Enterprise Risk Management. Hardy Karen

coinciding with the start of each new Congress, GAO has reported on the status of progress to address high-risk areas and updated the High Risk List. In 2013, the GAO removed the high-risk designation from two areas – Management of Interagency Contracting and IRS Business Systems Modernization – and designated two new high-risk areas: Limiting the Federal Government’s Fiscal Exposure by Better Managing Climate Change Risks and Mitigating Gaps in Weather Satellite Data. These changes brought GAO’s 2013 High Risk List to a total of thirty areas.

The GAO High Risk List is particularly useful to risk managers, chief risk officers, and agency executive leadership in general because it serves as an independent review for flagging risk areas in government that may be missed by agencies. Overall, GAO’s high-risk program has served to identify and help resolve serious weaknesses in areas that involve substantial resources and provide critical services to the public. Since the high-risk program began, the government has taken high-risk problems seriously and has made long-needed progress toward correcting them. In a number of cases, progress has been sufficient for GAO to remove the high-risk designation. A summary of changes to GAO’s High Risk List over the past twenty-three years is shown in Table I.2.

Table I.2 Changes to GAO’s High Risk List, 1990–2013

      Source: www.GAO.gov.

      CRITERIA

      When legislative, administration, and agency actions result in significant progress toward resolving a high-risk area, GAO removes the high-risk designation. Key to determining whether the high-risk designation can be removed are the following five elements: (1) a demonstrated strong commitment to, and top leadership support for, addressing problems; (2) the capacity to address problems; (3) a corrective action plan; (4) a program to monitor corrective measures; and (5) demonstrated progress in implementing corrective measures.

      To determine which federal government programs and functions should be designated high risk, GAO considers whether the program or function is of national significance or is key to performance and accountability. GAO also considers which of the following the risk represents:

      • An inherent problem, such as may arise when the nature of a program creates susceptibility to fraud, waste, and abuse

      • A systemic problem, such as may arise when the programmatic, management support, or financial systems, policies, and procedures established by an agency to carry out a program are ineffective, creating a material weakness

      Further, GAO considers qualitative factors, such as whether the risk

      • Is a matter of public health or safety, service delivery, national security, national defense, economic growth, or privacy or citizens’ rights

      • Could result in significant impaired service, program failure, injury or loss of life, or significantly reduced economy, efficiency, or effectiveness

      In addition, GAO also considers the exposure to loss in monetary or other quantitative terms. At a minimum, $1 billion must be at risk in areas such as the value of major assets being impaired; revenue sources not being realized; major agency assets being lost, stolen, damaged, wasted, or underutilized; improper payments; and contingencies or potential liabilities.

      Before making a high-risk designation, GAO also considers corrective measures planned or under way to resolve a material control weakness and the status and effectiveness of these actions. To determine which federal government programs and functions should be designated high risk, GAO uses the self-titled guidance document Determining Performance and Accountability Challenges and High Risks.

      In February 2011, GAO detailed thirty high-risk areas. Sufficient progress has been made to remove the high-risk designation from the following two areas:

      • Management of Interagency Contracting. Improvements include (1) continued progress made by agencies in addressing identified deficiencies, (2) establishment of additional management controls, (3) creation of a policy framework for establishing new interagency contracts, and (4) steps taken to address the need for better data on these contracts.

      • Internal Revenue Service Business Systems Modernization. The IRS made progress in addressing significant weaknesses in information technology and financial management capabilities. The IRS delivered the initial phase of its cornerstone tax processing project and began the daily processing and posting of individual taxpayer accounts in January 2012. This enhanced tax administration and improved service by enabling faster refunds for more taxpayers, allowing more timely account updates and faster issuance of taxpayer notices. In addition, IRS has put in place close to 80 percent of the practices needed for an effective investment management process, including all of the processes needed for effective project oversight.

      Although these two areas have been removed from the High Risk List, GAO will continue to monitor them.

      GAO has added two areas in 2013:

      • Limiting the Federal Government’s Fiscal Exposure by Better Managing Climate Change Risks. Climate change creates significant financial risks for the federal government, which (1) owns extensive infrastructure, such as defense installations; (2) insures property through the National Flood Insurance Program; and (3) provides emergency aid in response to natural disasters. The federal government is not well positioned to address the fiscal exposure presented by climate change; it needs a government-wide strategic approach with strong leadership to manage related risks.

      • Mitigating Gaps in Weather Satellite Data. Potential gaps in environmental satellite data, beginning as early as 2014 and lasting as long as fifty-three months, have led to concerns that future weather forecasts and warnings – including warnings of extreme events such as hurricanes, storm surges, and floods – will be less accurate and timely. A number of decisions are needed to ensure that contingency and continuity plans can be implemented effectively.

      Notable progress has been made in the vast majority of areas that remain on GAO’s High Risk List. This progress is due to the combined efforts of Congress, through its oversight and legislation; the Office of Management and Budget (OMB), through its leadership and coordination; and the agencies, through their efforts to take corrective actions to address long-standing problems and implement related GAO recommendations.

      PROFILES OF SELECT HIGH-RISK AREAS IN GOVERNMENT

      The U.S. federal government is the world’s largest and most complex organizational entity, with about $3.5 trillion in outlays in fiscal year 2012 funding a broad array of programs and operations. GAO maintains a program to focus attention on government operations that it identifies as high risk due to their greater vulnerability to fraud, waste, abuse, and mismanagement or the need for transformation to address economy, efficiency, or effectiveness challenges. Solutions to high-risk problems, such as those listed in this section, offer the potential to save billions of dollars, improve service to the public, and strengthen the performance and accountability of the U.S. government:

      • Strategic Human Capital Management. Addressing complex challenges such as disaster response, national and homeland security, and economic stability requires a high-quality federal workforce able to work seamlessly with other agencies and levels of government and across sectors. However, current budget and long-term fiscal pressures, coupled with a potential wave of employee retirements that could produce gaps in leadership and institutional knowledge, threaten the government’s capacity to effectively address these and many other evolving national issues. The Office of Personnel Management (OPM), individual agencies, and Congress have all taken important steps in recent years that will better position the government to close current and emerging critical skills gaps that are undermining agencies’ abilities to meet their vital missions. Although progress has been made, the area remains high risk because more work is needed in implementing specific corrective strategies for addressing critical skills gaps and evaluating their results. GAO added this area to its High Risk List in 2001.

      • Managing Federal Real Property. The federal government faces long-standing problems in managing federal real property,