Hello and welcome to the podcast. All right, I say the podcast because we're actually doing a cool podcast, some of those fun AGA affirm collabs. So today we're actually doing a wrist chat and an accountability talk two for one. So and of course that means I had to bring along my co-host, Mr.
Dan over there. How you doing Dan? When good Paul, excited that you are so excited for this podcast. That's how you got to be man.
Got to be excited. And two wonderful guests. We have Mr. Bert and Miss Bobby Joe.
I'll let them introduce themselves about Bert. Okay, thank you so much Paul. Bert nearing a partner with Crow. And I had the opportunity to be the chair of the annual ERM workshop this year, the seventh annual.
Nice and you've been on several podcasts with me. I have, yes. Welcome back. Great to be back.
All right. Bobby Joe. Hi everyone. Bobby Joe Pankaj.
I work for Guy House and one of the ERM leaders and I was lucky enough to lead the workshop of report writing and lead the committee for this. So this is my first time being on the podcast. So thanks for having me. All right, well welcome, welcome.
Okay, so what we're going to do today is we're going to kind of go over the AGA affirm workshop that took place back in April, 2023. And if you guys can kind of walk us through it, you know, some of the keynote session points, three sessions I believe that there were. So yeah, this is just kind of to talk about it. And it's also going to be a report that's probably released about the same time as this podcast.
So this will touch on that as well, right? So yeah, so why don't we start off with Bert? Do you mind just kind of walking us through how did this thing kick off? Absolutely.
So the session was held on April 18th and it was a full day session. And we had 12 sponsors that sponsored the program and those were from corporate ranks, if you will. And we had over 100 participants at the workshop itself. The format was in a keynote presentation and then we had three sessions and then each of those three sessions was followed by a table discussion.
So we got a lot of feedback, a lot of collaboration as you mentioned between a firm and AGA to put on the workshop, but also the results of those workshop sessions were then put into a report that Bobby Jo also helped co-author. So as we look at the keynote session, we had Mike Wecklow, the deputy CFO from the National Science Foundation with us, presented an interesting discussion related to emerging risks. And some of those emerging risks as it relates to artificial intelligence and really kind of looking at how artificial intelligence has changed, looking at generative AI and how organizations are beginning to use that. And he went through some of the tools that are available to us, to organizations with regards to AI and how they provide a lot of promise to organizations to help increase productivity, to help understand and analyze information, but there are hidden risks.
And what Mike was talked about in his session was that organizations should not be afraid of the risks. In fact, they need to look at an opportunity to utilize AI as a way to maybe embrace that technology but understand the risks related to the decisions they make around technology. And he emphasized the importance of ERM in the future to address that ever-increasing risk that may involve around technology and the use of technology within our organizations themselves. And I think that I was struck by an important point that he made is that whenever new technologies are introduced, the focus is on the benefits of that technology, not always looking at the potential risks that are associated with implementing that technology.
So sometimes we fail to weigh those particular risks. So one of the things that he mentioned that I think is so important with regards to AI in particular is so much of the data and the importance of that data both organizationally as well as personally. And as you can imagine utilizing AI, you have to understand the enterprise wide security of the tools themselves. And so it's important really to understand that organizations must evaluate those risks of the new technology and understand those as quickly as they can understand those risks, but also not be afraid to adopt that technology as it relates to how they evaluate the risks that are taken and just be mindful of them.
Dan, does that sound familiar? That topic? Yeah, it sounds very familiar. And as Bert was talking, it came with my mind terminator, which it always does.
Yeah, we just had a podcast recently with Accenture, strangely enough, talking about generative AI and then the risks and the rewards, hopefully, right? So yeah, especially when you look at it from a governmental standpoint of how so much of this data is out there available to the public, so there's access to that data or AI to utilize. But at the same time, you don't want to be taking your organizational data, utilizing it in an AI manner, which then makes it public. So there's a lot of those types of risk.
When you look at it from an ERM program, it's really establishing how do you get your employees trained on the new technology so that they understand those risks and understand what not to do as they're evaluating. I don't know if the government structure exactly. Yeah, because we've been playing with these tools. These generative AI, I mean, chat, GPT, things like that.
They're pretty amazing. And you're just like, we have to use this. The government needs this. But how do you do it without everybody running scared for the hills?
Because it seems like there's a lot of AI fright out there in my mind. Even some of the AI working groups and things you see out there, all I ever see is risk, risk, risk, worry, worry, worry. We seem to be very at a gut level scared of AI as humans for some reason. Well, I'm scared of it because Elon Musk is what he's worried about it.
So he's worried about it. I'm worried about it. Yeah, but I don't know. I'm saying certain aspects, I mean, it's a very broad subject to, I mean, we're talking about business applications or mission applications, not necessarily like the robots are coming.
But that's, yeah, I'm glad to hear that we're talking about this very apropos, very timely discussion topic there to kick things off. Absolutely. So, yeah, so from there, you had three sessions. So what's the next one there?
Yeah, so the next session was ERM in practice balancing risks with decisions in mind. And this session was led by Wilmer Graham, who is this chief risk officer for the US housing and urban development, as well as Ronald Beck, who is the chief risk officer for the defense logistics agency or DLA. So our speakers from HUD and DLA provided an overview of their program structure, explained how they established ERM tools, how they utilize those tools in a risk-based manner to make key decisions. So DLA in particular provides a lot of logistical support to military organizations, as well as other federal agencies, delivering over $37 billion in goods and services annually.
So they have a lot of activity around making sure that their goods and services get delivered where they need to be delivered. So in 2020, they established an ERM program, and to mature that program, DLA has been focused on executing data, using that data then to drive decisions, to drive their risk assessment processes, also building in a comprehensive approach to the governance, as well as establishing a GRC system. And that has helped them then better manage that enterprise risk management program at the agency. And DLA, as you might imagine, based on what they do around logistics, faces a lot of challenges and complications.
And so, you know, the importance of that was then they had to scale to their operations. They had to scale the activities to their operations. So that is why they decided to implement some tools, GRC tools to do that. They established policies and procedures and taxonomies, as well as implemented frameworks around their ERM program.
They also created and developed workshops and job aids, and as a part of them, that then they developed a GRC pilot that has helped them enable more tracking of the issues, more monitoring, as well as help them initiate a robust risk assessment system. And so now what they're doing is slowly they're rolling that out organization wide. And that framework and task management tracker that they've developed has become instrumental in them being able to assimilate the ERM program throughout the agency. And part of that has also been, as well as the training, is really kind of coming up with a common language for them to use, to understand and communicate with everybody.
It's tough to do. It's tough to do. Because you've got the accounting folks, and you've got the mission folks. Yeah.
And it's the idea of their own language, too. Yeah, I'll talk about that. So I think what they are looking to continue to evolve that program, to go beyond just looking at it from a standpoint of controls. And internal controls are really helpful to establish for folks to understand on the accounting and finance side.
But then broaden that and really look at the risk mitigation and risk controls from the other groups within the organization outside of accounting and finance. And so as they mature their program, they're consolidating models, including their fraud risk model, which has been deployed throughout the organization. And coming up with those standardized, documented, repeatable, and measured focus of their ERM program. So all of those are very important for them to continue to do.
Yeah. So I guess I'm surprised that they just did something up in 2020. Right? Yeah.
It is pretty new. Although when you think about it, there were probably a lot of activities they were doing, risk-oriented prior to that. Sure. But now with having a CRO in place, it really helps them formalize the process.
And that's so important with regards to an ERM. Right. We're trying to do some DoD, ERM-centric podcasts. Yeah, with the PPV reform, PPV reform.
Yeah. Yeah. And this is kind of where DoD is compared to the rest of federal right now. Yeah.
Absolutely. And so you had HUD on there too. And we had HUD as well. So HUD's mission is to create strong, sustainable, inclusive communities and quality of affordable homes for all.
So HUD has a enterprise and fraud risk management framework with the general objectives of establishing governments, governance, policy procedures, processes, looking at an enterprise view of their risks and then facilitating the development of risk appetites and risk tolerance statements, and also helping them to identify and study root causes with regards to some of their risks as well as findings. They've also established programs to host training for folks to better understand their risk profile. And so what they've done is they've used this to influence strategies and priorities around planning as well as audit readiness and budget requests. So that, to me, kind of looks like they're really, you know, at a mature stage with their program to help identify those integrators.
Yeah. That's definitely good. Yeah. So one of the success stories that they've told that the session was really around what they call their front end risk assessment.
And this is a program that they use to evaluate new programs. Or when they have changes to existing programs. And what they're doing in this particular case is they're using guidance from the GAO Green Book, the GAO's fraud risk framework as well as OMB Circulars A123 and A11 to, and it's really geared to providing a structure to assess and report on identified risk and mitigation plans as it relates to new programs that they're implementing. Which is so important these days to better understand.
And so, you know, they have as an operating principle to be timely, responsive, data-driven, and provide accurate information. And so as we kind of look at balancing decisions and risk in mind when we consider DLA and HUD, I think that we understand that understanding all the risk is important in federal government as it relates to decisions because the decisions can have significant impacts on operations and the effectiveness of an agency, as well as providing transparency and consultation, collaboration, and leverage the tools that are in place can help bring that process to bear or the organization as a whole. And also, it's key to have leadership support around these initiatives and also really helping the organization foster risk-based mentality not only takes the tools that each of these organizations were investing in, but it also takes the other resources to make sure that you have everyone aligned, that you have the ability to make decisions using it, and you can demonstrate that you utilize the ERM program to make those decisions. So, I think, you know, as I would kind of look at this whole session, session one of the day, it's really highlighted the importance of balancing those decisions with the risks, and that is what I think effectively HUD and DLA have done with their programs.
Yeah, and I was just going to say it's interesting because HUD is definitely more mature. They've been doing this for a while. They're a pretty robust program. I think our first podcast, guess, was from HUD.
He was a chief risk officer, but out in the field, they had multiple risk officers out there, then they got the centralized one. They're like, gee, he has a chief risk officer, right? I mean, there's a lot of fun. Session three, I'll tell you about that, surely.
Yeah, but that's kind of interesting. Like the newer program, the more mature, robust program, it sounds like it was some good insights. So, yeah. Hey, let's kick it over to you, Bobby Joe.
Talk about session two and session three, please. Sure, thanks. So session two was the rise of supply chain risk management in the importance of integration with ERM. So, session two and three, we did have the chief risk officer perspective, but also, like I mentioned in session three, we also had the OIG perspective.
So, session two, we had two executives from the Federal Retirement Thrift Investment Board, so including Tom Brant, who is the chief risk officer. Oh, yeah, yeah. So, he's no stranger to the podcast. Yeah.
And Patrick Bevel from the chief, he's the chief information security officer. So, two great perspectives on supply chain risk management. They really focused on insights about their unique risk environment at FRTIB and why they chose to incorporate supply chain risk management or SCRM into their ERM program. And so, of course, one of the stories that was brought up was SolarWinds and kind of just the impetus of the cyber attack where the adversary weaponized the third party to get into the system and extract private information and how that is really being prevalent.
These bad actors and I'm using quotes are getting into a lot of federal systems and how we can use ERM to help protect federal data and just the federal citizens. So, federal government has stepped in. They talked about NIST, so National Institute of Standards Technology, NIST IR 8286, and then the new cyber supply chain risk management. So, CSCRM.
So, that's a mouthful of an acronym and the executive orders around supply chain risk management and how, at least at FRTIB, how they've been incorporating ERM into this kind of all hands-on deck against these threats. So, Brandt, so Tom did recommend engaging all agency stakeholders, which is always a big theme on any of these workshops or the summit. Any ERM conversations is to have all stakeholders involved in risk conversations. So, I thought this one was really unique where we did bring in the kind of cyber and information system perspective into the ERM conversations and not merely just the chief information security officer to complete the full risk conversation.
And then they did say the ERM program team, you know, we really should push all of these ERM teams across the federal government to start these conversations with the IT groups. If they have CISOs, if they, you know, have CIOs who are willing to have these, you know, conversations about supply chain risk management. Yeah, my perspective is a lot of these CISOs and these IT folks, if you will, they're doing ERM. They might just not realize what they're doing as ERM.
For sure. And the NIST, you know, a big part of NIST and this CSCRM, there are a lot of risk management requirements that mirror a lot of what we do in ERM. And so, it's really combining, you know, their kind of rigor around risk management, but bringing it into like the ERM framework. Yeah, it's interesting, you know, I think supply chain, I think, like, DLA, right, or something like that.
And like, the risk retirement doesn't like jump at the top of my head when I'm thinking about risk and supply chains. Well, Molly Joe first mentioned, I was like, she's talking about the number of federal employees that are going to retire at some point. I was sick of that. Right.
Yeah, it was interesting. So, I guess it's in terms of, I mean, whatever the IT infrastructure, where all that comes from, what the vulnerabilities are, I mean, is that where we're getting at or, I mean, yeah. Exactly. And I think, you know, I don't know if we mentioned this, but the out of the hundred participants, this was a closed session for federal employees, and then it was just the sponsors who were kind of the facilitators.
So, this is very important to, you know, our fellow colleagues who are government retirees to be and retirees about, you know, their retirement. Yes, they are. And so, they take their money and their investments. So, Tom did say, you know, ERM was pivotal in implementation of SCRM, at least at the Drift Investment Board, and where it currently serves to connect SCRM to the sub-programs and so, and vendor risk management.
So, they do a lot of this vendor risk management, risk assessments, and looking into the risks for vendor risk management into the whole cyber supply chain risk management as well. And so, they have a great partnership between the IT office, the CISO and ERM, and I know a lot of ERM programs are trying to get there, but may not have, you know, that great of a relationship yet. Right. Oh, so that was two and number three there.
Yes, I also want to mention one other thing too. There were table discussions after each session, so I thought that was really lively, and this one brought a lot of lively conversations about their very eager, the table participants into talking about how they could bring in ERM into their kind of supply chain risk management. And a lot of times it's really high on the risk register at many of the agencies that were represented at the workshop. So, I just wanted to kind of plug that, that there was some really great discussions that will be kind of summarized in the report.
So, be on the lookout for the report very soon and you can get more information on that. Awesome. Yes, you'll walk us through it in the last session, right? Yes, last session.
So, as Bert mentioned, we had the HUD Chief Risk Officer for Session 1. For Session 3, we had Tamika Edwards, who is another Chief Risk Officer for HUD, but the Chief Risk Officer for the Office of the Inspector General. As many of you know, there's only a few Chief Risk Officers in the OIGs, Tamika being one of them. She focused a lot on balancing results, resources, and risks.
So, a little bit of the kind of risk management, the softer side of ERM. So, it was a great session. She mentioned three key players in a successful ERM program in the federal government, GAO, so Government Accountability Office, OMB, Office Management Budget, and Offices of Inspector General. So, put a big plug in for OIG.
And since she had the OIG perspective, her whole session was kind of the perspective of OIG in implementing ERM. She focused on value-based management, enterprise integration, benefits of change, and delivering value from ERM. A big thing of OIG, I've listened to a couple of those sessions, is VUCA, Volatility, Uncertainty, Complexity, and Ambiguity, and how they use that in kind of the enterprise risk management. So, she said federal agencies today often are environments of constant unpredictable change, both internally and externally characterized by VUCA.
So, volatility, uncertainty, and complexity in ambiguity. And I would say that's kind of the world we live in, maybe not just the federal government. And so, she was just talking about the very big importance of value-based management in combating that VUCA. She also focused on enterprise integration.
Managing value requires breaking down the silos, and so I mentioned that in session two as well. So, breaking down the silos and bringing all of the players at the same time to the table. I thought this was really great, meaning to optimize value management should examine what the agency actually does. So, your non-value-added functions, what it's required to do, so compliance, and what your stakeholders want.
So, unsatisfied expectations. So, kind of a different three-legged stool than we normally talk about. She focused on benefits of change. One key benefit of ERM, she said, is helping agencies identify and prioritize risks.
And then the last thing, and I thought, was the kind of the most important was using ERM to deliver value. This is where she highlighted enterprise risk management in what she is on the Council of the Inspector General on Integrity and Efficiency ERM Working Group. And that's kind of where you get the OIG really involved in enterprise risk management. I mentioned earlier, there's a couple of chief risk officers in the OIG.
And so, she's part of this working group by no department of labor. I think that Jessica Southwell and others are part of this working group. So, she focused on kind of how that working group is focusing on applying ERM best practices and how it's already contributed to maximizing some organizational value in many ways. And that's a teaser to read the report.
I won't mention all the great things there. But a couple, just I guess takeaways from Tamika's session is, for things understanding that risk and value impact every decision, ERM and value can be properly managed with significant transparency and communication. Managing change through the agency is the recipe for success. And then finally, risk and value management are the responsibility of everyone.
So, I thought she had a very uplifting and kind of a great kind of positive tone to end the workshop. Yeah, if you want more, go to our podcast, she was a guest and she was great here too. So, yeah, she was pretty awesome. Well, that sounds really interesting.
Yeah, I mean, you guys have done this for many years now. Do you remember how many years has this been going on? This was our seven. Seven, wow.
Okay, yeah, this is a look for number eight next spring. But, you know, can't stop. Got to keep moving. Well, I want to wrap things up here.
Maybe, you know, Bert, just give us some of your final thoughts on the session or anything going forward. And then I'll give Bobby Joachans. Well, thank you, Paul. Yes, thank you for the opportunity to be here.
I think, you know, what has been important with this session over the seven years that we've done it is really getting folks together to talk about enterprise risk management. And I think we provided that forum to do so. As Bobby Jo mentioned, we've had, we had table discussions after each of the three sessions. And that really facilitated an interaction between consultants as well as governmental folks to really kind of talk about some best practices, talk about issues in a setting that really, you know, is not for attribution really, it's really to help everyone kind of learn from others.
And I think that's one of the important parts that, you know, is highlighted within the report itself when you read it is the importance of really learning from others. And that's how you improve an ERM program. So it's been a delight seeing the, you know, the workshops continue for this many years. And it really provides, I think, a value to both the ERM communities as well as the AGA communities.
Absolutely. Bobby Joachans, what final thoughts you got for us? Definitely. And if folks still had business cards, they were passing them around.
But a lot of contact information was that's right, a little stand. And I think that was probably the most impactful, was just kind of hearing other people's struggles and successes in this kind of environment, round tables, very collaborative, and giving them the time after each session to talk about it, what's working at their agencies, what's not, and kind of swapping contact information. So we'll definitely continue having this. I think this is the marquee AGA firm kind of co-op ERM activity.
And then I'd like to put a plug in for our marquee event that's a firm. And that's our summit, which is coming up November 28th and 29th. The registration is open. Early bird registration goes until October 27th.
But please don't wait. Register now. So we can plan to have you there. Our theme this year is collaborate and celebrate, weaving ERM into the fabric of government.
So please come, collaborate, and celebrate with a firm in November. And if you have any questions, Melissa Rennard and myself are the co-chairs of the summit this year. We have great committee planning it. We have great breakout sessions that have been nominated.
So we're going through those. We have great plenary sessions that have already been kind of secured, getting everybody signed up for those. So please come, and we'd love to see everybody. I heard the food's going to be great this year too.
Good food. Great new menus. It's going to be at the convention center. So trying to new venue this year, so the DC convention center.
And it'd be a great two days for us to do what we did at the workshop. Collaborate and swap success stories and maybe tools and tips and tricks. All right. Well, I really appreciate you both being here.
And that's going to be a wrap for today. So this was accountability talks and wrist chats as well. So signing off to host Paul Marshall. Have a great one.