5

insights for
executives

Implementing enterprise risk

management in government
Of special interest to
Deputy secretaries
Chief risk officers
Chief financial officers
OMB leadership

A government agency learns that those who are owed disability payments are not receiving
them in a timely manner. Another learns of wide variation in its processing of applications,
suggesting the demonstrated preference for certain applicants. Still another agency finds
its employees spending what appears to be an unusually large amount on external training
and conferences.
These are very different situations, but what they have in common is that the leaders
were surprised to learn of these events. In retrospect, these failures now seem clear and

| 5: insights for executives

preventable. But no one thought these situations were possible, no one planned to deal with
them, and no could imagine the negative consequences they could produce. In short, each
agency didnt identify these as risks.
For many reasons, including the embarrassment caused by these situations, agencies
are now focusing on enterprise risk management (ERM). Interest in ERM is growing fast
among federal agencies, as seen in how more of them have established chief risk officer
(CRO) positions.

Whats the issue?

ERM is the management of risks across the organization to enable an
agency to achieve their strategic objectives. Agencies need to inventory
all risks that might have substantial impacts on their performance and
achievement of objectives. Agencies need the ability to identify and
address key risk areas and the agility to respond quickly.

A number of agencies have enhanced their risk management capability to

better manage their ERM efforts. Federal agencies are now implementing
enterprise solutions to manage risks that impact strategic and tactical
objectives and the use of resources.

Why now?
There has been an increase in recent years in previously uncertain events
that have jeopardized the achievement of agency goals, including the
HealthCare.gov websites failure to anticipate high levels of traffic, the
Department of Veterans Affairs failure to anticipate rapid increases in
workload, and the federal governments failure to accurately forecast.
Agencies clearly need more risk management so that they can recognize
and address future opportunities and threats to performance goals as they
arise, not after the fact. ERM provides a framework to track these uncertain
events and serves as an additional support to traditional performance
management tools. Overall, ERM provides a new set of tools for agencies
to more effectively manage performance.

In addition, uncertain budgets, expanded mandates and calls for increased

transparency now require agencies to:
Update their awareness of risks associated with their processes
Determine whether the agencys risk management function is structured
Yf\Yda_f]\^gjl`]jakchjgd]g^l`]^mlmj]
Elevate the need to integrate risk and performance management
It is now getting more difficult to make the right decisions at the right time,
and the consequences of getting it wrong are intensifying. The leaders
of today need to be able to handle uncertainties and improvement at the
same time. All levels of management now need to identify risk exposure,
what-if scenarios, uncertainty analysis, best-case/worst-case forecast and
contingency plans.

5: insights for executives |

How does it affect you?

When an agency is setting goals, risk identification and management must
be integrated into plans to achieve those goals. A successful manager
in government must not only master previously developed performance
management tools but also formally and rigorously address an increased
number of uncertainties.

A narrow approach to performance and risk management can pose

challenges for an agency. It reduces the organizations ability to monitor
and mitigate critical risks on a timely basis, and it prevents key decision
makers from having access to and leveraging risk information. It is possible
for an agency to be fully compliant with laws and regulations but suffer
from clearly inadequate risk management, resulting in unexpected
events that prevent the agency from achieving its mission, strategic goals
and objectives.

Agency priority goals,

which are a subset of
all goals.

Line managers need

to consider risk as they
work on the following
tactical opportunities:

Cross-agency priority goals that

agencies need to report on every
quarter. Here, agencies conduct
an assessment of the risk of not
meeting the goals.

| 5: insights for executives

Review of strategic
objectives in which
project risks and
uncertainties are
determined, along with
how to address them
for the desired level
of performance.

Whats the fix?

Agencies need to change the role and objective of their risk functions and
structures. Strong and attentive agency managers are needed to integrate
risk and performance management. At the same time, risk specialists
need to become trusted advisors for line managers. This often requires a
change of management principles and a new governance setup. In addition,
management processes at the strategic, tactical and operational levels need
to receive sufficient risk support in setting goals, planning, and performing
and evaluating efforts.

trend and indicator analysis. These analyses should be closely monitored

and reviewed to assess relevance and impact. Standard review processes
provide agility going forward and enable managers to continuously revise
plans, scenarios and focus areas and escalate deviations if necessary.

To become fully risk-enabled, an organization needs to clearly define

and articulate the risk boundaries and appetite, and integrate this into all
strategic considerations such as major investment decisions and portfolio
risk-exposure levels. Moreover, the ambition and tolerance levels for both
risk and results need to be communicated and implemented by senior
leadership, establishing a tone at the top and guiding decisions on all levels
in the organization.

Embed risk management aflgl`]gj_YfarYlagf$af[dm\af_a\]fla[Ylagf$

assessment and analysis of risk across the entire organization

On a tactical and operational level, agencies need to turn strategic plans

and initiatives into objectives, performance prognosis, plans and projects,
backed up by fact-based analysis of the most important risk and value
drivers. Based on this, agencies can gain more control of uncertainties
and opportunities going forward, ultimately improving performance and
reducing unwanted risks. To align ongoing activities and strategic plans,
operational performance feedback should always be incorporated with risk

To implement ERM, agencies need to take the following steps:

Enhance risk strategy within the agency so that risk management can
drive accountability across the organization

Optimize risk management functions, including:

 Aligning mandate and scope
 Coordinating infrastructure and people
 Using consistent methods and practices
 Implementing common information and technology
Improve controls and processes
Enable risk management so that the organization manages key risks with
processes and controls, embedding consistent risk activities

5: insights for executives |

Whats the bottom line?

A robust integration of risk in performance management enables risk
identification and assessment to be part of the rhythm of the agency.
This is accomplished through providing new insights and information that
support decision-making on all levels. A well-implemented ERM initiative
transforms the traditional silo risk functions to a systematic approach to
handling uncertainty.

| 5: insights for executives

Want to
learn more?
The answers in
this issue are
supplied by:

Werner Lippuner
Principal
Government and Public Sector
Ernst & Young LLP
+1 202 327 8389
werner.lippuner@ey.com

Linda M. Springer
Executive Director
Government and Public Sector
Ernst & Young LLP
+1 703 747 0388
linda.springer@ey.com

Danila Weatherly
Executive Director
Government and Public Sector
Ernst & Young LLP
+1 202 327 7367
danila.weatherly@ey.com

Daniella Datskovska
Senior Manager
Government and Public Sector
Ernst & Young LLP
+1 703 747 0172
daniella.datskovska@ey.com

For related thought leadership, visit ey.com/5.

5: insights for executives |

EY | Assurance | Tax | Transactions | Advisory

About EY
EY is a global leader in assurance, tax, transaction and advisory services. The insights and quality
services we deliver help build trust and confidence in the capital markets and in economies the world
over. We develop outstanding leaders who team to deliver on our promises to all of our stakeholders.
In so doing, we play a critical role in building a better working world for our people, for our clients and
for our communities.
EY refers to the global organization, and may refer to one or more, of the member firms of Ernst & Young
Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company
limited by guarantee, does not provide services to clients. For more information about our organization,
please visit ey.com.
Ernst & Young LLP is a client-serving member firm of Ernst & Young Global Limited operating in the US.
About EYs Advisory Services
Improving business performance while managing risk is an increasingly complex business challenge.
Whether your focus is on broad business transformation or more specifically on achieving growth,
optimizing or protecting your business having the right advisors on your side can make all the
difference. Our 30,000 advisory professionals form one of the broadest global advisory networks of
any professional organization, delivering seasoned multidisciplinary teams that work with our clients
to deliver a powerful and exceptional client service. We use proven, integrated methodologies to help
you solve your most challenging business problems, deliver a strong performance in complex market
conditions and build sustainable stakeholder confidence for the longer term. We understand that you
need services that are adapted to your industry issues, so we bring our broad sector experience and
deep subject matter knowledge to bear in a proactive and objective way. Above all, we are committed
to measuring the gains and identifying where your strategy and change initiatives are delivering the
value your business needs.
2014 Ernst & Young LLP.
All Rights Reserved.
EYG/SCORE No. BT0441
ED None
This material has been prepared for general informational purposes only and is not intended to be relied upon as accounting, tax, or other
professional advice. Please refer to your advisors for specific advice.

ey.com/5

We want to hear from you!

Please let us know if there
are subjects you would like
5: insights for executives
to cover.
You can contact us at:
fiveseries.team@ey.com