Enterprise Risk Management for the U.S. Federal Government

1 Playbook: Enterprise Risk Management for the Federal Government Developed and issued in collaboration with Federal Government organizations to provide guidance and support for ERM. MEMORANDUM FROM Chief Financial Officers Council (CFOC) Performance Improvement Council (PIC) DATE: July 29, 2016 SUBJECT: Playbook: Enterprise Risk Management for the Federal Government The Chief Financial Officers Council (CFOC) and the Performance Improvement Council (PIC) release the Playbook: Enterprise Risk Management (ERM) for the Federal Government (Playbook).

2 The Playbook guidance and accompanying appendices are tools designed to help Government departments and agencies meet the requirements of the revised Office of Management and Budget Circular A-123. They are also designed to provide high-level key concepts for consideration when establishing a comprehensive and effective ERM program. The Playbook specifically addresses the additional requirements included in Section II in A-123, which defines Management s responsibilities related to ERM, to help departments and agencies make better decisions based on a more holistic view of risks and their interdependencies.

3 The Playbook is the result of an interagency effort convened by the Office of Executive Councils and included risk practitioners and cross function representation from more than twenty Federal agencies to gather, define, and illustrate practices in applying ERM in the Federal context. The final document and subsequent versions will be posted to the CFOC and PIC websites. To help affected agencies implement A-123, the Playbook will be updated with information and examples as programs and agencies ERM capabilities mature. Additionally, forums to discuss issues that arise and share best practices related to ERM across the Federal Government will be convened.

4 As part of these on-going efforts, we will continue to accept any comments, suggestions, and examples for the Playbook at cc: Dave Mader, Controller of the United States of America Mark Reger, Deputy Controller of the United States of America Lisa Danzig, Federal Chief Performance Officer, OMB Dustin Brown, Deputy Associate Director for Performance and Personnel Management , OMB Table of Contents I. Introduction .. 5 A. Using This Playbook .. 5 B. What is Risk Management ? What is ERM? Why Do Government Agencies Need Them? .. 6 C.

5 Integrating ERM into Government Management Practices .. 7 II. Enterprise Risk Management Basics .. 9 A. Outcomes and Attributes of Enterprise Risk Management .. 9 B. Internal Controls and Risk Management .. 9 C. Common Risk Categories .. 12 D. Principles of Enterprise Risk Management .. 13 E. Maturity of ERM Implementation .. 15 III. ERM Model .. 16 A. Step One: Establish Context .. 17 B. Step Two: Identify Risks .. 18 C. Step Three: Analyze and Evaluate .. 19 D. Step Four: Develop Alternatives .. 20 E. Step Five: Respond to Risks.

6 20 F. Step Six: Monitor and Review .. 20 G. Step Seven: Continuous Risk Identification and Assessment .. 21 IV. Developing an ERM Implementation Approach .. 22 V. Risk Governance .. 22 VI. The Risk Appetite Statement .. 23 A. What is Risk Appetite .. 23 B. Relationship Between Risk Appetite and Strategic Objectives .. 24 C. Considerations When Developing Risk Appetite .. 24 VII. Developing a Risk Profile .. 24 A. Steps to Creating a Risk Profile .. 25 B. Additional Considerations .. 34 VIII. GAO/IG Engagement .. 35 IX. Appendices.

7 35 A. Risk Types .. 37 1. Credit Risk .. 39 B. ERM Governance/ Culture/ Framework .. 40 1. Organization Charts .. 40 2. Position Descriptions .. 47 3. Risk Committee Charters .. 61 4. Facilitating an ERM Culture Conversation .. 65 5. ERM Frameworks .. 68 6. Implementation Plans .. 73 7. Maturity Models .. 75 C. Risk Assessment .. 79 1. Establishing Context .. 79 2. Risk assessments and the ERM Process .. 80 D. Risk Profile .. 81 1. Key Questions to Help Develop a Risk Profile .. 81 2. Templates .. 82 3. Risk Assessment Tools .. 87 E.

8 Risk Reporting and Monitoring .. 99 1. Dashboards .. 99 2. Monitoring .. 101 F. Glossary .. 103 G. References and Resources .. 109 H. Agency Acknowledgements .. 110 5 The material in this document should not be construed as auditing guidance. I. Introduction Playbook: Enterprise Risk Management (ERM) for the Federal Government ( Playbook ) is the result of an interagency effort to gather, define, and illustrate practices in applying ERM in the Federal context. This Playbook and accompanying appendices are tools designed to help Government departments and agencies meet the requirements of the revised OMB Circular No.

9 A-123. They are also designed to provide high-level key concepts for consideration when establishing a comprehensive and effective ERM program. Nothing in this Playbook should be considered prescriptive. All examples provided should be modified to fit the circumstances, conditions, and structure of each agency (or other Government organization). The goal of the Playbook is to promote a common understanding of ERM practices in agencies to support effective and efficient mission delivery and decision making processes, such as policy and program development and implementation, program performance reviews, strategic and tactical planning, human capital planning, capital investment planning, and budget formulation.

10 The Playbook is intended as a useful tool for Management . It is not intended to set the standard for audit or other compliance reviews. The material in this document is intended to be: 1. Useful to employees at all levels of an agency; 2. A useful statement of principles for senior staff, whose leadership is vital to a successful risk Management culture and ERM program implementation; 3. Practical support for operational level staff who manage day-to-day risks in the delivery of the organization s objectives; 4. A reference for those who review risk Management practices, such as those serving on Risk Committees; and 5.