Enterprise Risk Management: Selected Agencies' Experiences Illustrate Good Practices in Managing Risk
Released: 2016-12-01T00:00:00

Letter

Background

ERM allows management to understand an organization’s portfolio of top- risk exposures, which could affect the organization’s success in meeting its goal. As such, ERM is a decision-making tool that allows leadership to view risks from across an organization’s portfolio of responsibilities. ERM recognizes how risks interact (i.e., how one risk can magnify or offset another risk), and also examines the interaction of risk treatments (actions taken to address a risk), such as acceptance or avoidance. For example, treatment of one risk in one part of the organization can create a new risk elsewhere or can affect the effectiveness of the risk treatment applied to another risk. ERM is part of overall organizational governance and accountability functions and encompasses all areas where an organization is exposed to risk (financial, operational, reporting, compliance, governance, strategic, reputation, etc.).

In July 2016, OMB updated its Circular No. A-123 guidance to establish management’s responsibilities for ERM, as well as updates to internal control in accordance with Standards for Internal Control in the Federal Government. OMB also updated Circular No. A-11, Preparation, Submission, and Execution of the Budget in 2016 and refers agencies to Circular No. A-123 for implementation requirements for ERM. Circular No. A-123 guides agencies on how to integrate organizational performance and ERM to yield an “enterprise-wide, strategically-aligned portfolio view of organizational challenges that provides better insight about how to most effectively prioritize resource allocations to ensure successful mission delivery.” The updated requirements in Circulars A- 123 and A-11 help modernize existing management efforts by requiring agencies to implement an ERM capability coordinated with the strategic planning and strategic review process established by the GPRA Modernization Act of 2010 (GPRAMA), and with the internal control processes required by the FMFIA and in our Standards for Internal Control in the Federal Government. This integrated governance structure is designed to improve mission delivery, reduce costs, and focus corrective actions towards key risks.

More specifically, Circular No. A-123 discusses both internal control and ERM and how these fit together to manage agency risks. Our Standards for Internal Control in the Federal Government describes internal control as a process put in place by an entity’s oversight body, management, and other personnel that provides reasonable assurance that objectives related to operations, compliance, and reporting will be achieved, and serves as the first line of defense in safeguarding assets. Internal control is also part of ERM and used to manage or reduce risks in an organization. Prior to implementing ERM, risk management focused on traditional internal control concepts to managing risk exposures. Beyond traditional internal controls, ERM promotes risk management by considering its effect across the entire organization and how it may interact with other identified risks. Additionally, ERM also addresses other topics such as setting strategy, governance, communicating with stakeholders, and measuring performance, and its principles apply at all levels of the organization and across all functions.

Implementation of OMB circulars is expected to engage all agency management, beyond the traditional ownership of A-123 by the Chief Financial Officer community. According to the A-123 Circular, it requires leadership from the agency Chief Operating Officer (COO) and Performance Improvement Officer (PIO) or other senior official with responsibility for the enterprise, and close collaboration across all agency mission and mission-support functions. The A-123 guidance also requires agencies to create a risk profile that helps them identify and assess risks arising from mission and mission-support operations, and consider those risks as part of the annual strategic review process. Circular A-123 requires that agencies’ risk profiles include risks to strategic, operations, reporting and compliance objectives.

A federal interagency group of ERM practitioners developed a Playbook released through the Performance Improvement Council (PIC) and the Chief Financial Officers Council (CFOC) in July 2016 to provide federal agencies with a resource to support ERM. In particular, the Playbook assists them in implementing the required elements in the updated A-123 Circular.

Updated ERM Framework Provides Assistance to Agencies as They Implement ERM

To assist agencies in better assessing challenges and opportunities from an enterprise-wide view, we have updated our risk management framework first published in 2005 to more fully include recent experience and guidance, as well as specific enterprise-wide elements. As mentioned previously, our 2005 risk management framework was developed in the context of risks associated with homeland security and combating terrorism. However, increased attention to ERM concepts and their applicability to all federal agencies and missions led us to revise our risk framework to incorporate ERM concepts that can help leaders better address uncertainties in the federal environment, changing and more complex operating environments due to technology and other global factors, the passage of GPRAMA and its focus on overall performance improvement, and stakeholders seeking greater transparency and accountability. For many similar reasons, the Committee of Sponsoring Organizations of the Treadway Commission (COSO) initiated an effort to update its ERM framework for 2016, and the International Organization for Standardization (ISO) plans to update its ERM framework in 2017. Further, as noted, OMB has now incorporated ERM into Circulars A-11 and A-123 to help improve overall agency performance.

We identified six essential elements to assist federal agencies as they move forward with ERM implementation. Figure 1 below shows how ERM’s essential elements fit together to form a continuing process for managing enterprise risks. The absence of any one of the elements below would likely result in an agency incompletely identifying and managing enterprise risk. For example, if an agency did not monitor risks, then it would have no way to ensure that it had responded to risks successfully. There is no “one right” ERM framework that all organizations should adopt. However, agencies should include certain essential elements in their ERM program.

Below we describe each essential element in more detail, why it is important, and some actions necessary to successfully build an ERM program. 1. Align the ERM process to agency goals and objectives. Ensure the ERM process maximizes the achievement of agency mission and results. Agency leaders examine strategic objectives by regularly considering how uncertainties, both risks and opportunities, could affect the agency’s ability to achieve its mission. ERM subject matter specialists confirmed that this element is critical because the ERM process should support the achievement of agency goals and objectives and provide value for the organization and its stakeholders. By aligning the ERM process to the agency mission, agency leaders can address risks via an enterprise-wide, strategically-aligned portfolio rather than addressing individual risks within silos. Thus, agency leaders can make better, more effective decisions when prioritizing risks and allocating resources to manage risks to mission delivery. While leadership is integral throughout the ERM process, it is an especially critical component of aligning ERM to agency goals and objectives because senior leaders have an active role in strategic planning and accountability for results. 2. Identify risks. Assemble a comprehensive list of risks, both threats and opportunities, that could affect the agency from achieving its goals and objectives. This element of ERM systematically identifies the sources of risks as they relate to strategic objectives by examining internal and external factors that could affect their accomplishment. It is important that risks either can be opportunities for, or threats to, accomplishing strategic objectives. The literature we reviewed, as well as subject matter specialists, pointed out that identifying risks in any organization is challenging for employees, as they may be concerned about reprisals for highlighting "bad news." Risks to objectives can often be grouped by type or category. For example, a number of risks may be grouped together in categories such as strategic, program, operational, reporting, reputational, technological, etc. Categorizing risks can help agency leaders see how risks relate and to what extent the sources of the risks are similar. The risks are linked to relevant strategic objectives and documented in a risk register or some other comprehensive format that also identifies the relevant source and a risk owner to manage the treatment of the risk. Comprehensive risk identification is critical even if the agency does not control the source of the risk. The literature and subject matter specialists we consulted told us that it is important to build a culture where all employees can effectively raise risks. It is also important for the risk owner to be the person who is most knowledgeable about the risk, as this person is likely to have the most insight about appropriate ways to treat the risk. 3. Assess risks. Examine risks considering both the likelihood of the risk and the impact of the risk on the mission to help prioritize risk response. Agency leaders, risk owners, and subject matter experts assess each risk by assigning the likelihood of the risk’s occurrence and the potential impact if the risk occurs. It is important to use the best information available to make the risk assessment as realistic as possible. Risk owners may be in the best position to assess risks. Risks are ranked based on organizational priorities in relation to strategic objectives. Risks are ranked based on organizational priorities in relation to strategic objectives. Agencies need to be familiar with the strengths of their internal control when assessing risks to determine whether the likelihood of a risk event is higher or lower based on the level of uncertainty within the existing control environment. Senior leaders determine if a risk requires treatment or not. Some identified risks may not require treatment at all because they fall within the agency's risk appetite, defined as how much risk the organization is willing to accept relative to mission achievement. The literature we reviewed and subject matter specialists noted that integrating ERM efforts with strategic planning and organizational performance management would help an organization more effectively assess its risks with respect to the impact on the mission. 4. Select risk response. Select a risk treatment response (based on risk appetite) including acceptance, avoidance, reduction, sharing, or transfer. Agency leaders review the prioritized list of risks and select the most appropriate treatment strategy to manage the risk. When selecting the risk response, subject matter experts noted that it is important to involve stakeholders that may also be affected, not only by the risk, but also by the risk treatment. Subject matter specialists also told us that when agencies discuss proposed risk treatments, they should also consider treatment costs and benefits. Not all treatment strategies manage the risk entirely; there may be some residual risk after the risk treatment is applied. Senior leaders need to decide if the residual risk is within their risk appetite and if additional treatment will be required. The risk response should also fit into the management structure, culture, and processes of the agency, so that ERM becomes an integral part of regular management functions. One subject matter specialist suggested that maximize opportunity should also be included as a risk treatment response, so that leaders may capture the positive outcomes or opportunities associated with some risks. 5. Monitor Risks. Monitor how risks are changing and if responses are successful. After implementing the risk response, agencies must monitor the risk to help ensure that the entire risk management process remains current and relevant. The literature we reviewed also suggests using a risk register or other comprehensive risk report to track the success of the treatment for managing the risk. Senior leaders and risk owners review the effectiveness of the selected risk treatment and change the risk response as necessary. Subject matter specialists noted that a good practice includes continuously monitoring and managing risks. Monitoring should be a planned part of the ERM process and can involve regular checking as part of management processes or part of a periodic risk review. Senior leaders also could use performance measures to help track the success of the treatment, and if it has had the desired effect on the mission. 6. Communicate and Report on Risks. Communicate risks with stakeholders and report on the status of addressing the risks. Communicating and reporting risk information informs agency stakeholders about the status of identified risks and their associated treatments, and assures them that agency leaders are managing risk effectively. In a federal setting, communicating risk is important because of the additional transparency expected by Congress, taxpayers, and other relevant stakeholders. Communicating risk information through a dedicated risk management report or integrating risk information into existing organizational performance management reports, such as the annual performance and accountability report, may be useful ways of sharing progress on the management of risk. The literature we reviewed showed and subject matter specialists confirmed that sharing risk information is a good practice. However, concerns may arise about sharing overly specific information or risk responses that would rely on sensitive information. Safeguards should be put in place to help secure information that requires careful management, such as information that could jeopardize security, safety, health, or fraud prevention efforts. In this case, agencies can help alleviate concerns by establishing safeguards, such as communicating risk information only to appropriate parties, encrypting sensitive data, authorizing users' level of rights and privileges, and providing information on a need-to-know basis.

Emerging Good Practices Are Being Used at Selected Agencies to Implement ERM

We identified six good practices that nine agencies are implementing that illustrate ERM’s essential elements. The selected good practices are not all inclusive, but represent steps that federal agencies can take to initiate and sustain an effective ERM process, as well as practices that can apply to more advanced agencies as their ERM processes mature. We expect that as federal experiences with ERM evolve, we will be able to refine these practices and identify additional ones.

Below in table 1, we identify the essential elements of ERM and the good practices that support each particular element that agencies can use to support their ERM programs. The essential elements define what ERM is and the good practices and case illustrations described in more detail later in this report provide ways that agencies can effectively implement ERM. The good practices may fit with more than one essential element, but are shown in the table next to the element to which they most closely relate.

Good Practice: Guide and Sustain ERM Strategy through Leadership Engagement

The following examples illustrate how selected agencies are guiding and sustaining ERM strategy through leadership engagement. These include how they have: designated an ERM leader or leaders committed organization resources to support ERM, and set organizational risk appetite.

This good practice relates most closely to Align ERM Process to Goals and Objectives as shown in table 1.

TSA’s ERM Process Is Led by a Chief Risk Officer and Senior-Level Executive Risk Steering Committee

According to the Chief Financial Officer’s Council (CFOC) and Performance Improvement Council (PIC) Playbook, strong leadership at the top of the organization, including active participation in oversight, is extremely important for achieving success in an ERM program. To manage ERM activities, leadership may choose to designate a Chief Risk Officer (CRO) or other risk champion to demonstrate the importance of risk management to the agency and to implement and manage an effective ERM process across the agency. The CRO role includes leading the ERM process; involving those that need to participate and holding them accountable; ensuring that ERM reviews take place regularly; obtaining resources, such as data and staff support if needed; and ensuring that risks are communicated appropriately to internal and external stakeholders, among other things. For example, at TSA, the CRO serves as the principal advisor on all risks that could affect TSA’s ability to perform its mission, according to the August 2014 TSA ERM Policy Manual. The CRO reports directly to the TSA Administrator and the Deputy Administrator. In conjunction with the Executive Risk Steering Committee (ERSC) composed of Assistant Administrators who lead TSA’s program and management offices, the CRO leads TSA in conducting regular enterprise risk assessments of TSA business processes or programs, and overseeing processes that identify, assess, prioritize, respond to, and monitor enterprise risks.

Specifically, the August 2014 TSA ERM Policy Manual describes ERSC’s role to “oversee the development and implementation of processes used to analyze, prioritize, and address risks across the agency including terrorism threats facing the transportation sector, along with non- operational risks that could impede its ability to achieve its strategic objectives.” The TSA CRO told us that its ERSC provides an opportunity for all Assistant Administrators to get together to have risk conversations. For example, the CRO recently recommended that the ERSC add implementation of the agency’s new financial management system to the risk register.

According to the CRO, the system’s implementation was viewed as the responsibility of the Chief Financial Officer (CFO) and Chief Information Officer (CIO). However, the implementation needed to be managed at the enterprise-level because if it was not successfully implemented, the entire enterprise would be affected. The CRO proposed adding the implementation of the new financial management system to the TSA risk register to give the issue broader visibility. The ERSC unanimously concurred with the recommendation, and staff from the Office of Finance and Administration—the risk owner—will brief the ERSC periodically on the status of the effort.

According to TSA’s ERM Policy Manual, the CRO leads the overall ERM process, while the ERSC brings knowledge and expertise from their individual organizations to help identify and prioritize risks and opportunities of TSA’s overall approach to operations. While the CRO and ERSC play critical roles in ERM oversight, the relevant program offices still own risks and execute risk management, according to the TSA ERM Policy Manual.

FSA Committed Resources to Support ERM

To launch and sustain a successful ERM program, organizational resources are needed to help implement leadership’s vision of ERM for the agency and ensure its ongoing effectiveness. For example, when FSA began its ERM program in 2004, the Chief Operating Officer (COO) decided to hire a CRO and give him full responsibility to establish the ERM organization and program and implement it across the organization. According to documents we reviewed, the CRO dedicated resources to define the goal and purpose of the ERM program and met with key leaders across the agency to socialize the program. Agency leadership hired staff to establish the ERM program and provided risk management training to business unit senior leaders and their respective staff. Our review of documents shows that the FSA continues to provide ERM training to senior staff and all FSA employees and also participates in an annual FSA Day, so employees can learn more about all business units across FSA including the Risk Management Office and its ERM implementation. In September 2016, the FSA CRO told us that the Risk Management Office had a staff of 19 full-time equivalent (FTE) employees. FSA continues to provide resources to its ERM program and has subsequently structured its leadership by involving two senior leaders and a risk management committee to manage ERM processes. According to the CRO, its risk committee guides the ERM process, tracks the agency’s progress in managing risks, and increases accountability for outcomes.

Both the CRO, the Chairman of the Risk Management Committee and the Senior Risk Advisor report directly to the FSA Chief Operating Officer (COO). The CRO manages the day-to-day aspects of assessing risks for various internal FSA operations, programs and initiatives, as well as targeting risk assessments on specific high-risk issues, such as the closing of a large for-profit school. The Chairman of the Risk Management Committee and the Senior Risk Advisor advise the COO by identifying and analyzing external risks that could affect the accomplishment of FSA’s strategic objectives. The Senior Risk Advisor also gathers and disseminates information internally that relates to FSA risk issues, such as cybersecurity or financial issues. In addition, he serves as the Chair of the Risk Management Committee and leads its monthly meetings.

Other senior leaders and members involved with the Risk Management Committee were drawn from across the agency and demonstrate the importance of ERM to FSA. Specifically, the committee is chaired by the independent senior risk advisor and comprised of the CRO, COO, CFO, Chief Information Officer (CIO), General Manager of Acquisitions, Chief Business Operations Officer, Chief of Staff, Chief Compliance Officer, Deputy COO, and Chief Customer Experience Officer, and meets monthly. Agency officials said that the participation of the COO, along with that of the other functional chiefs, indicates ERM’s importance and the commitment of staff—namely these executives–in the effort.

National Institute of Standards and Technology Surveyed Leaders’ Views of Risk Appetite

Developing an agency risk appetite requires leadership involvement and discussion. The organization should develop a risk appetite statement and embed it in policies, procedures, decision limits, training, and communication, so that it is widely understood and used by the agency. Further, the risk appetite may vary for different activities depending on the expected value to the organization and its stakeholders. To that end, the National Institute of Standards and Technology (NIST) ERM Office surveyed its 33-member senior leadership team to measure risk appetite among its senior leaders. Without a clearly defined risk appetite, NIST could be taking risks well beyond management’s comfort level, or passing up strategic opportunities by assuming its leaders were risk averse. The survey objectives were to “assess management familiarity and use of risk management principles in day-to-day operations and to solicit management perspectives and input on risk appetite, including their opinions on critical thresholds that will inform the NIST enterprise risk criteria.”

Survey questions focused on the respondent’s self-reported understanding of a variety of risk management concepts and asked respondents to rate how they consider risk with respect to management, safety, and security. The survey assessed officials’ risk appetite across five areas: NIST Goal Areas, Strategic Objectives, Core Products and Services, Mission Support Functions, and Core Values. See figure 2 for the rating scale that NIST used to assess officials’ appetite for risk in these areas.

The survey results revealed a disconnect between the existing and desired risk appetite for mission support functions. According to NIST officials, respondents believed the bureau needed to accept more risk to allow for innovation within mission support functions. According to agency officials, to better align risk appetite with mission needs, the NIST Director tasked the leadership team with developing risk appetite levels for those areas with the greatest disagreement between the existing and desired risk appetite, while still remaining compliant with laws and regulations. Agency officials told us the NIST ERM Office plans to address this topic via further engagement with senior managers and subject matter experts.

Good Practice: Develop a Risk-Informed Culture to Ensure All Employees Can Effectively Raise Risks

The following examples illustrate how selected agencies are developing a risk-informed culture, including how they have: encouraged employees to discuss risks openly, trained employees on ERM approach engaged employees in ERM efforts, and customized ERM tools for organizational mission and culture.

This good practice relates most closely to Identify Risks, one of the Essential Elements of Federal Government ERM shown in table 1.

Commerce Defined Roles and Responsibilities Across the Agency to Build a Risk Management Culture and Guide Its ERM Process

Successful ERM programs find ways to develop an organizational culture that allows employees to openly discuss and identify risks, as well as potential opportunities to enhance organizational goals or value. The CFOC and PIC Playbook also supports this notion that once ERM is built into the agency culture, the agency can learn from managed risks or, near misses, using them to improve how it identifies and analyzes risk. For example, Commerce officials sought to embed a culture of risk awareness across the department by defining cascading roles of leadership and responsibility for ERM across the department and for its 12 bureaus. Additionally, an official noted that Commerce leveraged this forum to share bureau best practices; develop a common risk lexicon; and address cross-bureau risks, issues and concerns regarding ERM practice and implementation. According to the updated ERM program policy, these roles should support the ERM program and promote a risk management culture. They also help promote transparency, oversight, and accountability for a successful ERM program.

Table 2 shows the ERM roles and set of responsibilities within Commerce and how they support a culture of risk awareness at each level.

To successfully implement and sustain ERM, it is critical that staff, at all levels, understand how the organization defines ERM, its subsequent ERM approach, and organizational expectations on their involvement in the ERM process. The CFOC and PIC Playbook also supports risk awareness as previously stated because once ERM is built into the agency culture, it can be possible to learn from managed risks and near misses when risks materialize, and then used to improve the process of identifying and analyzing risk in the future. Further, the Playbook suggests that this culture change can only occur if top agency leaders champion ERM and encourage the flow of information needed for effective decision making. For example, to promote cultural change and encourage employees to raise risks, PIH trained about half of its 1,500 employees in 2015. Agency officials told us that they plan to expand on the 2015 training and provide training to all PIH employees after 2016.

The in-person PIH training includes several features of our identified ERM good practices, such as leadership support and the importance of developing a risk-informed culture. For example, the Principal Deputy Assistant Secretary for PIH was visibly involved in the training and kicked off the first of the five training modules using a video emphasizing ERM. The training contained discussions and specific exercises dedicated to the importance of raising and assessing risks and understanding the leadership and employee roles in ERM. The first training module emphasized the factors that can support ERM by highlighting the following cultural characteristics.

ERM requires a culture that supports the reporting of risks.

ERM requires a culture of open feedback.

A risk-aware culture enables all HUD staff to speak up and then be listened to by decision-makers.

Leadership encourages the sharing of risks.

By focusing on the importance of developing a risk aware culture in the first ERM training module, PIH officials emphasized that ERM requires a cultural transformation for its success. To enable all employees to participate and benefit from the training, PIH officials recorded the modules and made them available on You-Tube.

TSA Sponsored Several Programs to Raise Risk Awareness Among Employees

Our literature review found that building a risk-aware culture supports the ERM process by encouraging staff across the organization to feel comfortable raising risks. Involving employees in identifying risks allows the agency to increase risk awareness and generate solutions to those identified risks. Some ways to strengthen this culture include the presence of risk management communities of practice, the development and dissemination of a risk lexicon agencywide, and conducting forums that enable frontline staff to raise risk-related strategic or operational concerns with leadership and senior management. For example, TSA’s Office of the Chief Risk Officer (OCRO) has sponsored a number of activities related to raising risk awareness.

First, TSA has established a risk community of interest open to any employee in the organization, and has hosted speakers on ERM topics. These meetings have provided an opportunity for employees across the administration to learn and discuss risks and become more knowledgeable about the types of issues that should be raised to management.

Second, TSA created a risk lexicon, so that all staff involved with ERM would use and understand risk terminology similarly. The lexicon describes core concepts and terms that form the basis for the TSA ERM framework. TSA incorporated the ERM lexicon into the TSA ERM Policy Manual.

Third, in January 2016, TSA started a vulnerability management process for offices and functions with responsibility for identifying or addressing security vulnerabilities. Officials told us that this new process is intended to help raise risks from the bottom up so that they receive top level monitoring. According to the December 2015 TSA memo we reviewed, the process centralizes tracking of vulnerability mitigation efforts with the CRO, creates a central repository for vulnerability information and tracking, provides executive engagement and oversight of enterprise vulnerabilities by the Executive Risk Steering Committee (ERSC), promotes cross-functional collaboration across TSA offices, and requires the collaboration of Assistant Administrators and their respective staff across the Agency.

See figure 3 below for an overview of how TSA’s vulnerability management process is intended to work. The CRO told us that employees from all levels can report risks with broader, enterprise-level application to the OCRO. Once the OCRO decides the risks are at an enterprise level, the office assembles a working group and submits ideas to the ERSC to decide at what level it should be addressed. The risk is then assigned to an executive who will be required to provide a status update.

Fourth, officials in the TSA OCRO told us that TSA has established points of contact in every program office, referred to as ERM Liaisons. Each ERM Liaison is a senior level official that represents their program office in all ERM related activities. TSA also implemented risk management awareness training to headquarters and field supervisors that covered topics such as risk-based decision-making, risk assessment, and situational awareness. Officials told us they are also embedding ERM principles into existing training, so that employees will understand how ERM fits into TSA operations.

NIST Adapted the Commerce ERM Framework to Reflect Lab Safety Vocabulary Appropriate to Its Culture

Customizing ERM tools and templates can help ensure risk management efforts fit agency culture and operations. For example, NIST tailored certain elements of the Commerce ERM framework to better reflect the bureau’s risk thresholds. Commerce has developed a set of standard risk assessment criteria to help identify and rate risks, referred to as the Commerce ERM Reference Card. NIST officials reported that some of the safety and security terms used at Commerce differed from the terms used at NIST and required tailoring to map to NIST’s existing safety risk framework, which is a heavily embedded component of NIST operations and culture. To better align to NIST, the NIST ERM Program split safety and security risks into distinct categories when establishing a tailored ERM framework for the bureau (see table 3).

According to agency officials, the NIST ERM Reference Card also leverages American National Standards Institute guidelines, so it does not introduce another separate and potentially conflicting set of terms. Officials told us that these adaptations to the NIST ERM framework help maintain continuity with the Commerce framework, but reflect the particular mission, needs, and culture of NIST.

Good Practice: Integrate ERM Capability to Support Strategic Planning and Organizational Performance Management

The following examples illustrate how selected agencies are integrating ERM capability to support strategic planning and organizational performance management. These include how they have: incorporated ERM into strategic planning processes, and used ERM to improve information for agency decisions.

This good practice most closely relates to Assess Risks, one of the Essential Elements of Federal Government ERM, shown in table 1.

Treasury Used Risk Discussions in Quarterly Performance Reviews

Through ERM, an agency looks for opportunities that may arise out of specific situations, assesses their risk, and develops strategies to achieve positive outcomes. In the federal environment, agencies can leverage the GPRAMA performance planning and reporting framework to help better manage risks and improve decision making. For example, Treasury has integrated ERM into its existing strategic planning and management processes. According to our review of the literature and the subject matter specialists we interviewed, using existing processes helps to avoid creating overlapping processes. Further, by incorporating ERM this way, risk management becomes an integral part of setting goals, including agency priority goals (APG), ultimately achieving an organization’s desired outcomes. Agencies can use regular performance reviews, such as the quarterly performance reviews of APGs and annual leadership- driven strategic objective review, to help increase attention on progress towards the outcomes agencies are trying to achieve. According to OMB Circular No. A-11, agencies are expected to manage risks and challenges related to delivering the organization’s mission. The agency’s strategic review is a process by which the agency should coordinate its analysis of risk using ERM to make risk-aware decisions, including the development of risk profiles as a component of the annual strategic review, identifying risks arising from mission and mission-support operations, and providing a thoughtful analysis of the risks an agency faces towards achieving its strategic objectives. Instituting ERM can help agency leaders make risk- aware decisions that affect prioritization, performance, and resource allocation.

Treasury officials stated they integrated ERM into their quarterly performance or data-driven reviews and strategic reviews, both of which already existed. Officials stated this action has helped elevate and focus risk discussions. Staff from the management office and individual bureaus work together to complete the template slide, which is used to include a risk element in their performance reviews. As part of this process, they are assessing risk. See figure 4 for how risk is incorporated into Treasury’s quarterly performance review (QPR) template. Officials stated that they believe this approach to prepare for the data-driven review has helped improve outcomes at Treasury. For example, according to agency officials, Treasury used its QPR process to increase cybersecurity.

Treasury officials also told us that during the fall and the spring, each Treasury bureau completes the data-driven review templates. Agency officials are to use the summer data-driven review as an opportunity to discuss budget formulation. In winter, they are to use the annual data- driven review to show progress towards achieving strategic objectives. According to agency officials, the strategic review examines and assesses risks identified as part of the data-driven reviews and aggregates and analyzes these results at the cross cutting strategic objective level, which helps improve agency performance. Integrating ERM into this existing data-driven review process avoids creating a duplicative process and increases the focus on risk.

In another example, Treasury officials identified implementation of the Digital Accountability and Transparency Act of 2014 (DATA Act) both at Treasury and government-wide as a risk and established “Financial Transparency” as one of its two APGs for fiscal years 2016 and 2017. According to agency officials, incorporating risk management into the data-driven review process sends a signal about the importance of the DATA Act and brings additional leadership focus and scrutiny needed to successfully implement the law.

OPM Builds Agency View of Risk into Decision Making and Organizational Performance Management Reviews

The literature we reviewed notes that ERM contributes to leaders’ ability to identify risks and adjust organizational priorities to enhance decision- making efforts. For example, OPM has a Risk Management Council (RMC) that builds risk-review reporting and management strategies into existing decision making and performance management structures. This includes Performance Dashboards, APG reviews, and regular meetings of the senior management team, as is recommended by the CFOC and PIC Playbook. The RMC also uses an existing performance dashboard for strategic goal reviews as part of its ERM process and to help inform decisions as a result of these reviews. Officials told us they present their dashboards every 6 or 7 weeks to the Chief Management Officer (CMO) and RMC, as part of preparing for their data-driven reviews. Each project and its risks are mapped against the strategic plan. When officials responsible for a goal identify risks, they must also provide action plan strategies, timelines, and milestones for mitigating risks.

Figure 5 shows an OPM dashboard to illustrate how OPM tracks progress on a goal of preparing the federal workforce for retirement, for such a risk as an unexpected retirement surge, and documents mitigation strategies to address such events. According to agency officials, the CMO and RMC monitor high level and high visibility risks on a weekly basis. In August 2016, OPM officials told us they were monitoring five to seven major projects, such as information technology (IT) security implementation and retirement services processes.

Each quarterly data-driven review includes an in-depth look into a specific goal and the examination of risks as part of the review. Officials told us that in the past 3 years, they have covered each of the strategic goals using the dashboard. According to officials, during one of these reviews, OPM identified a new risk related to having sufficient qualified contracting staff to meet the goal of effective and efficient IT systems. Since OPM considers contracting a significant component of that goal, they decided to create the Office of Procurement Operations to help increase attention to contracting staff. Using ERM, OPM officials told us they believe that they could better prioritize funding requests across the agency, ultimately balance limited resources, and make better informed decisions.

Good Practice: Establish a Customized ERM Program Integrated into Existing Agency Processes

The following examples illustrate how selected agencies are establishing a customized ERM program into existing agency processes. These include how they have: designed an ERM program that allows for customized agency fit, developed a consistent, routinized ERM program, and used a maturity model approach to build an ERM program.

This good practice relates primarily to Identify Risk and Select Risk Response, two of the Essential Elements of Federal Government ERM shown in table 1.

The Office of Federal Student Aid Customized Its Approach to Designing and Implementing ERM

Effective ERM implementation starts with agencies establishing a customized ERM program that fits their specific organizational mission, culture, operating environment, and business processes but also contains the essential elements of an ERM framework. The CFOC and PIC Playbook focuses on the importance of a customized ERM program to meet agency needs. This involves taking into account policy concerns, mission needs, stakeholder interests and priorities, agency culture, and the acceptable level for each risk, both for the agency as a whole and for the specific programs.

For example, in 2004, the Department of Education’s (Education) Office of Federal Student Aid (FSA) began establishing a formal ERM program, based on the Committee of Sponsoring Organizations of the Treadway Commission (COSO) ERM Framework, to help address longstanding risks using customized implementation plans. More specifically, FSA’s framework and materials were customized for it to ensure that they were specific to work within a government setting, and to capture the nuances of FSA's business model. Agency officials told us that one reason they adopted a COSO-based model for ERM is that it was geared toward achieving an entity's objectives, and could be customized to meet FSA’s organizational needs as a performance-based organization.

Thus, FSA adopted a three-phase approach that allowed for increased maturity over time, and customized it to help the organization adapt to the new program using a COSO-based methodology for risk management. According to FSA documents, the first phase involved creating the ERM organization, designing a high-level implementation plan, and forming its enterprise risk committee to help support its first ERM efforts. The second phase involved creating a strategic plan and detailed project plan to implement ERM. For example, the original FSA ERM Strategic Plan contained an ERM vision statement (see textbox below) for aligning strategic risks with goals and objectives. The FSA Plan also provided its approach for identifying risks that could affect FSA’s ability to achieve these objectives.

Federal Student Aid Enterprise Risk Management Original Vision Statement “Our vision is to create the premier Enterprise Risk Management Program in the Federal government. One that provides for an integrated view of risk across the entire Federal Student Aid organization; aligns strategic risks with the organization’s goals and objectives; ensures that risk issues are integrated into the strategic decision making process; and manages risk to further the achievement of performance goals.”

During the initial implementation of FSA's ERM program, the ERM strategic goals were to: 1. provide for an integrated view of risks across the organization, 2. ensure that strategic risks are aligned with strategic goals and 3. develop a progressive risk culture that fosters an increased focus on risk and awareness of related issues throughout the organization, and 4. improve the quality and availability of risk information across all levels of the organization, especially for executive management.

Finally, according to documents we reviewed, the third phase of FSA’s ERM implementation included developing enterprise-level risk reports, and advanced methods, tools, and techniques to monitor and manage risk. For example, the documents we reviewed showed that some of the key tools that supported FSA’s ERM implementation included ERM terminology, risk categories, risk ratings, and a risk-tracking system. These tools help FSA select an appropriate risk response that works with existing agency processes and culture.

TSA Risk Taxonomy Promotes a Consistent Approach to the Risk Review Process

A consistent process for risk review that systematically categorizes risk helps leaders to ensure that the consideration of potential risk takes place. The CFOC and PIC Playbook suggests that organizations define risk categories to support their business processes, and use these categories consistently. For example, to identify and review risks, the TSA Risk taxonomy organizes risks into categories so the agency can consistently identify, assess, measure, and monitor risks across the organization, as discussed in the TSA Policy Manual.

The TSA Risk Taxonomy captures the risks in all aspects of mission operations, business operations, governance, and information. Figure 6 lists each risk category that is reviewed. The taxonomy helps TSA both collect risks and identify the most critical, and helps ensure that the same vocabulary and categorization system are used across TSA. Officials report that they chose these categories to help break down organizational silos and help identify all types of risks. For example, they did not want “mission risk” to consider only the Federal Air Marshal Service and airport checkpoint screening. Rather, they wanted a broad understanding of risks across the various TSA components.

TSA officials stated that they believe the taxonomy will be even more useful when TSA has an automated computer application to help analyze all similar and related risks across the enterprise.

Commerce Designed an Assessment Tool for Its Bureaus to Determine Their ERM Maturity

OMB is encouraging agencies to use a maturity model approach in the ERM guidance provided in A-123. Results from our literature review and OMB suggested that a maturity model allows the organization to plan for continued agency improvement as its efforts mature. For example, to assist implementing a department-wide ERM process, Commerce developed an ERM Maturity Assessment Tool (EMAT), as well as a comprehensive guidebook and other tools, to share with its 12 bureaus. The EMAT consists of 83 questions to help bureaus determine their ERM maturity (see figure 7 for a sample of EMAT questions). According to agency officials, bureaus are required to conduct EMAT assessments annually. According to agency officials, while the EMAT lays out the basic components of ERM, the bureaus may customize the tool to fit their respective organizations. Commerce expects the bureaus to demonstrate increased levels of maturity over time. Agency officials reported that overall, the level of maturity has increased since the program began.

Discussions of the EMAT have allowed bureaus to learn from each other and identify strategies for addressing common challenges. According to officials, these challenges include documenting risk treatment plans and providing the rationale to support management’s risk mitigation choices.

Good Practice: Continuously Manage Risks

The following example illustrates how a select agency is continuously managing risks including how it has: tracked and monitored current and emerging risks.

This good practice most closely relates to Monitor Risks, one of the Essential Elements of Federal Government ERM shown in table 1.

HUD Uses Risk Dashboards to Monitor Risks

Continuously managing risk requires a systematic or routine risk review function to help senior leaders and other stakeholders accomplish the organizational mission. The CFOC and PIC Playbook recommends that risks be identified and assessed throughout the year as part of a regular process, including surveillance of leading risk indicators both internally and externally. For example, PIH has two risk management dashboards, which it uses to monitor and review risks.

The Risk and Mitigation Strategies Dashboard shown in figure 8, according to PIH officials, helps them monitor risks and mitigation actions that PIH is actively pursuing. Officials told us that the risk division prepares and presents this dashboard to the Risk Committee quarterly. The dashboard provides a snapshot view for the current period, analysis of mitigation action to date, and trends for the projected risk. It tracks the highest level risks to PIH as determined by the Risk Committee, along with the corresponding mitigation plans. Currently, officials told us PIH is managing the top risks using the dashboard. Risk division staff continually update the dashboard to concisely display the status of both risk and mitigation efforts.

The second dashboard in figure 9, Key Risk Indicators Dashboard, monitors external, future risks to PIH’s mission. Agency officials told us that the dashboard is used as an early-warning system for emerging risks, which the Risk Committee must address before the next annual risk assessment cycle begins. The dashboard includes a risk-level column that documents the residual risk, and is measured on a five-point scale with one being the lowest and five being the highest, which is assigned by the relevant Deputy Assistant Secretary and Risk Division staff. A trending column indicates whether the risk is projected to increase, decrease, or remain the same. There is also a link to a document that summarizes the risk assessment including the risks and measures to address the risk and anticipated impact. The Risk Committee reviews the dashboard as needed, but not less than quarterly.

These two dashboards show how an agency uses the continuous risk review cycle. The cycle allows leaders to treat risks until they are satisfied the risk is under control or successfully treated or managed.

Good Practice: Share Information with Internal and External Stakeholders to Identify and Communicate Risks

The following examples illustrate how selected agencies are sharing information with internal and external stakeholders to identify and communicate risks. These include how they have: incorporated feedback on risks from internal and external stakeholders to better manage risks, and shared risk information across the enterprise.

This good practice most closely relates to Communicate and Report on Risks in the Essential Elements of Federal Government ERM shown in table 1.

Two Agencies Use A Memorandum of Understanding to Share Accountability and Ownership for Risks from a Shared Satellite Program

Effective information and communication are vital for an agency to achieve its objectives and this often involves multiple stakeholders, inside and outside the organization. ERM programs should incorporate feedback from internal and external stakeholders because their respective insights can help organizations identify and better manage risks. For example, the National Oceanic and Atmospheric Administration (NOAA) and the National Aeronautics and Space Administration (NASA) are creating and sharing inter-agency risk information as part of their joint management of the Joint Polar Satellite System (JPSS) program. JPSS is a collaborative effort between NOAA and NASA; the program was created with the President’s Fiscal Year 2011 Budget Request to acquire, develop, launch, operate and sustain three polar-orbiting satellites. The purpose of the JPSS program is to replace aging polar satellites and provide critical environmental data used in forecasting such weather events as the path and intensity of a hurricane and measuring climate variations. These two agencies have a signed agreement, or memorandum of understanding, to share ownership for risk that details the responsibilities for delivering the satellite and overall cost and schedule performance. In particular, NOAA has overall responsibility for the cost and schedule of the program, as well as the entire JPSS program. NOAA manages the ground segment elements needed for data collection and distribution, while NASA manages the system acquisition, engineering, and integration of the satellite, as well as the JPSS Common Ground System.

Because of this management arrangement, the Joint Polar Satellite System (JPSS) program also required “joint” risk tracking and management. Other program documentation also points to the agencies’ close collaboration on risk management. The March 2014, JPSS Risk Management Plan describes how risk management practices are planned for consistency with NASA’s risk management requirements and outlines roles and responsibilities. NOAA officials stated that they share programmatic and technical information across the two agencies, and that certain high-level risks are elevated through Commerce quarterly. Our review of meeting agendas and presentations show that NASA and NOAA officials met monthly as part of a NOAA held Agency Program Management Council (APMC) to track JPSS’s progress and that of other satellite programs. These meetings also allowed participants to discuss and approve courses of action for top program risks. During the APMC meetings, the JPSS program director presented status updates and other information including risks. Participants discussed risks, cost, performance, schedule, and other relevant issues for each program.

Sharing information helps promote trust within and outside of the organization, increases accountability for managing risks, and helps stakeholders understand the basis for identified risks and resulting treatment plans. Further, internal and external stakeholders may be able to provide new expertise and insight that can help organizations identify and better manage risks. Both the NASA Program Managers and the NOAA Program Director or their representatives attend meetings to discuss potential issues, according to NOAA officials. Each major satellite program also has an independent Standing Review Board. At defined program/project milestones, the Standing Review Board reviews relevant data and writes up its conclusions, presents an independent review of the program/project, and highlights key risks to the convening authorities. NOAA officials said that having a joint risk-sharing process established for JPSS and other joint programs allows them to elevate risks both internally up through the agency, and externally, more quickly and efficiently. For example, for another satellite program, NOAA had to reschedule its launch date due to a problem that arose with the launch service provider.

After it became clear that the program was going to miss its schedule baseline, it was elevated up through NOAA. According to NOAA, NASA officials then explained to the APMC the steps they were taking to address the risk. As a result of having a process to elevate the risk, NOAA was able to discuss risks associated with the launch vehicle and how it planned to proceed with a new launch date range. According to NOAA officials, because the APMC discussion developed joint information, this information was available to pass on more quickly to Congress.

IRS Uses a Decision-Making Tool that Includes Input from Stakeholders Across the Enterprise

When discussing potential risks, gathering input from across an enterprise helps to ensure decisions work for all agency groups affected. It also gives groups an opportunity to share any concerns or ideas that can improve outcomes. Appropriate and timely sharing of information within an organization ensures that risk information remains relevant, useful, and current. The CFOC and PIC Playbook also notes that informed decision making requires the flow of information regarding risks and clarity about uncertainties or ambiguities—up and down the hierarchy and across silos—to the relevant decision makers so they can make informed decisions. For example, IRS uses the Risk Acceptance Form and Tool (RAFT) as shown in figure 10 to document business decisions within a consistent framework. As part of the RAFT development process, IRS considers the views of internal and external stakeholders. According to agency officials, the RAFT assists IRS business units in making better risk-based decisions and elevating risks to the appropriate level. IRS officials said the RAFT also encourages units to consider how decisions may affect other units, as well as external stakeholders. As a result, business units often collaborate on key decisions by completing the RAFT, including considering and documenting risks associated with those decisions.

According to IRS officials, the RAFT is used as a guide to articulate rationales behind decisions within the context of risk appetite and serves as a documentation trail to support these business decisions. IRS agency officials told us that one goal of its ERM program is to look at risk across the enterprise rather than taking a narrow approach to risk management. This also applies when making risk informed decisions, such as those that would be documented on a RAFT. As such, the RAFT includes the following instructions: “If the decision impacts or involves multiple organizations, coordinate with the respective points-of-contact to ensure all relevant information regarding the risk(s) are addressed in each section.” The form also allows users to identify other business units involved in the decision and external stakeholders affected by the decision.

Agency Comments and GAO Responses

We provided a draft of this report to Office of Management and Budget (OMB) and the 24 Chief Financial Officer (CFO) Act agencies for review and comment. OMB staff provided us with oral comments and stated they generally agreed with the essential elements and good practices as identified in this report. They also provided technical comments that we incorporated as appropriate. We received written responses from the Social Security Administration (SSA) and Department of Veterans Affairs (VA) reprinted in appendices II and III. The SSA and the VA neither agreed nor disagreed with our findings. However, VA mentioned that enterprise risk management should be monitored at a minimum as part of the quarterly reviews of Agency Priority Goals because of the high-level audience led by the Deputy Secretary and suggested that monitoring risks more frequently should be emphasized as a practice that most agencies should follow, among other things. SSA stated that they are adopting the good practices identified in the report.

Of the remaining 22 CFO Act agencies, we received technical comments from 10 agencies, which we incorporated as appropriate, 10 had no comments, and two others did not respond.

We are sending copies of this report to the Director of OMB as well as appropriate congressional committees and other interested parties. In addition, this report is available at no charge on the GAO website at http://www.gao.gov.

If you or your staff members have any questions about this report, please contact me at (202) 512-6806 or mihmj@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix IV.

Appendix I: Subject Matter Specialists

Dr. Doug Webster, AFERM, Co-founder and Past President; George Washington University Center for Excellence in Public Leadership, Senior Fellow; author of articles and a book on ERM in the public sector; and Director, Risk Management at the U.S. Agency for International Development, Office of the Chief Financial Officer.

Appendix III: Comments from the Department of Veterans Affairs

Appendix IV: GAO Contact and Staff Acknowledgements

GAO Contact

Staff Acknowledgements

In addition to the individual named above, William M. Reinsberg, Assistant Director, Carole J. Cimitile, Analyst-in-Charge, Shea Bader, Crystal Bernard, Amy Bowser, Alexandra Edwards, Ellen Grady, Erin E. Kennedy, Erik Kjeldgaard, Robert Gebhart, Sharon Miller, Anthony Patterson, Laurel Plume, Robert Robinson, Cynthia Saunders, Stewart W. Small, Katherine Wulff, and Jessica L. Yutzy made major contributions to this report.