Enterprise Risk Management: A Guide for Government Professionals

322 Pages·2014·1.98 MB·English

by  Karen Hardy

Enterprise Risk
Management
ffirs.indd 1 19-09-2014 13:14:07
Join Us at
Joosseybass.com
Register at www.josseybass.com/email
for more information on our publications,
authors, and to receive special offers.
ffirs.indd 2 19-09-2014 13:14:07
Enterprise Risk
Management
A GU IDE FOR GOVERNMENT
PR OFESSIONALS
Dr. Karen Hardy
Foreword by
Allen Runnels
ffirs.indd 3 19-09-2014 13:14:08
Cover Design: Wiley
Cover Images: Isometric buildings © iStock.com/Jamie Farrant, Business People Walking © iStock.com/
Robert Churchill, Tightrope Walker © iStock.com/AdrianHillman, Business Executives © iStock.com/4x6,
Informal Presentation © iStock.com/A-Digit, Businesswoman Balancing © iStock.com/juhat, Businessman
Sitting © iStock.com/trigga, Business Silhouette © iStock.com/OST, Balance © iStock.com/blackred
Copyright © 2015 by John Wiley & Sons, Inc. All rights reserved.
Published by Jossey-Bass
A Wiley Brand
One Montgomery Street, Suite 1200, San Francisco, CA 94104-4594—www.josseybass.com
No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or
by any means, electronic, mechanical, photocopying, recording, scanning, or otherwise, except as permit-
ted under Section 107 or 108 of the 1976 United States Copyright Act, without either the prior written
permission of the publisher, or authorization through payment of the appropriate per-copy fee to the
Copyright Clearance Center, Inc., 222 Rosewood Drive, Danvers, MA 01923, 978-750-8400, fax 978-646-
8600, or on the Web at www.copyright.com. Requests to the publisher for permission should be addressed
to the Permissions Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, 201-748-
6011, fax [phone], or online at www.wiley.com/go/permissions.
Limit of Liability/Disclaimer of Warranty: While the publisher and author have used their best efforts in
preparing this book, they make no representations or warranties with respect to the accuracy or com-
pleteness of the contents of this book and specifically disclaim any implied warranties of merchantability
or fitness for a particular purpose. No warranty may be created or extended by sales representatives or
written sales materials. The advice and strategies contained herein may not be suitable for your situation.
You should consult with a professional where appropriate. Neither the publisher nor author shall be liable
for any loss of profit or any other commercial damages, including but not limited to special, incidental,
consequential, or other damages. Readers should be aware that Internet Web sites offered as citations and/
or sources for further information may have changed or disappeared between the time this was written
and when it is read.
The views herein are the author’s and do not necessarily represent those of the United States Government.
Jossey-Bass books and products are available through most bookstores. To contact Jossey-Bass directly
call our Customer Care Department within the U.S. at 800-956-7739, outside the U.S. at 317-572-3986,
or fax [phone].
Wiley publishes in a variety of print and electronic formats and by print-on-demand. Some material
included with standard print versions of this book may not be included in e-books or in print-on-demand.
If this book refers to media such as a CD or DVD that is not included in the version you purchased, you
may download this material at http://booksupport.wiley.com. For more information about Wiley prod-
ucts, visit www.wiley.com.
Library of Congress Cataloging-in-Publication Data
Library of Congress Cataloging-in-Publication Data has been applied for and is on file with
the Library of Congress.
ISBN 978-1-118-91102-0 (cloth); ISBN 978-1-118-91103-7 (ebk.); ISBN 978-1-118-91112-9 (ebk.)
Printed in the United States of America
first edition
HB Printing 10 9 8 7 6 5 4 3 2 1
ffirs.indd 4 19-09-2014 13:14:08
C O N T E N T S
Figures, Tables, and Exhibits ix
Foreword xi
Preface: Managing Risk in the Current Federal Environment xiii
Introduction 1
State of Risk Management in Government 5
How This Book Should Be Used 7
Emerging Risks Today 7
Top Government Risks 10
Criteria 11
Profiles of Select High-Risk Areas in Government 13
CHAPTER ONE Why Enterprise Risk Management? 27
Status of ERM in the Government 29
Limitations to ERM 30
Risk Management: What It Is and Why It Matters 32
What Is Risk? 33
Evolution of Risk Management 36
Traditional Risk Management versus Enterprise Risk Management 38
U.S. Federal Government Policy on Risk Management 41
Establishing an Agency Risk Management Policy 46
ERM Policy and Practice in Canada 48
Linking ERM and Internal Control 54
v
What Are the Standards for Internal Control? 55
Assessing Internal Control Structures 68
Overall Internal Control Summaries 68
CHAPTER TWO Examples of Risk Management in
the Federal Government 81
Health Risks 82
Security Risks 82
Financial Risks 85
Transportation Safety Risks 86
External Risks 87
Case Study: Applying Risk Management in Government:
National Institutes of Health 89
Case Study: National Archives and Records Administration 95
CHAPTER THREE Managing and Communicating Risk 105
Writing Risk Statements 111
Developing a Risk Statement 112
Inventory of Risk Statements 113
Risk Assessment Techniques 120
CHAPTER FOUR Risk Management
Frameworks and Standards 125
Why Voluntary Standards? A Look at OMB Circular A-119 126
GAO Risk Management Framework 129
ISO 31000: International Risk Management Standard 135
COSO ERM Integrated Framework 138
OCEG Red Book 2.0: 2009 140
FERMA: 2002 140
BS 31100: 2008 142
An Expanded View of ISO 31000 143
vi Contents
CHAPTER FIVE Risk and Performance Management 151
Risk and Performance: Government 153
Managing Risk to Performance 157
An Expanded View of Strategic Risk Management 160
Risk and Performance: Private Sector 167
Standard & Poor’s ERM Analysis 170
CHAPTER SIX Building a Risk Culture 173
Risk Culture Survey 177
CHAPTER SEVEN ERM Maturity and Assessment 181
ERM Maturity Models 181
The Role of the Internal Auditor in ERM 194
Case Study: The Public Safety Canada Audit
of Integrated Risk Management 196
CHAPTER EIGHT ERM Core Competencies 209
ERM Core Competency Survey 209
Summary of Survey Results 211
Federal versus State and Local Government Views of ERM 216
CHAPTER NINE ERM Best Practices of Federal Agencies 223
Ninety-Day Action Plan 223
Sample Implementation Plan 224
Words of Wisdom 225
CHAPTER TEN Conclusion 227
Notes 231
Appendix: Index of Survey Questions and Responses 243
About the Author 279
Index 281
Contents vii