Fundamentals of Risk Management

Risk strategy
228
However, there is a further consideration related to projects and that is the effec-
tiveness of enhancements to core processes that the project is designed to deliver. 
There is little benefit in having a project delivered on time, within budget and to 
specification if the required increase in core process effectiveness and/or efficiency is 
not achieved. For example, the installation of a new business software system may 
be undertaken by a successful project, but if the new software system is inadequate, 
or does not deliver all of the additional benefits anticipated, then the improvement 
in business core processes may not have been achieved.
The main risk management inputs into tactics and projects will be risk assessment, 
risk response enhancement and the review and monitoring activities. The purpose in 
undertaking a risk assessment of a project is to identify necessary controls. When 
these controls have been implemented, the effectiveness and efficiency of the controls 
will need to be reviewed. Overall, the intention is to ensure that tactics and projects 
are themselves effective and efficient.
Effective tactics mean that the core processes are the correct ones for delivering 
what is required. Established core processes may be fully efficient, but that does not 
mean that they are the correct or most effective core processes that the organization 
could employ. In order to ensure that core processes are fully effective, change will be 
required by way of projects that will be designed to ensure that strategy is delivered.
Developing more effective core processes will be the way by which the organiza-
tion ensures that it continues to satisfy customers, financiers and other stakeholders. 
In order to ensure that effective core processes are in place, the business model and 
business objectives may need to change.