# Presentation: 480715

## National Institutes of Health (NIH)

- Risk Management Program

- ORS - Risk Identification and Scoring Training

- Questions or comments regarding these materials can be directed to RiskProgram@mail.nih.gov.

## Purpose

- This training will provide a basic overview of the NIH Risk Management Program, methodology, and guidance on identifying and scoring risks using a standardized tool.

## Introduction to Risk Management

- A **Risk** is an uncertain event or condition that may have a negative impact on an organization.
- A **Control **is a mechanism, such as policies and procedures, that prevents or reduces the likelihood of a risk occurring.

- A basic example of risk management in our lives is discussed below:

**Risk** = “If I don’t wake up by 6:00, then I will be late for work.”
**Control** = An alarm clock prevents or reduces the likelihood of the risk occurring.

## Introduction to Risk Management

- Some examples of NIH specific risks include:

**Management**
**If** NIH does not perform a physical inventory of government property assets, **then** management will not be able verify the accuracy of records which reflect the status of personal property, or identify misuse, theft, and other losses.
**Intramural**
**If** an IC’s Intramural Research Program animal research activities do not comply with laws, regulations, and policies, **then** NIH can suspend animal activities and withhold PHS funds.
**Extramural**
**If** an IC’s decisions to fund grants out of rank order are not documented, **then** the transparency of grant award decisions is reduced and may call into question the integrity of the overall grant funding process.

## Benefits of Risk Management 

- The NIH Risk Management Program provides a number of benefits to the organization.
- Supports the NIH research mission and vision.
- Provides a cross-cutting look at NIH risks.
- Addresses operational, management and financial risks.
- Identifies risks and proactively manage them.
- Creates an organized and integrated process of evaluating risks, including those that affect the entire agency.
- Provides senior leadership with consistent, prioritized risk information.
- Improves strategic decision making.

## NIH Risk Management - Timeline

- The following timeline shows the major activities of the NIH Risk Management Program.

**June 08**

**July 08**

**Aug 08**

**Sep 08**

**Oct 08**

**Nov 08**

**Dec 08 – Sep 09**

*Identify and *
*Score OD Risks*

*Develop OD Baseline*

*Conduct Assess and *
*Remediate Activities*
*with OD Offices*

*Identify and Score*
*Risks at the ICs*

*Produce Documentation*
*and Lessons Learned*

*Review and Validate*
*OD Risk Information*

## NIH Risk Management Methodology

- Conduct formal reporting activities quarterly and annually.

- The NIH Risk Management Methodology is a customized six step approach that provides a standardized means of addressing risks.

- Identify risks within risk management structure using standardized tools.
- Score risks based on Impact and Likelihood. Plot results on a Risk Heat Map.

- Develop and execute Corrective Action Plans to address control gaps and deficiencies.

- Monitor the Risk Baseline.

- Identify RMOs and RMs. Define Risk Management Structure.

- Determine assessment approach and conduct control assessments.

_**1. Organize **_

_**2. Identify & Score**_

_**3. Assess**_

_**5. Monitor**_

_**4. Remediate**_

_**6. Report**_

## The NIH Risk Management Organization

- NIH is divided into Assessable Units (AUs). An AU is a discrete mission oriented sub-set of an organization.
- At NIH, AUs reflect existing organizational structures to promote accountability.
- The OD is divided into 11 AUs based on the strategic groupings of certain offices. Each of the 27 ICs also represents an AU.

**Assessable Units at NIH**

*** Other OD includes: ORWH, OFACP, ES, OEODM, CCR, OLPA, OCPL, OSP, OPASI, NEO, ODP, OBSSR, OAR.**

## NIH Risk Management Roles and Responsibilities

- Roles of key risk management participants are illustrated below.

**Assessable Unit**

- The Risk Owner (RO) is responsible for all risks that exist within the Assessable Units. In most cases, the RO signs the annual statement of assurance for the organization. The RO may also serve as the RMO in some cases.

- The Risk Management Officer (RMO) oversees and coordinates risk management activities at the Assessable Units.

- Risk Managers (RMs) are selected based on the risk management structure at the AU and report to the RMO. RMs manage risks in their area of the AU.

- Risks are identified during **team sessions** that include the RMO and the RMs.

## Organize - Overview

- The Organize step involves identifying and training personnel with key roles and responsibilities within each AU.
- Your designated RMO has identified the risk management structure to be used and you have been identified as RMs for your specific area.

## Identify and Score - Overview 

- Risk Identification and Scoring involves determining those adverse events that could potentially affect the organization.
- Identifying and scoring risks begins with key personnel from the organization’s risk management structure.
- The RMOs and RMs identify and review the risks as a team.
- Before establishing the risk baseline, OMA meets with RMOs and RMs to review the risks that have been identified.

## 2.1 Identify and Score Risks 

- Risk Managers and a team of subject matter experts identify and score risks affecting the AU or NIH.
- A risk statement should be developed when identifying risks. Risk statements are a detailed description of a potential risk and its perceived effect.
- Developing an “if-then” risk statement is a standardized approach.
- The “if” portion of the risk statement relates to an uncertain event or condition that may occur.
- The “then” portion of the risk statement describes the potential outcome of the risk.

***We will identify and score a sample risk as part of today’s training session.***

## 2.1 Identify and Score Risks - Best Practices 

- Best practices for defining “if-then” statements include:
**Strategic approach:** Consider the goals, objectives, and mission of the organization.
**Materiality:** Risks should be related to the operations of the organization, and they should have potential negative effects that are more than negligible.
**Cause-Effect Relationships**: Consider the types of events or conditions (causes) whose occurrence would have a legitimate negative impact (effect) on the agency.

## 2.1 Identify and Score Risks - Risk Categories

- As risks are identified, they may be logically grouped with other related risks.
- The categories are aligned to major OD and IC functional areas to provide enhanced reporting capabilities to the Risk Management Program.
- The following are examples of potential risk categories used at NIH.

## 2.1 Identify and Score Risks - Tools

- The Risk Capture Form is a standardized tool used to identify and score risks.
- Risk Capture Form demonstration of Risk Identification.

## 2.1 Identify and Score Risks - Tools

- Risks are scored based on two dimensions:
- The **Impact** that a risk could have on the organization.
- The **Likelihood** of the risk occurring.
- The score for each of these factors is calculated based on responses to a set of questions contained in the Risk Capture Form.

## 2.1 Identify and Score Risks - Scoring Impact

- Risks are measured for impact along five dimensions: **Mission Impact,** **Impact on** **Public Trust, Organizational Impact**, **Financial Impact and Professional Judgement**. These five categories contribute to an overall risk impact score.
- Each Impact question has three potential responses.

## 2.1 Identify and Score Risks - Scoring Likelihood

- Likelihood is measured based on responses to six** **questions. These questions attempt to determine the existing controls in place that contribute to the likelihood of a risk being realized.
- Some questions have “Yes/No” responses, while other questions use a scale of four possible responses.

## 2.1 - Identify and Score Risks -Tools

- Risk Capture Form Demonstration of Scoring Impact and Likelihood.

## 2.2 Review Risks

- Once risks have been identified and scored by the RMs, the RMOs review the risks.
- It is recommended that the RMO should conduct a meeting with the team to collectively review and evaluate the identified risks.
- If it is not feasible to conduct a group meeting, RMs should submit their risks to the RMO.
- The RMO coordinates activities between RMs and subject matter experts to review risks and determine if they have been appropriately scored.

## 2.3 Provide Risk Information to OMA

- Once risks are reviewed and approved by the RMO, the data is submitted to OMA.
- OMA consolidates the information and using impact and likelihood scores, risks are plotted accordingly on the Risk Heat Map.
- The Risk Heat Map prioritizes the most critical risks.

## 2.4 Validate Risk Information with OMA and 2.5 Establish Risk Baseline

- Risk validation is the process in which risk data is reviewed, discussed and clarified in order to gain a thorough understanding of the risk before it is finalized.
- OMA validates the information with the RMO, RMs and other key personnel at the AUs once the Risk Heat Map has been compiled.
- A Risk Baseline is established and tracked by OMA.

- A summary of the risk identification and scoring process with recommended guidance is shown in the figure below.

- Identify and Score - Summary

- * Please reference the Risk Management Guidebook for more detail and guidance.

## Next Steps

- The immediate next steps for the OD Baseline Risk Assessment include the following activities.
- Each AU identifies and scores risks as their homework. Information is due to OMA **one month** after today’s training session.
- OMA will aggregate your risk information and plot risks on a risk heat map.
- OMA will review risk information with each AU at the next facilitated meeting.
- OMA will establish the OD Risk Baseline by aggregating the results from all OD Assessable Units.
- OMA will document baseline risk assessment outcomes and communicate results and lessons learned to NIH senior leadership.

## Homework

**RMs identify and score the risks at your organization, using the Excel-based Risk Capture Form.**
**RMO compiles and submits completed Risk Capture Forms, via email to riskprogram@mail.nih.gov by Friday, July 18th.**
**RMO schedules dates and times for your office to attend the next OMA facilitated session.**** **
**For assistance during this process, please contact OMA staff:**
**Jeff Hayden: haydenj@mail.nih.gov**
**Karen Hardy: khardy@mail.nih.gov**
**Marilyn Kinsey: kinseym@mail.nih.gov**

_**Homework**_

## Discussion 

***Are there any additional questions at this time?****** ***