Hello, and welcome to Risk Chats with Affirm. I'm your host, Paul Marshall. And today we have an exciting guest from the Department of the Interior, Mr. Jake Lee.
How are you doing today, Jake? I'm doing great. How are you? I'm doing good.
Thanks for, you know, getting through all the snow and craziness on the mountain to come down and visit us. It was a little wild this morning. It's one of those random February snows, and now it's pretty much gone. But hey, we had some risk mitigation plans, but it came true, right?
We did. So why don't we just start off, Jake? You might just tell us about yourself and your role over at DOI? Sure.
So I'm the Chief Risk Officer for the Department of the Interior, and I've been with the Office of Secretary, that's where my office sits, under the Office of the Secretary, since 2020. Prior to that, I was with three different bureaus within the Department of the Interior, to include Fish and Wildlife Service, the Bureau of Land Management, and the Bureau of Safety and Environmental Enforcement, where I did develop an ERM program at the Bureau of Safety and Environmental Enforcement. It was a brand-new bureau created in 2011, and it was created as a result of the BP oil spill. Oh, wow.
Okay. Gotcha. And we were the oversight. It is the oversight for offshore energy development.
Okay. So that was a brand-new program from the bottom-up? A brand-new program from the bottom-up. I started with nothing and built it.
My prior, my boss that I had at the Bureau of Land Management actually went over there to stand up the office that was going to have the programmatic risk assessment function in it, and he called me and he said, hey, I need a risk guy. Here's my guy. So I applied for the position, and I got it, and I was there for not quite nine years, almost nine years. So what got you into risk management?
What was your, you know, what did you start your career? What kind of led you in that direction? So I actually began my career in government with the United States Air Force, and I was a meteorologist. That was in 1978.
So I'm going into my 49th year of federal service, which is hard to believe. But I was a meteorologist for almost 28 years, and actually it turns out that aviation meteorology is really risk analysis and risk mitigation, because you take a look at an individual flight or an operation, you identify risks that are associated with weather, and then you come up with mitigation strategies. For instance, if it's an individual flight and there's forecast hazards along the route, you come up with a different route of variation. If it's an area of turbulence, you go lower or go higher or something like that.
All right, that'll be interesting as we go down my questions here, because your background is not, you know, you're not a CFO shop guy, you're kind of from a different perspective. I'm an operations guy. All right. Well, why don't we talk a little bit about, you know, so now you're chief of officer for the agency versus the bureau, one of the bureaus.
You know, can you tell us a little bit about, you know, how did you build, well, actually I want to hear more about the program you built at that bureau, and then kind of lead to the department. Sure, and that's the exact right path to go down. So at the bureau itself, when I designed the program, and I worked with a contractor to help me, because I was the only person in the bureau doing it, and so what we did was we took a look at the operations, and the programs, and the things that make the bureau able to achieve its objectives. In this case, they have a very simple motto, develop energy safe and clean.
So safe and clean, what does it take to do that? As a regulatory body, they actually write regulations for offshore energy development, primarily oil and gas, but now it's moving into the wind area as well, and identifying what the regulation should be to regulate the safety of the operations, and also to mitigate any likelihood of oil spills. As I said, the agency was created after BP oil spill, after Deepwater Horizon, and for just that purpose. So I looked at how did they operate, again, I'm an operations guy, I ran weather stations around the world, and I think about operations, and I think about how do you actually achieve the goals that you have set before you.
So we looked at how that whole flow goes, and it begins with regulation, and then it moves to permitting, which is permitting things that are regulated, and then you inspect to ensure that what is going on are the permitted activities based on regulation, and then when you find variations, then you have enforcement capabilities, and then at the very end of the entire process, you have decommissioning, which requires a whole bunch of things. So that was kind of the layout in the order of operations that the bureau engages in. So we identified then all the risks to achieving those goals and being effective with those goals. So, for instance, in the regulatory space, you have to first have the technology and the understanding of the technology in the oil and gas business in this instance, and as they move into deep water in the Gulf of Mexico, where the vast majority of operations are, there's real technological challenges.
So they have petroleum engineers and structural engineers and electrical engineers in BESI that look at what the risks are and how to mitigate the risks, and then you incorporate that into regulation. So then you take a look at the regulation process. There is a process to writing regulations. And so that process has its own risks.
So first we identified the risks associated with getting the technology and understanding the technology correctly. Then we identified the risks to actually creating regulation. Then we looked at risks to having effective inspections. So in order to have an effective inspection process, you need to have guidelines for the inspector to fly out to the facilities.
So just step by step by step by step. Right. And as you said, focus on that very specific purpose and mission goals of that organization to be ready. Exactly.
So with that program, I mean, did that originate from somebody within operations? Or was it anything related to the oil spill? So was that really the main driver? Yeah, that was the main driver.
So this is before the OMB initiatives and all that, kind of A123, but they put it into that. Well, A123 certainly leads into it. So when I started Fish and Wildlife Service in 2005, I read A123. I'd never done that type of risk management before.
I hadn't thought about it in that way. I just thought about the weather and how the weather affected operations. But as I read A123, I read it as a guide to ensuring that you have the proper risk treatment in place for operations. Now, I know a lot of people read A123 to see it as more of a financial oversight, but it's not.
It's an operations document. And then you have the appendices that do address specifically financial things, right? Financial reporting, credit cards. Exactly.
That's exactly right. So the main body of the text in my reading has always been about operations and risks to operations and properly treating those risks. And I think you were telling me before, because you're based on the ISO standard, right? ISO 31,000.
So when I started at Bessie, I actually brought in an ISO 31,000 specialist, a trainer. We paid for the training, and we invited people in other organizations within the Department of the Interior and outside of the department to come and attend the training. We were paying for the training, and it wasn't a per head thing. It was a flat fee.
So I'm like, hey, the more the merrier. And so we actually had three days of training on ISO 31,000. Now, I had attended ISO training previously for 9,001, which is process, and 14,030, I believe it is, which is environmental process. So I've been ISO certified in other areas earlier.
So I understand the ISO principles, which are pretty broad and widely applicable. So as I got to know those standards and could incorporate those into how I was designing my program, I also became involved in the team at OMB that was rewriting A123, the 2016 version, which we are now working on, or working from. So I was actually with a group of other folks from across the government, and we would meet on a monthly basis, and the meetings were led by Dr. Karen Hardy, which I think a number of people know Karen Hardy, and I was with that group, and we would go piece by piece by piece to update A123, and I wanted to incorporate and make sure we incorporated 31,000 standards.
And so I was part of that team, very proud of the output of that, because really it was a game changer in 2016 when the new A123 came out, and it was far more focused on operations. Right, yeah, I definitely noticed that. Exactly. So, yeah, exactly, and also incorporating it into A11, which is the budgeting process for the federal government.
So Section 260 of A11 incorporates ERM principles into the budgeting process, along with performance data and evidence information and program management. So all those things were incorporated into A11. Right. And A123, over the years, you know, when we sit at the Office of Secretary, we were asked for input from OMB about updating A11, and I've made a number of suggestions, not just me, across the government, people, to incorporate A123 enterprise management principles more so into creating the data that we need to budget correctly.
So when you work at the Bureau, was that the first ERM program at Interior? That was the first full-fledged ERM program. At about the same time, I was doing mine, Jason Bruno, who I know you know. Oh, yeah, sure.
Jason, and we were kind of partners in things, and they were standing up their ERM program, so we would bounce ideas off of them. Right. So because of the attitude towards A123 about it being driven by the CFO shop, which I always thought was misplaced, that was the shop that gathered, in Interior, that was the place that gathered programmatic risks and programmatic risk assessments and then reviews of risk treatments. And, of course, the primary risk treatment we have are internal controls, right?
Mitigations. Internal controls. So I used to, from the Bureau, I would go and I would do presentations at the monthly meetings, getting people to think more about enterprise risks. Right.
And then we would have meetings of my peers where we would just, the programmatic people, where we would talk about how we could go more towards an enterprise risk management solution or how we were doing our programmatic risk assessment. So I started actually doing that and spreading the word with the Bureaus from the time I was at Bessie and then moving forward. So at this point, you have many of the other Bureaus had their own programs, too? Is it really those two?
Some of the Bureaus, we are in various stages across DOI. And so when, in 2019, let me back up. In 2016, when the new A123 came out, there was someone tasked at the headquarters to write guidance and to help the Assistant Secretary for Policy Management and Budget understand what this enterprise risk and management's responsibility for enterprise risk and internal control and how to incorporate that from a departmental level. Right.
So I was actually called on from the Bureau to come up and help this person write it, who was actually a biologist from the Bureau of Indian Affairs, who was in the Senior Executive Development Program. And so this was one of his projects. So I helped. I basically said, well, this is how we do risk assessment now within the department.
And then this is what enterprise risk management means in comparison to doing just program risk assessment. Right. Right. So breaking down silos, looking at things more holistically, looking at achieving the objectives.
Very few objectives are met within a single program. Right. Right. So it's multiple programs, and that's why enterprise risk makes sense.
So you can take a look at who contributes to achieving those objectives and who has risks in being able to meet those objectives and achieve the goals of the organization. So I helped create the original briefing that was to the then Assistant Secretary in October of 2016, and at that time, the assignment for developing an ERM program was given to the Office of Planning and Performance. And so I went back to the Bureau and continued to do my work, more fully develop my program because it was still in its infancy, and then completed that. So in 2019, a new head of the Office of Planning and Performance was hired, and he had come from the Department of Transportation, and they had an enterprise risk management program.
When he arrived at the headquarters, he saw that there was no real enterprise risk management program at the departmental level. Right. So he started inquiring within the headquarters, people who he was encountering, to, you know, who has ERM within DOI? And apparently my name came up.
First mover, so yeah. Vocal advocate, I'm assuming, too. Yeah. Like I said, I was doing presentations regularly three or four times a year showing people how to create, for instance, a more holistic risk register that would focus in on risks instead of focusing in on programs.
Right. Well, so yeah, let's move into, so now you're, you know, at the department level. A couple questions about that. You know, how is that different from just the Bureau?
I mean, is even, you know, ERM, it feels like when you get to the department level, what are those risks really versus the ones that are more the granular Bureau level? It seems like, are they too high level almost, and it's just, you get the rule work done at the Bureau? I don't know. Sometimes people want to bring the risks to such a high level that they almost become meaningless.
Right. Exactly. Right. And so I have a real problem with that, and I have pushed back on that many, many times in the past.
So I'm now in the Office of Planning and Performance. All the things our office does are aligned with OMB A11, Section 260. We have the Evidence Act as part of our profile. We have performance.
We are the Office of Planning and Performance. We do the strategic plan for the department every four years. And we have the lead for PAMIA, the Program Management Improvement and Accountability Act. I think I got that right.
And also ERM. Right. And those four functions are exactly what are outlined as evidence, information, to use in the budgeting process in Section 260. So I am correctly, I'm sitting in the right office, that's for sure.
So what we did, so I came in in 2020, and I wrote a framework document kind of laying out how DOI would approach standing up in ERM program and what the ERM program would encompass. And it had roles and responsibilities, communications, all those things that you would put in the framework. Right. So I got that signed in late 2020 and 2021.
Early 2021, I actually worked with a curriculum developer and created a two-day seminar on ERM for all of the bureaus and all of my former peers when I was at the Bureau. So that really was the beginning of creating an ERM mindset across DOI. Some people were familiar already with my advocacy for it at the time, but this became even more ingrained into the culture within the program. So we had the training and then for fiscal year 2022, we created our first risk register from the department.
And what we used as a scoping mechanism, because the first thing you have to do is to scope how deep you want to go. Right. Our primary scoping mechanism was the new strategic plan that we just released. There you go.
So we had four, we have four strategic goals with seven. strategic objectives and then we have different bureaus engaged in achieving those objectives. So we've then engaged with the bureaus and the bureau programmatic risk leads to identify where the risks were for them to achieve those objectives. So that was the starting spot for our risk register.
Okay. So going back to that training program, how did you come up with that? Did you have anything to base it on? Where did it come from?
What's in it? Curious anymore about it. Sure. So as I said, I worked with a curriculum developer.
I actually have a master's in education, so I got to use that for the first time. In any way, although obviously we use all the things we learn eventually. So we sat down and I said, okay, how did I create a program and what do we need to start with? And so we started with framework and setting the scope and then the identification of risks.
What is a risk versus getting to the root cause of the risks and then addressing the root causes, risk treatments. Different ways to do that, techniques. So do you use a failure mode or how do you do your analysis? So we went into actually identification of risk, the analysis of risk, the identification of the root causes, and then the risk treatments that are in place and assessing risk treatments for their effectiveness.
How do you do that? What's a measurement? What do you measure against? So we covered all those topics.
We talked about communication. We talked about creating risk committees, how to actually incorporate this information because any time you do any type of risk mitigation or risk treatment, typically it requires time, money, and effort. And so you need to be aware of that. So if you identify risks but they're being treated properly, okay, we've already invested that in our risk tolerance.
We're below our risk tolerance. We talked about risk tolerance. We talked about risk appetite. We did, absolutely.
And the difference between the two, and they are quite different. Tolerance is much easier to teach than appetite. And appetite is a much more complex thing because typically you'll have different levels of appetite depending on the nature of what you are doing. For instance, when I was at Bessie, we did risk appetite for our science piece, for our technology, for our piece that goes into the regulatory space.
We had a risk appetite that was, we could stand time. There wasn't an urgency to it. But when we took a look at our risk appetite for safety and environmental protection, well, we had a very low appetite. Yeah, exactly, right?
So the urgency, the impact, those things all go into it. So we stated different levels of risk appetite based upon the type of activity because it's all based on activity, right? Because without an objective, I explain this all the time, I need to know what your objective is so I can start identifying what goes into achieving that objective and then we can start identifying the risks. So and how long is that training?
I said two? It was two full days. Two full days. And I'm sure people were sick and tired of seeing my slides.
I think there were 243 slides or something like that. Right. But it was also interactive. And we did this, of course, we did it online because we were in the middle of the pandemic.
Oh, right, right. It's 2021. And we were all at maximum telework, but it actually worked out well. We're actually now, at the end of this month, we are doing a refresher that are two half days online.
And we have 80 people signed up for the February training and then we're going to do it again in April for those who couldn't get into the training. So we're trying to bring in numerous people that make inputs to the risk register, right? Right. And so understand what we're trying to capture here.
What's the purpose? You know, first thing is setting the criteria and coming up with scope and setting that up and then moving forward and then the process is involved because that's what we need to do is focus in on the process. A lot of it's just process stuff. So we are refreshing our training of creating new inputs because now we're three years into it and we learned how things, so I had a vision of how I thought it would go and then the reality is it went differently in some areas than I thought it would go.
So it makes sense to update your framework, which we are in the process of doing. Right. And we are bringing in people from the bureaus to help us redo our framework so it matches what their needs are and then matching that with the department's needs. To go back to your earlier point about granularity versus specificity.
Right. In our risk register, we actually have two forms of initial risk. We have enterprise risks and bureau level risks. So our enterprise risk piece is pretty well developed at this point in time.
It's not perfect, it's far from perfect, but we understand what most of our risks are associated with achieving the strategic goals and objectives of the department. Right. So that part's done, but my goal is to create an enterprise risk process at each bureau. So they use that as their process for identifying what do we need to know more about?
What do we need to assess for risk treatment and risk treatment effectiveness? Where do we need to go with new risk treatments? In addition to developing that, we are now working with the Office of Budget. We're trying to come up with templates that they can use for creating the Green Book, the budgeting process.
And we are supposed to use performance information, evidence, and enterprise risk information to create those forecasts for budgeting. So we are actually working now with the Office of Budget to create a template for 2025 so we can start looking at incorporating this information into the 2025 budgeting process which we'll be entering into very, very soon. Yeah, that's kind of been a goal that's been talked about for years in the community, to really get it into the budget, you know. Yeah, and we are working with them now very closely.
And actually, I talked earlier about the person who was tasked with the 2016 creation of this is what enterprise risk looks like in the Department of the Interior. Well, there's another senior executive candidate now who is from one of the bureaus, and she's actually working on a white paper talking about how we will incorporate enterprise risks into the budgeting process. So her current assignment for her SES development is with the budget office, and so we're using that as a tool to help get us in so we can. And my partner at the department, who we hired from USDA last year, we doubled our capacity when we hired another person, because it was just me for the first three years pretty much.
Anyway, he actually had done some of that work at USDA and has a template for doing that. So we're going to modify that template, see how it works, make it fit for our needs, and then we hope to go from the Office of Budget at the headquarters out to the bureaus because the bureaus are where everything happens. For sure, right. So a couple more questions.
Our time is flying by, but that's okay. I want to understand a little bit better about where exactly you sit in the organization, you know, kind of who do you report to or, you know, interaction with other C-level folks. You know, just how does that work? So I sit in the Office of Planning and Performance.
I work for the director, who is a senior executive that's in charge of that office. Okay. She works for a deputy assistant secretary. And the deputy assistant secretary, I think we have seven deputy assistant secretaries under the assistant secretary for policy, management, and budget, the MD.
Okay. So we sit under that office. And that office has a lot of the oversight, policy, management, and budget. It has all the things you would imagine, policy, management, and budget.
Right. And so there are deputy assistant secretaries over all those areas. So where does the CFO kind of sit? That's the CFO.
Yeah, yeah. So the CFO, so the deputy CFO sits over in the Office of Financial Management, which is a parallel office to ours. They sit under a different deputy assistant secretary. Okay.
We sit under the deputy assistant secretary for policy, environment and policy. And so that, because we really do a lot of policy, that assignment I guess was done a few years back. We were not under the deputy CFO. But the CFO is actually the assistant secretary for policy management.
Got it, got it. Okay. So that's my boss's boss. So you basically are in the CFO shop, but you have a very, you know, it's a mission and operations view of ERM, not just financial view.
Exactly, yeah. It's an interesting achievement. That's good. I like that.
Yeah, so the financial management branch, they have their function and they focus in on Appendix A and the appendices. Right. And we do work with them. We came out last year with guidance that both offices worked on together.
So we're trying to come up with a singular message coming from the headquarters where we're looking at internal controls, which are just a form of mitigation. Yep. So we've tried very hard to incorporate both offices and what we're trying to achieve in the end. Because in the end, what happens every October is we, from the bureau, submit the annual statements of assurance.
Right, right. And those assurances are over finances, but they're financial reporting actually. Right. But they're also over programmatic assurances.
And then, of course, there's a technology IT assurance. And those are the three parts that go into the annual statement of assurance. Right. It really sounds like this office makes so much sense to me because you do an evidence act, all the performance of the strategic plan, ERM, all these inputs in the budget.
Do you think it's the right spot for this? Absolutely. I've thought about it a lot. Because we know that across the government, there are all types of places where people are aligned, whether they're under an operations function or whether they're under a financial function.
But really, we are in the right place. Yeah, it sounds like it. We align with the budgeting process. Yeah, exactly.
And the other thing about risk management, which is different than financial reporting, is financial reporting is where we're looking. Right? We're looking at what's happened over the last year. Yep.
What we do is we look forward. Right. And we anticipate. You're planning.
You're looking forward. Exactly. And we're in the office of planning. So we anticipate risks associated with the planning and the performance.
And the performance is kind of the report card of how we're doing. Yeah. Right? But we anticipate the risks.
And then we ensure that we have the right mitigations in place or the right treatments in place. Because sometimes, we don't just treat risk for mitigation. We treat risk through contracting. Right?
And a lot of departments, they go, we use NASA to the NASA supercontract to buy our small computers. Because there's a whole supply chain risk management function that we don't have to enter into because we've actually, I'll call it outsourced. Outsourced that piece. Yep.
So we share that risk. When you look at the four ways to treat risk, you have mitigation, you have sharing, you have avoiding, but there's very few things we can avoid doing because most things we do are by law. Right? And then there's acceptance.
And this is the thing about risk acceptance. At some point in time, even with mitigation, when we lower the risk enough, we accept that level of risk. Because we never eliminate risk altogether. It's impossible to.
So there's eventually an acceptance. So acceptance is always involved there at some point in time. Acceptance of risk. It's just how high is that risk.
Yeah, try to get it as low as you can and then accept it. Right. Exactly. Well, so just one last question for you.
I kind of always throw this one in. But obviously you've got a great program going here, a lot of good things. Is there areas for improvement or things you want to do in the future that you aren't doing now? Sure.
Like I said, I do want the bureaus to start using an enterprise risk approach to identifying the risks. I've also asked our Inspector General's office to come in and look at my program and they're assessing our program now. All right. And I did that so they can identify gaps.
You know, there's a SIGI guide for IGs to assess enterprise risk programs. Yes, yes. And I've read the SIGI guide. Actually, that was part of my training when I did my two-day training.
Yeah. I pulled out all the elements of the program. So these are the things you have to do. And so I use that SIGI guide as part of my training program.
So they are actively involved now in taking a look at the program. They're doing a historical look going back to 2016 to see how it's evolved over time. Okay. And then identify where we are now.
They have done a series of surveys and interviews and I've actually encouraged them to interview more people so they can really get the context of how things work within the department. And so we're supposed to have a draft of their report sometime late this spring and a final in the fall. So I'm looking forward to that. When I asked the IG to come in and audit my program, there were a lot of people that thought I was nuts.
But once upon a time, I was a member of the IG when I was in the Air Force and I was the weather evaluator on the IG team when I was in Europe at the United States Air Forces of Europe. Okay. And so I know it. IGs are good.
I mean, it's just like risk identification. Yeah. Nobody wants to talk about their risk. But if you don't talk about your risk, you can't address them.
So if I don't know where my gaps are from an outside party, I mean, we have outside audits that happen all the time. Oh, yeah. Why do we do that? Because that helps us identify where we need to improve, where we have shortfalls, where we have gaps.
Right. Well, thanks again for coming out here. This was really interesting. I mean, I think we're going to be excited to hear about what you guys are doing.
And, again, for braving the weather. I know it looks sunny now, but thanks again for coming out. Well, thank you very much for having me. This has been a pleasure.
And I really enjoyed it. Thanks so much. All right. Happy Mardi Grasier, right?
Happy Fat Tuesday. Fat Tuesday. All right. Well, that was Risk Chats with Affirm.
And this is your host, Paul Marshall, signing off.