Could enterprise risk management become a common cloud-based service at most government agencies? It's an idea being explored by other industries, especially within the financial management and manufacturing sectors. There's a good chance that the idea could take root in the public sector too.

Once an organization assesses its potential safety and economic risks, specific rules can be then be set to help mitigate those risks. Historically organizations have not always taken an enterprise wide approach to risk management. More often solutions were done piecemeal, such as requiring locks on certain doors or passwords on specific machines. As risk management became more formalized, it slowly became an evaluation process to be followed, a set of formal decisions to be made and a way to track and enforce specific rules.

A risk-management system often is used not only to track risk but to document decisions made on how the risk should be addressed. This system can include coordinating resources to minimize risk, monitoring risk-related activity, and managing the short- or long-term impact of known risks.

Such systems fall under the general heading of governance, risk and compliance (GRC), and many government agencies already have systems in place to help them manage their approach to risk. The key word here, though, is "systems" (plural). Agencies can find it difficult to integrate a truly enterprisewide view of how risk is managed. Too often GRC systems have been built ad-hoc at the sub-agency level to deal with local issues.

Further, government has unique needs. Risk management is not the same for government as it is for an insurance company that is working to manage risk and assure profits across thousands of insurance policies and investments. Government also tends to focus heavily on risk associated with project management. Getting program or project governance properly aligned helps ensure success for the program itself, and it also reduces long-term risk from other internal and external factors.

There are popular GRC solutions available from enterprise software vendors such as Oracle and SAP. Some organizations have created their own customized risk-management solutions, and other companies have risk-management solutions that are targeted at a specific issue, such as compliance with the Federal Information Security Management Act or the Homeland Security Presidential Directive (HSPD) 12.