Erm risk management

September-October 2006

In the News
BUSINESS TRANSFORMATION AGENCY LEVERAGES DOD ACQUISITION DECISION MAKING TESTING THE ENTERPRISE RISK ASSESSMENT MODEL
Paul K. Ketrick

and set the stage for real change, in real time.” The BTA charged the Investment Management (IM) directorate with testing the ERAM concept. At the conclusion of each successive test case, the BTA will reassess theeffectiveness of the process. (Test cases were implemented MaySeptember 2006) The question we have been asked is, “What is the genesis of ERAM, and how is it different from past recommendations?” In January 2006, the Defense Acquisition Performance Assessment Project, an external assessment, provided an independent review of and recommendations for the acquisition process. Similar recommendations in thepast hadn’t really been able to produce lasting change. The ERAM initial test cases present an opportunity to create solutions and set examples for credible and enduring change management. ERAM is a model that helps program managers determine the root cause of problems and issues within their programs and to define a process that helps in gaining a deeper understanding of issues and risks. Krieghas talked about our need to “distinguish between ‘Big A’ and ‘little a’ acquisition.” ERAM ties into his vision of a capabilities-focused acquisition decision-making process. The differences between what we decide to buy at the strategic level (Big A) and how we develop, test, produce, and sustain the programs (little a) allow us to deliver capabilities to the warfighter. The ERAM concept givesdecision makers increased visibility into their programs by providing insight without creating another layer of oversight, and it gives us situational awareness of both the Big A and little a in acquisition. The BTA has a strategic approach to investment management and to developing and testing ERAM. The overarching goal of the BTA is the rapid delivery of capabilities and informed decision making.Within that framework, the IM team is focused on a variety of issues, including integrated and aligned requirements definition, integrated DoD decision support systems, and efficient investment review—all of which allow us to keep our eye on that overarching goal. Tom Modly and Paul Brinkley (co-directors of the BTA) agreed that IM, among other strategic activities, should spend the next 12 monthsdeveloping, testing, and institutionalizing proven concepts to improve acquisition management process outcomes. ERAM ties directly into that strategy. It is important to note that conceptually, ERAM is no different from the Department of Defense Directive (DoDD) 5000 process. However, the assessment itself is a content-rich, energy-focused approach. It uses existing artifacts and documents thatallow us to leverage current acquisition decision-making processes. ERAM adheres to
46

E

nvision gaining deeper insight into the risks associated with major automated information systems within the business mission area without asking program managers to create new artifacts. Imagine program managers and senior Department of Defense leadership working together to create usable, actionablerisk mitigation plans that identify ownership and accountability from the program level up to the Office of the Secretary of Defense. Finally, picture an assessment model that looks across seven distinct risk areas (including people, processes, and external impacts) at a reduced cost and shortened schedule—again, without any additional oversight. That is the vision of the future for major businesssystems acquisition proposed by the developers of the Enterprise Risk Assessment Model (ERAM). In January 2006, the Defense Business Systems Management Committee approved test cases for a concept that modernizes the way DoD manages the acquisition of major business information systems. Part of the 2007 National Defense Authorization Act, ERAM represents a major opportunity for the Business...