Enterprise Risk Management (ERM)Ontario Ministry of Agriculture and Food,

Ontario Ministry of Rural Affairs

S.O.A.R.  Annual ConferenceNovember 7, 2013

· Conflict of Interest Guidelines · “Doing the right thing” campaign

VALUES AND ETHICS· Oath of Allegiance and Oath of Office · Guide to Public Service Ethics and Conduct

HUMAN RESOURCES

ADMINISTRATION

INFORMATION MANAGEMENT

AND INFORMATION TECHNOLOGY

FINANCE AND ACCOUNTING

CONTROLSPROCUREMENT

PERFORMANCE MEASURES

ENTERPRISE RISK MANAGEMENT

A structured, consistent and continuous process toIdentify, assess and prevent adverse effects

and to seize opportunities related to the achievement of strategic objectives.

Controllership Action Plan: Enterprise Risk Management (ERM)

3

Enterprise Risk Management (ERM)

“Ontario must be the leader in shifting public services from a reactive to a proactive mode. Whether it is health care, social services, education, training, economic development or almost anything else, governments typically patch up things once something has gone wrong. Ontario must shift to foreseeing problems and cutting them off before they develop…” (Drummond Report)

ERM Objective: “OMAFRA will develop a plan to implement a more risk sensitive culture that encourages proactive and transparent identification and profiling of risks, so that staff can mobilize while mitigating financial, legal or program exposures.”

(Direction from OMAFRA Senior Management 2011/12) 

4

Enterprise Risk Management is:

• a structured, consistent and continuous process across an entire organization

• to identify, assess and prevent adverse effects and • to seize opportunities related to the achievement of its strategic objectives.

The underlying premise of ERM is that every entity exists to provide value for its stakeholders.

ERM enables management to effectively deal with uncertainty and associated risk and opportunity, enhancing the capacity to build value.

By identifying and proactively addressing risks and opportunities, OMAF/MRA can protect and create value for the Ministry’s stakeholders, including employees, producers, regulators, and in general, citizens of the Province of Ontario.

ERM is a management tool to apply a lens/filter to what you already do, but in a systematic manner.

What is Enterprise Risk Management

5

Why ERM ??

ERM provides

• better, more consistent identification of threats, opportunities and strategies to address and

• the creation of an effective tool that can assist in financial and strategic planning decision making.

ERM is a good business practice

6

Financial Management ChallengesFinancial Accountability Challenge• Evolving expectations for greater oversight of the Broader Public Service (BPS) delivery of

services.

Value-for-Money Challenge• Meeting public expectations for demonstrating economic, efficient and effective delivery of

services by ministries and the broader public service.

Financial Transparency Challenge• Growing expectations for public disclosure of financial information and attestation to its integrity

consistent with public accounting and financial disclosure standards.

Sustainability Challenge• Managing program expenditure growth in the near term during a constrained fiscal period while

meeting increasing stakeholder expectations.• Managing policy and program development in a longer-term economic and fiscal context.

Capital Investment Challenge• Increasing complexity of integrating capital investment and operations planning to ensure efficient

and effective delivery of services. • Ability to sustain level of debt required to support capital investments (long-term impacts)• Managing the life-cycle costs of assets (effective asset management)

Source: OPCD Presentation of February 14, 2012

7

It is important to recognize the distinction between risk assessments and

enterprise risk management…

Today FutureWhere risk assessments are: Enterprise risk management is:

Narrowly focused, considering single program, process or project

Broadly focused, considering risks across and through the organization

A moment in time Ongoing and continuous

A tool to focus resources within a project

A tool to redistribute resources across an organization

Shared with immediate team and decision makers

Shared with Executive and senior leadership and informs business planning

Typically operational in focus Typically strategic in focus

Managed on a spreadsheet or simple table

Managed via a database for improved reporting

Championed by team or project leads Championed by Executive and senior leaders

Source: Risk Management Guideline for the BC Public Sector, Province of British Columbia, November 2011

8

OMAFRA’s Current and Desired State

Initial Ad Hoc Specialist Silos Top-Down Integrated Strategic

• Ad-hoc/chaotic

• Depends primarily on individual heroics, capabilities, and verbal wisdom

• Independent risk/ opportunity management activities

• Limited focus on the linkage between risks/ opportunities

• Limited alignment of risk/ opportunities to strategies

• Disparate monitoring and reporting functions

• Risks/opportunities managed at the project rather than enterprise level

• No aggregation of risks/ opportunities

• Common framework, program statement, and policy

• Routine risk and opportunity assessments

• Communication of top strategic risks and opportunities to the SEC

• Knowledge sharing across functions that manage risks and opportunities

• Awareness activities

• Formal risk and opportunity consulting

• Dedicated team

• Coordinated risk and opportunity management activities across silos

• Risk and opportunity appetite is fully defined

• Enterprise-wide risk and opportunity monitoring, measuring, and reporting

• Technology implementation

• Contingency plans and escalation procedures

• Risk and opportunity management training

• Linkage with audit function

• Embedded in strategic planning, capital allocation, product development, etc.

• Early warning risk indicators

• Linkage to performance measurement/incentives

• Risk modeling/scenarios and opportunity scenarios

• Industry benchmarking

Stages of ERM maturity

OMAFRA’s overall current state

OMAFRA’s overall desired state

9

ERM – Outcomes Sought

Outcome Status

1 Information and tools available to Senior Management to assist with decision making

Achieved

2 Increase awareness of ERM Achieved

3 Implementation of recommendations regarding the next phases of ERM

•Governance structure and resourcing

•Embedding ERM tools and processes throughout Ministry

•Connecting ERM with other key ministry processes

Under consideration

10

Results of the Assessments Strategic Priorities – Individual Assessments:

• Results integrated in with key annual ‘Results based Plan’ Projects

Strategic Priorities – Individual Assessments and Common Themes

• Shared with appropriate areas in the ministry for consideration during the – implementation of the transformation projects;– development of OMAFRA’s strategic plan; and– preparation of the Results based Plan for 2013/14.

Specific RbP projects:

– Used to refine the project charter and inform the project co-leads, projects members and Director Oversight Committee.

11

OMAFRA’s Evolution to More Mature ERM State

OMAF/MRA should continue to implement ERM given:

• ERM is a good business practice

• Results of Phase 1 positive– Outcomes have helped to inform transformative

and priority projects– Most participants became strong supporters of

ERM

• Office of the Provincial Controller exploring ERM

• ERM initiative could partially address staff comments about perception of “risk averse” culture.

12

Expected outcomes for a mature ERM organization

– better, more consistent identification of risks, opportunities and strategies to respond

– the creation of an effective tool that can assist in strategic planning and decision making.

Via: • Senior Executive responsible for ERM provides

leadership for the ongoing ERM initiative

• Key roles, responsibilities and authorities relating to risk / opportunity management are clearly delineated

• A common definition of risk / opportunity and a common risk / opportunity framework used by all ministry staff members

Activities Supporting Key Outcomes

• A common ERM approach to support the performance of the risk / opportunity responsibilities

• Assurance is provided about the ERM initiative’s effectiveness with periodic monitoring/reporting of the ERM initiative’s progress in relation to expected outcomes

• Controllership - Divisions, branches, units and staff are accountable for and capable of managing the risks and opportunities as identified through the use of ERM

• Corporate support functions (e.g., Finance, IM/IT, Audit Services, Strategic Solutions, Business Services, Legal, etc.) actively support the program areas in the management of risks/opportunities.

13

Tools

Customized approach to ERM that consists of scalable tools that have been tested throughout the ministry.

•Five step process

•ERM website launched as a resource on Charlotte

•Network of trained users

•Third party facilitation

14

Currently• Enterprise Risk Management (ERM) is a key component of

ministry Controllership Action Plan (CAP)

• OMAF/MRA using a tested and made-in-OMAF/MRA model to assess risks and opportunities associated with ministry's key priorities and positioned as part of strategic planning cycle.

• Staff understand that approach supported by tools can help the

ministry achieve priorities.

15

Enterprise Risk Management cont’d

• Development of “built in OMAFRA” model based on our pilot experience. The OMAFRA model includes information and online tools including case studies and testimonials based on our pilot experience

• Approach used for risk identification, assessment in terms of likelihood and impact for both enterprise-wide assessment and RbP project specific areas

– It is a workable tool that is flexible to respond to subject matter and nature of assessment

– It is scalable so it can be use to assist in decision making at several levels

16

Enterprise Risk Management -Experience

• Benefits to date:

– Higher level of awareness of concepts and benefits

– Consistent language and mental models

– Consistent identification of threats, opportunities and strategies to address

– Assessment results and common themes shared and integrated at several levels

– Has informed refinement of RbP project charters, implementation of transformation projects, development of RbP and development of 5-year plan

17

Enterprise Risk Management – Experience cont’d

• Visual – OMAF/MRA ERM model uses a stepped process. To date, the first 4 steps have been used, and step 5 is in progress.

• We are shooting for a more mature state – one that is integrated :

– where assessment occurs at all levels, and results of both risk and opportunity assessments would flow across, up and down the ministry

– where we have a coordinated approach, where we fully define our risk appetitive and are linked with audit function

• Next step: finalize governance, structure, how we will embed and sustain in OMAFRA and ensure that we connect with key ministry processes as part of an annual business cycle

18

1919

OMAFRA Model

Steps

1. Validate Objective(s) and Context

2. Identify Risks

3. Assess and Prioritize Risks

2a. Identify Opportunities

3a. Assess and Prioritize Opportunities

4. Identify Recommendations Regarding Strategies for the Significant Risks and Opportunities

5. Reporting and Monitoring

LessonsImplementing ERM requires a long term commitment to:

•Prepare and implement an ERM architecture for OMAF/MRA

•Develop the competencies of staff members;

•Integrate ERM findings into annual business planning cycle, program, policy and resource decision making

•Initiative owners must:

-define assessment objectives

-decide who will be participating in the assessment

-determine the structure and schedule of the assessment.

20

Appendices

Enterprise Risk ManagementInternal Messaging

• Part of CAP, a multi-year approach with the goal of strengthening our controllership pillars – first year focused on a foundation of values and ethics – to provide foundational element for transformative projects (eg. other pillars for future include procurement, performance measures, IM/IT)

• Our specific goal with ERM is to create a ministry culture where identifying risk and opportunities becomes an intrinsic part of our annual business cycle of process supporting strategic planning and decision making

• Application to date – pilot project this year using cross-ministry teams and assessment on 4 enterprise-wide strategic priorities

22

23

Risk and Opportunity Assessments- Methodology • Risks and opportunities are assessed by assigning a numerical

ranking (from 1 to 5) to the: – Likelihood (what the chance that the risk or opportunity will

actually occur?); and – Impact (what is the impact given that the risk or opportunity

has occurred?).

• A risk or opportunity score is then calculated by multiplying the likelihood by the impact.

• This score is then translated to classification of the risk or opportunity from low to very high.

• The classification is not strictly driven by the resulting score, but professional judgement is also applied to validate that the resulting classification makes sense.

24

Common Themes - Risks

Examples: Themes relating to the ERM assessments across several strategic priorities

• Capacity: Issues concerning both intellectual and physical resource capacity, specifically access to sufficient physical infrastructure, aging demographics, resource retention and succession planning within OMAFRA and the industry.

• Program Delivery: The need to better utilize the Ministry’s existing tools and mechanisms and to evaluate the Ministry’s programs in order to support decision making and demonstrate value for money.

• Alliances and Partnership Building: Issues concerning the Ministry’s ability to maintain/enhance existing partnerships as well as the ability to build new alliances in the future.

25

Common Themes - Opportunities

Examples: Themes relating to the ERM assessments across several strategic priorities

• Collaboration and coordination: Increased collaboration and coordination within OMAFRA and with other ministries, the federal government and industry partners.

• Modernization: Modernization of program delivery, research infrastructure and Information Technology (IT) platforms in order to better meet the Ministry’s objectives.

Establish Context, State Objectives

Key Questions to “Establish the Context”•What does your business unit or program strive to achieve?•How do you or how will you go about it?•On what do you place a high value? On what does your organization place a high value?•What are key success factors in meeting your objectives?•What authority and resource do you have?•What kind of environment do you face (internal and external – i.e. customers, suppliers, regulation, technology, etc.)?•Are there any pre-established criteria against which risks should be evaluated? •Are there corporate polices or legislation that must be followed absolutely?•How will the results of the risk assessment be sued? Who will see it?•What is the organization’s sensitivity, capacity and maturity in dealing with risk information?

27

Establish Context, State Objectives cont’dGetting Started Tips•For the first step in the process - establishing the context and objectives - it is recommended to clearly plan out what information needs to be covered (background or history; jurisdictional scan; what the problem is; how the outcome will help solve the problem; and, what is relevant to the issue you are dealing with; and have all relevant information available before the first task team meeting.•Choose your working group carefully to have key people who can provide context at the beginning and during the process. Working group should remain the same throughout the process; however, if and when needed, use experts for risk assessment and economic analysis (formal training in risk and economic analysis should be requested). •Identify early on in the process the manager that “owns” the risk of the proposed project. His/her leadership will be crucial in driving the project and keep task team members motivated; have adequate resources and staff allocated proportional to the project importance, priority and timelines.

28

Establish Context, State Objectives cont’d

Getting Started Tips cont’d

•Be inclusive, flexible, consult early on in the process and communicate often (with Task Team members, Working Group members, Senior Management Group, and if applicable outside stakeholders).

•Clearly state the objectives that you will be measuring the risks against. This should be tied in with the context (e.g., one of OMAFRA’s objectives is safe food for Ontario consumers. More specific, detailed objectives, supporting OMAFRA’s objectives, can be found in Division or Branch strategic plans or strategy maps). If this process is being used for a project, the objectives of the project itself should be used.

29

Risk Classification Categories

CATEGORY Strategic Corporate Management Operational Organizational Environmental

Definition of Associated

Risks

 Risks that could

impede the achievement of the Ministry’s mandate

and objectives.

Risks that could cause the Ministry’s common

business processes to breakdown or fail.

Risks that could hinder the successful management of the Ministry’s operations.

Risks related to the Ministry’s reputation

or work culture.

Risks caused by external factors or

requirements outside of the control of the

Ministry.

Definition of Associated

Opportunities

Opportunities that could advance the achievement of the Ministry’s mandate

and objectives.

Opportunities that could advance the Ministry’s

common business processes.

Opportunities that could advance the successful

management of the Ministry’s operations.

Opportunities related to the

Ministry’s reputation or work culture.

Opportunities related to external factors or

requirements outside of the control of the

Ministry.

OPS wide or OMAFRA specific

(OPS/OMAFRA) (OPS/OMAFRA) (OPS/OMAFRA) (OMAFRA) (OPS/OMAFRA)

Possible considerations

-Influence within the OPS-Alignment with OMAFRA strategic priorities-Alignment with OPS priorities-Policy development-Media relations-Technology trends-Economic trends-Financial or budget

-Strategic planning & budgeting-Financial management-Project management-Asset management-Human resources-Corporate communications-Enterprise risk management-Legal issues-Emergency preparedness

-Program development-Program delivery-Synergies with major projects-Alliances & partnerships-Information technology-Workplace health and safety-Security, privacy & confidentiality-Physical resources-Legal liabilities & litigation-Business continuity-Stakeholder compliance

 -Values & Ethics-Accountability/ Transparency-Modern controllership-Internal demographics

-Political factors-Public expectations-Stakeholder relations-Environmental protection-Laws and regulations-Central agency policies-Agreements and contractual obligations-External demographics-Legal issues

30