Page 38 - FCW, July30, 2016

DrillDown
mark Office, and the Centers for Dis-
ease Control and Prevention — are tak- ing action. Others are waiting for the new OMB circular and its companion guide so they can use them as a play- book for best practices.
OMB is encouraging agencies not to wait, however, and is instead sug- gesting they move forward by adopting other agencies’ best practices or hiring consultants.
Finding ways to comply
As a longtime risk management ser- vice provider, our firm has developed a robust understanding of the ongo- ing applications of ERM in industry, the nonprofit world and government. Judging from our experience, agen- cies will likely respond in one of three ways when OMB issues the update to Circular A-123.
Some agencies, particularly those with smaller budgets or specialized missions, might not perceive ERM as being especially applicable to them. Others might believe their existing management system is sufficient. And some large organizations with skillful internal control departments might conclude that a holistic ERM system is not necessary.
Those groups will fulfill the ERM mandate by adopting an approach that relies on compliance checklists and will probably incorporate ERM into the auditing function.
Other agencies will view ERM as a system that proves its value by pro- ducing a “golden nugget” on a frequent basis. That nugget might be identifica- tion of a risk that had not been recog- nized previously or one that emerges from a changing market condition. The value of that type of ERM system will be delivered by a stand-alone team that operates outside the main leadership group. Officials at organizations using that approach will respond to the valu- able and timely information by taking action to mitigate risks.
Although that approach has merit,
following it means that ERM is inter- mittent and valued mainly for the most recent risks it has identified.
Some agencies are taking a third and more advanced approach by using ERM as an integral element of opera- tions. They incorporate it into all areas of management and do not view it as a stand-alone tool or annual exercise. Used that way, ERM becomes a vital tool for proactively identifying risks and informing leaders’ understanding of risk management.
That holistic approach allows ERM to function as a key component of the organization that supports risk commu- nication and strategic decision-making for leaders. Agencies that adopt this approach will gain a broader, enter- prisewide view of the internal and external issues that could adversely affect agency performance or tarnish its reputation.
Factors that influence implementation
Embracing ERM is the logical next step in the development of a govern- ment that is determined to decrease its risk exposure while better serving the U.S. public. Even with the circular and playbook, ERM will mature with vastly different implementation styles driven by a number of key influential factors.
The first factor is the placement of the ERM team. Many early adopters in government have been experts in performance management and risk. Organizations led by individuals with those competencies will find it more natural for the ERM role to be handled by the project management office or the head of strategic planning.
OMB is expected to house the new ERM requirement under its manage- ment branch (instead of budget), an indication of the importance of ERM as a management function rather than a fiscal one. OMB has recommended that the ERM function be the responsi- bility of agencies’ project management
office, strategic planning office or chief operating officers.
However, some agencies might find it easier to expand the chief financial officer’s responsibilities because the CFO is already familiar with one ele- ment of ERM — financial risk. And agencies with fully staffed internal control offices might choose to expand that staff’s responsibilities to include ERM. (ERM and internal control are naturally interrelated because they flow from the same Circular A-123 mandate.)
The second influencing factor is the tone from the top. The circular will mandate progress in implement- ing an ERM strategy with which agen- cies must comply, but agency leaders will set the tone for the level of ERM integration into their systems and processes. Even the most robust and informative ERM system might not deliver value if it is not regarded as a key management tool.
The third factor is whether a given agency has experienced a transform- ing risk event. Organizations that have recently undergone major distress or experienced a public risk event are typically more amenable to change and more likely to embrace innova- tive, forward-looking ideas like ERM that decrease the chance of another incident.
The circular update will set the tone for a new era of informed strategic decision-making within government that, when fully embraced, will be an integral part of those organizations. But implementing an ERM system is challenging.
Whether an agency moves forward on its own or looks outside for assis- tance, it is important to begin taking the first steps now. n
Laura Jackson is senior program director for strategic and enterprise risk management and John Duncan is vice president for the government sector at ABS Group.
30 July 30, 2016 FCW.COM