Enterprise Risk Management: Selected Agencies' Experiences Illustrate Good Practices in Managing Risk
Published: 2016-12-01T00:00:00

Fast Facts:
Federal managers often handle complex and risky missions, such as preparing for and responding to natural disasters, and building and managing safe transportation systems. While it is not possible to eliminate all uncertainties in these types of projects, there are strategies that can help plan and manage them.
One such strategy is Enterprise Risk Management. It provides ways to better anticipate and manage risk across an agency. Our enterprise risk management framework has 6 essential elements to consider when implementing ERM, as shown below. We also identified good practices, as well as examples from federal agencies that are using ERM.

Highlights:
section_title: Why GAO Did This Study
paragraphs: Federal leaders are responsible for managing complex and risky missions. ERM is a way to assist agencies with managing risk across the organization. In July 2016, the Office of Management and Budget (OMB) issued an updated circular requiring federal agencies to implement ERM to ensure federal managers are effectively managing risks that could affect the achievement of agency strategic objectives.
GAO's objectives were to (1) update its risk management framework to more fully include evolving requirements and essential elements for federal enterprise risk management, and (2) identify good practices that selected agencies have taken that illustrate those essential elements.
GAO reviewed literature to identify good ERM practices that generally aligned with the essential elements and validated these with subject matter specialists.
GAO also interviewed officials representing the 24 Chief Financial Officer (CFO) Act agencies about ERM activities and reviewed documentation where available to corroborate officials' statements. GAO studied agencies' practices using ERM and selected examples that best illustrated the essential elements and good practices of ERM.
GAO provided a draft of this report to OMB and the 24 CFO Act agencies for review and comment. OMB generally agreed with the report. Of the CFO act agencies, 12 provided technical comments, which GAO included as appropriate; the others did not provide any comments.
section_title: What GAO Found
paragraphs: Enterprise Risk Management (ERM) is a forward-looking management approach that allows agencies to assess threats and opportunities that could affect the achievement of its goals. While there are a number of different frameworks for ERM, the figure below lists essential elements for an agency to carry out ERM effectively. GAO reviewed its risk management framework and incorporated changes to better address recent and emerging federal experience with ERM and identify the essential elements of ERM as shown below.
GAO has identified six good practices to use when implementing ERM.

section_title: Letter
paragraphs: Federal government leaders manage complex and inherently risky  missions across their organizations, such as protecting Americans from  health threats, preparing for and responding to natural disasters, building  and managing safe transportation systems, advancing scientific discovery  and space exploration, maintaining a safe workplace, and addressing  security threats. Managing these and other complex challenges, requires  effective leadership and management tools and commitment to delivering  successful outcomes in highly uncertain environments.
While it is not possible to eliminate all uncertainties, it is possible to put in  place strategies to better plan for and manage them. Enterprise Risk  Management (ERM) is one tool that can assist federal leaders in  anticipating and managing risks, as well as considering how multiple risks  in their agency can present even greater challenges and opportunities  when examined as a whole. Risk is the effect of uncertainty on objectives  with the potential for either a negative outcome or a positive outcome or  opportunity. The Office of Management and Budget (OMB) defines ERM  as an effective agency-wide approach to addressing the full spectrum of  the organization’s significant internal and external risks by understanding  the combined impact of risks as an interrelated portfolio, rather than  addressing risks only within silos. An example of an agency enterprise  risk is unfilled mission critical positions across the entire organization that  when examined as a whole could threaten the accomplishment of the  mission.
We first issued our risk management framework in 2005 related to  homeland security efforts for assessing threats and taking appropriate  steps to deal with them. At that time, there was no established  universally agreed upon set of requirements or processes for a risk  management framework specifically related to homeland security and  combating terrorism. We developed the 2005 framework with five major  phases that helped us assess how the Department of Homeland Security  (DHS) was applying risk management.
In July 2016, OMB issued an update to Circular A-123 requiring federal  agencies to implement ERM to better ensure their managers are  effectively managing risks that could affect the achievement of agency  strategic objectives. Even before OMB required agencies to adopt ERM,  several agencies, after facing significant risks to their mission, were  implementing ERM to address risk-based issues and improve their ability  to respond to future risks. For example:
The Office of Federal Student Aid (FSA) in the Department of  Education (Education) adopted ERM in 2004, in part, according to  documents we reviewed, to help address long-standing risks including  poor financial management and internal controls, which led us to  place it on our High-Risk List between 1990 and 2005.
The Internal Revenue Service (IRS) adopted an ERM program in  2013 to address issues related to the review of tax-exempt  applications cited in a Department of the Treasury (Treasury)  Inspector General for Tax Administration report that would improve  IRS operations broadly, as well as provide a common framework for  capturing, reporting, and addressing risk areas, and improve the  timeliness of reporting identified risks to the IRS Commissioner, IRS  leaders, and external stakeholders, such as Congress.
The Office of Public and Indian Housing (PIH) at the Department of  Housing and Urban Development (HUD) finalized its ERM framework  and implementation plans in 2014. This was done in response to  several high profile financial and compliance issues with public  housing authorities, as well as concerns over the completeness of its  Federal Managers' Financial Integrity Act (FMFIA) certifications  including internal controls and risk management practices, according  to agency officials.
We performed our work for this report under the authority of the  Comptroller General to conduct evaluations to assist Congress with its  oversight responsibilities. Our objectives were to (1) update our risk  management framework to more fully include evolving requirements and  essential elements for federal ERM, and (2) identify good practices that  selected agencies were taking that illustrate those essential elements. We  also considered views of subject matter specialists with current  experience in ERM. See appendix I for the list of subject matter  specialists who advised us in our review of the practices.
To adapt our 2005 risk management framework to focus on ERM, we  identified essential elements needed to execute ERM and assist agencies  as they implement and sustain their ERM programs that are generally  consistent with other commonly used ERM frameworks, such as the ISO  31000 Risk Management Principles and Guidelines and the 2004 COSO  Enterprise Risk Management - Integrated Framework.  When we shared  these essential elements with subject matter specialists, they confirmed  that they represent the critical elements of the ERM process.
To identify good practices in using ERM, we analyzed and synthesized  ERM literature using ProQuest, First Search, and Scopus bibliographic  databases in public and business sources. We validated these good  practices with subject matter specialists with knowledge specific to the  use of ERM in government settings, and, based on their suggestions, we  refined the practices. We then considered the essential elements of ERM  relative to our identified good practices and determined how these  practices generally fit with the essential elements as a way to assist  agencies as they implemented ERM.
To identify what agencies were doing consistent with our essential  elements and how their good practices were used in implementing ERM,  we used a semi-structured interview protocol and spoke with officials  representing 21 of the 24 executive branch agencies covered in the Chief  Financial Officers (CFO) Act of 1990, as amended. Three agencies did  not participate in interviews but provided us with written responses to our  questions, including the Departments of Agriculture and the Interior and  the Social Security Administration. We asked each of the 24 agencies  whether or not the agency had ERM in place and their perspectives on  ERM.
To identify case illustrations of the good practices, we reviewed  information from agency interviews and documentation they provided  about their ERM practices. From the ERM practices of 24 CFO Act  agencies and their component agencies, we selected examples that best  illustrated our essential elements and good practices. In conducting the  case illustrations, we interviewed agency officials and reviewed agency  documentation about their use of ERM. We selected examples from nine  agencies including the Department of Commerce (Commerce) and its  component bureaus the National Institute of Standards and Technology  (NIST) and the National Oceanic and Atmospheric Administration  (NOAA), DHS’s Transportation Security Administration (TSA), PIH, the  Office of Personnel Management (OPM), Treasury and the IRS, and FSA.
We also interviewed OMB officials from the offices involved in the update  of Circular A-123, the Office of Performance and Personnel Management  and the Office of Federal Financial Management, to gain their  perspectives on agencies’ implementation of ERM.
We conducted this performance audit from June 2015 to December 2016  in accordance with generally accepted government auditing standards.
Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: ERM allows management to understand an organization’s portfolio of top- risk exposures, which could affect the organization’s success in meeting  its goal. As such, ERM is a decision-making tool that allows leadership to  view risks from across an organization’s portfolio of responsibilities. ERM  recognizes how risks interact (i.e., how one risk can magnify or offset  another risk), and also examines the interaction of risk treatments  (actions taken to address a risk), such as acceptance or avoidance. For  example, treatment of one risk in one part of the organization can create  a new risk elsewhere or can affect the effectiveness of the risk treatment  applied to another risk. ERM is part of overall organizational governance  and accountability functions and encompasses all areas where an  organization is exposed to risk (financial, operational, reporting,  compliance, governance, strategic, reputation, etc.).
In July 2016, OMB updated its Circular No. A-123 guidance to establish  management’s responsibilities for ERM, as well as updates to internal  control in accordance with Standards for Internal Control in the Federal  Government. OMB also updated Circular No. A-11, Preparation,  Submission, and Execution of the Budget in 2016 and refers agencies to  Circular No. A-123 for implementation requirements for ERM. Circular  No. A-123 guides agencies on how to integrate organizational  performance and ERM to yield an “enterprise-wide, strategically-aligned  portfolio view of organizational challenges that provides better insight  about how to most effectively prioritize resource allocations to ensure  successful mission delivery.” The updated requirements in Circulars A- 123 and A-11 help modernize existing management efforts by requiring  agencies to implement an ERM capability coordinated with the strategic  planning and strategic review process established by the GPRA  Modernization Act of 2010 (GPRAMA), and with the internal control  processes required by the FMFIA and in our Standards for Internal  Control in the Federal Government. This integrated governance  structure is designed to improve mission delivery, reduce costs, and focus  corrective actions towards key risks.
More specifically, Circular No. A-123 discusses both internal control and  ERM and how these fit together to manage agency risks. Our Standards  for Internal Control in the Federal Government describes internal control  as a process put in place by an entity’s oversight body, management, and  other personnel that provides reasonable assurance that objectives  related to operations, compliance, and reporting will be achieved, and  serves as the first line of defense in safeguarding assets. Internal  control is also part of ERM and used to manage or reduce risks in an  organization. Prior to implementing ERM, risk management focused on  traditional internal control concepts to managing risk exposures. Beyond  traditional internal controls, ERM promotes risk management by  considering its effect across the entire organization and how it may  interact with other identified risks. Additionally, ERM also addresses  other topics such as setting strategy, governance, communicating with  stakeholders, and measuring performance, and its principles apply at all  levels of the organization and across all functions.
Implementation of OMB circulars is expected to engage all agency  management, beyond the traditional ownership of A-123 by the Chief  Financial Officer community. According to the A-123 Circular, it requires  leadership from the agency Chief Operating Officer (COO) and  Performance Improvement Officer (PIO) or other senior official with  responsibility for the enterprise, and close collaboration across all agency  mission and mission-support functions. The A-123 guidance also  requires agencies to create a risk profile that helps them identify and  assess risks arising from mission and mission-support operations, and  consider those risks as part of the annual strategic review process.  Circular A-123 requires that agencies’ risk profiles include risks to  strategic, operations, reporting and compliance objectives.
A federal interagency group of ERM practitioners developed a Playbook  released through the Performance Improvement Council (PIC) and the  Chief Financial Officers Council (CFOC) in July 2016 to provide federal  agencies with a resource to support ERM. In particular, the Playbook  assists them in implementing the required elements in the updated A-123  Circular.
section_title: Updated ERM Framework Provides Assistance to Agencies as They Implement ERM
paragraphs: To assist agencies in better assessing challenges and opportunities from  an enterprise-wide view, we have updated our risk management  framework first published in 2005 to more fully include recent experience  and guidance, as well as specific enterprise-wide elements. As  mentioned previously, our 2005 risk management framework was  developed in the context of risks associated with homeland security and  combating terrorism. However, increased attention to ERM concepts and  their applicability to all federal agencies and missions led us to revise our  risk framework to incorporate ERM concepts that can help leaders better  address uncertainties in the federal environment, changing and more  complex operating environments due to technology and other global  factors, the passage of GPRAMA and its focus on overall performance  improvement, and stakeholders seeking greater transparency and  accountability. For many similar reasons, the Committee of Sponsoring  Organizations of the Treadway Commission (COSO) initiated an effort to  update its ERM framework for 2016, and the International Organization  for Standardization (ISO) plans to update its ERM framework in 2017.  Further, as noted, OMB has now incorporated ERM into Circulars A-11  and A-123 to help improve overall agency performance.
We identified six essential elements to assist federal agencies as they  move forward with ERM implementation. Figure 1 below shows how  ERM’s essential elements fit together to form a continuing process for  managing enterprise risks. The absence of any one of the elements  below would likely result in an agency incompletely identifying and  managing enterprise risk. For example, if an agency did not monitor risks,  then it would have no way to ensure that it had responded to risks  successfully. There is no “one right” ERM framework that all organizations  should adopt. However, agencies should include certain essential  elements in their ERM program.
Below we describe each essential element in more detail, why it is  important, and some actions necessary to successfully build an ERM  program.  1.  Align the ERM process to agency goals and objectives. Ensure  the ERM process maximizes the achievement of agency mission and  results. Agency leaders examine strategic objectives by regularly  considering how uncertainties, both risks and opportunities, could  affect the agency’s ability to achieve its mission. ERM subject matter  specialists confirmed that this element is critical because the ERM  process should support the achievement of agency goals and  objectives and provide value for the organization and its stakeholders.  By aligning the ERM process to the agency mission, agency leaders  can address risks via an enterprise-wide, strategically-aligned portfolio  rather than addressing individual risks within silos. Thus, agency  leaders can make better, more effective decisions when prioritizing  risks and allocating resources to manage risks to mission delivery.  While leadership is integral throughout the ERM process, it is an  especially critical component of aligning ERM to agency goals and  objectives because senior leaders have an active role in strategic  planning and accountability for results.  2.  Identify risks. Assemble a comprehensive list of risks, both threats  and opportunities, that could affect the agency from achieving its  goals and objectives. This element of ERM systematically identifies  the sources of risks as they relate to strategic objectives by examining  internal and external factors that could affect their accomplishment. It  is important that risks either can be opportunities for, or threats to,  accomplishing strategic objectives. The literature we reviewed, as well  as subject matter specialists, pointed out that identifying risks in any  organization is challenging for employees, as they may be concerned  about reprisals for highlighting "bad news."   Risks to objectives can often be grouped by type or category. For  example, a number of risks may be grouped together in categories  such as strategic, program, operational, reporting, reputational,  technological, etc. Categorizing risks can help agency leaders see  how risks relate and to what extent the sources of the risks are  similar. The risks are linked to relevant strategic objectives and  documented in a risk register or some other comprehensive format  that also identifies the relevant source and a risk owner to manage the  treatment of the risk. Comprehensive risk identification is critical even  if the agency does not control the source of the risk. The literature and  subject matter specialists we consulted told us that it is important to  build a culture where all employees can effectively raise risks. It is  also important for the risk owner to be the person who is most  knowledgeable about the risk, as this person is likely to have the most  insight about appropriate ways to treat the risk.   3.  Assess risks. Examine risks considering both the likelihood of the  risk and the impact of the risk on the mission to help prioritize risk  response. Agency leaders, risk owners, and subject matter experts  assess each risk by assigning the likelihood of the risk’s occurrence  and the potential impact if the risk occurs. It is important to use the  best information available to make the risk assessment as realistic as  possible. Risk owners may be in the best position to assess risks.  Risks are ranked based on organizational priorities in relation to  strategic objectives. Risks are ranked based on organizational  priorities in relation to strategic objectives. Agencies need to be  familiar with the strengths of their internal control when assessing  risks to determine whether the likelihood of a risk event is higher or  lower based on the level of uncertainty within the existing control  environment. Senior leaders determine if a risk requires treatment or  not. Some identified risks may not require treatment at all because  they fall within the agency's risk appetite, defined as how much risk  the organization is willing to accept relative to mission achievement.  The literature we reviewed and subject matter specialists noted that  integrating ERM efforts with strategic planning and organizational  performance management would help an organization more  effectively assess its risks with respect to the impact on the mission.   4.  Select risk response. Select a risk treatment response (based on  risk appetite) including acceptance, avoidance, reduction, sharing, or  transfer. Agency leaders review the prioritized list of risks and select  the most appropriate treatment strategy to manage the risk. When  selecting the risk response, subject matter experts noted that it is  important to involve stakeholders that may also be affected, not only  by the risk, but also by the risk treatment. Subject matter specialists  also told us that when agencies discuss proposed risk treatments,  they should also consider treatment costs and benefits. Not all  treatment strategies manage the risk entirely; there may be some  residual risk after the risk treatment is applied. Senior leaders need to  decide if the residual risk is within their risk appetite and if additional  treatment will be required. The risk response should also fit into the  management structure, culture, and processes of the agency, so that  ERM becomes an integral part of regular management functions. One  subject matter specialist suggested that maximize opportunity should  also be included as a risk treatment response, so that leaders may  capture the positive outcomes or opportunities associated with some  risks.   5.  Monitor Risks. Monitor how risks are changing and if responses are  successful. After implementing the risk response, agencies must  monitor the risk to help ensure that the entire risk management  process remains current and relevant. The literature we reviewed also  suggests using a risk register or other comprehensive risk report to  track the success of the treatment for managing the risk. Senior  leaders and risk owners review the effectiveness of the selected risk  treatment and change the risk response as necessary. Subject matter  specialists noted that a good practice includes continuously  monitoring and managing risks. Monitoring should be a planned part  of the ERM process and can involve regular checking as part of  management processes or part of a periodic risk review. Senior  leaders also could use performance measures to help track the  success of the treatment, and if it has had the desired effect on the  mission.   6.  Communicate and Report on Risks. Communicate risks with  stakeholders and report on the status of addressing the risks.  Communicating and reporting risk information informs agency  stakeholders about the status of identified risks and their associated  treatments, and assures them that agency leaders are managing risk  effectively. In a federal setting, communicating risk is important  because of the additional transparency expected by Congress,  taxpayers, and other relevant stakeholders. Communicating risk  information through a dedicated risk management report or integrating  risk information into existing organizational performance management  reports, such as the annual performance and accountability report,  may be useful ways of sharing progress on the management of risk.  The literature we reviewed showed and subject matter specialists  confirmed that sharing risk information is a good practice. However,  concerns may arise about sharing overly specific information or risk  responses that would rely on sensitive information. Safeguards should  be put in place to help secure information that requires careful  management, such as information that could jeopardize security,  safety, health, or fraud prevention efforts. In this case, agencies can  help alleviate concerns by establishing safeguards, such as  communicating risk information only to appropriate parties, encrypting  sensitive data, authorizing users' level of rights and privileges, and  providing information on a need-to-know basis.
section_title: Emerging Good Practices Are Being Used at Selected Agencies to Implement ERM
paragraphs: We identified six good practices that nine agencies are implementing that  illustrate ERM’s essential elements. The selected good practices are not  all inclusive, but represent steps that federal agencies can take to initiate  and sustain an effective ERM process, as well as practices that can apply  to more advanced agencies as their ERM processes mature. We expect  that as federal experiences with ERM evolve, we will be able to refine  these practices and identify additional ones.
Below in table 1, we identify the essential elements of ERM and the good  practices that support each particular element that agencies can use to  support their ERM programs. The essential elements define what ERM is  and the good practices and case illustrations described in more detail  later in this report provide ways that agencies can effectively implement  ERM. The good practices may fit with more than one essential element,  but are shown in the table next to the element to which they most closely  relate.
subsections: section_title: Good Practice: Guide and Sustain ERM Strategy through Leadership Engagement
paragraphs: The following examples illustrate how selected agencies are guiding and  sustaining ERM strategy through leadership engagement. These include  how they have: designated an ERM leader or leaders  committed organization resources to support ERM, and  set organizational risk appetite.
This good practice relates most closely to Align ERM Process to Goals  and Objectives as shown in table 1.
subsections: section_title: TSA’s ERM Process Is Led by a Chief Risk Officer and Senior-Level Executive Risk Steering Committee
paragraphs: According to the Chief Financial Officer’s Council (CFOC) and  Performance Improvement Council (PIC) Playbook, strong leadership at  the top of the organization, including active participation in oversight, is  extremely important for achieving success in an ERM program. To  manage ERM activities, leadership may choose to designate a Chief Risk  Officer (CRO) or other risk champion to demonstrate the importance of  risk management to the agency and to implement and manage an  effective ERM process across the agency. The CRO role includes leading  the ERM process; involving those that need to participate and holding  them accountable; ensuring that ERM reviews take place regularly;  obtaining resources, such as data and staff support if needed; and  ensuring that risks are communicated appropriately to internal and  external stakeholders, among other things. For example, at TSA, the  CRO serves as the principal advisor on all risks that could affect TSA’s  ability to perform its mission, according to the August 2014 TSA ERM  Policy Manual. The CRO reports directly to the TSA Administrator and the  Deputy Administrator. In conjunction with the Executive Risk Steering  Committee (ERSC) composed of Assistant Administrators who lead  TSA’s program and management offices, the CRO leads TSA in  conducting regular enterprise risk assessments of TSA business  processes or programs, and overseeing processes that identify, assess,  prioritize, respond to, and monitor enterprise risks.
Specifically, the August 2014 TSA ERM Policy Manual describes ERSC’s  role to “oversee the development and implementation of processes used  to analyze, prioritize, and address risks across the agency including  terrorism threats facing the transportation sector, along with non- operational risks that could impede its ability to achieve its strategic  objectives.” The TSA CRO told us that its ERSC provides an opportunity  for all Assistant Administrators to get together to have risk conversations.  For example, the CRO recently recommended that the ERSC add  implementation of the agency’s new financial management system to the  risk register.
According to the CRO, the system’s implementation was viewed as the  responsibility of the Chief Financial Officer (CFO) and Chief Information  Officer (CIO). However, the implementation needed to be managed at the  enterprise-level because if it was not successfully implemented, the entire  enterprise would be affected. The CRO proposed adding the  implementation of the new financial management system to the TSA risk  register to give the issue broader visibility. The ERSC unanimously  concurred with the recommendation, and staff from the Office of Finance  and Administration—the risk owner—will brief the ERSC periodically on  the status of the effort.
According to TSA’s ERM Policy Manual, the CRO leads the overall ERM  process, while the ERSC brings knowledge and expertise from their  individual organizations to help identify and prioritize risks and  opportunities of TSA’s overall approach to operations. While the CRO and  ERSC play critical roles in ERM oversight, the relevant program offices  still own risks and execute risk management, according to the TSA ERM  Policy Manual.
section_title: FSA Committed Resources to Support ERM
paragraphs: To launch and sustain a successful ERM program, organizational  resources are needed to help implement leadership’s vision of ERM for  the agency and ensure its ongoing effectiveness. For example, when FSA  began its ERM program in 2004, the Chief Operating Officer (COO)  decided to hire a CRO and give him full responsibility to establish the  ERM organization and program and implement it across the organization.  According to documents we reviewed, the CRO dedicated resources to  define the goal and purpose of the ERM program and met with key  leaders across the agency to socialize the program. Agency leadership  hired staff to establish the ERM program and provided risk management  training to business unit senior leaders and their respective staff. Our  review of documents shows that the FSA continues to provide ERM  training to senior staff and all FSA employees and also participates in an  annual FSA Day, so employees can learn more about all business units  across FSA including the Risk Management Office and its ERM  implementation. In September 2016, the FSA CRO told us that the Risk  Management Office had a staff of 19 full-time equivalent (FTE)  employees. FSA continues to provide resources to its ERM program  and has subsequently structured its leadership by involving two senior  leaders and a risk management committee to manage ERM processes.  According to the CRO, its risk committee guides the ERM process, tracks  the agency’s progress in managing risks, and increases accountability for  outcomes.
Both the CRO, the Chairman of the Risk Management Committee and the  Senior Risk Advisor report directly to the FSA Chief Operating Officer  (COO). The CRO manages the day-to-day aspects of assessing risks for  various internal FSA operations, programs and initiatives, as well as  targeting risk assessments on specific high-risk issues, such as the  closing of a large for-profit school. The Chairman of the Risk  Management Committee and the Senior Risk Advisor advise the COO by  identifying and analyzing external risks that could affect the  accomplishment of FSA’s strategic objectives. The Senior Risk Advisor  also gathers and disseminates information internally that relates to FSA  risk issues, such as cybersecurity or financial issues. In addition, he  serves as the Chair of the Risk Management Committee and leads its  monthly meetings.
Other senior leaders and members involved with the Risk Management  Committee were drawn from across the agency and demonstrate the  importance of ERM to FSA. Specifically, the committee is chaired by the  independent senior risk advisor and comprised of the CRO, COO, CFO,  Chief Information Officer (CIO), General Manager of Acquisitions, Chief  Business Operations Officer, Chief of Staff, Chief Compliance Officer,  Deputy COO, and Chief Customer Experience Officer, and meets  monthly. Agency officials said that the participation of the COO, along  with that of the other functional chiefs, indicates ERM’s importance and  the commitment of staff—namely these executives–in the effort.
section_title: National Institute of Standards and Technology Surveyed Leaders’ Views of Risk Appetite
paragraphs: Developing an agency risk appetite requires leadership involvement and  discussion. The organization should develop a risk appetite statement  and embed it in policies, procedures, decision limits, training, and  communication, so that it is widely understood and used by the agency.  Further, the risk appetite may vary for different activities depending on the  expected value to the organization and its stakeholders. To that end, the  National Institute of Standards and Technology (NIST) ERM Office  surveyed its 33-member senior leadership team to measure risk appetite  among its senior leaders. Without a clearly defined risk appetite, NIST  could be taking risks well beyond management’s comfort level, or passing  up strategic opportunities by assuming its leaders were risk averse. The  survey objectives were to “assess management familiarity and use of risk  management principles in day-to-day operations and to solicit  management perspectives and input on risk appetite, including their  opinions on critical thresholds that will inform the NIST enterprise risk  criteria.”
Survey questions focused on the respondent’s self-reported  understanding of a variety of risk management concepts and asked  respondents to rate how they consider risk with respect to management,  safety, and security. The survey assessed officials’ risk appetite across  five areas: NIST Goal Areas, Strategic Objectives, Core Products and  Services, Mission Support Functions, and Core Values. See figure 2 for  the rating scale that NIST used to assess officials’ appetite for risk in  these areas.
The survey results revealed a disconnect between the existing and  desired risk appetite for mission support functions. According to NIST  officials, respondents believed the bureau needed to accept more risk to  allow for innovation within mission support functions. According  to  agency officials, to better align risk appetite with mission needs, the NIST  Director tasked the leadership team with developing risk appetite levels  for those areas with the greatest disagreement between the existing and  desired risk appetite, while still remaining compliant with laws and  regulations. Agency officials told us the NIST ERM Office plans to  address this topic via further engagement with senior managers and  subject matter experts.
section_title: Good Practice: Develop a Risk-Informed Culture to Ensure All Employees Can Effectively Raise Risks
paragraphs: The following examples illustrate how selected agencies are developing a  risk-informed culture, including how they have: encouraged employees to discuss risks openly,   trained employees on ERM approach engaged employees in ERM efforts, and  customized ERM tools for organizational mission and culture.
This good practice relates most closely to Identify Risks, one of the  Essential Elements of Federal Government ERM shown in table 1.
subsections: section_title: Commerce Defined Roles and Responsibilities Across the Agency to Build a Risk Management Culture and Guide Its ERM Process
paragraphs: Successful ERM programs find ways to develop an organizational culture  that allows employees to openly discuss and identify risks, as well as  potential opportunities to enhance organizational goals or value. The  CFOC and PIC Playbook also supports this notion that once ERM is built  into the agency culture, the agency can learn from managed risks or, near  misses, using them to improve how it identifies and analyzes risk. For  example, Commerce officials sought to embed a culture of risk  awareness across the department by defining cascading roles of  leadership and responsibility for ERM across the department and for its  12 bureaus. Additionally, an official noted that Commerce leveraged this  forum to share bureau best practices; develop a common risk lexicon;  and address cross-bureau risks, issues and concerns regarding ERM  practice and implementation. According to the updated ERM program  policy, these roles should support the ERM program and promote a risk  management culture. They also help promote transparency, oversight,  and accountability for a successful ERM program.
Table 2 shows the ERM roles and set of responsibilities within Commerce  and how they support a culture of risk awareness at each level.
To successfully implement and sustain ERM, it is critical that staff, at all  levels, understand how the organization defines ERM, its subsequent  ERM approach, and organizational expectations on their involvement in  the ERM process. The CFOC and PIC Playbook also supports risk  awareness as previously stated because once ERM is built into the  agency culture, it can be possible to learn from managed risks and near  misses when risks materialize, and then used to improve the process of  identifying and analyzing risk in the future. Further, the Playbook  suggests that this culture change can only occur if top agency leaders  champion ERM and encourage the flow of information needed for  effective decision making. For example, to promote cultural change and  encourage employees to raise risks, PIH trained about half of its 1,500  employees in 2015. Agency officials told us that they plan to expand on  the 2015 training and provide training to all PIH employees after 2016.
The in-person PIH training includes several features of our identified ERM  good practices, such as leadership support and the importance of  developing a risk-informed culture. For example, the Principal Deputy  Assistant Secretary for PIH was visibly involved in the training and kicked  off the first of the five training modules using a video emphasizing ERM.  The training contained discussions and specific exercises dedicated to  the importance of raising and assessing risks and understanding the  leadership and employee roles in ERM. The first training module  emphasized the factors that can support ERM by highlighting the  following cultural characteristics.
ERM requires a culture that supports the reporting of risks.
ERM requires a culture of open feedback.
A risk-aware culture enables all HUD staff to speak up and then be  listened to by decision-makers.
Leadership encourages the sharing of risks.
By focusing on the importance of developing a risk aware culture in the  first ERM training module, PIH officials emphasized that ERM requires a  cultural transformation for its success. To enable all employees to  participate and benefit from the training, PIH officials recorded the  modules and made them available on You-Tube.
section_title: TSA Sponsored Several Programs to Raise Risk Awareness Among Employees
paragraphs: Our literature review found that building a risk-aware culture supports the  ERM process by encouraging staff across the organization to feel  comfortable raising risks. Involving employees in identifying risks allows  the agency to increase risk awareness and generate solutions to those  identified risks. Some ways to strengthen this culture include the  presence of risk management communities of practice, the development  and dissemination of a risk lexicon agencywide, and conducting forums  that enable frontline staff to raise risk-related strategic or operational  concerns with leadership and senior management. For example, TSA’s  Office of the Chief Risk Officer (OCRO) has sponsored a number of  activities related to raising risk awareness.
First, TSA has established a risk community of interest open to any  employee in the organization, and has hosted speakers on ERM topics.  These meetings have provided an opportunity for employees across the  administration to learn and discuss risks and become more  knowledgeable about the types of issues that should be raised to  management.
Second, TSA created a risk lexicon, so that all staff involved with ERM  would use and understand risk terminology similarly. The lexicon  describes core concepts and terms that form the basis for the TSA ERM  framework. TSA incorporated the ERM lexicon into the TSA ERM Policy  Manual.
Third, in January 2016, TSA started a vulnerability management process  for offices and functions with responsibility for identifying or addressing  security vulnerabilities. Officials told us that this new process is intended  to help raise risks from the bottom up so that they receive top level  monitoring. According to the December 2015 TSA memo we reviewed,  the process centralizes tracking of vulnerability mitigation efforts with the  CRO, creates a central repository for vulnerability information and  tracking, provides executive engagement and oversight of enterprise  vulnerabilities by the Executive Risk Steering Committee (ERSC),  promotes cross-functional collaboration across TSA offices, and requires  the collaboration of Assistant Administrators and their respective staff  across the Agency.
See figure 3 below for an overview of how TSA’s vulnerability  management process is intended to work. The CRO told us that  employees from all levels can report risks with broader, enterprise-level  application to the OCRO. Once the OCRO decides the risks are at an  enterprise level, the office assembles a working group and submits ideas  to the ERSC to decide at what level it should be addressed. The risk is  then assigned to an executive who will be required to provide a status  update.
Fourth, officials in the TSA OCRO told us that TSA has established points  of contact in every program office, referred to as ERM Liaisons. Each  ERM Liaison is a senior level official that represents their program office  in all ERM related activities. TSA also implemented risk management  awareness training to headquarters and field supervisors that covered  topics such as risk-based decision-making, risk assessment, and  situational awareness. Officials told us they are also embedding ERM  principles into existing training, so that employees will understand how  ERM fits into TSA operations.
section_title: NIST Adapted the Commerce ERM Framework to Reflect Lab Safety Vocabulary Appropriate to Its Culture
paragraphs: Customizing ERM tools and templates can help ensure risk management  efforts fit agency culture and operations. For example, NIST tailored  certain elements of the Commerce ERM framework to better reflect the  bureau’s risk thresholds. Commerce has developed a set of standard risk  assessment criteria to help identify and rate risks, referred to as the  Commerce ERM Reference Card. NIST officials reported that some of the  safety and security terms used at Commerce differed from the terms used  at NIST and required tailoring to map to NIST’s existing safety risk  framework, which is a heavily embedded component of NIST operations  and culture. To better align to NIST, the NIST ERM Program split safety  and security risks into distinct categories when establishing a tailored  ERM framework for the bureau (see table 3).
According to agency officials, the NIST ERM Reference Card also  leverages American National Standards Institute guidelines, so it does not  introduce another separate and potentially conflicting set of terms.  Officials told us that these adaptations to the NIST ERM framework help  maintain continuity with the Commerce framework, but reflect the  particular mission, needs, and culture of NIST.
section_title: Good Practice: Integrate ERM Capability to Support Strategic Planning and Organizational Performance Management
paragraphs: The following examples illustrate how selected agencies are integrating  ERM capability to support strategic planning and organizational  performance management. These include how they have:  incorporated ERM into strategic planning processes, and used ERM to improve information for agency decisions.
This good practice most closely relates to Assess Risks, one of the  Essential Elements of Federal Government ERM, shown in table 1.
subsections: section_title: Treasury Used Risk Discussions in Quarterly Performance Reviews
paragraphs: Through ERM, an agency looks for opportunities that may arise out of  specific situations, assesses their risk, and develops strategies to achieve  positive outcomes. In the federal environment, agencies can leverage the  GPRAMA performance planning and reporting framework to help better  manage risks and improve decision making. For example, Treasury has  integrated ERM into its existing strategic planning and management  processes. According to our review of the literature and the subject matter  specialists we interviewed, using existing processes helps to avoid  creating overlapping processes. Further, by incorporating ERM this way,  risk management becomes an integral part of setting goals, including  agency priority goals (APG), ultimately achieving an organization’s  desired outcomes. Agencies can use regular performance reviews, such  as the quarterly performance reviews of APGs and annual leadership- driven strategic objective review, to help increase attention on progress  towards the outcomes agencies are trying to achieve. According to OMB  Circular No. A-11, agencies are expected to manage risks and challenges  related to delivering the organization’s mission. The agency’s strategic  review is a process by which the agency should coordinate its analysis of  risk using ERM to make risk-aware decisions, including the development  of risk profiles as a component of the annual strategic review, identifying  risks arising from mission and mission-support operations, and providing  a thoughtful analysis of the risks an agency faces towards achieving its  strategic objectives. Instituting ERM can help agency leaders make risk- aware decisions that affect prioritization, performance, and resource  allocation.
Treasury officials stated they integrated ERM into their quarterly  performance or data-driven reviews and strategic reviews, both of which  already existed. Officials stated this action has helped elevate and focus  risk discussions. Staff from the management office and individual bureaus  work together to complete the template slide, which is used to include a  risk element in their performance reviews. As part of this process, they  are assessing risk. See figure 4 for how risk is incorporated into  Treasury’s quarterly performance review (QPR) template. Officials stated  that they believe this approach to prepare for the data-driven review has  helped improve outcomes at Treasury. For example, according to agency  officials, Treasury used its QPR process to increase cybersecurity.
Treasury officials also told us that during the fall and the spring, each  Treasury bureau completes the data-driven review templates. Agency  officials are to use the summer data-driven review as an opportunity to  discuss budget formulation. In winter, they are to use the annual data- driven review to show progress towards achieving strategic objectives.   According to agency officials, the strategic review examines and  assesses risks identified as part of the data-driven reviews and  aggregates and analyzes these results at the cross cutting strategic  objective level, which helps improve agency performance. Integrating  ERM into this existing data-driven review process avoids creating a  duplicative process and increases the focus on risk.
In another example, Treasury officials identified implementation of the  Digital Accountability and Transparency Act of 2014 (DATA Act) both at  Treasury and government-wide as a risk and established “Financial  Transparency” as one of its two APGs for fiscal years 2016 and 2017.  According to agency officials, incorporating risk management into the  data-driven review process sends a signal about the importance of the  DATA Act and brings additional leadership focus and scrutiny needed to  successfully implement the law.
section_title: OPM Builds Agency View of Risk into Decision Making and Organizational Performance Management Reviews
paragraphs: The literature we reviewed notes that ERM contributes to leaders’ ability  to identify risks and adjust organizational priorities to enhance decision- making efforts. For example, OPM has a Risk Management Council  (RMC) that builds risk-review reporting and management strategies into  existing decision making and performance management structures. This  includes Performance Dashboards, APG reviews, and regular meetings  of the senior management team, as is recommended by the CFOC and  PIC Playbook. The RMC also uses an existing performance dashboard  for strategic goal reviews as part of its ERM process and to help inform  decisions as a result of these reviews. Officials told us they present their  dashboards every 6 or 7 weeks to the Chief Management Officer (CMO)  and RMC, as part of preparing for their data-driven reviews. Each project  and its risks are mapped against the strategic plan. When officials  responsible for a goal identify risks, they must also provide action plan  strategies, timelines, and milestones for mitigating risks.
Figure 5 shows an OPM dashboard to illustrate how OPM tracks progress  on a goal of preparing the federal workforce for retirement, for such a risk  as an unexpected retirement surge, and documents mitigation strategies  to address such events. According to agency officials, the CMO and RMC  monitor high level and high visibility risks on a weekly basis. In August  2016, OPM officials told us they were monitoring five to seven major  projects, such as information technology (IT) security implementation and  retirement services processes.
Each quarterly data-driven review includes an in-depth look into a specific  goal and the examination of risks as part of the review. Officials told us  that in the past 3 years, they have covered each of the strategic goals  using the dashboard. According to officials, during one of these reviews,  OPM identified a new risk related to having sufficient qualified contracting  staff to meet the goal of effective and efficient IT systems. Since OPM  considers contracting a significant component of that goal, they decided  to create the Office of Procurement Operations to help increase attention  to contracting staff. Using ERM, OPM officials told us they believe that  they could better prioritize funding requests across the agency, ultimately  balance limited resources, and make better informed decisions.
section_title: Good Practice: Establish a Customized ERM Program Integrated into Existing Agency Processes
paragraphs: The following examples illustrate how selected agencies are establishing  a customized ERM program into existing agency processes. These  include how they have: designed an ERM program that allows for customized agency fit, developed a consistent, routinized ERM program, and used a maturity model approach to build an ERM program.
This good practice relates primarily to Identify Risk and Select Risk  Response, two of the Essential Elements of Federal Government ERM  shown in table 1.
subsections: section_title: The Office of Federal Student Aid Customized Its Approach to Designing and Implementing ERM
paragraphs: Effective ERM implementation starts with agencies establishing a  customized ERM program that fits their specific organizational mission,  culture, operating environment, and business processes but also contains  the essential elements of an ERM framework. The CFOC and PIC  Playbook focuses on the importance of a customized ERM program to  meet agency needs. This involves taking into account policy concerns,  mission needs, stakeholder interests and priorities, agency culture, and  the acceptable level for each risk, both for the agency as a whole and for  the specific programs.
For example, in 2004, the Department of Education’s (Education) Office  of Federal Student Aid (FSA) began establishing a formal ERM program,  based on the Committee of Sponsoring Organizations of the Treadway  Commission (COSO) ERM Framework, to help address longstanding  risks using customized implementation plans. More specifically, FSA’s  framework and materials were customized for it to ensure that they were  specific to work within a government setting, and to capture the nuances  of FSA's business model. Agency officials told us that one reason they  adopted a COSO-based model for ERM is that it was geared toward  achieving an entity's objectives, and could be customized to meet FSA’s  organizational needs as a performance-based organization.
Thus, FSA adopted a three-phase approach that allowed for increased  maturity over time, and customized it to help the organization adapt to the  new program using a COSO-based methodology for risk management.  According to FSA documents, the first phase involved creating the ERM  organization, designing a high-level implementation plan, and forming its  enterprise risk committee to help support its first ERM efforts. The second  phase involved creating a strategic plan and detailed project plan to  implement ERM. For example, the original FSA ERM Strategic Plan  contained an ERM vision statement (see textbox below) for aligning  strategic risks with goals and objectives. The FSA Plan also provided its  approach for identifying risks that could affect FSA’s ability to achieve  these objectives.
Federal Student Aid Enterprise Risk Management Original Vision Statement  “Our vision is to create the premier Enterprise Risk Management Program in the  Federal government. One that provides for an integrated view of risk across the entire  Federal Student Aid organization; aligns strategic risks with the organization’s goals  and objectives; ensures that risk issues are integrated into the strategic decision  making process; and manages risk to further the achievement of performance goals.”
During the initial implementation of FSA's ERM program, the ERM  strategic goals were to:   1.  provide for an integrated view of risks across the organization,  2.  ensure that strategic risks are aligned with strategic goals and  3.  develop a progressive risk culture that fosters an increased focus on  risk and awareness of related issues throughout the organization, and  4.  improve the quality and availability of risk information across all levels  of the organization, especially for executive management.
Finally, according to documents we reviewed, the third phase of FSA’s  ERM implementation included developing enterprise-level risk reports,  and advanced methods, tools, and techniques to monitor and manage  risk. For example, the documents we reviewed showed that some of the  key tools that supported FSA’s ERM implementation included ERM  terminology, risk categories, risk ratings, and a risk-tracking system.  These tools help FSA select an appropriate risk response that works with  existing agency processes and culture.
section_title: TSA Risk Taxonomy Promotes a Consistent Approach to the Risk Review Process
paragraphs: A consistent process for risk review that systematically categorizes risk  helps leaders to ensure that the consideration of potential risk takes  place. The CFOC and PIC Playbook suggests that organizations define  risk categories to support their business processes, and use these  categories consistently. For example, to identify and review risks, the TSA  Risk taxonomy organizes risks into categories so the agency can  consistently identify, assess, measure, and monitor risks across the  organization, as discussed in the TSA Policy Manual.
The TSA Risk Taxonomy captures the risks in all aspects of mission  operations, business operations, governance, and information. Figure 6  lists each risk category that is reviewed. The taxonomy helps TSA both  collect risks and identify the most critical, and helps ensure that the same  vocabulary and categorization system are used across TSA. Officials  report that they chose these categories to help break down organizational  silos and help identify all types of risks. For example, they did not want  “mission risk” to consider only the Federal Air Marshal Service and airport  checkpoint screening. Rather, they wanted a broad understanding of risks  across the various TSA components.
TSA officials stated that they believe the taxonomy will be even more  useful when TSA has an automated computer application to help analyze  all similar and related risks across the enterprise.
section_title: Commerce Designed an Assessment Tool for Its Bureaus to Determine Their ERM Maturity
paragraphs: OMB is encouraging agencies to use a maturity model approach in the  ERM guidance provided in A-123. Results from our literature review and  OMB suggested that a maturity model allows the organization to plan for  continued agency improvement as its efforts mature. For example, to  assist implementing a department-wide ERM process, Commerce  developed an ERM Maturity Assessment Tool (EMAT), as well as a  comprehensive guidebook and other tools, to share with its 12 bureaus.  The EMAT consists of 83 questions to help bureaus determine their ERM  maturity (see figure 7 for a sample of EMAT questions). According to  agency officials, bureaus are required to conduct EMAT assessments  annually. According to agency officials, while the EMAT lays out the basic  components of ERM, the bureaus may customize the tool to fit their  respective organizations. Commerce expects the bureaus to demonstrate  increased levels of maturity over time. Agency officials reported that  overall, the level of maturity has increased since the program began.
Discussions of the EMAT have allowed bureaus to learn from each other  and identify strategies for addressing common challenges. According to  officials, these challenges include documenting risk treatment plans and  providing the rationale to support management’s risk mitigation choices.
section_title: Good Practice: Continuously Manage Risks
paragraphs: The following example illustrates how a select agency is continuously  managing risks including how it has:   tracked and monitored current and emerging risks.
This good practice most closely relates to Monitor Risks, one of the  Essential Elements of Federal Government ERM shown in table 1.
subsections: section_title: HUD Uses Risk Dashboards to Monitor Risks
paragraphs: Continuously managing risk requires a systematic or routine risk review  function to help senior leaders and other stakeholders accomplish the  organizational mission. The CFOC and PIC Playbook recommends that  risks be identified and assessed throughout the year as part of a regular  process, including surveillance of leading risk indicators both internally  and externally. For example, PIH has two risk management dashboards,  which it uses to monitor and review risks.
The Risk and Mitigation Strategies Dashboard shown in figure 8,  according to PIH officials, helps them monitor risks and mitigation actions  that PIH is actively pursuing. Officials told us that the risk division  prepares and presents this dashboard to the Risk Committee quarterly.  The dashboard provides a snapshot view for the current period, analysis  of mitigation action to date, and trends for the projected risk. It tracks the  highest level risks to PIH as determined by the Risk Committee, along  with the corresponding mitigation plans. Currently, officials told us PIH is  managing the top risks using the dashboard. Risk division staff continually  update the dashboard to concisely display the status of both risk and  mitigation efforts.
The second dashboard in figure 9, Key Risk Indicators Dashboard,  monitors external, future risks to PIH’s mission. Agency officials told us  that the dashboard is used as an early-warning system for emerging  risks, which the Risk Committee must address before the next annual risk  assessment cycle begins. The dashboard includes a risk-level column  that documents the residual risk, and is measured on a five-point scale  with one being the lowest and five being the highest, which is assigned by  the relevant Deputy Assistant Secretary and Risk Division staff. A  trending column indicates whether the risk is projected to increase,  decrease, or remain the same. There is also a link to a document that  summarizes the risk assessment including the risks and measures to  address the risk and anticipated impact. The Risk Committee reviews the  dashboard as needed, but not less than quarterly.
These two dashboards show how an agency uses the continuous risk  review cycle. The cycle allows leaders to treat risks until they are satisfied  the risk is under control or successfully treated or managed.
section_title: Good Practice: Share Information with Internal and External Stakeholders to Identify and Communicate Risks
paragraphs: The following examples illustrate how selected agencies are sharing  information with internal and external stakeholders to identify and  communicate risks. These include how they have:  incorporated feedback on risks from internal and external  stakeholders to better manage risks, and   shared risk information across the enterprise.
This good practice most closely relates to Communicate and Report on  Risks in the Essential Elements of Federal Government ERM shown in  table 1.
subsections: section_title: Two Agencies Use A Memorandum of Understanding to Share Accountability and Ownership for Risks from a Shared Satellite Program
paragraphs: Effective information and communication are vital for an agency to  achieve its objectives and this often involves multiple stakeholders, inside  and outside the organization. ERM programs should incorporate feedback  from internal and external stakeholders because their respective insights  can help organizations identify and better manage risks. For example, the  National Oceanic and Atmospheric Administration (NOAA) and the  National Aeronautics and Space Administration (NASA) are creating and  sharing inter-agency risk information as part of their joint management of  the Joint Polar Satellite System (JPSS) program. JPSS is a  collaborative effort between NOAA and NASA; the program was created  with the President’s Fiscal Year 2011 Budget Request to acquire,  develop, launch, operate and sustain three polar-orbiting satellites. The  purpose of the JPSS program is to replace aging polar satellites and  provide critical environmental data used in forecasting such weather  events as the path and intensity of a hurricane and measuring climate  variations. These two agencies have a signed agreement, or  memorandum of understanding, to share ownership for risk that details  the responsibilities for delivering the satellite and overall cost and  schedule performance. In particular, NOAA has overall responsibility for  the cost and schedule of the program, as well as the entire JPSS  program. NOAA manages the ground segment elements needed for data  collection and distribution, while NASA manages the system acquisition,  engineering, and integration of the satellite, as well as the JPSS Common  Ground System.
Because of this management arrangement, the Joint Polar Satellite  System (JPSS) program also required “joint” risk tracking and  management. Other program documentation also points to the agencies’  close collaboration on risk management. The March 2014, JPSS Risk  Management Plan describes how risk management practices are planned  for consistency with NASA’s risk management requirements and outlines  roles and responsibilities. NOAA officials stated that they share  programmatic and technical information across the two agencies, and that  certain high-level risks are elevated through Commerce quarterly. Our  review of meeting agendas and presentations show that NASA and  NOAA officials met monthly as part of a NOAA held Agency Program  Management Council (APMC) to track JPSS’s progress and that of other  satellite programs. These meetings also allowed participants to discuss  and approve courses of action for top program risks. During the APMC  meetings, the JPSS program director presented status updates and other  information including risks. Participants discussed risks, cost,  performance, schedule, and other relevant issues for each program.
Sharing information helps promote trust within and outside of the  organization, increases accountability for managing risks, and helps  stakeholders understand the basis for identified risks and resulting  treatment plans. Further, internal and external stakeholders may be able  to provide new expertise and insight that can help organizations identify  and better manage risks. Both the NASA Program Managers and the  NOAA Program Director or their representatives attend meetings to  discuss potential issues, according to NOAA officials. Each major satellite  program also has an independent Standing Review Board. At defined  program/project milestones, the Standing Review Board reviews relevant  data and writes up its conclusions, presents an independent review of the  program/project, and highlights key risks to the convening authorities.  NOAA officials said that having a joint risk-sharing process established for  JPSS and other joint programs allows them to elevate risks both internally  up through the agency, and externally, more quickly and efficiently. For  example, for another satellite program, NOAA had to reschedule its  launch date due to a problem that arose with the launch service provider.
After it became clear that the program was going to miss its schedule  baseline, it was elevated up through NOAA. According to NOAA, NASA  officials then explained to the APMC the steps they were taking to  address the risk. As a result of having a process to elevate the risk,  NOAA was able to discuss risks associated with the launch vehicle and  how it planned to proceed with a new launch date range. According to  NOAA officials, because the APMC discussion developed joint  information, this information was available to pass on more quickly to  Congress.
section_title: IRS Uses a Decision-Making Tool that Includes Input from Stakeholders Across the Enterprise
paragraphs: When discussing potential risks, gathering input from across an  enterprise helps to ensure decisions work for all agency groups affected.  It also gives groups an opportunity to share any concerns or ideas that  can improve outcomes. Appropriate and timely sharing of information  within an organization ensures that risk information remains relevant,  useful, and current. The CFOC and PIC Playbook also notes that  informed decision making requires the flow of information regarding risks  and clarity about uncertainties or ambiguities—up and down the hierarchy  and across silos—to the relevant decision makers so they can make  informed decisions. For example, IRS uses the Risk Acceptance Form  and Tool (RAFT) as shown in figure 10 to document business decisions  within a consistent framework. As part of the RAFT development process,  IRS considers the views of internal and external stakeholders. According  to agency officials, the RAFT assists IRS business units in making better  risk-based decisions and elevating risks to the appropriate level. IRS  officials said the RAFT also encourages units to consider how decisions  may affect other units, as well as external stakeholders. As a result,  business units often collaborate on key decisions by completing the  RAFT, including considering and documenting risks associated with those  decisions.
According to IRS officials, the RAFT is used as a guide to articulate  rationales behind decisions within the context of risk appetite and serves  as a documentation trail to support these business decisions. IRS agency  officials told us that one goal of its ERM program is to look at risk across  the enterprise rather than taking a narrow approach to risk management.  This also applies when making risk informed decisions, such as those  that would be documented on a RAFT. As such, the RAFT includes the  following instructions:  “If the decision impacts or involves multiple  organizations, coordinate with the respective points-of-contact to ensure  all relevant information regarding the risk(s) are addressed in each  section.” The form also allows users to identify other business units  involved in the decision and external stakeholders affected by the  decision.
section_title: Agency Comments and GAO Responses
paragraphs: We provided a draft of this report to Office of Management and Budget  (OMB) and the 24 Chief Financial Officer (CFO) Act agencies for review  and comment. OMB staff provided us with oral comments and stated  they generally agreed with the essential elements and good practices as  identified in this report. They also provided technical comments that we  incorporated as appropriate. We received written responses from the  Social Security Administration (SSA) and Department of Veterans Affairs  (VA) reprinted in appendices II and III. The SSA and the VA neither  agreed nor disagreed with our findings. However, VA mentioned that  enterprise risk management should be monitored at a minimum as part of  the quarterly reviews of Agency Priority Goals because of the high-level  audience led by the Deputy Secretary and suggested that monitoring  risks more frequently should be emphasized as a practice that most  agencies should follow, among other things. SSA stated that they are  adopting the good practices identified in the report.
Of the remaining 22 CFO Act agencies, we received technical comments  from 10 agencies, which we incorporated as appropriate, 10 had no  comments, and two others did not respond.
We are sending copies of this report to the Director of OMB as well as  appropriate congressional committees and other interested parties. In  addition, this report is available at no charge on the GAO website at  http://www.gao.gov.
If you or your staff members have any questions about this report, please  contact me at (202) 512-6806 or mihmj@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix IV.
section_title: Appendix I: Subject Matter Specialists
subsections: section_title: Dr. Doug Webster, AFERM, Co-founder and Past President; George Washington University Center for Excellence in Public Leadership, Senior Fellow; author of articles and a book on ERM in the public sector; and Director, Risk Management at the U.S. Agency for International Development, Office of the Chief Financial Officer.
section_title: Appendix III: Comments from the Department of Veterans Affairs
section_title: Appendix IV: GAO Contact and Staff Acknowledgements
subsections: section_title: GAO Contact
section_title: Staff Acknowledgements
paragraphs: In addition to the individual named above, William M. Reinsberg,  Assistant Director, Carole J. Cimitile, Analyst-in-Charge, Shea Bader,  Crystal Bernard, Amy Bowser, Alexandra Edwards, Ellen Grady, Erin E.  Kennedy, Erik Kjeldgaard, Robert Gebhart, Sharon Miller, Anthony  Patterson, Laurel Plume, Robert Robinson, Cynthia Saunders, Stewart  W. Small, Katherine Wulff, and Jessica L. Yutzy made major contributions  to this report.