Stay Informed
of New Reports
Twitter
Where To Report Waste
Fraud, Abuse, Or Retaliation
Where To Report Waste Fraud, Abuse, Or Retaliation

Audit of the NRC’s Implementation of the Enterprise Risk Management Process

Related Open Recommendations

Recommendation Number Recommendation Status Significant Recommendation Additional Details
1 Open Yes
Develop and implement a process to periodically communicate a consistently understood agency risk appetite.
2 Open Yes
Revise agency policies and guidance to: a. Designate the official agency risk profile document and remove references to it as a U.S. Office of Management and Budget (OMB) deliverable in Management Directive 4.4, Enterprise Risk Management and Internal Control and Office of the Executive Director for Operations Procedure 0960, Enterprise Risk Management Reporting Instructions. b. Fully address the risk profile components and elements in accordance with OMB Circular A-123, Management’s Responsibility for Enterprise Risk Management and Internal Control.
3 Open Yes
Implement an enterprise risk management maturity model approach by selecting an appropriate model, assessing current practices per the model, and making progress in advancing the model.
4 Open Yes
Establish and monitor implementation of procedures to ensure that Quarterly Performance Review (QPR) practices are fully performed, such as completion of the QPR Dashboard entries, and recordation of all management decisions of risk in the QPR meeting summaries and the Executive Committee on Enterprise Risk Management meeting minutes.
5 Open Yes
Reconcile the business lines structure with the Office of the Chief Financial Officer to have a common business lines structure list. (Deviations from the common business lines structure list for either the Quarterly Performance Review or reasonable assurance processes may be clarified with applicable justification noted).
6 Open Yes
Update policies and guidance to address Management Directive 4.4, Enterprise Risk Management and Internal Control, and Management Directive 6.9, Performance Management, links to the Quarterly Performance Review (QPR) and reasonable assurance processes to accurately reflect that both agency processes address different aspects of enterprise risk management (ERM). This includes, but is not limited to: a. Updating Management Directive 6.9 for the expanded risk responsibilities added to the QPR process; b. Explaining the role of the Programmatic Senior Assessment Team (PSAT) in the QPR process in Management Directive 6.9; c. Specifying the Executive Committee on ERM (ECERM) role in decision-making of PSAT risks and ECERM focus areas in Management Directive 4.4; d. Cross-referencing Management Directive 4.4 to Management Directive 6.9 to clearly show that ERM implementation activities through the QPR process eventually lead to the ERM focus areas and the reporting of ERM in the Integrity Act statement; and, e. Including Management Directive 4.4 and Office of the Executive Director for Operations (OEDO) Procedure - 0960 in Management Directive 6.9, “Section VI. References.”
7 Open Yes
Update policies and guidance to clarify the effective date of the quarterly risks in the Quarterly Performance Review (QPR) process.
8 Open Yes
Require enterprise risk management-specific training that addresses U.S. Office of Management and Budget Circular A-123, Management’s Responsibility for Enterprise Risk Management and Internal Control requirements and current best practices, and periodically provide them to NRC personnel with ERM responsibilities.
Displaying 8 of 8 Recommendations