The Grant Risk Assessment And Management (GRAM ) Tool

3.4 Contributing Factors: In addition to the risk types and the standard risks, thecontributing factors describe the key drivers of each of the 23 standard risks. The success ofthe GRAM depends on the ability of the implementer to take into consideration the keycontributing factors for each risk mentioned in the tool and to complete the risk assessmentwith candour and honesty. Keep in mind, this list is not comprehensive but rather a set ofindicative factors used to help guide implementers which can be found in Annex 2 of thisdocument. Implementers are advised to think through the contributing factors thoroughlyby using the indicated list as a checklist when completing the GRAM.3.5 Risk Heat Map: The tool has been developed using MS excel which consolidates inputsand presents these in several formats to allow validation and prioritization. It thensummarizes the results of the assessment in the form of a heat map as well as a trackingsheet for any actions proposed from the assessment.The various output sheets from the MS Excel Tool should be seen as dynamic products. Assuch, they will be regularly updated to support discussions between implementers, CCM, andCTs on risk and grant management on an ongoing basis.The table below is an example of a generated risk heat map created once all inputs aretracked in the GRAM:3.6Likelihood, Severity and Time HorizonIn order to generate the risk heat map above, GRAM users must assess the 23 standard risksin terms of their Likelihood and Severity. Likelihood refers to the chance that the futurenegative outcome occurs, while Severity refers to the estimated impact of the negativeoutcome assuming it does occur. The purpose of introducing these two dimensions inassessing risks is to:5 Page

improve consistency and granularity ofrisk assessmenttake into account materiality of risksfor more effective prioritization encourage and facilitate robustdiscussionThe Time Horizon over which Likelihood and Severity should be assessed for each risk is thefollowing one year (twelve months) from the date of the assessment. In other words, theuser should be assessing how likely the risk may occur in the coming 12 months, andestimating how severe it would be if it the relevant risks were to occur.Likelihood RatingsWhat is the chance of the risk occurring within the time horizon, based on thecontributing factors?Highly UnlikelyUnlikelyLikelyHighly likelyless than 10%chance ofhappeningbetween 10-40%between 40-70% chance ofhappening 70% chance ofhappeningchance of happeningSeverity RatingsAssuming the risk occurs, how severe is its impact expected to be, based on thecontributing factors?In rating the severity of the risks, consider the impact on the following 4 areas: Wastage of grant funds Poor program performance, data quality, impact or sustainability Negative health outcomes from program activities Reputational issues and threats to future fundingMinorModerateNo or only minor impactexpected in all areasAt most moderate impactexpected in all areasMajorAt most major impactexpected all areasCriticalCritical impact expectedin at least one areaBoth the likelihood and the severity should be assessed based on consideration of thecontributing factors which have been identified as the main drivers or indicators for each ofthe 23 standard risks. The user is also expected to provide a written description to justify thelikelihood rating, severity ratings and the key contributing factors they have selected. If thelowest possible likelihood and/or severity ratings are chosen, no contributing factors need tobe listed (to justify the low ratings). Keep in mind that the tool has a very generic view oflikelihood and severity definition. A written description explaining each determined ratingwill add more value and detail to the assessment.6 Page

The following color-coded heat chart signifies the determined risk rating based on thecombination of the likelihood rating and the severity rating. Likelihood and severity combineto signify the level of risk for each standard risk which is then added the overall heat ySeverityMajorRisk LevelMediumHighVery HighVery High Very HighExample of a combined likelihood& security rating which determinesa risk levelLikelihood4. GRAM Rollout – ProcessFor effective use of the GRAM, the following broad steps are recommended. Please note thatthese steps are general guidelines and at the discretion of implementers. Implementers canadapt this process depending on their preparedness and capacity to effectively integrate riskmanagement into their respective programs. In order to understand the tool fully and cometo an agreement on a realistic “baseline,” implementers will receive training support by CTsor an experienced facilitator who can answer any questions and concerns.4.1 Appreciating the objective of risk assessment: There is usually a sense ofapprehension when it comes to detailing risks affecting the roll out and success of agrant, such as risk ratings related to CCM and GF Secretariat effectiveness, forexample. Some implementers may feel as though providing such information cannegatively impact the CT’s perception of their work. On the contrary however, for theGlobal Fund, knowing and agreeing on the key risks is a constructive and collectiveeffort that should involve many stakeholders (e.g.: partners/CCM/ others) whosupport in finding solutions and mitigating risks. Therefore, providing as muchhonest information as possible will strengthen risk mitigation measures for all actorsinvolved in the grant management and risk management process.4.2 PR preparedness to undertake a risk assessment. The use of the GRAMitself will be a self-assessment. However, some prior review of contributing factors orrisk will prepare implementers for the GRAM workshop.7 Page

4.3 Risk Self-Assessment – In preparation for the workshop, implementers areencouraged to conduct their own risk self-assessments. The objective of the selfassessment is to have better alignment within an implementer on the key risks andshould facilitate better focus during the GRAM workshop discussions. A risk selfassessment template is attached in Annex 1.4.4 Workshop: The GF CTs or an experienced consultant will facilitate an incountry workshop on how to use the GRAM tool. This brief, two-day workshop willallow in-country implementers, PRs and CCM to familiarise themselves with the tooland a chance for initial stakeholder dialogue on how to appropriately administer riskassessments.During a scheduled in-country workshop, implementers will be introduced to the GRAMtool. There are four main steps to completing the GRAM which will be described andenacted during the proposed workshop.1.2.3.4.Fill in the specific contextual information in the General Info sheet Assess risks and propose actions in the four risk and action input sheets (i) Programmatic & Performance, (ii) Fiduciary & Financial, (iii) HealthServices & Products, (iv) Governance, Oversight & ManagementRate Likelihood and Severity for each riskExplain the Likelihood and Severity ratings and the most significant causes foreach riskWhere appropriate, propose actions to prevent and/or mitigate risks Use the Risk Heat Map to validate the risk assessment across the differentareas and to prioritize risks to address through action planning. Use the Action Tracker sheet to decide which actions to pursue to addresskey risks, and input the relevant tracking information next to these:existing actions, cost, source of resources, responsible personAfter becoming familiar with the GRAM tool, participants of the workshop will complete thetool and share their completed GRAM including the risk heat map and proposed action planto the group for further understanding and discussion. It is possible that the workshop willidentify risks and possible mitigating strategies whichKEEP IN MIND: The workshop isrequire further information or consultation before thegenerally a one-time activity tostrategy can be confirmed. For instance, a proposedintroduce the tool and trainstrategy may require consultation with external agenciesimplementers on its use. A keyor ministries to develop a coordinated approach toobjective of the workshop is toreducing a specific risk. Therefore, some follow-up mayplan to update the tool regularlybe required prior to the GRAM tool being finalized.and use the information from itAdditionally, it may be critical that senior managementfor decision making purposes.collate and review the recommended actions forconsistency, calibration and to identify linkages withother activity underway in the country. This may lead to8 Page

identification of 10-15 priority actions. Accordingly, at the end of the workshop, it may beappropriate to schedule a follow-up meeting, possibly in one or two week’s time, when thefinal GRAM action plan is confirmed.During the workshop, implementers will be provided contact information and follow-upguidance so as to ensure that the GRAM tool can be an effective and sustainable tool for GFimplementers.NOTE: Careful consideration needs to be given to how many grants should be covered in asingle workshop. This will vary considerably dependent upon the grant and country context.While grants may have common risks, obviously programmatic risks may vary considerablyand including all grants in a single workshop may result in “nuances” between grants beinglost. On the other hand, there can be valuable insights gained by sharing ideas betweengrants4.5 Follow up: During the workshop, stakeholders willdiscuss and come to an agreement concerning a number ofpoints. After the workshop, implementers should be inagreement and aware of:REMEMBER: Jointprioritization of a shortlist ofactions and follow up points isa key for effective riskmanagement1. Time frames for completing the assessment of the fullportfolio2. Ways of ensuring quality check and validation3. Identification of point persons in each implementer who can support on-goingimplementation of this.4. Overall frequency of updates of GRAM (recommended every 6 months – along withthe disbursement request)5. Next grant milestone which will provide an update on the implementation of the riskmitigation and prevention actions.Refer to the chart below that describes the risk assessment follow up process:In country workshop /discussions Done byimplementerGrant Risk SelfAssessment9 Page Sharing GF perspectives Sharing of Grant risk self- assessmentoutcome Partners experience Introduction to tools Group work - use of tools (facilitated bythe Country Team) Sharing of Group work outcome Alignment of Risk Prevention mitigationmechanisms between CT, LFA andimplementer Instituting amechanism tosupport theimplementers infollow ups andintegration ofrisk assessmentin grantmanagementImplementer ownedfollow up mechanism

REMEMBER: The GRAM is a simple tool for implementers who wish to introduce amechanism for prioritizing action for risk management and for detailing risk mitigationmeasures for their grants. All implementers are expected to have comprehensive riskmanagement plans as part of effective grant governance.5. Annexures Annex 1: Self-Assessment TemplateAnnex 2: Risk and indicative list of major contributing factorsAnnex 1: Self-assessment TemplateGrant Risk self-assessment(This template captures discussions within the implementer on various risks as perceivedby them at a grant level).Name of the PR Grant No: .Definition: Operational risk is the possibility of reduced program impact, not achieving targets,and/or wastage or misuse of resources due to specific processes or actors in our PerformanceBased Funding model not operating as intended. In this framework a risk is a future adverseoutcome which the PR is seeking to avoid in a given GrantProgrammatic & Performance RisksThis is a broad area encompassing programmatic, monitoring and evaluation and performancerelated risks. Typically, this includes risks related to grants and the broader programs havinglimited relevance in relation to epidemiological and programmatic context, not being aligned tothe national context, systems and other donors, and other aspects which may impede relevanceor sustainability. In addition, issues related to inadequate monitoring and valuation and dataquality should also be considered in this section. Finally, key drivers of the risk that the grantdoes not achieve targets agreed in the Performance Framework or longer-term impact should beexplored.10 P a g e

Brainstorming: Where are the risks in this area that you foresee for a period ofnext 12 months? Please provide specific details of the risk that youidentified by listing the contributing factors.Guidance: Please try to elicit the contributing factors and consequencesi.e. risks. Please find some examples of two 2 risks identified (e.g.: (i)misalignment between proposal objectives and program strategies leading to the riskof not achieving the impact, (ii)Malfunctioning HMIS (Health ManagementInformation System), unfilled vacancies, inadequate training of existing data entryoperators contributing to inaccurate data collection from ARV centres etc.)123456Priority: From the above, please select three most important risks (i.e. have a high likelihoodor a high negative impact or both)?123Management: What can you do to avoid these risks or mitigate their impact? (Please specifythe action, timeframe, person(s) responsible)Risk 1 : Action 1Action 2Action 3Risk 2 Action 1Action 2Action 3Risk 3 Action 1Action 2Action 311 P a g e

Fiduciary & Financial RisksFiduciary and financial risks address the possibility of funds and other resources not being usedfor the intended purposes, according to policies, or efficiently, or not being properly recorded,accounted for or reported. This area therefore includes financial management and fiduciarycontrol risks such as: low or ineffective absorption of funds; weak internal controls and the risk offraud, corruption, theft or diversion of funds or non-financial assets including pharmaceuticalsand health products and equipment; and wastage of funds or non-financial assets due to poormanagement by implementing entities, foreign exchange or market price changes. Risks relatedto financial misreporting should also be explored here.Brainstorming: Where are the risks in this area in the next 12 months? Please providespecific details of the risk that you identified by listing the contributing factors. (E.g.Insufficient understanding of Global Fund reporting requirements, inadequatefinancial accounting software, lack of management supervision over financial systemleading to the inadequate Financial Reporting)Guidance: Please try to elicit the contributing factors and consequences i.e. risks.12345Priority: From the above, please select three most important risks (i.e. have a high likelihoodor a high negative impact or both)?123Management: What can you do to avoid these risks or mitigate their impact? (Please specifythe action, timeframe, person(s) responsible)Risk 1 Action 1Action 2Action 3Risk 2 Action 1Action 2Action 3Risk 3 Action 1Action 2Action 312 P a g e

Health Services & Health Products Quality RisksBroadly, this risk area is defined as risks related to quality and accessibility of health servicesprovided to beneficiaries. This includes risks related to timeliness, safety, quality, andaccessibility of health services, including pharmaceuticals and health products and equipment,negatively impacting beneficiaries and key populations. Risks of diagnostic or treatmentdisruptions including supply chain management issues should be considered here.Additionally, human rights barriers may impede access to health services. Human rights risksarising from the operating context as well as risks of rights violations affecting grant recipientsshould be considered.Brainstorming: Where are the risks in this area in the next 12 months?Please provide specific details of the risk that you identified by listing the contributingfactors. (E.g. Lack of reliable consumption data, inadequate MIS and lack of coordinationand reconciliation between inventory and patient information to leading to inadequateforecasting and quantification for 2013 )Guidance: Please try to elicit the contributing factors and consequences i.e. risks.12345Priority: From the above, please select three most important risks (i.e. have a high likelihoodor a high negative impact or both)?123Management: What can you do to avoid these risks or mitigate their impact? (Please specifythe action, timeframe, person(s) responsible)Risk 1 Action 1Action 2Action 3Risk 2 Action 1Action 2Action 3Risk 3 Action 1Action 213 P a g e

Action 3Governance, Oversight & Management RisksThese risks relate to inadequate governance, oversight and monitoring, or program andgrant management including complying with Global Fund policies and reportingrequirements. Governance encompasses effective institutional structures and leadership,management of competing interests and stakeholders, and sufficient management controlsand information of the organization's activities and staff as well as key partners to ensuresatisfaction of the organization's objectives. Oversight relates to the ability of the overseeingbody or actor to proactively identify and rectify issues that can materially impact attainmentof these objectives, and can range from audit, inspection and investigation, to evaluation andmonitoring, to Whererisk torming:are the risksin this areain theandnextgrant12 months?Pleaserisksprovideconsiderthe quality,timeliness,complianceby CCM, PR,factors.SR, LFAand thespecificdetailsof the riskthat youefficiencyidentifiedandby listingthe contributing(e.g.:Global FundSecretariat,withGlobalFund policiesand of theCCMoversightcommittee,definedoversight plansand lack of proactive upwards reporting by PR to CCM leading to inadequate CCMgovernance and oversight )Guidance: Please try to elicit the contributing factors and consequences i.e. risks.Inadequate CCM Governance & Oversight12345Priority: From the above, please select three most important risks (i.e. have a high likelihoodor a high negative impact or both)?123Management: What can you do to avoid these risks or mitigate their impact?Risk 1 Action 1Action 2Action 3Risk 2 Action 1Action 2Action 3Risk 3 14 P a g e

Action 1Action 2Action 3Annex 2: Major Contributing Factor

assessment tools. The Global Fund has developed one such qualitative risk assessment tool for its in-country implementers. The following document explains the rationale and processes for developing in-country risk management plans using the Global Fund's qualitative risk assessment tool known as GRAM. 2.