ERM allows management to understand an organization’s portfolio of top- risk exposures, which could affect the organization’s success in meeting its goal. As such, ERM is a decision-making tool that allows leadership to view risks from across an organization’s portfolio of responsibilities. ERM recognizes how risks interact (i.e., how one risk can magnify or offset another risk), and also examines the interaction of risk treatments (actions taken to address a risk), such as acceptance or avoidance. For example, treatment of one risk in one part of the organization can create a new risk elsewhere or can affect the effectiveness of the risk treatment applied to another risk. ERM is part of overall organizational governance and accountability functions and encompasses all areas where an organization is exposed to risk (financial, operational, reporting, compliance, governance, strategic, reputation, etc.). In July 2016, OMB updated its Circular No. A-123 guidance to establish management’s responsibilities for ERM, as well as updates to internal control in accordance with Standards for Internal Control in the Federal Government. OMB also updated Circular No. A-11, Preparation, Submission, and Execution of the Budget in 2016 and refers agencies to Circular No. A-123 for implementation requirements for ERM. Circular No. A-123 guides agencies on how to integrate organizational performance and ERM to yield an “enterprise-wide, strategically-aligned portfolio view of organizational challenges that provides better insight about how to most effectively prioritize resource allocations to ensure successful mission delivery.” The updated requirements in Circulars A- 123 and A-11 help modernize existing management efforts by requiring agencies to implement an ERM capability coordinated with the strategic planning and strategic review process established by the GPRA Modernization Act of 2010 (GPRAMA), and with the internal control processes required by the FMFIA and in our Standards for Internal Control in the Federal Government. This integrated governance structure is designed to improve mission delivery, reduce costs, and focus corrective actions towards key risks. More specifically, Circular No. A-123 discusses both internal control and ERM and how these fit together to manage agency risks. Our Standards for Internal Control in the Federal Government describes internal control as a process put in place by an entity’s oversight body, management, and other personnel that provides reasonable assurance that objectives related to operations, compliance, and reporting will be achieved, and serves as the first line of defense in safeguarding assets. Internal control is also part of ERM and used to manage or reduce risks in an organization. Prior to implementing ERM, risk management focused on traditional internal control concepts to managing risk exposures. Beyond traditional internal controls, ERM promotes risk management by considering its effect across the entire organization and how it may interact with other identified risks. Additionally, ERM also addresses other topics such as setting strategy, governance, communicating with stakeholders, and measuring performance, and its principles apply at all levels of the organization and across all functions. Implementation of OMB circulars is expected to engage all agency management, beyond the traditional ownership of A-123 by the Chief Financial Officer community. According to the A-123 Circular, it requires leadership from the agency Chief Operating Officer (COO) and Performance Improvement Officer (PIO) or other senior official with responsibility for the enterprise, and close collaboration across all agency mission and mission-support functions. The A-123 guidance also requires agencies to create a risk profile that helps them identify and assess risks arising from mission and mission-support operations, and consider those risks as part of the annual strategic review process. Circular A-123 requires that agencies’ risk profiles include risks to strategic, operations, reporting and compliance objectives. A federal interagency group of ERM practitioners developed a Playbook released through the Performance Improvement Council (PIC) and the Chief Financial Officers Council (CFOC) in July 2016 to provide federal agencies with a resource to support ERM. In particular, the Playbook assists them in implementing the required elements in the updated A-123 Circular. To assist agencies in better assessing challenges and opportunities from an enterprise-wide view, we have updated our risk management framework first published in 2005 to more fully include recent experience and guidance, as well as specific enterprise-wide elements. As mentioned previously, our 2005 risk management framework was developed in the context of risks associated with homeland security and combating terrorism. However, increased attention to ERM concepts and their applicability to all federal agencies and missions led us to revise our risk framework to incorporate ERM concepts that can help leaders better address uncertainties in the federal environment, changing and more complex operating environments due to technology and other global factors, the passage of GPRAMA and its focus on overall performance improvement, and stakeholders seeking greater transparency and accountability. For many similar reasons, the Committee of Sponsoring Organizations of the Treadway Commission (COSO) initiated an effort to update its ERM framework for 2016, and the International Organization for Standardization (ISO) plans to update its ERM framework in 2017. Further, as noted, OMB has now incorporated ERM into Circulars A-11 and A-123 to help improve overall agency performance. We identified six essential elements to assist federal agencies as they move forward with ERM implementation. Figure 1 below shows how ERM’s essential elements fit together to form a continuing process for managing enterprise risks. The absence of any one of the elements below would likely result in an agency incompletely identifying and managing enterprise risk. For example, if an agency did not monitor risks, then it would have no way to ensure that it had responded to risks successfully. There is no “one right” ERM framework that all organizations should adopt. However, agencies should include certain essential elements in their ERM program. Below we describe each essential element in more detail, why it is important, and some actions necessary to successfully build an ERM program. 1. Align the ERM process to agency goals and objectives. Ensure the ERM process maximizes the achievement of agency mission and results. Agency leaders examine strategic objectives by regularly considering how uncertainties, both risks and opportunities, could affect the agency’s ability to achieve its mission. ERM subject matter specialists confirmed that this element is critical because the ERM process should support the achievement of agency goals and objectives and provide value for the organization and its stakeholders. By aligning the ERM process to the agency mission, agency leaders can address risks via an enterprise-wide, strategically-aligned portfolio rather than addressing individual risks within silos. Thus, agency leaders can make better, more effective decisions when prioritizing risks and allocating resources to manage risks to mission delivery. While leadership is integral throughout the ERM process, it is an especially critical component of aligning ERM to agency goals and objectives because senior leaders have an active role in strategic planning and accountability for results. 2. Identify risks. Assemble a comprehensive list of risks, both threats and opportunities, that could affect the agency from achieving its goals and objectives. This element of ERM systematically identifies the sources of risks as they relate to strategic objectives by examining internal and external factors that could affect their accomplishment. It is important that risks either can be opportunities for, or threats to, accomplishing strategic objectives. The literature we reviewed, as well as subject matter specialists, pointed out that identifying risks in any organization is challenging for employees, as they may be concerned about reprisals for highlighting "bad news." Risks to objectives can often be grouped by type or category. For example, a number of risks may be grouped together in categories such as strategic, program, operational, reporting, reputational, technological, etc. Categorizing risks can help agency leaders see how risks relate and to what extent the sources of the risks are similar. The risks are linked to relevant strategic objectives and documented in a risk register or some other comprehensive format that also identifies the relevant source and a risk owner to manage the treatment of the risk. Comprehensive risk identification is critical even if the agency does not control the source of the risk. The literature and subject matter specialists we consulted told us that it is important to build a culture where all employees can effectively raise risks. It is also important for the risk owner to be the person who is most knowledgeable about the risk, as this person is likely to have the most insight about appropriate ways to treat the risk. 3. Assess risks. Examine risks considering both the likelihood of the risk and the impact of the risk on the mission to help prioritize risk response. Agency leaders, risk owners, and subject matter experts assess each risk by assigning the likelihood of the risk’s occurrence and the potential impact if the risk occurs. It is important to use the best information available to make the risk assessment as realistic as possible. Risk owners may be in the best position to assess risks. Risks are ranked based on organizational priorities in relation to strategic objectives. Risks are ranked based on organizational priorities in relation to strategic objectives. Agencies need to be familiar with the strengths of their internal control when assessing risks to determine whether the likelihood of a risk event is higher or lower based on the level of uncertainty within the existing control environment. Senior leaders determine if a risk requires treatment or not. Some identified risks may not require treatment at all because they fall within the agency's risk appetite, defined as how much risk the organization is willing to accept relative to mission achievement. The literature we reviewed and subject matter specialists noted that integrating ERM efforts with strategic planning and organizational performance management would help an organization more effectively assess its risks with respect to the impact on the mission. 4. Select risk response. Select a risk treatment response (based on risk appetite) including acceptance, avoidance, reduction, sharing, or transfer. Agency leaders review the prioritized list of risks and select the most appropriate treatment strategy to manage the risk.