Enterprise Governance, Risk and Compliance

DFAS seeks an Enterprise Governance, Risk and Compliance (EGRC) solution, by adopting the frameworks from the Open Compliance & Ethics Group (OCEG), also known as the "OCEG Red Book, GRC Capability Model," and the Committee of Sponsoring Organizations of the Treadway Commission (COSO), Enterprise Risk Management - Integrated Framework. Furthermore, according to the GAO-08-904T report, recognizing that risk management helps policymakers make informed decisions, Congress and the administration have charged federal agencies to use a risk-based approach to prioritize resource investments. As a result, GAO has developed a risk management framework, based on industry best practices and other criteria. This framework, divides risk management into five major phases: (1) setting strategic goals and objectives, and determining constraints; (2) assessing risks; (3) evaluating alternatives for addressing these risks; (4) selecting the appropriate alternatives; and (5) implementing the alternatives and monitoring the progress made and results achieved. All three frameworks integrate and include models for governance and assurance; management of performance; and risk and compliance, to help design and implement an effective enterprise-wide approach to risk management, and will support DFAS' effort to produce and sustain documentation required to satisfy common deliverable requirements for audit readiness, which include customer audit assertions, Statement on Standards for Attestation Engagements No. 16, and other Federal requirements to support the National Defense Authorization Act of Fiscal Year 2010. Ultimately, DFAS seeks an EGRC solution to provide a common framework to capture an enterprise view of governance, risk, and compliance activities throughout the agency by adopting and standardizing the frameworks into the MICP to ultimately report its efficiencies and effectiveness of internal controls through the annual SoA process. Additionally, DFAS is in search of an application that can interface with existing DFAS tools and information libraries to capture, track, and report on various monitoring initiatives, control frameworks, and training programs to provide DFAS with the ability to link risk and controls to internal and external regulations; correlate laws and regulations relevant to DFAS with internal policies, procedures, and compliance activities; enable risk management and minimize operational complexity; and, provide the opportunity to adopt best business practices and standardize processes when and where possible.