with a firm on your host Paul Marshall. And today we have a guest that we haven't had before. And agency we haven't talked about the FDIC. And to do that, we have Joe, let's Joe, how are you doing today?
Doing good. All right, well thanks for joining us. We just kind of want to do a profile of your program, where did it start with a little bit of history, your journey, where you are today. And maybe any recommendations you have for other agencies to kind of look at for their programs.
But we just just have a little bit about yourself. You know, you'll be back here background. Sure, and the first off, thank you for having me. It's a pleasure to be here and talk about the FDIC Enterprise of Management Program.
So I have been at the FDIC almost 15 years now. And I've been in a whole different roles. I started out in the Office of Physical General Community managing all the evaluations of FDIC programs. And then I transitioned about five years ago in February of 2019 to manage the FDIC, the emergency program.
And I worked for the chief officer. And we were re-establishing the ERM program at that time. And I worked very closely with the ERM to re-establish the program. Okay, that makes sense.
I know several folks that start off in the OIG and kind of went over to risk management. It makes sense to me. So we're going to start off with a little bit about just a little bit about the listeners. Can you tell us just a little bit about FDIC itself, the agency, and maybe what makes it unique?
Sure, so for a little bit of effort on FDIC, we're an agency of about 5500 people, so contractors. We are led by our chairman and a five member board of directors. FDIC had about nine divisions and six offices that cover different mission and operational areas. And we have several mission responsibilities.
In addition to measuring the process and maintaining the deposit insurance fund, we examined and supervised about 30,000 and 50 financial institutions for taking the founded and consumer protection. It should have large and complex financial institutions that were double. And we would be all failing banks and managers. The issue.
So basically your whole agency's mission is about risk management when you say. About risk management and protecting consumers. Examine banks are taking advantage of the idea that we can save that off all under the umbrella of risk management definitely. So let me talk about your program.
Maybe just starting off here, where is ERM located in the FDIC? Sure, so the ERM program is in a housing what's called the office of risk management and internal controls for O-minix and the FDIC chief risk officer in the commercial industry, he leaves O-minix and O-minix reports to the chief financial officer who reports to the chairman. So and O-minix has three of the sessions and up 25 staff. So my ERM team started out as me and one other person.
And then we grew down to set a number team. And we are in section. And we also went into the ERM. We implemented our corporate wide supply chain with management and corporate insurance program.
We coordinated independent validation of the FDIC and community models and we gave a program for some of the different areas of program matters. We have two other sections, corporate management control, the FDIC's internal control program. And we're closely with the vision of the offices, division and office internal union. And they also audit performance coordination and follow-up activities for GAO and OIG audits and management annual report development and insurance and process.
And finally, the third column is our process improvement section and they assign dedicated to the manager to the largest and most complex development efforts. Cross improvement also provide organizational analysis and change energy services to clients, individually and the office. So that's open it, our three sections. Again, my section is on the end of the number team.
Yes, please, robust that team there. I like that. So you both are the ERM and the internal controls and the process improvement too. So that's pretty unique.
And maybe just talk a little bit about, again, sort of the history of the program. How long ago you all stand it up? Where's the constant stand? What are some of the main attributes?
Maybe like, what do you guys do for inventory and the average type of estate and stuff like that and stuff? Sure. So our ERM program has waned a bit in the 2017 timeframe. And then Marshall Gentry became the new CRO in April of 2018.
And he was tasked with re-establishing the ERM program. And then as I said, I started in February of 2019. And so by the time I started Marshall had laid out, it really solid framework for re-establishing our program. And on that program, they sent a 1D search for A123.
We're not required to follow that, but we choose to follow that. We follow that. We call that very closely in our ERM program. And I worked really closely with Marshall in rebuilding the program.
And at the time when I started, I decided to send a team in March of 2017, and we built a program over time, which I went into later. But we have actually on a groundwork where we had a risk profile, a risk-effectment, and he had a vision for a risk inventory. And it was going to be probably the program that I helped to build out. So our risk profile at the 2017 items on it, it goes to the highest risk, basically, and you can see what is really having an agency that's a big picture.
For example, he's got a management of something that's on there. And then we have our risk inventory. And the vision analysis at the FES, the only risk inventory. And it's about 135 risks on a risk inventory.
And those risks kind of flow out into the risk profile. So in other words, a risk profile item on the budget management, that kind of theme that we covered slightly more granular as well in the budget environment. So what I mean is we have a lot of risk related to the budget management on the budget inventory that our own budget vision is on the FES. So we look at the inventory, and we just make sure the profile will reflect those risks.
And both of these are really not going to weaken my time at any time, and we do have formal processes to validate and refresh them as well as during period of time. And then the third one is our organic statement. And that kind of shows a lot of risk that the FES is willing to absorb in order to fulfill admission and take on different program responsibilities. And we've refreshed that document once a year and otherwise as needed.
So we built the program. We built the program with the data profile, the risk inventory, the data statement was very, very closely with FES personnel and identifying with the VA with FES program personnel quite a bit. And then we also built a solution in SharePoint that we call it How is All This with Information? And that's coupled with that low for visualization and reporting and also Power BI for the same thing, visualization.
So our inventory is how it's in there. A lot of people have access to it. Probably about 500 across the agency and access to the agency tools to see the inventory. And in a nutshell, that's that way, that we work closely with the evidence to implement the program, get it off the ground.
And now we're at a point where it's definitely more routine than it was. So we're in a routine better. That's right. So I would be interested just a little more information on, you guys rebuilt the program.
And then you're kind of more mature level now. Maybe like what were some of the key foundational things that you put into this program. And then where did you grow from there? Just curious some of the major milestones.
Some of the major milestones? Well, I would say we back in 2018 with more foundational. We revised and published our ERM program directive. We socialized the ERM program, obtained by an health meeting with all the divisions and offices to discuss the risk profile which is actually the first document we put out there.
And that's when we just started initiating development of the ERM's SharePoint tools, how's our ERM risk? And that's what built in-house. In 2019, I'm called that building. We published the standard operating procedure jotties.
We completed our risk profile. We worked very closely with the division that was completed with inventory. And we told evidence what we thought the risk inventory items might be. So we didn't have a blank piece of paper.
We did a lot of research and we said, this is what we think. The original items are. So people have no statistics on point or any key change. So we did some divisions.
We started on point, other divisions changed it. We just didn't want them to have blank piece of paper and say come up with your risk. So we worked very closely very hand to hand to them. In 2019, I came up with communicated with the academic data activity agency by global emails.
We established regular reporting through our operating committee, which is our risk management council. We ended the ERM training with the quarterly. And we began using that ERM tool in SharePoint and creating dashboard reports that we shared with the division offices. And then 2020, our program is more defined.
We tweaked our ERM standard operating procedure, our board endorsed and the chairman approved our academic statement. And that's done every year by the way. We implemented cyclical and recurring cyclical and recurring ERM process. And we reached out to headquarters on all the regional offices.
We had lots of stuff. We had to make sure we were known. And we also started reporting with videos that were requested by EOSC. But we had to get the board with the chairman.
And that's where we saw an area that weren't in the review. Maybe something that was inserted out and we looked at the program area and reported that. 2021, maturing agency went back to mission of the program. We did an ERM with awareness campaign where we partnered with a couple of other divisions at the EOSC to raise awareness about risk and raise awareness about a program and to emphasize that we wanted people to come talk about this.
And so we did that. We had different news articles published. I think like that. And we also began integrating ERM with discussions into our strategic planning and budget processes.
And kept doing reviews for program operations as where we partnered with people. And different than than not to talk about it. But actually partnered with a health problem and such as this. And honestly 2022 and beyond has been a lot of partnering with the agency to really address them in the inventory and do work with them and do reviews to see how we controlled our and to make recommendations for improvement.
And so that's even healthy to see the implementation for improvement. We held an ERM with awareness opposing on the 2020-2023. And 2020-2024, that's where we got people from around the agency to discuss this with the whole agency. We had about 600 attendees in 2023.
And probably about the same in 2020. Actually, yeah, around 2020-2024. So and then we had to do Power BI to enhance our ERM reporting in 2020-2023. And I thought we kind of matured over the years.
And our process is very simple and understood now. And the material has been more partnering with the agency to self-love. Yeah, just one follow-up. I'm always curious about that.
What kind of dashboard do you all have or what kind of things do you look at on this? So our dashboard reports show the risk inventory items by division. It shows you can make custom dashboard or what it's like. I mean, I'll be standing on the risk profile, the risk inventory.
But we can show it in many different ways. We can show it with one division. We can show it with any division's inventory. We can show it with the associated mitigation strategies or the risk inventory.
So if you have a risk that says here's my risk, we also have a data strategy. And then we have a report that shows how the risk inventory items may do a higher-level risk profile item as well. And some of these are standard reports that we produce every month. And this isn't enough for that.
You can also customize what the report should look like. Yeah, it's great. It's a great question. I mean, we don't have a budget for a big fancy tool.
They're going to be able to share a point in Power BI and all kinds of tools that they have. So you're just looking similar. So that's good. That's good.
Yeah. Well, let me ask a few more areas here. I want to cover with you. I guess one, I was just curious.
Since you're an team to cover multiple things, when you do assess different things, you know, what are some other ways that you all kind of say provide value to other areas at FDIC besides just the core yarn. What do you do? So we provide value. But one thing we did, we did with the concerns about the contracting items at PSP.
And we partnered with what we did with the associate program to review FDIC contract for compliance. And make sure that documents were retained. It's a good approach to contracting process. We're carried out.
And we did this in partnership with other FDIC personnel. And provided feedback on what we were seeing. And it's been a really successful program. And we just went to the contract.
And by doing this with other people across the FDIC, we are also training them with the contract. And if we see anything that's wrong, a lot of times we can correct stuff in real time, rather than say, we reduce something here in the issue. A lot of times we just got things corrected in real time, which just took a little bit of effort. And to coordination with FDIC staff, and that provided value of the catalog of the data on that.
So another big topic. So finally, I'm saying that your improvements are being successful in integrating with budget. How are you all doing that? So our budget directive was revised a couple years ago.
And at that time when it was revised, what we did was we did insert something from some information out that your program did about it. And our FDIC budget directive and supplemental guidance act, the division of the author's two links. The ERM written inventory items, super-prepared, and described how funding impact or expected impact or reduced the inventory items, especially for those of us that are marked as high or elevated. And then our chief vice officer participates in budget meetings with other division directors.
And if it's a division or office, for funding, for a significant project, what we want to do when we communicated it. We want to see a related risk inventory item, or risk profile item, and negations reflected in the risk inventory. So that's our act of division and audits and system that correlation. And we have a couple of different major budget meetings each year and our zero participating in those meetings and transit system information.
All right, like that. And speaking of that, just interactions of the CRO or ERM program with your leadership, do you think the program does a good job of reporting up two senior leaders and how often you all do that? Oh, sure. So I'll get an overview of your reporting.
So we report through FDIC leadership. We report quarterly to the chairman on our ERM program. We report quarterly to the operating committee, which as I said earlier, that the risk management council. And then we have an audit committee as well.
And we report semi-annually to the audit committee. And the briefing that we provide to the audit committee is also provided to the FDIC board director at the next meeting. At the meeting, so that's the point of the audit committee. And then on an annual basis, our division and office is certified at the inventory item for that at a formal validation.
Now there's a significant interest in the update at any time. There's really documents or limits of the day. But on an annual basis, we didn't have to certify to the items. Also on an annual basis, our operating committee confirms the risk profile.
We usually update it formally once a year or at least review it for a potential update. And then we have a new committee confirmed it. And also annually the four industries are with gap and tight statements. So we're formally with the risk appetite statement, make changes as we deem appropriate, vet it for comment and then get more endorsement.
Yeah, I'm just curious. Do you guys publish that publicly? I know come out to agencies do not do, but what do you want to do as far as I guess? So at the moment, no, we do not publish our risk appetite statements publicly or our other documents, not our risk profile with inventory and evidence that they are not public.
Yeah, I think it just makes sense for some agencies versus others. I think it wasn't anywhere ever more international aid and stuff like that. You guys have more regulatory rights, maybe it's not great to have all that other. Well, so at something else, I just want a couple more questions for you.
But again, it sounds like you really did a great job of rebuilding your program and maturing it. You know, what would you say were some of the key things that helped you all have a successful rebuild and things that you might recommend to other agencies? So what I would say on that is I think it's really important to have an executive level chief officer and established at the top. And we are so fortunate at the FVIC, our chief risk officer in the emergency industry, he thinks that if he reports to our chief financial officer who reports to the chairman and that whole line is there, there's a port of program.
And that is really key. Second, you really need to customize that you're implemented at your agency. You have to understand the culture of your agency, how it works, how people think, and you're implemented in that mode. So and there's not one size at all.
So we really try to build it in line with the agency culture. And then you need to also establish and communicate your nation vision. What do you want your information with chief? In other words, so in the beginning it was all about looking at these documents down, look at the risk profile down and make sure that they're at the inventory on.
But those are just lists of risks, right? And what we always wanted to achieve was to take it to the next level and say, we want to be instrumental in not just talking about these risks, but addressing these risks. How can we be happy at the IC to make sure they are taking proactive steps to address anything and enhance and improve as we can? And that's what we communicated early on at the end of the time.
And with our maturity, that's how our program transition. And we are partnering more and more with us. And another thing you need to focus on the top risk, expand the ER and program. Equinarily expand it slowly, which is what we did.
As you get more entrenched in the agency and as people get to know you and have to build it. Expand it slowly and incrementally. Empower your staff, assign them program areas and I have some staff and most of them are assigned to different program areas. So you're in program where they directly use different divisions offices to help make sure the risk inventory is up to date and definitely like that.
We facilitate risk discussions. We see programs feedback. We have survey BEC on the ER and program and how they feel about risk. They like that, they're serving the goods.
And then also, you know, you know, we need to partner with the ITAL department. And then also adopt the ER inventory model and track progress. So we've done that and we, that's where we're at based on that model. There is a model that goes to the federal government has a good option and is out there on the web in the, um, one of the ER and animals and that's the one that we adopted.
And we talked about risk and that model. Once we can ask that last question, you know, where do you feel you are on that maturity model level and, you know, the last level, where's something you'd like to do in the future? Can we get that ultimate level? Yeah, so the model we adopted actually available in the ER and playbook is available at the the end of the web.
And, um, for that model, you know, the five levels. Level one is initial, you know, the formal government structure with your ER and program level two is fragmented. Level three is defined. Level four is institutionalized and level five is optimized.
I would say we're at a level four on the five level scale. And what we've done to be at this level four is we fully standardize our processes. We coordinated with management activities associated by ERM. ERM is considered an HTTP query about hypotheses.
Which responses are proactive and predictive at this point. Oh, no, I was proactive. I think it was kind of neat. And there is a perceived, you know, higher perceived values were for me because like I said, we are actually partnering with the agency to address it with.
And eventually we don't just do the ER and program. We do the positive management program. We let the contract for compliance. And we also manage the corporate insurance program.
And either always that we do the minutes because we're doing that. There is a perceived, I perceive value to what we are doing. Now, if you come a level five according to our model, you know, there was something that the transformational value to the agency. And I'm like, well, that's really hard to get the transformation value.
But I think there are aspects where I think we're hitting a five overall. I would say because they're ready for it. And I think we just need to get more and more interest in the agency a little bit. And, you know, we have a couple projects in pipeline that we're just trying to initialize with the agency.
More partnerships going on. And we fully form those partnerships to address some other risks. And I'll just get to level five. But right now, if you have to pay for it.
Okay. Well, that's not bad. Definitely tell from the discussion that you're, this really is entrenched in the organization. You have official program and documentation and cyclical reports and meetings.
And I mean, it really sounds like that's, you know, that absolutely sounds like a level four. That's an additional, I think you said it's just, you know, continuing to evangelize and get that risk culture, you know, going to the IC. But, but you have Jill, it's been awesome. I really appreciate your time.
Is there any five words you want to say or, you know, put any shout outs out there or anything. Just open the floor to you. Just a couple shout outs. Thank you for having me and allowing me to talk about the application of your program.
The other thing I'd like to say when I started in the program in February 2019, I would do two ERMs. Now, having worked in the whole community, it was a natural progression to be in ERMs. I would do. And I met people in a firm.
I got to know them. And the community is just wonderful. I reached out by email individually to different people. And everyone helped me so much when I had a question that, I found it just one of the best groups that there is.
And I was just a great poll, such a supportive community. And I know when I had a question, I can go out to them and I've got to know so many people in the community. And there's just so many hardworking people. And I'm grateful that people shared their insight and effort to something that it just has been really helpful in building a program.
Absolutely. And you're continuing the tradition. Thank you for sharing with us and everybody out there in the podcast world. So without working to wrap it up, and again, this was Chris Chantwood, a firm.
I was just holding it inside of.