Colleagues,

Over the next month, I will be sharing a series of updates about where AFERM is headed and how we are positioning the organization for long-term strength. Increased communication during periods of growth and change is important to me, and I want to ensure you hear directly from me about what we are doing and why.

Let me begin with something energizing: our upcoming Virtual AFERM Summit on April 8–9.

👉 [Summit Registration Link]

This year’s Summit represents both continuity and evolution. We are working closely with AGA to deliver a strong program focused squarely on advancing enterprise risk management in government. Their event infrastructure is helping us elevate the experience while keeping the content grounded in practitioner needs.

AFERM State of ERM Community Snap Poll with George Mason University

In the past year, ERM within the government sector has undergone some drastic changes.  While the majority of these changes were driven by changes in policy and regulations, there were also new emerging risks and strategic priorities that are redefining the relevance and importance of ERM.  Where ERM will go from here remains unknown but AFERM will continue to remain a strong advocate and be a thinktank within the community.  

To this effect, AFERM is conducting a pre-Summit snap poll with George Mason University as a pulse check with the community about the current and future state of ERM.  During the Summit, additional snap polls will also be conducted to collect participant inputs and perspectives on global risk outlook, new emerging threats and opportunities, and the role of ERM.  The pre-Summit poll will be conducted using LinkedIn (multiple choice) and open to all to respond.  Results of the pre-Summit and Summit polls will be shared with Summit attendees, which would be valuable for everyone.

We encourage you to participate in this snap poll through LinkedIn to share your insights.  The first snap poll went out earlier in the week.  Check it out here. The goal is simple: take a candid look at the current state of ERM in government.

We will:

• Discuss results live during a Summit session
• Compile findings into a product available to all members
• Use insights to guide future programming

Be on the lookout for additional polls being released every week through LinkedIn.

This is how we live our mission — through thought leadership grounded in real data.

Recognizing Excellence

We recently announced our 2025 ERM Award and Scholarship recipients. Their work reflects the dedication that makes this community meaningful.

👉 Awards Announcement Link

https://www.aferm.org/news/715242/AFERM-Announces-2025-ERM-Individual-Awards-and-Scholarship-Recipients.htm

Please take a moment to review and congratulate them.

Looking Ahead

We are also exploring an in-person event shortly after the Summit to bring our community together and allow all of us to catch up face-to-face.

More details soon.

I hope you will join us at the Summit. This is an important moment for AFERM — and for ERM in government.

Respectfully,
Sam Twyman

• Clio Grillakis is the first ERM Principal for the CHIPS Program Office at NIST, US Department of Commerce. In her role, she has led the design, development, and implementation of an industry-leading ERM program in federal government. She has worked hand-in-hand with the CHIPS Program Chief Risk Officer to write the Program’s first ERM Policy and design a unique risk governance structure that incorporates layers of risk management. Her work with Program leadership to define the value proposition for ERM and to obtain buy-in and support for layered risk management practices have proven effective from inception through early execution phases. 

• Marshelle Richardson is the Chief Risk Officer, Office of the Chief Financial Officer (OCFO) for the DC Government and has more than 27 years of professional work experience in the areas of accounting, readiness and remediation, risk management, training and development, financial accounting and reporting. Her role as a trusted advisor has secured the OCFO’s ERM stance, focusing on enhancing decision-making, promoting regulatory compliance, optimizing resource allocation, encouraging innovation, and creating a more resilient workplace overall. Under her guidance, the ERM team has adopted innovative strategies that have greatly enhanced the organization’s capability to navigate complex regulatory landscapes and adjust to evolving organizational priorities. At the same time, she has inspired those around her to reach significant milestones professionally and personally.  
  

• Christina Summers is the ERM Program Lead, Interior Business Center (IBC), Department of the Interior and attending the GMU CRO Program will enable her to continue to thrive and expand her breadth of knowledge and experience. In her current role, she developed the IBC ERM program from a newly emerging focus to a successful risk program, including gaining critical buy-in by demonstrating strategic value. As a result of this success, she has been selected to serve as the DOI ERM Lead, where she will spearhead the translation of DOI Executive Leadership’s strategies and visions into an actionable risk framework, working towards further integrating Enterprise Risk Management with DOI’s Strategy, Performance Management, Evidence gathering, and budget planning efforts.

The Association for Federal Enterprise Risk Management (AFERM) is proud to announce the recipients of the 2025 ERM Awards for Government, celebrating outstanding achievements in Enterprise Risk Management (ERM) across all levels of the public sector. This year, AFERM expanded its awards program to include state and local government entities, reflecting the growing impact and importance of ERM throughout the public sector.  

Notable Achievement Award Recipients 

• City of Norfolk, Virginia
  The City of Norfolk is recognized for its innovative “Risk Management Day” initiative. This annual event fosters a risk-aware culture by integrating training and discussions on organizational risks, improving communication across departments, and leveraging real data to mitigate liability exposures. Risk Management Day has become a foundational step for advancing ERM in local government, featuring interactive sessions with risk owners and stakeholders in both virtual and in-person formats. The initiative efficiently utilizes existing resources and expertise to address emerging and persistent risks, breaking down organizational silos and enhancing service delivery. 

• Port Authority of New York & New Jersey 
  The Port Authority’s ERM team is honored for its 2023–2024 Comprehensive Enterprise Risk Assessment. This effort provided a real-time, enterprise-wide view of risks, integrating findings into strategic planning and operational documents. The mature ERM program, operating for 17 years, supports transparency, alignment, and proactive mitigation across a complex infrastructure portfolio. The team collaborated with senior leadership and the Board of Commissioners, using interviews, workshops, and emerging risk research to update risk profiles and prioritize risks. Their work has transformed risk reports into strategic tools that influence five-year plans, operating budgets, and capital plans, embedding ERM into agency-wide decision-making. 

Luminary Award Recipient 

• King County, Washington 
  King County is recognized with the Luminary Award for achieving an advanced level of ERM maturity and demonstrating sustained excellence in integrating ERM into organizational practices. Over the past decade, King County’s ERM program has evolved from a basic risk register to a comprehensive framework that integrates risk appetite, data-driven decision-making, and cross-agency collaboration. The program has expanded the understanding of risk beyond financial losses, uniting siloed agencies under shared risk responsibilities. Notable achievements include a pioneering risk appetite statement, a loss control program funding safety and environmental risk mitigation, and effective risk management during the COVID-19 pandemic. The program continues to align risk decisions with strategic priorities and is developing guidance for managing risks related to artificial intelligence.

Dr. Karen Hardy, AFERM President, extended congratulations to the recipients for their leadership and innovation in advancing ERM practices across government, noting that, “The achievements of the award winners demonstrate the value that can be gained through the practice of risk management and demonstrate the value of collaboration, transparency, and strategic integration in public sector organizations.” 

A webinar with the award winners is planned for Tuesday, December 16, 2025. For more details, and to register, click here. 

Questions about the ERM Awards for Government can be directed to ERM-Awards@aferm.org. 

Turning Adversity into Advantage: A Moment for Reflection and Renewal

 As we close out the fourth quarter and this final newsletter of 2025, I invite us all to take a collective breath. The past year has tested our adaptability, resilience, and sense of purpose as an organization. Yet amid the uncertainty, AFERM continues to grow—learning, adjusting, and rising stronger together.

Recently, I watched a football game that offered an unexpected lesson in leadership. One team, riddled with injuries, had to rely on its substitutes to step up and perform at the highest level. During the broadcast, a commentator said something that struck me deeply: “The team shouldn’t waste adversity.”

That phrase stayed with me. To “not waste adversity” means to recognize challenge as a chance to grow. It’s the difference between a team that merely survives and one that transforms. For AFERM, this is our opportunity to pause and ask:

• What is this moment revealing about who we are?
• What are our strengths and where can we improve?
• What opportunities can emerge from this period of change?

Adversity, after all, is inevitable in every organization. The real measure of success lies in how we adapt—how we turn obstacles into catalysts for progress.

One clear example of this is our decision to reschedule the AFERM Summit. While the change was disappointing, it reflects our deep commitment to delivering the best experience possible for our members. Moving the event to March 2026 ensures that we can meet that promise. I want to extend heartfelt thanks to our volunteers and planners whose hard work, flexibility, and dedication have made this possible.

As my term as AFERM President comes to a close, I encourage each of you to seize the many leadership opportunities within our organization—through board service, committee participation, or volunteer engagement. AFERM is more than a professional association; it’s a community where you can sharpen your leadership skills, build lifelong connections, and leave your mark on the future of risk management.

Thank you for allowing me the honor of serving as your president. Together, we’ve faced challenges, found our footing, and proven that even in times of uncertainty, there is always opportunity in adversity.

Dr. Karen Hardy

Due to the ongoing federal government shutdown and the significant challenges it is posing for federal participation in the AFERM 2025 Virtual Summit, the AFERM Board of Directors has made the difficult decision, after careful consideration, to postpone the 2025 October Virtual Summit to Spring 2026. 

Our primary goal is to ensure that every participant has the opportunity to fully engage, exchange lessons, and benefit from this important industry event.  

We believe rescheduling to a time when our community can fully participate is the best way to deliver on that commitment and host the exceptional program you expect from AFERM. 

We understand this news may cause inconvenience, and we sincerely appreciate your understanding. We will announce the new dates very soon.

Thank you again for your flexibility and ongoing support of the AFERM community.  

Click here for more information. If you have any questions, please contact us at info@aferm.org or call AFERM at #1-760-512-3376. 

We look forward to seeing you at the Summit in Spring 2026! 

This quarter, AFERM achieved some remarkable goals amid continued uncertainty. While uncertainty is a constant factor that's always present, there are times when it seems overwhelming. When that occurs, it's essential to re-emphasize and (1) focus on strengths, (2) focus on what you can control, and (3) focus on what's possible. And that's where we start regarding our quarterly update.

First, AFERM hosted two excellent webinars, “Integrating ERM into the Agency Budget Process,” and “ERM for Optimization.” We also launched AFERM UNIVERSITY, capitalizing on our amazing partnerships with organizations such as RIMS. As a result, we welcomed our first workshop students and celebrated this revenue-generating opportunity.

Additionally, we welcomed new members to our association and continue to engage our state and local community of professionals by solidifying growth in this area through engagements with AFERM's State and Local Committee.

As President, I urge you to understand that uncertainty will never completely disappear and has always been a part of our lives. As practitioners, we have an advantage that most people do not: an understanding of how to adapt and pivot during those times because of our expertise. Risk management is not a law. It's a leadership discipline. Just because you don't write risk down, doesn't mean it doesn't exist. ERM is a strategic and mature approach to risk management in times of uncertainty, a skill that is often lacking at executive levels within government and non-governmental organizations.

Finally, as the VUCA world, which we understand, continues to unfold, more risk management skills, when paired with the pursuit of opportunity, will be needed — not reduced. 

Remember that it is our uniqueness as AFERM and a skill many strive to achieve. It is our mission to educate as many people as possible about the importance of this skill.

Let's continue to fulfill our mission, which sets us apart from many.

Until next time, STAY CONNECTED AND ENGAGED! 

Thank you,

Dr. Karen Hardy

The beginning of this new year has displayed the power of engagement and community when running on all four cylinders.

Being intentional certainly has resonated with AFERM in the first quarter. It all starts with leadership. We selected a President-Elect, Jacob Lee. We also retained the expertise and insights of two former Presidents. One as the newly established VP of Events – Marianne Roth – while Jason Bruno, as Past President, is playing a key role in working with Ceresa Wilson, our new Planning Committee Chair, to update AFERM’s strategic plan. This updated plan will align our goals, including our extended partnership with the state and local government community, to ensure that AFERM maintains its relevancy and sustainability while owning our unique position in the government space.

A Recent LinkedIn Survey Ranked Risk Assessment as #15 on their Top Skills List for 2025

Speaking of state and local, AFERM successfully launched its first State and Local Virtual Conference. What first seemed impossible has now been accomplished. From here, we build, and we be bold and intentional about supporting State and Local, and expanding our reach. Our post-State and Local event saw an increase in membership as well!

Another core focus for AFERM is offering revenue-driven activities to sustain the organization. With that in mind, we secured a partnership agreement with RIMS (the Risk Management Society) to provide virtual two-day prep workshops for taking the RIMS-CRMP-FED certification. This is a huge win for AFERM for two reasons: (1) the distribution of press releases by RIMS to media outlets regarding our partnership will garner further exposure and visibility, and (2) it opens a revenue stream with a lot of upside and little downside. With a set revenue share percentage, AFERM can be characterized as an elite Association specializing in upskilling the state, local, and federal government community in risk management competencies.

Risk management is needed more now than ever. We can’t shrink from our mission of filling this void as the government and other stakeholders navigate the future. No other organization does what we do.

I am so proud to lead AFERM. The membership's talent and shared passion make us so unique. Let’s continue to forge ahead, tapping into new ways of serving our membership, our community, and each other.

As always…Stay Engaged. Stay Connected.

See you soon! 
Dr. Karen Hardy

Greetings and Happy New Year to all our AFERM members, sponsors, and those interested in Enterprise Risk Management or supporting AFERM’s mission. As I contemplate my new role as AFERM President, I would be remiss not to thank Jason Bruno for his leadership and service as the 2024 AFERM president and recognize all the hard work our volunteers and members contributed. I am beyond thrilled to step into this role with enthusiasm and high expectations.

Although I am one of the founders of AFERM, I do not take my responsibility lightly. It’s great to see how far the organization has gone! What a metamorphosis. The growth has been phenomenal, given the complexities of the government space. This makes AFERM’s success even more incredible to behold.

Think about it: our association has weathered the government cycles through continuing resolutions, sequestrations, and presidential cycles in the last decade. Yet, we still show up to serve the government sector and its professionals. And you know why? Because our collective passion and expertise are so much bigger than who we are individually. Remember, AFERM was an outcome of a grassroots effort before there was a mandatory policy requiring agencies to do ERM.

We are the catalyst. As an association, we own the Federal ERM government space.

So, where do we go from here?

As with any growth cycle, we must continuously assess what we do, how we do it, and for whom we do it while also keeping in mind the technological environment in which we operate. As a firm believer in pushing the envelope, 2025 is the year we will not shrink back from—but step up to a higher level of relevance and opportunity.

That’s the proper form of AFERM. It always has been and will be.

We are 25 years into the new millennium – a time I think will require that we operate from a growth mindset. We must ask ourselves the right questions during timeline shifts.

Using our voice, what does AFERM have to say from an ERM perspective as we head to 2030? How do we leverage our strengths to have an impact while also driving revenue?

We are already on the right path:

• We are updating our next 5-year Strategic Plan and aligning our goals to deliver the outcome we want and need to see.
• We are expanding! Our upcoming State and Local Government Virtual Summit is scheduled for February 2025.
• There’s already a lot of energy and buzz about planning this year’s AFERM Summit.
• There’s a great opportunity to extend our expertise and teach others the value of ERM skills in the workplace that is within reach.
• We even rebranded our Newsletter as the AFERM Journal to be more attractive in the ERM market.

In closing, there is only one message, to sum up these next twelve months that I hope you all will take with you and act on:

THINK BIG. THINK BOLD. AND BE INTENTIONAL.

Let’s make every moment count and put our mark on the future.

I know I’m in!

Dr. Karen Hardy
AFERM President 2025

On Tuesday, November 12th, at its 17th Annual ERM Summit held at the Ronald Reagan Building in Washington, DC, AFERM recognized three federal agencies for significant progress and notable achievements in the implementation and practice of Enterprise Risk Management (ERM).

The U.S. Treasury Department received the ERM Luminary Award, and the Veterans Benefits Administration and NOAA received the ERM Notable Achievement Award.

The Luminary Award recognizes agencies that have attained an advanced level of maturity and demonstrated a broad range of accomplishment in the implementation and practice of ERM. The Notable Achievement Award recognizes agencies that have achieved impressive growth or realized a significant milestone in their ERM program.

Jason Bruno, president of AFERM, in presenting the awards at the Summit, noted that, “the award winners have shown how ERM has had a positive impact, demonstrating the value that ERM can provide in helping agencies deliver on their goals and objectives.”

Treasury’s ERM program was launched in 2014 and was among the first ERM programs initiated in the Federal Government. In 2022, the program was aligned with the Office of Strategy, Planning and Performance Improvement, fostering the integration of ERM into the budget and planning processes. ERM has become firmly embedded in the Department’s governance processes, and it is a key component of the Strategic Objective Annual Review process where robust discussions of the trade-offs that need to be made when prioritizing risk responses occur, enabling the Department to better articulate what can be accomplished within available resources and timeframes.

The Veterans Benefits Administration and NOAA’s ERM programs were initiated in 2019 and 2015 respectively. The Veterans Benefits Administration (VBA) has taken significant steps to integrate ERM into their budget process, requiring the linkage of risks to budget submissions in the agency’s Budget Request Intake Tool. VBA also launched an ERM Community of Practice, deployed an ERM Playbook, and implemented new deep-dive review and analysis sessions for specific enterprise risks.

NOAA was a recipient of the AFERM Luminary Award in 2023 and they have leveraged their successes to further strengthen and enhance their program. They developed a risk mitigation cost estimation guide, expanded their Risk Consequence Scoring Tool to factor in the positive upside perspective of risk, and implemented a new online solution for their risk register and risk profile.

“We are pleased to see how ERM is evolving within the federal government,” said Bruno, “with agencies linking risk to their planning and budgeting processes, while also promoting greater awareness and understanding of risk to help improve decision-making and, ultimately, better enabling mission delivery.”

AFERM is a professional association dedicated to the advancement of Enterprise Risk Management (ERM) in the government through thought leadership, education, and collaboration. For more information about AFERM or the ERM awards program, visit www.AFERM.org or call 760-512-3376.

Risk awareness enhances decision-making, promotes safety, and ultimately safeguards resources and well-being. Understanding risks not only helps in navigating challenges but also seizes opportunities for growth and innovation. It is important for the Internal Revenue Service (IRS) to have a robust risk-aware culture that encourages employees and managers to identify and mitigate risks while doing their work before those risks escalate into an issue or crisis.

Each year, the IRS conducts a risk awareness campaign that emphasizes the importance of identifying and managing potential risks and provides information on the various channels for reporting risks. A risk-aware culture encourages open communication and collaboration that drives organizational resilience through risk-based decision making and provides opportunities to support the IRS mission, goals, and objectives.

The IRS’s Chief Risk Officer, Mike Wetklow, kicked off the IRS Risk Awareness Month on November 4 with the theme: Forward Focus: Empowerment through Risk Management. In a message to all employees, Mike encouraged everyone to be proactive and strengthen their knowledge about risk management.

The IRS Office of the Chief Risk Officer was featured in an awareness event and issued several internal messages for Risk Awareness Month. A “Workday Snapshot” event with Enterprise Risk Management (ERM) staff explored their career paths, what they do at the IRS and how they operate in the IRS organization. Throughout the month, the IRS also issued messages to promote a strong risk culture empowering employees to identify risks and encouraging leaders to adopt risk-based decision-making approaches to minimize risks and maximize opportunities.

During Government Risk Awareness Week, the IRS participated in the 17th Annual Association for Federal Enterprise Risk Management Summit in Washington, DC. The IRS ERM Director discussed a COVID-19 case study, sharing lessons learned and possible risk management approaches for emerging risks. In addition, the IRS Director of Data Products and Insights within Research, Applied Analytics and Statistics joined in a panel discussion about a framework for managing risk related to artificial intelligence. The goal of the framework is to provide guidance on identifying, assessing, and mitigating risk associated with the use of artificial intelligence technologies.

The IRS will close out the agency’s campaign with a message recapping the month’s activities and providing links to access all materials shared during the campaign. Employees will also be able to test their understanding of enterprise risk management by taking a Risk Knowledge Check on the IRS intranet.

In summary, the goal of IRS Risk Awareness Month is to broaden everyone’s understanding of the range of risk management activities taking place at the IRS and to incorporate risk management into everything we do. When our employees and managers can identify potential threats and make informed decisions, it strengthens our operations, promotes transparency and accountability, and improves our ability to serve taxpayers.

The Committee facilitates connections between federal, state, and local government entities to share best practices, promote engagement, and expand educational opportunities. By establishing new networks across all public entities with a critical need for risk management, the Committee helps demonstrate the true value of ERM for every level of government. Federal practitioners contribute seasoned experience, while state and local practitioners bring innovative, agile approaches that can benefit federal entities. These cross-level dialogues deepen participants’ understanding and enhance awareness of diverse ERM practices and approaches.

If you arere interested in ERM or currently run a program at the state or local level, we invite you to connect with us and join the State and Local Outreach Group. Our mission is to unite ERM professionals across all levels of government, no matter where you are on your ERM journey.

To learn more and join us, please visit:

State & Local Outreach Committee – 2024 – AFERM – Association for Federal Enterprise Risk Management

The DART CoP aims to unite ERM practitioners from the public and private sectors, enabling them to exchange knowledge, share resources, and explore best practices for advancing government agency ERM programs. This includes using GRC (Governance, Risk, and Compliance) technology, enhancing risk data governance and analytics, and adopting innovations such as Artificial Intelligence (AI) and other emerging technologies.

The DART CoP will serve as a collaborative network focused on enhancing ERM program maturity within government agencies.

Topics will cover a range of advanced concepts, such as:

• Emerging technology use and governance, including Robotic Process Automation (RPA), AI, and Generative AI
• Advanced data analytics for improved risk reporting
• Risk data governance strategies
• ERM GRC technology enablement
• Development, analysis, and reporting of Key Risk Indicators (KRIs)

The DART CoP will host structured virtual and in-person meetups, providing public sector ERM practitioners an opportunity to increase engagement beyond AFERM’s annual summits and networking gatherings. Through platforms like the AFERM website, members will access reusable and adaptable tools, templates, accelerators, and open-source resources, supporting collaborative knowledge-sharing for agency ERM advancements.

Please click on the link below to sign up or contact the co-Chairs for additional information.

Communities of Interest/Practice – AFERM – Association for Federal Enterprise Risk Management

The ERM Community of Practice (ERM CoP) was created to provide an open forum for enterprise risk management (ERM) professionals from across the Federal Government. The ERM CoP was founded in 2017 after the release of the update to OMB Circular A-123 as a forum for federal employees in ERM to come together to share experiences and get and provide advice to each other. It is led by Treasury’s Deputy Chief Risk Officer. It is comprised of and operated entirely by federal employees from over 50 agencies. This group has been central in mobilizing ERM efforts for the Federal Government including writing and updating the ERM Playbook, creating a Federal ERM Maturity Model, and providing input into other various related guidance and regulations.

Past Highlights

Roundtable Discussions

• Defining Risk Appetite
• Integrating with Strategic Reviews and Strategic Planning
• ERM Policy and Governance
• Enterprise-level Risk Assessments
• Office of Management and Budget (OMB) Circular Guidance
• Strengthening the Connection with Strategy and Budget
• Implications of Artificial Intelligence for ERM

Shared Risk Area Discussions

• Emerging Risks
• Artificial Intelligence
• Administration Transition
• Cyber
• Fraud
• Hiring
• Procurement
• Security Clearance
• Environmental, Social, and Governance

Call for Action!

The ERM CoP welcomes federal employees who are ERM practicioners for agencies. Non-federal employees are not permitted to join, and the group does not include inspectors general. If you have interest in joining the ERM CoP, please reach out to Karen.Weber@treasury.gov

Cyber-ERM Community of Interest: Merging Strategy and Decision-Making for Government Cybersecurity

As cyber threats become more sophisticated and pervasive, the federal government faces increasing pressure to align strategic decision-making with comprehensive cybersecurity risk management. To address these challenges, the integration of Enterprise Risk Management (ERM) with cybersecurity practices is crucial. The Cyber-Enterprise Risk Management Community of Interest (Cyber-ERM COI), an interagency group affiliated with the Association for Federal Enterprise Risk Management (AFERM), is leading this critical integration.

Comprised of 175 members from 53 federal agencies, the Cyber-ERM COI brings together federal ERM and IT practitioners to bridge communication between agency-level ERM and cybersecurity risk management functions. The Cyber-ERM COI enhances strategic decision-making across federal agencies by embedding cybersecurity risk management into the core of governmental operations, thereby improving the U.S. Government’s ability to respond to a dynamic and evolving cyber threat landscape with resilience and confidence.

Introduction to the Cyber-ERM COI

The Cyber-ERM COI is a collaborative interagency community that brings together federal agencies to explore and navigate cybersecurity risk management challenges. By promoting communication and cooperation between ERM and cybersecurity functions, the COI supports efforts to align strategies and address emerging risks, helping agencies better prepare for evolving threats.

Strategic Importance of the COI’s Present and Past Work

To support AFERM priority themes, including the 2024 theme focusing on the intersection of government decision-making and strategy, and previous themes such as weaving cyber into the fabric of the federal government, the COI has elevated cybersecurity as a core priority withing governmental operations. By promoting a culture of continuous learning and collaboration, the COI provides federal leaders with the tools and knowledge necessary to enable and protect their agencies’ missions effectively.

To address the complexity of cybersecurity and ERM integration, the Cyber-ERM COI has created three specialized working groups, each targeting key areas of risk management crucial for federal resilience: The Cyber Risk Register (CRR) Working Group, the Risk Appetite and Tolerance Frameworks Working Group, and the Tools & Technology Working Group. Each group and their subgroups play a vital role in aligning cybersecurity risk management practices with the strategic objectives of federal agencies.

Cyber Risk Register Working Group

The Cyber Risk Register Working Group is focused on developing a comprehensive, hybrid risk register template that considers existing templates. This new template will address diverse system and agency-specific needs by providing customizable and scalable options for risk registers that accommodate different business decisions and reporting levels.

The new hybrid template created by this working group combines the best aspects of other frameworks, with system-focused details to provide flexibility and encourage creative use. The goal is to help agencies better capture, categorize, and manage risks, ensuring a clearer understanding of potential impacts and appropriate mitigation strategies.

By integrating elements from respected frameworks, the new hybrid template offers a standardized yet flexible approach to risk management that can be tailored to each agency’s unique requirements. This helps align risk management efforts with broader strategic priorities, enhancing resilience in an unpredictable cyber environment.

Risk Appetite and Tolerance Working Group

The Risk Appetite and Tolerance Working Group is essential for developing risk appetite and tolerance sample statements, templates, and best practices that guide federal decision- makers in balancing risk and opportunity. These statements help foster a culture of informed risk-taking and decision-making across federal agencies.

In 2023, 54% of federal organizations reported having a defined risk appetite statement, maintaining the same rate as in 2022 but significantly higher than 39% in 2021. Additionally, there was an increase in the communication of these statements across organizations, with 23% of respondents integrating them into strategy and decision-making processes, up from 18% in the previous year. This represents the highest rate since this data was first collected in 2017, underscoring the growing recognition of risk appetite statements as essential tools for navigating complex challenges.

Moreover, organizations with longer-duration ERM programs are more likely to have risk appetite statements, with 68% indicating they have one, compared to 30% of organizations with shorter-duration programs. Furthermore, 85% of ERM programs rated as “managed or optimized” had risk appetite statements, compared to just 44% at an “initial or developing” maturity level.

These findings highlight the importance of maturity in risk management practices, demonstrating that well-established ERM programs are better positioned to articulate and implement risk appetite statements effectively.

Tools and Technology Working Group

The Tools and Technology Working Group seeks to address opportunities presented by various technology options to advance risk analysis, improve efficiency and effectiveness of ERM programs, and help to further integrate enterprise risk analysis with domain-specific risk management activities within an agency. This includes activities in the information communications technology arena as well as other critical inputs to ERM programs such as audit results, governance and policies requirements, and technology innovation. The subgroups explore various aspects of tools and technology in ways that can benefit agencies.

Subgroups include:

• The Governance, Risk, and Compliance (GRC) Tools Considerations for Enterprise Risk Management (ERM) Subgroup provides considerations for agencies pursuing technology solutions at the enterprise level to inform build-or-buy decisions. The considerations are outlined in a helpful guidance document and are intended to inform decision-making and cybersecurity-ERM integration. The document includes benefits at the ERM program and agency levels, roles and responsibilities, and a decision tree followed by a process overview and additional considerations.
• Artificial Intelligence (AI) Comparative Analysis and Questionnaire Subgroup analyzes the implications of artificial intelligence on cybersecurity and governance. It provides actionable insights on leveraging AI for strategic advantage, aligning with the National Institute of Standards and Technology (NIST)’s guidance on adopting a proactive approach to AI risk management (NIST.AI.600-1, Section 1.3, 2, and 2.3). This subgroup helps federal leaders understand AI’s potential risks and benefits, supporting informed decision-making and strategic adaptation.

Driving Strategic Decision- Making Through Cyber-ERM Integration

As cyber threats continue to evolve, integrating cybersecurity risk management and ERM is crucial for federal government resilience. The Cyber-ERM COI is uniquely positioned to drive this integration, enabling federal leaders to make informed strategic decisions that enhance both security and resilience.

By engaging with the Cyber-ERM COI, federal agencies can leverage shared expertise and adopt best practices, ensuring they are prepared to navigate the ever-changing threat landscape and fulfil their mission objectives.

We encourage all federal practitioners and stakeholders to become active participants in this vital community, contribute to its efforts, and help shape the future of cybersecurity strategy within the federal government.

Together we can build a more resilient government capable of meeting today’s challenges and anticipating tomorrow’s threats!

Take Charge of Cyber Futures: Join the Cyber-ERM COI and shape Our Strategic Defense!

The Cyber-ERM COI invites all federal employees working in risk-related fields who are interested in developing their skills in ERM and cybersecurity. Non-federal employees can join if they have a federal sponsor and receive approval from the Chairperson(s). If you would like to join, please contact us through:

Communities of Interest/Practice – AFERM – Association for Federal Enterprise Risk Management

Who? The Small Agency Community of Practice (SACoP) provides an open and engaging venue for federal government Enterprise Risk Management (ERM) practitioners from small agencies to share their best practices and resources on ERM implementation. SACoP serves as a forum for Risk Professionals to discuss common challenges, brainstorm solutions, and provide learning opportunities, while fostering networking and collaboration. All government (local, state, and federal) ERM practitioners are welcome to join SACoP. In fact, ERM practitioners who manage component-level ERM programs at large agencies have found the SACoP discussions relevant and helpful because they face similar challenges and may learn from sharing ERM strategies.

Why? Small government agencies may have fewer staff and financial resources dedicated for ERM implementation. ERM practitioners from small agencies may benefit from leveraging their relationships with colleagues engaged in risk management within their agencies and meeting ERM professionals external to their agencies, to advance their agency ERM program’s efforts.

What? SACoP co-Chairs poll their members annually for potential ERM topics of interest for presentations and discussions. Common themes that have emerged over the years include:

1. ERM training and risk awareness tools, techniques, and events
2. ERM and audits and ERM’s relationship with internal controls
3. Integrating ERM with budget, strategy, performance and evaluation
4. Understanding risk appetite and demonstrating the value of ERM
5. ERM professional development and ERM practitioners’ journeys

Where? SACoP currently meets virtually, each month on the third Wednesday from 2-3:30 pm from January/February to September/October. SACoP participates in the Annual Government Risk Awareness Week during the Association for Federal Enterprise Risk Management Summit.

When? SACoP was formed in 2016, around the release of the revised OMB Circular A-123: Management’s Responsibility for Enterprise Risk Management and Internal Control to help small agencies fulfill the federal requirements to implement ERM outlined in the circular.

How? Interested federal ERM practitioners from all agencies are welcome to join SACoP. AFERM membership is not required. ERM practitioners who manage component-level ERM programs at large agencies have found the SACoP discussions relevant and helpful and are welcome to join. State and local government ERM practitioners may also join, if interested. Please click on the link below to sign up or contact the co-Chairs for additional information. Communities of Interest/Practice – AFERM – Association for Federal Enterprise Risk Management

We look forward to hearing about your ERM efforts and welcoming you into the ERM SACoP.

Greetings and Happy Autumn to all our AFERM members, sponsors, and those who are interested in Enterprise Risk Management or support AFERM’s mission. Over the past year, I have met so many of you that are dedicated to our shared goals. I am humbled by your passion, wisdom, and energy, and I remain committed to working with you all with the same vigor that you pour into your practice. As we enter the year’s end, we remain committed to advancing ERM by delivering top-notch trainings, creating networking and professional development opportunities, and sharing lessons learned and thought leadership.

This year, we’ve made great progress on our 2020-2025 strategic plan: setting and meeting goals in our areas of focus, including delivering value to our members and sponsors, building on outstanding in-person and online events and education, and establishing solid and sustainable infrastructure that enables us to drive forward the vision of AFERM.

For the past 16 years, enterprise risk management professionals have come together to receive exceptional training at the annual AFERM Summit. As I write this, the 2024 AFERM Summit is only two weeks away, and I am excited for another fantastic conference. The Summit is AFERM’s marquee event, providing enterprise risk management practitioners with opportunities to expand their knowledge and expertise through practical content that can be integrated into their workstreams and organizations. The Summit also provides valuable opportunities for practitioners to network with each other and exchange strategies with risk management professionals in the government, non-profit, and private sectors. This year’s Summit planning team have developed new ideas and innovative ways to engage you, and for you to meet and connect with one another.

The theme of the 17th Annual ERM Summit Training event is “ERM, Where Government Decision-Making and Strategy Meet.” This year we will be returning to the Ronald Reagan Building – easily accessible by car and Metro – on November 12 and 13, 2024. Our theme, and the educational and inspiring presentations, plenary discussions, and breakout sessions align with the leading practices that underscore the importance of maturing core business practices, refining operational standards, and improving organizational performance—establishing enterprise risk management as the nexus where government decision-making and strategy meet.

I want to thank Bobbi-Jo Pankaj and Melissa Thomson, Summit Chair and Co-Chair, for leading the Summit planning. I encourage you to take advantage of this opportunity to expand your knowledge, to network, to learn from experts throughout the government and private sectors, and to take away lessons that will help you make a positive impact in your organization. Registration is still open. I look forward to seeing you all on November 12!

President’s Article

Greetings and Happy Autumn to all our AFERM members, sponsors, and those who are interested in Enterprise Risk Management or support AFERM’s mission. Over the past year, I have met so many of you that are dedicated to our shared goals. I am humbled by your passion, wisdom, and energy, and I remain committed to working with you all with the same vigor that you pour into your practice. As we enter the year’s end, we remain committed to advancing ERM by delivering top-notch trainings, creating networking and professional development opportunities, and sharing lessons learned and thought leadership.

This year, we’ve made great progress on our 2020-2025 strategic plan: setting and meeting goals in our areas of focus, including delivering value to our members and sponsors, building on outstanding in-person and online events and education, and establishing solid and sustainable infrastructure that enables us to drive forward the vision of AFERM.

For the past 16 years, enterprise risk management professionals have come together to receive exceptional training at the annual AFERM Summit. As I write this, the 2024 AFERM Summit is only two weeks away, and I am excited for another fantastic conference. The Summit is AFERM’s marquee event, providing enterprise risk management practitioners with opportunities to expand their knowledge and expertise through practical content that can be integrated into their workstreams and organizations. The Summit also provides valuable opportunities for practitioners to network with each other and exchange strategies with risk management professionals in the government, non-profit, and private sectors. This year’s Summit planning team have developed new ideas and innovative ways to engage you, and for you to meet and connect with one another.

The theme of the 17th Annual ERM Summit Training event is “ERM, Where Government Decision-Making and Strategy Meet.” This year we will be returning to the Ronald Reagan Building – easily accessible by car and Metro – on November 12 and 13, 2024. Our theme, and the educational and inspiring presentations, plenary discussions, and breakout sessions align with the leading practices that underscore the importance of maturing core business practices, refining operational standards, and improving organizational performance—establishing enterprise risk management as the nexus where government decision-making and strategy meet.

I want to thank Bobbi-Jo Pankaj and Melissa Thomson, Summit Chair and Co-Chair, for leading the Summit planning. I encourage you to take advantage of this opportunity to expand your knowledge, to network, to learn from experts throughout the government and private sectors, and to take away lessons that will help you make a positive impact in your organization. Registration is still open. I look forward to seeing you all on November 12!

When I was growing up, a story my sisters and brother and I heard repeatedly was the story of how Great-Great Uncle Albert blinded himself as a 16-year old. The story went something like this: while whittling, he was scraping the knife along the piece of wood toward himself; it hit a bump along the wood and came flying up toward his face and he hit himself in the eye, making himself blind. The story was a cautionary tale, of course—never use a knife in a way that points the blade towards yourself; always whittle (scrape, cut) away from yourself. To this day, the story shapes the way I cut vegetables, bagels, or use anything sharp.

Whether they intended it or not, my parents were very successful in creating a risk-aware culture of safety in our family, at least when it came to using knives. Culture is, of course, the “taken-for grantedness” of the world around us, the things we think and do and say without really thinking about them. As the person who teaches Change Leadership and Culture Change for the GW Center for Excellence in Public Leadership’s Enterprise Risk Management in Government Certificate and ERM Mini Boot Camp programs, I’m always thinking about how we can create organizational cultures that provide us with the results we’re looking for in ERM: cultures that support information sharing and openness about the risks within our areas of responsibility, so that across the enterprise we can make the best possible decisions about those risks that threaten our ability to achieve our mission and our strategic objectives. And from a sustainment perspective, I’m always interested in what it takes to make the culture we want simply “the way we always do things around here.”

Recently, I came across the Institute for Risk Management’s Risk Culture Resource Guide for Practitioners (www.theirm.org), which I commend to anyone interested in shaping a risk-aware culture. As you can see in the graphic, their framework for risk culture begins with (1) an individual’s personal predisposition to risk, which then shapes (2) the individual’s personal ethics, followed by (3) that individual’s actual behavior; that person’s behavior combines with all other members of the organization to create (4) the organization’s culture, which then shapes how willing people in the organization are to live in a (5) risk culture that either welcomes openness and information sharing or “punishes” people for identifying risks openly.

The “Aha!” for me is the reminder that organizational culture is created by the individuals who make up that organization. What is my personal “risk appetite” for raising issues that I may see as career-ending, rather than career-enhancing? Am I more likely to wait to raise a problem until I have a resolution for it (which may then make it almost impossible to address if I can’t figure out a solution in time), or am I willing to admit that I don’t have a solution on my own and ask others for help early on? Am I willing to share information about a risk that I’ve uncovered, or do I keep that information hidden because there may be negative political consequences? How prepared am I to work collaboratively with others in my organization, even though that may risk them knowing that I and my part of the organization may have made mistakes or failed to achieve something we were responsible for? And what about my colleagues—how do they answer these questions for themselves?

The leadership challenge in creating and sustaining an organizational culture that supports and rewards people for raising risks is to figure out how to ensure that what we say and what we do are aligned with our vision for that risk-aware, risk-informed culture. It also involves making sure that all those individual mini risk cultures –each person’s own Great-Great Uncle Albert story—are managed in such a way that as a collective we come to believe that working in an organization that supports openness and the sharing of potential risks is the best kind of organization of which to be a part. Roger Connors and Tom Smith, in their book, Change the Culture, Change the Game, suggest that the experiences people have in their organizations lay the foundation for the culture that creates the results the organization produces (see chapter 5). Experiences do this because they confirm or disconfirm the beliefs individuals have, which then shape the actions individuals are prepared to take to complete their work.

As someone who is concerned about implementing Enterprise Risk Management in public sector organizations, let me invite you to consider incorporating these three practices into your leadership tool kit:

• Tell stories (over and over again—think Great-Great Uncle Albert!) that create a compelling vision for why a risk-informed organization is the best kind of place to work.
• Be vigilant in making sure that what you say matches what you actually do when it comes to dealing with the sharing of potential risks.
• Design experiences for your employees that confirm a positive approach to ERM (and risk management in general), and that will help them believe it is safe to raise concerns and possible risks early and often (for example, consider using In Progress, and After-Action Reviews to demonstrate your openness to hearing bad news without shooting the messenger).

My Great-Great Uncle Albert blinded himself almost 140 years ago. But the story of his experience, and what we should do to mitigate that risk for ourselves, is now passing on to a fifth generation in our family. What are the stories that your agency tells about risks that were avoided because committed employees were willing to take the risk to share information and to work across organizational boundaries? If you don’t have those stories yet, how can you help to craft them, so that current and new employees will discover that being open about potential risks is simply “the way we’ve always done it around here”? How will you help to create an enterprise-wide culture of risk-informed decision-making by what you say and do, so that the American people will benefit, as your agency successfully accomplishes its mission on behalf of them?

Natalie K. Houghtby-Haddon, Ph.D. is the Associate Director of the George Washington University Center for Excellence in Public Leadership (GW CEPL). She is the Faculty Director for GW CEPL’s ERM in Government Certificate Program. She would love to hear your stories, and how you are getting the message out about the successes and benefits of ERM for your organization. Feel free to contact her at hsquared@gwu.edu. For more information about the Center’s ERM and Leadership Development programs, please visit our website at: www.gwu.edu/cepl.a

President’s Article

Greetings to our AFERM members, sponsors, and everyone else who is reading this because you are interested in Enterprise Risk Management or support AFERM’s mission! I hope that this issue finds you and those close to you well, safe, and thriving. I remain committed to working with you all with thoughtfulness, flexibility, and energy. As we enter the second half of the year, we will advance ERM by delivering exceptional training, creating networking and professional development opportunities, and sharing lessons learned and thought leadership.

This quarter, we’ve made great progress on our 2020-2025 strategic plan, setting and meeting goals in our areas of focus, including delivering value to our members and sponsors, building on outstanding in-person and online events and education, and establishing solid and sustainable infrastructure that enables us to drive forward the vision of AFERM.

This past June I attended, along with more than 100 ERM practitioners, the annual ERM Workshop co-sponsored by AFERM and AGA. This compelling event provided participants with practical insight from thought leaders and ERM experts. The workshop included presentations as well as facilitated table discussions, where we moved from academic discussions to “how-to” explanations and examples. The small, facilitated groups enhanced opportunities for both hands-on work and Q&A. Thank you to everyone who came out to make this Workshop such a success!

We have had our second quarterly webinar, and launched a new association management technology, which was a smooth transition and will better support members.

Our committees are powerful partners in moving forward the work of AFERM, and we are developing and implementing strategic plans in the areas of Membership, Sponsorship, and Communications. We are grateful to our committee leaders for their work and dedication.

We are excited to have begun preparing for the AFERM marquee event – our annual Summit. I want to thank Bobbi-Jo Pankaj and Melissa Thomson, Summit Chair and Co-Chair, for leading the Summit planning. We are thrilled to announce the Summit will be held at the Ronald Reagan Center in Washington, DC, on November 12 and 13. We’ve opened 2024 Summit Registration – see link here. Also, there is still time to volunteer on a committee to help shape the Summit’s plenary and breakout sessions, as well as aiding marketing and logistics.

As we continue to grow our partnerships and our membership, we have been reaching out to state and local ERM practitioners to deliver our mission to advance the practice of Enterprise Risk Management in government through thought leadership, education, and collaboration.

Finally, we are excited to welcome our new long-term executive director, Mackenzie Kelley! We include an article about Mackenzie in the newsletter. Thank you to Dara Rudick, CEO of Management HQ, who has served as our interim Executive Director over the past four months.

Stay tuned for more exciting ways to get involved!

– Jason Bruno, AFERM President

We welcome Mackenzie Kelley as our AFERM Executive Director. Mackenzie brings more than 15 years of association management experience to AFERM. Her focus is working with boards of national and international associations to grow and strengthen their organizations. Mackenzie has been an integral part of the team at Management HQ (MHQ), AFERM’s association management company, for more than six years. Before her current role, Mackenzie served as MHQ’s Events Manager, supporting client associations through managing major conferences, distance education, and other educational and networking events.

Prior to joining MHQ, Mackenzie worked at the Better Business Bureau of Minnesota and North Dakota (BBB) for nine years. While at BBB, she executed over 50 annual events regionally, including the BBB’s annual awards ceremony, and the annual high school scholarship program. She cultivated relationships with media outlets and decision makers at local and national companies.

Mackenzie has been heavily involved with the Alzheimer’s Association, a cause that is near and dear to her heart, having lost her mom to the disease. She co-founded the Young Champions in 2010: the Alzheimer’s Association young professionals group in the Twin Cities. She served as the President of the Executive Board for many years, overseeing advocacy, fundraising, education, and member recruitment committees. Alongside her brother, she started the Memory Mixer, an annual fundraiser to honor their mom, raising over $300K over 10 years. Please join us in welcoming Mackenzie. She can be reached at executivedirector@aferm.org.