Quick Links
 
 

FAQ: Enterprise Risk Assessment Methodology (ERAM)

PDF File icon PDF version of this FAQ

1. What is ERAM?

The Enterprise Risk Assessment Methodology (ERAM) is an independent risk assessment process for business Major Automated Information Systems (MAIS) and MAIS/Major Defense Acquisition Program (MDAP). ERAM utilizes industry best practices to identify and mitigate business system risks in order to enable more rapid delivery of business capabilities. ERAM is an integral part of the Business Capability Lifecycle (BCL) process which is a new DoD framework that is being implemented in October 2007 to develop, approve and execute business capabilities in the Business Mission Area.

2. What is the goal of ERAM?

ERAM's primary goal is to improve delivery of business capability by reducing, identifying, and mitigating risk. It does this by pro-active identification of risk across seven key areas (Strategy, Process, Scope/Requirements, Technology, Contract, People, and External), with a focus on root cause, and by recommending risk mitigation strategies both within the program and external to the program.

3. Why was ERAM developed?

ERAM was developed in response to the Defense Acquisition Performance Assessment (DAPA) Report, which highlighted the ineffectiveness of current DoD acquisition oversight processes. The ERAM concept was proposed by the Office of the Deputy Under Secretary of Defense (Business Transformation (ODUSD(BT)),) as a means to enable more rapid delivery of operationally effective business capabilities with acceptable cost and risk. The concept was authorized in April 2006 by the Under Secretary of Defense for Acquisition, Technology and Logistics (USD(AT&L)), Kenneth J. Krieg for selected MAIS systems and, based on the successes of the test cases, in April 2007 was approved by the Defense Business System Management Committee (DBSMC) for broader use.

4. Which programs are required to use the ERAM process?

ERAMs are only performed on those business MAIS and business MDAP designated by USD(AT&L) as being under the BCL process. Those programs currently are:

  • Defense Integrated Military Human Resources System (DIMHRS);
  • General Fund Enterprise Business System (GFEBS);
  • Integrated Data Environment/Global Transportation Network Convergence (IGC)
  • DEAMS
  • ECSS
  • GCSS-Army (including PLM+)
  • GCSS-Marine Corps
  • Navy ERP
  • Logistics Modernization Program (LMP)

5. Will business systems other than business MAIS and business MDAPs undergo ERAM assessments?

At this time, only designated business systems will undergo ERAM assessments. Sub-MAIS business systems are not required to be reviewed by an ERAM assessment team. However, any Component may request BTA assistance from the Investment Review Board (IRB) to perform an assessment similar to an ERAM assessment in order to achieve comparable benefits.

6. When are ERAMs performed?

They are generally performed prior to key program events and are required prior to any acquisition milestone decision. ERAM review schedules are determined on a program by program basis. Other reviews may be conducted that are not in conjunction with a program event or milestone decision. These reviews are scheduled and conducted considering resource availability.

7. What documentation is produced by the ERAM process?

There are two findings documents that result from an ERAM assessment - a Detailed Findings Document and an Executive Briefing. The Detailed Findings document contains detailed Risk Statements, Risk Explanations and Mitigation Recommendations. The Executive Briefing contains a high-level view of the key program risks and mitigation recommendation. These documents are developed in collaboration with the associated program office. The final output of an ERAM assessment is the mitigation plan associated with each identified risk. These plans are developed in collaboration with the program office and are owned and managed by the program office within their risk management construct.

8. Who sees the documents created by the ERAM Team?

The Detailed Findings document is shared with the appropriate program team members and decision makers within the Component and IRB/DBSMC leadership. This deliverable contains pre-decisional information so care must be taken to ensure that it is shared with those persons who have a need to know. The Executive Briefing is presented at the IRB/DBSMC and will be available for public consumption.

9. Will the results of an ERAM assessment be formally coordinated to ensure full transparency?

No. As explained previously, a formal coordination process is not performed because the Detailed Findings deliverable contains pre-decisional information. However the Executive Briefing is presented at the IRB/DBSMC and will be available for public consumption.

10. Who uses ERAM information?

Program Managers, Functional Sponsors, IRBs, the DBSMC, Component Acquisition Executives (CAEs) and the Milestone Decision Authority (MDA) each use information from an ERAM assessment. For example:

Program Managers use ERAM assessments as input into improving their program performance.

Functional Sponsors use ERAM assessments to determine whether functional requirements have been adequately captured.

CAEs consider ERAM findings when making recommendations to the MDA regarding milestone decisions.

IRBs and the DBSMC use ERAM assessments as input to the IRB certification process.

ERAM assessments provide valuable information for consideration but do not make decisions or recommend outcomes for the decision makers.

11. How do ERAMs get scheduled?

In coordination with the ODUSD(BT), the Business Transformation Agency (BTA) schedules, staffs and leads ERAM teams.

12. Who participates in an ERAM assessment?

ERAM teams are composed of business system professionals led by analysts from the BTA with expertise in business system application implementation, augmented by Office of the Secretary of Defense (OSD) staff members with special expertise such as cost analysis and testing. The matrix team contains the expertise from across the department as necessary to evaluate a program's risk. The selection of matrix personnel depends on the type of program being assessed, the program's position in the implementation lifecycle, and the insights gained through the first phase of the ERAM assessment, the documentation review. The exact roster of augmentees is not standardized, and will be slightly different for each ERAM.

13. How long does it take to conduct and ERAM and what are the key activities that occur?

The target ERAM timeline is six weeks. There are 4 phases of activity: (1) program documentation review; (2) on-site interviews; (3) deliverable development and delivery; and (4) on-going assessments and support.

Its actual duration may be affected by variables such as availability and delivery of program documentation for review, availability of key program personnel for interviews, or critical program events where ERAM would cause an undo hardship on the program if conducted at that time.

14. How long has ERAM been in existence and what programs are using the ERAM process?

The ERAM initiative was originally tested on three pre-selected programs between May and September 2006. The test cases were:

  • Defense Integrated Military Human Resources System (DIMHRS);
  • General Fund Enterprise Business System (GFEBS); and,
  • Integrated Data Environment/Global Transportation Network Convergence (IGC)

In 2007 ERAM was approved by USD(AT&L) as the "methodology of choice" for business MAIS and business MAIS/MDAP programs. Additional business systems scheduled for ERAM assessments include:

  • DEAMS
  • ECSS
  • GCSS-Army (including PLM+)
  • GCSS-Marine Corps
  • Navy ERP
  • LMP

15. How does ERAM impact the principles espoused in DoD Directive (DoDD) 5000.1 and the requirements created by DoD Instruction (DoDI) 5000.2?

ERAM has no impact on DoDD 5000.1 or DoDI 5000.2.

16. What process is used to determine who will be interviewed during an ERAM assessment?

In order to gain the desired insight to program risk, the ERAM team will interview across the breadth and depth of the program - from the senior functional sponsor down to the end-user, across the functional user communities and the program implementation team. Both Government and contractor resources are interviewed.

17. How many ERAM teams are there?

One core ERAM team is in place today and a second is under development. The number of teams will depend upon the workload.

18. Have those organizations providing resources for an ERAM assessment "bought into" ERAM?

Yes, organizations providing resources for ERAM assessment teams understand the benefits such an assessment can render to the program being assessed, the DoD, and the Warfighter. Those who want to participate and have expertise related to a specific program, but who do not have resources to participate during on-site activities, can be interviewed or provide input to the ERAM team by reviewing program documentation prior to executing the ERAM assessment to ensure that their concerns are addressed.

19. What is the Component Pre-Certification Authority's (PCA's) role in the ERAM process?

The Component PCA has no defined role in the ERAM process.

20. How does ERAM fulfill statutory roles and authorities previously accomplished under the Major Automated Information System (MAIS) process?

ERAM itself is not a vehicle by which compliance to statutory and regulatory requirements is determined; that is an activity fulfilled by the CAE, in concert with the IRB and DBSMC via the BCL governance process. However, it is possible that an ERAM assessment can identify risks pertaining to those requirements that had not been previously addressed or managed.

21. How will ERAM address requirements instability?

ERAM considers stability of requirements and scope to be of such importance to the successful delivery of a program that it is considered one of ERAM's seven risk areas. In any ERAM assessment, significant effort is devoted to understanding the stability of requirements and any associated risks.

22. Is requiring that ERAM assessment teams include Senior Executive Service (SES) staff for on-site visits cost effective?

The composition of ERAM teams varies according to the business system under assessment. Assessment teams are typically composed of SES, GS-15, and HQE [Highly Qualified Expert] personnel in addition to other support staff. Given the potential benefits that the DoD can derive from the assessments and the relatively small size of the ERAM assessment teams compared to the number of people normally interviewed during an on-site ERAM assessment, the current approach is deemed to be cost effective.

23. How does ERAM improve upon the existing oversight construct, e.g. Overarching Integrated Product Teams (OIPTs)?

The OIPT's oversight role has been eliminated for programs that are in the BCL process; the IRBs and DBSMC are responsible for providing oversight for those programs. ERAM assessments give the IRBs and DBSMC insight into program risk.

24. What are ERAM's expectations in regards to Analysis of Alternatives (AoA) and Economic Analyses (EA)?

ERAM does not require the development of any documentation. The team looks at all of the documentation that a program is using to execute the program. The team will consider an AoA or an EA as input to a risk assessment, if they exist. Under the BCL process, the Business Case developed by the Functional sponsor as part of the BCL process replaces the stand-alone AoA and EA documentation used previously.

25. Who is the contact point for the ERAM initiative?

The BTA government point of contact is Mr. Paul Ketrick, Director of Investment Management, with Mr. Michael Stewart as the ERAM Lead They can be reached via the "Contact us" link on the BTA website at www.dod.mil/bta/contact.html.