Stepped Up ERM Teresa Mc Kay Director Defense

Stepped Up ERM Teresa Mc. Kay Director, Defense Finance and Accounting Service ASMC Washington Chapter September 17, 2008

Agenda Enterprise Risk Management Why We Need Enterprise Risk Management Case Studies PWounded Warrior POut of Country Payments PAccounts Payable 2

A Complex Environment Fraught with Risk 54. 5 million general ledger accounts with billions of transactions $328 billion in military retirement managed 6. 9 million travel payments 154. 6 million payroll payments 865 active Do. D appropriations $446 billion in disbursements 14 million commercial invoices 3

What is Enterprise Risk Management? Enterprise Risk Management (ERM): An organization-wide approach that proactively identifies inherent risks and prevents or manages them 4

Why ERM Why do we use Enterprise Risk Management? 5

DFAS’ Approach to ERM Assess Plan Execute Sustain DFAS ERMP Implementation Activities: ERM Governance Business Environment Identification KRI Identification and Monitoring ERM Reporting Compliance Management Taxonomy, Risk Classification, and Policy Establish DFAS Risk Appetite ERM System/ Dashboard Development Incident Capture Process Communication, Training, and Awareness Risk and Control Identification and Assessment Control Testing Issue Management and Remediation 6

ERM Evolution Implementation Activities Implementation Outcomes Governance Development Training Sub-Core Self Assessment Core Area Risk Assessment Map Key Processes Perform Risk & Control Identification and Assessment Establish Risk Tolerance Risk Mitigation Develop Test Plans Develop Internal Control Questionnaires Dashboard Reporting Proactive, Risk-Aware Workforce Centralized repository of policies and procedural guidance Process Excellence DFAS Enterprise Risk Management Program DFAS Risk Management Maturity Ad Hoc Managed Current State Standardized Integrated Optimized Desired State, Implementation 7

Identifying Risk Document the process Identify risks and establish controls to mitigate those risks Evaluate, test and -- if necessary -- revise 8

Accountability is Key Accounts Payable: Own the process Identify Risks: What all can go wrong Prioritize: Develop an integrated strategy for solutions 9

Compliance Audit oversight Internal review Federal Managers’ Financial Integrity Act Compliance Improper Payments Information Act Financial Improvement and Audit Readiness Federal Financial Management Improvement Act Clinger-Cohen Act Balanced Scorecard Department of defense Information Assurance and Certification Accreditation Process Federal Information Security Management Act 10

Outcomes • Streamlined accounting and personnel processes • Better support for our customers • Peace of mind for Warfighters and their families 11

Case Study: Wounded Warrior • Inaccurate pay to wounded soldiers resulted in soldiers owing money to the government Background • Pay and personnel systems unable to handle situation • Congress and media were outraged • Number of erroneous payments significantly reduced • Hospitalized Soldiers contacted personally Results • Wounded In Action (WIA) database developed • Available financial personnel at Walter Reed and Landsthul hospitals • Overall processes and procedures improved 12

Case Study: Out of Country Payments • Billions of dollars spent on the Global War on Terror Background • Do. D unable to support financial operations in Iraq and Afghanistan using standard operating procedures • Army needed to improve internal controls for soldiers to be supported properly • Regulations for soldiers in contingency environment revised Results • Partnered with Army to improve controls and ensure payments are properly supported • Communication, training and interagency planning improved • Oversight/follow-up procedures established 13

Case Study: Accounts Payable • Disparate accounts payable processes. • Consolidated operations and standardized processes Background • Improved efficiency and effectiveness, exceeding customer expectations • In FY 07 saved $53 m by eliminating rework and increasing productivity • 55 errors identified • Dollar impact $7, 166, 567 Results • Employee coding training opportunities identified • Opportunities to apply Business Activity Monitoring identified üReduced improper payments üIdentified Fraud 14

Business Activity Monitoring The Future of BAM with DFAS Detect and Prevent Improper Payments are detected and corrective action injected automatically at the source. 15

Questions 16