RM.4_Authority_Enterprise_Risk_Management_Policy.pdf

Authority Document Control Number (ADCN) POLl-1103

Approval Date 08/10/2022

Document Title Enterprise Risk Management Policy

Former ADCN(s)

Revision Number 0

Role Name Title Acceptance Date

Policy Drafter Sam Staples Consultant 06/29/2022

Policy Coordinator Alicia Barrios SSMI 07/12/2022

Policy Manager Alison Bietz Staff Services Manager I 07/12/2022

Reviewer 1 Thomas Fellenz Attorney IV 07/12/2022

Reviewer 2 Pam Mizukami Chief Deputy Director (E) 08/01/2022

Legal Reviewer Alicia Fowler Chief Counsel 08/10/2022

Document Control Chris Villareal

Program Document Control Manager

08/10/2022

Role Name Title Signature Approval Date

Approver Jamey Matalka Director of Risk

Management and Project Controls n~ 08/10/2022

CALIFORNIA HIGH-SPEED RAIL

AUTHORITY

POLICY

POLI-1103

TITLE: Enterprise Risk Management Policy

POLICY

The California High-Speed Rail Authority (Authority) is committed to managing Risks in the most effective and efficient manner to achieve its objectives. This policy formally establishes Enterprise Risk Management at the Authority.

PURPOSE

The purpose of this policy is to establish the formal acknowledgement, acceptance, and commitment of the Authority to participate in and contribute to the Enterprise Risk Management (ERM) function. Through this policy the Authority strengthens its system of internal controls and formalizes the mission and vision for the Authority’s ERM function.

Mission: Foster a Risk-aware culture to focus decisions on the proactive management of Risks in support of the Authority achieving its statewide goals and objectives.

Vision: An organization where every decision is informed and guided by a sound understanding of Risk. The Authority’s Board of Directors (Board) and Executive Leadership are committed to this vision and making Risk management a core responsibility of Authority staff.

California High-Speed Rail Authority POLI-1103, Revision 0 2022-08-10 Page 1 of 7

APPLICABILITY

This policy applies to all Authority employees (i.e., state staff) and to the Authority’s integrated team, per contract specific requirements (herein collectively referred to as “Authority Staff”).

TERMS AND DEFINITIONS

Term Definition

Delegation of

Authority

The process of transferring responsibility for a task to another of subsequent authority.

Enterprise Risk The identification of upside, downside, and outside (external)

Risks that impact the Authority’s strategic objectives. Generally categorized as mission critical relating to funding, market and economic factors, industry, reputation, and stakeholder relations.

This can be identified during Enterprise Risk assessments and through ongoing Risk monitoring.

Enterprise Risk

Committee (ERC)

The ERC is the Authority’s governance committee overseeing the ERM Program. The ERC evaluates risks of the Authority and determines which risks are the highest threats and opportunities to be addressed at the enterprise level, and provides guidance or direction on taking action to mitigate those risks or take advantage of opportunities.

Enterprise Risk

Management

(ERM)

The culture, capabilities, and practices that organizations apply in setting and carrying out the enterprise strategy with the purpose of actively managing Risk to realize and preserve value.

ERM Function The people, processes, and technology that support ERM.

2022-08-10 Page 2 of 7

Term Definition

Management

Preparedness

Gap

Subjective effectiveness of management and control activities in mitigating either the Risk Likelihood, Risk Impact, or Risk

Velocity.

Program Baseline

Budget

Defines the Authority’s execution plan and coherently links budget resources and schedule execution to implement the

Business Plan.

Risk The likelihood that a specific event with a measurable impact to the objectives, at any level of the organization, may occur. In contrast, Risks (plural) are a collection of such events that cumulatively impact the achievement of enterprise objectives.

Risk Appetite The amount of Risk that is acceptable by the Authority in pursuit of value creation objectives.

Risk Exposure A calculated average of Risk Impact, Risk Likelihood, and Risk

Velocity ratings.

Risk Impact The measure of potential impact resulting from the occurrence of a specific event. This impact can be positive or negative depending on the Authority’s objectives.

Risk Likelihood The probability that a given Risk will occur.

Risk Register A document/tool used to enable formal Risk management, which acts as a repository for all Risks identified. Each Risk includes additional information to appropriately manage and report on.

Risk Tolerance The boundaries of acceptable variation regarding performance in relation to achieving strategic objectives.

2022-08-10 Page 3 of 7

Term Definition

Risk Velocity A measurement of how quickly a Risk Impacts the Authority.

ROLES AND RESPONSIBILITIES

Board of Directors

• Responsible for reviewing and approving the policy and key documents of the Authority, including business plans; project update reports and delegations of authority;

• Performs oversight by conducting monthly Board of Director meetings and subject-focused meetings such as the Finance and Audit Committee to review program performance, audit, and financial updates;

• On an annual basis accepts a Program Baseline (scope, schedule, risk, and costs) and Program Budget to deliver the priorities set in the Business Plan;

• Authorizes the CEO to manage the Audit and Finance Committee’s approved contract contingency balance, with required reporting to the Audit and Finance Committee at its regular meetings or upon request, and for the Audit and Finance Committee to provide recurring notification to the Board on contingency trending information.

Director of Risk Management and Project Controls

• Leads and guides the ERM program and facilitates annual Enterprise Risk assessments;

• Sets policies, plans, procedures, and other documents for ERM;

• Provides guidance and expertise to support Risk owners;

• Presents Risk information on an as-needed basis; and

• Coordinates root cause analysis and lessons learned in the event of materialized Risks.

Enterprise Risk Coordinator

• Facilitates annual review of this policy and updates as needed;

• Provides administrative support for the ERM Function; and

• Supports the Director of Risk Management and Project Controls with maintaining the ERM program.

2022-08-10 Page 4 of 7

Authority Staff

• Participate in the identification and assessment of Enterprise Risks; and

• Uphold a sense of responsibility to protect the Authority from Risks, as well as identify opportunities to improve efficiency and increase value.

Risk Owners

• Monitor Risks, develop management plans, and mitigate strategies to reduce or increase the Risk Impact, Risk Likelihood, and Risk Velocity that either threaten or create opportunity when achieving objectives;

• Update Risk Registers as often as needed but no less than once a month;

• Participate in Risk assessments with the Risk Management Office (RMO);

and

• Present and share updates on their Risks at designated ERC meetings throughout the year.

Enterprise Risk Committee (ERC) Members

• Review, evaluate, and prioritize Enterprise Risks;

• Participate in discussions about Enterprise Risks;

• Adhere to the requirements of the ERC Charter; and

• Demonstrate integrity and ethical values and serve as an example by facilitating and monitoring employee compliance with participation and contribution to the Authority’s ERM Function.

POLICY DIRECTIVES

• Link Enterprise Risk Management to Strategy

The Authority must consider the top Risks during strategic planning cycles. To link ERM to strategy, the Authority must keep with the aligned annual cadence below:

Q1 – Q2: Annual Review of the ERM Plan;

Q2 – Q3: Annual Enterprise Risk Register Update, including a review of all

Office risk registers; and Q3 – Q4: Annual Strategic Planning and Budget Enactment.

• The Board and ERC Will Set Risk Appetite

The Board will set the Authority’s Risk Appetite through the approval of a Program Baseline Budget and Delegation of Authority. Formal Risk Appetite statements and Risk

2022-08-10 Page 5 of 7

Tolerances are developed through the ERC. Risk Appetite statements must be cascaded across the Authority and reviewed annually.

• The Authority Must Adhere to ERM Process Requirements

The processes at the core of the Authority’s ERM program, along with a detailed Responsible, Accountable, Consulted, and Informed (RACI) Matrix, must be followed as outlined in PLAN-1015: Enterprise Risk Management Plan (Pending Approval). These processes are to be carried out by Authority Staff, bringing together the Authority’s Risk owners, management, and when applicable, the Board, to achieve operational excellence in Risk management.

• Authority Staff Must Escalate Identified Risks

As Authority Staff identify Risks, they must be escalated to managers through established chains of command, tracked in appropriate Risks Registers or systems, and reviewed monthly by management (at the level of the Authority in which the Risk is identified). The RMO will collect all material Risks escalated for enterprise-level consideration and share with the ERC for review. The ERC will review escalated Risks for potential inclusion into the Enterprise Risk Register.

• Authority Staff Will Utilize Enterprise Risk Rating Criteria

Enterprise Risks must be assessed by the Authority Staff who identify the Risk using standard criterion to support prioritization against other Risks. The RMO has developed standard Risk rating criterion for Risk Impact, Risk Likelihood, Risk Velocity, and Management Preparedness Gap, to evaluate the Risk Exposure for both negative Risks (threats), and positive Risks (opportunities).

• Only the ERC can Close an Enterprise Risk

If an identified Enterprise Risk is no longer thought to be relevant by the Risk Owners, the Risk must be raised for discussion by the Risk Owner at a scheduled ERC meeting and voted on to remove it from the enterprise-level Risk Register. Removing a Risk from the Enterprise Risk Register could result in the retirement of the Risk or de-escalation to an appropriate Risk Register.

• The RMO will assist in facilitating ERM training and Office risk workshops

In order to foster a Risk-aware culture to focus decisions on the proactive management of Risks, the Risk Management Office will provide ERM training as needed for the

2022-08-10 Page 6 of 7

State Leadership Accountability Act (SLAA).

Authority and its Offices, including risk workshops to identify, assess, document internal controls, facilitate risk communication.

SOURCES OF AUTHORITY

• California Government Code section 5300; Risk Management, section 5305.6;

• California High-Speed Rail Authority Board Memo: Establishment of an Enterprise Risk Management Program, Agenda Item 2; and

REFERENCES

Authority Document Control Number

Document Title

PLAN-1015

(Pending Approval)

Enterprise Risk Management Plan

CONTACT

For questions regarding this document, please contact the Enterprise Risk Coordinator.

California High-Speed Rail Authority POLI-1103, Revision 0 2022-08-10 Page 7 of 7 https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5305-6/ https://www.dgs.ca.gov/Resources/SAM/TOC/5300/5305-6/ https://hsr.ca.gov/wp-content/uploads/docs/brdmeetings/2020/brdmtg_121020_Item2_Enterprise_Risk_Management_Board_Memo.pdf https://hsr.ca.gov/wp-content/uploads/docs/brdmeetings/2020/brdmtg_121020_Item2_Enterprise_Risk_Management_Board_Memo.pdf https://dof.ca.gov/programs/osae/state-leadership-accountability-act-slaa/ https://dof.ca.gov/programs/osae/state-leadership-accountability-act-slaa/