Presentation by Vincent Tophoff, Senior Technical Manager, IFAC, at the Interagency Council on Enterprise Risk Management, in Washington, DC, January 20, 2015

1. Page 1 | Confidential and Proprietary Information
Governance, Risk Management, and
Internal Control in the Public Sector
Vincent Tophoff, International Federation of
Accountants (IFAC)
Interagency Council on Enterprise Risk
Management
White House Conference Center
Washington DC, January 20, 2015

2. Page 2 | Confidential and Proprietary Information
International Federation of Accountants
• Global organization of the accountancy profession
• Supports professional accountants in following areas:
– Governance and ethics
– Risk management and internal control (RM/IC)
– Sustainability and corporate responsibility
– Financial and performance management
– Business reporting
– Promoting and contributing to the value of professional accountants
• All areas of critical importance to professional accountants
(and for risk managers & public sector entities too…)

3. Page 3 | Confidential and Proprietary Information
Today’s Agenda
• Relationship between Governance, Risk
Management & Internal Control
• IFAC/CIPFA Public Sector Governance
Framework
• Risk Management & Internal Control Pitfalls
• Current Thinking
• COSO/ISO 31000 Standards
• Risk Management & Internal Control
Maturity
• Risk Manager “Call to Action”
• Q&A

4. Page 4 | Confidential and Proprietary Information
Relation of Public Sector Governance, RM & IC

5. IFAC/CIPFA Public Sector Governance
Framework

6. Page 6 | Confidential and Proprietary Information
• What are the main challenges for good governance in
public sector organizations?
– Sovereign debt crisis
– Shortage of funding / rationalization
– Short-termism
– Internationalization, technology, complexity
– Corruption
Public Sector Governance: Analyzing the Environment

7. Page 7 | Confidential and Proprietary Information
• What can a governance framework accomplish?
– Establish a benchmark for good governance
– Serve as a reference point for those developing or reviewing national
codes
– Help public sector organizations continually improve governance
systems
– Where no code/guidance exists, provide:
• A shared understanding of what constitutes good governance
• A powerful stimulus for positive action
Public Sector Governance: Analyzing the Environment

8. Page 8 | Confidential and Proprietary Information
Good Governance in the Public Sector:
An International Framework

9. Page 9 | Confidential and Proprietary Information
Public Sector Governance: International Reference Group
Yoseph Asmelash United National Conference on Trade & Development (UNCTAD)
Ian Ball Formerly IFAC
Andreas Bergmann International Public Sector Accounting Standards Board (IPSASB)
Jón Blöndal Organisation for Economic Co-operation & Development (OECD)
Carlo Cottarelli International Monetary Fund (IMF)
Robert Dacey US Government Accountability Office (GAO)
Steve Freer Formerly CIPFA
Gert Jönsson International Organization of Supreme Audit Institutions (INTOSAI)
Mervyn King King Committee on Corporate Governance
Ian McPhee Australian National Audit Office
Maurice McTigue George Mason University (USA)
Roger Tabor Professional Accountants in Business Committee, IFAC

10. Page 10 | Confidential and Proprietary Information
Framework:
• Foreword by Mervyn King, Chair, IIRC, and King Report, South Africa
• Definitions
• Principles-based to maximize relevance, applicability
• Sub-principles and supporting guidance to provide explanation
Supplement:
• Examples
– Provide practical experience and aid understanding
• Evaluation questions to consider
• Further reading
Public Sector Governance: Framework Layout

11. Page 11 | Confidential and Proprietary Information
The fundamental
function of good
governance in the public
sector is to ensure that
entities achieve their
intended outcomes while
acting in the public
interest at all times.
Public Sector Governance: Fundamental Function
• Good governance
tied to:
– Achieving intended
outcomes
– Acting in the public
interest at all times

12. Page 12 | Confidential and Proprietary Information
Public Sector Governance: Achieving Intended Outcomes
While Acting in the Public Interest at all Times

13. Page 13 | Confidential and Proprietary Information
Public Sector Governance: Explicit Attention to Managing
Risk
• “Proper risk assessment assists public sector entities in
making informed decisions about the level of risk they are
prepared to take, and implementing the necessary
controls, in pursuit of the entities’ objectives.”
• “Effective risk management better enables public sector
entities to achieve their objectives, while operating
effectively, efficiently, ethically, and legally.”
• “Governing bodies should ensure that entities have
effective risk management arrangements in place.”

14. Page 14 | Confidential and Proprietary Information
Public Sector Governance: Explicit Attention to Internal
Control
• “Internal control supports a public sector entity in achieving
its objectives by managing its risks while complying with
rules, regulations, and organizational policies.”
• “Controls are a means to an end: the effective management
of risks enables an entity to achieve its objectives.”
• “Public sector entities should also consider the need to
remain agile, avoid over-control, and not become overly
bureaucratic.”

15. Risk Management & Internal Control Pitfalls

16. Page 16 | Confidential and Proprietary Information
Serious Risk Management & Internal Control Flaws
• Having a compliance-only mentality
• Treating risk as only negative and overlooking idea that
entities need to take risk in pursuit of their objectives
• Risk management & internal control that is overly focused
on external financial reporting
• Regarding risk management & internal control as a
separate function or process
• Viewing risk management & internal control as
predominantly important for operations

17. Current Thinking

18. Page 18 | Confidential and Proprietary Information
Current Thinking About Risk
The safest place for a ship…
… is to stay in the harbor
But that’s not what ships were made for…

19. Page 19 | Confidential and Proprietary Information
Current Thinking About Risk
…Instead, ships were made to transport people & goods to
other destinations…
…And that involves risk…
So, what is risk?
• Risk is defined as the “effect of uncertainly on (setting and
achieving) the entity’s objectives” (ISO 31000)
• No Objectives = No Risk
• Therefore, risk should always be assessed in light of
(setting and achieving) the entity’s objectives!

20. Page 20 | Confidential and Proprietary Information
Current Thinking About Risk Management
Q: How does your entity address uncertainty in achieving its
strategic objectives?
A: Through our strategic management system
– Line management engaged in plan-do-check-act cycle
– Focused on achieving the entity’s objectives
Q: How does your entity address risk?
A: Through our risk management system
– (Separate) risk and control system, staff functionaries, risk register
– Focus on mitigating risk

21. Page 21 | Confidential and Proprietary Information
Risk Management
Rest of the entity
Current Thinking About Risk Management
What does this example tell us?
• That we, risk management professionals, have made
great progress in the area of risk management & internal
control…
• ..But that we, in the process, lost the other people in our
entity!

22. Page 22 | Confidential and Proprietary Information
Five lines of defense:
Current Thinking About Risk Management

23. Page 23 | Confidential and Proprietary Information
Five lines of defense:
Current Thinking About Risk Management
1. Players
2. Captain
3. Coach
4. Referee
5. USSF/FIFA

24. Page 24 | Confidential and Proprietary Information
Five lines of defense:
Current Thinking About Risk Management
1. Players (Operational Staff)
2. Captain (Supervisor /Line Manager)
3. Coach (Risk Manager)
4. Referee (Internal Auditor)
5. USSF/ FIFA (GAO/External Auditor)
Support
Line

25. Page 25 | Confidential and Proprietary Information
Current Thinking About Internal Control
Hindering the entity Enabling the entity
Good internal control = The Invisible Hand
From To

26. Page 26 | Confidential and Proprietary Information
• Is not to have effective
controls…
• Is not to effectively manage
risk…
But to
• Properly set & achieve its
objectives
• Better adapt to surprises and
disruptions
• And create sustainable value
Main Objective of a Public Sector Entity

27. Page 27 | Confidential and Proprietary Information
Risk Is Inherent to Setting Your Objectives

28. Page 28 | Confidential and Proprietary Information
Achieving Your Objectives Through Planning & Control
Strategic, tactical, and
operational planning & control
cycles
A
P
D
C

29. Page 29 | Confidential and Proprietary Information
RM/IC Integral to Achieving Your Objectives

30. COSO Frameworks
(also adopted by INTOSAI/GAO)

31. Page 31 | Confidential and Proprietary Information
2013 COSO Internal Control Cube

32. Page 32 | Confidential and Proprietary Information
2004 COSO ERM Cube
Will be revised
soon!

33. Page 33 | Confidential and Proprietary Information
COSO IC vs. COSO ERM

34. ISO 31000 Risk Management Standard

35. Page 35 | Confidential and Proprietary Information
ISO 31000 Principles, Framework & Process

36. Page 36 | Confidential and Proprietary Information
ISO 31000 Risk Management Principles
• Creates Value
• Integral Part of Organizational Processes
• Part of Decision Making
• Explicitly Addresses Uncertainty
• Systematic, Structured & Timely
• Based on “Best Available Information”
• Tailored
• Considers Human & Cultural Factors
• Transparent & Inclusive
• Dynamic, Iterative & Responsive to Change
• Facilitates Continuous Improvement

37. Page 37 | Confidential and Proprietary Information
ISO 31000 Risk Management Framework

38. Page 38 | Confidential and Proprietary Information
ISO 31000 Risk Management Process
To be applied in
every decision
making process
and subsequent
execution!

39. Page 39 | Confidential and Proprietary Information
COSO ERM vs. ISO 31000
Many entities use both COSO ERM & ISO 31000…
… Biggest challenge is that concepts are not aligned
COSO ISO 31000
Lengthy vs. Short
Focused on ERM vs. General approach to managing risk
One cube vs. Principles, framework & process
Skewed to negative vs. Risk can be positive or negative
Risk already exists vs. Risk tied to achieving objectives
Risk & opportunities vs. Opportunities also source of risk
More sequential process vs. More iterative process

40. Risk Management & Internal Control Maturity

41. Page 41 | Confidential and Proprietary Information
RM/IC Maturity Levels

42. Page 42 | Confidential and Proprietary Information
• Consult and Communicate!
• Consider good practice developments
• Use the Frameworks
• Perform gap analysis
• Determine performance
• Look at audit results
• Analyze serious flaws
• …
• Continuously move to improvement!
Thoughts on Assessing RM/IC Maturity

43. Page 43 | Confidential and Proprietary Information
RM/IC Maturity: Continuous Improvement
From RM/IC as objective in itself to RM/IC to help achieve objectives
From Auditor / staff driven to Driven from top down
From Rules-based to Performance & principles-based
From Off-the-shelf systems to Tailored to the entity
From Focused on loss minimization to Also focused on value creation
From Mainly hard controls to Recognizing culture & attitude
From Imposed to Implemented organically
From Stand-alone / “bolt-on” to Integrated / ”built-in”
From Static, out-of-date to Dynamic, evolving
From Seen as overhead to Seen as a sound investment
From Abandoned to Integrated in governance

44. Risk Manager “Call to Action”

45. Page 45 | Confidential and Proprietary Information
Risk Manager “Call to Action”
Risk managers play important roles in implementing
good governance and RM&IC in public sector entities:
• Build subject-matter-expertise regarding governance & RM/IC (incl.
IFAC/CIPFA Governance Framework, INTOSAI standards &
guidance, COSO Frameworks, ISO 31000)
• Educate the governing bodies, audit committees, management
teams & staff of the relevant public sector entities
• Champion the importance of good governance and RM/IC: fully
integrated in the entity’s overall system of management
• Support public sector entities through the provision of high-quality
advice, insight, and assurance

46. Page 46 | Confidential and Proprietary Information
Risk Manager’s Role - #1
Champion importance of good risk management:
• Risk managers communicate with public sector entity’s
leadership
• Attitude and actions of risk manager sets tone for good
risk management in public sector entities
• Promote integrating risk management into risk
management of public sector entity!
• Most important element: making RM/IC part of every
decision-making process and subsequent execution in the
entity!

47. Page 47 | Confidential and Proprietary Information
Risk Manager’s Role - #2
Support line management by providing high-quality
advice, insight, and assurance:
• Decisions should only be made with explicit understanding
of related risks and their potential consequences for
achieving an entity’s objectives
• Therefore, decision makers require relevant and reliable
information for their decision-making and control
processes

48. Page 48 | Confidential and Proprietary Information
Key Take Aways
• There are many flaws in current RM/IC practices
• Achieving the entity’s objectives is the overall goal; risk is
an inherent part
• Risk management should, therefore, be fully integrated in
the entity’s system of management
• Risk manager support RM/IC in various ways in the public
sector entities they oversee
• IFAC supports professional accountants/risk managers
• However, no matter the guidance provided…

49. Page 49 | Confidential and Proprietary Information
There will always be some …
… who do it their own way!