I am drafting a risk assessment report and want to understand whether exclusion of current risk reports should be excluded. Am I just identifying issues, or also giving credit for planned or in process work?

AFERM EXPERTS SAY...

There is no standard form for developing a risk assessment report.  While various sources indicate elements that may find a home in such a report, one might expect no standard exists because assessment reports can be written for different audiences with different information needs.

Understanding what might go into a risk assessment report should thus begin with an understanding of the needs of those for whom the report is intended.  ISO 31000 defines risk assessment as the combination of risk identification, analysis, and evaluation, but does not include risk treatment.  Are we looking only to report information on the assessment of risks (as suggested by the wording of your question), or are we also seeking to report on the implementation status of selected risk treatments, and the resulting risk after treatment?  The more inclusive reporting of risk treatment status is required if the report is to be used by management to monitor risk treatment activities, and ensure that the targeted levels of risk resulting from risk treatments is actually achieved.  If your report is to share newly identified risks, then there would be no need to include risks previously identified.  However, if the intent is to communicate the organization’s ongoing level of risk and corresponding risk treatments, then understanding the full set of key risks is critical. 

I would propose the following elements for any risk assessment report:

• Objective to be achieved (remember that risks by definition do not exist in isolation, but are linked to a specific objective.
• Name of risk
• Classification category of risk
• Risk appetite for the risk classification
• Likelihood/probability (of current risk)
• Consequence/impact (of current risk)
• Risk rating (prioritization based upon consideration of consequence and likelihood)
• Selected treatment (Accept, Avoid, Transfer/Share, or Mitigate/Reduce, and also Enhance if intentionally increasing risk to seek opportunities).
• Likelihood/probability (projected after completion of selected treatment)
• Consequence/impact (projected after completion of selected treatment)
• The basis for selected risk treatment (considerations of consistency with desired risk appetite, and cost-benefit analysis of various responses for treating any particular risk).
• Risk owner (the person responsible for determining the acceptability of the risk, selecting the appropriate risk treatment, and ensuring completion of the risk treatment).
  

If this report will also be used to monitor the actual implementation of the selected risk treatment, I would propose also including the following:

• Date risk treatment projected to be completed.
• Current status of treatment (or indication of completion)
  

Too often organizations consider risk in a very informal, ad hoc manner.  Effective risk management requires meaningful reporting and monitoring.  Formal risk reporting will be important to any organization seeking to truly manage risks in an effective manner.  A full understanding of an organization’s risks will require inclusion of newly identified risks as well as ongoing risk treatment activities previously assessed.

Question asked by David Wooten

Additional Details

Some say that ERM will only occur at the Departmental level and above and that the bureaus (within Departments) will continue to only use the internal controls program. Are they correct?

AFERM EXPERTS SAY...

David, thank you for your question.  In my view, ERM is intended to be forward thinking/scanning the horizon, while the existing internal controls only measure how well we are executing measurable components towards our strategic goals.  ERM looks at what could keep us from accomplishing our goals, so it would seem that ERM would have to reach into the bureaus.  I am not in the camp that views ERM as only a Departmental-level initiative.

Question asked by Web User

Additional Details

(part 1 of 2) We are a bureau within a much larger agency.  Some are calling for us to implement ERM, but there appears to be no meaningful action to do so at the higher agency level.  How can we implement ERM without doing so at the agency level?  Will doing so even be helpful?

AFERM EXPERTS SAY...

One way of answering this question is to first ask: (1) what is the purpose of ERM? and (2) what is the key mechanism of ERM in accomplishing this goal? ERM seeks to develop an organization-wide, portfolio view of risk that allows balancing results, resources and risks in a manner that maximizes stakeholder value. The key mechanism is two-fold. In the words of John Fraser, former Chief Risk Officer of Canada’s Hydro One, ERM is about “conversation” and “prioritization”. By conversation, John is referring to an open conversation of risk across the organization. This in turn leads to meaningful prioritization of risk treatments at an enterprise level contributing to maximizing stakeholder value.

Implementing a formal ERM program may indeed have little value if those conversations and prioritizations are already occurring. This can easily be the case in small organizations that are already well interconnected and have not grown to the size and complexity where functional and programmatic silos have evolved as a result of organizational structures. A basketball team, as a very simple example, understands the risks to each of the other players at any point in the game and reacts to those risks in a manner designed to win the game. However, as any organization grows to require larger numbers of participants and more complex organizational structures to coordinate efforts, this group interaction in understanding risks begins to fall apart. Instead, many business decisions and associated risks are management within organizational silos. Concrete efforts need to take place to this conversation and prioritization across the enterprise is to take place.

With the preceding as background, it is clear that where an organization sits in the overall organizational hierarchy is not the critical factor. The key considerations are: (1) will the organization considering implementing ERM potentially benefit from that implementation, and (2) does it have the capabilities to be successful in that implementation.

The answer to point one is “yes” if the organization is large enough and complex enough to benefit from a conscious and organized approach to identifying, sharing, and managing risk across the organization in an integrated fashion. For a group of a dozen individuals, this level of sharing and integration is likely already present. However, when organizations grow to hundreds and thousands of individuals, then the resulting organizational silos make the benefits of ERM almost inevitable. If so, then the second question must be answered: does the organization have the capabilities to implement ERM. Internal organizational capabilities can be developed, but the starting point is to know that the organization has sufficient autonomy within the larger organizational structure to pull together the necessary governance structures, make the necessary risk-informed resource allocations, and develop the necessary cultural changes. The leader of a bureau typically has the needed level of autonomy and resource allocation discretion. If those necessary prerequisites are present, then the implementation of ERM within the bureau is possible even when the higher level organization (agency or department) has not yet sought to implement ERM.

Question asked by Web User

Additional Details

(part 1 of 2) I have worked with A-123 and Internal Controls for years, but now I am hearing a lot about ERM.  Isn’t this just a more mature way to implement internal controls? After all, the GAO Green Book states that internal control is a process “…that provides reasonable assurance that the objectives of an entity will be achieved.” Is this the same as saying risk is well managed?

AFERM EXPERTS SAY...

The distinction between internal control, risk management, and ERM is often a point of confusion. In translating a definition into a working concept, it is often important to understand the application of the concept, and what words in a definition might be lacking to further explain the concept. To start, the full GAO Green Book definition of internal control is:

“…a process effected by an entity’s oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. These objectives and related risks can be broadly classified into one or more of the following three categories:

• Operations – Effectiveness and efficiency of operations
• Reporting – Reliability of reporting for internal and external use
• Compliance – Compliance with applicable laws and regulations”

In each of these cases, processes and procedures can and should be set in place to achieve operational results, allow for appropriate reporting, and do so while ensuring compliance with applicable laws and regulations. Internal control is indeed important to developing reasonable assurance that the applicable processes will operate as designed and achieve the desired objectives.

However, what is unstated in the Green Book definition is that organizations can have objectives outside of these three categories. Any choice of a future action typically entails risk. Those choices extend far beyond the execution of currently implemented business processes, and include any decision for future action not dependent on an existing process.

Let us agree for purposes of this explanation that risk is the uncertainty of achieving objectives, and risk management is that set of activities used to assess and control risks to acceptable levels that contribute to maximizing stakeholder value. We manage risks in part by choosing to treat risks through one of the following options: acceptance, avoidance, transference, or mitigation. If our choice is to mitigate a risk, we are looking to take action through an internal control to reduce either the likelihood that a risk transitions into an adverse event, or the impact of that event is lessened, or both. This internal control can be placed on an existing process (if the process is in operation), or prospectively if the process is being designed or otherwise intended for future implementation. Internal controls are thus a means of lessening the risks to business processes.

Based on this description, internal control is clearly an important element of risk management. However, there are aspects of risk that are not addressed by internal control. Many risks occur outside the control of the organization (e.g., the likelihood that a federal agency will be allocated their requested budget by Congress). Other risks arise from plans that are made, well before processes are designed or put into place to deliver products or services in accordance with those plans (e.g., strategic planning options). Internal control cannot be applied to future trade-off considerations when there are no processes to control. While internal control may not be an option for managing some risks, that does not make the risk in those various trade-offs any less important.