The following is an example of an interview guide we used.
Introduction
1. About us and the project
a. Short presentation about Joel and Håvard b. Short introduction to the master’s thesis c. Anonymity
d. Acceptance for use of recorder
2. General information
a. The interview is anonymous and we want the individual’s honest reflections and opinions about risk management in their organization, not textbook answers.
3. Background of interviewee
a. What is your formal background/education?
b. How long have you been with Avinor?
c. Have you held other positions within Avinor before your current positons – if yes, what were they?
d. Have you held other positions outside of Avinor? If yes, what were they, and for how long?
e. What is your current position – what do you do?
Part 1: Risk management in Avinor
1. Very briefly, how was the transition from reactive issue management to proactive enterprise-wide risk management for you as a manager?
2. Risk process
a. Risk assessment
i. How are risk assessments done at the airport?
ii. How formalized is this process? Guiding principles?
b. Who owns the risks?
c. Risk reporting
i. Who reports what – and to whom?
ii. How often do you report?
iii. How do you report opportunities?
3. Risk and strategy
a. How does the interplay between ERM and strategy work?
i. Feed back both ways? (top down and bottom up)
ii. In Avinor, what is the difference between strategic management and enterprise risk management?
iii. KPI vs risk indicators
Part Two: Risk limits and perception 1. How would you define risk?
a. What are your top risks?
84
i. Are some of them more important than others? (relative exposure) 2. Risk assessment
a. How do you reach consensus about what risks that are most important?
i. Impact
1. How do you determine the impact of a specific risk?
a. Do you think of it as a relative consideration?
ii. Probability
1. How do you determine the uncertainty of a specific risk?
2. What data is acceptable when determining the probability?
3. How do you account for intuition or know-how in the risk assessment process? (subjective)
b. Is it more difficult to reach a common understanding of some types of risks in terms of how they are perceived/understood? (O&R)
c. How do you account for uncertainty? (surprises, black swans)
d. Once you have determined these risks, how do you use them in the management team?
i. Does it contribute to better management?
ii.
3. Risk reporting
a. What does it mean if someone reports red?
i. Unacceptable compared to what? The strategic goal?
ii. Do people use it to flag their concerns?
iii. Is it a way of clearing themselves from responsibilities?
iv. Does norms or culture play any part here?
v.
b. What makes a risk unacceptable (for example red) and where do this unacceptability come from?
i. Declared risk profile/ Safety/HMS/Security/ Environment (preventable risks) ii. Paragraph 10 – plan (commercial initiatives) (Strategic risks)
iii. Bankruptcies/politics/volcano (external risks) 4. Risk limits
a. What implications do such limits have?
i. Does it limit the scope of actions?
b. What is you willingness to take opportunities when you see them? (opportunities) i. How is it encouraged by corporate management?
c. What determines the acceptable level of total risk for your area of responsibly? (Risk appetite)
d. In your opinion, what is the organization’s appetite towards risk taking? (risk appetite)
- er et selskap i NHH-miljøet med oppgave å initiere, organisere og utføre ekstern-finansiert forskning. Norges Handelshøyskole og Stiftelsen SNF er aksjonærer.
Virksomheten drives med basis i egen stab og fagmiljøene ved NHH.
SNF er ett av Norges ledende forsk ningsmiljø innen anvendt økonomisk-administrativ forskning, og har gode samarbeidsrelasjoner til andre forskningsmiljøer i Norge og utlandet. SNF utfører forskning og forsknings baserte utredninger for sentrale beslutningstakere i privat og offentlig sektor. Forskningen organiseres i program-mer og prosjekter av langsiktig og program-mer kortsiktig karakter. Alle publikasjoner er offentlig tilgjengelig.
SNFCENTRE FOR APPLIED RESEARCH AT NHH
- is a company within the NHH group. Its objective is to initiate, organize and conduct externally financed research. The company shareholders are the Norwegian School of Economics (NHH) and the SNF Foundation. Research is carried out by SNF´s own staff as well as faculty members at NHH.
SNF is one of Norway´s leading research environment within applied economic administrative research. It has excellent working relations with other research environments in Norway as well as abroad. SNF conducts research and prepares research-based reports for major decision-makers both in the private and the public sector. Research is organized in programmes and projects on a long-term as well as a short-term basis. All our publications are publicly available.
Samfunns- og næringslivsforskning AS
The purpose of this thesis is to understand the concept of risk appetite in terms of what it is, what institutional pressures influence it, and how it is institutionalized in an organization. We try to understand what risk appetite is by examining the most influential enterprise risk management frameworks, reports from practitioners, and scholarly research on the topic. Through a case study of a large and complex Norwegian organization, we seek to explain what influences and institutionalizes risk appetite. First, we find that there is a consensus in the literature that risk appetite is a top-down element of enterprise risk management, but that there is disagreement as to how quantitatively it is understood and practiced. Second, we find that one cannot decouple risk appetite from its organizational context, as both external and internal institutional pressures influence risk appetite in the organization. Third, we find that risk appetite is not a singular concept in the organization. Risk appetites varies across risk categories, and the institutionalization of risk appetite relies on cultural elements in the organization. Our thesis adds to the understanding of the risk appetite concept, and adds to the scholarly argument that the evolution of risk appetite should go in the direction of addressing human and social behavior. Further, we contribute with a model to analyze institutionalization of risk appetite in organizations.