Hello and welcome to the chat with a firm. I'm your host, all Marshall. All right, well today we have a panel of folks that we're gonna cover a very important topic in the ERM world and that's training. So, you know, different approaches to training from different perspectives, kind of like the sea level and then middle management and then the users themselves, the learners, and to do that we have some great guests.
I'm gonna start off here. Why don't we say hello to Brad. Welcome back. Hi Paul, thanks for having me.
All right, and just as a reminder, give our folks a little background on yourself. I know you've moved around agencies probably since one of the times we had you on here before. Oh, absolutely, yeah, thanks. My background's been in ERM across agencies.
I started Department of Energy. I was at EPA for a while now I'm at Federal Aviation Administration as a regional environmental program manager. And I also lecture on this topic at Northwestern University on an edge on capacity. In my FAA role now though, however, I tend to be supporting statement governments known as sponsors on ERM.
One important note when we get started, everything I'm saying here today is just my own opinion in the citizen brand, either FAA or DOT on Northwestern, but I'll work to bring those contacts where I can. Awesome. We also have Gervondra Sanderland. How are you doing today?
Hi Paul, thank you so much for having me on your podcast today. So I've been in a couple of different agencies. I've been doing ERM probably about 10 years now, most recently at the Environmental Protection Agency for the last year and a half. And I've had the opportunity to stand up some ERM program at the US Department of Housing and Urban Development.
I'm looking forward to our discussion today. Additionally, I'd like to piggyback off of what Brad said as far as, although I currently work at the EPA, these are also my own opinions and views on ERM and not representation of the environmental protection agency. Absolutely, all right. Well, great.
Well, let's get it going here. I think we wanted just to start here, because we're gonna talk about different perspectives, but maybe Brad, do you mind kind of giving us that you would say the C-level perspective might be kind of that C-suite? Yeah, so one thing in working over time with Gervondra across agencies as well as with colleagues like Tamika Edwards at state, we've encountered a lot of interesting perspectives as far as the importance of policies and processes from the C-suite perspective in particular. And I say discussing the importance of processes and policies from a C-suite perspective, but I'm really getting added that there's a clear champion.
It's not enough just to say you have a strong control environment, it's not enough to say that, like there's a policy in place, but that really at the end of the day, your entire group of executives in the C-suite leadership team, the C-suite leadership team are actually working to advance those ERM policies, procedures, and compliance with them throughout the organization. And not only are they supposed to be doing that, but ideally they're showing value proposition. And one thing that we, Gervondra and I talked a lot about this across conferences is it's not just about communicating top down from the C-suite leadership team about the value of ERM as far as contributors and managers being a part of it, but it's also getting that buy-in and receipt back upward from contributors and managers in that space. And to these entities, it's really important to have a human center design and focus to make sure we have that human element, and that we're thinking through all of the ways in which champions can lead an ERM team, not only through policies, practices, and compliance activities, but also through education and training, with managers and contributors, and how contributors and managers can inform the senior leadership team in C-suite about things that need to change.
And two of those ends of change, it's really important to think about flexibility, and need to be flexible in training approaches. And one thing that will come up a lot is about an answer to a little bit later, is different generational learning styles. For example, it used to be a standing expectation in the federal government that if there was a policy or order, people were trained on it and it was followed, and it was always kind of taken as a given. As you were a generation such a workforce, there's really an emphasis on live documentation, live on the job training, making sure there are refreshers and recurrences in training.
And so one thing we're gonna highlight a lot about is the need to have a lot of different modes of communication and methods of instruction and training for folks on an ERM program, so that they're really well aware, and you can document their awareness in multiple different ways that are understood at different people within the workforce and their needs. Jomondra, I know you got a lot to add here, so I was gonna turn it to you. Now, thank you, Brad. Now, those are great points.
You really definitely hit some key points on training, and the various options that are available when you're thinking about your audience and the needs and expectations of those folks as in your audience. And so we talk about the different approaches to training, and some of those pros and cons that come along with those training as you present them. Often, I know at EPA, previously we did a lot of large training events across the agency where we have groups of folks, and our risk management community that would gather and get trained on what the expectations were annually for enterprise risk management and risk management as a whole. I would say the pro to the large training sessions is very leadership driven.
It allows opportunities for folks that are in the room from different subject matter expertise to ask questions that others may not have thought about in an individual style type of training. It opens the floor for other offices and subject matter experts to share what they're doing with their near functional areas, as well as at the enterprise areas, to capture risk appropriately. So that's one of the things I would say that would be, well, if you think that would be pros to doing those larger training sessions. And then the downside to that is that oftentimes, because it is a large group, I would say a con to that, is that people may not speak up, and they may not ask questions out of fear of thinking that a question may come off to not be the greatest question, and it doesn't allow to hone in on some of the specific needs of those offices.
So what I see to struggle at, I would say with a struggle with the EPA specifically, sometimes connecting the dots between program areas, risk versus those daily operational risk. And oftentimes folks get a little confused on risk management, enterprise risk management, specifically just thinking they only focus on maybe financial management risk, and not thinking about those risks that are truly going to prevent them from achieving their program objectives. I don't know if you have anything to add to your bread. Oh, absolutely, no.
I mean, I think that's just a great way of taking it. And what's really interesting, Paul, is when it comes to risk in your leadership, they usually like the large training, because it's a way to really emphasize the importance of other policies and practices and compliance efforts in one room. So like Javondra mentions here, and I hardly agree, people aren't necessarily comfortable in those locations about speaking through the details or having the nuance or detail that we would like to see, or they may miss key risks in the process. It tends to be that we end up focusing either on the financial risks, like Javondra mentioned, or strategic risks about thinking about the other operational risks that might feed them.
And it's just like a huge issue to consider. So on the other side, the other piece we supported is that it's really helpful, and getting into those greater details at a leadership and management level, but has the challenge of being too resource-intensive and leaving out contributors is that workshop, which is kind of the next player down. And there we found that while it is useful to have senior leaders and managers in our room together to work through risk issues, if the contributor is un-included, or the workshop is too resource-intensive, it can get lost in the shuffle of things, in the sense that people either over-invest and miss on risk detail, because they're so focused on that agenda, or providing the risks that work best to them, or they miss out on contributors as well, because they see the leaderships that venue would not run for detail or contribution. Javondra, you've seen us too, across different workshops we've done together.
Yeah, very true, especially when you hit on the resource and since this, I would have to agree, because a lot of times, safe for instance, human capital, unfortunately, that tends to be a risk for almost any agency, federal agency, and even some private companies, right? I think where people get hung up on and find difficulty is actually honing in and realizing that, despite that, unfortunately, sometimes you have to accept, and actually thinking about the mission of their agency, and what those risks look like, as far as them not achieving that mission itself. So you hit that right on the nose with really being resource-intensive at the con, and just thinking about the next level of training type that we've offered and Brad and I've worked together, heavily on this, doing office hours, right? And this gets to a more individual, a step forward.
And I found that it'd be very beneficial a lot of times, because you can work with those offices individually to kind of walk them through what their risk of self-mission look like. Thinking through those risks that they have control over within their functional areas versus some risks that may potentially affect them, but they're not the true owners to officially have the ability to appropriately mitigate those risks. And what would you say, Brad, would be, do you have any pros, I'm sure you have some additional pros that you can add in to that. Oh, and office hours, I think everything, like all the above, like you mentioned, but then, also one thing I've learned from office hours is it allows leaders, managers, and contributors to all of you there where needed.
It's easier to phone a friend in that circumstance and it allows for the flexibility that a lot of us senior leaders are looking for, as far as how we provide technical assistance. What's interesting, what I found over cash, months of applying this, everyone requested it. Senior leaders really liked having office hours because they could direct their managers, contributors, even themselves there. They didn't see it as a value add, even though most of the value added in their reporting was through the office hours dynamic.
When we were reporting back on end of year findings, we almost always re-centered workshops for larger meetings when in fact it was the office hour follow-ons that were the place people benefited from. The most, the only kind that a lot of people would mention was office hours is there's this odd resource intensity that everyone wants their own special time and you as an agency working through how you were being so happy curating that space and time can be a challenge. We worked out, I mean, I think it's a matter for us, like I don't think we had a challenge on that, as like others would. But if you're a large department with many bureaus, you may actually have to run separate office hours because how your bureaus or administration operate, you can't have them together.
We could mix ours pretty easily. And that's a great point. I think what was helpful for us was having a good community of folks that, they were pretty good with scheduling, having the ability to kind of schedule those office hours one on one time with the individual program in regional offices as well. So I think you definitely hit that on the nose with if you're an agency that operates off of bureaus, that can build bureaus with them so they're pretty large, right?
So I can see how that could be very labor intensive, trying to coordinate those efforts or trying to find the right time with the right folks. So coordinate those efforts, so I'm just trying to think through some of the things that were additionally beneficial for us with those office hours. Well, it also allowed a lot of off ramps which I've never looked at, it's one on one, right? I mean, we can get to that one, but that's another good positive that we've had.
Yes, yes. And that worked really well. It worked really well because you can, again, do the hand holding and really work with offices to appropriately identify risk and risk responses and facilitate the conversations, and ensure that they are putting the right mitigation strategies in place and things of that nature, so that those 101 technical systems are, they typically work out very well. Absolutely.
And it leads to our last major in-house opportunity, which was working one-on-one with contributors and managers, which has been great when we can do it. Unfortunately, you start to lose how those pieces of risk information together is hard to keep your training consistent to, we should have probably highlighted earlier in the podcast that not only are users to collect data for also using these ways to train folks. And once you move off of office hours into one-on-ones, the consistency of training can diverge, or your training becomes so bespoke to one group. It may not be as transferable as you would like it to be.
And that's something that across agencies, Gervondra, Tineka, and I have all noticed. Though I would highlight too that even within offices or bureaus, this could be a real challenge when you start to go one-on-one watching our permission creep or policy or practice changes or specificities that are actually in documentation. It would become kind of a native way of knowing how to do something that isn't documented. So the one thing that we would highlight is that for one-on-one technical assistance, especially when you're going as a VRM practitioner or a manager earlier in the VRM shop, if you're going to provide technical assistance to offices one-on-one, particularly with their main point of contact to make sure everything has a high fidelity to your general training.
So that you're not just giving them unique passes. Gervondra, I know you've seen this all the time, especially at the point. Yeah, definitely. I would totally have to agree with Brad on that one, but the confidentiality and things of that nature, you really have to be careful.
And you want to open the floor for people to feel comfortable and actually speaking up to share what those risk are through their offices. Oftentimes, I think folks may fear, if I speak up, am I going to get in trouble? If I say this is a risk? Or if I say it is a risk, is that going to look bad on our part?
I'm not realizing that it's a good thing, right? It's a good thing you can identify risk appropriately and just try to address them. So they'll come a big issue, especially in the federal space. We're talking about the funding and things that are appropriate for agencies and how you handle those things.
You want folks to speak up. You want them to feel comfortable sharing. You want others to feel comfortable sharing their knowledge and expertise when it comes to that arena or that specific subject matter expert, excuse me, subject matter expertise that they share. And moving away, I think that we have gone to conferences.
All right. I'm talking about conferences. Yeah. Yeah.
I think, often, it's not going to go even for, and I think I can see for you, Brad, for a certain extent. Isn't it helpful on collaborating and having conference opportunities? Is there beneficial to sit in on panels and share knowledge, learning from other agencies, and how they have matured their enterprise management programs? EPA were still working to mature hours.
So I found it has been beneficial even with Brad as it moved on to aviation. We still collaborate, right? We don't got ideas off each other. We share our experiences in just helping each other kind of work through the maturing phase of our program.
So being those conferences, faces, you learn different key assets of ERM. The system management data analytics, the different data analytics tools that are out there and that are available for agencies to use. That's been extremely helpful when you have attended conferences as well. But the overall knowledge guarantee is definitely.
And it's great just for seeing where there's consistency across our federal family and where there is. And as far as references and all people are always wondering, where are some great external trainings to get me started? There's one trainer who's been out a lot. I think Ker west has a presentation with that, where it's connected.
But Vanessa Matthews at Svalice has really talked about things you should share conferences and things to think about as you're leveraging any of the tools that we've talked about here for training and education or just collecting your data today. Whether it be a large training, a workshop, office hours, technical assistance, or a conference, you really need to be mindful of what Vanessa Matthews calls the four P's. I love this. She just has a presentation quite frequently for new P's.
Her work at Svalice really focuses on this, though. And the four P's are policies, processes, playbooks, and practices are SOP's. And making sure that you not only have the value proposition and the human center design elements, you'd measure communication both top down and bottom up is correct. And it's not only about just having trainings and training for us, whether it be sessions, workshops, one one.
But you need to have policies that are documented and clear, and that there are processes for those policies. And then you'll playbooks at this best tactics, and then really getting into the SOP dynamic and how your contributors make sure we're accomplishing everything we have in our documentation and it's done correctly. And so, I know in our implementation of the four P's, there are some aspects of the four P's that cross agencies and we joke that different agencies are missing. Different ones.
For example, a lot of these agencies I worked with are missing the little P's. Like the SOP, but they have the other power. And I know you can't do that. That's an excellent point, Brad, because I often see that where the SOP's are not clearly defined.
You've been used to just trying to either just do something, figuring out how you go, but no actual formal documentation of policies and procedures that can consistently be performed so that we're all on the same page, when we're documenting things, we're all on the same page, when we're discussing these activities, where ERM. And speaking of policies, oftentimes what I find is that the governance structure is lacking, right? There's no formal documentation on even what your framework is, who's governing the ERM process. So I need to actually look more into the next method.
I love these. The four P's, I think those are very key. I think that definitely well-defined some of the key items that you should consider when you're appropriately maturing and documenting your enterprise management. So thanks for sharing that, Brad.
Oh, you're welcome. And the other thing I find, you know, Gerondra, you can't hit on it here, there's a unique spectrum, Paul, to of like hierarchical structures versus adaptive. And you've even sought across offices, when Gerondra and I work together, we see across agencies and we're at conferences, like there's something that have great overall policies and orders, and they're super hierarchical, and it's documented at a high level, but they don't have the adaptive networks or support structures or staff to make the work actually happen. And then the other hand, you have a lot of places where there may not be like an agency-wide policy or process, but there are adaptive networks that have amazing skills.
Like you have resumes that are making like actual P's the ground level, but just aren't recognized beyond them. And there's people in between, but it seems to be people either specialized in one or the other, rarely have ever to be brought up both, unless they're at a really, really high maturity level, after like many, many years of investment. But one thing that we would probably highlight too, is that you really need to have a champion to make sure that investment continues. Otherwise, you're left with like Gerondra mentioned, a lot of policies in the governance structure, or a lot of activities about guidance from a leader, to provide them support when they need to accomplish that.
And now a champion is very important. Very important. So just a quick little follow-up here. So as far as a risk and that, and some of the four P's and all that, are there some, is that stuff on the internet?
Are there links out there? Or how would folks learn more about that? Yeah, so I know what's been asked on that to use this material, when it's been written back, she shared it, on their webinars, if they have the free webinar once a month. And I want to say they're all recorded.
And yeah, if you go to RiskConnect's website, they have her recordings there. And it's been asked on Matthews with one T, and her recordings are available at RiskConnect website. It's RiskConnect, K with no C, so R-I-S, K-O-N-E-C-T.com. And then if you go to, look through their recordings, you'll find her materials there.
Okay, yeah, yeah, we can add the link to the, to our podcast website too. And just another, as I was listening to you guys, observation kind of popped in my head, I don't know, if it's valid or not. When you talk about the different levels of training, kind of going from, I guess, conference would be the highest, most far reaching, and then agency specific, large trainings down to the one on ones and all that. It kind of feels like the top down, bottom up approach of risk management in general, right?
Because from the very high level, those are kind of like seminars, you're talking at people, that's kind of like the top down. Here's what our policies are, communicate. But then when you get one on one with folks, you get all those really nitty gritty details and training questions that can inform your policies. Oh, we forgot about this thing, we're informing your other trainings.
I mean, I don't know, what do you think, Brad? Does that pair a little kind of make sense? Yeah, I know I couldn't agree more. You sometimes may be more than one champion, so accomplish all that we talked about today.
One thing we didn't mention, but your comments just now really highlighted it. A lot of people focus on a champion, it's just one person, facilitating all the ERM program, or like, oh, it's that one T-3 person, but to your point about all the different layers of levels, sometimes you have T-3 leaders who work better and want to ask back to our project to another. And to then, I would just like mention that, like, you know, if one champion isn't enough to accomplish everything that your managers and contributors need, don't feel like you have to just have one. You may have co-leaders, one thing, especially our newer employees, especially younger generations, how, like, all the time, is that, you know, you don't need one leader, you don't need to necessarily be a leader, or a champion to be the only one.
And you see a lot more co-leadership dynamics. In the education as well, it's just risk-generation, information-generation space. So, you know, if you need more than one champion, or a whole support structure to make your organization work with everything we talked about today, I'll approach it that way. You can have an executive committee that covers all of this with different champions for different tasks, for all the tasks that you mentioned.
Gervondra, I know you want to add on that. Yeah, that is a great point. Definitely having some type of senior executive or as management counselor or some sort, that you have a team of folks to help guide the championship, so to speak, at their agency level. And I think another key point or opportunity is trying to advocate and demonstrate to the agency that they're the partnership here.
You may have, you typically have this overarching office that oversees the enterprise management program. But connecting with those other offices, it happens to understand the value added, and having ERM at the agency enterprise level, and the benefits that it will have from that top down approach to really hone in on the bottom level, you know, functional areas, and moving that information, and having to integrate it. Even when you talk about working with your partners at the district to planning pieces, those that do the policy making and so forth, ERM truly can feed into making all strategic decisions that need to be made and so forth. So, I think just connecting with those individuals and those offices, whether they are the identified champions or folks that just truly have an interest in advocating for risk management across your agencies, it's just having that value added, demonstrated I think it's very key.
Awesome. Well, just one last question for both of you here. I just want, I think it'd be great if just, if you could spend a couple minutes maybe just telling us a little bit more about anything unique about training at your agency, whether it's a challenge or a benefit, or just something like an anecdote, so that you can kind of share with the audience how you guys do training, maybe Brad, you wanna go and then Javondra can wrap us up with EPA? Sure.
I guess I'll hit on it from like an academic, or you know, FAA based perspective, the format, but it's like Citizen Brad, the way I would mention how we have unique training challenges is within aviation, a lot of the work is done through what we call sponsors. So, you're federally funded work, like which is a sponsor, which is usually a state tribal or government that takes on the work that's being funded and so, their ERM policy is really what's important. You know, we have our own, we'll incentivize ERM programs, we have our own ERM program, something across federal agencies, from teaching, one challenge is that it's sponsor dynamic, you have an ERM program at your agency, but then your funding state tribal government governments that may need to have their own based on your grant assurances, or based on your terms and conditions, and how you wanna oversee that, or how you wanna be involved with that, and we'll be able to agency to agency, but in my academic research work on this topic, I find it really interesting how a challenge I see, not only in the agencies in which I work, but across the government is like, how you wanna integrate or incorporate, or recognize enterprise risk management programs, that are from sub-government, that you're funding or supporting or collaborating with, and what that means for your own policy, and how you wanna recognize it, and getting back to those four P's, like how are your four P's gonna match up with what they're doing? And that's really a unique challenge, and it's gonna be growing with the whole myra funding, and with how many of the new congressional funds are going out there, we're gonna see more and more of that.
I think we spoke about it on a prior podcast of Mel Thompson, but it's just as well, but now it's not more, than we've asked. I know she's a CPA, but she has her own unique challenges with the new game and how it's structured too. Yeah, so I was one unique, and it may actually may not necessarily be unique, because I'm pretty sure there's other agencies that possibly experience the same. However, the way we're set up currently, and we have a team of folks, well, they are community of folks, that are liaison, that we work with between our oversight office, which is in our chief financial office, and then the program and regional offices.
And oftentimes I find it challenging to find the right people to be in those rooms in that community for risk, to appropriately discuss risk, understand risk, to data information back to their program offices, on the expectations of enterprise risk, responsibilities specifically related to like OMBA 123, and GAO, green book and things of that nature. So I definitely think it's having the right people all of them times can be a challenge. I'm pretty sure you also experienced that as well, when you were still around at EPA, but... Oh yeah, for sure.
And getting into that level of view with even more robots, like in my new role, I work with some governments that are getting funding, and so it's been thinking about you're having a totally different way, and I like how you're bringing it back up to, but what about the actual policies that procedures get to follow across the federal family? Sometimes you get so stuck working with your contributors or your collaborators on the governmental levels, you forget about the federal standards, you've got to really thread those needles too. And you may need a champion for that work as well, on that need to be required to all work. All right, well, it's been a great podcast, time just flew by, but I want to thank you both again for joining the podcast today.
And if you want to give us any little final words of encouragement or anything else, you want to say about the topic before we sign off, Brad, please go ahead. And not recommend continuous learning and growth mindset enough. You can't come into the ERM space thinking you're aware or you know or you don't need training or everything's established, even if you have great policies, processes, playbooks and procedures, you always have to be looking at where you can improve or you can grow and how requirements and standards are changing around you. If you come in to an agency with two stronger policies or procedures, you may get into a place where you don't think you need to change, but everyone needs to be growing all the time and you need to leverage your yearly, quarterly daily risk collection and risk information sharing approaches and activities and your training programs to really keep a growth mindset and continuous improvement, continuous growth and just continuous learning and emphasizing that.
I think that's an excellent point, Brad. If I would have to say one thing I think that would be very important with me to ensure that you are appropriately identifying a types of training based on whatever the level of audience that we discussed earlier, there may be some form of training that would be more appropriate at the C-suite level versus the types of training that would be necessary for those that may be a little bit smaller group setting, things of that nature. So just really paying attention to the audience and what their needs are and their level of understanding as well. All right, great feedback, great final thoughts there.
I appreciate you both and with that, I guess we'll go ahead and wrap this up for today. And again, this was Paul Marshall signing off for Ris Chats with a Firm. We'll see you next time.