Enterprise Risk Management

KAREN HARDY is an expert risk management professional with extensive experience in the public sector. Dr. Hardy is a co-founder of the Association for Federal Enterprise Risk Management and serves on the U.S. Technical Advisory Group for ISO 31000. She also worked at Citibank and The White House Office of Management and Budget. She has published articles in numerous national and international publications, including Canada's Public Sector Digest.

• Figures, Tables, and Exhibits ixForeword xiPreface: Managing Risk in the Current Federal Environment xiiiIntroduction 1State of Risk Management in Government 5How This Book Should Be Used 7Emerging Risks Today 7Top Government Risks 10Criteria 11Profiles of Select High-Risk Areas in Government 13Chapter One Why Enterprise Risk Management? 27Status of ERM in the Government 29Limitations to ERM 30Risk Management: What It is and Why It Matters 32What is Risk? 33Evolution of Risk Management 36Traditional Risk Management versus Enterprise Risk Management 38U.S. Federal Government Policy on Risk Management 41Establishing an Agency Risk Management Policy 46ERM Policy and Practice in Canada 48Linking ERM and Internal Control 54What Are the Standards for Internal Control? 55Assessing Internal Control Structures 68Overall Internal Control Summaries 68Chapter Two Examples of Risk Management in the Federal Government 81Health Risks 82Security Risks 82Financial Risks 85Transportation Safety Risks 86External Risks 87Case Study: Applying Risk Management in Government: National Institutes of Health 89Case Study: National Archives and Records Administration 95Chapter Three Managing and Communicating Risk 105Writing Risk Statements 111Developing a Risk Statement 112Inventory of Risk Statements 113Risk Assessment Techniques 120Chapter Four Risk Management Frameworks and Standards 125Why Voluntary Standards? A Look at OMB Circular A-119 126GAO Risk Management Framework 129ISO 31000: International Risk Management Standard 135COSO ERM Integrated Framework 138OCEG Red Book 2.0: 2009 140FERMA: 2002 140BS 31100: 2008 142An Expanded View of ISO 31000 143Chapter Five Risk and Performance Management 151Risk and Performance: Government 153Managing Risk to Performance 157An Expanded View of Strategic Risk Management 160Risk and Performance: Private Sector 167Standard & Poor’s ERM Analysis 170Chapter Six Building a Risk Culture 173Risk Culture Survey 177Chapter Seven ERM Maturity and Assessment 181ERM Maturity Models 181The Role of the Internal Auditor in ERM 194Case Study: The Public Safety Canada Audit of Integrated Risk Management 196Chapter Eight ERM Core Competencies 209ERM Core Competency Survey 209Summary of Survey Results 211Federal versus State and Local Government Views of ERM 216Chapter Nine ERM Best Practices of Federal Agencies 223Ninety-Day Action Plan 223Sample Implementation Plan 224Words of Wisdom 225Chapter Ten Conclusion 227Notes 231Appendix: Index of Survey Questions and Responses 243About the Author 279Index 281