ERM Implementation in Local Government

Transcription

1 ERM Implementation in Local Government Sean Catanese, ARM, C31000 Enterprise Risk Management Program Manager King County, Washington Greg Wallig, CISA, CGEIT Principal Grant Thornton LLP 1

2 King County s ERM Framework Electorate County Council Reporting Duties Budget County Executive County Administrative Officer Risk Manager ERM Program Manager Executive Priorities Best run gov t Provisos Mobility Equity Loss Control Fund Sheriff Metro Transit Wastewater Detention Risk ERM Work Group Public Health Climate change Safety Executive Services Roads What is ERM? Enterprise Risk Management ( ERM ) is a strategic business discipline that supports the achievement of an organization's objectives by addressing the full spectrum of its risks and managing the combined impact of those risks as an interrelated risk portfolio. Risk & Insurance Management Society (RIMS) 2

3 What led King County to ERM? Millions $8.0 $7.5 $6.0 $6.5* $4.0 $2.0 $0.0 $ Mission: Implement ERM using ISO Housed within Office of Risk Management Single person program + work group Loss control and risk mitigation funds What does it mean to implement ERM? Support intentional, informed decision making Establish/understand the County s risk tolerance Re frame risk as uncertainty and opportunity Share best practices and lessons learned Address risks beyond our loss history Assist with control efforts Demonstrate excellence to risk sharing partners 3

4 Implementing ERM in Practical Terms 1. Establish senior management s investment 2. Identify your ERM champion 3. Create an effective working group 4. Start with an enterprise wide risk assessment 5. Inventory your risk management practices 6. Develop some basic risk reporting 7. Build action plans based on identified needs Adapted from Embracing Enterprise Risk Management: Practical Approaches for Getting Started Written by Frigo and Anderson, published by COSO, 2011 Measuring ERM Maturity Measuring ERM Maturity 4

5 What does an ERM novice sound like? This is how it s always been done. If something changes, we ll deal with it as it comes up. We know where our big problem areas are, but we spend most of our time and energy addressing emergent needs. Don t Risk, Safety, HR, and our attorneys take care of that? Isn t that why we have insurance? What does an ERM practitioner sound like? We consider the bigger picture for long term decisions. We know how to check whether we ve made the right decision. We share ownership of risks with Risk, Safety, and many other agencies. We re working together to address high impact causes of loss. What does an ERM champion sound like? Our front lines believe in and practice the concept that Everyone s a risk manager. Risk is an integral part of our decision making process, and we communicate about risk using sound analytic process. We share ownership and responsibility for risks together as One King County. We know what s on the horizon, and we have a plan to address our risks and make the most of our opportunities. 5

6 King County s ERM Process Governance Risk Assessment Risk Identification Risk Analysis Risk Evaluation Monitor & Review Identify Risk Treatment Analyze Plan & Implement Select Communication Risk Assessment Risk Identification Risk Analysis Risk Evaluation Keep it brief and open ended Solicit data from across the enterprise 6

7 What we asked our managers: 1. What risk do you spend the most time managing? 2. What do you think is the most important risk you are responsible for managing? 3. What risk do you wish you had more time, money, or resources to manage, but can't given the current environment? 4. What is the main reason you are unable to devote time, money, or resources to that risk? 5. From your perspective, what are the three most important risk issues facing the County as a whole? Risk Assessment Risk Identification Risk Analysis Risk Evaluation Loss history can provide some context Add in planned/anticipated changes Seek peer experiences and lessons learned Frame in terms of risks (not consequences) Risk Assessment Risk Identification Risk Analysis Risk Evaluation Consolidate commonly repeated issues Distinguish between localized and enterprise risks Estimate likelihood and impacts Impacts vary among risk owners Identify a couple risks to address quickly 7

8 8

9 Risk (abbreviated) Likelihood Impact Score 1Metro Transit coach strikes a pedestrian Extreme Med High 67 2 Employment related conflicts Extreme Medium 54 3Road design and maintenance Very Med High 50 4 Retirement and succession planning Extreme Medium 46 5Metro Transit vehicle collision Extreme Medium 46 6Electronic security breach Somewhat Med High 40 7Use of force by Sheriff's deputy Somewhat Med High 40 8Severe weather disruption/damage Very Medium 40 9 Public records and discovery requests Very Medium Medical care provided to a jail detainee Very Medium 37 9

10 How do we know if we re succeeding? We intentionally take risks to pursue opportunities When we have good information about the risks When the opportunities align with our strategy Severe losses are less frequent ERM maturity scores improve over time Demonstrate excellence to risk sharing partners 10