Organizational Challenges and Phases of Implementation and Optimization

Abstract

In a competitive environment organizations have to constantly adapt and change in order to preserve and to increase financial returns. The dynamics of adaption and change include risks which can create internal resistance to change. For that reason, creating and sustaining substantive strategic changes can only be achieved by those organizations that foster a risk seeking culture with the willingness to change the future position of the organization.

Appendices

International Civil Aviation Organization (ICAO) (2009).

Appendix: SMS Gap Analysis

International Civil Aviation Organization (ICAO) (2009).

Appendix: Sample Safety Policy

Appendix: Master Risk List Examples

Appendix: ASR/Hazard Reporting Procedure

Appendix: Sample Air Safety Report

Appendix: Safety Manager Evaluation Sheet

Appendix: SWANS Report

Bundesamt für Zivilluftfahrt (BAZL) (2007).

In order to submit a report, please complete the online form below. Alternatively, you can download the Snapform version, which can be sent by mail or fax to the SWANS address. Complaints raised against third persons will not be filed by means of SWANS, they have to be reported to FOCA via the ordinary recourse. Nevertheless, should a complaint against a third person be filed by means of SWANS, the person filing the complaint has to take into account that his/her personal data could be disclosed to the accused person in the course of his/her right of access to records.

Appendix: ERP Checklist Emergency Director

8.1 Emergency Director

Appendix: Individual Risk Assessment Example

RISK MANAGEMENT SAMPLE COMPANY

Individual Risk Assessment

Risk No. 9 Exchange rate development

9.1 Introduction

As part of the Risk Management of the sample company, all potential sources of risk in relation to existence, operation and development of the company are systematically recorded and analyzed. The recognized and relevant risks are assessed according to standard criteria regarding financial scope, frequency of occurrence and severity. The resulting risks are then entered into a Master Risk List according to their priority and risk factor. This is the basis for the individual risk assessment in which the significant risks are presented and mitigation measures are proposed to reduce the level of risk.

Starting point: No. 9 Exchange rate risk developments

• Changes in exchange rates might not only affect income and costs, but also the assets and liabilities of the sample company extremely unfavorably. The sample company invoices in the following currencies: CHF, EUR, USD and YEN. As an exporter, the strength of CHF in recent years is, in the view of the sample company, no advantage.

• For several years, the sample company has assured the currencies CHF, EUR and USD, but not YEN, with instruments at the UBS against downward trends, with the aim of planning security. The corresponding operating margin is described in the mandatory foreign currency directive of October 3rd in 2013.

• For a natural hedging, the possibilities for the sample company are low, e.g. no production facility in the USD or YEN-area, limited ability to pay suppliers and employees in EUR.

Appendix: Risk Management Policy

NEW AIRLINE LTD.

RISK POLICY

Table of Contents

PRINCIPLES OF RISK MANAGEMENT

• Concept of the Risk Management

• Purpose of the Risk Management

• Strategy of the Risk Management

• Annual Briefings

• Risk Management Organization

• Roles and Responsibilities

RISK MANAGEMENT PROCESS

• Process Phases

• Overview of the Process

RISK MANAGEMENT GUIDELINES

• Phase 0: Preparation

• Phase 1: Risk Identification

• Phase 2: Risk Assessment

• Step 1: Risk Consolidation and Classification

• Step 2: Risk Prioritization

• Phase 3: Risk Measures

• Phase 4: Risk Re-Mapping

• Phase 5: Reporting

FINAL PROVISIONS

• Entry into Force

• Changes and Amendments

10.1 PRINCIPLES OF RISK MANAGEMENT

10.1.1 Concept of the Risk Management

The Risk Management (RM) of New Airline Ltd. is a task of the Executive Management and is monitored by the Board of Directors, forming an enterprise-wide strategic framework. It is designed to identify potential events that could have a substantial negative impact on the company. Its aim is to control risks and to ensure an adequate level of certainty in relation to the achievement of corporate goals. With the early identification of risks associated with the scope of the different departments, corporate safety should be increased. The RM of New Airline Ltd. is embedded into the existing management processes of the company and should not be a parallel organization in itself.

10.1.2 Purpose of the Risk Management

The main objective of the Risk Management is to provide the Board of Directors (BoD) and the Executive Management (EM) with a complete and continuously updated corporate risk overview. Based on this, the most important risks can then be systematically processed according to their potential and be mitigated as far as possible. The main objectives include:

• Coordination of strategy, Risk Management and internal controls

• Optimization of decisions in response to risks

• Improvement of the reliability of forecasts

• Identification and control of enterprise-wide risks

• Improvement of risk awareness throughout the company

• Standardization of procedures and the Risk Management language at the corporate level

• Annual preparation of a Top Risks List, which is then applied across corresponding departments

• Provision of adequate insurance coverage

• Ensuring that the internal control system (ICS) is continuously implemented and optimized as far as possible.

10.1.3 Strategy of the Risk Management

Risk factors that may impact the ability of the company to reach its strategic objectives are detected and analyzed. The Board and Executive Management of New Airline Ltd. are convinced that risks are always associated with opportunities. Calculated risk-taking is essential for the growth of our company. Each employee should be aware of the strategic direction of New Airline Ltd. and work to achieve these goals by taking reasonable steps, outlined below, in order to effectively manage risks and opportunities.

The strategy of New Airline Ltd. is based on the following vision:

• 1. Take advantage of the growth opportunities in Switzerland through well-chosen market segments and service solutions

• 2. Market leadership in the aviation sector in Switzerland with the label Swiss Made

• 3. Expansion of transportation services by offering state of the art transportation services in a global network

10.1.4 Annual Briefings

The Board of Directors has to discuss the risk environment and the related risk exposure of New Airline Ltd. with the Executive Management at least once per annum. The findings are included in the risks list and measures. Ways to address and mitigate them are presented.

10.1.5 Risk Management Organization

At New Airline Ltd., the Board of Directors has the overall responsibility for Risk Management. The board may seek advice from an advisory board, if such is established and needed. In line with the law, and based on company regulations, the Board delegates the implementation of Risk Management to the Executive Management. The EM is assisted by the Risk Manager. He/she carries out activities on behalf of the EM and reports to them. In the case of urgent risks or if there is a concern that these risks are not adequately perceived and/or covered, the Risk Manager can directly communicate with the Chairman of the Board.

10.1.6 Roles and Responsibilities

Board of Directors ( BoD )

• Definition of the risk management organization

• Defining the risk management processes

• Defining the risk management policy and the adoption of the policy

• Ensuring the effective implementation of the risk management organization, risk management policy and risk management processes

• Taking overall responsibility for Risk Management

Executive Management ( EM )

• Management of all risk factors within the strategic, operational and financial framework to mitigate and to reduce risks

• Provide timely and accurate information about the risks that the company faces, as well as steps taken to ensure their effectiveness

• Responsible for the implementation and coordination of the Risk Management

• Coordination of information flow and documentation relating to the Risk Management

• Conduct sampling to ensure that all risks are identified, analyzed and, if necessary, a single risk assessment is carried out and appropriate risk-mitigating measures are defined

Risk Manager

• Preparation of annual risk analysis (as part of the annual SWOT analysis) for submission to EM and BoD

• Preparation of the definition of risk-mitigating measures for submission to EM and BoD, as well as monitoring the implementation of the risk-mitigating measures

• Quarterly reporting to the EM on the development of key risks and the level of risk-mitigating measures (risk radar as part of the quarterly reporting)

• Annual report on Risk Management to the BoD

• Coordination of the risk management function with measures of the ICS

• Ongoing identification, definition of proposed measures and reporting of significant changes in the risk environment

• Preparation of the annual insurance overview

• Ensuring that all employees are also questioned about new or worsened risks in connection with the annual staff performance review

Risk Management is the responsibility of everyone in the company, including management and employees, and is therefore explicitly or implicitly part of the job description of every member of the company. In order to allow a proper application of that responsibility by all employees, the relevant risk management information will be published with access for all employees through the intranet.

10.2 RISK MANAGEMENT PROCESS

10.2.1 Process Phases

The overall process of risk identification, risk assessment, risk measures, risk re-allocation and reporting in the strategic environment should be carried out annually. In the case of unforeseen and extraordinary events, these processes can occur more frequently.

Six phases of the Risk Management process:

• Phase 0: Preparation

• Phase 1: Risk Identification

• Phase 2: Risk Assessment

• Phase 3: Risk Measures

• Phase 4: Risk Re-allocation

• Phase 5: Reporting

10.2.2 Overview of the Process

The RM process is standardized across the whole company. The Executive Management undertakes all the necessary efforts to raise the awareness of Risk Management amongst employees on every level.

10.3 RISK MANAGEMENT GUIDELINES

10.3.1 Phase 0: Preparation

The preparation phase is a long-term process and is not performed on an annual basis. It takes place over a longer period of time, and is modified and amended with changes in strategy, in cases of extraordinary events or when new information becomes available. This phase includes the following tasks

• Set up of the Risk Management Organization

• Establishment of Risk Management Processes

• Establishment of the Risk Management Policy

• Set up of Risk Management Guidelines

Milestone 0: Set up of the Risk Management Organization, approve the Risk Management Policy, implement Risk Management Processes and adopt the Risk Management Guidelines. As a result, the Risk Policy is adopted or revised by the Board of Directors.

10.3.2 Phase 1: Risk Identification

In this phase, all risks that confront New Airline Ltd. are identified. A risk is an incident or event that arises from either internal or external sources and could have an impact on the implementation of a strategy or the achievement of objectives. Risks can have either positive or negative effects; however, the focus of risk management activities at New Airline Ltd. is on negative events. At this stage, the Executive Management identifies and monitors all potential events, even if these events have a low probability of occurrence. This is especially relevant if the potential impact on the achievement of important objectives is high.

In order to capture all relevant risks, not just the BoD and EM members are interviewed by the Risk Manager. All the employees of New Airline Ltd. have to be questioned about possible risks, using a standardized questionnaire. Subsequently, this survey can be conducted in conjunction with the annual employee performance review.

Milestone 1: After the implementation of the risk management process all employees, as part of their annual employee performance review, are interviewed about possible new or worsened risks.

10.3.3 Phase 2: Risk Assessment

10.3.3.1 Step 1: Risk Consolidation and Classification

All identified risks are first consolidated by an interdisciplinary team composed by the EM, and under the direction of the Risk Manager. Similar risks will be clustered and risks without a relevant damage potential will be deleted. The risks are classified into the following three categories: strategic risks, operational risks and financial risks.

Strategic risks: all risks that endanger the existence or continuation of the company or which may cause the company to go into liquidation/insolvency are classified as strategic risks. In general, these risks relate to the long-term success and viability of the company. These include:

• Risks which arise from disasters or force majeure situations including service disruptions caused by natural disasters, uncertainties, service liabilities, etc.

• Environmental risks: Strong competitors negatively affecting the business. Incorrect, untimely or unavailable information about competitors/rivals and their products could have an adverse impact on the business.

• Management risks: In addition to having an appropriate organization, management style is one of the crucial preconditions for the success or failure of a company. Lack of leadership (unclear instructions, unclear responsibilities) may represent a risk to a company, such as overdependence on leading executives.

• Risks related to stakeholders: Ensure that the company is focused on the needs and aspirations of all stakeholders, including shareholders and business partners, authorities, suppliers and society in general.

Operational risks: Operational risks are those risks that threaten strategic goals due to inappropriate or lack of internal processes, people or systems. In general, these risks are short or medium-term risks and include the following:

• Process risks: Risks that relate to the customer value proposition process in the company.

• Operational risks: Risks that arise in the daily operation, such as insufficient resources, quality problems, illness, accidents, miscalculations, maintenance deficiencies, etc.

• Credit risks: Risks associated with the failure of important equipment for operations such as failure of the necessary IT infrastructure, etc.

• People and cultural risks: Risks that arise as a result of years of corporate culture development and the people that live and work in this culture. There are several categories of such risks, and they may take the form of resources, know-how and skills, motivation, integrity, compensation, performance, relationship with trade unions and legal problems.

• Legal risks: Potential for losses arising from the uncertainty of future regulations or legal processes, such as outcomes of litigation, bankruptcy, etc.

Financial risks: Risks that have purely financial implications for the company (short or long term) fall in this category, for example:

• Market risks: The possibility of losses arising from adverse changes in market prices and rates, including commodity prices, interest rates and exchange rates.

• Liquidity and credit risks: Liquidity risk describes a situation in which one party is not able to meet liabilities and debt obligations at a certain point in time. This may affect collection, management of liquid assets, hedging and financing.

• Taxes, regulations and accounting: The accounts are subject to a thorough examination and may be subject to substantial risks in light of existing lawsuits and legal measures.

• Capital structure: The company does not have sufficient/optimal capital, resulting in higher capital costs, lower profitability and a reduction in cash flow and liquidity.

10.3.3.2 Step 2: Risk Prioritization

A workshop should be organized in order to prioritize risks in the master risks list. Members of Executive Management from selected departments and an external advisor all take part in this workshop. The idea is to encourage an open dialogue about risks.

All identified risks are analyzed based on a risk priority number (RPN), which is based on two criteria and a weighting on a scale of 1–5. The criteria are defined as:

• The impact or severity of the event (effect of risk in financial terms)

• Probability of occurrence (frequency with which these risks occur)

The risk priority number (RPN) is obtained with the multiplication of the two risk factors. The lowest RPN is therefore 1 and the highest 25. Part of the risk assessment is also to determine whether a risk has a relevant lead time. This is considered as a surprise factor which is accounted for with the risk factor of −1. The prioritization is made in the master risk list based on the determined RPN.

The master risk list should be treated as confidential by all employees. However, it may be required to present it to insurance brokers and insurance experts in connection with the annual insurance verification. The matrix to determine the RPN is shown graphically below.

Potential risks of more than ten RPN, according to the risk assessment, are the main risks (Top Risks) of New Airline Ltd. These risks have top priority for the following reasons:

• To keep the directed attention on the selected issues

• To allocate the available resources, human capital and finances efficiently.

• To assign risk owner(s) to each top risk

Milestone 2: Identification, development and mapping of the most important risks (Top Risks).

10.3.4 Phase 3: Risk Measures

The measures for each of the key risks (Top Risks) are defined in a so-called individual risk assessment. The analysis includes:

• The complete scenario of the risk occurrence

• Drivers of the risk

• The connection of this risk to other risks

• Quantification of risk (intelligent estimate)

• Identification of the “need for action” and definition of the necessary risk-mitigating measures

The detailed analysis must then be discussed with the Executive Management. Each risk is monitored by the Risk Manager along the following points:

• Clear and achievable goals and benchmarks

• Detailed planning process, including clear deadlines, important milestones and cost–benefit analysis

• Definition of Key Performance Indicators (KPIs) or Standards

• A clearly defined methodology

• Clear allocation of resources

Milestone 3: The measures for handling risks are defined, the action plan is prepared and persons responsible for each of the top most important risks are appointed.

10.3.5 Phase 4: Risk Re-Mapping

The action plan for responding to a particular risk is set in a specific, corresponding project. The risk mapping should be updated in the second quarter of each year, along with trends in the risks in the Top Risks List and the effectiveness of responses to these risks. The re-mapping is important for the following reasons:

• To keep the development of risk scenarios in mind

• The review of the effectiveness of measures for handling risks

• To control the risk management process

To ensure an accurate and complete understanding of all the potential risks, periodic surveys of all employees are conducted (as part of the annual performance review) to obtain their risk assessment. Where possible, the risk re-mapping should be made by a multidisciplinary team.

Milestone 4: The individual risk assessments are continually processed by the respective risk owners in coordination with the Risk Manager.

10.3.6 Phase 5: Reporting

The reporting is prepared by the Risk Manager and the monitoring of the risk management process is documented as follows:

• Quarterly reporting to the EM concerning the major risks

• Annual reporting of all risks according to the master risk list and the activities of the Risk Manager to the BoD

• Annual update of all documents relating to the Risk Management

In order to be able to update the Risk Management and reporting to the latest development standards, the Risk Manager should attend relevant training in consultation with the EM.

Milestone 5: Regular updates and reports on the follow up process, the effectiveness of risk responses and proposals for the next cycle.

10.4 FINAL PROVISIONS

10.4.1 Entry into Force

With the resolution of the Board, this risk policy will be active with immediate effect and replaces all previous provisions for risk management within New Airline Ltd.

10.4.2 Changes and Amendments

This risk policy has to be reviewed at least every four years and has to be amended if necessary.

*********

Zürich, 1 April 2013

Chairman of the Board of Directors:      Board secretary:

_______________________________    ________________________

Appendix: Steps in Assessing Risk

According to Kaplan and Garrick (1981), pp. 11–27:

What can happen, how likely is it, that it will happen and if it does happen, what are the consequences?

According to Suddle and Waarts (2003):

• 1. Probability of undesired consequence.

• 2. Seriousness of (maximum) possible undesired consequence.

• 3. Multi-attribute weighted sum of components of possible undesired consequence.

• 4. Probability x seriousness of undesired consequence (“expected loss”).

• 5. Probability-weighted sum of all possible undesired consequences (“average expected loss”).

• 6. Fitted function through graph of points relating probability to extent of undesired consequences.

• 7. Semi-variance of possible undesired consequences regarding their average.

• 8. Variance of all possible undesired consequences regarding mean consequences.

• 9. Weighted sum of expected value and variance of all possible consequences.

• 10. Weighted combination of various parameters of the probability distribution of all possible consequences (encompasses 8 and 9).

• 11. Weight of possible undesired consequences (“loss”) relative to comparable possible desired consequences (“gain”)

Appendix: Insurance Review

Glossary ^,

International Air Transport Association (IATA) (2012).

International Civil Aviation Organization (ICAO) (2009).

Accident (Aircraft)

An occurrence associated with the operation of an aircraft that takes place between the time any person boards the aircraft, with the intention of flight, until such a time as all such persons have disembarked, in which a person is fatally or seriously injured, the aircraft sustains substantial damage, or the aircraft is missing or is completely inaccessible.

Air Operator Certificate (AOC)

A certificate authorizing an operator to carry out specified commercial air transport operations.

Air Traffic Control (ATC)

A service provided for the purpose of controlling aircraft movement in a manner that: (a) Prevents collisions on the maneuvering area between aircraft and obstructions. (b) Expedites and maintains an orderly flow of air traffic.

Audit

A structured and objective assessment that determines the level of conformity with specific standards.

Change Management

A systematic approach to identifying and analyzing internal and external changes with the potential to affect the functionality of an organization, and assess and control the risks associated with such changes.

Compliance

To fulfill, meet or be in accordance with requirements specified in standards or regulations.

Defenses

Specific mitigating actions, preventive controls or recovery measures put in place to prevent the realization of a hazard or its escalation into an undesirable consequence.

Errors

An action or inaction by an operational person that leads to deviations from organizational or operational intentions or expectations.

Emergency Response Plan (ERP)

A formal plan that defines the actions taken following an accident to ensure an orderly and efficient transition from normal to emergency operations, and then safe continuation of operations or the return to normal operations as soon as possible. An ERP specifies the: (a) Delegation of emergency authority and assignment of emergency responsibilities; (b) Authorization for action by key personnel; (c) Coordination of efforts to cope with the emergency.

Fatigue

A physiological state of reduced mental or physical performance capability resulting from sleep loss or extended wakefulness, circadian phase, or workload (mental and/or physical activity) that can impair a crew member’s alertness and ability to safely operate an aircraft or perform safety-related duties.

Fatigue Risk Management System (FRMS)

A data-driven means of continuously monitoring and managing fatigue-related safety risks, based upon scientific principles and knowledge, as well as operational experience that aims to ensure relevant personnel are performing at adequate levels of alertness.

Framework for Safety Management Systems (SMS)

The structure of a safety management system (SMS), published in ICAO Annex 6, comprising the 4 components and 12 elements that define the minimum requirements for SMS implementation.

Hazard (Aircraft Operations)

An existing or potential condition that could lead to or result in injury to or death of persons and/or damage to or loss of an aircraft in operation.

ICAO Annexes

Additional sections to the ICAO Convention which are guidelines, provided for the various national aviation authorities, for use in developing civil aviation rules and regulations that govern flight operations in their respective states.

Quality Management System (QMS)

The aggregate of the organizational activities, plans, policies, procedures, processes, resources, responsibilities, and infrastructure implemented to ensure all operational activities satisfy customer and regulatory requirements. A controlled documentation system is used to reflect the plans, policies, procedures, processes, resources, responsibilities and the infrastructure used to achieve a continuous and consistent implementation and compliance.

Safety (Operational)

A condition in which the risk of injury or damage occurring during operations is limited to an acceptable level.

Safety Action Group (SAG)

A high level tactical committee within an SMS that comprises designated line managers and representatives of front line personnel. It takes strategic direction from the SRB and addresses the implementation and effectiveness of risk control actions in operations. See Safety Management System (SMS) and Safety Review Board (SRB).

Safety Assurance

The component of a Safety Management System that comprises processes for: (a) Safety performance monitoring and measurement; (b) The management of change; (c) Continual improvement of the SMS. See Safety Management System (SMS).

Safety Culture

The extent, to which an organization actively seeks improvements, vigilantly remains aware of hazards, and utilizes systems and tools for continuous monitoring, analysis, and investigation. It includes a shared commitment amongst personnel and management to personal safety responsibilities, confidence in the safety system, and a documented set of rules and policies. The ultimate responsibility for the establishment and adherence to sound safety practices rests with the management of the organization.

Safety Management System (SMS)

A systematic approach to managing safety within an organization, including the necessary organizational structures, accountabilities, policies and procedures. As a minimum, an SMS: (a) Identifies safety hazards; (b) Ensures that remedial action necessary to maintain an acceptable level of safety is implemented; (c) Provides for continuous monitoring and regular assessment of the safety level achieved; and (d) Aims to make continuous improvement to the overall level of safety.

Safety Promotion

The component of an SMS that provides support for the processes associated with safety risk management and safety assurance, and defines: (a) Training and education; (b)Safety communication. See Safety Assurance, Safety Management System (SMS) and Safety Risk Management.

Safety Review Board (SRB)

A strategic committee within an SMS that comprises senior management officials; addresses high level safety issues associated with an operator’s policies, resource allocation and organizational performance monitoring. See Safety Management System (SMS) and Safety Action Group (SAG).

Safety Risk

An assessment, expressed in terms of predicted probability and severity of the consequence(s) of a hazard to aircraft operations, with severity using as a reference the worst foreseeable or credible outcome. See Hazard (Aircraft Operations).

Safety Risk Management

The component of a Safety Management System that comprises: (a) Hazard identification processes; (b) Risk assessment and mitigation processes. See Safety Management System (SMS).

State Safety Program (SSP)

An integrated set of regulations and activities established by a state, aimed at managing civil aviation safety.

Organizational culture

Characteristics and safety perceptions among members interacting within a particular entity. Organizational value systems include prioritization or balancing policies covering areas such as productivity versus quality, safety versus efficiency, financial versus technical, professional versus academic, and enforcement versus corrective action.

Risk mitigation

The process of incorporating defenses or preventive controls to lower the severity and/or likelihood of a hazard’s projected consequence.