1. Integrity - Service - Innovation
Workshop Session I
Integrity - Service - Innovation

2. Terri McKay Deputy Director, DFAS
Risk Management
Terri McKay Deputy Director, DFAS
Integrity - Service - Innovation

3. Integrity - Service - Innovation
Risk Management
Teresa McKay
Principal Deputy Director
Defense Finance and Accounting Service
Integrity - Service - Innovation

4. Integrity - Service - Innovation
Agenda
What is Enterprise Risk Management (ERM)
DFAS Need for ERM
Mission and Vision
DFAS Risk Culture Yesterday
DFAS New Approach to ERM
Risk assessment – People, Process, and Technology
Establishing the Risk Management Organization
Transforming FMFIA to a Risk Management Organization
Risk Management Taxonomy & Risk Classification
Optimum Risk Management Organization
Business Activity Monitoring
Dashboard/Technology Integration
Expected Outcomes – People, Processes, Technology
Summary - Enterprise Risk Management
Integrity - Service - Innovation

5. What is Enterprise Risk Management? Integrity - Service - Innovation
What is ERM?
What is Enterprise Risk Management?
Integrity - Service - Innovation

6. What is Enterprise Risk Management?
Enterprise Risk Management (ERM):
A comprehensive, systematic approach for all organizations, regardless of size or mission, to identify events and measure, prioritize and respond to the risks challenging its most critical objectives and related projects, initiatives and day-to-day operating practices
Integrity - Service - Innovation

7. Integrity - Service - Innovation
DFAS Need for ERM
DFAS identified the requirement to improve its current risk infrastructure and Business Activity Monitoring (BAM) capabilities, thereby enabling potentially millions of dollars of savings to be repurposed in support of the warfighter.
DFAS needs greater assurance that potential weaknesses that could adversely affect DFAS’ ability to accomplish its mission, will be prevented or detected and properly mitigated in a timely manner.
Integrity - Service - Innovation

8. DFAS ERMP Mission and Vision
The DFAS' Enterprise Risk Management Program (ERMP) will create a proactive and sustained Risk and Control Culture to include the capacity to identify, prioritize, and respond to the risks challenging our most critical objective: the ability to provide responsive and efficient accounting and finance services to the men and women in uniform.
ERMP Vision
DFAS' ERMP is an integrated and embedded element of Agency operations, culture and ethical environment. ERM is institutionalized across DFAS' enterprise, aligned with individual and management responsibilities. This forms the basis for measured performance and individual accountability to DFAS' mission providing "world class" finance and accounting services and operations to it customers, shaping transformation planning, initiatives, and activities. DFAS' ERMP enables agency business improvement opportunities including system implementations and transformation through continuous improvement leading to predicative capabilities.
Integrity - Service - Innovation

9. Integrity - Service - Innovation
DFAS – What We Do
Mission: Provide accounting and finance services for the Military Departments and Defense Agencies.
Sales & Service - $1.63B
Scope of Business
Military Pay $246.7M
Civilian Pay $62.6M
Retiree Pay $48.2M
Travel Pay $38.5M
Commercial Pay $276.7M
Accounting Services $508.7M
Others $446.9M
Processed million pay transactions (5.9 million people)
Made 7 million travel payments
Paid 13.8 million commercial invoices
Posted 57 million general ledger transactions
Managed military retirement and health benefits funds ($255 billion)
Made an average of $424 billion in disbursements to pay recipients
Managed $20.9 billion in foreign military sales (reimbursed by foreign governments)
Account for 878 active DoD appropriations
People
13,770 employees * (Civilian and Military)
Located in:
22 sites
15 states
3 countries
*Source: HR Flash Report September 2006
Integrity - Service - Innovation

10. DFAS Current State Assessment
DFAS Risk Management Maturity Model across Categories
Assessed DFAS against the RMMM competencies of People, Process and Technology
DFAS relative maturity is transitional stage between Level 1 (Ad Hoc) and Level 2 (Managed)
Integrity - Service - Innovation

11. Integrity - Service - Innovation
DFAS Current State Assessment
People Observations:
Reactive, decentralized approach to risk.
Heavy focus on compliance risk.
Employees inundated with day-to-day tasks.
Culture does not ‘think’ risk; assumes S&C is responsible for “making things right.”
Lack of formal risk management training for staff; concept of risk management is misunderstood.
Retirement of workforce poses substantial risk.
Integrity - Service - Innovation

12. Integrity - Service - Innovation
DFAS Current State Assessment
Process Observations:
Lack of formal, agency-wide risk management policies & procedures.
DFAS targets areas of highest concern and other areas are unnoticed.
Decentralized approach to risk management with little coordination between departments (i.e., S&C and IT are responsible for separate compliance initiatives).
Integrity - Service - Innovation

13. DFAS Current State Assessment
Technology Observations:
DFAS maintains several dashboard reporting mechanisms containing risk information
Access to risk information limited within business process – ePortal/dashboards
Information is captured through voluntary data-entry resulting in overburdened staff
Dashboards lack integration of risk information across departments to maximize risk mitigation efforts
Compliance oriented
Culture is such that DFAS does not readily admit weaknesses
Integrity - Service - Innovation

14. Integrity - Service - Innovation
DFAS Approach to ERM
DFAS is employing a phased implementation approach.
The overall ERMP implementation consists of several supporting activities, such as:
Governance Structure Development
Communication and ERM Awareness
Taxonomy and Risk Classification Development
ERM Policy Development
End to End Process Flows
Risk and Control Identification and Assessment
Issue Management and Remediation
Technology
Implementation activities impact three key competency areas: People, Processes, and Technology.
Integrity - Service - Innovation

15. DFAS’ ERMP Implementation Phases
Assess
Plan
Execute
Sustain
Conduct assessment of existing/current DFAS risk management practices
Develop DFAS’ ERMP Strategy
Develop Implementation Plan
Assign Resources
Prioritize ERMP Initiatives/ Activities
Implement the Plan
Communicate the Strategy to the workforce
Optimize ERM processes
Perform ongoing ERM activities
Continuously incorporate employee feedback
Integrity - Service - Innovation

16. Three Critical Competency Areas
People
Processes
Technology
Three Critical Competency Areas
Assess
Plan
Execute
Sustain
DFAS’ approach emphasizes successful ERMP implementation is dependent on key competencies across three primary areas: People, Process, and Technology.
Outcomes in these three critical areas will drive the success of DFAS’ ERMP.
Integrity - Service - Innovation

17. Integrity - Service - Innovation
People
Processes
Technology
DFAS’ Approach to ERM
Assess
Plan
Execute
Sustain
DFAS ERMP Implementation Activities:
ERM Governance
Business Environment Identification
KRI Identification and Monitoring
ERM Reporting
Compliance Management
Taxonomy, Risk Classification, and Policy
Establish DFAS Risk Appetite
ERM System/ Dashboard Development
Incident Capture Process
Communication, Training, and Awareness
Risk and Control Identification and Assessment
Control Testing
Issue Management and Remediation
Integrity - Service - Innovation

18. DFAS’ Approach – Compliance Integration
DFAS will integrate the following compliance programs:
FMFIA/Circular A-123
Financial Improvement and Audit Readiness (FIAR)
FFMIA
Audit Oversight (A-50)
Improper Payment Information Act (IPIA)
Prompt Pay Act (PPA)
Balanced Scorecard
Clinger/Cohen Act
DIACAP
FISMA
Integrity - Service - Innovation

19. Integrity - Service - Innovation
ERMP Goals
Sustainable ERMP to integrate risk identification, analysis, and reporting for all key processes, programs, and operations throughout DFAS.
Integrated process to proactively manage risk and a decision support framework for management to systematical assess risks against DFAS objectives.
Culture of risk management that drives the responsibility for proactive risk management by appropriate personnel.
Disciplined approach toward efficiently maturing its risk management capabilities and instituting an approach toward continuous process improvement.
Integrity - Service - Innovation

20. Integrity - Service - Innovation
ERMP Objectives
Goal 1: Sustainable ERMP to integrate risk identification, analysis,
and reporting for all key processes, programs, and operations
throughout DFAS.
Objectives
Objective 1.1: An effective senior level sponsorship to manage development and execution of ERMP Strategy.
Objective 1.2: Uniform and disciplined approach to risk identification, management, and control.
Integrity - Service - Innovation

21. Integrity - Service - Innovation
ERMP Objectives
Goal 2: Integrated process to proactively manage risk and a decision
support framework for management to systematical assess identified risks against DFAS objectives.
Objectives
Objective 2.1 Validated risk inventory, using uniform terms and formats, aligned with DFAS objectives.
Objective 2.2 Management access to triggered risks, control deficiencies, and response status.
Objective 2.3 Efficient integration and communication of risk information.
Objective 2.4 Integrated management control program coordinating all compliance activities.
Integrity - Service - Innovation

22. Integrity - Service - Innovation
ERMP Objectives
Goal 3: Culture of risk management that drives the responsibility for proactive risk management to appropriate personnel.
Objectives
Objective 3.1 All personnel understand their responsibilities and requirements of the risk management program.
Objective 3.2 Open, candid, proactive risk management behavior
exhibited across the organization.
Integrity - Service - Innovation

23. Integrity - Service - Innovation
ERMP Objectives
Goal 4: Disciplined approach toward efficiently maturing its risk management capabilities and instituting a process of continuous process improvement.
Objectives
Objective 4.1 Continuous monitoring and assessment process using
the risk maturity model to assess progress toward
continuous improvement.
Objective 4.2 Improvement opportunities consistent with the logical progression suggested in the maturity model to ensure efficient operational investment.
Integrity - Service - Innovation

24. Establishing the Risk Management Organization
Performed Enterprise Business Diagnostic (Lean 6)
Identified process modeling redundancies
DFAS A-123 Appendix A (as an entity) “as-is”
Customer A-123 Appendix A “as-is”
Lean 6 “as-is” and “to-be”
BEA “to-be”
BAM system and operations “as-is”
Identified multiple risk identification activities
Existing assessable unit (AU) reviews
Standardization of AUs across operations
New AUs from BAM implementation
Audit findings and self identified deficiencies
Establish process modeling oversight office
Establish capability to collect, reconcile, and revise AUs
Determined optimum organization structure for risk management oversight and support
Integrity - Service - Innovation

25. Optimum Risk Management Organization
Integrity - Service - Innovation

26. ERM Supported by Business Activity Monitoring
Business Activity Monitoring (BAM): The identification, monitoring, reduction, or elimination of transactional errors, misuse, and potential fraud that results in financial discrepancies, losses, and workflow inefficiencies.
The BAM solution will provide the following:
Identify potential improper payment transactions;
Evaluate every transaction of a business process;
Automate controls;
Analyze modified transactions; and
Detect missing data.
Integrity - Service - Innovation

27. Integrity - Service - Innovation
Business Activity Monitoring (BAM)
Time Line – High Level Plan
Integrity - Service - Innovation

28. Benefits of BAM-supported ERMP
Implementing a BAM-supported ERMP will help:
Align risks to strategic objectives and priorities
Improve risk communication, monitoring, and reporting
Introduce consistency to methods for managing risk across the enterprise
Improve management controls
Integrate control activities
Enable risk assessments
Lower enterprise risk
Integrity - Service - Innovation

29. DFAS ERMP Dashboard / Technology Integration
Define:
Critical success factors for dashboard integration
Dashboard objectives and high-level requirements
Dashboards currently in use
Data sources and data validation
Phased implementation approach
Dashboard technology
Dashboard next steps
Implementation Plan will detail specific dashboard implementation tasks as well as timeframes.

30. Expected Outcomes – People
Leadership sets the tone for cultural change emphasizing proactive behavior versus reactive behavior.
Risk management is on the agenda of every senior management meeting.
To sustain change, risk management training performed annually.
ERM Steering Committee oversees risk management policies at the enterprise level.
Risk management activities are shared and coordinated across DFAS through a centralized Program Management Office.
Risk Mgt is Priority | Training & Awareness | Risk Culture | Executive Support
Integrity - Service - Innovation

31. Expected Outcomes – Processes
Risk Management procedures are documented, standardized, and integrated into a standard process for DFAS.
Information on risks is managed in a centralized repository.
Assessable unit and organizational wide risks are measured and linked across the enterprise.
Effectiveness of controls across DFAS is periodically tested and reported.
DFAS Enterprise Risk Management Policy
Processes | Policies | Procedures
Integrity - Service - Innovation

32. Expected Outcomes – Technology
Ability to search historical risk information and apply lessons learned to new or existing situations.
Dashboard implemented at enterprise level to capture risks throughout DFAS.
A Business Activity Management tool is in place across DFAS to continuously monitor risks and determine acceptable risk levels
Dashboards and Visual Reporting | Knowledge Management | Risk & Controls Repository
Integrity - Service - Innovation

33. Summary – Enterprise Risk Management
A process, ongoing and flowing throughout DFAS
Effected by people at every level of the organization
Applied in strategy setting
Takes an entity level portfolio of risk
Designed to identify potential events that, if they occur, will affect DFAS and to manage risk within its appetite
Able to provide reasonable assurance to an entity’s management and Executives
Resources are efficiently and effectively deployed in pursuit of DFAS’ objectives
Integrity - Service - Innovation

34. Integrity - Service - Innovation
Platinum Sponsors
&
Integrity - Service - Innovation

35. Integrity - Service - Innovation

36. Integrity - Service - Innovation