Network Rail operates, maintains and enhances Britain’s railway system and associated tracks, signalling system, rail bridges, tunnels, viaducts, level crossings and major stations.
Prior to the implementation of Active Risk Manager, spreadsheets and a legacy bespoke system were used to manage risk across projects on the rail network. There are now in the order of 20,000 risks held in Active Risk Manager ranging across the project, operational and corporate risks areas.
Because of the large number of individual projects, which can vary from hard structural projects such as replacing level crossings and bridges to softer organizational change projects, Network Rail needed easy risk reporting for management at all levels. There are also some mega projects such as the Thameslink upgrade. Therefore, there was a requirement for clear visibility, consistency and ease of reporting across all projects and programes. Having one central automated risk system repository has lead to easier and more accessible reports.
Looking across the board, and having talked to Sword GRC, we felt that ARM was the only suitable product on the market for us. We could see how an enhanced tool like ARM could help us manage and handle risks better – the accountability, better user interface, having identified risk owners and the cascade reporting all captured our interest. This, and feedback from some of our partners on how they used the tool, resulted in our final selection.
We recognized from our gap analysis both from internal consultation and externally with customers that risk management was a priority.
Stating that we use ARM gave them confidence in our approach to risk management, since they were familiar with the Sword GRC solution. In general, we now state in our business proposals that we use ARM to manage and mitigate risks in our internal processes, which endorses our quality certifications.
Operational and Corporate Risk
At Network Rail both Operational and Corporate risk are also managed using Active Risk Manager. Operational risks are regarded as the day to day risks involved in running the railway within a defined geographical area, for example the Thames Valley. These operational risks from across the company are then rolled up to a bigger picture at corporate level.
At Corporate level there are risk registers for all the major functions such as finance, engineering etc and Active Risk Manager allows all the disciplines to combine to give the Board of Directors an amalgamated view. This has lead to the development of consistent processes being introduced across the whole organization again leading to greater visibility and accurate reports. The company won the 2006 Strategic Risk, European Risk Management Award for Enterprise-Wide Risk Management; Active Risk Manager was part of this implementation.
At one point there were more than 52 risk register spreadsheets coming together for Board reporting as part of the integrated risk management process. All of these have been incorporated into Active Risk Manager. This has lead to more effective decision making as the overall view of risk is clearer and allows the consequence of a risk at project level to be seen right the way up to corporate level.
Why was Active Risk Manager Chosen?
At the same time as deploying Active Risk Manager Network Rail undertook a major implementation of a number of project management systems including Oracle Projects, P3e and Pertmaster for risk analysis. Active Risk Manager was selected as it was seen as a complete risk management package capable of integrating with other systems. Just over 2000 ARM licenses have been purchased and so far over 1600 of these have been allocated at project and corporate level.
Charles Longridge, Director of Business Development at Sword GRC concluded, “Through extensive use of Active Risk Manager across the organization Network Rail has managed to create much greater awareness and visibility of risks and the response to them. We look forward to working with Network Rail to extend its reporting capabilities and to continue to see further savings through effective risk management using Active Risk Manager.”