Hello, and welcome to the podcast. All right, well, today we have an exciting guest from the VA. We'll let her introduce herself there, but we have Denise Dunning. Welcome, Denise.
How are you doing today? Hi, Paul. I'm well. Thank you so much for having me.
Absolutely. Happy to see you. So, yeah, why don't we just start off with what we wanted to do today is just kind of, you know, profile your program over at Veterans Benefits Administration, and, yeah, we'll get into it, so the guests will listen in, but stay tuned to see all we're going to talk about, but we do want to profile your program over there. So, yeah, why don't we just start off with yourself.
Just tell us about, you know, your background. My name is Denise Dunning, and I have been with the Department of Veteran Affairs, Veterans Benefits Administration since 2008. I'm a retired Air Force veteran myself and take a lot of pride in serving and giving back to our nation's heroes, and so I currently serve as the ERM program lead for our administration, where I work with key stakeholders across the VBA to identify, assess, prioritize, and manage, and monitor our administration's top enterprise risk. Awesome.
Yeah, and actually my dad worked for the Air Force, too. We were down in Warner Robins, Robins Air Force Base. I don't know if you've ever been that way, but yeah, all right, there you go. Well, good.
Welcome. So we wanted to jump into the history, the structure of your ERM program, specifically VBA, because interestingly, VA has several programs, right? So yeah, do you want to just give us a little background on the actual program? Sure.
Our ERM program started way back in 2019 as a response to VBA's risk landscape that has since kept evolving and us along with it. Since 2019, our program has grown exponentially, driven by a deliberate focus on our relationship building across VBA's business lines and staff offices to ensure that we are embedding the ERM principles into all areas of administration, which is very important. So because of this relationship building, one of our most significant strides in our ERM journey occurred in 2021 when we received buy-in from our executive leadership through the standing up of our very own enterprise risk council. That has served as a crucial factor for engaging leadership in important enterprise risk management decisions.
We meet with them on a quarterly basis, and we're extremely fortunate that our senior leaders are brought into ERM and attend our ERC meetings on a quarterly basis, as I mentioned, and since then, we've hit so many key milestones with some of our most significant achievements being, let's see, we've aligned risk and budget to ensure our resourcing decisions are risk-informed across administration. We've developed staff-level trainings through the VBA ERM playbook sessions to strengthen our risk management skills. We've also worked on developing out VBA's risk profile that is refreshed biannually, and we're developing an ERM framework implementation plan to help achieve our desired program maturity that we work on. Awesome.
That's a lot since 2019, right? Yes. And so there's many more, but there's just a few of the big ones I wanted to highlight. Awesome, awesome.
So, you know, I'm curious as far as where ERM sits in the organization, like within VBA, where do you all kind of sit? So our program currently sits within the Office of Financial Management, which reports up to the VBA chief of staff, who ultimately reports to the principal deputy undersecretary for benefits, Mr. Mike Frew. And Mr.
Frew also serves as our executive risk council chair. Okay. So it shows that the tone at the top in our organization that we take risk management serious. Right, right.
So, and yeah, and who else, that's kind of like the council, the chair, you know, what are other kind of key stakeholders, you know, you all engage with? So we engage with our ERC members, which is our executive C-suite, and as well as the liaisons that we meet with on a monthly basis, and those are our boots on ground employees, if you will, that are actually getting the job done, that are collecting up the risks that we meet with and provide training to. Okay. So as far as, you know, moving that relationship with leadership forward, and you have obviously a lot of different business lines, things you all do there.
You know, how do you kind of work with all those different business lines and leadership over there? Sure. So there are a few main groups that we interact with, but the two main are the foremost mentioned, like I said, the ERC members and the risk liaisons, who are risk representatives from across every business line and staff office that we have at BPA. Senior leaders, we primarily engage with them through our quarterly ERC meetings to provide visibility into our risk management activities and efforts, and for our risk liaisons, we engage with them on monthly liaison meetings and during our enterprise risk assessment process that we do annually, and through taskers that ensure that leadership and the liaisons are collaborative in identifying and assessing risk in the most effective manner possible.
So we also hold quarterly community of practice meetings, and this time is intended to provide additional training and insight to ERM for folks that maybe don't have a specific assigned role in ERM, but are interested in learning, so that we are making sure the next generation of leaders has a heads up on what we have going on with our ERM program. Right, right. Well, I'm guessing you participate with things like Affirm and all that, right? Correct, yes.
That's good. Is it yourself or various folks in the office or throughout VA? Throughout VA, so this past Affirm Summit, we had, I think it was our partners at VHA won one of the awards that they had, the Luminary Award for the year for this program, so yeah, very proud of them. Nice.
Yeah, we'll get into a little bit about other activities at VA a little later here, but let's stick with VBA. So, you know, obviously this is about risk, so, you know, are there some kind of, of course there are, what are some of the maybe unique risks that specifically VBA has, and how are you all addressing those things? Okay, that's a great question, Paul, thank you. So I'd say there are quite a few key risks and challenges that VBA is currently facing.
One of the key challenges our program faces is prioritizing certain enterprise risks and really adding a layer of, how do you say that, risk prioritization analysis onto our budget process for projects, priorities, or requirements which require resources. So things like leadership attention, technology, FTP, and overtime, and of course the budget, which is becoming increasingly important in a never-changing federal appropriations process. Right. Yeah, any other examples or things you want to bring up?
Sure. So an example that comes to mind relates to one of our historically most pressing risks, which is benefits claims backlog. In essence, VBA had a backlog of veterans claims across different benefits, which resulted in long wait times and even appeals. You might have heard about it on the news once or twice.
This significantly impacts our administration's ability to fulfill our mission to provide adequate and timely service to all our veterans and their beneficiaries. So we are leveraging our risk capabilities, including driving, resourcing, decision-making, and resource response and monitoring efforts to continue to address the risk, but it is definitely a work in progress for us. Sure. This always is, right?
It never ends. They're always trying to just get things better. So is there anything in particular perhaps in the last few years, hint, hint, that might have triggered some additional changes over there, just like everybody else? Sure.
So the COVID-19 pandemic was a turning point for us in that regard. During that time, we made a concerted effort to appropriately address and proactively, emphasis on the proactive part, manage this risk. So VBA adapted to a virtual environment, and we had begun the process before COVID of digitizing claims documents, and we had to speed that up, as you can imagine, and lending a digital transformation effort. Right.
So this digitization helped us address veterans' needs more efficiently by repurposing our human capital to focus on VBA's mission and less on the back office operations that were now automated or streamlined. So as a result of these risk prioritization and the risk response efforts that we did, what was traditionally our highest scored risk did decrease in both likelihood and impact and I'm proud to report. Yeah, awesome. It's important to note that VBA's claim backlog does remain as a tier one risk.
It always will. It's our main goal, getting those claims taken care of. So meaning, it's not the top of our leader's mind to cross VBA, but for some operational risk, like those related to hiring and budget, have risen to top of tier one in terms of scoring. So that's new for us.
Interesting. Okay. Yeah, I mean, obviously COVID affected everybody, but this is interesting how it affected you all specifically. So I guess you kind of made something good out of a crisis in a way, though, right?
Yes, we had to. We had veterans depending on us. Yeah, that's great. So do you all utilize any kind of special technology, advanced techniques or software or anything to help you with your ERM program?
So currently, we do not employ any advanced technology in our ERM programming, but we do work closely with our budget programming formulation and execution teams to integrate ERM into our budget process. And I can take you through a brief overview of what we're currently doing, if you would like. Please, yeah. So last year, I'm very proud to share that VBA's enterprise risks were aligned to the requirements in our $4.3 billion budget, the GOE spending, which was aligned to the president's budget.
And I'm proud to share that this was the first time that we've used ERM governance to align risks explicitly to budget requirements. Awesome. So that was huge for us. So we have been working on integrating ERM with the budget in hopes that we can serve to strengthen our ability to deliver on strategic goals and objectives to create visibility into how VBA can manage various challenges, if you will, as well as promoting accountability by aligning our resources to the most crucial risks.
Does that make sense? Yeah, absolutely. I mean, that's definitely, that's the goal of, we're all trying to do that, right? I mean, actually aligning to the budget and justifying those with the risks aligned to them, that's a huge step forward there.
So pretty awesome. We've had much success having our CFO also be RCRO to at least get that started. I know that's not normally the way it's done, but we've had much success with that. And so currently, some of the objectives we hope to achieve through the integration are developing resilient strategies that plan for potential risk exposures, enhancing resource allocation based on priority, and strengthening strategic risks reporting through budget functions.
So each of these objectives will have significant benefits on our program, which I mentioned earlier. Yeah, no, that's great. This budget integration thing is huge. So I'm very glad to hear you all are having success there.
Now, speaking of that, you know, let me give us a little bit more, a little deeper dive. You know, how do you all use ERM to inform your actual formulation ideas there? So our first step in the process takes place during the enterprise risk assessment, where we conduct identification and assessment activities across our business lines and staff offices with the outcome of identifying our top enterprise risks and their impact to our mission. And so then this results in a refreshed risk profile that we can use as the basis for the rest of the process.
Okay. And then what happens under that? So the next step in the process is looking at BPA's enterprise risk profile to integrate qualitative factors to prioritize our most pressing risks, which will help us to decide our priorities, which priorities should be funded with any discretionary funding, both liaisons and our ERC members have an opportunity during this time to propose escalating or de-escalating the risks on the profile. And the tiering system then dictates how response is prioritized, particularly as related to resource allocation.
Okay. You mentioned tier one. So there's several tiers. Yes.
Okay. I'm assuming tier one. Is that the highest priority and then down? Or how do you all have that work?
Yes, that's how we have them. Gotcha. Okay. So then, you know, what kind of comes after that?
What's the next step there? So finalizing it, we reach the point where we can align budget requests, including their justification, to our risk profile, which is super important because we can show that these budget requests and justifications have some real data-informed backing. And it's helped our chief financial officer, you know, defend our budget on the hill in these, you know, times of budget constraints that we're in. Right.
Exactly. No, again, I mean, I definitely agree. That's what this is about, right? And that's a huge piece of ERM is actually actualize it, use it for budget decision-making.
You know, it's pretty fantastic what you guys are doing there. So I guess as far as, you know, you kind of give us a little insight into that process. You know, who are some folks that are actually directly involved in this? Where are some of the people involved?
So the two main groups that we work with to integrate ERM with a budget are the risk liaisons and our budget contact within the lines of business and staff offices. Okay. And what are kind of those different responsibilities and roles there? So an ERM liaison serves as a champion for ERM within their line of business or staff office to encourage a fostering, if you will, of a risk-aware culture within their line at VBA.
And then a budget POC serves as the business line staff office advisor, if you will, in developing and executing a resource needs and execution of VBA's mission and goals, which is huge. So they are two very important roles that stakeholders within VBA hold in addition to the rest of their duties. Because these budget and risks are so intrinsically intertwined, if you will, we have found that often a risk liaison also serves as a budget POC. So, however, in the event that they don't, that they're not the same person, we provide ample resources and job aids that support the collaboration of these representatives through the budget cycle, which we're currently in right now, as we develop our budget forward, so they can work seamlessly together.
Okay, yeah, so it sounds like this is how you actually integrate ERM and budget with these folks. And, I mean, how about just a few more specifics on, you know, what do they do exactly, you know? Sure. So our ERM liaisons coordinate the identification, assessment, and management, reporting, and monitoring of VBA risks, while our budget POCs coordinate all of the foremost mentioned items.
But instead of focusing on risk, they focus on VBA's resource requirements. And some of the budget POC's key responsibilities include things like validating requirements to be included in VBA's five-year budget plan and the budget year submission, the annual budget execution, escalating critical budget issues to the discretionary budget team that we work closely with, and developing and delivering our budget-related communications for leadership and our internal stakeholders. So I could go on and on. But I think the main point to get across is that the liaisons and the budget POCs essentially go through similar activities, but where an ERM liaison would focus solely on risk, a budget POC would focus on the budget-related items.
So another example would be that our ERM liaisons continue to communicate ERM and the best practices across the business lines and staff offices, while our budget POCs would communicate budget best practices, if you will, across the business lines and staff offices. Does that make sense to you? Absolutely, yeah. That's great.
That's just a lot of good detail. So folks out there that might want to do a similar thing, they kind of understand what you all do. So yeah, thank you for that detail. So you mentioned earlier that this whole process is kind of a progression from what you've done before.
It's not exactly the same. So what things changed and why? One of the biggest changes that we've had for this process were the modifications to our evidence-based budgeting evaluation criteria, which serve to support ERM, evidence, and budget integration, which is what we've been focusing on. The preview question asks, have the risks of not implementing or continuing the program been identified and evaluated, which at first glance doesn't really tell us much about how this can affect other enterprise risks at BBA or potential risks that may arise out of this.
So we did some rework and came up with a few questions that address the concerns. And one of them is, does the implementation slash continuation of this initiative address the impacts on one or more of our enterprise risks or make that risk less likely? Right, right. It's the one that really gets to the heart of the issue.
And to me, that is a much more insightful piece of criteria to follow. So it's important to know that this is only the second budget cycle where risk is a required input. So we are continuously working on updating our resources and our job aids to best support our risk and budget. stakeholders in alignment of the budget to the risk.
Yeah, so that's good. I mean, so this is going to be a huge emphasis, obviously, going forward. So, well, all right. Well, yeah, thank you for that.
I love that detailed explanation. Like I said, I think it helped other folks think about how they might want to lay out, you know, integrated ERM with budgets. So I mean, that's like just a huge topic for everybody right now. I just had a couple other questions for you.
So, you know, we talked about, so you're supporting VBA specifically. How about the other administrations? What do they do? They have ERM programs too?
Yes, they all have ERM programs as well. We're in different stages of maturity within each administration, and then we all fall under our department, big VA, if you will. Right. We're in the office, out of the secretary's office.
Gotcha, gotcha, gotcha. Okay. But obviously very strong CFO involvement, right? Yes.
Yeah, and obviously we talked about budget all for the whole time, so it makes sense. Well, that's awesome. No, this has been very insightful into, you know, what you guys do over there. I did want to also kind of wrap us up today, ask you a more personal note that I understand you took a chief risk officer class recently.
Can you tell us about that? Yes. I had an opportunity to attend a George Mason University chief risk officer program, and it was very much value-added. My boss before me went, and he said that it was something that she definitely sent everybody to because of the networking was huge for us.
So his course had more folks that were on the private sector, whereas mine had a lot that were in the public sector. So I am still very close with the team that I worked with during class, in collaboration with other federal agencies. And so our programs are pretty much neck and neck with immaturity, and so we rely on each other for questions and networking and just seeing how we can push our programs to the next levels. It was a great opportunity.
Right. That's awesome. Yeah, we've talked about that a little bit. We've had some other guests that have been in the program.
So am I right, you said that's a combination of private sector, people, government, federal, also state and local folks, too? Yes, we had them as well. And then we focused on not just ERM. There was also data.
We learned a lot about the data because it's, you know, incorporating data to your ERM statements and responses is very strong to support your statements and your risk profiles. And then, like, where were your professors from? Were there some federal folks or what kind of, you know? So that was really great.
We had folks that were chief press officers in the public sector as well as in the private sector. So we got a great combination of how they set up their programs, how the public sector differs greatly from the private sector. And it was good to know that the public sector is actually doing really, really good work in comparison to the private sector. Yeah, it's kind of different goals, right?
I mean, in a way, I mean, business cares about the bottom line, and we care about the mission and the programs and the impact, right? Right. Well, they have board members to respond to, and we have taxpayers and Congress to respond to. Yeah, a lot more of those, right, then.
Well, awesome. Anything else you want to say before you go? Just any shout-outs or anything about what you'd like to be doing with the program going forward? Any final thoughts?
Well, I appreciate the time to come on here and speak with you and share about our program. We've had good interactions. When we spoke at a firm this past fall, we were contacted by another agency looking to see how they could integrate ERMs into their budget as well. And so if anyone is looking to collaborate, please give us a call.
We'd be very interested in meeting up and working together. All right. Well, you might get a lot of calls. I know a lot of people are trying to get this right.
So, all right. We'll be right back.