Enterprise Risk Management for the Federal Government – Where’s the Value?

1. Enterprise Risk Management for the Federal Government – Where’s the Value? Donna Davis Defense Finance and Accounting Service June 2010 Integrity - Service - Innovation

2. Agenda • ERM - Where’s the Value? • Putting the COSO Framework to Work in the Federal Sector • Event Identification • Risk Assessment • Risk Response • Control Activities • Information and Communication • Monitoring • Some Pitfalls to be Wary of • A Gallery of Tools and Techniques Integrity - Service - Innovation

3. ERM in the Federal Government – Where’s the Value Three Parts of Business • Objective • Risk • Controls Integrity - Service - Innovation

4. ERM in the Federal Government – Where’s the Value Three Parts of Business • Objective – what you are trying to accomplish Not For Profit To achieve a mission or objective while protecting assets. Achieve goals and objectives for resources expended. Focus on effectiveness. For Profit To maximize shareholder wealth or, in the case of a corporation, to maximize the value of the firm as measured by stock price. Realize a benefit from resources expended. Focus on efficiency. Integrity - Service - Innovation

5. ERM in the Federal Government – Where’s the Value Three Parts of Business • Objective – what you are trying to accomplish • Risk – the barrier that will stop you from accomplishing the objective Not For Profit Avoid Risk seeking safest path to mission achievement. Measure Impact of Risk on Goals and Objectives. For Profit Seek Risk as a means for expanding market value. Measure Value at Risk. Integrity - Service - Innovation

6. ERM in the Federal Government – Where’s the Value Three Parts of Business • Objective – what you are trying to accomplish • Risk – the barrier that will stop you from accomplishing the objective • Controls – the action that will remove or diminish the risk Not For Profit Affect controls to assure compliance, accountability, effectiveness/efficiency, reliability of reported data and safeguarding assets. For Profit Affect controls for the purpose of minimizing loss. Integrity - Service - Innovation

7. ERM in the Federal Government – Where’s the Value • What Do We Want From the “Business” of Government? • To be Affordable and Efficient • To be Effective • To provide Quality Service • To be Dependable Integrity - Service - Innovation

8. ERM in the Federal Government – Where’s the Value • What Do We Want From the Business of Government? • To be Affordable and Efficient • To be Effective • To provide Quality Service • To be Dependable So – We need to be able to achieve the established mission in order to retain the confidence of our funders. We need to provide value for our services. Bottom Line – We need to meet our objectives and protect our assets, including intangible ones such as reputation. Integrity - Service - Innovation

9. ERM in the Federal Government – Where’s the Value • What Value does ERM Provide? • Supports Government’s Governance Responsibilities • Improves Results • Strengthens Accountability • Enhances Stewardship Integrity - Service - Innovation

10. ERM in the Federal Government – Where’s the Value • How does ERM support Government’s Governance Responsibilities? By ensuring that significant risk areas associated with polices, plans, programs and operations are identified and assessed. By ensuring that appropriate measures are in place to address unfavorable impacts and to benefit from opportunities. Integrity - Service - Innovation

11. ERM in the Federal Government – Where’s the Value • How does ERM Improve Results ? Through more informed decision-making and by ensuring that values, competencies, tools, and a supportive environment form the foundation for innovation and responsible risk-taking. By encouraging learning from experience while respecting parliamentary controls. Integrity - Service - Innovation

12. ERM in the Federal Government – Where’s the Value • How does ERM Strengthen Accountability? By demonstrating that levels of risk associated with policies, plans, programs and operations are explicitly understood. By facilitating the optimum balance in risk management measures and stakeholder interests. Integrity - Service - Innovation

13. ERM in the Federal Government – Where’s the Value • How does ERM Enhance Stewardship? By strengthening public service capability to safeguard people, government property and interests through increased insight to the potential impact of abnormal events. Integrity - Service - Innovation

14. Putting the COSO Framework to Work in the Federal Sector DFAS-ization of COSO Integrity - Service - Innovation

15. Putting the COSO Framework to Work in the Federal Sector DFAS alignment to the Risk Components ensures a robust program and strengthens compliance with the GAO Standards for Internal Control. Integrity - Service - Innovation

16. Putting the COSO Framework to Work in the Federal Sector DFAS expanded the Risk Management Objectives to address data security concerns and general auditing standards. Integrity - Service - Innovation

17. Putting the COSO Framework to Work in the Federal Sector Stratification across business units and at every level of the organization was applied to enable accurate reflection of the interrelationships of risks and create a common taxonomy for business activities. Integrity - Service - Innovation

18. Putting the COSO Framework to Work in the Federal Sector We are actually finding this layer adds little value as we evolve the program. Stratification across business units and at every level of the organization was applied to enable accurate reflection of the interrelationships of risks and create a common taxonomy for business activities. Integrity - Service - Innovation

19. Some Pitfalls to be Wary of Trying to risk manage EVERYthing Just focusing on financial risks An obsession with internal controls – an inward looking limitation Integrity - Service - Innovation

20. A Gallery of Tools and Techniques • Agency Mission and Functions Manual • Provides the business objectives • COSO Framework • Identifies a comprehensive view of the elements of a robust ERM • A Catchy Logo • CARES – covers the five Risk Management Objectives DFAS assesses Compliant Accountable Reliable & Accurate Effective & Efficient Safeguarded Auditor’s Lenses Integrity - Service - Innovation

21. A Gallery of Tools and Techniques • SIPOC Model • Guides process mapping through a complete end to end review of the factors impacting the business activity Integrity - Service - Innovation

22. A Gallery of Tools and Techniques • IDEF Model • Denotes the role of compliance/regulations/controls in the business activity • Denotes the role of the supporting mechanisms for the business activity Integration DEFinition Model Integrity - Service - Innovation

23. A Gallery of Tools and Techniques • Risk Identification Questionnaire • Facilitates comprehensive and consistent assessment of potential risks Courtesy of Brian Williams Integrity - Service - Innovation

24. A Gallery of Tools and Techniques • Process Map & Narrative • For business processes • For Information Systems data flow Integrity - Service - Innovation

25. End Questions? Integrity - Service - Innovation