Risk management system at Gemini Observatory

摘要

One of the challenges in implementing an effective enterprise risk management system is establishing a common set of processes, tools, and standard terminology. The risk management system recently implemented at Gemini Observatory operates at four connected levels: project, program, division, and observatory, using a common set of processes, tools, templates and standard terminology. The risk management process flow begins with the leader of the corresponding level writing a risk management plan outlining the process for the size and type of the project, roles and responsibilities, budgeting, timing, risk tolerances, and reporting for that specific level. Within the actual managing of risks, the leader of each level performs risk identification, risk assessment, internal risk controls evaluation, mitigation planning, contingency planning, risk monitoring (includes mitigation and contingency plan execution as needed), and risk closure in collaboration with appropriate staff. Risk categories used for project, program, and division risks are subcategories of the Observatory risk categories of strategic, operational, financial, and compliance. The same risk register template is used for all levels modified only for the specific categories required for each level. The risk register displays a risk score based on impact and likelihood ratings on a five by five matrix. All risk registers require that internal controls be evaluated for reducing risk, that mitigation and contingency plans are created, and costs are estimated. Finally, staff are trained in risk management through a set of training modules designed for the system. This paper describes in detail the risk management system implemented at Gemini Observatory and discusses the first four months of use.