Hello, and welcome to Risk Chats for a firm. I'm your host, Paul Marshall. Today, Tal and I speak with Jason LeCost from Ginnie Mae of their ERM program. Hello, and welcome to the podcast.
Today, we have Jason from Ginnie Mae. He's the risk management program here, and Jason, let's know what you do for Ginnie Mae here. Sure. So I'm the director of operational risk.
I work for the chief risk officer. I have about six programs underneath of me. Enterprise risk management, vendor risk management, operational risk, operational incident tracking, model validation, and then our continuity of operations program. Okay, great.
And actually, we have Tal as our co-host today. I don't want to leave him out. Good afternoon. All right.
So, Jason, why don't we start off with talking a little bit more about Ginnie Mae. It's kind of a unique entity in the federal world. So maybe you'll start with that and some of the unique risks that come with that organization. Sure.
So Ginnie Mae plays in this kind of quasi-space between federal and commercial. The commercial component is with our issuers. Our issuers are made up of banks and non-banks. So that's your quasi-commercial environment dealing with government loans and then going to our issuers and being securitized through our program and being sold off as a government security.
So along with that, you have credit risk, you have market risk, you have operational risk, the system of the process, the payments to the investors, which are fairly large payments that happen twice a month. So you can't affect any downtime with the systems. So that's one of the metrics that we look at. You have strategic and reputational risk.
You know, I like the fact when I say Ginnie Mae, most people don't know what Ginnie Mae is. That means that we're keeping ourselves low and we're flowing below the radar. We're doing what the government intended us to do. We support only federal loans.
So that's the difference between us. Well, one of the differences between us and the GSEs. So when people get a VA loan, they get a FHA loan, agriculture, there's several other kind of federal loans. Those loans go through our issuers and they get securitized by our issuers who are in our Ginnie Mae program.
And then those things get sold off the market. So what's a GSE? So a GSE would be a government-sponsored entity. So that would be a Fannie or Frey.
Ginnie Mae is wholly owned by the government. We've always been wholly owned by the government. To give you a little historical background, Fannie Mae was first. And they focused on the government loans.
At some point, about 10 years in, they decided to expand Fannie Mae's role. But they didn't want to lose the government role focusing on the government loans. So they created Ginnie Mae. And so Ginnie Mae was created by the federal government and it's wholly owned by the federal government and it always has and always will probably.
Right. Yeah, just on that introduction, we were talking about what Ginnie Mae does. How are you organized within the leadership of Ginnie Mae? Are you at the CSO level?
Are you below it? Who do you report to? And how's that working? Yeah.
So Ginnie Mae has had a chief risk officer for about 10 years. My boss, Gregory Keith, has been a chief risk officer for about six or seven of those years. And I think it works out well for us because he's at the C-suite level. He sits at the peer level with our CFO, our CIO, and has direct reporting to our chief operating officer as well as our president.
And so I think that gives us a lot of, that gives us a strong presence within the organization. I think some of the things that also helps our organization is the fact that a lot of the people here are used to commercial entities, whether they're contractors that work with us like large banks or like our issuers, which could be banks or non-banks, we have risk offices. They're used to those organizations having risk functions. So the expectation is we should have it to.
Now, how many sub-organizations are under the CRO? Is it all one organization or are there divisions that, how many direct reports report to the CRO? So Greg has four direct reports. Again, I told you the areas I focus on.
He is the chief information security officer, focuses on reports to him, which is helpful for cyber risk. And so we work together, because we're peers, we work together and I make sure to include those IT risks, whether they're FSMA, whether they're cyber, whatever they may be, into our program. As you'll see on our taxonomy behind me, IT risks are underneath the operational. We also have our counterparty division, the director that leads that, and that focuses a lot on the underwriting and our credit side of the house.
So that reports to him. So to get into our program, our counterparty has to do an underwriting of that issuer to determine if they meet the criteria to come into the GMA program. And then we also have the economic modeling group, which is in this group, which has a real impact on our financial statements, a lot of forecasts. And so that's why one of the groups that's under me is model validation.
So since I'm separate, I'm a true second line, I do validation of those models. So you've got segregation duties between people who build models and people who prove them. Correct. And more so, it's reviewing the theory, the assumptions, the thought behind some of the calculations to make sure as well as is the calculation itself correct.
Okay. So it sounds like you guys, so you're, you know, the CRO is, you know, kind of one of the peers of the CFO in the other C-suite. So is the CFO's office the one that takes care for the internal control reviews, things like that, at the organization? I would guess that.
No, I would say here we have a very, we have an office within CFO that focuses on what I would call what was traditional A-1-3-3-3-5. But because I've gone through and documented the entire agency, flowcharted it out, you can see one of the flowcharts there, whether it's, we're all encompassing, kind of holistic in review. Right. That includes financial, operational, strategic, and any other types of risk that will kind of fall on our taxonomy.
Right. One of the things we do is we're trying to leverage the documentation we have to satisfy that. And then the dropping of the latest specular lends itself towards that type of thought. Right.
So unintentionally, we were already headed that direction. Okay. And so we work really well together. They make sure we always get a copy if they have something built around cycle memos.
And then that way we're able to, when we go in, we understand where the financial controls are. But I'm able to document the entire process. And then I'm able to show people where the financial plays a role in the overall process, which is a much better picture than just cutting a piece of the pie and saying, this single control is something you need to focus on. Right.
Because there's a lot of operational and strategic decisions that are made that may affect that financial control. Right. Right. And those things need to be accounted for.
Well, let's talk a little bit about, I think, something fundamental here is your taxonomy, your risk taxonomy. Mm-hmm. Can we go a little bit into that and how that is a fundamental piece here? Yeah.
So our taxonomy, we're on version 2.0. The first year I did it, it only had, we had a level one, level two, and level three. But our level one the first year was financial management, operational, strategic, and illegal. And so the struggle with it being four at the level one was, if I wanted to develop metrics around the risk that related to those different buckets, they were too broad.
All right. So in version 2.0, we pulled marketing credit out of financial. Because accounting reporting and financial audibility is very different than credit risk. Right.
Right? And it's very different than market risk. Right. And so those deserve their own buckets.
And they deserve their own metrics. And they deserve their own competition, if you will. Right? They bring a different type of exposure to the organization.
Same thing with governance oversight. With governance oversight, lap out on your strategic. And I think your strategic goals and your strategic kind of plan, as well as the risks that are strategic, are different than necessarily government oversight. Sure.
So we wanted to break that out, too. Right. Because like a line, it's about how ambitious and challenging your mission is in terms of goals versus a changing environment. Versus the other one, it's just how well does the organization lead and set the tone at the top of success.
Exactly. I agree. That's great. I was up here taking pictures.
With your permission, Jason. Paul, go ahead and post that on the website with the podcast so that listeners can see the enterprise risk universe as it's been plotted by Jenny May. Yes. No, I appreciate that.
But it's taken a lot of work. It's something we put a lot of thought into. It's something, definitely at the level three, we're open to always kind of updating it on an annual basis. Right.
So one of the things is, is we've gone through and documented all the risk controls within the agency. And operational incidents helps with that, too, because that catches the things that we didn't document a lot of the times. Or we catch failures in a process that we thought had to make it in place that was working well, but then something failed. We use that to update the taxonomy.
So when I come back to my boss, I'm able to communicate this information. And I only kind of tell him where we have problems, but I'm able to segregate the problem so he knows, okay, within credit risk, for example, you have a problem in concentration risk with an issue. It's something that's different than traditional financial management in accounting and reporting. But previously, they were lumped together, and that didn't give you enough clarification that you needed to really understand the risk.
So by breaking it out this way, you can now drive all the way down to the lower level, understand what those risks are, but then you can roll it up, too. And I can give him a pie chart by level one. I can give him a pie chart or a bar graph by level two. And even if I needed to level three, if he said, okay, what in credit?
If I see credit on my bare areas, what's in credit? What's driving some of my problems in credit? Or what's my high risk? And I might say concentration risk, industry risk, and some counterparty or maybe market practices.
And then with any time, I'm able to drive to level three to show him what may be the leading So they can make decisions, right? Right. I mean, obviously, it's a great tool to report up to the CRO, but also navigate your stakeholders in these different areas, right? So give us a little insight on how do you...
Well, again, I'm really appreciative of the leadership at Jenny, and I'm appreciative of the managers and the staff because they wanted risk management, right? And that's very different. Now, we all may think differently about what is risk management, but that's my job to communicate it and to facilitate those discussions so we come to some common ground, right? So it's not my way is the right way.
It's not someone else's way is the right way. But through discussion and through integration, we can come up with what is a good way for Jenny to make, and that's what it's really about. But because I work in an environment of individuals who care about risk and care about risk management and they care about protecting the program, it made it a lot easier for me to have these discussions. It was almost like, where are you waiting on?
We want you to get this thing in place. We need it. It helps us because, you know, it helps managers manage their process. When your process is documented and your team agrees with the way the process is documented and the risk in there, not only does it give a level of transparency is of what your process is, it gives a level of transparency around what your risks are, but it also lets every staff know how they play a role in the bigger picture of the organization.
Right. One of my questions was, you know, such a large portfolio, you know, different kinds of risks at this at Jenny May. You know, what have you seen? How do you manage this?
It sounds like you're taking ownership of this. We're still young and rolling this thing out. I've been here a little over three years and we've been working on it every day. Again, I appreciate the staff and the leadership for being accepting of it.
But we still have a long way to go, but we're moving well. I think on a maturity scale, every year we take one step to getting better. The ideal goal is when you get to proactive risk management and you produce reports that management really uses to make decisions. Right.
And so where are we on that, right? So we just finished documenting our largest business office, actually at the end of August, 18 months spent documenting them, a thousand page document on flows. And I focus on flows more so in just narratives because people can digest visual documents a lot easier. And so we focus on flows mostly with some context around the boxes so people can drive in.
But it was focused on getting the flows right so I can really hurry up and quickly drive into the risk and then drive into the controls. And so that's where we're at on that scale. So now that we've kind of turned the corner in documentation, now my staff is challenged with the fact of following up on a annual, I don't know, biannual, so twice a year, following up on the gaps that we've identified with the different offices. So then we can start to address the things that are out there to fix them.
Like the new 8123 Appendix A, as they're talking about I-Corps, they're talking about making sure we have established data quality objectives for all of our material reports and material reporting lineups. Jason just held it up. He's got tabbed and underlined and highlighted. It really gets to the point where it is essential to have good objectives for each of your areas so that you can identify and analyze the risk of meeting those objectives.
So you guys on tier two have seven areas and you've got 35 categories of risk underneath those seven in your universe. How many of those have good objectives down, such that when it comes time to identifying risks and analyzing the impact of that risk against meeting that objective, do they all, some of them, most of them? Well, so now I think you're bleeding into the discussion around appetite. Is that true?
Right? So the way we look at appetite, taxonomy plays a role in it. And it helps us understand where these bigger risks are. So what I'm showing you right now on the screen is a part of our risk profile.
We break out where those top 10 risks are and where they were, where they added to your level one and where they're added to your level two. So the slide previously shows you tier one, what was driving some of our larger risks. And then tier two shows you the level one and the level two. So it shows you underneath of it, what are the things that are really driving.
So operational is one of our larger risks. Now you can see, for example, procurement plays a role in that. IT plays a role in that, in the operational space, right? So now you understand that.
But from an appetite standpoint, I think there's two good ways to kind of do appetite from a standpoint of building one. You can build it around your taxonomy. So each level one could have an appetite statement. Or you can do the way we chose.
Each strategic goal for the organization has an appetite. So each strategic goal for us has an appetite. And then we're now going through the process of building metrics for each appetite statement. So how do I know that we're making progress towards our appetite?
So it's one thing to have an appetite statement. It's another thing to follow it. And so how do we do that? How do we quantify that?
How do we understand if we're actually following this appetite that we put out there? Would you have like an example of what it means that you just described? Put a metrics in place that shows that you're following your appetite. So in this slide I'm showing you right here, this is an example of where we have a management goal, right?
Strategic goal. Then we have an appetite adjacent to that. And then we have metrics that we place underneath of that that help us measure to it. For the folks listening, could you describe the specific goal and the metrics like for this example for folks so they can get an appetite?
Yeah, so I don't want to get too much to make his wrist away, but we want to, for example, operations. You might have a system that's important in meeting one of your strategic goals, and downtime is important, right? So putting metrics around, can we afford to be down? We can't afford to be down more than four hours on a day when payments are due, right?
So now we're measuring against that. So are we saying, okay, we have an appetite where two hours is reasonable, four hours we know we can't do. Zero, of course, is perfect, right? So it's forcing people to have discussion around trade-offs, around appetite.
That is very tangible. That's kind of a theoretical or... Yeah, and it takes time. It takes time.
I mean, within a year, just focus on the enterprise level. We still have another few years to go on the programmatic level, but it helps a lot because we have the program areas documented. So at least when we go and have discussions around appetite, we know what their real risks are, and we know what their controls are, and we know what the purpose of that division is. So we try to create an appetite around the purpose of that division, and we can use their metrics and their risk and controls to start the discussion around what are real metrics that should be in place.
They might be metrics you're already generating, right? Because one of our goals is in creating metrics is we want to leverage as much information that's already being produced as possible, and see if you can provide that on a quarterly basis. Because I don't want you to create... My job is to create more work for you.
So if you have a metric that says, look, we already measure when the systems are out, and we measure when we're up and running, and we have metrics on that, well, great. Then those are the type of things I want to leverage to see if we're in line with the appetite we just discussed. Right. Well, because appetite's going to translate to, I mean, where do we focus our funds, our time, and energy, right?
Exactly. So if your appetite for system being down is extremely low, you know, then you've got to make sure there's funding available when downtime happens or whatever, right? Exactly. Or redundancy, or...
Or redundancy, or... Et cetera, or the strategy is, yeah. Well, no, I mean, at least it's kind of the cool part, right? Right, exactly, right, exactly.
So, you know, one of the things when you start laying things out and identifying this is, you know, where are your essential functions as it pertains to your high risk? Mm-hmm. Right? And so that's one of the things that we're still very, you know, new in this space, but that's one of the things that we're thinking about.
Because we want to make sure when you're making... When we give management information to make decisions, we want to make sure we give them as much information as possible. So if we also tell someone, hey, this area's an area of high risk, this is the type of appetite we have on it. But by the way, our, you know, two of our essential functions reside in this space.
Mm-hmm. So you need to know that management needs to know that when they make a decision, my boss needs to know that when he makes a decision on, you know, communicating that with his bosses or with his peers, and they make a decision around, you know, budget, resources, all those type of decisions, and they need to have that information. Right. And how long have you had these, you know, risk appetite statements, so to speak, coming around?
Literally, starting a year ago. What? I would say within the last few months, we've had these statements, and the metrics are still at the enterprise level. They're probably, if a scale of 1 to 10, 10 is complete, we're probably on a scale of 7 or 8.
Right. So we're still working through it. You know, my boss is giving me critiques on them, and then after these critiques, I go and socialize it with his peers, and they give critiques, and we give back. So it's iterations.
Right. It's no silver bullet. Sure. Right?
So, and we don't have a goal of getting it done right now. The goal is, you know, trying to improve a little bit every day. It also sounds like you're really trying to, you know, bring some value from this program as an organization. It's not, we're just not, you know, what's the risks and kind of be worried about it.
You're really doing proactive steps to really track them, measure them, do something about it. I mean, that's a big deal. It is a big deal, and honestly, that's our value proposition. Yeah.
We have to give you information that helps you make decisions. And if we're not doing that, if we're just collecting information to collect it, we're not a value add. Right. Right?
So if I can, you know, this is years down the road, but, you know, at some point create some snazzy reports that go to senior leadership, that help senior leadership make budget decisions, make strategy decisions, make, you know, resource decisions, then I've accomplished my goal. Right. Right? Because now I'm actually giving the senior leaders the tools, an additional tool.
They already have tools, but an additional tool they can use to help them make a decision. Sounds great. Well, it's another area I want to cover today is the risk profiles. Just curious what your approach was to put those together.
So the risk profile, this is year two. The great thing is, again, because we have stuff documented at an office level, we're able to roll up those risks to maybe a group of maybe 60. And then we have workshops, and where we go through that 60 and we cut it down. Okay.
Right? And we do it through individual interviews, so everyone has to be pulled into the same room. We'll get to meet with certain people as risks are in their area. And I say, as a senior leader in this area, these are the risks we've identified.
What do you think about these risks or any of these risks that you want to elevate to an enterprise level? And I ask them to elevate it because you want them to own it. Right. And if they're willing to elevate it, that means to me that they think it's something that they're willing to put out front in front of their peers as well as their bosses.
So we ask them for that. And sometimes they say stuff that we didn't have captured. And that's great, too. And so we capture that information.
We go about doing that across the board. Then we do a survey. We send out the survey to everyone. We ask them about impact and probability.
But then we add an additional column. We have two additional things. We have one, a context box. So if you have comments about the risks that you like, dislike, or you think we can improve it in one way, we give you a certain amount of characters to explain that thought.
But then we also ask you regarding resources, do we have enough, too much, or not enough? And so as it rolls up, you can, once you get to the point where you can actually see the risk, right, in the profile, you'll see whether we have not enough, the right amount, or too much. And you'll see which one is a leading indicator. And you'll be able to communicate that based on where that risk fell in the overall heat map.
And so this is additional information we can give to senior leaders so they now understand that this might be a medium or high risk, but the census in the room is we don't have enough resources, or we have the right amount, or too much. So we want to give them as much information as possible without overwhelming them to help them make decisions. So if you've got a risk and you know whether you have enough resources around it, that helps you, too. Because now you know whether I've got the right amount, not enough, or, you know, so at least that's the system for me.
You still have to make your own decision. But my job is to set the table, not to tell you what to eat, right? Right. So speaking of setting the table, there's a lot of folks that are still on the more early side of program development and implementation at their agency.
What words of wisdom would Jason tell them that if you're on the earlier side of the program maturity model, here's what I'd encourage you to do to get the most miles ahead for the future that you can? Develop a sponsor. If you can get multiple sponsors, do that. Take it slow.
We did a pilot year where we did one small office, one medium-sized office the first year. It allowed us to cut our teeth and learn a lot. That was very helpful. And then not only did we learn a lot, we were very flexible in the process.
So by the time we ended that process, you know, at the beginning I asked them, what do you want to see at the end of this? That would say there'll be added value, right? So I have that at the beginning kind of as my guide, right? And the whole time I'm working towards that as well as trying to accomplish what other goals I may have in place.
But the benefit of that is when I finish that assessment, it may be one office, and you might have 10 more, 20 more to go. But now you develop goodwill, and you have a sponsor. And so the next time you roll out, maybe you have three offices, right? It's iterations.
And so guess what? If you do the same thing and you do it well, when you finish year two, like we did, now I got five sponsors. And guess what? I got three left to go, right?
My organization is smaller than some, so it'll be a different strategy for every organization. There is no, you know, my way fixes everyone's way. We all have different approaches. But I think if you're patient, just as much as you're trying to explain stuff, you're willing to listen, you'll go a long way.
And develop those sponsors that support your program because word of mouth goes a long way. Well, following up on that, for your own organization, what would you like to see the development of ER in the next year or two? So, I mean, senior leaders continue to absorb the work that we're doing, give me valuable input on the reports they'd like to see, continue to give me feedback on ways I can improve, and ways I can give them better information to help them make decisions. I don't know what's in their mind, but if they communicate it to me, my goal is to try to meet it, and I try to give them things that are helpful.
That sounds good. Well, Jason, thank you very much for joining us today. Yes, thanks a lot. Thank you.
I appreciate it. Well, that's our show. Thanks for tuning in. And we look forward to many new podcasts in the new year.
So keep your eyes on the website. And until the next time, this is Paul Marshall signing off for Risk Chats with A. Thank you.