I have yet to hear of anyone’s risk profile, including my own, that includes opportunities, even though A123 requires risk profiles to include opportunities. Why is that?

Question asked by

AFERM Experts Say...

While OMB Circular A-123 requires agencies to present instances of uncertainty (i.e., opportunities and threats), where applicable, it does not necessarily mean that both will be presented in the risk profile. However, there are likely two reasons why opportunities are not readily identified in Federal risk profiles to the extent that threats are identified:

• The Federal government is inherently risk averse; and
• Most agencies are still in the early stages of ERM program maturation.

Because of the Federal government’s unique position, in comparison to perhaps a commercial entity, the Federal government tends to lean towards stability instead of volatility.  This places more emphasis on managing downside risks, or threats, and seeking to monitor or minimize the accompanying risk exposure.  Identifying and seeking to exploit opportunities involves numerous constraints in the Federal space, including potential alignment with the President’s agenda and the agency’s mission and priorities, not to mention sufficient funding to pursue the opportunity.  However, trends in information technology modernization, business intelligence, data analytics, and shared services, may support near-term reporting of opportunities in agencies’ risk profiles.

Secondly, it is taking time to shape agency risk culture and awareness to understand that risk essentially translates to uncertainty, and that uncertainty is not always negative. Focusing early ERM adoption and implementation strategies on enterprise risks helps build the foundation of an effective ERM program that may eventually seek to identify, exploit, and report on opportunities.  Additionally, ERM may be leveraged to review and understand existing risk exposures when evaluating new strategic objectives and opportunities.  Due to many Federal ERM programs still being in their early stages of implementation, adopting a risk profile and a risk awareness that promotes the identification of opportunities will take time to complete.