Hello, welcome to RISC-Tats with a firm, I'm your host, Paul Marshall. Today we'll be speaking with Meredith Stein from the NIH, Mother Whiz Inventory, RISC Champions, and their RISC Profile. So that's what I'm going to do with your Meredith. Good morning and welcome to the podcast.
Say we have Meredith here from NIH, good morning Meredith. Morning. Okay, well thanks for joining us today. I want to start off with you just to give us a little overview of NIH's risk management program and your role over there.
Sure, thanks for having me. NIH has had a risk management program in place since 2009, and this was all before Enterprise Risk Management began taking stronger holds in federal government. Our program establishes a framework in standard methodology that's used across an age to identify a self-managed risk. But to give you some background first about what NIH is, NIH is the nation's medical research agency and it supports scientific studies that turn discovery into health.
And our mission is to seek and apply knowledge to enhance health, link and life, and reduce illness and disability. We have a fairly healthy budget of $32 million annually. I mean, that's that in more than 80% of our funding is awarded grants. And we also conduct research within the largest clinical research hospital in the world.
We have about 6,000 scientists in our own labs that conduct research on our campus in Bethesda, Maryland. We're a very decentralized organization with about 28 component units and 27 of which are individual institutes and centers that are focused on either a particular body part or a type of disease. And each institute and center has a specific research agenda and a separate budget allocated directly by Congress. And the remaining component unit is the office of the director, which is the central office for setting policy planning and coordinating, you know, oversight program activities for the 27 institutes and centers.
My office is the office of management assessment, and that's part of the office of the director. So we set the policy and guidance for the risk management program that's used across NIH. My office records to the NIH CFO, and I have a small team of dedicated staff to support the risk management program. We spent a large part of our time communicating and educating people about risk management and, of course, more recently, Enterprise Risk Management.
And we're experiencing, I think, a new challenge right now with educating people to understand the difference between enterprise level risks and the more day-to-day operational level risks. Right. So the organization, so I said decentralized basically, 27 institutes. I mean, it sounds like I had the biggest chance for you all to get everybody to message out to everybody and everybody, you know, getting on board of the program.
Yes, yes. Well, does that bring us to my first question about how did you guys, you know, put together our risk inventory without, you know, everything? So spread out like that. What was your approach?
Thank you. So the risk management program methodology is a 6D approach, and it includes an annual risk inventory assessment process. And our program offers a large flexibility for each of the NIH organizations to conduct their annual assessment the way they'd like. But at the end of the day, they have to have a documented risk inventory that meets our program requirements.
And we're right now in the middle of that cycle that risk inventory is due at the end of August. And then after that information is collected, my team aggregates all of it and looks across all of the risk inventory. So see if there are any sort of common themes requiring emerging risks or new types of things that might float to the top. That might be better addressed at the NIH level.
And my team produces reports that aggregate risk from across the inventories by categories, or things like HR, acquisition, IT security, facilities, and we provide those reports to the policy officials that are in charge of that program area. So they could look and see what is coming up from, I guess we can look at this from a bottom up approach about what the institutes and centers are saying at their level that they think are challenging to their mission of their own organization. And the risk inventory is a great source of information for us to help NIH develop our first-ever ERM risk profile. And those recurring annual risk inventory guides will also contribute to any refreshes that we will do for the ERM risk profile.
And again, we see this as a bottom up top down approach to identifying enterprise risks. And the risk inventory is also focused on areas that senior leadership might request more endops and agency-wide-level internal control assessments. And my team will conduct those to give the NIH directors assurances that those internal controls are operating as intended. I mean, again, I'm still going back to you.
So how do you get folks across these different areas that really beyond board? I mean, you have something about champions I've talked to before on the regions. Yes, great question. So I have four FTEs supporting the risk management program.
And with each NIH organization or component, we designed a network of risk management champions and risk management officers to oversee the execution of the risk management program at their organization. And so each of my FTEs has a group of organizations that they function as a liaison for, and they can engage their champions at those institutes and centers. If they have any questions or need some feedback, or something like that, everyone is always welcome to contact any member of my team. So I want to thank all of you for the opportunity to make sure that the champions and officers know that we're customer service focused and here to support them in their execution of risk management NIH.
A few years ago, we initiated a risk management champion working group to give the champions a venue to share ideas and best practices. The ultimate goal was to pass the ownership onto the champions or that group themselves, so we're extremely proud that that sort of played out the way we had hoped. In addition to the quarterly meetings that these champions end up, for the last few years, this champion working group sponsored and managed a risk culture day for the risk community, which is an excellent, you can sort of think of it as a mini-affirm summit. We do a one-day event, NIH features a variety of educational presentations and speakers, and the theme that we've done for the last few years, the topic that we've tried to talk about and enhance skill sets have been facilitation because that's where we see a lot of the skill sets for risk practitioners needing to facilitate conversations about risks.
Right, absolutely. So who makes up the champions or what type of roles or what type of folks are the champions to know? Most of them have been managed in NLS, the 343 series. That's been the book of the CHOP series that we've seen.
And do they have specific, when you give them guidance at the beginning of this is what your role is going to be, what we want you to do, or? Yes, so risk management program has a policy that describes the roles and responsibilities under the risk management program for NIH, and then we have a supporting guidebook that goes into more in-depth what those roles and responsibilities mean. Obviously, it's essential that you've set up these programs. Here's the rules, here's the policies, there's the guidance, here's the procedures, otherwise, you know, what to do or what it's supposed to do.
And I love this champion idea. I think other agencies would really benefit from this. And actually, did you guys just matter how you heard that work somewhere else? At the start of our implementation back in 2008 and 2009, we recognized that there was a need to have that champion role.
That was the program sitting in the office of the director level. We needed those people, those special people, and with those right skill sets that knew their own organization business and culture. And so that was the key to the success of implementation for NIH. Awesome.
Well, more about learning. I'm curious to hear about what kind of learning initiatives and how you spread the word out there on the program. Sure, so that's been back a little bit to the champion working group. It's been a fabulous resource for the champions who are new to their positions.
A while back, we realized that as time advances and people move on to other responsibilities, we naturally be faced with a new cadre of people trying to fill that champion role. And we've, over the last two years, been able to take time to create on-demand e-learning. And that's been, we haven't been able to have that effort take place until two years ago. And we're fortunate to have a resource that is skilled in e-learning.
And we're happily engaging head-on on that activity at the moment. We developed and deployed basic courses that introduced enterprise risk management. More descriptions about the risk management program itself are methodology and especially the terminology and making sure that everybody understood that lexicon. They're all in the same page with that.
And not just to the champions in the community, but to a wide variety of individuals. And right now, we're focusing on developing more advanced courses that break down the individual stages of our six methodology for those who fill the role of the risk management champion. And we're planning to pair these advanced courses with a lab experience so the champions can get more hands-on learning and a variety of practical approaches to help them execute the risk management program within the organization. And our plan right now is to roll that out with our first advanced course on learning lab early next year.
One thing I'd like to mention is that we also have an available on-demand e-training to teach people how to use our home grown software application for capturing the annual risk data. Okay, so, all right, so you've spread that software a little bit how that works? Sure, sure. So, let's be on a program we use Excel templates, and then we move on to an off-the-shelf GRC product.
We eventually came to the decision to develop our own centralized in-house applications to capture the risk inventory data across NIH. This will actually be the second year of the applications in use for the annual risk inventory assessment, and we're always seeking feedback the ways to enhance the user experience. We find it very beneficial to throughout the system development process to actively engage with our champions and users to produce a system that the various needs and flexibility for those folks. I'll give you an example.
So, some of our organizations prefer to have the risk champion input all of the data into the system, while others prefer to have managers assigned to each risk and put their own data. And this is one of the flexibilities our program allows. We wanted to ensure that the application would support flexibility. We also have, we've also spent a lot of time in discussions with the champions on the types of reports that their organization needs and their leadership needs to help make decisions based on risk information.
And two types of reports that I wanted to share. One was we actually had a report that collects and produces a report for the risk inventory, so showing the risk statement, the risk owner, and another terrific report that we've found to be helpful is a trend risk report. So, looking at the scores throughout the course of five years, see if there are any significant changes, even if a risk manager applies risk responses, doesn't necessarily mean that the score might decrease, but that we can look at and see if there are any trends across the five years if the risk exists without long to see what the trend information is. Right.
Yes, it's been, it's been helpful to see, you know, looking at all of the risk inventories and taking enterprise approaches to see if there are any sort of common beings frequently identified risks, things that, you know, from a risk event might have happened that have trickled down to the institutes in a level. Right. So, just one software. So, is it the folks that use their institutes, so they would just see their risks and then kind of move up higher levels.
You can see everything or what's the access? Correct. Correct. So, the access is locked down to their own organization.
And my team has access to all the rest of the data. And we, my team aggregates and analyzes that information, tries to synthesize it. And we put together a presentation to show to the risk community the frequently scored that type of analysis with some graphs. But, you know, how the, I guess, bell curve of all the risk inventories came out as red, yellow, or green.
What's the most of the number of risks that have been identified this year? We also compared to the prior year data. And we tried to keep it anonymous in a sense that we don't share specifics about individual risk inventories, but we look at it, you know, from an aggregate level. Right.
And it's just on the bottom head. But, you know, these are a few years. I mean, do you see the, you know, the risks, you know, being getting better or as far as, you know, getting better responses from folks who are really getting deeper into potential risks or, you know, do you see things kind of getting, you know. Sure.
So, over the years, we have seen improvements in the data quality and we've placed an emphasis on that in our annual risk inventory guidance. I think provided, you know, tools and templates like a checklist of these are the types of information and trying to hone in on the better quality of data. We've also looked at those trends to see if there are any emerging risks that have occurred throughout the year. And whether, you know, as compared to prior years, if anything is significant enough to report the leadership that they would need to know.
Right. That's good. Well, so, I know recently, I just had some of their risk profiles. So, you guys did that?
Your first risk profile, how did that go? Yes. So, as I mentioned, NIH has had a risk management program in place since 2009. But, oh, and these 2016 updates to Circle A13 was the impetus to think about risk from an enterprise perspective.
So, the timing was perfect because NIH had recently developed an NIH-wide strategic plan. And in that plan, the Director emphasized the importance of engaging in proactive risk management practices. We understood that the requirement, you know, in the Circular A13 was for an ERM risk profile directed towards the executive level agencies. And for that, that meant for us the Department of Health and Human Services.
NIH felt we were well situated to undertake that challenge. We had a couple of goals in mind when we began the effort to develop our first profile. I strongly believe that having the dialogue about risk is one of the benefits of ERM. And the strategic plan was fairly new to the organization.
We anticipated the effort of developing our profile would engage a more open and candid conversation about the challenges that threatened the achievement of the goals set out in the NIH-wide strategic plan. It would also offer a chance to discuss the opportunities that could significantly enhance our ability to support the NIH mission. Our profile was designed to be an internal informational management tool, and we leveraged diverse risk assessment data to articulate thinking on NIH level risks. Our goal was to have the data to be used to inform strategic planning, budget formulation, budget execution, performance management, resource allocation, and other high-level decisions.
The process we used would probably sound very familiar to people with experience in developing risk profiles. My team performed an environmental scan of our agency and coupled that with information from existing risk data. We collected an analyze and array of available information existing inventories, assessments, internal and external reports, meeting minutes, news articles, budget requests, congressional testimonies, and the NIH Director's Logs. Then my team analyzed the information using the NIH strategic plan as a framework and proposed a number of risks for leadership to consider as potential NIH ERM risks.
Then leadership selected 10 risks for the initial profile and designated and top the risk owner for each. My team then worked with each risk owner to fine-tune the statements and capture supporting the award for that particular risk. And we helped the risk managers and risk owners document planned action items. We didn't assign sores for priority rankings.
We put the profile together and it was reviewed and approved by senior management. We did encounter a few challenges. ERM was new and we were working with many people who had no idea what ERM meant and what the profile was and why we were creating one. And so we had a lot of educational discussions that had happened before we could even get down to the business of discussing the ERM risk statements.
Another challenge is when commonly faced by any effort that engages with leadership is getting time on their busy schedules. But because ERM's about those couple of arrests, senior leadership engagements and absolute musts. We know that having an initial profile is a starting point. My team and I are continuously looking for ways to mature our program.
We're communicating the results of the profile and without a doubt, it was very satisfying to facilitate and hear those cross time dialogues that occurred during the selection of the ERM risks. The work needs to go out beyond the small circle of folks we've actively engaged with in the development of the profile. And as I mentioned earlier, and I chose a decentralized organization, there are many different groups that would benefit from knowing about the profile. We'll be working on communications and presentations for some time.
But right now we're, like I said, also in the middle of our annual risk inventory assessment. This year we're able to offer the profiles and other source of information for organizations to consider as they determine their own level of ERM risks. But as our program matures, we're thinking about how to best use and integrate it into existing decision processes. I talked a little bit earlier about our efforts to develop on-demand risk management on e-learning at multiple levels.
And we're proud of our progress. We'll be looking on how to incorporate information about the profile into our training. So we came up with the profile and then for all the risks you've all been tracking. How do you monitor progress on these things and make sure people are like, no, just put it down on paper and then forget about it.
You're actually doing something actively. Yeah, and that is also a challenge. There's the accountability factor. It's not just a shell filler that you actually have to use that information to help make decisions.
We're looking for ways on how to get the risk responses updated. See what progress has been made for those action plans that were documented a month ago. And seeing the progress that's been made in discussions with those risk owners. Right.
And you mentioned that obviously this helps with strategy and budget and everything. So, you know, the senior leadership at this point, you know, regularly incorporating ERM risk to their discussions. Or is that how you work in progress or speak? We've seen success stories with the rest of it being used to help make budget decisions.
There are examples where an organization uses their risk inventory information to make budget requests for additional funds and leveraging that risk information to stay in two ways. One, if you don't fund this effort or risk event or risk response, then the risk is either high, medium, or low. If you, the opportunities here, if you do provide you this funding, this is how the money will be set back as a risk response. Right.
I mean, that's what we're starting to do here to use this, you know, data for, you know, make decisions. Okay. Well, actually, I was curious to, you know, what degree does your team get involved in actual risk responses? You know, do you guys advise on that?
Or what was the role in that? So, as typical with most risk management programs, my team as risk practitioners are not responsible to identify the risk or even develop or execute risk responses. Each risk has a designated risk manager accountable for that. That said, my team has experience in risk mitigation techniques and are available for facilitation and consultation as a strategic advisor.
We get the right people in the room to discuss the risk and the risk responses. But at the end of the day, it's the risk managers responsibility. Absolutely. But you definitely definitely have to facilitate those discussions or at least get those in the room.
Yeah, so that's one of the core competencies that I see as a person who works in the risk field is that, you know, as a practitioner, you need to be able to facilitate those conversations, ask the question why multiple times to understand the root cause of a risk. And also what seems to be happening is that sometimes this is the first time that you're getting people from different parts of the organization, so chopping down those silos, getting people in the room that have not typically sat together to discuss different perspectives of a risk. Right. Well, let me ask this.
Here's my next question. I was curious about the interactions between NIH and HHS level, right? Because they also have a risk program or risk guidance. So what was that dynamic like?
So ERM can exist and operate at multiple levels at the same time. And this definitely applies to the relationship between HHS and NIH. The NIH CFO is a member of the governance body at the HHS level called ERM Council. And NIH level information flows up as an input to the HHS ERM profile.
HHS looks at cross cutting risks that affect other operating divisions under HHS. And leadership discusses the risk that are trans-AGGHS like acquisitions, HR, IT security, shared services. At the risk practitioner level, I'm a member of the HHS ERM core team, as well as my counterparts at the HHS operating divisions, our sister agencies, such as CDC, FDA, and CMS. I think HHS has a very healthy and logical maturity model approach to implementing ERM across HHS.
HHS provides tools and templates to guide a flexible approach for ERM. And I very much enjoy working with the HHS practitioners there. When we were developing the NIH ERM profile, we leveraged as a source of information the HHS profile to validate and confirm the NIH level of information. Directly the strategic, NIH strategic plan is linked to the HHS strategic plan and those goals in which NIH plays a part.
And the selection of the NIH ERM risks were framed by the NIH strategic plan. Right. That makes sense. I just find it baffling the organization so huge, how do you bring it down to a small number of highest profile risks?
I don't know if you know the answer to this, but, you know, at any point, NIH and FDA, everybody else sends their risks at a higher level. Do you have any idea how they can get that window down to a high profile list? It's all about the dialogue. They are very thoughtful in coming together mentally to talk.
And also, in between the monthly meetings, they're having discussions and looking at information. Each of the members of the HHS ERM Council looks at the types of risks that are proposed for management and HHS to consider in the ERM profile. And they leverage technology to help narrow the gap of which risks need more dialogue. You might have IT security, certainly in any organization, whether it's public or private, IT security is going to come up as a top level enterprise risk.
So, there might be conversations that need a little less dialogue that this is, you know, undisputable arrest for the agency. And then those that need more dialogue, they're very thoughtful and deliberate about how those risks are discussed and how that information is synthesized. Certainly, there's a lot of effort that goes in into supporting those meetings by the HHS practitioners there. Right.
Okay. Well, I mean, NIH itself is so big to run. I mean, so you have the champions to help you with the different institutes and, I mean, you really have to have this huge community participating to make this work. Yes, it can't just be one individual.
Certainly, without the champions at the NIH, we would not have a program at all. It's definitely, you know, they know their own organization. They're very thoughtful in understanding how their leadership needs the risk of data information and what level each organization and each institute or center director has their own data needs. So, they're his variation.
But they're the ones who know the folks who are, you know, the risk managers of those risks that their organization identifies as enterprise. And they definitely play a very key role. Right. Well, Mary, this is fascinating.
I really appreciate you taking the time to speak with us today. And thanks again. I look forward to hearing more about your program in the future. My pleasure.
Thanks for hosting. Thanks for joining us. Thanks for joining us. Check us out on paper.org.
We'll see all the pod tests. Give us some feedback. Let us know what you'd like to hear. Make guests are talking to you guys, too.
Until next time, this is Paul Marshall signing out. I wish you'd have to be gone.