and welcome to risk chats with a firm. All righty, well, we have a fun hybrid podcast today. We got a gentleman in the room. We got a gentleman on the phone, and we got me as well.
So let's just start off here. So we're actually going to be talking about a little bit about the current state of ERM right now. We'll get into some topics. But first let's introduce our guests.
Why don't we start with Norbert? Thank you, Paul. Norbert Howard, I'm a partner with the 11th Hour Service. I lead their federal practice, and I manage our portfolio of clients as well as help with our business development.
And I do a whole lot of ERM. All right. And we got a return guest, Mr. Tom Brandt.
Tom, how are you doing today? I'm doing great, Paul. Happy to be here. All right.
Well, we wanted to get together and just kind of go over some fun topics here. And just talk a little bit about how are things today in a current environment. What state is ERM in? So kind of a high level topic.
But why don't we just kind of start with that? Maybe, Tom, do you want to? How are you seeing ERM right now? You're a practitioner.
What are some high level thoughts of how things are going right now? Sure. And I'm happy to sort of reflect on that. And share with you kind of what I've heard talking with colleagues and peers across the government.
And sort of how things have been going for the last few months. And it's probably no surprise that it's been a challenging period of time. And ERM programs have been among those programs where cuts have been made or they've been scaled back. We know that contract support has been terminated in many agencies, including support for ERM programs.
The staff departures that have occurred throughout organizations have also included staff from the ERM office. And we've also had instances where, unfortunately, ERM program activities have ended or those functions have been consolidated into other programs. And I think part of the unfortunate part about that is sometimes these decisions have been made without necessarily a full understanding or appreciation of what ERM and how it does and can add value for organizations. And I think in some instances, it was a reflection of people looking at names on an org chart and trying to determine what an office did or what a function did and absent really understanding for making cuts.
But regardless of how cuts came about and some of these changes came about, I think it's been a tumultuous few months that ERM programs are trying to regroup and figure out a way forward. Oh, and you know what? We forgot your disclaimer. You want to give us one of those real quick?
I'm sure, yeah. And I think I could just share that the views I'm sharing today on my own and not those of my agencies. Thanks, Paul. Absolutely.
Little wrist management right there. So yeah, Norbert, I mean, from the private sector side, what are you saying to me? Same thoughts as Tom here? What do you think?
Yeah, I'm certainly seeing the same things from the perspective of a federal contractor. And really, I think we can all kind of collaborate, if you will, to try to make the case for ERM. And I think we have to pivot and really communicate the value of the tool set that I'll call it a tool set, because it has a lot of different pieces to it. And I think, you know, as a world has become more complex for agencies in particular, ERM was one of those tools that really helps to keep that agency on track in terms of meeting its goals and objectives and the mission.
So I think there's still a critical role for ERM. And I think it needs to stay on the forefront, or we really lose something that was really valuable in how agencies ensure they're delivering for their stakeholders. So I think we really need industry and government to help us make that case. Make it clearer, make it more obvious what the ROI is for ERM.
And it's embedded in a whole lot of different parts of agencies. And we really have to work together and figure out how to put it back out front. Well, let me ask you both, because, you know, a couple things. So every time there's a new administration period, you have to kind of explain the value, right?
No matter who it is or what it is. And then, you know, do you guys also feel too that ERM, that function, that role, CRO, or that shop? It just hasn't always been super clear to folks. What is that value?
I don't know, not just the new administration, but it's the type of job that you feel like you have to keep justifying yourself. I don't know, Tom, what do you think? Well, keep in mind, Paul, that the practice of ERM in government is still somewhat new. The OMB circular really, you know, it did come out now nine years ago, but in government time, that's still somewhat new in sort of having a number of administrations over which ERM has been practiced, and it's integrated into the way agencies operate.
So, you know, I think, you know, the challenge that could have happened this time too is that typically, as administrations turn over, you don't also then have a significant amount of turn in your career. And in the people that, you know, the ERM offices partnered with, and who understand sort of the value proposition for ERM. So given in the current state, we've just seen a lot of departures from the career staff, and from a lot of the, you know, people that the ERM office partnered with, you lose that part of the equation that's helped to communicate and articulate what that value is, the VRM. So, you know, it's almost like double effort to not only try to rebuild some of those relationships, but also create and build a new relationship with the new administration and the, you know, the political and others that have come in through that administration.
You know, you always have to introduce them to, you know, the way agencies are operating and what they're doing and what ERM is, but there's an added layer now of having to, you know, rebuild relationships with the career level at a degree to which I don't think we've had to do that in the past. Yeah, and, you know, I was just thinking here, so I mean, that's happening across all different sectors of the government too, right? That's also very unique. So not only ERM practitioners, practitioners and finance offices.
I mean, you know, crossing the whole thing. So, you know, you're having, you probably having to make relationships, yeah, essentially with folks that were not in a position before or brand new. I mean, it's just so many different fronts that you're challenged right now, right? Yeah, absolutely.
And it's also, I think we've seen that, you know, processes are also, you know, being upended. Programs are, you know, changing or stopping. A lot of the governance is changing. So all of those ways in which ERM has been integrated into an agency's operations and the decision making.
And, you know, I think it's just the overall governance process who's got to have changed. So, you know, there's a need to be reflective of the implications of all of that. And then how do we position and still make ERM work in a very, very changed environment? Yeah, and just one more thing here.
I was just in another meeting not long ago and somebody else is also coming in for the new administration or, you know, under the new administration. And, you know, a lot of folks leaving, obviously institutional knowledge is another one, right? And then, you know, if you guys never wrote this stuff down, oh, well, it's kind of running out the door now, you know, that's another challenge. It's just a lot of challenges, right?
Sure, but that's why it's so important that we have policies and procedures and have those documents come there. Yeah, I know, that's the thing. Well, so then let me turn to the next question. So, you know, that's sort of the state of where we are.
And that's, you know, fair enough. You know, what can we, so now what do we do, right? We're still here. So how do we adapt to this environment?
I mean, you know, do you want to pick us off with that one? Sure, sure. I mean, there's still a place for ERM. I mean, I would, you know, listen to Tom's comments, I would agree.
We have to work a whole lot harder to pivot, but still stay relevant. And I think even more than ever, there's a place for ERM when, you know, we just talked about all the changes and the loss of personnel, that the people were carrying an incredible amount of institutional knowledge out the door. I mean, that's a risk itself. And some of those are ERM practitioners.
So the whole is getting a little bigger. But I think some of the institutional tools that we've developed over the years, some of the associations as well as the methodologies, you know, those things are still useful as a recovery mechanism to try to, okay, maybe there may not be a CRO. It doesn't mean we can't practice ERM. We can, you know, pivot to organizational components that have the most risk, perhaps it'll be more valuable to them to, and they may understand better, what the value proposition of ERM is to their particular programs.
I mean, if you think about across government, different missions, different objectives, some agencies are more public facing than others, there's, they have a different set of risk, and some are more high impact than others. So the high impact parts of an agency might be where we want to target ERM. You know, even if we don't have a CRO, there's still a place to apply the methodologies and the techniques that we're all experts in, effectively, and make a difference. Yeah, tell me what you think.
Yeah, so I think what's happening is where we are having to rethink how we're doing ERM and how we engage with our stakeholders and partners throughout the organization. And, you know, I think what that means is we can't just rely on what we've been doing and expect that that's gonna work. And in some cases, that's just not gonna be possible because, you know, some of the new people may not have an appetite or interest in, for example, doing a full-scale risk assessment. They may not even understand what we mean by risk profile or risk treatment plans.
So, you know, we have to figure out how do we frame all of this in a way that's understandable for, you know, our new partners and agency colleagues. And, you know, some of my peers have, you know, have talked about trying to undertake this sort of sensing effort to try and discern kind of, you know, ways in which they can help, you know, what are the specific needs, where are the opportunities? And through that, also recognizing that while there may not be, you know, interested in sort of doing traditional ERM, there may be opportunities to take and, you know, pull out pieces of ERM and slot those in, you know, to new opportunities or in different ways in kind of this changed environment. And I think that's sort of coined this notion of, you know, agile ERM where we sort of adjust our approach in response to sort of these evolving needs and this ever-changing environment that we're in.
So it's a matter of, I think, utilizing the skill sets, the tools, the capabilities that we've built up, but not trying to deploy those in the same manner that we've been doing ERM now for a few years. It requires us really stepping back, trying to really sense where the new opportunity and new entry point is, and then leveraging those tools in a different way to still try to help the organization be successful and achieve its outcomes. But doing that through what we might refer to as a more agile ERM approach. Yeah, that's exactly where I was going with some of my opening remarks.
And when you think about some of those techniques, continuous monitoring, predictive analytics, and those types of tools, they have a place in managing a large complex organization. Even if we don't call it ERM, it's still part of the tool set that we're very familiar with and has a tremendous amount of value for avoiding missteps and surprises that really can throw off achievement of a mission. So I think we have a lot to offer if we take the tools and the methodologies and really use them like a toolbox, which we kind of do that anyway, but I think we can break it into useful modules that can provide ROI faster, can show immediate benefit to the customer, which would be head of an agency, lead of a major component of an agency or program. I think there's a way to bring that value to them in a package that's faster for us to implement, and also produces ROI faster for the folks we're advocating to.
And I think we have an opportunity there that we may not have taken full advantage of earlier now. The door is open for change, so we can also adapt and pivot with the way we deliver ERM. We're still going to maintain our discipline and bring the same skills to the table. It's a reconfiguration, but we still are able to help manage risk and really help those agency leaders see around the corner and really avoid some of the worst things that can happen when you're caught off guard.
And we've never had more data at our disposal than now, and we have some incredible tools to interrogate that data and get these risks insights that we're really trying to bring forward and be proactive about mitigation. That's kind of where I see this going. It's an opportunity for us. Right, so not such a rigid, here's how we do ERM.
Every year we do this thing, this profile, whatever it is. We're just agile, quick, deployment of what are some very specific things that we know or resonate with the administration to get done, but still do that risk management, still be effective and be able to identify those major risks, but maybe just not the very rigid or structure that used to be done perhaps. Correct. It's really taking the tools we have and mapping them to particular problems we know are there.
I mean, we have a lot of historical data on particular types of risk related to particular business cycles or processes. So you have, OK, we know that a particular process has XYZ type of risk. And if you're not monitoring those risks, I mean, you're really kind of exposed to having some of the bad outcomes happen when you could have taken some really deliberate steps and either avoid the risk or at least be able to control the impact. So my next question, what do you guys think about this?
I mean, so again, I think administration neutral, sort of thing, any new administration comes in, or any private sector, new CEO comes in, whatever. They want to come in and get new things done, right? They want to change a lot of stuff. They don't want to hear, no, I can't do that.
They want to do it. They have new goals and visions and they want to implement them, so do you feel, how do you get your profession that ERM will to resonate with them, that this is actually going to help them? Is it like turning it more into, here's your opportunities? Or here's how you can obviously avoid failure of your new initiatives.
How do you kind of change the voicing of it to resonate better? Maybe, Tom, you want to kick us off? Yeah, I think unfortunately sometimes the ERM function and program gets branded as the Office of No. And that's really not the role or the intent of the ERM.
And if it's operating as it should, it's not the ERM team or staff or the risk officer who's making the decisions around whether or not we do something. But what they're doing is they're bringing information and data and insight to those who are accountable for those decisions to help them understand kind of what some of the implications, options, outcomes, whatnot associated with those decisions. And then hopefully equipping them to make better decisions that have considered the risk and by doing so, position them to actually be likely to have greater success in delivering on their agenda or achieving the overall outcome. So I think sometimes the ERM capability gets branded as blockers, but that's really not their role.
They can sometimes slow things down. And I think for those who might be used to just acting fast and breaking things and leaving it for somebody else to sort of worry about cleaning up and, you know, to clean up an aisle 10, so to speak, there isn't you to kind of rethink how do you, you know, rebrand ERM and risk the risk office for those, you know, folks, but again, and to, nor is point two, everybody wants to be successful in achieving what they've been, you know, tasked to accomplish or, you know, put in that role to deliver. And, you know, nothing other than a crisis can take you off course, you know, quicker than, you know, anything else. And so helping, you know, new leaders and new folks avoid those circumstances where they get distracted or, you know, taken completely off track because something, you know, some problem arises that could have been avoided.
I think there's an opportunity for us to again, say how we can help you get things right so that you can achieve, you know, those outcomes that you were, you know, brought here to deliver. Yeah, I would add to that. It's making it real for them, the folks we're trying to break through too, is okay, what difference will this make? And I've had some experience explaining to customers why you should prioritize ERM.
And, you know, it wasn't a trick question, they were asking, it was a serious question. And so I didn't use all the fancy terminology that I could use. I said, well, you need a way to see in the dark. You need to be able to see around the corner and make adjustments.
And if you can go left instead of right and avoid something bad happening, you know, that's the easy one. To walk right into trouble and not really have a plan, to not be prepared, to not have contingencies in place is really one of the worst situations you could be in. We can't control everything that's bad. We can't keep all of it from happening.
We can prepare for it. And it's really a form of insurance. And insurance against the worst thing in the world happening to your program or to people if you think about natural disasters, if we know something is coming, we're able to get out of the way. We're able to take preventive measures to mitigate the damage.
And, you know, that's how I was able to get through, breaking it down that way once to operate without insurance. Right. Well, and I'll leave you to my next question here. So, you know, some of the things that are being rolled out, I mean, there's definitely some major restructuring efforts.
You know, some agencies' programs are being changed or they want to change staffing, you know, all kinds of things. So, you know, this is something the RM programs dealt with before, right? Again, it might just be a lot more right now of a certain thing. So, how can you guys add to those discussions, you know, like, again, they want to accomplish some major program change or some major restructuring, you know, what knowledge, I guess, back to institutional knowledge, does like an ERM function serve to help them see maybe, because again, a lot of these folks are brand new to government, too, like, they may not know how, quote, things work right now and they might slow them down if they want to restructure this.
There's this law over here or there's this lease over there we got to worry about, you know, I don't know what do you think? Yeah, those are places where we can help, because it's stuff we've seen before. Right. This is not the first time an agency has been reorganized or the budget's been shifted around.
And, you know, when we look at the budget and how that's set up, we also contract risk related to that. And we have a lot of historical data to model and say, hey, this is what can happen if you don't take these steps to mitigate your risk. So, there's a lot of value us folks who've been around a while can bring to the table. We know what can happen and we can try to steer newcomers to government around some of those pitfalls.
And you think about, you know, things like agency consolidations, we've seen a lot of attempts to do that in different parts of government. Well, it's easy to move the people around. It's more difficult to move systems around. And reorganized supply chains and suppliers.
And when you think about two large organizations being put together, you have duplication. You have to work that out in a way that doesn't create complete chaos that really distracts you from your mission. You know, and people, you have to take care of the people. People have anxiety around change.
And that's an area that gets neglected sometimes. Even smaller initiatives. You've got to remember the impact on the folks that are involved or the pegs being moved around. That's irreplaceable talent in some cases.
Yeah. You don't want to walk out the door. Well, I don't know what I haven't thought of this before. But I mean, does government make really big changes?
Like, we're going to get rid of this department, that is department, this thing. It's almost like mergers and acquisitions, isn't it? That's right. It should probably bring some of those folks in and get some thoughts from them.
Yeah, Tom, when you think about that, what are your thoughts? Well, I think that it regoses. Because of what we want to accomplish, new leaders, careers, whoever, with any organizations want to accomplish, in order to get anything done, you're going to have to do that either through people, processes, technology systems, something. It's going to have to be used to get that done.
And what we've seen, again, as a result of many of these cuts and changes and things the last several months is that, in many cases, and we've seen new stories about this in the last few weeks, that there's a recognition now that, well, maybe in some agencies or some offices, we cut too many people or we got rid of the experts that we need. We've eliminated essential functions. You probably saw some new stories about how some agencies couldn't get time approved, because they let the time keepers go, or they couldn't fix IT systems that were down, because the IT programmers had them let go. So leaders in these agencies are now trying to figure out what have they been left with after all these changes, and trying to figure out now is what do they need to do.
So I would say as hard as it may be to swallow, in some cases, what we've experienced, this is an opportunity because we got to build something back. And we don't necessarily have to build it back the way it was. There may be a better way, we may be able to use this opportunity to actually achieve some of the outcomes we had attempted in the past, but we're unable to break through because of the way things are sometimes. But this is where an ERM office can help, because they can come in and help pinpoint where some of those vulnerabilities might be, help prioritize where we need to put attention to either rebuild or restore, whether that's a system, a process, a technology, or people, and help give a roadmap or a path to getting back to sustainability to deliver outcomes.
And I'm reminded of how quickly ERM offices acted during the early days of COVID to help their agencies do that type of assessment. After we had to send everybody home, process is stopped, we had to rethink how we're doing things, and many agencies, the ERM programs were the ones that helped kind of do those assessments, figure out how the risk could change, and where we needed to make changes as a result of COVID, thinking through the risk, how do we do that in a way that brings us back to a path to delivering, again, a program outcomes, et cetera, in a way that has least impact to our stakeholders, customers, et cetera. Well, we're almost at time, he seems to go so fast, it's crazy. But I just wanted to bring one more idea up here to discuss.
And in my opinion, in general, I believe all three is probably agree on this. I mean, we're not here to make policies, we're here to support whatever. Whoever's in charge, we're here to make them successful, that's our job. So I think one of those techniques that might be interesting that risk managers might want to offer up is the whole idea of scenarios and I don't know if war gaming is the right word.
But like you mentioned COVID, I'm sure risk managers were involved in just some scenario planning, what if this, what if that? I mean, what do you guys think about using techniques like that, again, to maybe help administration put in place? There are goals. I don't know what do you think.
But there's certainly some tremendous potential there. And it kind of goes back to what I mentioned earlier. Some of the tools we have at our disposal now, and our ability to take all types of data and make it useful. And if you think about the ability to model the impact of a decision, I mean, we can not just create a dashboard of KPIs and impacts that way.
We can do geospatial presentation of that impact. We know which ZIP codes are impacted. OK, well, who's in that ZIP code? We have all of that data at our disposal, and we can get very granular in modeling impacts to anything from funding cuts to natural disasters to policy changes.
You're able to see in pre-realistic models. Here's what may happen with a high degree of certainty that the model is pretty well-aligned with reality. So I like those possibilities. And it's another way where we can help bring ERM back to the forefront.
We have the skill set and the perspective to really put that together and make it useful. Yeah, tell me think that or other techniques that you maybe use to help folks out. Exercise is really important. And they don't take that much time.
There is a need to have a long-run-out process. And I think there's so much opportunity, because of all the changes that are happening right now and new policy ideas that are being floated, program changes, et cetera. It doesn't take that much time just to get some people together and talk through what are the potential implications. And I think something that resonates with many of the stakeholders right now is reputational risk.
And not only can we do this, but what's the reputational risk of trying to do this? How could this play out? What might the impact be? Is this going to get me in the news in a way I don't want to be, or are agency in the cross-seers unnecessarily?
So that's something that oftentimes isn't thought about. But again, if you want to talk about something that can derail an agenda, or a program, reputational risk being realized, and then taking up all the air in the room. So you can do a quick scenario exercise to think through those implications and avoid those unforced errors, so to speak. Yeah, and something I'm kind of taking away.
I just heard it in the room here in the last 30 minutes. We talked about new folks are here. They're going to understand the value of the RM, all this stuff. Well, let's not tell them.
Let's do something and show them. It sounds like what you're saying. Here's some practical things. We're going to help you.
We're going to be agile. We're just going to sit back and pontificate. You're so important. Why don't you listen to me?
Don't show up with the 50 page ERM playbook. Are you on time for the ELS training? It's more about, all right, we recognize here's something you're trying to get done. And we have a tool that can help a process and approach that can help deliver that to help the agency be successful, to help you be successful, and also at the same time to protect the brand and the reputation of agency, the administration, and the folks that we're working with as well.
All right, well, we're at the end. Maybe you guys just want any final thoughts or encouragement to folks out there? You know, Norbert, then I'll give you Tom the last word here. Well, I'm one of those folks who always looks for it.
So I think the possibilities are great. And some of the ideas we've exchanged today are actionable. We can take our methodologies and approaches and put them in a package that are easier to consume. And I think that's the way to go.
And we don't have to turn everyone into an ERM expert. They need to have some understanding of what it is, and allow them to make use of our expertise, and move forward that way. Yep, I think out of risk comes opportunity. And we've got a really risk-rich opportunity.
I mean, risk-rich environment that we're operating in, good or bad, but that presents a lot of opportunity. So if you're in professionals, we should take this opportunity to figure out kind of, again, where we can add the most value, which in many cases means we need to pivot, and look at different ways in which we can provide our assistance to the organization, to our new leaders, and demonstrate that value so that over time, we can then perhaps restore and rebuild some of the broader processes and elements of our programs. But, yeah, there's opportunity, I think, in the situation we're in today. Absolutely.
Well, on that positive note, I want to thank you both for being here today and joining the podcast. Thanks. Thank you, Paul. Thank you.
All righty, well, that was Risk Chats with a Firm, and this is your host, Paul Marshall signing us off.