8.1.1 OMB Motivation

The updated version of OMB Circular A-123 (2016), in a subsection entitled: “Role of Auditors in Enterprise Risk Management,” states that: “Internal or external auditors conduct independent and objective audits, evaluations, and investigations of an Agency's programs and operations, which includes aspects of the internal control and risk management systems.” Independent evaluation is stated as having special value, as follows: “Management and external auditors might have different interpretations of risks based on their respective roles and responsibilities. The agency risk function should seek to coordinate their roles so that the independence and scope of the external auditor's role is preserved while ensuring the continuing flow of risk information to the risk management function.” In a later section, the updated Circular amplifies the importance of evaluating internal controls through the lens of ERM: “Agency managers must continuously monitor and improve the effectiveness of internal control associated with significant risks identified as part of their risk profile. This continuous monitoring, and other periodic evaluations, should provide the basis for the Agency Head's annual assessment of and report on internal control as required by the FMFIA.” Through these statements, the Circular endorses independent periodic evaluations to ensure the integrity of the EROM approach and the completeness and accuracy of its analyses as they relate to the selection and implementation of internal controls and the associated required annual assurance report.

8.1.2 Department of Energy Guidance

The risk and internal control processes that the Department of Energy (DOE) uses are subject to independent evaluation through the financial statement audit conducted by DOE's external auditor and through normal quality assurance and peer review processes, according to the DOE FY 2014 guidance document on internal control evaluations (DOE 2014).

Also according to DOE, the determination of risk should drive not only the selection and placement of controls, but also the prioritization of controls testing. Controls designed for what would otherwise be intolerable risks should be tested more frequently than controls designed for marginal or tolerable risks. Example risks cited as being of concern to DOE in the context of internal controls (DOE 2014) are similar to those for other agencies. They fall within the following categories:

• “Human Resources—If the program does not have a sufficient number of qualified staff and managers available to effectively manage, oversee, and close out its projects, then project or program objectives will not be met.
• “Contractor Oversight—If federal staff is unable to manage issues with contractor or awardee performance, such as performance or quality shortcomings, cost or schedule overruns, or non-compliance with laws and regulations, then waste, or abuse of government funds may occur and program objectives will not be met.
• “Acquisition or Procurement—If a system is not in place to ensure competitiveness and fairness in contractor or awardee selection, then conflicts of interest may result.
• “Budget Execution—If the organization does not follow established policies and procedures for budget execution, then government funds may be wasted, anti-deficiency violations may occur, and information regarding obligations, disbursements, and outlays may be inaccurate.
• “Safeguards and Security—If security procedures are not fully documented, supported by training for the appropriate personnel, and followed, then non-compliance with security requirements could occur and DOE property could be damaged or stolen or employee or public safety could be at risk” (DOE 2014, p. 9).

8.1.3 Institute of Internal Auditors Guidance

The United Kingdom's Institute of Internal Auditors (IIA, 2009) provides specific guidance on the desirable content of independent evaluations of ERM within an organization. According to IIA, audits of ERM practices should be performed to “provide objective assurance to the board [of directors of a company] on the effectiveness of risk management. Indeed, research has shown that board directors and internal auditors agree that the two most important ways that internal auditing provides value to the organization are in providing objective assurance that the major business risks are being managed appropriately and providing assurance that the risk management and internal control framework is operating effectively.” The IIA report divides ERM activities into three categories: (1) those that fall under core internal audit roles, (2) those that fall under legitimate internal audit roles with safeguards, and (3) those not subject to internal audit, and it defines the ERM activities within each category as follows:

ERM Activities Falling under Core Internal Audit Roles

• Giving assurance on the risk management processes
• Giving assurance that risks are correctly evaluated
• Evaluating risk management processes
• Evaluating the reporting of key risks
• Reviewing the management of key risks

ERM Activities Falling under Legitimate Internal Audit Roles with Safeguards

• Facilitating identification and evaluation of risks
• Coaching management in response to risks
• Coordinating ERM activities
• Consolidated reporting on risks
• Maintaining and developing the ERM framework
• Championing establishment of ERM
• Developing risk management strategy for board approval

EROM Activities Not Subject to Internal Audit

• Setting the risk appetite
• Imposing risk management processes
• Management assurance on risks
• Taking decisions on risk responses
• Implementing risk responses on management's behalf
• Accountability for risk management

“In the case of ERM,” according to the IIA paper, “internal auditing can provide consulting services so long as it has no role in actually managing risks—that is management's responsibility—and so long as senior management actively endorses and supports ERM.”

8.2.1 Overview

For an EROM approach based on the principles, recommendations, and templates provided in this book, an independent evaluation would need to be concerned with all the activities leading to the selection and implementation of risk mitigations, opportunity actions, and especially, internal controls informed by risk and opportunity drivers. Since there is a requirement for a statement of assurance regarding internal controls, the evaluation would also have to be concerned with whether the residual cumulative risks and opportunities after implementation of mitigations, actions, and controls are acceptable. Because these selections and decisions ultimately depend on the execution of all the processes discussed in the preceding chapters, the independent evaluation would have to be concerned with all of the following subjects:

• How the EROM team has been structured
• How the objectives hierarchy has been developed and the interfaces between objectives have been identified
• How risk tolerances and opportunity appetites have been derived from the decision makers' views of risk and opportunity parity
• How risk and opportunity scenarios have been identified
• How risk and opportunity leading indicators have been identified, monitored, and evaluated
• How risk and opportunity scenarios have been rolled up to aggregated risks and opportunities
• How risk and opportunity drivers have been identified and evaluated
• How risk mitigations, opportunity actions, and internal controls have been identified and evaluated based on the risk and opportunity drivers
• How asset distributions and risk/opportunity responses/controls have been optimized to achieve a desirable balance of aggregated risk and opportunity
• How viable are the associated implementation plans
• Whether to accept or reject the residual aggregated risks and opportunities

8.2.2 Template for Evaluating EROM Process and Results

Table 8.1 itemizes the queries that need to be addressed by the appraisal team for each evaluation category. Underneath each category, the template provides a list of queries and, for each query, results of the evaluation with respect to the subject of the query, recommendations for improvement (if any) in the treatment of the subject, and status of resolution if any is requested.