Hello and welcome to Rist Chats, where they firm. I'm your host Paul Michael. Today we're speaking with Chief Risk Officer from the Corporation for National and Community Service, Lori Givlin. Hello and welcome to the podcast.
Today we have Lori Givlin, the Chief Risk Officer from CNCS. Good morning, Lori. Good morning. Well, I'd like to start off today if you could just give our listeners a little overview of yourself, what you're doing at the agency and a little bit more about CNCS.
Great, thank you. As you mentioned, I am the Chief Risk Officer here at the Corporation for National and Community Service. CNCS is a grant making agency and we are probably most well known for our amazing AmeriCorps Grant, AmeriCorps program. I think a lot of people describe it as Peace Corps but for America.
But essentially we support communities throughout the country by fostering volunteerism and service. And my role here is as a Chief Risk Officer, I came on about two years ago to put together I think possibly one of the very few, if maybe the only, office of the Chief Risk Officer which comprises the entire suite of A123. So I oversee internal controls and proper payments, enterprise risk management, our annual grant risk assessment program. And most notably, I also oversee the policy for one of the largest risk programs that we have here at the agency related to our criminal history checks.
Wow. Good to know. So I know a lot of different ways you can kind of set up a risk management program and it sounds like you're in the financial world so to speak. So speak a little bit about that.
How is that, do you think that's an advantage or disadvantage for a risk officer to kind of be in the financial arena? So that's a good question. I think we are somewhat in the financial arena. We like most other agencies, our internal control program really does look at financial risk over reporting.
But we are expanding to be in testing operations and I think one of the biggest operational risks that we have, like I said, is our criminal history check program where we require their background check for all those who receive our grant monies. And we are really trying to push ourselves into the operational arena to ensure that we have a full coverage of risk oversight here at the agency. Right. Okay.
Well, and I would thank your staff and the folks that support you, you know, internal control reviews and audit world. It's an important background that has. It makes things a little easier as far as assessing risks and trying to get illicit risks from folks. It does.
And actually one of the great things about this organization is we really value our association with the mission. Many of our staff not only actively volunteer and engage in our mission but have been members and volunteers through our programs that are funded by our grants. So I think having an affinity for and a sensitivity to what the agency does is very helpful in assessing risk, most notably because you may have participated in activities that could have been rise to that risk and you understand what's going on in the community. Right.
Absolutely. So tell us a little bit. One more detail into your approach to risk assessment and supporting things like risk responses and obviously getting the profile together and all that. Right.
So we thank you. We actually just completed our risk profile. I think like many other organizations and notably our small federal agencies. And in doing that we noticed our timing was such that we were associating a lot of our risk response with the creation of our agency transformation or agency reform plan.
So we were really lucky in that we could link the risks and the association of risk mitigation to the transformation plan. Right. And we are grateful that we're starting to see some of that activity now. Our senior leadership is kind of moving forward with addressing those risks and transformation at the same time.
So I feel that our program is making an impact. And to what degree does your program get directly involved with the response that different risk stakeholders have in the agency? What's your involvement specifically with that? So for the most part our involvement is coordination.
We bring folks to the table. But like I mentioned the criminal history check program, we own the policy for that. So we are actually leading the risk response. It's been a multi-year response effort that just happens to coincide now and align with our transformation plan.
But we are not only involved in coordinating the agency effort and bringing people to the table but will be involved in actually implementation and making sure that we're measuring for success. Right. Well, and so something I'm thinking about if you all over if you're doing the internal controls and you're supporting the enterprise risk management program. Do you have any trouble listening risks from folks or do they not want to let you know what their real risks are?
What's that approach? Right. So we were actually reforming and revitalizing our internal control program at the same time that we were doing our first risk register and its profile. So we had no problem actually having folks kind of share with us what their vision was for the organization.
And I think that's one of the great ways that the team that was here at the time helped talk about risk for the agency. It's really talking about what is your vision. How is the agency not able to meet its mission or its vision because of things that could be getting in the way? We were actually able to pull over 700 risks from our agency and it was actually more of a challenge to kind of put that into smaller buckets that we were able to work with.
Right. So how did you boil that down to a small number of those approaches? So we kind of condensed things into theme areas and then kind of moved from there. We did our calibration against themes.
So we identified 19 key themes that we saw giving rise and then we allowed senior leadership to do the final risk risk prioritization. Right. But again, we were timing that at the same time that everyone was going through agency reform and it just basically was able to dovetail. And we were able to present senior leadership that was coming on with a new administration with an opportunity to kind of address things, challenges that we've identified for them to help us all.
Right. So you're saying this is the first time you're getting a profile together, right? Right. So how do you envision leadership using that or the lower level of work that's just going forward on an active basis?
So I think it was ERM 1.0. We were looking at ERM 2.0 going forward and really rethinking how we capture risk from whom we capture risk and how we associate risk with risk ownership or risk mitigation ownership. So I think we had a number of lessons learned. I think we cast a wide net this last time.
And I think we'll be doing more about departmental focus this time so that folks can more distinctly associate risk with their department's ability to meet the mission rather than just casting the wide net of the agency's ability to meet its mission. Right. That's good. And static curiosity, what percentage of the big, you know, the prioritized major risks would you say were in the financial arena or were it was a spread across the permission areas?
I think generally, I mean, it was overarching, you know, ensuring that we have a strong risk or financial profile or financial management profile. But I think a lot of our risks were in the larger enterprise buckets, which was surprising and I welcomed it because it meant that the even agency employees were thinking from the top. You know, how do we align our size with our mission? How do we serve our customers better from where we are located?
So it was a great, it was just a great opportunity to see how even folks who are involved in the transactions can really see how the enterprise as a whole could improve and better from ERM. Right. And actually that kind of leads me to my next question related to, you know, how do you help spearhead some risk efforts, especially in things that are at risk areas that are not financial or your specialty, obviously. But, you know, what are the challenges as far as that goes, just kind of making sure these non-financial areas that they're really involved in this?
Well, I think our agency is very keen on, you know, using the input that we've received from GAO, from our OIG. We've had some interest from the Hill and some of the programs and the operations of our programs. So we've been able to use, you know, some of that inspiration and kind of forward movement to guide us into thinking about risks that are operational in nature. And like I said, this criminal history check program was one of them.
We also have a number of other activities that, you know, our members, we have to be careful that our members don't engage in their called prohibited activities. We were able to kind of think more strategically and enterprise-wide about how we address those. Right. So, I mean, I'm a vice for a risk officer.
I mean, you know, what seems like using a little bit about everything. The agency does, I mean, you can't just have one, you know, specialty area. You kind of really have to get to know your agency very, very well. I mean, what would you recommend, folks?
Absolutely. I think that's the key. It's not only the key to, you know, your own personal success and being able to feel like you can address the issues, but it's also for the success of the position, for the agency to know that you're engaged and that you understand, and you understand their association to the mission and what they're trying to do. I think it's, a lot of agencies like mine are just starting off with this new position and really trying to push forward with ERM and push forward with, you know, tiny enterprise-wide culture to your internal control program or your other risk testing programs like improper payments.
And I think it's just really taking the time and the space to just get involved and to listen, to get on those email chains and just follow them through to the end and make sure you're reading those reports. Another way that I think you can be involved and you can understand your organization is really to get involved with those who also have an external stake in your organization like the IG. All right. And I think the IG's reports provide some insight into what, you know, others are seeing in your organization.
It's not all about, you know, what I think the organization can see about itself but what others can say about it. Right. And so, you've been working with IG with risk management for you guys. Well, our IG has actually been very involved in the launch of ERM.
I think she's been an avid speaker through the Association of Government Accountants and has been present and active in the Association of Federal Enterprise Risk Management. And she understands the world that we're in and quite honestly, I think this is the world that IG's have been in all the long, right? You know, they do risk assessments of organizations and try to understand where the highest risks are and have been inspiring organizations through their audit findings as inspirational as they are to really think more strategically and more broadly. But I think even if you just go one audit at a time, you can find yourselves going right back down into the details and going mostly associated chasing the dollars and again at just taking that big, broader view.
But I think in working with the IG, it's really having, again, that connection. You had to work with agency leadership to really understand the mission but you really have to work with your IG and we meet periodically, biweekly if not monthly, or very committed to that. I think if either one of us are not in the office, we will make it to that meeting so that we can connect and just talk about, you know, what's on our minds, what's keeping us up at night. So is that a, what type of meeting is that just that specific, just between you two or is that something broader?
Right now. So right now the IG and I, we have biweekly meetings. So other than standing meetings. But we also, she meets with senior leadership as a whole.
We have periodic meetings like that. But I think it's really making sure that you've developed a level of trust. I think that's the key to enterprise risk management is that the enterprise trust that you are going to use the information to help inform management decisions, that the agency trust that management will do something with the information and not reprise against the information that shared. It's having that trust with your IG to ensure that you can talk openly about risks in a way that isn't, you know, setting yourself, yourself up for some sort of a failure.
So I think we're in that stage at federally where everyone is trying to establish that level of trust. At least for five years, it's almost like the first five years of marriage, you know, who's going to do what and when and how, how do we, how do we share our concerns in a productive way that we haven't hit that, that status quo. That's early stage, right? Yeah.
So, and I mean, I talked to some agencies that their risk list is open to everybody. IG sees that everybody sees that, you know, it's kind of one extreme in some places. They just don't want to share that at all, the IG or others, you know, I don't know where you, where you all are and that's, and that's somewhere in the middle. Somewhere in the middle.
Somewhere in the middle. Somewhere in the middle. What the risk profile, what leads to the risk profile, so they see all the risks all the way up. Right.
We definitely do mask information so that, you know, folks can feel free to open up, honestly, no fear of reprisal there. We share with our IG the final, the final final, the risk profile and how we got there. Okay. And we're just providing periodic updates to everyone.
What are we doing with it? Again, it's that level of trust. Are you going to do something with the information I gave you? Right.
So do you find that the IG is kind of what they consider the big risks are pretty similar to what you all have come up with or do you see big differences? I don't and I hope there wouldn't be. I would imagine there could be, we would each look at each other's list and say that there could be more or less on each. Right.
Things that nobody knows are. But I think again in these early stages you have to take the one or two or three big things because it's hard to tackle. It's hard to bust through and do that first risk mitigation until it becomes just more part of your normal business routine. Right.
And yeah, I just work with IG actually and I think one thing we always wanted to see was that if folks did have some kind of a risk program that they are actively using it, taking action on things and finding problems, fixing the problems, you know, kind of common sense things. Absolutely. I think the years before the ERM was a big of an issue as it is now or an idea, agencies did have ways to do risk assessment and things but it wasn't always transparent to the IG or even if they weren't sure what was going on. Well in addition to the IG's you have your audit community, right?
Right. So your FISMA auditors, your financial statement auditors, your IPRA auditors are all coming in. And I think we're starting to see a level of interest in the specifics about how you're running your program. And I'm sure that's feeding up again to senior leadership and to the IG's.
But all of this interest and support for this type of risk-based thinking and decision-making has been helpful. I think a lot of CROs are probably feeling the support of that. Right. Let me go back a little bit to the interaction between the ERM approach and internal control work you all do.
So I'm sure you're familiar with the updates today, 8123 A and non-proper payments updates. So it seems like everything is going risk-based, you know. So what are your thoughts on that? How do you think that, you know, how do you think, take a risk management lens and apply even more so to your internal programs now, you know, the proper payments and all these different areas you're looking at?
I think specifically with internal controls, we really need to be mindful that it's not just risk-over-financial reporting. We have to look at all of our reports. Right. So how did you come up with that AFR or annual management report?
How, you know, what were the controls and developing those reports? What are the controls and the things that you put out for public notice? We are grant-making agency and we do put out a number of documents that inform folks of how they can get to our money and looking at what the control environment is there. So really I'm following some of that and then linking that to your ERM program by identifying what's most impactful to the agency as a whole.
Again, getting too focused on silos can be dangerous. I think that's where a lot of agencies have fallen prey to strategic or reputational risk is because they've just focused on one or two things that are very transactional in each or an easy to fix. Improper payments, again, taking that ERM approach, we've always retest the transactions. Is this payment proper or improper?
Our auditors are looking to see that we followed all of the specifics of PNICC. But what are the controls over the development of that program, the operations of that program? Are there proper quality control at every step of the way? So I think this is really going to inspire a way of looking at how we all do our work.
Well, even going back to how you choose what you want to review in a year. It used to be all these, you know, you have your major programs, but every three years you would kind of rotate. But now there's even more freedom on how we guys incorporated that guidance. So we're, I think we're at the beginning stages of really looking at what does materiality look like in an operational state of affairs.
I think it was very easy to just look at your financial statements and do some math to identify those key programs. And when you're looking at programs that don't necessarily rise to level of materiality, you're going to have to start asking your questions about the impact to mission and the impact of failure. Right, those are the impacts. I think it's very difficult to provide that information.
So I think it's taking that look at the, I don't know what it's called now, it used to be a Rubik's Q, is it an ERM, key makes? He likes to. Yeah, the candy strip, I think is a big calling. So we're really trying to figure out those questions.
And I think that would be a great way to partner with an IG office again, as to what is material when you're looking outside of the financial world. Right, I mean, you're actually right. The material for financial world has a specific meaning, but mission or reputation or things like that, you know, does that make sense to use that? Marometer or something different, it's more, you know, the impact of not getting your programs, you know, the programs are being successful or something getting out that was, you know, embarrassing or whatever, you know.
Right, so meeting your mission, not satisfying the statute, not satisfying the deliverables that are and the goals that the administration has placed on the organization. I think we all have to be mindful that our strategic plans are going to be directing us in new ways than we've ever been moving. Right, well, speaking of strategy, again, so you, how long have you, your program, how long have you, your program and your program have you been active at your program? About two years.
Okay, so you're still relatively new, but have you seen to any degree that, you know, senior leadership is starting to utilize some of this feedback to inform strategy or budget decisions or things like that? Absolutely, I go back to the fact that many of our risks inform the transformation plan and I think our transformation plan and the ways that we are going to move the organization in a new direction will be funded in accordance with the transformation plan. So I think risk-based decision-making on what the organization should look like and do next is very helpful for senior leadership. Absolutely, so I spoke to somebody a few podcasts ago about, you know, ever since they started the risk program, the CROs, physically getting pulled into these meetings they were never pulled into before because they want to get their perspective on, and there's this new program, which we'd be thinking about as far as risk.
You know, I don't know if that's happening to you at this point, but you know, is that something you might want to get more involved in, things beyond just the reviews or the, you know, the things that are more, you know, kind of mission focused or program focused, you know. So I think meetings are the name of the game and it's trying not to cut up into two meetings that you can't focus so much, you need to focus on. But I think our department right now is really kind of focused on the enterprise wide approach and a lot of the meetings that we get pulled into are really about those things that cross department lines. Yeah.
So it's really when there's multiple departments involved and where we can add value, that's where we go. Okay. I've had a couple more questions for you. Actually, what was related to, you know, corporations are relatively small.
So have you found that being a smaller agency, is that an issue or do you think, you know, you've had the resources you need for your program? I love, I have to tell you right now, I've circled the small agency community and I love being a small agency. Resources are always a challenge no matter where you go. It's a scale and scope is always what you're trying to keep up with, especially when you're dealing with a small agency because sometimes you need the numbers you need.
We are staffed appropriately in accordance with our size right now and I think we've been able to garner the support from other departments when we need it, you know, taking on detailed opportunities. We've had a number of folks who just came to us to help us from other departments just to help us stand up the program. So I think when you're in a small agency, you learn how to do much more with much less. That's the point, right?
And I think in many cases you have much more access to leadership to, I mean. Access to leadership, you have access to staff. I mean, the vast majority of our agency staff are right here on three floors in one building. So it's very easy to be involved and to get to know your clients and get to know your customer.
I think the challenge rises when you don't put yourself out there to get to know it. Right. No, yeah, because I've spoken with small agencies like FTC or Arctic Capital, I mean, they're ERM programming, they're speaking to the heads of the agencies. I mean, they're right there in the same building.
Once a week we do speak directly to the CEO of our corporation and our chief of staff and are able to share with her what we're seeing on the ground. And I think when we first stood up the program I used to present to the senior leaders, including the chief of staff, on a monthly basis, just what kept me up at night. And we were able to just inspire that conversation about, you know, what do we do about this and how can we do it. And we're able to make decisions right on the spot and affect them within hours of a meeting.
So that's one of the great things about being in small. That's the small advantage for sure. Because I know I was speaking with an NIH and, you know, they have like 20-something institutes and they're all over the country and it's just a very different approach to risk management over there. Absolutely.
They almost act just kind of an interesting one. They have these, so they call champions, which is a great idea, you know, to have them all the different institutes and all that. And then of course they're under HHS, another huge organization. So I think, you know, in a way for small agencies it might even be easier or, you know, you get more access than you would in these large ones.
So you can get your hands around. The former Appendix A approach to the SMC and SAT and meeting them, the Risk Assessment Committee and the Risk Management Council in accordance with the new ERM standards. But we like the approach of the champion and we use our Risk Assessment Committee members to be focused, you know, our ears and our voice when we need to spread the word around the agency. Right.
It's very easy to find yourself in a meeting where you've got a quarter of the agency there and you don't want to drain the agency of resources, especially in a small environment. Right. So that's why you use those folks to get that message out. Yeah, I got an approach.
And just one last question for you, just about the future. You know, what would you like to see in the next year or so for your program, you know, where your goals, how are you trying to grow your program? Well, I think we're just trying to make lightning strikes twice in each one of our programs. So it's really, it was one thing to get that.
It was just a Herculean effort, right, to get that first risk, registered and misprofiled together and we're trying to find ways to streamline and to ensure that that information is right timed. I think that's often the challenge when you are small agency, folks are very, very busy. They're multitasking all the time. But it's how do you get that information to them in the right time?
You know, we're all fighting for the September 30 year end and you find that you're stumbling over the auditors or stumbling over folks who are trying to get, you know, 930 information into the system. So our goals for next year are to be more right timed. And then to, I think the theme of AGA or one of the themes I took away from AGA was really to start thinking about how to move away from that low value transaction work and bring yourselves up to more of that high value decision making work. So how can we work with our customers to get them the type of information they need on a quarterly basis rather than an annual basis so they can make some strategic decisions about how they're going to resource what they're doing.
Right. Great. Well, I'll put a pitch in too. Hopefully we'll see the A firm summit this year.
You're able to get there. Alright, great. Well, Laurie, I appreciate it very much. We enjoyed having on the podcast and good luck with all your future endeavors of the program.
Well, thank you and thanks to the Association of Federal Enterprise Risk Managers for being so involved. That's our show. Thanks for joining us. Go to A firm.org, use the other podcast there.
Keep a lookout. We're always posting new ones. And until next time, this is your host, Paul Marshall signing off for Chris Chats with A firm.