	Background

The Comptroller General convened this expert panel from the U.S. and  abroad to advance a national dialogue on strengthening the use of risk  management principles to better manage homeland security programs. The forum brought together a diverse array of experts from the public and  private sectors, including, from the public sector, a former governor, a  former DHS under secretary, a U.S. Coast Guard Admiral, and senior  executives from DHS, the U.S. Army, and the National Intelligence  Council, as well as state and local officials with homeland security  responsibilities. Identifying Effective Risk Management Practices in the Private and Public Sectors

Participants discussed effective risk management practices used in the  public and private sector. For example, they discussed the concept of a  chief risk officer but did not reach consensus on how to apply the concept  to the public sector. The participants also identified examples of public  sector organizations that effectively integrated risk management into their  operations and compared and contrasted public and private sector risk  management practices. One key practice for creating an effective chief risk  officer, participants said, was defining reporting relationships within the  organization in a way that provides sufficient authority and autonomy for a  chief risk officer to report to the highest levels of the organization. However, participants did not reach consensus on how to apply the  concept of the chief risk officer to the public sector. Participants stated  that the U.S. government needs a single risk manager. One participant  suggested that this lack of central leadership has resulted in distributed  responsibility for risk management within the administration and  Congress and has contributed to a lack of coordination on spending  decisions. Identifying and Addressing the Most Critical Homeland Security Risk Management Challenges

Participants identified three key challenges to strengthening the use of risk  management in homeland security—risk communication, political  obstacles to making risk-based investments, and a lack of strategic  thinking. Key Challenges

Many participants, 35 percent, agreed that improving risk communication  posed the single greatest challenge to using risk management principles  (see fig. Risk Communication Challenges

Participants identified several risk communication challenges and  recommended actions to address them as follows:    Educate the public about risks and engage in public discourse to reach  consensus on an acceptable level of risk. Develop new risk communication practices to alert the public during  emergencies. Participants said there is a lack of a  national strategic planning process to guide federal investments in  homeland security. Fragmented approaches to managing security risk within and across  the federal government could be addressed by developing  governmentwide risk management guidance. Partnership and Coordination Challenges

Participants agreed that risk management should be viewed as the  responsibility of both the public and private sector. They identified  challenges related to public-private collaboration:    Private sector should be more involved in public risk assessments. They recommended that more state  and local practitioners and experts become involved in applying risk  management principles to homeland security. Strategic Budgeting: Risk Management Principles Can Help DHS  Allocate Resources to Highest Priorities. Homeland Security: Efforts to Improve Information Sharing Need to Be  Strengthened.
Why GAO Did This Study

From the terrorist attacks of September 11, 2001, to Hurricane Katrina, homeland security risks vary widely. The nation can neither achieve total security nor afford to protect everything against all risks. Managing these risks is especially difficult in today's environment of globalization, increasing security interdependence, and growing fiscal challenges for the federal government. Broadly defined, risk management is a process that helps policymakers assess risk, strategically allocate finite resources, and take actions under conditions of uncertainty. GAO convened a forum of 25 national and international experts on October 25, 2007, to advance a national dialogue on applying risk management to homeland security. Participants included federal, state, and local officials and risk management experts from the private sector and academia. Forum participants identified (1) what they considered to be effective risk management practices used by organizations from the private and public sectors and (2) key challenges to applying risk management to homeland security and actions that could be taken to address them. Comments from the proceedings do not necessarily represent the views of all participants, the organizations of the participants, or GAO. Participants reviewed a draft of this report and their comments were incorporated, as appropriate.

What GAO Found

Forum participants identified what they considered to be effective public and private sector risk management practices. For example, participants discussed the private sector use of a chief risk officer, though they did not reach consensus on how to apply the concept of the chief risk officer to the public sector. One key practice for creating an effective chief risk officer, participants said, was defining reporting relationships within the organization in a way that provides sufficient authority and autonomy for a chief risk officer to report to the highest levels of the organization. Participants stated that the U.S. government needs a single risk manager. One participant suggested that this lack of central leadership has resulted in distributed responsibility for risk management within the administration and Congress and has contributed to a lack of coordination on spending decisions. Participants also discussed examples of public sector organizations that have effectively integrated risk management practices into their operations, such as the U.S. Coast Guard, and compared and contrasted public and private sector risk management practices. According to the participants at our forum, three key challenges exist to applying risk management to homeland security: improving risk communication, political obstacles to risk-based resource allocation, and a lack of strategic thinking about managing homeland security risks. Many participants agreed that improving risk communication posed the single greatest challenge to using risk management principles. To address this challenge, participants recommended educating the public and policymakers about the risks we face and the value of using risk management to establish priorities and allocate resources; engaging in a national discussion to reach a public consensus on an acceptable level of risk; and developing new communication practices and systems to alert the public during an emergency. In addition, to address strategic thinking challenges, participants recommended the government develop a national strategic planning process for homeland security and governmentwide risk management guidance. To improve public-private sector coordination, forum participants recommended that the private sector should be more involved in the public sector's efforts to assess risks and that more state and local practitioners and experts be involved through intergovernmental partnerships.