Donna Davis Defense Finance and Accounting Service June 2010 Enterprise Risk Management for the Federal Government – Where’s the Value? Donna Davis Defense Finance and Accounting Service June 2010 Integrity - Service - Innovation

Integrity - Service - Innovation Agenda ERM - Where’s the Value? Putting the COSO Framework to Work in the Federal Sector Event Identification Risk Assessment Risk Response Control Activities Information and Communication Monitoring Some Pitfalls to be Wary of A Gallery of Tools and Techniques 9/16/2018 Integrity - Service - Innovation

ERM in the Federal Government – Where’s the Value Three Parts of Business Objective Risk Controls Objective Control Risk 9/16/2018 Integrity - Service - Innovation

ERM in the Federal Government – Where’s the Value Three Parts of Business Objective – what you are trying to accomplish For Profit To maximize shareholder wealth or, in the case of a corporation, to maximize the value of the firm as measured by stock price. Realize a benefit from resources expended. Focus on efficiency. Not For Profit To achieve a mission or objective while protecting assets. Achieve goals and objectives for resources expended. Focus on effectiveness. 9/16/2018 Integrity - Service - Innovation

ERM in the Federal Government – Where’s the Value Three Parts of Business Objective – what you are trying to accomplish Risk – the barrier that will stop you from accomplishing the objective For Profit Seek Risk as a means for expanding market value. Measure Value at Risk. Not For Profit Avoid Risk seeking safest path to mission achievement. Measure Impact of Risk on Goals and Objectives. 9/16/2018 Integrity - Service - Innovation

ERM in the Federal Government – Where’s the Value Three Parts of Business Objective – what you are trying to accomplish Risk – the barrier that will stop you from accomplishing the objective Controls – the action that will remove or diminish the risk For Profit Affect controls for the purpose of minimizing loss. Not For Profit Affect controls to assure compliance, accountability, effectiveness/efficiency, reliability of reported data and safeguarding assets. 9/16/2018 Integrity - Service - Innovation

Integrity - Service - Innovation ERM in the Federal Government – Where’s the Value What Do We Want From the “Business” of Government? To be Affordable and Efficient To be Effective To provide Quality Service To be Dependable The faster pace and need for innovation, combined with significant risk-based events from computer failures to natural disasters, has focused attention on risk management as an essential factor in sound decision-making and accountability. 9/16/2018 Integrity - Service - Innovation

Integrity - Service - Innovation ERM in the Federal Government – Where’s the Value What Do We Want From the Business of Government? To be Affordable and Efficient To be Effective To provide Quality Service To be Dependable So – We need to be able to achieve the established mission in order to retain the confidence of our funders. We need to provide value for our services. Bottom Line – We need to meet our objectives and protect our assets, including intangible ones such as reputation. The faster pace and need for innovation, combined with significant risk-based events from computer failures to natural disasters, has focused attention on risk management as an essential factor in sound decision-making and accountability. 9/16/2018 Integrity - Service - Innovation

Integrity - Service - Innovation ERM in the Federal Government – Where’s the Value What Value does ERM Provide? Supports Government’s Governance Responsibilities Improves Results Strengthens Accountability Enhances Stewardship The faster pace and need for innovation, combined with significant risk-based events from computer failures to natural disasters, has focused attention on risk management as an essential factor in sound decision-making and accountability. 9/16/2018 Integrity - Service - Innovation

Integrity - Service - Innovation ERM in the Federal Government – Where’s the Value How does ERM support Government’s Governance Responsibilities? By ensuring that significant risk areas associated with polices, plans, programs and operations are identified and assessed. By ensuring that appropriate measures are in place to address unfavorable impacts and to benefit from opportunities. The faster pace and need for innovation, combined with significant risk-based events from computer failures to natural disasters, has focused attention on risk management as an essential factor in sound decision-making and accountability. 9/16/2018 Integrity - Service - Innovation

Integrity - Service - Innovation ERM in the Federal Government – Where’s the Value How does ERM Improve Results ? Through more informed decision-making and by ensuring that values, competencies, tools, and a supportive environment form the foundation for innovation and responsible risk-taking. By encouraging learning from experience while respecting parliamentary controls. The faster pace and need for innovation, combined with significant risk-based events from computer failures to natural disasters, has focused attention on risk management as an essential factor in sound decision-making and accountability. 9/16/2018 Integrity - Service - Innovation

Integrity - Service - Innovation ERM in the Federal Government – Where’s the Value How does ERM Strengthen Accountability? By demonstrating that levels of risk associated with policies, plans, programs and operations are explicitly understood. By facilitating the optimum balance in risk management measures and stakeholder interests. The faster pace and need for innovation, combined with significant risk-based events from computer failures to natural disasters, has focused attention on risk management as an essential factor in sound decision-making and accountability. 9/16/2018 Integrity - Service - Innovation

Integrity - Service - Innovation ERM in the Federal Government – Where’s the Value How does ERM Enhance Stewardship? By strengthening public service capability to safeguard people, government property and interests through increased insight to the potential impact of abnormal events. The faster pace and need for innovation, combined with significant risk-based events from computer failures to natural disasters, has focused attention on risk management as an essential factor in sound decision-making and accountability. 9/16/2018 Integrity - Service - Innovation

Putting the COSO Framework to Work in the Federal Sector DFAS-ization of COSO 9/16/2018 Integrity - Service - Innovation

Putting the COSO Framework to Work in the Federal Sector DFAS ‘ ERM Philosophy and Methodology Risk Taxonomy Risk Polices and Standards Internal Environment DFAS Mission Strategic Objectives Operational Objectives Objective Setting Potential Events affecting Objective Achievement Positive/Negative Impact External/Internal Factors Event Identification Likelihood and Impact Category of Impact Risk Assessment Response Options: Accept, Avoid, Mitigate, Share, etc. Response Cost versus Benefit Risk Response Policies and Procedures Control Activities: Approvals, Authorizations, Verifications, Reconciliations, Reviews, etc. Controls Activities Timely ERM Communication Flow Up, Down and Across the Agency Integration of Risk Information Across the Agency (Audit Findings, SITREPS, Self-Identified Deficiencies) Internal and External Training Information & Communication Assessment of Presence and Functioning of ERM Components Regular Control Testing and Reviews Monitoring DFAS alignment to the Risk Components ensures a robust program and strengthens compliance with the GAO Standards for Internal Control. 9/16/2018 Integrity - Service - Innovation

Putting the COSO Framework to Work in the Federal Sector With Federal Regulations and Laws With DFAS Regulations and Polices With Operational Policies and Procedures Compliance For Achievement of Strategic Objectives and desired outcomes For Achievement of Operational Objectives and desired outcomes For use of public resources Accountability (Strategic) Provide reliable, useful and timely information Accurate and timely recoding of transactions and events Reliability (Reporting) Carryout public functions legally, effectively, efficiently, economically, ethically, and equitably Effective and Efficient (Operations) Access restrictions to and accountability for resources and records Segregation of duties Safeguard Assets DFAS expanded the Risk Management Objectives to address data security concerns and general auditing standards. 9/16/2018 Integrity - Service - Innovation

Putting the COSO Framework to Work in the Federal Sector DFAS Agency Business Enabling Governance Cycle Payroll Disbursements Personnel Customer Relation Mngt Other Disbursements Procurement Mgt of Processes & Programs Revenue & Receipts Provide IT Support Strategic Planning & Execution Assets & Liabilities Infrastructure Financial Reporting Finance & Budget 63 Programs - Business Functions (Mil Pay, Accounts Payable, Budget, ERM, etc.) Program A group of related actions (Payroll Record Maintenance, Process Payroll, Certify Payroll, etc.) Functions A series of tasks or operations conducing to an end ( Input data, edit data, validate entry, save data, etc.) Processes Detailed steps for accomplishing a task Level 3 Maps Stratification across business units and at every level of the organization was applied to enable accurate reflection of the interrelationships of risks and create a common taxonomy for business activities. 9/16/2018 Integrity - Service - Innovation

Putting the COSO Framework to Work in the Federal Sector We are actually finding this layer adds little value as we evolve the program. DFAS Agency Business Enabling Governance Cycle Payroll Disbursements Personnel Customer Relation Mngt Other Disbursements Procurement Mgt of Processes & Programs Revenue & Receipts Provide IT Support Strategic Planning & Execution Assets & Liabilities Infrastructure Financial Reporting Finance & Budget 63 Programs - Business Functions (Mil Pay, Accounts Payable, Budget, ERM, etc.) Program A group of related actions (Payroll Record Maintenance, Process Payroll, Certify Payroll, etc.) Functions A series of tasks or operations conducing to an end ( Input data, edit data, validate entry, save data, etc.) Processes Detailed steps for accomplishing a task Level 3 Maps Stratification across business units and at every level of the organization was applied to enable accurate reflection of the interrelationships of risks and create a common taxonomy for business activities. 9/16/2018 Integrity - Service - Innovation

Some Pitfalls to be Wary of Trying to risk manage EVERYthing Just focusing on financial risks An obsession with internal controls – an inward looking limitation 9/16/2018 Integrity - Service - Innovation

A Gallery of Tools and Techniques Agency Mission and Functions Manual Provides the business objectives COSO Framework Identifies a comprehensive view of the elements of a robust ERM A Catchy Logo CARES – covers the five Risk Management Objectives DFAS assesses Compliant Accountable Reliable & Accurate Effective & Efficient Safeguarded Auditor’s Lenses 9/16/2018 Integrity - Service - Innovation

A Gallery of Tools and Techniques SIPOC Model Guides process mapping through a complete end to end review of the factors impacting the business activity 9/16/2018 Integrity - Service - Innovation

A Gallery of Tools and Techniques IDEF Model Denotes the role of compliance/regulations/controls in the business activity Denotes the role of the supporting mechanisms for the business activity Integration DEFinition Model 9/16/2018 Integrity - Service - Innovation

A Gallery of Tools and Techniques Risk Identification Questionnaire Facilitates comprehensive and consistent assessment of potential risks Courtesy of Brian Williams 9/16/2018 Integrity - Service - Innovation

A Gallery of Tools and Techniques Process Map & Narrative For business processes For Information Systems data flow 9/16/2018 Integrity - Service - Innovation

Integrity - Service - Innovation End Questions? 9/16/2018 Integrity - Service - Innovation