omb circular no. a-123 management’s responsibility for ... kaneshiro.pdf · management’s...
TRANSCRIPT
1
OMBCircularNo.A-123Management’sResponsibilityforEnterpriseRisk
ManagementandInternalControl
CounciloftheInspectorsGeneralonIntegrityandEf7iciency
FederalAuditExecutiveCouncilAnnualConferenceSeptember26,2017
From1-2-3toE-R-M
2
OpeningRemarks
CXO/Operations Support
RISK
2
3
CurrentRiskEnvironmentFacingFederalGovernment
CXO/Operations Support
• TheFederalgovernmentisfacinggreaterchangethanatanyotherpointin?me• Currentbudgetreali?esmeangovernmentagenciescompeteforlimited
resourcesasneverbefore• Budgetswillgotothosewhobestshowvalue• Thereisgreaterscru?nyandexpecta?onsfrominternalandexternal
stakeholdersforagenciestorespondtoriskfasterandmoreeffec?vely• Thecon?nualfocusofriskmanagementonfinancialareashaslimitedthe
broaderconsidera?onsofriskwithinorganiza?ons
MajorManagementChallengesCouldtheyhavebeenavoided?
Couldtheimpacthavebeenminimizedandmoremanageable?
Whatwillbenext?
4
EnterpriseRiskManagementandInternalControl
CXO/Operations Support
Riskistheeffectofuncertaintyonobjec?ves.Itistypicallyaddressedwithinfunc?onal,programma?c,ororganiza?onalsilos.EnterpriseRiskManagementis:“adisciplinethataddressesthefullspectrumofanorganiza?on’srisks,includingchallengesandopportuni?es,andintegratesthemintoanenterprise-wide,strategicallyalignedporQolioview.ERMcontributestoimproveddecision-makingandsupportstheachievementofanorganiza?on’smission,goals,andobjec?ves.”
InternalControlisaprocesseffectedbyanen?ty’soversightbody,managementandpersonnelthatprovidesreasonableassurancethattheobjec?vesofanen?tywillbeachieved.(GAOGreenBook)Aprocesstohelpachieveobjec?ves(GAOGreenBook)Inotherwords,thingsyoudotomakesuregoodthingshappenandbadthingsdon’t.InternalControlSystemisacon?nuousbuilt-incomponentofopera?ons,effectedbypeople,thatprovidesreasonableassurance,notabsoluteassurance,thatanen?ty’sobjec?veswillbeachieved.(GAOGreenBook)
Outcomes:• Anincreasedlikelihoodofsuccessfullydeliveringonagencygoalsandobjec?ves.• Fewerunan?cipatedoutcomesencountered.• BeVerassessmentofrisksassociatedwithchangesintheenvironment.
5
BackgroundandContext
6
TheDecisionWeMade
CXO/Operations Support
• CompliancewithNewGAOInternalControlStandards
• Trea?ngRiskasonlyNega?ve• HeavyEmphasisonFinancial
Repor?ng• RegardingRiskManagementas
Separate• ChecktheBoxon3YearA-123
Assessments
• RiskBasedApproachwithNewInternalControlStandards
• Trea?ngRiskasPosi?ve(i.e.,opportunity)andNega?ve
• BalancedEmphasisonFinancialRepor?ng
• Integra?ngRiskManagementandInternalControl
• ManageRisksAcrossSilos
ERMandInternalControlsTheCubeVersion
7
A-123Sec?onII.Update(EnterpriseRiskManagement)
Source:BasedonCOSO
LevelsofOrganizationalStructure
ComponentsofInternalControl
ControlActivities
InformationandCommunication
Monitoring
RiskAssessment
ControlEnvironment Function
OperatingU
nit
Division
Entity Monitoring
InternalEnvironment
Subsidiary
BusinessUnit
Division
Entity-Level
ObjectiveSetting
EventIdentification
RiskAssessment
RiskResponse
ControlActivities
InformationandCommunication
Monitoring
Source:GAOGreenBook
A-123Sec?onIII.Update(InternalControls)
ExpandingontheGreenCubeToIncludeERM
8
ControlActivities
InformationandCommunication
Monitoring
Function
OperatingU
nit
Division
EntityRiskAssessment
ControlEnvironmentObjectiveSetting
EventIdentification
RiskResponse
2017RequirementsofA-123,ExpansionofRiskAssessment
2017RequirementstoA-123,Incorpora?ngStrategicObjec?ves
2016UpdatetoA-123,InternalControls
Theorganiza?onofinternalcontrolsasintroducedinthe2014GreenBook
Theinclusionofastrategicprocesstorisk
managementandinternalcontrol
Theintroduc?onandrefinementofERMcomponentstobeintegratedintoexis?nginternalcontrolprocesses
EnterpriseRiskManagementModel
9
Overview:• 7CyclicalComponents
• EstablishtheContext• Iden?fyRisks• AnalyzeandEvaluate• DevelopAlterna?ves• RespondtoRisks• MonitorandReview• Con?nuousRisk
Iden?fica?onandAssessment
• 3EnterpriseComponents• CommunicateandLearn• ExtendedEnterprise• RiskEnvironment/Context
Illustra(veExampleofanEnterpriseRiskManagementModel
CommunicateandLearn
1.EstablishContext
4.DevelopAlternatives
2.IdentifyRisks
3.AnalyzeandEvaluate
5.RespondToRisks
6.MonitorandReview
10
WhatIsRequiredbyA-123toImplementERM?
• RiskProfiles:Establisha“riskprofile”withthefollowingcomponents:• Iden?fica?onofObjec?ves• Iden?fica?onofRisk• InherentRiskAssessment• CurrentRiskResponse• ResidualRiskAssessment• ProposedRiskResponse• ProposedRiskResponseCategory
• Integra?on:Riskprofilestobeintegratedwithmanagementevalua?onofInternalControl(ReasonableAssuranceProcess)
• Governance:AgenciesmustestablishanERMgovernancestructure.• Agencieshavediscre?onandflexibilityinoverallgovernancestructure.• Shouldbeledbyhighrankingpolicyofficial,COOorequivalent.• AgenciesmayestablishaChiefRiskOfficer,butarenotrequiredto.• Shouldincludeaprocessforconsideringriskappe?teandrisktolerance.
Agencies must complete their ini1al risk profiles in coordina1on with the agency Strategic Reviews. Key findings should be made available for discussion with OMB as part of the Agency Strategic Review mee1ngs and/or FedSTAT.
ERMImplementaConPlans
IniCalRiskProfile IntegraConwithManagementEvaluaConofInternalControl
For those risks for which formal internal controls have been iden1fied as part of the Ini1al Risk Profile in FY 2017, assurances on internal control processes must be presented in the Agency FY 2017 Annual Financial Report (AFR) or Performance and Accountability Report (PAR).
June ‘17 Sept ‘17
RevisedOMBCircularA-123ERMImplementa?on
Agencies are encouraged (not required) to develop an approach to implement Enterprise Risk Management.
No less than annually, agencies must prepare a complete risk profile and include required risk components and elements required by this guidance. CFO Act Agencies, at a minimum, must complete their risk profiles in coordina1on with the agency Strategic Review. For these Agencies, key findings should be made available for discussion with OMB by June 3rd as part of the Agency Strategic Review mee1ngs and/or FedSTAT.
UpdatedRiskProfile
Annually, June 3, 20XX As soon as prac1cable, prior to June Ini1al Risk Profile
11
12
Crea?nganEnterprise-LevelRiskProfile
AgencieshavediscreConintermsofcontentandformatfortheirRiskProfiles;however,ingeneralriskprofilesshouldincludethefollowingcomponents:
• Iden?fica?onofObjec?ves• Iden?fica?onofRisk• InherentRiskAssessment• CurrentRiskResponse• ResidualRiskAssessment• ProposedRiskResponse• ProposedRiskResponseCategory
RISK
RiskProfile:AnIllustra?veExample
13
A-11A-123
GreenBookPlaybook
Policy/Guidance
ManagementChallenge
StrategicObjecCveRiskResponse
Chief Risk Officer (CRO)
LowRisk
MediumRisk
HighRisk
ChiefRiskOfficer
CFOOrganizaCon
HROrganizaCon
PIOOrganizaCon
CAOOrganizaCon
14
15
ERMKeyTerminology
RiskAppe?te“Thebroad-basedamountofriskanorganiza?oniswillingtoacceptinpursuitofitsmission/vision.Itisestablishedbytheorganiza?on’smostseniorlevelleadershipandservesastheguideposttosetstrategyandselectobjec?ves.”
RiskTolerance
“Theacceptablelevelofvarianceinperformancerela?vetotheachievementofobjec?ves.Itisgenerallyestablishedattheprogram,objec?veorcomponentlevel.Inseongrisktolerancelevels,managementconsiderstherela?veimportanceoftherelatedobjec?vesandalignsrisktolerancewithriskappe?te.”
HeatMap–Illustra?veExample
16
17
“Providesinsightintoallareasoforganiza?onalexposuretorisk(suchasreputa?onal,programma?cperformance,financial,informa?ontechnology,acquisi?ons,humancapital,etc.),thusincreasinganAgency’schancesofexperiencingfewerunan?cipatedoutcomesandexecu?ngabeVerassessmentofriskassociatedwithchangesintheenvironment.”
• PorQolioViewofRisk
ERMKeyTerminology
18
ERMImplementa?onPlaybook
ERMPlaybookSteeringCommiUeeSetprojectpolicyandestablishedthe?meline
fortheproject.
PlaybookPurpose:ToprovideanERMFrameworkandprac?calguidancetosupportA-123complianceandeffec?veERMimplementa?onacrossagencies.
ERMPlaybookWorkingGroupImplementedtheprojectgoalssetbysteering
commiAeeandkeyedupdecisionsandrecommenda?onsfortheSteeringCommiAee.
Mul?-disciplinaryrepresenta?onfromacrossthefederalgovernment
Overtwentyfederalagenciesrepresented
ü FinancialManagementü Procurementü RiskManagement
ü PerformanceManagementü GrantsManagementü FederalCredit
AccessthePlaybookatthesewebsites
CFOCouncil:www.cfo.gov
AFERM:www.aferm.org
ü InternalControlsü HumanCapitalü IT
OMBCircularA-123andPlaybookOutreachEffortsandMajorMilestones
SeptApr2016 May June July Aug OctSept Oct Nov Dec Jan2017 Feb Mar Apr May June July Aug
4/21-NOVAGASpringTrainingEvent
4/25-AGAForum
5/9-JointFinancialManagementImprovementProgram
6/29-PartnershipA-123RollOut
7/17-20-AGAPDTAnaheim
8/8-AICPAEasternConference
5/10-PartnershipIGRoundTableDiscussion
5/4-AFERMLuncheon
7/14-PotomacForum
5/5-AGAMontgomery/PGCounty
11/1-DOT
7/7–AFERMLuncheon/ERMBlitz
6/17-NAPA
7/15A-123PublicRelease
5/24CAOC
5/23-AmericanAssoc.forBudget&ProgramAnalysis
3/23-BOAC
3/24-PIC
4/24–PerformanceLeads
6/22–SmallAgencyCouncil
7/29-ReleaseERMImplementaConPlaybook1.0 6/3/2017–IniCalRiskProfile
(Allagencies) 9/30–DiscussionofKeyRiskFindingsaspartofA-11StrategicReviewsunderM-17-22guidance
6/2ASMC
9/20-21–AGAInternalControlForum
Dec–CIOCouncil
Jan–FinancialSystemsSummit
9/16–ERMTownHall
3/2–Execu?veCouncil
6/15-COFAR/FACE
7/15–OMBBlogPost
*Knowndatesareprovided.Approximate?meframesareprovidedforeventswhichareintheplanningphase.
MajorMilestones
GovernmentEvent
PublicEvent
A-123Deliverable
CompletedEvent!
!!
!!
!!
!!
!!!
!!
!!
!!
!
8/2-IICW
8/9-WGofFederalComplianceProfessionals
!!
11/7/8–AFERMSummit
!
!
9/15/2017–IntegraConofERMandInternalControl(2017AssuranceStatements)
!
!
!
AgencyRollout
!
8/16-CIGIE
9/23–USAID
8/23-PotomacForum
9/26–DCIEAuditCommiVee
8/24-AFERMSmallAgenciesCOP!
!
9/7-AGAHawaiiChapter8/30–Treasury
9/22–EPA
9/23–TSA
9/27–VA9/28–NSF
10/4–HHS10/5–OPM10/6–NASA10/12–SSA
10/14–ED
!
10/19–State
10/21–DOD
!!
9/26–SBA
!
9/21–DOC
!
10/24–GSA
10/26–HUD!
!
!!
!!!!
10/20–DOI
11/8–NRC
10/25-USDA
10/3–DOE!!!!
10/18–PPS
!!!
!
!!!
!
10/27–NRCIC
!
10/27–DHS!
!
!!
!
12/8-AGAMontgomery/PGCounty
7/8-13–AGAPDTBoston
9/7-AGAHawaiiChapter
4/20–AGANM
4/27–CIGIEGAO
5/8–JFMIP
ReleaseDrabPresident’sManagementAgenda
!
4/28–AGANOVA
AgencyRollout
3/29–Treas4/5–NASA
4/26–HUD4/26–TSA!
!!!!
!!
6/30–IniCalAgencyReformPlans,MaximizingEmployeePerformanceunderM-17-22
!!
4/27–AGAMoCo/PG
7/24–PerformanceIns?tute
9/25-9/26–FederalExecu?veAuditCouncil11/1-11/2–AFERMConference
!!
8/10-SBA!
9/19-9/20-AGAInternalControlandFraudForum
8/17-ED8/18-DOD
8/24-VA8/25-USDA
!!!!
9/6-DOE
9/6-DHS
!!
9/15-GSA!
19
ERM-KeyFactors
Leadership
Process
Culture
20
A-123/ERM Assessments CURRENTMATURITY
LessMature MoreMature
FewerCapabili?e
sHigherCapabili?e
sLessMature,HigherCapabiliCes
Agenciesareatearlystagesof
implementa?on,buthavethecapabili?esnecessarytomature
LessMature,FewerCapabiliCes*Agenciesareatearlystagesof
implementa?onandfacesignificant
hurdlesinmaturing
*Agencies in this quadrant exhibit higher levels of
component autonomy.
MoreMature,Higher
CapabiliCesAgenciesareontrack.Lookforbestprac?ces.
MoreMature,Fewer
CapabiliCesAgencieshavesomematureprocesses,butcapabili?es
hinderfurtherprogress
CAPA
BILITIESNEEDE
DTO
MAT
URE
21
ANewSetOfParametersTowardsaMoreResilientGovernment
22
• “SuccessfulimplementaConofthisCircularrequiresAgenciestoestablishandfosteranopen,transparentculturethatencouragespeopletocommunicateinforma?onaboutpotenCalrisksandotherconcernswiththeirsuperiorswithoutfearofretaliaConorblame.
• “Similarly,agencymanagers,InspectorsGeneral(IG)andotherauditorsshouldestablishanewsetofparametersencouragingthefreeflowofinformaConaboutagencyriskpointsandcorrec?vemeasureadop?on.”
• “Anopenandtransparentcultureresultsintheearlieriden?fica?onofrisk,allowingtheopportunitytodevelopacollabora?veresponse,ul?matelyleadingtoamoreresilientgovernment.”
--OMBCircularNo.A-123
ERMandtheRoleoftheAuditor
23Source:BasedonIIAmodelforinternalauditrolewithERM
Accountabilityforrisk
management
Implemen?ngriskre
sponses
onmanagement’sb
ehalf
Cham
pion
ingestablish
ment
ofERM
Maintaining&develop
ing
theER
Mfram
ework
Givingassuranceontheriskmanagementprocess
Givingassurancethatrisksarecorrectlyevaluated
Coordina?ngERMac?vi?es
Consolida?ngrepor?ngon
risks
CoreinternalauditrolesinregardtoERM
Legi?mateinternalauditroleswithsafeguards
Rolesinternalauditshouldnotundertake
CoreInternalAuditRolesinRegardtoERM
24
Source:BasedonIIAmodelforinternalauditrolewithERM
ReviewingTheManagementOfKeyRisks
Evalua?ngTheRepor?ngOfKeyRisks
GivingAssuranceOntheRiskManagementProcess
GivingAssuranceThatRisksAreCorrectlyEvaluated
Evalua?ngRiskManagementProcesses
Evalua?ngandReviewingEstablishedRiskProcesses
• Evalua?ngtheagency’s
establishedriskmanagementprocesses.
• Evalua?ngtheagency’seffortsatrepor?ngonkeyrisks.
• Providingassurancesontheagency’sriskmanagementprocesses.
RolesInternalAuditShouldNotUndertake
25
Source:BasedonIIAmodelforinternalauditrolewithERM
SeongTheRiskAppe?te
ImposingRiskManagementProcesses
ManagementAssurancesOnRisk
AccountabilityForRiskManagement
Implemen?ngRiskResponsesOnManagement’sBehalf
MakingDecisionsOnRiskResponses
Ac?veManagementandOwnershipOverERM
• Makingdecisionsand
ac?onstypicallyinthepurviewofmanagement.
• Takingresponsibilityforriskdecisionsandresponses
• GivingassurancesforERMandriskresponses.
Legi?mateInternalAuditRolesWithSafeguards
26Source:BasedonIIAmodelforinternalauditrolewithERM
DevelopingRiskManagementForBoardApproval
ChampioningEstablishmentofERM
Maintaining&DevelopingTheERMFramework
Facilita?ngIden?fica?on&Evalua?onOfRisks
CoachingManagementInRespondingToRisks
Coordina?ngERMAc?vi?es
Consolida?ngRepor?ngOnRisks
Assis?ngandImprovingERMDevelopment
• Advoca?ngERMasa
goodmanagementtool.
• Workingwithmanagementtoiden?fy,evaluate,respondtorisks
• Coordina?ngwithmanagementtodevelopandimproveERMframeworks
ERMandtheRoleoftheAuditor
27
WhyDoCarsHaveBrakes?
28
• “Whydoesacarhavebrakes?Acarhasbrakessoitcangofast.Ifyougotintoacarandyouknewtherewerenobrakes,you’dcreeparoundveryslowly.Butifyouhavebrakesyoufeelquitecomfortablegoing65milesanhourdownthestreet.Thesameistrueof[risk]limits.”
--JohnReed,formerCEOofCi?grouptotheFinancialCrisisInquiryCommission
29
Ques?ons?
MoreQuestions?
PleaseContactOfficeofFederalFinancialManagement(OFFM)PerformanceandPersonnelManagement(PPM)DanKaneshiro,[email protected]
MarkBussow,[email protected]