Hello and welcome to RISC chats with a firm today. We'll be speaking with Nicole Hurry, RISC management officer at the pension benefit guarantee corporation about their ERM program. Good morning. Thanks for joining us today.
Great. I'm excited to hear all about what you do over at PBGC, the risk management work you do over there and I thought if you could start off by the listeners know kind of you know what's unique about your agency and your role over there at your agency. Sure. Yeah so I am the risk management officer at the pension benefit guarantee corporation and you know one of the things actually that's unique about my position and get into a little bit what I do as well but one of the things that is unique is I was actually hired because of a congressional mandate so there's very few I think agencies maybe one other that I know of where Congress actually said hey you need to actually hire a risk management officer and so what happened was that was in 2012 and the agency you know after a new director came in they they brought me in and at the time because the new enterprise risk management was coming through when 23 they actually decided to go ahead and implement a 123 enterprise risk management at the same time so they wrote that into the job description.
It was a little bit unique so it was not so much that the agency was really burning and wanting to implement a RM but they knew that there was that congressional mandate out there but the director did embrace the concept so that's the part so you know some of the things that I do I share our risk management council probably one of the things I said the most amount of time on that council is made up of I was in mid-level executives and so I spent a lot of time with them helping them understand what we're trying to do with the RM to really you know get their minds around you know what we need to do to be able to change the culture and that's a great group of people that I work with and then I in general I lead the implementation of the RM you know right now what that means is we just implemented a risk assessment process that really involves all parts of the organization so we really made sure to look at every part of the organization as we're identifying and then starting to mitigate those top risks. There were efforts before I got there that that looked at risk but this is much more holistic now and we have a process to escalate those risks to the top and that the senior executives have embraced that and have been working on trying to mitigate those so that's been great. I collaborate with those senior executives on risk strategies and framework for the agency for the RM for the agency and that's gone pretty well we've gotten a framework into place in the 18 or so months I've been there and I spent a lot of time coordinating risk management activities across the corporation so again of course there were risk management efforts going on before I got there so we try to make them consistent and to have more of a corporate approach make sure people know what the top corporate risks are as opposed to just the risk that they deal with you know day-to-day the more program level risks. I provide technical expertise on enterprise risk management so you know that has been that has been fun and interesting I think something that's been a little bit new to them so having somebody that they can go to for technical expertise I think has provided a lot of value especially on some areas like information technology where they already have a lot of you know risk activities that they do but they don't quite know how to integrate it with the RM so I've been able to work with them on that and another thing I do is assess and report on risk compliance you know we use of course our existing methodologies that we have but I've also tried to bring in some new innovative ideas new strategies for them to look at and then lastly we have both an advisory committee and a board of directors so I do report on this to both of those organizations.
So and how often do you all report up or you know what's the kind of frequency meetings? So our advisory committee meets every other month and I have so far I've met with them twice and they're starting to get more interested in it so I expect that I probably won't talk to them every month but maybe twice a year or three times a year something like that. The board is a little different we we had a new board of course with the change in administration new board of directors our board is the the secretaries of labor commerce and treasury and then there they designate representatives so you know those folks are busy and sort of depending on who's in the position at any given time there's more or less interest in different topics and so I think right now you know we're trying to ease into the idea of giving your reports and so we'll see how that goes but it's a new thing so they're we don't have an established pattern yet but I imagine at least once a year I'll be reporting to the board. Okay, I just have some curiosity questions you have some specific topics today but I was just curious as far as the operations of your program so similar other agencies I would guess you did have a risk profile you developed all that as well.
Yes, yes we have risk profile this we just completed our second one so we're in compliance exactly and that has been an interesting process they actually had started that they had a concept of what their top risks were before I ever came on board. Yeah and so what we've done is make sure that process is comprehensive so that when I'm missing anything and we've tried to then narrow down focus so that we make sure that my role is helping the corporation just look at what those top risks are and also to mitigate I think there's a good recognition that we need to spend more of our time on doing something about the risks and I'm just identifying them which I think is you know yeah it's good and it's perhaps a little unique to that agency. Right, so do you feel come in in your role you've been able to kind of help push some of that action you know not just identify with us do something about this let's actively manage the risks. Exactly, yeah that was one of my biggest focus areas I really I believe that if you're just identifying risk you're not really adding a whole lot of value honestly.
So I think that when you're spending time to you know reduce that risk what to take advantage of an opportunity that you see as a result of a risk that's where you're really starting to add value right and that's where over time executives will see that it's worth their time to invest in this process. Right, so that's always been a big focus of mine and I think we've already started to see some results come out of that we had one risk that we were looking at last year that had to do with one of our biggest programs and its kind of its ability to get data use the data that it had and just to sort of better wrap its arms around you know how to improve that process in the future and went out to OMB and said hey this is a risk and we need you know we'd like some money to address it and they agreed and so certainly identifying it as a risk didn't hurt. Absolutely, a lot of folks I've talked to I mean this is really becoming something very important for strategy and budget for sure I mean this is where we have major risk areas we need to address these and you know funding goes with it of course. Exactly.
Well this kind of delves into our first topic here which is I really want to talk about kind of how you feel about the CRO's role in the organization should be kind of an independent sort of position or how would you characterize it for the work best? Yeah, so this is something that I have felt since I first started learning about Enterprise Risk Management and what its role was in the organization that it's really important that a chief risk officer you know maintain some level of independence from you know really everything everything going on in the organization whether you're reporting to a CFO or you know like a deputy secretary or whatever it might be whatever level you're reporting to you need to maintain independence in that reporting. I think a lot of people hear the word independence and they start to think well that's the IG and we're not it's not the same and I think yeah it's not exactly the same there are differences because of IG's usually either report directly to the head of an organization or even in our case actually our IG reports to our board of directors. So there's a little difference there in terms of how that works out but I think the concept is similar right IG should have independence so that they feel that they can always bring something to light that they believe is an issue and when you think about what a chief risk officer does it should be the same if you as a chief risk officer are constrained by the politics of the organization and you feel that you know you don't have the ability to talk freely about what's going on right you're you're kind of not really doing your job right and so I feel like that's really important and it's harder for us I think sometimes because when you have an internal role and you're working with people closely trying to establish relationships so that people will trust you to talk in order to talk about risk and to do something about these risks it becomes more difficult to it becomes more difficult to sort of maintain that independence right because you you want to you want to make sure people trust you and so at any rate so that's what I think is important to you know maintain that independence but it can be a little bit more difficult when you're in the internal role so what's important what you have to do I think when you're chief risk officer is to make sure you're always kind of coming back to what that vision is and you know what your role is in the organization and always be reminding yourself that yes there's probably gonna be a lot of pushback in certain areas there you know people don't want to change the way they do things they don't want to rock the political vote but if you don't if you don't do those things when they're needed then you could be missing out on opportunities to you know move the organization forward right and I mean things that you know a lot of big risks and agencies are political risks or things are necessarily just a budget or you know something's a perception or you know how to focus your agency I think you know if you can't get folks to talk about that and bring it out then you know you don't really have to do in your job as a risk officer yeah yeah I mean every day you know senior executives are making decisions about shifting resources from here to there you know what's a priority today and what isn't a priority and they don't want to make those decisions public a lot of times right and certainly understandably those are often sensitive you know management decisions that if the public just randomly found out just pieces of information you know could be yeah difficult and so you know I think as two first officers we first have to be sensitive to that that that's not the point isn't just to be completely open transparent and you know to not provide any context for what we do so you so you so there you have to walk a little bit of a line but the point is to be honest with the people internally right I mean when you're if you're reporting to your director or your secretary or deputy secretary whoever might be that you are honest with them about what you see and let them make the final decision as opposed to trying to hide the information or say well this person didn't want me to say that or what have you right so they're not correctly do you also support internal control work actually we so we have a process that separates the two okay yeah not because that was kind of thing and also from the independence aspect you know sort of the internal audit function in a way has to be independent as well right there's only three folks and then beyond that you also have a similar you know you want to keep independent as well so right yeah makes sense because you know you want to be able to do I mean OIG really does try to you know stay kind of separate you know make the recommendations but you know even 23 as well as I think risk officers I mean it's sort of a hybrid role in a way you know you're advising but you're also kind of keeping that third party perspective too so unique challenge yes it is absolutely yeah I am lucky in that our folks who do have responsibility for the internal controls and you know now just controls part of our work are very supportive of enterprise risk management so you know they we have cross-participation our director of internal controls sits on the risk management council I sit on our internal controls committee and so we do spend a lot of time thinking about talking about that interaction although the responsibility for those two is separated so it's a little different but it's some you know it's one approach it seems to work for the agency though so and so what are your lines of reporting you know what could you report to sure so I report to the director of PBGC and so I sit in the office of the director technically and yeah then that's that's an interesting whole subject in and of itself it has some it has pros and cons you know and actually before I came to PBGC I worked at HUD and at HUD I was the deputy director for the enterprise risk management division which was within public and Indian housing which was a component of HUD so I you know it was several levels down from the secretary of HUD obviously and you know so I saw I have kind of percent experience with both approaches right working sort of under the radar and then reporting you know directly to the top person and I think both can work both have again pros and cons and minuses you know I think in the case of PBGC it's a small agency so it's helpful to have the ear of the director and so far you know that seems to be working reasonably well and I was just curious what you know what advice would you give other agencies I mean I know some for example some folks I've talked to they have dual roles as a risk officer but also I mean in some cases a deputy financial officer or you know management area different kind of you know dual roles and I don't know if that's partly due to you know the size of the agency or just they're trying to figure out how this role actually should work you know what would you recommend to folks out there so yeah I think I think for many organizations you make a good point in that perhaps if it's a small organization they need to have somebody you know focused on two different areas and you know if you have the okay the kind of buy-in of your management to move forward with the RM I don't think it matters you know whether you you're you're filling two roles I mean as long as you can do both effectively of course but you know if you have the freedom to move forward with under pressure management and you're getting the support you need that's wonderful you know I think if you're in a position where the agency has decided to sort of group or you know sort of put enterprise risk management under the CFO or you know with internal controls just because they think it's a financial function that's more difficult and that's where I think you know most of the people I know that are in roles like that are really passionate about ERM and they believe that this is you know something that will make the organization better and so they spend the time and the energy and effort to you know convince their senior leadership and you know convince them that this is worthwhile and they should spend time on it and so forth you know imagine there's people out there that don't and that you know they may not be interested in this podcast but but you know I mean I think that you can easily do both I know people also that do strategic planning and performance and enterprise risk management so you know any of those things can be combined because they're all related you know I would I think it'd be interesting to see somebody who does is a budget director and you know does ERM and see how that works out well it's kind of your independent role but also you know understanding of the bigger picture of the whole organization you know you're not just looking at it from a financial viewpoint or a HR viewpoint whatever it may be so I think it's great where you are you kind of you know you're looking across the truly full enterprise and you try to you know yeah absolutely that's definitely key to this position to be able to have that perspective if you don't have the access or the ability you know you have to have that information to be able to do your job effectively okay well speaking of which so this kind of goes to our next area as far as gaining the buy-in from the stakeholders throughout the organization and how do you demonstrate you know the value that the ERM programs bringing to the agency yeah so value is one of those things that man it's it's a huge subject and it is something that I think even in the private sector they still struggle with and it's so much easier in the private sector because really everything comes down to cash flow right and they're there to make money in the government we don't have that so how do you how do you show value everybody has a different definition I thought I spent a lot of time thinking about this because I think it's not only an interesting topic but one that is gonna make or break enterprise risk management in the long run during the federal government so you know I think that you know one of the biggest questions is how do you do it right and I think we all kind of you can think about what is value to my organization and you probably have a pretty good idea you can name a couple of things off the bat that the organization values but how do you actually do it and there's really no magic answer I think that's the reason why probably we haven't as a community spent a lot of time documenting and thinking about this because it's not like there's gonna be one answer that fits every agency it's just not gonna be that way so you know I think what you have to do is to actually take that time to dig down into your own agency and come up with the answers very individualized answers and when you think about these things it also has to be something that has longevity how do you span administrations you know to the extent that you can I mean you may not always be able to we've had you know there's been a major paradigm shift recently it may be hard in some agencies to really to do that but then again there's some things that are really long-term problems you know challenges risks that we face across government that we may be able to you know if we can add value in those areas that would span across administrations like staffing and you know like to you know technology modernization things like that so you know what I've done personally is sort of looking at a model for enterprise risk instrument that gets away from the kind of you know sort of simplistic view of looking at probability and impact which is a great place to start I actually think it's fine to start there there's nothing wrong with it but it doesn't give you the precision I think that you need and it also doesn't always it doesn't help you focus in enough on where the value is so it's just a very generic look right and if you're not if you're not well trained if you're not sort of really you know able to tune into what the true risks are to the mission of the organization then that approach probably you know it's only somewhat effective it's not going to get you 200% as effective as it could be so anyway what I've started to do is to look at a model that will combine actually getting away from a strategic plan and just looking at value what is the organization value and can we come up with some metrics that would measure that value right so you know for instance one of the things that we looked at was or that I would like to look at is the like how much we spend in legal fees and how much we get in return for that right so you know our organization spends a fair amount in only not only internally on lawyers but also we have outside council but we get a lot of value out of that because we are able to recover money that pension plans or individual employers might have put towards something else and not put into the pension plan and we're able to get that money back either I mean in our case it's for the corporation right it's for the benefits that we have to pay out to the for our own obligations but the concept is the same so you know if we have a pretty good ratio there and we can justify the legal fees then that may be an area where that you know that really adds value and that we can demonstrate that value to that metric and there's there's other things to I mean another one that we that could perhaps be used to PGC would be like keeping down the number of audit findings you know to PGC that's really an important thing is to try to keep audit findings under control and we do we already spend a lot of time and effort on that so a metric that showed them on a time and effort that we spend and really put that up as a value driver for PGC I think would would be an interesting place to start right so you take these value drivers this the way this model works you take the value drivers and you have some measurement of them and then you go out and you talk to the subject matter experts just like you would do I think in any risk assessment process you talk to those folks who know it and say what is it that's going to prevent you from being able to meet this or you know what opportunities would you have you know again the risks but then the next part is where it changes from what we do now so then you take that information and you you develop deterministic scenarios that look at not only one of those events occurring but also perhaps multiples of those events so you can net now once you have these this model done with this deterministic scenarios and you can actually quantify what your risk is going to be of either one event or multiple events occurring and it becomes more precise it assigns a better quantitative number right so instead of just saying a one to five we're really somewhat guessing which is okay to start with again but I think as you get more sophisticated with this you want a more precise answer and you want to really focus in on what those those risks are so so that's the overall that model works with a value driven approach and so that's something that I'm really interested in doing I think it works it's an adaptation from what is done in the private sector some organizations do it it's a specific approach but it can work for the public sector if you can identify what those value drivers are and again that and so this is why it's hard to apply it across government in general because you have to do the work you're on your own agency exactly if you didn't have approach I mean even if you chose not to employ this model that you just said let's look at what the you know what our value drivers are right what do we for all the things that we spend money on or put our resources and time into our you know what are we getting value out and are those the right things that what's important to us and this can be difficult conversations to have if you're not used to doing it right yeah I mean a lot of agencies have all programs just for that this is meant to specific values supposed to get for this grant or this loan or this whatever it may be yeah and I think it helps if you are large agency and you're already required to report under a gamma because PBGC is not where it's not agencies so we're exempted from the strategic review process and that it makes it a little more difficult because you have to go a couple steps back and convince people that it's even worth it to set performance measures at all but I think at least if you can say this is what you know you clearly value this particular area because you're putting time and effort into it and as long as the rest of the senior executives in the corporation agree then that may be a good place to go as opposed to trying to point to something esoteric and strategic plan that they may not you know they say yeah we have to have that but it's perhaps not you know really representative of what we think is important right so you said this is something you have started doing to some degree you're gonna get more deeply into it yeah so we're looking into it there's there's still groundwork for us to do in terms of you know convincing leadership that this is a good approach and it's worth spending money on you know I don't have a you know any staff really so it's not something I can implement on my own so you know if we move forward we'll be moving forward with them you know support and help do that yeah absolutely well I have one more question for you today and I really was curious about how you feel the interaction between the CRO and IG you know what was a good relationship there was the especially for you guys you know what's kind of the relationship there yeah well actually I'm really lucky I have an instructor general who is a huge supporter of your room and I think you know most people probably know that in our industry he's been there since before I came so you know I think what is important in having a relationship with your IG is whether you're on the same page about the role that each of you play right so in essence our roles are very similar but our approach and our toolbox is what's different right so if you are working with an instructor general who agrees that their role is to help make the organization better and they should be open to enterprise risk management as a concept right if you're working with an IG who you know is about cranking out audit findings it's gonna be much more difficult but I think what's great is that we we now have IG's out you know in the world who are saying hey this is what your room can bring to the table for an inspector general this is why it's beneficial and this is why you should embrace it and so other IG's then can see that oh okay this is not a threat to me it's it's something that will actually you know support everybody's work and support making government better in general and so that's the I think that's the path to sort of a better relationship between inspectors general and the business right so you know again I'm lucky because I had that going in so I didn't have to overcome all of that I just had it and then we you know we work from the point of yeah we we understand that we're both here to do the same thing but we don't you know I wouldn't say that we get together and collaborate or anything like that it's not a it's not the type of relationship where you know we're working closely together RIG reviews his information independently he determines what he thinks is important what's risky for the corporation he's been very good about looking to get more information where he doesn't have enough so he will go to the focus on the business side and say you know I'd like to learn more about what you do so that I can provide better you know monitoring or audit of those things and make sure that I'm also focusing on the riskiest areas he said you know without without any information I just assume you're risky so that's what I think that an effective approach at PPGC where people have said yeah okay I would rather that you have the right information and that you help me to reduce my risks or to better identify my risks or whatever it might be and so that's it's been pretty successful and so again perhaps that's you know a good model you know for others to follow in terms of how that has affected our relationship it's between myself and my general you know I just think I just think it has continued to make it more positive it really supports what I do because I'm also trying to get our senior executives to better understand what their risks are and to take as open-minded of an approach as possible and to recognize that sharing information and you know it's a bit more transparency is generally helpful to trying to achieve their goals right and so it has worked well and so we've been able to I think take more steps toward that than you know maybe others have so I think we're leading away a little bit and not but overall yeah it's a good relationship and I think it's one that if you get to experience it it's really it's actually really helpful in terms of being a chief risk officer right no I mean I used to work in IG early my career and our agency I know for sure if the ERM would have been around we would have been RIG happy because you know at least it would show that different programs different areas are actually considering what our risk and proactively doing something about it even trying to you know to take some actions on them proactively and that was you know some places that did that you know that made our job a lot easier and you know I think IG's ideally would be hoping that agencies are embracing risk management yes so thanks so yeah yeah so well Nicole thank you very much for joining us today I think we learned a lot and appreciate taking your time so again thanks and good luck in moving forward over the thank you so much appreciate it well that's our show thanks again for tuning in find us on a firm dot org and you can provide us some suggestions for guests that you'd like to hear on podcast so we'd like to hear from you and until the next one this is Paul Marshall signing out for risk chats where they are