1. Donna Davis Defense Finance and Accounting Service June 2010
Enterprise Risk Management for the Federal Government – Where’s the Value?
Donna Davis
Defense Finance and Accounting Service
June 2010
Integrity - Service - Innovation

2. Integrity - Service - Innovation
Agenda
ERM - Where’s the Value?
Putting the COSO Framework to Work in the Federal Sector
Event Identification
Risk Assessment
Risk Response
Control Activities
Information and Communication
Monitoring
Some Pitfalls to be Wary of
A Gallery of Tools and Techniques
9/16/2018
Integrity - Service - Innovation

3. ERM in the Federal Government – Where’s the Value
Three Parts of Business
Objective
Risk
Controls
Objective
Control
Risk
9/16/2018
Integrity - Service - Innovation

4. ERM in the Federal Government – Where’s the Value
Three Parts of Business
Objective – what you are trying to accomplish
For Profit
To maximize shareholder wealth or, in the case of a corporation, to maximize the value of the firm as measured by stock price.
Realize a benefit from resources expended.
Focus on efficiency.
Not For Profit
To achieve a mission or objective while protecting assets.
Achieve goals and objectives for resources expended.
Focus on effectiveness.
9/16/2018
Integrity - Service - Innovation

5. ERM in the Federal Government – Where’s the Value
Three Parts of Business
Objective – what you are trying to accomplish
Risk – the barrier that will stop you from accomplishing the objective
For Profit
Seek Risk as a means for expanding market value.
Measure Value at Risk.
Not For Profit
Avoid Risk seeking safest path to mission achievement.
Measure Impact of Risk on Goals and Objectives.
9/16/2018
Integrity - Service - Innovation

6. ERM in the Federal Government – Where’s the Value
Three Parts of Business
Objective – what you are trying to accomplish
Risk – the barrier that will stop you from accomplishing the objective
Controls – the action that will remove or diminish the risk
For Profit
Affect controls for the purpose of minimizing loss.
Not For Profit
Affect controls to assure compliance, accountability, effectiveness/efficiency, reliability of reported data and safeguarding assets.
9/16/2018
Integrity - Service - Innovation

7. Integrity - Service - Innovation
ERM in the Federal Government – Where’s the Value
What Do We Want From the “Business” of Government?
To be Affordable and Efficient
To be Effective
To provide Quality Service
To be Dependable
The faster pace and need for innovation, combined with significant risk-based events from computer failures to natural disasters, has focused attention on risk management as an essential factor in sound decision-making and accountability.
9/16/2018
Integrity - Service - Innovation

8. Integrity - Service - Innovation
ERM in the Federal Government – Where’s the Value
What Do We Want From the Business of Government?
To be Affordable and Efficient
To be Effective
To provide Quality Service
To be Dependable
So –
We need to be able to achieve the established mission in order to retain the confidence of our funders.
We need to provide value for our services.
Bottom Line –
We need to meet our objectives and protect our assets, including intangible ones such as reputation.
The faster pace and need for innovation, combined with significant risk-based events from computer failures to natural disasters, has focused attention on risk management as an essential factor in sound decision-making and accountability.
9/16/2018
Integrity - Service - Innovation

9. Integrity - Service - Innovation
ERM in the Federal Government – Where’s the Value
What Value does ERM Provide?
Supports Government’s Governance Responsibilities
Improves Results
Strengthens Accountability
Enhances Stewardship
The faster pace and need for innovation, combined with significant risk-based events from computer failures to natural disasters, has focused attention on risk management as an essential factor in sound decision-making and accountability.
9/16/2018
Integrity - Service - Innovation

10. Integrity - Service - Innovation
ERM in the Federal Government – Where’s the Value
How does ERM support Government’s Governance Responsibilities?
By ensuring that significant risk areas associated with polices, plans, programs and operations are identified and assessed.
By ensuring that appropriate measures are in place to address unfavorable impacts and to benefit from opportunities.
The faster pace and need for innovation, combined with significant risk-based events from computer failures to natural disasters, has focused attention on risk management as an essential factor in sound decision-making and accountability.
9/16/2018
Integrity - Service - Innovation

11. Integrity - Service - Innovation
ERM in the Federal Government – Where’s the Value
How does ERM Improve Results ?
Through more informed decision-making and by ensuring that values, competencies, tools, and a supportive environment form the foundation for innovation and responsible risk-taking.
By encouraging learning from experience while respecting parliamentary controls.
The faster pace and need for innovation, combined with significant risk-based events from computer failures to natural disasters, has focused attention on risk management as an essential factor in sound decision-making and accountability.
9/16/2018
Integrity - Service - Innovation

12. Integrity - Service - Innovation
ERM in the Federal Government – Where’s the Value
How does ERM Strengthen Accountability?
By demonstrating that levels of risk associated with policies, plans, programs and operations are explicitly understood.
By facilitating the optimum balance in risk management measures and stakeholder interests.
The faster pace and need for innovation, combined with significant risk-based events from computer failures to natural disasters, has focused attention on risk management as an essential factor in sound decision-making and accountability.
9/16/2018
Integrity - Service - Innovation

13. Integrity - Service - Innovation
ERM in the Federal Government – Where’s the Value
How does ERM Enhance Stewardship?
By strengthening public service capability to safeguard people, government property and interests through increased insight to the potential impact of abnormal events.
The faster pace and need for innovation, combined with significant risk-based events from computer failures to natural disasters, has focused attention on risk management as an essential factor in sound decision-making and accountability.
9/16/2018
Integrity - Service - Innovation

14. Putting the COSO Framework to Work in the Federal Sector
DFAS-ization of COSO
9/16/2018
Integrity - Service - Innovation

15. Putting the COSO Framework to Work in the Federal Sector
DFAS ‘ ERM Philosophy and Methodology
Risk Taxonomy
Risk Polices and Standards
Internal Environment
DFAS Mission
Strategic Objectives
Operational Objectives
Objective Setting
Potential Events affecting Objective Achievement
Positive/Negative Impact
External/Internal Factors
Event Identification
Likelihood and Impact
Category of Impact
Risk Assessment
Response Options: Accept, Avoid, Mitigate, Share, etc.
Response Cost versus Benefit
Risk Response
Policies and Procedures
Control Activities: Approvals, Authorizations, Verifications, Reconciliations, Reviews, etc.
Controls Activities
Timely ERM Communication Flow Up, Down and Across the Agency
Integration of Risk Information Across the Agency (Audit Findings, SITREPS, Self-Identified Deficiencies)
Internal and External
Training
Information & Communication
Assessment of Presence and Functioning of ERM Components
Regular Control Testing and Reviews
Monitoring
DFAS alignment to the Risk Components ensures a robust program and strengthens compliance with the GAO Standards for Internal Control.
9/16/2018
Integrity - Service - Innovation

16. Putting the COSO Framework to Work in the Federal Sector
With Federal Regulations and Laws
With DFAS Regulations and Polices
With Operational Policies and Procedures
Compliance
For Achievement of Strategic Objectives and desired outcomes
For Achievement of Operational Objectives and desired outcomes
For use of public resources
Accountability (Strategic)
Provide reliable, useful and timely information
Accurate and timely recoding of transactions and events
Reliability (Reporting)
Carryout public functions legally, effectively, efficiently, economically, ethically, and equitably
Effective and Efficient (Operations)
Access restrictions to and accountability for resources and records
Segregation of duties
Safeguard Assets
DFAS expanded the Risk Management Objectives to address data security concerns and general auditing standards.
9/16/2018
Integrity - Service - Innovation

17. Putting the COSO Framework to Work in the Federal Sector
DFAS
Agency
Business
Enabling
Governance
Cycle
Payroll Disbursements Personnel Customer Relation Mngt
Other Disbursements Procurement Mgt of Processes & Programs
Revenue & Receipts Provide IT Support Strategic Planning & Execution
Assets & Liabilities Infrastructure
Financial Reporting Finance & Budget
63 Programs - Business Functions (Mil Pay, Accounts Payable, Budget, ERM, etc.)
Program
A group of related actions (Payroll Record Maintenance, Process Payroll, Certify Payroll, etc.)
Functions
A series of tasks or operations conducing to an end ( Input data, edit data, validate entry, save data, etc.)
Processes
Detailed steps for accomplishing a task
Level 3 Maps
Stratification across business units and at every level of the organization was applied to enable accurate reflection of the interrelationships of risks and create a common taxonomy for business activities.
9/16/2018
Integrity - Service - Innovation

18. Putting the COSO Framework to Work in the Federal Sector
We are actually finding this layer adds little value as we evolve the program.
DFAS
Agency
Business
Enabling
Governance
Cycle
Payroll Disbursements Personnel Customer Relation Mngt
Other Disbursements Procurement Mgt of Processes & Programs
Revenue & Receipts Provide IT Support Strategic Planning & Execution
Assets & Liabilities Infrastructure
Financial Reporting Finance & Budget
63 Programs - Business Functions (Mil Pay, Accounts Payable, Budget, ERM, etc.)
Program
A group of related actions (Payroll Record Maintenance, Process Payroll, Certify Payroll, etc.)
Functions
A series of tasks or operations conducing to an end ( Input data, edit data, validate entry, save data, etc.)
Processes
Detailed steps for accomplishing a task
Level 3 Maps
Stratification across business units and at every level of the organization was applied to enable accurate reflection of the interrelationships of risks and create a common taxonomy for business activities.
9/16/2018
Integrity - Service - Innovation

19. Some Pitfalls to be Wary of
Trying to risk manage EVERYthing
Just focusing on financial risks
An obsession with internal controls – an inward looking limitation
9/16/2018
Integrity - Service - Innovation

20. A Gallery of Tools and Techniques
Agency Mission and Functions Manual
Provides the business objectives
COSO Framework
Identifies a comprehensive view of the elements of a robust ERM
A Catchy Logo
CARES – covers the five Risk Management Objectives DFAS assesses
Compliant
Accountable
Reliable & Accurate
Effective & Efficient
Safeguarded
Auditor’s Lenses
9/16/2018
Integrity - Service - Innovation

21. A Gallery of Tools and Techniques
SIPOC Model
Guides process mapping through a complete end to end review of the factors impacting the business activity
9/16/2018
Integrity - Service - Innovation

22. A Gallery of Tools and Techniques
IDEF Model
Denotes the role of compliance/regulations/controls in the business activity
Denotes the role of the supporting mechanisms for the business activity
Integration DEFinition Model
9/16/2018
Integrity - Service - Innovation

23. A Gallery of Tools and Techniques
Risk Identification Questionnaire
Facilitates comprehensive and consistent assessment of potential risks
Courtesy of Brian Williams
9/16/2018
Integrity - Service - Innovation

24. A Gallery of Tools and Techniques
Process Map & Narrative
For business processes
For Information Systems data flow
9/16/2018
Integrity - Service - Innovation

25. Integrity - Service - Innovation
End
Questions?
9/16/2018
Integrity - Service - Innovation