Chapter One
Why Enterprise Risk Management?
The U.S. government has a long history of adapting and adopting successful and prudent business practices from the private sector. In the arena of financial management, this is perhaps best illustrated by the adoption of the Chief Financial Officers Act of 1990, with its requirement that federal agencies pass financial audits.1 The adoption of enterprise risk management (ERM) is no exception. Although risk management has long been a priority for many organizations, the private sector financial collapse of 2008–2009 has put a spotlight on enterprise risk management as a critical component of an organization’s overall health and long-term sustainability.2
There is no one set definition of ERM that all organizations abide by. Several organizations, however, have taken the liberty of defining ERM based on their organizational or industry perspectives. Although the definitions vary, they do have some common themes. Each agency should determine which definition fits their organization, in whole or in part.
According to the Committee of Sponsoring Organizations (COSO), ERM is defined as “a process, effected by the entity’s board of directors, management and other personnel, applied in a strategy setting and across the enterprise, designed to identify potential events that may affect the entity, and manage risk to be within its risk appetite, to provide reasonable assurance regarding the achievement of objectives.”3
Embedded in this definition are seven fundamental concepts, which assert that ERM is:
- A process, ongoing and flowing through an entity
- Effected by people at every level of an organization
- Applied in a strategy setting
- Applied across the enterprise, at every level and unit, and includes taking an entity-level portfolio view of risk
- Designed to identify potential events that, if they occur, will affect the entity, and to manage risk within its risk appetite
- Able to provide reasonable assurance to an entity’s management and board of directors
- Geared to achievement of objectives in one or more separate but overlapping categories4
The Institute of Internal Auditors (IIA) defines ERM as “a structured, consistent and continuous process across the whole organization for identifying, assessing, deciding on responses to and reporting on opportunities and threats that affect the achievement of its objectives.”5
The Risk & Insurance Management Society (RIMS) defines ERM as “a strategic business discipline that supports the achievement of an organization’s objectives by addressing the full spectrum of its risks and managing the combined impact of those risks as an interrelated risk portfolio.”6
When put into context, the general idea is well put by Pickett: “ERM is a process that works well at all levels in an organization and brings together the business, back office, and top strategic layers in an integrated manner. By definition, a process is immersed in the business and does not sit outside of the real work. ERM is not about setting up a new team to do ERM. It is about getting a process that feeds into the main business lines to add value and make a meaningful contribution to the bottom line.”7
Furthermore, ERM is an initiative that is championed by the highest level of management and driven down from there into the organization. ERM promulgates that “if risk is built into the equation when setting strategy for the entire business, then risk management can become a holistic process that starts at the top and filters its way down through the enterprise.”8
In response to the public’s demand for change, government managers as well as those in the private sector are looking for ways to weave risk management strategies and tactics into their everyday operations and strategic decisions at the highest level. Federal agencies are now beginning to recognize the need to weigh the probabilities of what could go wrong before it happens, the upside of doing a cost-benefit analysis for mitigating or accepting a risk, and the advantages of discussing, evaluating, and feeding risk into an agency’s strategic plan and budget regardless of the mission. ERM is fast becoming an important activity for many agencies to undertake as a solution for bringing together various agency risk activities.
Although traditional risk management has its merits, it is often still carried out in silos and stovepipes within organizations, leaving the “white spaces” between organizational functions open for interpreting the crosscutting impact of risk. ERM challenges the status quo and requires managers and leaders to step out of their organizational comfort zones and into a collaborative environment to not only discuss common risks but uncover latent risks as well. As part of ERM, the white spaces also indicate that there is room to discuss risks that do not necessarily fit into one particular functional area, but it requires perspective from every function to properly address an enterprise-wide issue that could impact the organization’s mission and strategic objectives.
STATUS OF ERM IN THE GOVERNMENT
ERM is in its infancy in the U.S. government. Other governments, such as that of Canada, have long established a national policy for ERM; in the case of Canada, nearly a decade ago. Canada’s Integrated Risk Management Framework aims to protect the public interest and maintain public trust. The Canadian framework is part of its larger objective to modernize management practices in order to make the government more citizen-focused and able to meet the changing needs and priorities of its community.9
Despite this level of ongoing risk management activity throughout the government, there has been increasing pressure on the government to do a better job at managing risks. Robert Charette, a risk management expert and founder of the ITABHI Corporation, which specializes in organizational risk management issues, writes: “Recent events, like [Hurricane Sandy] and the subprime mortgage financial meltdown, have Americans looking to their government to ensure that these catastrophes are reduced in the future. Furthermore, the public not only demands that government manages the consequences of risk, but that it deals with problems before they turn into catastrophes. Merely reacting to risk is eroding the people’s trust in government.”10
To address this issue, agencies are looking to enhance their management practices and have shown an increased interest in enterprise risk management. For example, in 2009, for the first time in its seventy-five-year history, the Federal Housing Administration (FHA) hired its first chief risk officer. The initial focus of the chief risk officer was to be the oversight and the coordination of FHA’s efforts to concentrate risk management in a single division devoted solely to managing and mitigating risk to the FHA’s insurance fund—across all FHA programs.
In addition to adding a chief risk officer, the FHA proposed specific credit policy changes that are largely focused on ensuring responsible lending and risk management for FHA-approved lenders. These changes build on lessons learned in the credit crisis and seek to align the FHA with the administration’s goal of regulatory reform. As the FHA’s stable of lenders grows, these lenders must have “skin in the game.” These credit changes will do that by ensuring they have long-term interest in the p...
