In July 2016, OMB updated its Circular No. Updated ERM Framework Provides Assistance to Agencies as They Implement ERM

To assist agencies in better assessing challenges and opportunities from  an enterprise-wide view, we have updated our risk management  framework first published in 2005 to more fully include recent experience  and guidance, as well as specific enterprise-wide elements. We identified six essential elements to assist federal agencies as they  move forward with ERM implementation. Assemble a comprehensive list of risks, both threats  and opportunities, that could affect the agency from achieving its  goals and objectives. Subject matter  specialists noted that a good practice includes continuously  monitoring and managing risks. Emerging Good Practices Are Being Used at Selected Agencies to Implement ERM

We identified six good practices that nine agencies are implementing that  illustrate ERM’s essential elements. Below in table 1, we identify the essential elements of ERM and the good  practices that support each particular element that agencies can use to  support their ERM programs. One that provides for an integrated view of risk across the entire  Federal Student Aid organization; aligns strategic risks with the organization’s goals  and objectives; ensures that risk issues are integrated into the strategic decision  making process; and manages risk to further the achievement of performance goals.”
During the initial implementation of FSA's ERM program, the ERM  strategic goals were to:   1.  provide for an integrated view of risks across the organization,  2.  ensure that strategic risks are aligned with strategic goals and  3.  develop a progressive risk culture that fosters an increased focus on  risk and awareness of related issues throughout the organization, and  4.  improve the quality and availability of risk information across all levels  of the organization, especially for executive management. For example, PIH has two risk management dashboards,  which it uses to monitor and review risks. Agency Comments and GAO Responses

We provided a draft of this report to Office of Management and Budget  (OMB) and the 24 Chief Financial Officer (CFO) Act agencies for review  and comment. OMB staff provided us with oral comments and stated  they generally agreed with the essential elements and good practices as  identified in this report. They also provided technical comments that we  incorporated as appropriate.
Why GAO Did This Study

Federal leaders are responsible for managing complex and risky missions. ERM is a way to assist agencies with managing risk across the organization. In July 2016, the Office of Management and Budget (OMB) issued an updated circular requiring federal agencies to implement ERM to ensure federal managers are effectively managing risks that could affect the achievement of agency strategic objectives.
GAO's objectives were to (1) update its risk management framework to more fully include evolving requirements and essential elements for federal enterprise risk management, and (2) identify good practices that selected agencies have taken that illustrate those essential elements.
GAO reviewed literature to identify good ERM practices that generally aligned with the essential elements and validated these with subject matter specialists.
GAO also interviewed officials representing the 24 Chief Financial Officer (CFO) Act agencies about ERM activities and reviewed documentation where available to corroborate officials' statements. GAO studied agencies' practices using ERM and selected examples that best illustrated the essential elements and good practices of ERM.
GAO provided a draft of this report to OMB and the 24 CFO Act agencies for review and comment. OMB generally agreed with the report. Of the CFO act agencies, 12 provided technical comments, which GAO included as appropriate; the others did not provide any comments.

What GAO Found

Enterprise Risk Management (ERM) is a forward-looking management approach that allows agencies to assess threats and opportunities that could affect the achievement of its goals. While there are a number of different frameworks for ERM, the figure below lists essential elements for an agency to carry out ERM effectively. GAO reviewed its risk management framework and incorporated changes to better address recent and emerging federal experience with ERM and identify the essential elements of ERM as shown below.
GAO has identified six good practices to use when implementing ERM.