Looking back over 10 years of Enterprise Risk Management (ERM)

By: Natalie K. Houghtby-Haddon, PhD
Executive Director, GW Center for Excellence in Public Leadership

My, how time flies when you’re having fun!  I can’t believe that it has been 10 years since Doug Webster was introduced to me, coming to my office to talk about something called "Enterprise Risk Management,” and would the Center for Excellence in Public Leadership at GW (GW CEPL) be interested in developing a certificate program to teach people about this new thing that the federal government was going to be introducing over the next year.  I’ll be honest—at first, I was skeptical, because it seemed either like a “Duh” concept—weren't organizations already talking to each other across organizational boundaries to ensure organizational success? And then it seemed like a “how in the world would we ever get people to see its value?” idea—way too much hassle to make it financially viable for the Center to create, market, and get it off the ground.  Finally, however, it seemed like a, “but of course, everyone would want to know about and use ERM principles,” sort of idea—especially when the revised version of OMB Circular A-123 came out in July of 2016, encouraging federal agencies, among other things, to establish a risk register that took into account how specific risks were affecting multiple components of the same agency, potentially putting at risk the agency’s ability to achieve its mission and its strategic goals, and then to monitor and evaluate the effectiveness of the risk responses selected by the agency to manage its risks. 

Over the years, new ERM experts have come to work with CEPL—Tom Stanton and Nancy Potok, chief among them. We’ve tried different formats, developed customized and open enrollment programs, worked with hundreds of federal workers committed to doing their best to ensure their agency can achieve its mission critical goals, and assisted several agencies in working to create a “risk-aware culture" in which all employees see themselves as stewards of risk, no matter what position they hold. It has been a decade of exploration, of learning how different agencies have taken different paths to make it work for them, of AFERM growing and expanding its reach to support the ERM movement as people captured the vision of how ERM can really make a positive difference in organizations’ ability to prepare for the unforeseen—and seen—risks that threaten to derail their mission. 

We are living in a time when many of the things we had taken for granted about the way the federal government works have been upended, changed, and transformed into a landscape that is sometimes unrecognizable. It seems to me that ERM is needed even more now, even though the Office of Budget and Management has curtailed access to Circular A-123 on its website. In this moment, I am reminded of William Bridges’s work on leading organizational change.  In his book, Managing Transitions, he reminds us that it isn’t the change that is the issue (the new boss, the new policy, the new organization structure)—it's the transition to accept the change that is the hard part—the human part—of engaging in organizational change. ERM can be a tool that helps us identify, assess, and respond to the unintended, unforeseen, unimagined consequences of the changes that are being put in place.  How do our agencies continue to meet their mission when the workforce has been so drastically reduced?  What if the mission has changed so dramatically that the remaining staff aren’t prepared or trained to act on that new mission? What if there is no more “Tone at the Top” --one of the critical leadership features of an effective risk culture? How do those of us “in the know,” so to speak, continue to persevere in the effort to engage in effective risk management at all levels, and across components of our organizations?

Bridges suggests that there are three phases in the transition to accept the changes that occur around us.  The first phase is Endings—the identification of what will stop being the old way of doing and being.  The second phase is what Bridges calls the Neutral Zone, where things are in limbo—things that are ending aren’t fully ended, things that are beginning aren’t fully started yet. The third phase is the phase of New Beginnings, where the new ways of doing and being have been articulated and are starting to be implemented. The three phases are not particularly discrete—Endings may be still going on while New Beginnings are getting started, the Neutral Zone will most likely overlay both endings and beginnings.  Bridges’s point is that, while all these things are taking place, leading to confusion, resistance, and loss, the Neutral Zone, in particular, can provide a space for imagination, creativity, and the possibility of establishing new ways of doing things that are even better than the old ways were. 

Bridges includes helpful checklists to help manage the three phases of transition, which I highly recommend to you in these challenging times, as you lead your colleagues to focus on the mission and purpose of your organization.  I also encourage you to pair his model of managing transitions with the tools of Enterprise Risk Management (see the inner box of “Risk Assessment” in the ISO 31000 model), especially the phases of Identifying, analyzing, and evaluating risks that may arise due to the changes in the landscape.  I also encourage you to make it a collaborative effort among your staff and colleagues, to help them find a measure of control and ownership in the midst of uncertainty and chaos. 

As I look back on 10 years of Enterprise Risk Management, I am very grateful to the group of federal managers who got together to say, “this is something the federal government needs to do; this is something important to help us ensure that our agencies are managing the risks that threaten to prevent us from achieving our strategic objectives, the risks that could prevent us from achieving our organization’s mission in serving the American People.”  Thank you to all those of you who planted the seeds and brought ERM to fruition, and for the work you do in bringing ERM not only to federal agencies, but also to state and local governments.  The George Washington University Center for Excellence in Public Leadership is proud to have played a small part in helping to train and shape those who work in this important area of public service. 

Dr. Natalie K. Houghtby-Haddon is the Executive Director of the George Washington University Center for Excellence in Public Leadership (GW CEPL), part of the GW College of Professional Studies. She continues to serve as the Faculty Director for CEPL’s Enterprise Risk Management in Government Certificate Program.  She can be reached at: hsquared@gwu.edu. Please stop by CEPL’s website to check out that program, and our 1-day ERM Mini Boot Camps: Certificate Program in ERM for Government | The Center for Excellence in Public Leadership (CEPL) | The George Washington University.