More Related Content
What's hot
What's hot (20)
Similar to Communicating and Managing Risks at NGA
Similar to Communicating and Managing Risks at NGA (20)
More from Max Justice
More from Max Justice (7)
Recently uploaded
Recently uploaded (19)
Communicating and Managing Risks at NGA
- 1. Tech Day VII Chip Justice and Courtney Lane Booz Allen Hamilton Tech Day VII Ritz Carton Monday, November 13, 2006 McLean, VA Communicating and Managing Risks within the National Geospatial- Intelligence Agency (NGA)
- 2. 2Communicating and Managing Risks within the National Geospatial-Intelligence Agency (NGA) Agenda Defining Risk Management – Chip Programmatic Development – Courtney Identifying Managing Risks – Courtney Changing A Culture – Chip Applying Risk Management to other Organizations – Chip
- 3. 3Communicating and Managing Risks within the National Geospatial-Intelligence Agency (NGA) Agenda Defining Risk Management – Chip – Industry Definition vs NGA definition – Purpose & Goals – Value of Risk Management – Opportunities & Issues Programmatic Development – Courtney Identifying and Managing Risks – Courtney Changing A Culture – Chip Applying Risk Management to other Organizations – Chip
- 4. 4Communicating and Managing Risks within the National Geospatial-Intelligence Agency (NGA) What is a Risk? A threat or obstacle that prevents an organization from achieving its objectives A hazard The future chance or probability of loss
- 5. 5Communicating and Managing Risks within the National Geospatial-Intelligence Agency (NGA) Let’s take a look how Industry defines RiskRisk “The potential inability to achieve overall program objectives within defined cost, schedule, and technical constraints and has two components (1) the probability/likelihood of failing to achieve a particular outcome, and (2) the consequences/impacts of failing to achieve that outcome.” [1] “...an uncertain event or condition that, if it occurs, has a positive or negative effect on a project objective.” [2] “RISK (risk) n. [Fr. risqué < Ital. risco.] 1. Possibility of suffering harm or loss: DANGER. 2. A factor, course, or element involving uncertain danger: HAZARD….” 3. a. The danger of probability of loss to an insurer. b. The amount that an insurance company stands to lose. c. One considered with respect to the possibility of loss to an insurer <a good risk>. ” [3] [1] Risk Management Guide for DoD Acquisition, Fourth Edition DoD, DAU, DSMC, February 2001 [2] Project Management Institute PMBOK®, 2001 Edition [3] Webster’s II University Dictionary
- 6. 6Communicating and Managing Risks within the National Geospatial-Intelligence Agency (NGA) NGA tends to define risk much like that of the DAU but further breaks it down into three categories Risk The potential inability to achieve objectives Opportunity The potential ability to exceed objectives Issue An unfavorable circumstance that is certain to affect achievement of objectives
- 7. 7Communicating and Managing Risks within the National Geospatial-Intelligence Agency (NGA) How do you communicate your risks?
- 8. 8Communicating and Managing Risks within the National Geospatial-Intelligence Agency (NGA) Process • Define a risk management process based on the ERM process • Introduce risk management process documents into the Enterprise Configuration Control Board (ECCB) • Recommend process improvements • Decision making process / Decision point (Requirements, spending) NGA communicates their risks through standardized processes utilizing People, Processes, and Technologies People Process Technology People • Promote a risk management culture that is supported and championed by leadership across the Enterprise • Communicate the standup of the risk management process through known and established communication channels • Provide training through established workshops Technology • Promote the use of the web-based Risk, Issue, and Opportunity Tool (RIOT) to capture and report information regarding risks, issues and opportunities Much like Booz Allen Hamilton, NGA focuses on People, Process & Technology in their transformation initiatives
- 9. 9Communicating and Managing Risks within the National Geospatial-Intelligence Agency (NGA) Enterprise Risk Management (ERM) Vision Effective planning and program implementation Integrate good risk information with decision activities for better planning UNCLASSIFIED UNCLASSIFIED
- 10. 10Communicating and Managing Risks within the National Geospatial-Intelligence Agency (NGA) Understanding the risk management process is the key to defining the purpose and the goals of every directorate within NGA Purpose & Goals – Identify the Agency’s Top Risks so that NGA can direct the right amount of resources, at the right time, to implement the right solution – Ensure that all NGA directorates understand the identified risk with a mitigation plan that is created from a common frame of reference – Create a bottom-up and top-down approach to Enterprise Risk Management – Track overarching or summary level risks and use that information to assist with strategic decisions – Instill the belief in the workforce that communicating risks is a positive, not negative, process that is rewarded, not punished
- 11. 11Communicating and Managing Risks within the National Geospatial-Intelligence Agency (NGA) The value of risk management is that it is inline with Industry best practices and coincides with NGA’s mission Process compliant with industry standards Unified risk management process Web-based risk management tool Improved participation and communication throughout the Agency Increase visibility with all stakeholders Achievement of organizational objectives Defining the value of the ERM process is different for every organization, the key is understanding how you define ‘Value’ Defining the value of the ERM process is different for every organization, the key is understanding how you define ‘Value’
- 12. 12Communicating and Managing Risks within the National Geospatial-Intelligence Agency (NGA) So why implement a Enterprise Risk Management (ERM) program? It can almost be thought of as situational awareness and capital improvement all in one By identifying risks, executive leadership and mid level management can make a decision that is based on solid information with a strategy to mitigate the risk at hand Management can look to see which are the most critical risks within the agency and then define the appropriate resources to resolve the issue If implemented correctly, the entire enterprise will benefit from understanding the most important issues and the biggest challenges
- 13. 13Communicating and Managing Risks within the National Geospatial-Intelligence Agency (NGA) Agenda Defining Risk Management – Chip Programmatic Development – Courtney – NGA Risk Management Process – Implementation at the Program Level Identifying and Managing Risks – Courtney Changing A Culture – Chip Applying Risk Management to other Organizations – Chip
- 14. 14Communicating and Managing Risks within the National Geospatial-Intelligence Agency (NGA) An enterprise risk management process should be documented to ensure standardization Process documentation contains the following information: – Tasks required to implement the ERM process – Entry and exit criteria – Inputs and outputs – Roles and responsibilities – Required measures Templates and training materials should be made available – Risk management plan templates – Briefing templates – Enterprise risk management training package
- 15. 15Communicating and Managing Risks within the National Geospatial-Intelligence Agency (NGA) Projects and programs should tailor the ERM process to meet their needs The following elements of the ERM process can be tailored by projects and programs: – Stakeholders – Probability and consequence definitions – Risk tolerance thresholds – Roles and responsibilities – Communication plan – Measures Each project and program should document their risk management process in a risk management plan
- 16. 16Communicating and Managing Risks within the National Geospatial-Intelligence Agency (NGA) Risk management at NGA is an iterative, tailorable process Source: Adapted from the Software Engineering Institute’s“Continuous Risk Management Guidebook” Lessons learned Validated risks, issues, opportunities Classification Rating Handling Priority Mitigation Plans Contingency Plans Triggers Status reports Communication Project Kick-Off ERM 03 Analyze ERM 04 Plan ERM 05 Monitor ERM 06 Control ERM 02 Identify ERM 01 Develop Strategy
- 17. 17Communicating and Managing Risks within the National Geospatial-Intelligence Agency (NGA) Agenda Defining Risk Management – Chip Programmatic Development – Courtney Identifying and Managing Risks – Courtney – Identifying Risks – Analysis and Planning – Monitor and Control Changing A Culture – Chip Applying Risk Management to other Organizations – Chip
- 18. 18Communicating and Managing Risks within the National Geospatial-Intelligence Agency (NGA) There are four elements to risk identification at NGA Title Captures the “so-what” Statement For risks and opportunities: “If [concern], then [consequence or benefit] For issues: “[Statement of concern]; thus, [consequence] Context Facts only (who, what, when, where, why) Avoid assumptions Do not introduce new risks Avoid blame Closure Criteria Must alleviate the concern in the statement to an acceptable level Must be specific, actionable, and measurable 4 2 1 3
- 19. 19Communicating and Managing Risks within the National Geospatial-Intelligence Agency (NGA) Risks are analyzed and handled using the appropriate method Qualitative analysis is performed to determine: – The level of cost, schedule, and performance impacts – The probability of occurrence (probability is 100% if it is an issue) Results are mapped on a probability impact diagram to determine the risk level A handling method is chosen depending on the type of risk: – Mitigate, Resolve, Exploit – Watch – Transfer – Assume Plans for reducing the probability of occurrence or severity of consequence if the risk occurs are developed Probability Impact Diagram ProbabilityofOccurrence Consequence Level Negligible Marginal Significant Catastrophic 0-19% Highly Unlikely 20-39% Unlikely 40-59% Likely 60-79% Highly Likely 80-99% Near Certain 100% Issue Critical
- 20. 20Communicating and Managing Risks within the National Geospatial-Intelligence Agency (NGA) Risks and progress on their plans must be monitored and controlled Monitoring risks is extremely important – New programs are created – Resource levels change – Funding status changes – New supporting information is discovered Risks should be updated to reflect any changes found in the Monitor step Controls (risk boards) are in place at every level of NGA to monitor risks. These boards can make several decisions about each risk: – Reject (need more information or rework) – Accept – Escalate – Return for status – Close
- 21. 21Communicating and Managing Risks within the National Geospatial-Intelligence Agency (NGA) Risk Controls at NGA NCEE Directorate JOIO IT/IS EEGeoScout Key Component Risk, Issue, and Opportunity Management Board (KC-ROMB) Risk Management Core Team (RMCT) ELG Strategic Risks Enterprise Risks Directorate Level Risks Program Risks Joint Risk Process
- 22. 22Communicating and Managing Risks within the National Geospatial-Intelligence Agency (NGA) Agenda Defining Risk Management – Chip Programmatic Development – Chip Identifying and Managing Risks – Courtney Changing A Culture – Chip – Obtaining Buy-in & Support – Risk & Reward vs. Exposure & Condemnation – Defining a Concept of Operations (ConOps)/ Risk Management Plan – Training Applying Risk Management to other Organizations – Chip
- 23. 23Communicating and Managing Risks within the National Geospatial-Intelligence Agency (NGA) Where do you stand with the evolution of risk management? Problem Stage “I’m too busy to apply a formal risk management practice.” Risk identification not seen as positive. “What went wrong?” Mitigation Stage “Risk Management is What Managers Have to Do” Aware of risks but not sure how to communicate them “What can go wrong and what are the consequences?” Prevention Stage “Risk Management is everybody’s responsibility.” Risk management is viewed as a team activity Identification and elimination of root causes “What caused the risk?” Anticipation Stage “We can focus on the right priorities” Use of measures to anticipate predictable risks Alternatives are easy to compare using a quantitative approach “How can we proactively attack risks and assess alternatives?” Opportunity Stage “Where there is risk, there is opportunity” Risks are a chance to do better than planned Risk management is used to innovate and shape the future Engineering excellence “How can we take advantage of risks?” Increasing levels of knowledge, commitment, communication, efficiency, and effectiveness enable transformation through each stage Increasing levels of knowledge, commitment, communication, efficiency, and effectiveness enable transformation through each stage Source: NGA Enterprise Risk Management Training Workshop
- 24. 24Communicating and Managing Risks within the National Geospatial-Intelligence Agency (NGA) Defining and utilizing the risk management process will not succeed with just executive level support The risk management process has to be embraced by the entire organization and championed by Leadership Obtain buy-in through: – Using checklist for standardization – Providing guidelines – Encouraging and welcoming open communications between individuals, departments, and organizations – Taking Surveys – Evaluating the upside and downside of the risk Obtain commitment and resource from leadership. At this point, risk management automatically becomes a management priority and leadership becomes an advocate of risk management and supports the process
- 25. 25Communicating and Managing Risks within the National Geospatial-Intelligence Agency (NGA) Changing a culture is not easy, but a little praise could not hurt The key is to understand that 'risk' exists and it can be managed and rewarded Training, Training, and Training instilling Risk & Reward vs. Exposure & Condemnation Leadership Communications – Talking points – Brown bags – Define why holding risk information is not a benefit Transition to a Risk Aware (Manage the Risk), not Risk Adverse culture
- 26. 26Communicating and Managing Risks within the National Geospatial-Intelligence Agency (NGA) Defining a Risk Management Plan is a must if you want your ERM program to succeed Identify, Evaluate and Manage the process for risks management Develop Comprehensive Safety/Loss Control Programs Policies and Procedures that is tailorable to specific risk Establish a Catastrophic Business Continuation or COOP Program Transfer Risk Whenever Economically Feasible through Insurance, Legal Contracts, and Avoidance Analyze/Re-evaluate Your Risks on a reoccurring basis Identify best practices Benchmark and define standards/metrics
- 27. 27Communicating and Managing Risks within the National Geospatial-Intelligence Agency (NGA) NGA has implemented a very effective training program that address risks, mitigation, and NGA’s culture Enterprise Risk Management Training Workshop – One day workshop held at least once a month – Trained over 500 NGA contractors and government employees – Teaches the risk management language at NGA, the enterprise risk process, and allows students to practice identifying and managing risks Executive Level Overview Training – 2 hour overview of enterprise risk management at NGA – Presented to senior level NGA management – Describes the process and how management can engage
- 28. 28Communicating and Managing Risks within the National Geospatial-Intelligence Agency (NGA) Agenda Defining Risk Management – Chip Programmatic Development – Chip Identifying and Managing Risks – Courtney Changing a culture – Chip Applying Risk Management to other Organizations – Chip – Lessons Learned – Best Practices
- 29. 29Communicating and Managing Risks within the National Geospatial-Intelligence Agency (NGA) Communicating risks can be implemented better by understanding the Lessons Learned from previous risks Identify Communicate Learn
- 30. 30Communicating and Managing Risks within the National Geospatial-Intelligence Agency (NGA) Implementing best practices assists in communicating effectively
- 31. 31Communicating and Managing Risks within the National Geospatial-Intelligence Agency (NGA) Plan Standard definitions Processes Team training Plan Standard definitions Processes Team training Using a Risk Management process that is consistent with existing government and industry best practices results in easier client buy- in, implementation and results DAU Risk Management Community of Practice Identify Situation Uncertainty Impact Actions Identify Situation Uncertainty Impact Actions Control Mitigation Contingency Plans Control Mitigation Contingency Plans Analyize Probability Impact Outcomes Analyize Probability Impact Outcomes Monitor Maintain history Monitor plans Periodic updates Monitor Maintain history Monitor plans Periodic updates One Firm delivering results that endure
- 32. 32Communicating and Managing Risks within the National Geospatial-Intelligence Agency (NGA) How to Learn More… DAU – PMCoP (https://acc.dau.mil/CommunityBrowser.aspx) – New Risk Management Guide, Aug 2006 – Acquisition Review Quarterly, “Risk Special Edition”, Spring 2003 PMI – http://www.pmi.org/info/default.asp – PMBOK – Risk SIG INOCSE – https://www.incose.org – Risk Management Working Group Prince2 – Projects in controlled environments http://www.tsoshop.co.uk Read!
- 33. 33Communicating and Managing Risks within the National Geospatial-Intelligence Agency (NGA) Closing Remarks The Director of Central Intelligence Directive (DCID) 8/1, identifies risk management as “Balancing the goal of greater intelligence information sharing with the need to protect sources and methods requires IC members to apply a risk management methodology. This policy must be implemented in ways that balance the risk of unauthorized disclosure of sources and methods against the imperative to provide the most useful and responsive intelligence. The information needs of the customer must be given important weight in this risk management determination.”
- 34. 34Communicating and Managing Risks within the National Geospatial-Intelligence Agency (NGA) Q& A
Editor's Notes
- &lt;number&gt;
- Colleagues, welcome back from lunch, I am Chip Justice and my co-author & presenter is Ms Courtney Lane and today we are here to talk about Risk Management
- Within this presentation, we will discuss NGA’s approach to enterprise risk management, identifying the value of risk management, and how this approach can be leveraged by you to implement at your customer locations. How many of you think that risk management is a process that should be defined within your customer’s PMO and/or your customers project management methodology? How many of you believe that by identifying risks your customer will be able to deliver their projects on time, within budget and the originally defined scope? How many of you have a customer that have a defined and formal risk management process For those of you were not able to answer yes to all three, then it’s it obvious that you need to have a defined Risk Management process and the information contained within this Deck could be used by you and your customer to build a Risk Management program
- Here is a common definition of risk. This is a good start in defining Risk for your customer, however, it’s only a start. Typically people think of risk in many ways and it is important to have a formally defined definition for risk.
- So let’s look at a few more examples Some people may look to other known and well defined definitions of risk like that of the PMBOK or Websters, however, wouldn’t it be better for your organization if you had a single tailored definition for risk
- For NGA we needed to have a standardized definition, so we modeled our definition to something that is similar to DAU. For you, you need to understand that a risk management process is tailorable, but it is vital that you define it so that everyone is speaking from the same frame of reference What I would like to point out with this definition is that Risk & Opportunity has a degree of uncertainty and Issues are 100% Also, as Courtney and I talk about risk in this briefing, we are actually talking about all three: risks, opportunities, & issues
- So how do you communicate your risks and risk management process. Hopefully you have a defined & mature communication process and it is known by all of your stakeholders
- Much like Booz Allen Hamilton, NGA focuses on People, Process & Technology within their transformation initiatives The take away from this slide is that you must know that everything within your risk management process doesn’t necessarily overlap, but they all relate and that changing one piece of technology might mean that you need to look at your defined processes and the people working those processes with the technology.
- &lt;number&gt; The vision of Enterprise Risk Management is that it cannot be a stand alone process and the Risk Information contained within your customers ERM process should be integrated into all of your decision activities and processes People might look that this picture and wonder just how does a prism define the vision for Risk Management. ERM is like the rays from the sun, the prism is like the NGA decision activities by separating everything into the data elements, and the output of the ERM process is the filtered light that can be used by a wide spectrum of programs and processes that need this information for effective decision and planning elements All project managers know, proper planning is the key to a successful project, so the take away from this is simple, you need to integrate your risk management program into you project planning and decision activities in order to have a successful project
- Any organization that cannot properly assess risk will be unprepared and unable to react in a timely manner due to the uncertainty of a combination of tangible and intangible information involved in risk assessment. Further, it’s difficult to show an audit trail that cannot explain how decisions about risk get made. By implementing a well-defined enterprise risk management plan, any organization will be able to ensure that they do not operate in stovepipes, but more so in an integrated manner to help reduce cost, schedule and performance impacts. The last item identified (Instilling belief in the workforce) is a goal and has been a long time roadblock for NGA in its culture, but with the right training, communication, and define processes, this goal can become a reality.
- NGA understands that they do not have all of the answers, so they looked at some of industry’s best practices to define their Enterprise Risk management solution They did this because NGA perceives the value of Enterprise Risk Management lies in the fact that with the proper identification and reduction of risks, the Agency will be able to increase productivity and develop Enterprise strategies to manage future risks and exploit potential opportunities
- Implementing an ERM solution can almost be thought of as an investment into an organizations&apos; situational awareness because it will assist you in making mid & senior level decisions, it will help in identifying an organizations’ most critical risks, and if implement correctly it will be a primary venue for communicating any known challenges. Many risk managers have attempted to take enterprise risk management (ERM) from a slick consulting pitch to a practical management system. But while ERM has helped many organizations improve the strategic structure of their risk programs, few have fully achieved their ambitions. Therefore, you need to focus on ERM as a capital investment to your organizations situational awareness.
- The challenge is not just to manage risk more efficiently, but also to affect the kind of institutional change within the organization that would outlive the current employee base
- (point to slide) So where dose your organization stand with Risk Management. (count to 4) These are the typical characteristics showing the evolution of risk management. Are you on the Bottom or the Top? If you anywhere below the Opportunity stage, maybe you want to develop a plan to get there. Everyone starts at the Problem stage, and hopefully everyone wants to drive to the opportunity stage You should always scale your ERM process to whatever competency, budgetary and other business restraints may exist. If your risk management solutions have not yet developed a mature relationship, if they don’t have a big budget with lots of resources, then scale your requests to something that is possible for you to achieve. It’s all about taking it one step at a time Just so you have an idea of where we are, NGA is in between the problem and mitigation stage
- A risk management process will not succeed if you have a culture that is anti-risk. Risks goes against what many managers are taught. They often believe that you have to quantify everything down to the spreadsheet level, lock it all in, and then tightly control to those numbers. This is not the case! The workforce needs to understand that if something does happen, whether they have all of the information or not, they need to react quickly with the information available and make a decision that is in the organizations’ best interest This can only happen if it is promoted by your executive leadership. Additionally, you need to obtain workforce and customer buy-in. It might be as simple as developing a Risk Checklist and adding the check list to your project templates. Or you may look to standardizing the way to identify and work a risk so that every person understands that there is a defined set of guidelines in which to handle a situation Finally, everyone needs to see that if leadership believes that Risk Management is important and that they are providing resources for the ERM solution and therefore is a priority for the organization
- You can define a process to the ninth degree, you can set it in stone, however, if you do not communicated the new process effectively and you have a culture that has not bought into the ERM process, it is not going to succeed. So here are just a few ideas on how to change the mind set of your organization and the culture within that organization. (Point to slide) Myself, I would make sure that you have leadership buy-in and commitment nailed down. After you do, you will need to obatin the resources necessary for management, process development, training, and communication The final bullet should be your goal for the culture, to have a risk aware, not risk adverse culture
- So now you have buy-in, you are working to change the culture, but you still have yet to define your plan. So where do you start, here are some possible tactics: Define what it is that you want to manage by adding a Risk category to formal status reports, status meeting agendas, and work order documents. Discuss newly found risks and identify the actions taken and update the project plan. In some organizations you will want a safety and loss control program where you include an assessment of the likelihood of the risk occurring and the likely impact to resources in cost, time, and quality. In every organization you need to define when is it acceptable to transfer the risk and that the transferee has accepted the risk You also want to document each risk in management terms for purposes of analysis, education and discussion. I&apos;ve found spreadsheets to be effective in some organizations but databases in others . The key is to make sure that the risk information that you have is valid and available to all And finally you want to Benchmark your process by doing good risk planning and keep risks out in the open and identify if you have an legal liabilities to this information.
- So we have defined risk, we have defined the plan, put we need to get everyone on the same page. To do this, NGA has implemented two training programs, on for the workforce, and one for the executives. Both are utilized for the same reason, to communicate and enlighten the culture as to the value of Risk Management, and to bring everyone up to the same operating platform
- Communication is a valuable risk management tool that can help build awareness, support and “buy-in” in the event of risk impacts / changes. (1 Enter) Communications almost never averts risks but it is very useful in managing expectation and can often lead to other solutions. Additionally, though the use of effective risk communication and by (2 Enter) understanding lessons learned, we can simultaneously acknowledge the significance of differing opinions and the importance of the information itself Some examples include Communicating current risks, potential impacts and/or mitigating strategies (enter 3) as part of the regular stakeholder communications Immediately notifying all stakeholders if a risk becomes an issue, including the potential impacts and actions being taken And finally you will want to continue to update all stakeholders regularly until the risk or issue is overcome
- Implementing an effective Risk communications plan is can actually quite easy, it can be as simplistic as a poster or billboard, or it can be as elaborate as a Command center that physically contacts your stakeholders, the key is to make absolutely sure that you have identified the venue and audience for each project event that requires a communication strategy You will want to include ALL stakeholders in the communications plan And you will want to align the communication plan with the project plan by identifying everyone’s roles and responsibilities within risk management plan You will also want to solicit input from all of your stakeholders when developing and engaging in risk planning and mitigation activities If you are unsure wear to start you need to look not further than PMI, the Gartner Group, ISO and ITIL processes. Once you have the practices in place you can look to such tools as Prince 2 and OPM3 to see just how mature your processes are and if they are providing the ROI that your organization expects with your risk solution
- The overall take away from this presentation is that if you plan to succeed in Project Management, you must understand that Risk and the Risk Management process needs to be an integral part of the decision making process for your customer And you must develop a risk management process that is bought into, easy to implement, and delivers results. So when it’s your turn to implement a risk management solution, you need to look no future than the methodologies within Booz Allen and our partnering organizations such as INCOSE and PMI If you do, I am sure that you will succeed and your customer will be able to strategically meet their goals and implement a technical solution that will help you in delivering Risk solutions that will endure.
- If you need more information on Risk Management, I highly recommend that you look at these fine web site, read a couple of books or go for the synopsis and revisit our brief
- This afternoon, Courtney spoke to you a little about Communicating Risks with the NGA and we hope that you have picked up on some valuable experiences that we have had while at NGA. We along with NGA have defined Risk Management, we have discussed the programmatics of risks, we have shown you how to identify and manage your risks, we have presented the obstacles of changing the culture and we have given you the tools and content required for you to implement a Risk Management program for your customer. What you must be aware of is that this program cannot be stood up over night. NGA has been working for the past couple of years to quantify its Risk Management program and is still learning this art of balancing the strategic goals of the Intelligence Community and learning to communicate not just risks, but communicating its issues and opportunities associated with risk identification to its internal and external stakeholders. As NGA matures this program, the Agency will be able to deliver and meet the expectations of not only DCID 8/1, but the expectations of the Warfighter and the citizens of the United States.