Implementation of the AASHTO Guide for Enterprise Risk Management (2022)

Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

4 Introduction 1.1 Project Background NCHRP Project 20-44(02) was funded through NCHRP’s Implementation Support Program, which was created to facilitate implementation of NCHRP research results. The project sup- ported implementation of the product from an earlier research project, NCHRP Project 08-93, “Managing Risk across the Enterprise: A Guide for State Departments of Transportation,” which was completed in June of 2016. It produced an enterprise risk management guide for state DOTs that was published as the AASHTO Guide for Enterprise Risk Management (AASHTO and FHWA 2016). Enterprise risk management is defined as “the formal and systematic effort to control uncertainty and variability [to an] organization’s strategic objectives by managing risks at all levels of the organization” (Proctor et al. 2016, p. 5). Achieving strategic agency objectives and performance goals is critical to the successful operation of an agency. Departments of trans- portation (DOTs) are increasingly facing revenue and other resource challenges. Addressing the numerous risks to achieving agency strategic objectives and state and federal performance requirements is becoming increasingly challenging. It requires addressing numerous uncer- tainties and variabilities and making well-informed trade-offs that can stand the test of public scrutiny. People and organizations are more likely to adopt strategies and practices that are in use by peers. If adoption of a practice reaches beyond the innovators, it is more likely to become routine practice. The strategies to advance this include peer support, confidence building, and the creation of an environment of trust, where an honest exchange of ideas occurs without repercussions. The project supported the pilot implementation of risk management strategies addressing nine DOT objectives in three states. The project convened a community of practice (COP) of 10 DOTs that created a trust environment that facilitated an honest exchange of information related to challenges and successes that further advanced the understanding of risk management in transportation. It also created opportunities for mentorship and peer support in implementa- tion activities. Finally, risk implementation is enhanced when the word gets out to others in the community. The project engaged at least 23 state DOTs in various outreach meetings. These included an in- person peer exchange, a virtual regional meeting, Managing Risks in Uncertain Times meetings, and the COP sessions. Attendance at those sessions totaled at least 266 people, counting those from the pilot states and the COP who attended more than one session. Formal meetings were held with each pilot DOT between eight and 10 times. Those included formal kickoff meetings, midpoint progress meetings, final wrap-up meetings, and periodic progress calls. Many more C H A P T E R   1

Introduction 5   undocumented calls occurred between the project team and individuals at the pilot agencies. Meetings that state DOTs attended included: • An early AASHTO Subcommittee on Risk Management (SRM) meeting held September 10, 2018, in San Diego, California; • A peer exchange with invited states and the COP on November 21, 2019, at the Minnesota Department of Transportation (MnDOT), with 33 attendees or virtual participants; • An in-person COP meeting on November 22, 2019, at MnDOT, with 15 in-person attendees and numerous virtual participants; • A split 2-day COP and virtual regional meeting held over June 17 and 18, 2020, with 90 attendees; and • The Managing Risks in Uncertain Times meeting held virtually on October 19, 2020, with 59 attendees. 1.2 Project Objectives The objectives of this project were to develop and execute a dissemination and implemen- tation plan to create awareness of the Guide and to facilitate successful implementation of enterprise risk management (ERM) by state DOTs. For purposes of this project, “successful implementation” is the documented adoption and use of the research products presented in the Guide by practitioners within at least three state DOTs. Specifically, the project included: 1. A well-defined strategy for dissemination and application of the research results, 2. Immediate actions to be completed as a part of the current project, and 3. Discussion of longer-term actions that may be taken following the completion of this project. 1.3 Project Process and Methodology The project included eight major tasks, with numerous subtasks within each. Following is a description of each major task. 1. Pilot State Selection and Support: The project supported three pilot states with direct, hands-on, continuous assistance to help them integrate enterprise risk management into their day-to-day operations. These pilot states became early implementers and can serve as role models for others. The three pilot states identified over 30 risks and narrowed these to a total of nine enterprise-wide risks for which they developed implementation strategies. Case studies on each are included later in this report, as is information on where to find the tools they developed. Pilot states were selected based on a competitive process. Twenty states that had expressed some past interest in ERM were contacted and provided information on the project and how to apply. Three state DOTs were selected as pilot agencies: Tennessee DOT, Utah DOT, and Washington State DOT. The support provided to the pilot states includes that listed and discussed in the following: a. Risk management tools such as a sample risk matrix and risk register. b. In-person meetings with subject-matter experts from each pilot state DOT on the topics proposed by them for pilot implementation. c. A kickoff workshop in which teams of state DOT personnel were briefed on risk manage- ment and led through risk identification and assessment exercises. d. Supporting calls that were provided as frequently as monthly or as needed to help the pilot states develop mitigation strategies for the risks identified in the kickoff workshop.

6 Implementation of the AASHTO Guide for Enterprise Risk Management e. A midpoint workshop to help the pilot DOTs assess progress and refine the steps to complete pilot implementation of mitigation strategies. f. Pilot states participated in three workshops with the other two pilots. In those sessions, the three pilot DOTs explained their initiatives and shared strategies for successful implementation. g. The pilots participated in COP meetings, peer exchanges, and a COVID risk-mitigation session, all of which are discussed later in this report. h. The project team worked with the pilot states, clarifying their questions and facilitating progress on the implementation strategies and tools produced by them. The project team provided ongoing review and feedback to the pilots on the strategies and tools. i. A final wrap-up workshop was held with each of the pilot state DOTs. The pilots’ final implementation products were reviewed, and lessons that could help other state DOTs were documented. 2. Formation and Support of a Community of Practice: The project created a national COP consisting of officials from 10 transportation agencies interested in ERM. The COP created a network of support for risk management implementation, as well as advocates to promote and support ERM, suggest additional research into it, and illustrate its practical benefits. The project began before the AASHTO SRM was formed. Otherwise, the SRM may have served the role of the COP. Throughout the proceedings of the project, the project team invited the SRM to all events and closely coordinated with the subcommittee. Seven COP meetings were held, and minutes were produced for each. In June 2020, a 2-day virtual meeting was held where COP members participated. The meeting invitation was extended to all states so that they could participate and learn about ERM. A total of 90 individuals participated in the 2-day meeting. A final COP meeting included a formal hand-off of COP findings to the SRM. Suggestions and example practices from the COP meetings are included throughout this report. 3. Peer Exchange: Pre-COVID, the project included an in-person peer exchange involving approximately 10 in-person state representatives, six virtually participating states, and three FHWA representatives. A total of 33 people participated. The states included a mix of early risk-management adopters who could interact with officials from other states that wanted to adopt ERM. The in-person participants also engaged in a risk workshop about risks their DOTs faced and collaborated on identifying mitigation strategies. The intent was to provide DOTs that were only beginning to consider ERM the opportunity to interact with states that were in more advanced stages of implementing ERM practices. The peer exchange provided a venue for mature ERM implementers to share best practices and for emerging states to learn how to navigate the implementation of a new or expanded ERM effort. 4. Virtual Peer Exchange Meetings of the Three Pilots: The project included three virtual peer exchange meetings between the three pilot states. At these meetings, the three pilots shared experiences, explained their processes, and presented their accomplishments and challenges. 5. National Webinar: Managing Risks in Uncertain Times: The pre-pandemic intent was to hold four regional workshops across the country in which state DOT representatives would be exposed in-person to the Guide and hear presentations from state peers who were benefiting from implementing risk management. Because of COVID-19 and the need to support imple- mentation activities, the regional meetings were replaced by a national webinar, an additional COP meeting, and several additional meetings to support pilot implementation activities. The virtual national webinar was not originally included in the project work plan. How- ever, the project panel and project team determined that it would be a timely addition. The webinar included presentations and discussions on how state DOTs were using risk manage- ment techniques to overcome the challenges posed by the COVID-19 pandemic. The webinar was attended by 59 state and federal DOT personnel. Proceedings were developed and are included in Appendix D.

Introduction 7   6. Case Studies: This report includes case studies of each of the pilot states’ risk management initiatives. Included in the case studies are summaries of how the pilot states identified risks and the implementation strategies and tools developed to mitigate them. The case studies addressed risks that are common to many state DOTs, such as hiring and retaining employees, managing the voluminous knowledge DOTs accumulate, managing environmental risks to corridors, improving equity, managing highway incidents, and ensuring reliable project delivery. 7. Updates to the AASHTO Subcommittee on Risk Management: The project team partici- pated and presented at two SRM meetings. 8. Roadmap for Future Risk Management Activities: Throughout the project, suggestions for future risk management support, research, and implementation activities were documented. These are included in this report in a format convenient for the AASHTO SRM, NCHRP, or FHWA to access if desired. The findings also could be of use to other projects, such as NCHRP Project 20-123(04), “Development of a Risk Management Strategic Plan and Research Roadmap.” 1.4 The Products of This Project This section provides brief summaries of the ERM resources developed during the project. These include tools and strategies for risk management. Several could be modified by other state DOTs to manage commonly faced risks to performance. Other products engaged state DOTs to learn about risk management, exchange ideas, and meet peers who can assist their efforts. Additional detail on each is provided elsewhere in the report. 1.4.1 Reducing Risks to Quick-Clearance Risk Practices The Tennessee DOT (TDOT) developed a suite of resources to reduce the risk that crashes and other incidents would not be cleared quickly and safely across the state. The package includes a memorandum of understanding (MOU) with the Tennessee Department of Safety that spells out roles and responsibilities for clearing incidents. The package also includes classroom train- ing on quick-clearance procedures that includes a video from the commissioner on the impor- tance of prompt but safe clearance practices. The suite also includes hands-on training that occurs on a highway-like training facility where crash scenes can be simulated. Participants learn to perform important tasks such as safely righting overturned vehicles, de-tensioning cable barriers, releasing air brakes on trucks, righting jack-knifed trucks, moving wrecked vehicles, and safely clearing debris in confined spaces. 1.4.2 Preventing Risks to Complete Plans Another TDOT tool is a detailed checklist to accompany each complex project as it is sub- mitted for scheduling in the bid lettings. The checklist will ensure that each approval, review, or element of a plan package is included. The checklist will reduce the risk that plans will be filed without all the needed approvals, which results in bid delays or expensive change orders after award. 1.4.3 Reducing Risks That Cause Project Delays and Change Orders TDOT also produced a risk-register-like tool for capturing risks that could cause projects under development to be delayed, face cost increases, or otherwise affect planned file dates. The tool includes an Excel-based risk register that walks users through a series of questions and ratings of potential risks. The tool also includes a lengthy list of possible risks they should consider. The

8 Implementation of the AASHTO Guide for Enterprise Risk Management list prompts participants’ thinking so that they do not miss any of the most common risks. Each new project will have its own risk register, which will be posted in a widely available online location to facilitate understanding of the project’s risk by all the staff who will deal with the project as it goes through the project-development process. 1.4.4 Reducing Risks to Hiring and Retaining a Workforce To mitigate the risks of not hiring the best candidates and not retaining them once hired, the Utah Department of Transportation (UDOT) produced a toolkit for managers to use as they begin the hiring process. The toolkit not only provides managers access to all the resources needed to hire an employee, but it also includes advice on how to identify the most promising candidates. The toolkit includes information for the new hires to show them the long-term career opportunities available at UDOT. Although UDOT’s starting salaries may be lower than those in the private sector, UDOT offers a long-term career path that can be more attractive than that of many private-sector jobs. The toolkit helps new hires understand the skills they need to develop to advance their careers. It also informs them of the training UDOT offers to help them develop those skills. UDOT intends the toolkit to help new hires understand that UDOT offers a lifelong career and not just an entry-level job. The intent is to reduce the risk of employee turnover as well as the risk of hiring the wrong person for the job. 1.4.5 Turning Managers into Leaders and Building from Employees’ Strengths The second set of products UDOT produced that may be of interest to other states reduces the risk of employee turnover and poor performance among frontline workers. The suite of resources includes training for frontline managers to develop their leadership skills so they can more effectively guide their staff to be productive. UDOT noted that managers are often selected because of their technical abilities but have not had the opportunity to develop their leader ship skills. The initiative includes enhanced training for managers to become more effective leaders. The training also instructs managers on how to use skill assessments to identify and focus on employees’ strengths, as opposed to the traditional performance review processes of identifying improvement plans to address weaknesses. The training includes how to use a skills assessment process to help employees identify their strengths so that leaders can help employees enhance those strengths to be more productive and satisfied in their jobs. 1.4.6 Managing Risks to Knowledge A third UDOT initiative began the process of developing a knowledge management architec- ture, process, and taxonomy. Although the initiative is not complete, the initiative developed a multi-phase path that should lead to a department-wide effort to manage the agency’s knowl- edge. UDOT faces the risk common to many DOTs of an aging workforce and frequent turn- over. UDOT staff identified the lack of a knowledge management process as a risk to retaining the institutional knowledge essential to remain effective. UDOT’s initiative includes a path to identify the agency’s knowledge management needs, define its knowledge management objec- tives, identify a framework for knowledge management, and engage leadership in developing a long-term knowledge management approach. 1.4.7 Developing a Repeatable Corridor Risk Management Process The fourth initiative developed by UDOT is a scalable, repeatable process to assess and miti- gate environmental or natural disaster risks to corridors. The UDOT process was designed to be

Introduction 9   performed using in-house planning staff. The data are publicly available, either through UDOT databases or as publicly available threat data such as seismic data from the U.S. Geological Survey. The process is documented in a guide that is unique to UDOT but that could be amended for use by other states. The intent is for regional planning staff to assess the environmental or natural disaster risks to their corridors and then incorporate possible mitigation activities into their program of projects. 1.4.8 Managing Risks to Inclusion and Being an Employer of Choice The Washington State Department of Transportation (WSDOT) undertook two complex risk initiatives. One was to improve cultural sensitivity and inclusion. The second was to work to be an attractive employer of choice for a developed workforce. The efforts to address these risks will continue beyond the timeframe of this NCHRP project because of the significant issues that confronted WSDOT as it tried to address these risks. However, the efforts to date provide insights into the complexity of managing these two risks that are so common among DOTs today. 1.4.9 Practical Experiences from ERM Implementation During the implementation of the various initiatives, peer exchanges and other meet- ings were conducted with participation from several states. The California Department of Transportation (Caltrans) and the Vermont Agency of Transportation (VTrans) shared their experiences in implementing ERM. These experiences included the establishment of an Office of Risk Management at Caltrans with a chief risk officer who can ensure the continuity of ERM efforts. Caltrans also described the process it used to implement ERM. Separately, the VTrans experience illustrates the practical aspects of obtaining buy-in for ERM from leadership and staff who are skeptical of implementing formal risk manage- ment; obtaining buy-in can be aided by demonstrating the efficacy of ERM in achieving agency objectives. These experiences can provide valuable insights to agencies that have not achieved sufficient maturity in the implementation of ERM. These are detailed in Sections 5.1 and 5.2. 1.4.10 Using Risk Management to Support Financial Decision Making During the NCHRP project webinar, WSDOT and MnDOT demonstrated the use of risk management to support agency budgeting. This is described in Section 5.3. During the project, WSDOT experienced significant budget reduction threats caused by a ballot initiative that repealed a revenue source and because of a decline in ferry, rail, and transit ridership caused by the pandemic. This report describes the process WSDOT used to assess the risks of the proposed cuts. Appendix C also includes information on an Excel tool that WSDOT developed for the effort. The risk management team assessed the risk of each proposed cut and distilled the risks down to an understandable and relatively brief assessment of the risks posed by each suggested cut. Each cut was assessed by the risks it could cause to the agency’s strategic objectives or the risks it would cause to multiple functions in the agency. MnDOT helped agency leaders evaluate budget requests by how these requests contributed to reducing risks to MnDOT objectives. MnDOT risk management staff conducted risk assess- ment–like exercises that allowed agency leaders to think of budget requests as possible risk- mitigation strategies. The process also demonstrated how emerging nontraditional issues such as social equity could be factored into the agency’s investment decision making.

10 Implementation of the AASHTO Guide for Enterprise Risk Management 1.4.11 Integrating ERM in Agency Decision Making Section 6.1 includes strategies suggested by participants in this project on how to advance the practice of ERM within state DOTs. These suggestions come from some states that have pursued risk management for a decade or more. The suggestions describe how to demonstrate to agency executives the benefits of ERM, how to navigate changes in leadership, and how to strengthen ERM by using it to advance agencies’ strategic objectives. The strategies in Section 6.1 illustrate how ERM has been used in many applications, such as helping make budget decisions, mitigating environmental risks, and supporting strategic initiatives. 1.4.12 Managing Risks in a Pandemic Section 6.2 summarizes how risk management helped state DOTs cope with the unprec- edented pandemic of 2020. The section summarizes how COVID-19 identified gaps in agen- cies’ continuity of operations plans that had not anticipated a pandemic. The section also describes how COVID accelerated the threats and opportunities created when remote work- ing changed from an occasional option to an operational necessity. Remote working reduced agency costs for maintaining office space but increased costs for technology and technical support, and increased the risks to cyber security. COVID presented immediate threats to in-person training but accelerated by many years the opportunity for remote learning and engagement. COVID also posed existential risks to fare revenue for bus, rail, and ferry ser- vices. Those revenues fell precipitously, creating risks that threaten whether those services can return to pre-COVID levels. For highway agencies, COVID probably will permanently reduce commuter traffic volumes and create uncertainty for how to best plan and pay for highway needs. 1.4.13 Identifying Long-Terms Risks Resulting from the Turmoil of 2020 This project occurred during a watershed era for transportation. COVID undermined certainty about travel modes and revenues. George Floyd’s killing ignited and re-ignited the calls for social equity. The presidential election brought a new national transportation agenda. The recession undermined near-term assumptions about agency revenues, hiring, and priorities. Section 6.3 examines the long-term risks that resulted from 2020 and its aftermath. For state DOTs, these include uncertainty about revenues, mode split, remote work trends, hiring a diverse workforce, retaining workers in a knowledge economy, and coping with a changing climate. 1.4.14 Creating a National Network of ERM Practitioners This project began before AASHTO created the Subcommittee on Risk Management. To ensure that there was a community of practitioners to help promote ERM, this project created a national COP. It consisted of 10 state DOTs and represented a mix of mature ERM practi- tioners and states that were interested in expanding their ERM efforts. The COP facilitated an exchange of ideas between the states and resulted in several of them conducting additional meetings between themselves to share risk management practices. The COP members enriched a peer exchange with agencies new to risk management, shared best practices, and documented strategies to advance the practice of ERM. The COP also provided the AASHTO SRM with suggestions to further the adoption of risk management. A formal handover of the COP was made to the SRM to ensure that the valuable activities of the COP are continued in an effort to accelerate the nationwide adoption of ERM.

Introduction 11   1.4.15 Sharing Risk Management Tools This report produced the following tools that are discussed in the appendices. • The UDOT toolkit and training curriculum for supervisors to help them navigate the hiring process and identify the strongest candidates. • A checklist for UDOT new employees that helps them acclimate to their new job and, more importantly, identify a long-term career path to remain with the department. Developing a career path is aided by a description of the skills needed for each promotion and the training UDOT provides to advance a person’s career. • A strategy to create a knowledge management process for UDOT. • A guide and process for using publicly available data sets and the agency geographic infor- mation system to assess and mitigate risks to corridors posed by natural disasters such as floods, earthquakes, or avalanches. • An MOU and training program to ensure that TDOT workers know how to safely and consistently clear crashes and other incidents that close highways. • A detailed checklist that allows managers of projects that are under development to identify each plan element, approval, or coordination step required for the plans to be ready for bid lettings. • A risk-register-like tool that identifies and assesses the risks that could cause projects to miss their scheduled plan filing date. • A strategy for starting the long-term effort to develop a more diverse and equitable workplace that is an employer of choice for an empowered workforce. • A tool that shows how to integrate risk management into the budgeting process, particularly to assess how investments may reduce risks to agency objectives.