Hello and welcome to Risk Checks with the firm. I'm your host, Paul Marshall. All right, well today we have some returning guests as we are going to have a fun discussion about some of the differences between federal and state and local ERM and a little bit about how they influence each other and to do that. I have with me Mel Thompson and Brad Graham.
How are you all doing today? You're well, thank you. You're welcome. All right, awesome.
Well, welcome back. I want to start off a little bit here and you know you all have introduced yourself in the past but I wanted to just maybe give me a little bit of background on your kind of your primary view of state and local versus federal or you know I know Brad has kind of touched on both areas and male primarily local but you know just your maybe high level before we get into the big differences. What's your background, your perspective? So maybe Mel, do you want to start?
Yeah, really Paul, our approach with ERM is really centered around local government with what I do in state engagement. So for example, like Brad is working on federal government in the ERM space and has observed implementation with other subnational governments. So we both observe different state differences in theory and practice in the ERM in these spaces really do this substantially different value proposition and accountability structure. It makes sense.
I know you're mostly federal but you started touching on the local space too, right? Yeah, I know. I mean, that was a great point. I just acknowledge the local government.
I've been federal most of my career across three agencies of urban energy, EPA, and their transportation out there today. And while these are my opinions, that was a better government. One thing I've done in those agencies is not only we're done federal year-end implementations or we're doing under measures management but then supporting state and local governments in doing ERM on their own, however it may be. I know and I have met through various associations, pre-mom rooms, association for federal enterprise risk management and work.
And she's coming up in the local perspective and I come up with some really interesting differences and decisions and how to incentivize programming and how to make it happen. And you know, we just have the interest and share insights to others and how to dialogue with the government. Awesome. All right.
Let's jump into it. I was thinking, Mel, maybe just some primary high level differences you seem to be breaking into some of the real key distinctions but Mel, what do you think are some of the high level differences? Obviously things like, you know, a 1-3 in the federal, is that a state thing, you know? What do you think?
Sure. Well, one thing that really became apparent to us over a different project in finance was that really state, tribal, and local governments do not face that same ERM standard, right? So OMB-A123 is a federal government basis. So to those end, ERM uptake and state and local government can be not only diverse but also very more limited and focused and sporadic at those levels of government.
You know, the thing is, as though increase uptake of ERM by federal government agencies in recent years plus the increase of increased federal brand dollars has brought ERM to the fore in government, in federal government and is leading to trickle down effects for state, tribal, and local governments. And really, that's where more of the discussion needs to happen is what getting granular to talk more about those trickle down effects as we start working together between different levels of government. Right. Yeah, absolutely.
Yeah, sorry, yeah. You probably have some real specific ones that you can share with us. Oh, absolutely. Everything I was talking about that still went up to me.
It was still in my reference, like the federal government as well as the federal government as well as well as the government as well as the federal government as well as the federal government as we had it. And so people are maintaining us all are managing with dollars everyone on the methamphetamine industry, according to my request, very important and important to me why because that's a lot of the work you do that, but let me know I know that's too now I've got to be a little bit honest, because I've never seen like three drivers or distinction for YP-R-T right now and in place and most importantly the only thing I've learned and to be as with that, I never got to slap Trump's arms and we've all been charged by a federal agency. Anyway, so you rarely ever have insurance discussions with federal levels, but at state and local, you're very concerned about insurance premiums, make managing rates those are about rating, and then a price of management is key on that, but it's always being a federal government constantly bringing up their own income out of the same way. And so as well as middle and learning that insurance is huge driver controlling premium costs and using high drivers management for that.
Huge driver prevention. I think about that. The statement learned to always, you know, thinking about that. The other financial incentive we saw was bondage with it.
You know, the FADs believe in race, funding is very uncomfortable. State and local governments are looking at private lenders. They're going to find out on these funds and banks, uh, and look at the enterprise management. It's hugely important for reducing your interest rate and getting the best possible rate.
So here you have insurance and violence. It's huge drivers on financial plans to have, you know, and have it. And these are drivers that are ladies who don't think about it because they're drivers that they're doing. So, you know, for them, one of these is what they are concerned about.
And that means the second big area of distinction is what we found that the driver of standard and that's, you know, preventative. So, do I have a 23 and obviously I'm having a budget direction because that's what the inspectors general are looking at as far as agency compliance. But at the same local level, there are multiple standards you consider. I mean, so do I have a 23 is great, real federal grants in any terms and conditions there.
But your external auditor might center on, you know, costo framework for your own or isopridic one thousand. And the math is probably most important to me. And now we're linking this all the time. In statement learning, your contracting out your external function, whereas most federal agencies are sector general.
And so, statement learning and travel governments are exposed to much more external population. From consulting and contractors and private sector, where it's exposed to costo and is over all day. So, they get exposure and long leadership on multiple frameworks and approaches. Whereas that is a really focused on one of the requirements, which is a 23.
So, you get a lot of variance in ERM practice at the state, like, local and travel. But what you don't see is a level of health. And this is a level of health. I think it's a key driver's perspective as far as why they do ERM.
Yeah. I mean, any high level response to that? We can get some of the specifics in a minute. Yeah.
You know, it's interesting because one of the things that we learned as ERM practitioners, and I think, and Brad, if I'm wrong, is that they say, well, you know, quality standards, you know, you guys have a 1.3. And, you know, we tried to blend more with hybrid to costo and ISO, whatever works for us. But, you know, you don't do ERM just one specific way. And I find it interesting because you guys are held at that standard, right?
There's certain things that you guys have to do and have to have those outcomes, but in the framework and everything. But it's interesting because we just have more about flexibility. And because we have that flexibility and it is very new for state and local, we actually struggle more because we don't have that directive. Because we have been given such a big white canvas to design ERM.
Oh, yeah. Absolutely. And, like, what does that thing at the top? You know, people have been doing different speaking events and working on like, we interact with the color, the color, the color, the color, the color, the color, the color, the color, the color, the color, the color, the color.
And, you know, it makes me do more research and improve my teaching than the color. But, you know, I'm like, wow, that's what I was going to think about that way. Like, what most people are going to do is apply with a circular and we are a instructor general, and as far as applying color, ISO, I think it's really on Sunday. It's not correct with it.
And so, like Malmention, you just need to reverse implementation, play-read, I'm a director's manager of the Rans, you name it, but it's basically really, really interesting to be. Yeah, and just my two cents. I mean, I was around some of the government agencies were just starting to implement this that mandate really cemented the direction of federal, you know, going forward. But, you know, we talk more about that.
I just think that's very interesting. So, Brad had a couple areas I wanted to get more of your perspective. So, kind of again, some drivers for, you know, federal and state and local. And I thought one that was very interesting is, you know, the federal government obviously got a lot of these grants out to state and local communities.
And, it seems like some of those terms and conditions can definitely influence how they do VRM out there. Is that right? Oh, absolutely. I mean, I think one thing that's really new is the important thing, the economic benefit.
With Bill and Hyra, we have programs that have 100, 200, 300% more funding on the government. And, you know, government employees are really focused on being good stewards of and internal controls and enterprises management. And, you know, just regular risk management for operational risk management are really key in showing the taxpayer our stewardship. And so, with this increase in funding, most federal agencies are hyper-focused on making sure every grantee has a risk assessment in place.
It isn't, anymore, to see agency and ask for risk profiles across the enterprise to make sure they've gone through probably managing dollars, particularly if a new program or a state standing company program. And, I think most of the local governments are getting paid past through a federal grant as well. You know, it isn't going to be strange for a state agency or a federal agency to be looking more at the schoolhouse than they had in the past. Just to document that we've been thinking through all the potential risks to spending with new employers.
It might work with student programs for each other. So, for example, managing any new implementation challenges, making sure the enterprise is well situated. It has a strong reputation going forward. Those are things we're really looking at.
And, again, for state local, it's more of a federal, but it's still in my way, started. Part of my way, it's still in my way. It's still in my way. It's still in my way.
It's still in my way. It's still in my way. It's still in my way. It's still in my way.
It's still in my way. But the whole of this program, it actually changes the year-round's been further implemented than that. Then, there's just new and less of money. So, you're seeing federal, year-round, applied because of this other enterprise-wide management.
Actually, it's just people are going to talk to you now for AI. It's like a red one. Yeah, so definitely some influence coming down from the federal side, especially with the requirements they receive. I found another interesting one.
Some of the private sector environmental things that are kind of, you know, private sector is having to report on sustainability and things that are working on the AI programs and other things like that. So, what are some of those private sector drivers? We know, in terms of in here, this is a crock layer. It's an important thing now in our colleagues, and I have been talking about is, you know, with where green financials go in, financials go in, sustainable finance, environmental and governance frameworks.
And even DIA frameworks, a lot of people are asking how we're managing risks. You know, one thing that always comes up is, the ESG at the end of the day is a type of risk management framework, just like EIA, consumer banks. So, you have these in helping organizations manage their risks. But as ESG, EIA, sustainable financing, there's very much the idea to have mature over time.
Private sector consultants are really emphasizing the use of ESG, EIA metrics and enterprise management, and really trying to bring to unify the frameworks. But a really good example is projects on the government's big government and federal grants. We're just also a private investment component and private investors are looking to get credit for their nothing. The question number really works, whether it's green investing, doing sustainable things for a metric in a corporate responsibility, or even for a climate variation.
We're showing results there. These are all things that are driving investment and driving ERM on the investment in a shared risk, and I get that in any way spent, is showing results and getting for the risk. And now I know you're seeing a full level all the time with a lot of things. I know you have a lot going on here, because I'm sure you've been talking here.
Oh, yeah, you know, I was just on a call just yesterday, and we were talking about municipal bonds and what we're going to be doing, and how they relate to green bonds and climate bonds and social bonds and sustainability. And it is really fascinating how we were seeing ESG and ERM starting to really work its way into many different facets of state and local. And I'm getting calls all the time that, you know, somebody learning or experiencing something about ERM or might have to deal with environmental initiatives that we're working on. So it's fascinating time to be in state and local, because ERM is happening.
People just don't understand that's really what the framework in the process is going on behind things. So it's pretty great. Yeah, I find it fascinating. So I kind of feel like private sector or even international standards kind of tend to pick up the new stuff that's like environmental and all those kind of new things that are being tracked now, definitely overseas and then use all the private sector companies.
But then I feel like state and local governments are probably really close behind with the federal government kind of being at the tail end for whatever reason. But, you know, so it seems like there's a lot of, you know, there's stuff happening at the states and local levels that they're starting to really take into consideration, you know, the ESG and things like DEIA, even faster than like federal government. I don't know. What do you think about that, Brian, is that fair statement?
Oh, absolutely. I think it's back to what Malay is being with the local government as leaders on these fronts. You conjure up with like the insurance and bond drivers. You know, the green bonds are on the areas that didn't apply at the target.
So I know we've seen that ESG push really heavily at the levels required investors have bigger voice because of how funding is raised. So ESG has a big role in just general science-based targets. You know, some people need to focus on science-based targets, climate-based targets, pollution management. We see that across the board and to think about insurance.
I mean, I'll think that this is really clear. But, you know, if you want to manage your premiums more effectively, if you want to show your insurance company, you're thinking through your investments and we're getting to really get the biggest impact possible here, too. You're going to be thinking about different metrics, life, environmental, social measures that can reduce your risk, that you're close to. So it's just really, you know, I know you've seen that all the time, but that's part of your management of our choice.
Absolutely. And I think, you know, going off of what you're talking about with insurance, I think we're going to start seeing more such activities, more requirements from insurance company saying, how are you managing your risk? So I think there's going to also be, you know, that messaging coming down from the insurance industry thing. You know, you're not only filling out an insurance application every year to get coverage, but we also want to know, you know, what are you doing to look at your risk politically?
So I think that conversation is not too far away, as we approach the middle cycle in the coming years, but it's starting to happen because the market is getting more difficult in some areas. So, you know, it's probably one because of the hurricanes and fires and so forth. So, you know, they're saying, what are you guys doing at a galactic level to manage your risk and build those binoculars? And ERMs is a perfect example of how we can do that.
Yeah, fascinating how, you know, these natural events and things are obviously some of the biggest risks at the state, local insurance related and all that, so it totally makes sense. Well, so we talked about, you know, some of the federal grant areas, some of the private sector and things like that. So Mel's going to ask you and then, you know, definitely chime in Brad. I mean, how about some things you're seeing pressures or levers or drivers from things like what the auditors do, like internal or external auditors?
Yeah, it's really fascinating because I think that with the internal audit, you know, we've seen pockets of interest across the United States in state and local, but internal auditor, and then also we have external auditor. So those are your private sector accountants. And what we're looking at is really looking at clearly defined internal audit roles and how they work with ERMs. But, you know, I know, you know, working at the city that their peers are pop open and they wouldn't say something about ERMs.
So they, I think they're one of our largest supporters. And I think that's really where we can make a lot of grounded state local is working with our internal audit. And then as with the county moving towards increasing adoption of ERMs in the private sector, you know, we're also seeing that in the auditing field and internal and external, they'll be looking to apply these principles and really supporting a structure review of the organization. So that's really what I'm saying is that internal audit is really there just to help get us to the next level with ERM expansion throughout state mobile.
Yeah, but I'm building an open up point there and then with this right point, I really like what you mentioned about structured review because even at the level known, you see others, internal, external, reading, looking to see those risk profiles and risk assessments to understand how the best structure overview to make it as impactful as possible. And you know, I was seeing that as I was, you know, leaving EK and going into the OT that increasingly others as well as just like people interested in governance really wanted to see where risk were to inform their thinking and where to make investments and where to do important work. And it's really that I think I'm not talking about because in a lot of cases, the whole idea of whether it's a grantee to a federal agency or a federal agency itself is usually harder to really get people to work off. And with others not really looking at risk profiles and risk assessments much more than they had in the past, and actually it's a quad agency now in college that we've mentioned too.
You're releasing an increasing move towards structured review and focus review where we can use the risk resources to get the most impactful as well as possible. Yeah, and, you know, being a former auditor, I always joke with folks, you know, if you put something down in writing or policy or procedure, they're going to come looking at it. So, you know, that's kind of the blessing and the curse of getting more organized and getting all these policies, procedures, and best practices at your organizations and your government agencies. But it just means, yeah, the auditor's going to look at that now and make sure you're following your point, what you said.
So, it's a good thing. Yeah, and absolutely. But, you know, there's a positive to it. A lot of people focus on the negatives, but like, oh, you know, I don't want people to know about that, so I won't write it down.
But it actually helps you structure your thinking, what I was talking about. If you don't prioritize and structure your thinking as an organization, it's going to be hard to manage risk across your enterprise. And that's the only I've always tried to focus on. I'm sure I don't want to hear about that.
Yeah, it's interesting that you could bring that up as a state mobile. We are so spread out as far as the variety of risks. And I think that's where you're on to be a huge help to state mobile. And really, that's kind of what we're talking about is like resiliency, right?
So, when you hear state mobile, we're always talking about how can we become more resilient? And it's becoming more increasingly difficult because we are such a complex, hyper-connected world, right? That we have risks that just compound and they really do not, they're still there, even as we work through them. And so, we're really feeling that at the state mobile levels.
And we understand how deeply connected we are at all different levels of government, really when it comes to these risks. So, what may start as a national threat can cascade down to state mobile leaders who are responsible for keeping their community safe. So, for example, if you have a threat to critical infrastructure, it can jeopardize your clean drinking water for citizens. Or maybe you have a bad actor trying to take down essential services for residents.
So, regardless of whatever the scenario might be, state and local leaders are looking for those solutions. And they're searching for tools to help create resilient communities. And really see this in some of the proof of the literature and things that have been posted through different associations. So, you do have the National Association of Public Administrators.
And what they have developed recently is the grant challenges. And this is really a call to action to bring people together to solve critical issues involving resiliency. And so, now you can go to their site, but now they've posted an IBM report and it's called preparing government for future shocks. And in that report, it calls on federal government's health strength and state and local risk management.
And we're not talking about traditional risk, like hazard risk where you have flip trips and followers, insurance policies, or claims. We're talking about those uninsurable risks that face us and all of our organizations. They really can't transfer that into a contract in their third party. Either those big things like we deal with COVID and we're dealing with climate change.
And some of those things that we can't fully ensure. So, these risks are really internal that bubble up from within an organization or maybe they're external risk that are really headed straight for it. But this is where leaders, and I think really it's member of the firm specifically, because they have the field of knowledge can gear the call to action and start working with state and local government to start assisting. And this is really what Brad was talking about when we see these grant requirements, these account contractors, whether it be internal accounting or external accounting, and really looking at some of these other drivers and specifically resilient when it comes to the local community.
So, state and local leaders, they can start with resilience and hazard risk. That would be where I would tell somebody, hey, if you want to start with me around, start easy when you look at safety, right? Because every state and local organization has to keep their citizens safe and they've got to keep their employees safe. And so, emergency management is really locating fruit.
And there's many different examples of people that have started working with ERM and stay local with emergency management and operational risk. But we have to realize that we have those huge macro changes nationally, which these are the drivers that Brad had identified, that will be changing the landscape to put risk management in the forefront to help lead public entities in all different levels of government. And so, like I said earlier, it's really an exciting time to be involved in enterprise risk, to see these conversations starting to surface up in all of our different departments. And it's really fascinating to see.
Yeah, and we'll put the links on the slide there too, for NAPPA. And yeah, Brad, do you want anything else here? Because I think we're near the end. Oh, yeah, the only thing that's at NAPPA is increasingly increasing the meaning so much to so many.
Now, and I are lucky in that for most of the programs we support. We have a strong idea of the definition of resiliency there. If you're someone that won't want to stay or learn an agency, you're just sitting in that term for the first time. I would tell folks, just what is house defined for you within your elected officials, as well as your others?
And what definition are you being held to? And start your enterprise risk management work for resiliency with that in mind. And then you're going to have to broaden it. Because there's an outside between climate risk, insurance issues, bond issues, and like drivers were being done.
You guys think always agree about what resiliency would mean for your organization? It's going to be different to all of us. That's one of your own ways that it's going to be identified as a different structure and a broader management. That's right.
Well, I think I had to give you a final thoughts here, but I think, Mel, do you want to maybe plug again the state and local committee and what you guys are doing with the firm? Yeah, thank you. Really, people are interested in knowing more those that are either leading or part of organizations are just curious of how we see ERM expanding through the country. You can go to firm.org and look under committees, and you will be state and local.
And you can reach out to us to ask any specific questions that you have. We also meet once a month on the second Friday, don't quote me on that. But in the afternoon, if you'd like to network with others that are starting ERM programs, I actually just got three new people this week from around the country that are starting ERM programs in state and local. So, and everyone's joining us.
So, it's fascinating to see people starting to come out of the work to start, you know, putting it here to the ground. What's going on with ERM? And we're here to kind of bring everybody together, and then as we build and identify those that are interested in building a program in federal government where we start being some of those ties between state, local, tribal governments and looking at how can we work together, what are some of those fascinating risks, and really starting to learn what they've been working on for well over a decade with ERM and how we can work together. All right, definitely.
Everybody check it out a lot of things happening with that committee and firm this year. So, and then Brian, I was just going to say, you know, we have another podcast coming up about training. You want to just give a couple things that you think you'd like to discuss on that one? Oh, yeah.
So, I keep up. I'm just wondering if you're going to be doing a podcast with you all on ways to train off your staff on ERM. What do we found as well? And if you are really on the ball or really focused on the software on it, then make sure the data is being marked up.
One thing I've found is to try to train your staff to build their practice and, you know, to really help form an ERM workforce. I don't need it, but I don't want it to cross players in front of it. And you know, I don't think all that is really focused on ERM with the decision for federal directors management. While she's sharing that statement will go into your committee, we're always looking for volunteers to help train off the next generation of ERM professionals.
We'd love to have you know, matter of what, whether or not you're coming from public or private. And it's one thing we'd like to share in the podcast is tips and tricks for adapting your folks, whether or not you're a team manager, or someone's just looking to learn how to contribute to their own team. And if you're really interested in that field, like we can't come out with your statement, go, you have to reach out to me on volunteering. We'd love to have your leadership.
You can support us. Mel and I are looking at it. I'm trying to rebuild thought leaders and intergovernmental home system of ERM practitioners that can ban government, goals and risk management across the nation. So, moving forward to everyone.
All right. Well, awesome. Well, Mel and Brad, thank you very much. And I'll go ahead and sign us off your another great podcast.
And that was Risk Chats with a Firm and it's Paul Marshall signing off.