cannot be serviced. Again providing a reduced/cheaper level of protection for personnel, risks increasing the danger to them in a hostile environment. Over time these risks accumulate and their combined effect may be greater than would be recognised when looking at the individual risks.

Integrating risk management and performance management in a single IT system helped to meet commanders’ need for greater visibility of their ‘operational risks’, and to maintain both an authoritative audit trail of reviews and the current status of ameliorating actions, all to aid their decision making.  It also had to meet governance requirements, however these were considered to be secondary to the prime objective.

The integrated risk and performance management system has therefore been designed to provide both performance and risk information in a manner that allows the performance assessments to be made in the light of the risks that have been recorded. The risk and issue management implementation was a clear success. After an initial 3-month pilot period on selected stations, the system was introduced organisation-wide.

Key lessons

  • Ensure you don’t run performance management and risk management in siloes
  • Align performance management with risk management
  • If possible, create a single IT system to manage and report performance and risks
  • Rely on ‘calculated’ metrics as well as ‘subjective’ assessments
About the author

Bernard Marr is a leading performance management expert and business author.

Related resources

Further reading into integrating your performance management and risk management approaches is available through the resources below.

Online articles

The Library provides access to leading business, finance and management journals. These journals are available to logged-in ICAEW members, ACA students and other entitled users subject to suppliers' terms of use. 

More support on business

Read our articles, eBooks, reports and guides on risk management.

Risk management hubeBooks on risk
Can't find what you're looking for?

The ICAEW Library can give you the right information from trustworthy, professional sources that aren't freely available online. Contact us for expert help with your enquiries and research.

Changelog Anchor
  • Update History
    15 Jan 2013 (12: 00 AM GMT)
    First published
    20 Sep 2022 (12: 00 AM BST)
    Page updated with Related resources section, adding further reading into integrating your performance management and risk management approaches. These additional resources provide fresh insights, case studies and perspectives on this topic. Please note that the original article from 2013 has not undergone any review or updates.