Like any professional, the salary range for an ERM professional with 10 years of working experience will depend on many factors. Formal education, relevant peripheral experience (e.g., strategic planning, performance management, internal controls, audit, etc.), closely aligned experience (i.e., risk management and ERM), and specific familiarity with the organization and/or similar projects all play into (more…)
[More]
Compiling risk registers and claiming treatment effectiveness.
[More]Wade, OMB A-123 update of July 15, 2016 required ERM to be implemented at all executive agencies, regardless of size. How robustly those agencies are implementing ERM is another question, and one that has not been authoritatively addressed to the best of my knowledge. There is an A-123 requirement, however, that ERM and internal controls (more…)
[More]Doug, I wish I knew of such a repository. We face many challenges in our risk management community. One challenge is that risk management is too seldom recognized as an actual discipline of knowledge. The recognition of Enterprise Risk Management is rising rapidly in the Federal government. This suggests that risk management will become more broadly recognized as (more…)
[More]There is no standard form for developing a risk assessment report. While various sources indicate elements that may find a home in such a report, one might expect no standard exists because assessment reports can be written for different audiences with different information needs. Understanding what might go into a risk assessment report should thus (more…)
[More]
Rationalizing and aligning the concepts and terminology of the internal control community with the risk management community is an ongoing challenge for many in the public sector and beyond. This is in part because these two communities come from a history relying on similar terms to mean different things. Take for example the concepts of (more…)
[More]David, thank you for your question. In my view, ERM is intended to be forward thinking/scanning the horizon, while the existing internal controls only measure how well we are executing measurable components towards our strategic goals. ERM looks at what could keep us from accomplishing our goals, so it would seem that ERM would have (more…)
[More]
As I hopefully conveyed in my prior thoughts on the distinction between ERM and internal controls, it would be a serious mistake for any organization to presume their internal control program will suffice for addressing the risk to their organizational objectives. Hopefully that message will filter down throughout the Department, because all levels of the (more…)
[More]One way of answering this question is to first ask: (1) what is the purpose of ERM? and (2) what is the key mechanism of ERM in accomplishing this goal? ERM seeks to develop an organization-wide, portfolio view of risk that allows balancing results, resources and risks in a manner that maximizes stakeholder value. The (more…)
[More]Previously, I shared thoughts on the relationship between internal control and risk management. These two terms are not synonyms, and to understand their relationship is important to achieving any organization’s full set of objectives. However, how does Enterprise Risk Management (ERM) factor into this discussion? Is ERM simply a new term for discussing risk management, (more…)
[More]