State, Local and Education (SLED) organizations have to deal with a wide array of risks, and a lack of coordination between departments can lead to blind spots. Cybersecurity, finance, compliance, audit and IT teams may each track and manage their own risks effectively. But when risk information stays siloed in separate departments and systems, Government leaders lack an enterprise-wide view of their agency’s risk exposure. It becomes harder to see how risks interact, which ones pose the greatest threat to strategic goals and where limited resources should be allocated.
An enterprise risk management (ERM) program helps you coordinate risk management across departments and see how risks are interconnected throughout your agency. This guide shows you how to implement ERM step by step in your State or Local Government.
Understanding the Role of Enterprise Risk Management in Government
Enterprise risk management involves identifying and managing risks across an organization, rather than treating them as isolated departmental concerns. A reliable ERM program unifies risks in one place and shows how they’re connected and how they evolve in real time, allowing SLED organizations to respond to threats proactively.
With a comprehensive view of your risk posture, you can avoid Government strategies that have more downsides than upsides. The visibility likewise supports informed decision-making when setting budgets and allocating resources.
How to Build an Enterprise Risk Management Program for State or Local Governments
Every ERM program may address different risks, but the process for building one is generally the same. Here are the key steps to get started in your SLED organization.
1. Create an ERM Framework or Risk Governance Structure
Set rules and standards that determine how your Government agency identifies, evaluates, prioritizes, responds to and reports on risks. The goal is to have a consistent approach to managing risk instead of letting each department develop its own processes.
If you don’t want to create a risk governance structure from scratch, you can implement an ERM framework that public and Government organizations typically use. Examples include:
2. Identify and Prioritize Enterprise Risks
Find out what could prevent your SLED organization from achieving its strategic and operational objectives. Rather than relying on a single team to identify risks, gather input across departments, including IT, cybersecurity, finance, HR, procurement and compliance. Types of risks to consider include:
- Cybersecurity risks: Threats that could compromise Government systems or the delivery of public services
- Strategic risks: Factors that could prevent your SLED organization from achieving its long-term goals or adapting to changing compliance requirements
- Financial risks: Events that make it harder to stay within budget or fund essential Government services
- Operational risks: Things that could disrupt day-to-day operations
You can then use a risk assessment matrix to evaluate the likelihood and potential impact of the risks you identified. A matrix helps you prioritize risks, so you can allocate more resources to threats that are most likely to occur or those that could have devastating effects on your organization.
3. Establish Risk Ownership
Every risk should have an accountable owner, whether an individual or a team. Their responsibilities may include:
- Monitoring risk indicators (warning signs that a risk is about to occur or is growing)
- Maintaining risk treatment plans
- Reporting risk changes to leadership
- Coordinating mitigation activities
Assign risk owners based on who has the authority and knowledge to manage each risk. For example, a finance director might own the risk of a budget shortfall because their role and expertise enable them to monitor revenue, control spending and recommend budget adjustments.
4. Centralize and Connect Risk Information
Instead of keeping risk data in multiple disconnected sources, use a platform like Onspring to create a centralized risk register. With all your risk information in one place, teams can seamlessly coordinate risk management across departments and collaborate more effectively. You also connect each risk to related information, such as:
- Risk assessments
- Risk owners
- Internal controls and policies
- Compliance requirements
- Risk treatment plans and remediation activities
Linking this information shows you how different parts of your risk program fit together. For example, you can quickly see who owns a risk, which controls are in place to address it, whether those controls meet specific compliance requirements and what remediation activities are still outstanding. The interconnectedness gives Government leaders a clear view of risk exposure and makes it easy to track whether risks are being addressed effectively.
5. Develop Risk Response Plans
How your SLED organization responds to a risk depends on how likely it is to occur and how significant its potential impact would be. Key risk response strategies include:
- Acceptance: You choose to tolerate a risk rather than fix, avoid or transfer it. Opt for this when risk mitigation is more expensive than the potential loss.
- Transfer: You fully or partially shift the consequences of a risk to another party, usually through a contract or insurance policy. For example, a Local Government agency can purchase cybersecurity insurance to transfer the financial costs of a data breach to an insurer.
- Avoidance: You eliminate the risk by avoiding actions or decisions that could cause it. For example, your organization may choose not to adopt a technology that presents unacceptable data privacy risks.
- Reduction: If you can’t eliminate the risk, you adopt measures that minimize its likelihood or impact.
6. Use Risk Management Insights in Strategic Planning and Budgeting
Map risks to strategic objectives that they can influence. As a result, you understand not only what could go wrong but also how a risk could affect your agency’s ability to achieve its long-term goals.
Risk information can also inform budgeting and resource allocation. For example, if an organization-wide view of your risk posture shows that a risk identified by one department could disrupt services across several others, you can prioritize funding to address its root causes instead of treating it as a departmental issue.
7. Monitor Risks Over Time and Continuously Improve Your ERM Program
Risks change as Government budgets and regulations evolve. Monitoring them in real time helps you identify emerging issues before they become big problems. Track key risk indicators (KRIs), such as:
- Number of data breaches
- Frequency of unplanned system downtime
- Number of regulatory compliance issues
You should also monitor the effectiveness of your ERM strategies. Useful key performance indicators (KPIs) to track include:
- Average risk response time: How long it takes to respond to a risk
- Control effectiveness: The percentage of controls that are working as intended
- Audit findings: Internal and external audit issues identified per review cycles
KPIs and KRIs reveal which risk management strategies are working and which ones aren’t. Use them to make your ERM program more effective over time.
Improving ERM Programs in State and Local Governments
Building an effective ERM program for SLED organizations requires a centralized platform to unify data and manage risk organization-wide. Enterprise risk management software like Onspring helps you identify, analyze, monitor and mitigate risks in one place.
On the platform, you can see your agency’s risk posture in real time so you can respond proactively. You can also map risks automatically to internal controls and prioritize them by criticality.
Want to improve your operational resilience? Create a more proactive risk program with Onspring’s platform and book a demo today.
Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including Onspring, we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.
