AFERM EXPERTS SAY...

Past experiences with ERM program audits by the Government Accountability Office (GAO) and Inspector General (IG) lead to similar areas of focus.  Their initial reviews concentrated on ensuring that basic program elements were present and documented.  These elements included the maturity model and program development map; ERM governance structure; ERM framework, including standardized processes and procedures; ERM function staffing, including Chief Risk Officer (CRO) duties and responsibilities, as well as placement within the agency’s organizational structure; and the agency’s Risk Appetite Statement.  After the audit teams understood the basic design and foundation elements supporting the ERM program, they investigated methods used to identify key risks, as well as conducted interviews with agency executives, ERM program staff, and ERM points of contact within each line of business.  While auditors from both teams were interested in the enterprise risk register and responses to key risks, the GAO team did not raise questions regarding whether the risk appetite and risk response actions were appropriate.  On the other hand, the IG audit team questioned various aspects of risk appetite and risk tolerance adopted by the agency.  Each audit team will likely have a different focus, but starting with foundational ERM program elements with a clear direction for program development and maturity will compel the audit team to consider how the agency is approaching its ERM program and may help steer auditors away from judgements about whether agency leadership has set suitable risk appetites and tolerances and if risk response actions are appropriate.

Question asked by Sharon White

Additional Details

COSO ERM Understanding and communicating risk appetite identifies 1) general statement, 2) by org objectives, or 3) by risk types identified by the org. What organizational characteristics would benefit from each of these methods? (e.g. education level of employees, complexity of org, variety of programs administered)

AFERM EXPERTS SAY...

Risk appetite denotes the level and nature of risk that is acceptable.  Risk tolerance refers to the degree of variability in Return on Investment (ROI) in programmatic execution or administration that an Agency is willing to withstand.  Risk appetites and tolerances should be set at the Governance level, Executive level, and Operational level and should flow downward from the top of the organization to the various lower levels of management, with actual risk information flowing from the lower levels of the organization, upward.

Should risk appetite and risk tolerance statements be documented by organizational objective or by risk classes?

Depending on the agency, risk appetite and risk tolerance statements can be documented by organizational objective or by risk classes, and in some agencies, risk appetite and risk tolerance statements can both be documented at the same time.  Some agencies manage complexity large enough to have to deal with differentiated risk classes within each organizational objective, and some agencies manage programs where a single set of risk classes can apply across the enterprise.

The most important thing to remember is that risk appetite and risk tolerance statements enable the ERM program and officers to respond to risk in a dynamic and direct way.  In other words, an Agency should make sure it does not create risk appetite and risk tolerance statements that constrain behavior (unless by design) and delay risk response actions.

AFERM EXPERTS SAY...

While OMB Circular A-123 requires agencies to present instances of uncertainty (i.e., opportunities and threats), where applicable, it does not necessarily mean that both will be presented in the risk profile. However, there are likely two reasons why opportunities are not readily identified in Federal risk profiles to the extent that threats are identified:

• The Federal government is inherently risk averse; and
• Most agencies are still in the early stages of ERM program maturation.

Because of the Federal government’s unique position, in comparison to perhaps a commercial entity, the Federal government tends to lean towards stability instead of volatility.  This places more emphasis on managing downside risks, or threats, and seeking to monitor or minimize the accompanying risk exposure.  Identifying and seeking to exploit opportunities involves numerous constraints in the Federal space, including potential alignment with the President’s agenda and the agency’s mission and priorities, not to mention sufficient funding to pursue the opportunity.  However, trends in information technology modernization, business intelligence, data analytics, and shared services, may support near-term reporting of opportunities in agencies’ risk profiles.

Secondly, it is taking time to shape agency risk culture and awareness to understand that risk essentially translates to uncertainty, and that uncertainty is not always negative. Focusing early ERM adoption and implementation strategies on enterprise risks helps build the foundation of an effective ERM program that may eventually seek to identify, exploit, and report on opportunities.  Additionally, ERM may be leveraged to review and understand existing risk exposures when evaluating new strategic objectives and opportunities.  Due to many Federal ERM programs still being in their early stages of implementation, adopting a risk profile and a risk awareness that promotes the identification of opportunities will take time to complete.

AFERM EXPERTS SAY...

Risk is typically considered a function of probability/likelihood of an event occurring, and the impact/consequence of that impact if the event does occur.  The scoring of the risk is thus a function of the combination of those two factors.  This is often graphically displayed on a “heat map”, in which one axis is likelihood/probability and the other impact/consequence. The axes may be numbered (e.g., 1-5) or have descriptions (e.g., Rare, remote, moderate, likely, very likely for probability and insignificant, minor, significant, major, critical for impact).  The intersection of a specific risk’s likelihood and impact is its risk rating.  These ratings can be quantitative (often the product of the numbers associated with the impact and probability ratings) or qualitative (e.g., low, medium, high, critical).  There is no single accepted approach to how many levels are designated for probability, impact or risk rating.

Keep in mind that risk treatment is not always mitigation.  Mitigation literally means to reduce, and that term is generally used in risk management to mean reduction in the likelihood or impact of a risk, and thus the overall level of risk after treatment. However, other treatment options include accepting the risk as it is, avoiding the risk, or transferring the risk to another party.  In any event, the risk after treatment is scored in the same fashion as evaluation of the risk before treatment.  Depending on the nature of the risk, this may be very quantifiable with significant precision.  In other cases, the estimation of a risk before and after treatment may be very subjective.  In the latter case, it is often advisable to gather a number of subject matter experts to discuss the risk and seek to achieve consensus on the level of risk before and after treatment.  In all cases, the level of claimed reduction in a risk after treatment should be justified as well as practical.

AFERM EXPERTS SAY...

Doug,

I wish I knew of such a repository.   We face many challenges in our risk management community.  One challenge is that risk management is too seldom recognized as an actual discipline of knowledge.  The recognition of Enterprise Risk Management is rising rapidly in the Federal government. This suggests that risk management will become more broadly recognized as a career field. However, this growing recognition has not yet reached the level of the Office of Personnel Management establishing risk management as a job series.  I strongly suggest it is time for OPM to take such action.  However, until that occurs, we will be faced with sharing amongst our peers.  AFERM has an online resource library for members (www.aferm.org/resources/), so you might want to check that out. Those organizations that have drafted position descriptions focused on risk management could provide value to the community by offering those documents for posting on the AFERM website (www.aferm.org).

Doug