SECTION A [40 MARKS]

Read the following case study and answer ALL the questions that follow. Article: Corporate Maturity Towards Risk

Maturity towards risk is achieved through awareness, the consideration that risk management is on the same level as cost, time and scope management tasks, commitment to high quality of data, systematic implementation of instruments to deal with risk, development of responses and assessment of the obtained results (Hulett, 2001). A scarce awareness towards risk drives occasional applications of informal risk management techniques to specific projects and problems are dealt with only when they occur. Understanding the relevance of risk, instead, allows to proactively manage uncertainty (Hopkinson, 2011). The degree of maturity towards risk of an organisation depends on its risk culture, which is stimulated by the available informational context and the type and size of the organisation itself.

Several models to assess risk maturity exist in literature (Hillson, 1997; Macgillivray et al., 2007). Among them, Hillson (1997) proposes four stages: nave, novice, normalised and natural. Nave means that an organisation does not feel the need for managing risk and does not use structured approaches for this purpose. Novice defines an organisation that recognises the benefits of managing risk and is implementing some form of risk governance but it lacks a formalised process to perform this task. Normalised is the degree of maturity characterised by a formalised risk process included in routine business activities whose benefits, however, are not consistently achieved in every project. Finally, the natural maturity level refers to an organisation that is completely aware of risk and proactively manages opportunities and threats through consistent risk information.

Moving from one level to the upper one in a maturity scale implies that an organisation is willing to perform a more thorough and systemic analysis of the escalation processes of project risks with more sophisticated and detailed techniques (Hopkinson, 2011; Hulett, 2001). In particular, a high level of risk awareness together with an appropriate availability of knowledge makes it possible to obtain that objective information allowing the quantification of risk. Based on this, it can be stated that the more mature an organisation towards risk, the more the phases of the risk management process it will implement. Companies with a low maturity degree only perform risk identification or qualitative risk analysis, while organisations with a high level of maturity deal with all the stages of the risk management process.

Source: Journal of Risk Research, 2015 Vol. 18, No. 2, 232248

QUESTION 1 (40 Marks)

1. How does the risk culture of an organisation impact the success or failure of a project? With reference to the case study, make recommendations on how to integrate project risk management with organisational risk culture. (20 marks)