Additional Details

(part 2 of 2) We are a bureau within a much larger agency.  Some are calling for us to implement ERM, but there appears to be no meaningful action to do so at the higher agency level.  How can we implement ERM without doing so at the agency level?  Will doing so even be helpful?

AFERM EXPERTS SAY...

As I hopefully conveyed in my prior thoughts on the distinction between ERM and internal controls, it would be a serious mistake for any organization to presume their internal control program will suffice for addressing the risk to their organizational objectives.  Hopefully that message will filter down throughout the Department, because all levels of the Department will need to be engaged if true ERM is to ultimately result.

Moving to ERM requires a change in organizational culture for most of the Federal government. In may be that bureaus may in some cases actually have leaders who more quickly understand and see the value of ERM.  In those cases, we may see bureaus or other subordinate parts of larger organizations being the primary advocates for ERM.  In DoD, for example, early explorers of ERM included DFAS (in 2007) and DLA (in 2009), well before DoD as a whole had expressed any interest in ERM.  While these early initiatives eventually stalled due to changes in leadership, my expectation is that the new focus by OMB on risk management and ERM as reflected in A-123 and A-11 will encourage proactive leaders to initiate ERM programs regardless of their organizational level.