Читать книгу Enterprise Risk Management - Hardy Karen - Страница 7

At a September 2011 annual summit on Federal Enterprise Risk Management, J. Christopher Mihm, managing director for strategic issues at the U.S. Government Accountability Office (GAO), summarized the state of risk management in the federal government and a path for moving forward (note: “Recent Risk Events” is reproduced at the end of this introduction):

In a relatively short amount of time, enormous progress has been made in the area of risk management in government. Due to major efforts by many risk managers in the public and private sectors, risk management both as a discipline and a way of thinking has deepened and expanded significantly. Risk management has moved from its traditional domains into areas such as IT, financial management, contracting, health and safety programs, and homeland security. In concept and language, risk management is moving more into the routines of other federal program and functional management areas.

The nature of risk is evolving as well and its dynamics originate from a variety of sources [see “Recent Risk Events”]. Characteristics of this evolution include the following:

• Risks can emerge more quickly;

• Greater transparency about risk is needed;

• Public knowledge of risk occurs more quickly; and

• There are higher expectations that risk will be addressed more quickly

With this newfound awareness, can risk management play a vital role in helping line managers understand and address the performance and accountability challenges associated with government issues?23

To help answer that question and to realize the true potential of risk management in government, Chris Mihm cited several additional actions that must be taken.24

First, there must be ongoing momentum and commitment to “continue to expand the discipline across programs” and at an enterprise level. Too often, “Federal managers take massive risks every day but too often do not consider and manage them as such.” Without the proper level of awareness, managers will not properly identify and manage risk effectively.

Second, there must be internal and external commitment to “help managers understand and calculate the risk inherent in the status quo.” Anecdotal observations and assumptions of risk made without a degree of calculation would undermine the value of risk management in an organization. The more specific the descriptions of risk made available to managers, the better they will be able to articulate the impact it will have.

And finally, actions speak louder than words. Current and future risk practitioners must demonstrate to managers “how they can use risk management to help address governance challenges.” It will be necessary to engage managers early on in action-oriented activities that show how risk management can improve their operations or performance.