|
Portfolio Management |
Programme Management |
Project Management |
|
There may be a growing recognition that risks need to be managed and that, at least for key business initiatives (e.g. cost saving or major site developments), they can threaten success.
|
There is minimal evidence of risk management being used to any beneficial effect. There may be evidence of a risk being documented but little evidence of active management.
|
There may be some evidence of risk management being deployed occasionally, but with minimal beneficial effect.
|
|
There is generally a top-down approach to risk identification, focusing on major organizational initiatives, but some initiatives are increasingly carrying out bottom-up risk identification. However, these approaches are inconsistent, not particularly interrelated and often do not address the actual management of risks.
|
Risk management is partially recognized and used on some programmes, but there are inconsistent approaches within and between programmes, which result in different levels of commitment and effectiveness.
|
Risk management is recognized and used in some projects, but there are inconsistencies in approach, commitment and deployment.
|
|
Portfolio risks are identified and quantified, and mitigation plans are developed and funded. Risk management across the portfolio is based on a common, centrally managed process.
|
Risk management has a clearly defined and centrally managed process that is followed consistently by all programmes. The framework is based on industry standards and is supported by a consistent system used by all programmes.
|
Project risk management is based on a centrally defined process that is cognizant of the organization’s policy for the management of risks.
|
|
The organization’s appetite for risk, and the balance of risk and benefit across the portfolio, are continually reviewed and managed. Senior managers own and oversee risk management across the portfolio.
|
Risk management works effectively, with active management and mitigation of risks evident through embedded behaviour. There is evidence of opportunity management and management of risk aggregation.
|
Risk management is working effectively, is embedded, and the value of risk management can be demonstrated from the organizational perspective. Decision making includes risk analysis.
|
|
The process of portfolio risk management is continually improved, based on the analysis of evidence from within the organization and comparison with other organizations.
|
Risk management is embedded in the culture of the organization and underpins all decision making within the programme. There is evidence of continual improvement and integration with strategic direction.
|
Risk management is embedded in the organizational culture and underpins all decision making with respect to projects.
|