Enterprise Risk and Opportunity Management

DR. ALLAN S. BENJAMIN, PHD, is an independent consultant, a Senior Scientist Fellow for Information Systems Laboratories, Inc., and a provider of risk management and system safety technical services for NASA. He has roughly fifty years of experience in the design and analysis of complex systems in the aerospace, nuclear reactor, nuclear weapon, ballistic missile, and commercial and military satellite sectors. He is a lead author of NASA's risk management and system safety handbooks.

• Preface xxiiiIntroduction xxvCHAPTER 1 An EROM Primer for Organizations Concerned with Technical Research, Integration, and Operations (TRIO Enterprises) 11.1 EROM Scope and Objectives for TRIO Enterprises 11.1.1 What Is EROM? 11.1.2 Why Is EROM Important to TRIO Enterprises? 21.1.3 What Kinds of Risk and Opportunity Are Considered within EROM for TRIO Enterprises? 31.1.4 How Does EROM for Nonprofit and Government TRIO Enterprises Differ from EROM for Typical Commercial Enterprises? 41.1.5 To What Extent Does EROM Work within the Existing Management Structure of a TRIO Enterprise? 51.1.6 How Does EROM Facilitate Negotiations between a TRIO Enterprise and the Entities That Provide Funding and Governance? 61.1.7 Can Various Management Units within the Organization Separately Apply EROM as Though Each Were an Enterprise? 71.1.8 In What Areas Does EROM Facilitate Strategic Planning, Implementation, and Evaluation of Performance for TRIO Enterprises? 81.2 EROM Definitions and Technical Attributes for TRIO Enterprises 91.2.1 What Is Meant by Risk and Opportunity within the Context of EROM? 91.2.2 How Do We Differentiate between Risks and Opportunities during Strategic Planning versus during Plan Implementation and Performance Evaluation? 111.2.3 How Does EROM Help Achieve an Optimal Balance between Risk and Opportunity? 111.2.4 What Is Meant by the Terms Risk Scenario, Opportunity Scenario, Cumulative Risk, and Cumulative Opportunity? 131.2.5 How Does EROM Incorporate Risk-Informed Decision Making and Continuous Risk Management within the rganization as a Whole and within Different Management Units? 141.2.6 Is the Analysis in EROM Principally Qualitative or Quantitative? 161.2.7 Can EROM Account for Unknown and Underappreciated (UU) Risks? 17Notes 18References 19CHAPTER 2 Coordination of EROM with Organizational Management Activities 212.1 The Executive, Programmatic, and Institutional/Technical Management Functions and Their Interfaces 212.2 EROM-Relevant Management Activities 232.2.1 Activities within Each Management Level 232.2.2 Roles and Responsibilities within and between Each Management Level 262.3 Coordination of EROM with Management Activities 312.3.1 Organizational Planning and Plan Implementation 312.3.2 Evaluation of Organizational Performance and Replanning 312.3.3 Alignment with Management-Level Roles and Responsibilities 352.4 Communication across Extended Partnerships 352.4.1 Nature of the Strategic Objectives That Require Extended Partnerships 352.4.2 The Challenges of Conducting EROM across Extended Partnerships 422.5 Contribution of EROM to Compliance with Federal Regulations and Directives 432.5.1 OMB Circular A-11 and GPRAMA (Government Performance, Results, and Budgeting) 432.5.2 EROM and Internal Controls from the Viewpoint of Federal Regulations and Guidance 452.5.3 OMB Circular A-123 (Management’s Responsibility for ERM and Internal Control) and the Required Statement of Assurance 472.5.4 Example Risk Profile from OMB Circular A-123 49Notes 52References 52CHAPTER 3 Overview of EROM Process and Analysis Approach 553.1 Organizational Objectives Hierarchies 553.1.1 Objectives Hierarchies for Each Management Unit 553.1.2 Objectives Hierarchy for the Enterprise as a Whole 573.2 Populating the Organizational Objectives Hierarchies with Risk and Opportunity Information 613.3 Establishing Risk Tolerances and Opportunity Appetites 633.3.1 Risk and Opportunity Parity Statements 633.3.2 Response Boundaries and Watch Boundaries 653.4 Identifying Risk and Opportunity Scenarios and Leading Indicators 663.4.1 Risk and Opportunity Taxonomies 673.4.2 Risk and Opportunity Scenario Statements 683.4.3 Risk and Opportunity Scenario Narratives 723.4.4 Risk and Opportunity Leading Indicators 733.4.5 Leading Indicators of Unknown and Underappreciated (UU) Risks 743.5 Specifying Leading Indicator Trigger Values and Evaluating Cumulative Risks and Opportunities 783.5.1 Leading Indicator Trigger Values 803.5.2 Cumulative Risks and Opportunities 803.6 Identifying and Evaluating Risk Mitigation, Opportunity Exploitation, and Internal Control Options 823.6.1 Deducing Risk and Opportunity Drivers 823.6.2 Deducing Risk and Opportunity Scenario Drivers 833.6.3 Evaluating Risk and Opportunity Scenario Likelihoods and Impacts 853.6.4 Identifying Options for Risk Response, Opportunity Action, and Internal Control 873.6.5 Evaluating Options for Risk Response, Opportunity Action, and Internal Control 893.6.6 Brief Comparison of this Approach with the COSO Internal Control Framework and the GAO Green Book 91Notes 94References 94CHAPTER 4 The Development and Utilization of EROM Templates for Performance Evaluation and Strategic Planning 974.1 Overview 974.2 Demonstration Example: The NASA Next-Generation Space Telescope as of 2014 994.3 Example Objectives Hierarchies 1014.3.1 Objectives Hierarchies for Different Management Levels 1014.3.2 Integrated Objectives Hierarchies for the Enterprise as a Whole 1034.4 Risks, Opportunities, and Leading Indicators 1034.4.1 Known Risk and Opportunity Scenarios 1054.4.2 Cross-Cutting Risks and Opportunities 1054.4.3 Unknown and Underappreciated Risks 1124.5 Example Templates for Risk and Opportunity Identification and Evaluation 1134.5.1 Risk and Opportunity Identification Template 1134.5.2 Leading Indicator Evaluation Template 1134.6 Example Templates for Risk and Opportunity Roll-Up 1264.6.1 Objectives Interface and Influence Template 1264.6.2 Known Risk Roll-Up Template 1264.6.3 Opportunity Roll-Up Template 1444.6.4 Composite Indicator Identification and Evaluation Template 1474.6.5 UU Risk Roll-Up Template 1514.7 Example Templates for the Identification of Risk and Opportunity Drivers, Responses, and Internal Controls 1594.7.1 Risk and Opportunity Driver Identification Template 1594.7.2 Risk and Opportunity Scenario Likelihood and Impact Evaluation Template 1614.7.3 Risk Mitigation, Opportunity Action, and Internal Control Identification Templates 1614.7.4 High-Level Display Template 1654.8 Upward Propagation of Templates for Full-Scope EROM Applications 1654.8.1 Scope of the Problem 1654.8.2 Propagation of Templates 1734.8.3 Development of an Integrated EROM Database 1754.9 Application of the Templates to Organizational Planning and the Selection from among Alternative Candidate Portfolios 175Notes 181References 181CHAPTER 5 Management and Implementation of EROM at the Institutional/Technical Level (Technical Centers or Directorates) 1835.1 EROM from a Technical Center’s Perspective 1835.2 Extended Enterprises and the Technical Center’s Extended Organization 1845.2.1 Overview 1845.2.2 Relationship of Each Technical Center to the Other Entities in the Center’s Extended Organization 1875.2.3 EROM Organizational Structure for a Technical Center’s Extended Enterprises 1895.2.4 Challenges of Creating and Managing an Integrated Database 1915.3 EROM-Informed Budgeting of Resources across a Technical Center’s Extended Organization 1925.3.1 Objectives-Based Distribution of Human, Physical, and Instructional Assets 1925.3.2 Representative Templates for Distributions of Allocated Assets 1925.3.3 Asset Risks, Opportunities, and Risk/Opportunity Scenario Statements 1985.3.4 Leading Indicators of a Technical Center’s Health 2005.3.5 Correlations between Internal Leading Indicators and Gaps in the Distributions of Human, Physical, and Instructional Assets 2015.3.6 Optimization of the Acquisition, Allocation, and Retirement of Human, Physical, and Instructional Assets 2035.3.7 Relevance to Provider Acquisition Decisions Made by Technical Centers 206References 206CHAPTER 6 Special Considerations for EROM Practice and Analysis at Commercial TRIO Enterprises 2076.1 Overview 2076.2 Risk and Opportunity Scenarios and Leading Indicators 2106.2.1 Risk and Opportunity Taxonomies 2106.2.2 Risk and Opportunity Branching Events and Scenario Event Diagrams 2106.2.3 Risk and Opportunity Templates 2156.2.4 Risk and Opportunity Matrices 2216.3 Controllable Drivers, Mitigations, Actions, and Internal Controls 229CHAPTER 7 Examples of the Use of EROM Results for Informing Risk Acceptance Decisions 2377.1 Overview 2377.2 Example 1: DoD Ground-Based Midcourse Missile Defense in the 2002 Time Frame 2387.2.1 Background 2387.2.2 Top-Level Objectives, Risk Tolerances, and Risk Parity 2397.2.3 Risks and Leading Indicators 2427.2.4 Leading Indicator Trigger Values 2447.2.5 Example Template Entries and Results 2477.2.6 Implications for Risk Acceptance Decision Making 2477.3 Example 2: NASA Commercial Crew Transportation System as of 2015 2497.3.1 Background 2497.3.2 Top-Level Objectives, Risk Tolerances, and Risk Parity 2517.3.3 Remainder of Example 2 2537.4 Implication for TRIO Enterprises and Government Authorities 254References 254CHAPTER 8 Independent Appraisal of EROM Processes and Results to Assure the Adequacy of Internal Controls and Inform Risk Acceptance Decisions 2558.1 Background 2558.1.1 OMB Motivation 2558.1.2 Department of Energy Guidance 2568.1.3 Institute of Internal Auditors Guidance 2578.2 Queries for an Independent Appraisal of EROM in the Contexts of Internal Control and Risk Acceptance 2588.2.1 Overview 2588.2.2 Template for Evaluating EROM Process and Results 259References 265CHAPTER 9 Brief Overview of the Potential Integration of EROM with Other Strategic Assessment Activities 2679.1 Technical Capability Assessment (TCA) 2679.2 Strategic Annual Review (SAR) 2709.3 Portfolio Performance Review (PPR) 271References 274CHAPTER 10 An Integrated Framework for Hierarchical Internal Controls 27510.1 Internal Control Principles and the Integration of Internal Control, Risk Management, and Governance 27510.2 Methodological Basis 28010.2.1 Hierarchical Control Loops 28010.2.2 RACI Matrices 28210.3 Examples 28510.3.1 Example 1: Institutional Responsibility for Risk Management and System Safety 28510.3.2 Example 2: NASA Commercial Crew Program Risk-Based Assurance Process and Shared Assurance Model 28710.4 Incorporation of Internal Control Principles into the Control Loop Approach 29710.5 Summary of Observations 302References 306APPENDIX A Acronyms 309APPENDIX B Definitions 311About the Companion Website 314About the Author 315Index 317