Rec #

#	Recommendation	Management Response	Est Comp Date	Status Updates (In Progress; Pending; Complete; Requires Resolution)
2 2	That the City Manager ensure there is a review to update the Centres of Expertise Service Level Agreements, including definition of performance levels, monitoring requirements and approach for identifying and resolving issues or disputes.	Management agrees with this recommendation. A draft proposed process, addressing all of these elements, will be presented to Senior Management Team (SMT) at the January 2006 meeting. This project is a priority identified in the 2006 Corporate Services departmental business plan and will be included in the 2006 workplan of the Office of the Chief Corporate Services Officer.	Q4 2006	December 2009: In Progress. Service levels between client departments and Shared Services departments will be negotiated and documented in the departmental Service Excellence Plans to be completed by the end of Q2 2010. Three options for post-implementation governance of the Shared Services Model have been developed. The options include an approach for identifying and resolving issues or disputes. These options will be reviewed by the Steering Committee in Q1 2010 and implementation will continue throughout 2010. June 2009: Shared Services Review - Phase II: Completed on March 25, 2009 as part of the realignment exercise. A new integrated management framework was established for shared services and new management organizational structures were defined for each of the shared services departments. These changes were made to respond to the results of the Phase I assessment. Shared Services Review - Phase III: Currently underway. A steering committee of the shared services directors has been established to guide the implementation of new service agreements, funding models and reporting frameworks. The implementation is also supported by a dedicated project team and a working group made up of both representatives from the shared services departments and the client departments. A more detailed project plan has been developed for this phase of the implementation, which includes a significant stream of work focussed on implementation of a service excellence culture. As part of this scoping and planning exercise, the timelines have been reviewed and adjusted. The anticipated completion date is now Q1 2010. December 2008: Shared Services Review - Phase I: Completed in November 2008. A consultant was engaged to work with EMC and other key stakeholders to define the service delivery principles for the City. Phases two and three of the project will be led by the Director, Organizational Development & Performance and will involve the development and implementation of mechanisms to achieve the principles and concepts endorsed by EMC. Shared Services Review - Phase II: Currently underway, to be complete by Q1 2009. This scope of this project is to design and implement an improved service delivery model for shared services that builds on Phase 1 findings and recommendations and fully supports the corporate realignment that is currently underway. It will define the management organizational structure for the “Centres of Expertise” and will identify the roles and functions that will be need to be included in the organizational structures of the service areas. Shared Services Review - Phase III: will complete the full implementation of the Shared Services Model including a review of service level agreements, funding models, and reporting frameworks. The implementation plan for Phase III is expected to be complete by the end of Q2 2009. August 2008: The BTS Department initiated a project to refine the shared services model so that it supports the City’s commitment to service excellence and meets client service values. The project will be undertaken in three phases and will run over the course of a year. A request for proposal was issued in July to engage the services of an external consultant that will work with EMC and other key stakeholders to define the service delivery principles for the City. Phases two and three of the project will be led by the Executive Director, BTS and will involve the development and implementation of mechanisms to achieve the principles and concepts endorsed by EMC. May 2008: A briefing note went to EMC in April outlining a proposed methodology and timelines to examine and resolve outstanding issues related to shared services (COEs) including the development of new service level agreements (SLAs). The shared services branches are in the process of reviewing how their service delivery models will complement the new corporate guidance and service excellence initiatives. New SLAs are expected to be developed in 2009 once the service delivery model reviews are completed. January 2008: EMC discussed this January 14, 2008. Action: COE Branch Directors to prepare a Briefing Note to address the following questions: Outline Audit recommendations specific to their branch and management responses re COE model and its components; Outline branch issues that came out of 2006 COE review work and assessment of what is required to be done to address; Outline of work that has occurred since 2006 and work yet to occur with respect to branch plans to address outstanding COE issues; Associated timelines and proposed process to implement. Briefing Notes to be considered at the February 25, 2008 EMC meeting.
4 4 4 4	That the CCPR Officer introduce integrated risk management within the City, as part of the planning and performance management cycle. This would include such activities as: a) development of an integrated risk management policy, b) development of tools and approaches for risk management, and c) provision of risk management training.	Although Management agrees with the Auditor General’s recommendation in principle, Management does not believe it would be practical to implement this recommendation at this point. The cost/benefit of implementing a full blown, organization-wide risk management initiative, as suggested by the Auditor General, is not clear, nor is it clear that this is a widely accepted best practice in municipal governance. Recent implementation of these types of programs in the private sector has been driven to a considerable extent by Sarbanes-Oxley requirements in the U.S. To Management’s knowledge, in the few cases where Canadian municipalities have experimented with them, implementation has not been successful. Management’s priority at this point, from a management control framework perspective, is on rolling out the planning framework and developing and implementing the performance measurement and reporting framework, throughout the organization over the next 2-3 years. Nonetheless, certain steps Management is taking to enhance the Corporate planning process, such as the presentation of a comprehensive environmental scan, which will identify risks to be considered in developing the City Corporate Plan and Departmental Business plans, will address this issue. Regarding the development of an integrated risk management policy management, Management believes that the Auditor General’s observations in this area should take into account that the City has a risk management policy, which was approved by Council in 2001, confirms the City’s commitment to sound risk management processes. Some of the specific measures that Corporate Services has taken to explicitly address risks in different areas are outlined in this policy. For example, risk management principles are explicitly applied in investment decisions, in decisions regarding insurance coverage and in providing and maintaining safe conditions in the workplace. In addition, risk management processes are also applied in other key areas. The Emergency Measures Unit has identified catastrophic risks that could impact the City and has developed a program/plan to address them. Moreover, on an ongoing basis, Public Works staff perform construction/maintenance project risk assessments and procedures have been adopted by the City to ensure that risks are reasonably transferred through the tender, contract and agreement process. Both Real Property Asset Management and Public Works and Services have adopted Comprehensive Asset Management Strategies that have been approved by City Council and that include inventories, gap analyses and strategies for decommissioning and rehabilitating infrastructure reaching the end of its lifecycle.	Q4 2008	December 31, 2009: In Progress. An ERM policy was developed and will proceed to SMC, EC, CSEDC and Council in Q1 2010. An ERM framework, tools and templates, have been developed including a Glossary, Risk Impact Measurement chart stating the City’s tolerance for risk, a “How to do a Risk Assessment” module, etc. Training on risk management will be developed in 2010 based on the framework. June 2009: The ERM Committee has had several meetings and a risk assessment demo was held on May 12, 2009 with participation from most City departments. Neither the ERM policy nor TOR for the Steering Committee went to Council in Q2 2009. Corporate Risk Management was transferred to Organizational Development and Performance branch on July 2, 2009. It is anticipated the ERM framework will be complete in Q4 2009. December 2008: Further to the August 2008 update, the following actions have taken place: a) City Council approved the permanent funding of $120K for both the ERM program and the Coordinator, Corporate Risk Management position as part of the 2009 budget deliberations in December 2008. b) A new Corporate Enhanced Risk Management policy has been drafted and will be forwarded to Council for approval in Q2 2009. Once approval has been granted, the new policy will replace the 2001 Risk Management policy. c) The Coordinator, Corporate Risk Management continues to provide strategic advice and assistance to the SBR project. Specific assistance is rendered with the Risk Management Module to capture the three to five most significant risks per Branch and identify how those risks will be addressed. d) A "Risk Review" of the Parks and Recreation Program Delivery function has been completed. e) The first meeting of the ERM Steering Committee was held on November 13, 2008. f) The first ERM report to Council is being drafted together with an implementation plan. This is expected to go forward in Q2 2009. g) Development of an ERM framework is underway and is expected to be complete in Q2 2009. August 2008: Further to City Council approval of Phase 1 of an Enhanced Risk Management (ERM) program, the following actions have taken place: a) A Corporate Risk Management Officer has been hired to implement Council's directives; b) The Corporate Risk Management Officer has been providing strategic advice and assistance to the Strategic Branch Review (SBR) project; c) One of the two risk reviews scheduled for 2008 has been completed as directed by Council; d) The composition of the Corporate Risk Management Committee as well as the draft terms of reference have been finalized. A report on the progress of this initiative, together with recommendations for next steps, including the permanent funding of the Corporate Risk Management Officer position is expected in the late fall of 2008. May 2008: As part of the 2008 budget, City Council approved the implementation of Phase 1 of an Enhanced Risk Management (ERM) program, which would include: a) developing an ERM framework aligned with the Strategic Branch Reviews; b) training around the framework; c) two risk reviews with key clients; and d) the establishment of a Risk Committee. Council approved one-time funding of $150K and one FTE for a Corporate Risk Manager to implement the above. It is anticipated that a status report will be presented to Committee and Council in Q4 2008. January 2008: The required funding for 2008 has been provisionally approved pending completion of the Operational Budget Reviews for Administrative Services. On March 7, 2008 a presentation will be made to Long-Range Financial Planning Sub-Committee outlining the planned approach to the broader, systems-wide initiative of "Enterprise Risk Management". Risk management approaches have been included in the detailed design for the strategic branch review process that will go to Council on March 13, 2008. September 2007: The required funding for 2008 has been submitted as a budget pressure. In the meantime, risk management approaches are being built in to the conceptual design that has begun for the branch service review process. May 31, 2007: Agreed to action plan. Subject to further discussion between the Auditor General and the Council Audit Working Group. A business case for the potential implementation of an integrated risk management framework was completed in January 2007. Staff recommendation remains deferring implementation of such a framework to focus on other priorities. March 6, 2007: Resolution. Briefing note provided to CAWG. AG and CAWG confirmed that proposed actions met the intent of the audit. January 29, 2007: CAWG considered the business case CPPRO will undertake the following to address the AG recommendation: i) modify the existing risk management policy or develop a new Corporate integrated risk management policy by 2008; ii) introduce into its guidance for the preparation of branch business plans, a section that outlines the potential risks to the achievement of the branch objectives; iii) develop a template that can be used to capture the 3-5 most significant risks for each branch & how those risks are addressed - this will be integrated with the branch business plan templates & will be made available in 2008 for the 2009 business planning cycle; & iv) develop a course to be offered in the latter part of 2008 on risk management relating to the application of these concepts & the use of the template. Since the budget requirement was identified after the tabling of the original report, discussion and approval will be required of CAWG. This course will be offered to management staff involved in the evaluation of risk as part of the business planning process. We estimate the cost of policy development, training material development & delivery is $150K, which we will include as a budget pressure for 2008.

Recommendation

Management Response

Est Comp Date

Status Updates

(In Progress; Pending; Complete;

Requires Resolution)

That the City Manager ensure there is a review to update the Centres of Expertise Service Level Agreements, including definition of performance levels, monitoring requirements and approach for identifying and resolving issues or disputes.

Management agrees with this recommendation. A draft proposed process, addressing all of these elements, will be presented to Senior Management Team (SMT) at the January 2006 meeting. This project is a priority identified in the 2006 Corporate Services departmental business plan and will be included in the 2006 workplan of the Office of the Chief Corporate Services Officer.

Q4 2006

December 2009: In Progress.

Service levels between client departments and Shared Services departments will be negotiated and documented in the departmental Service Excellence Plans to be completed by the end of Q2 2010. Three options for post-implementation governance of the Shared Services Model have been developed. The options include an approach for identifying and resolving issues or disputes. These options will be reviewed by the Steering Committee in Q1 2010 and implementation will continue throughout 2010.

June 2009: Shared Services Review - Phase II: Completed on March 25, 2009 as part of the realignment exercise. A new integrated management framework was established for shared services and new management organizational structures were defined for each of the shared services departments. These changes were made to respond to the results of the Phase I assessment.

Shared Services Review - Phase III: Currently underway. A steering committee of the shared services directors has been established to guide the implementation of new service agreements, funding models and reporting frameworks. The implementation is also supported by a dedicated project team and a working group made up of both representatives from the shared services departments and the client departments. A more detailed project plan has been developed for this phase of the implementation, which includes a significant stream of work focussed on implementation of a service excellence culture. As part of this scoping and planning exercise, the timelines have been reviewed and adjusted. The anticipated completion date is now Q1 2010.

December 2008: Shared Services Review - Phase I: Completed in November 2008. A consultant was engaged to work with EMC and other key stakeholders to define the service delivery principles for the City. Phases two and three of the project will be led by the Director, Organizational Development & Performance and will involve the development and implementation of mechanisms to achieve the principles and concepts endorsed by EMC.

Shared Services Review - Phase II: Currently underway, to be complete by Q1 2009. This scope of this project is to design and implement an improved service delivery model for shared services that builds on Phase 1 findings and recommendations and fully supports the corporate realignment that is currently underway. It will define the management organizational structure for the “Centres of Expertise” and will identify the roles and functions that will be need to be included in the organizational structures of the service areas.
Shared Services Review - Phase III: will complete the full implementation of the Shared Services Model including a review of service level agreements, funding models, and reporting frameworks. The implementation plan for Phase III is expected to be complete by the end of Q2 2009.

August 2008: The BTS Department initiated a project to refine the shared services model so that it supports the City’s commitment to service excellence and meets client service values. The project will be undertaken in three phases and will run over the course of a year. A request for proposal was issued in July to engage the services of an external consultant that will work with EMC and other key stakeholders to define the service delivery principles for the City. Phases two and three of the project will be led by the Executive Director, BTS and will involve the development and implementation of mechanisms to achieve the principles and concepts endorsed by EMC.

May 2008: A briefing note went to EMC in April outlining a proposed methodology and timelines to examine and resolve outstanding issues related to shared services (COEs) including the development of new service level agreements (SLAs). The shared services branches are in the process of reviewing how their service delivery models will complement the new corporate guidance and service excellence initiatives. New SLAs are expected to be developed in 2009 once the service delivery model reviews are completed.

January 2008: EMC discussed this January 14, 2008. Action: COE Branch Directors to prepare a Briefing Note to address the following questions: Outline Audit recommendations specific to their branch and management responses re COE model and its components; Outline branch issues that came out of 2006 COE review work and assessment of what is required to be done to address; Outline of work that has occurred since 2006 and work yet to occur with respect to branch plans to address outstanding COE issues; Associated timelines and proposed process to implement. Briefing Notes to be considered at the February 25, 2008 EMC meeting.

That the CCPR Officer introduce integrated risk management within the City, as part of the planning and performance management cycle. This would include such activities as:
a) development of an integrated risk management policy,
b) development of tools and approaches for risk management, and
c) provision of risk management training.

Although Management agrees with the Auditor General’s recommendation in principle, Management does not believe it would be practical to implement this recommendation at this point. The cost/benefit of implementing a full blown, organization-wide risk management initiative, as suggested by the Auditor General, is not clear, nor is it clear that this is a widely accepted best practice in municipal governance. Recent implementation of these types of programs in the private sector has been driven to a considerable extent by Sarbanes-Oxley requirements in the U.S. To Management’s knowledge, in the few cases where Canadian municipalities have experimented with them, implementation has not been successful.

Management’s priority at this point, from a management control framework perspective, is on rolling out the planning framework and developing and implementing the performance measurement and reporting framework, throughout the organization over the next 2-3 years. Nonetheless, certain steps Management is taking to enhance the Corporate planning process, such as the presentation of a comprehensive environmental scan, which will identify risks to be considered in developing the City Corporate Plan and Departmental Business plans, will address this issue.

Regarding the development of an integrated risk management policy management, Management believes that the Auditor General’s observations in this area should take into account that the City has a risk management policy, which was approved by Council in 2001, confirms the City’s commitment to sound risk management processes. Some of the specific measures that Corporate Services has taken to explicitly address risks in different areas are outlined in this policy. For example, risk management principles are explicitly applied in investment decisions, in decisions regarding insurance coverage and in providing and maintaining safe conditions in the workplace. In addition, risk management processes are also applied in other key areas.

The Emergency Measures Unit has identified catastrophic risks that could impact the City and has developed a program/plan to address them. Moreover, on an ongoing basis, Public Works staff perform construction/maintenance project risk assessments and procedures have been adopted by the City to ensure that risks are reasonably transferred through the tender, contract and agreement process. Both Real Property Asset Management and Public Works and Services have adopted Comprehensive Asset Management Strategies that have been approved by City Council and that include inventories, gap analyses and strategies for decommissioning and rehabilitating infrastructure reaching the end of its lifecycle.

Q4 2008

December 31, 2009: In Progress.
An ERM policy was developed and will proceed to SMC, EC, CSEDC and Council in Q1 2010. An ERM framework, tools and templates, have been developed including a Glossary, Risk Impact Measurement chart stating the City’s tolerance for risk, a “How to do a Risk Assessment” module, etc. Training on risk management will be developed in 2010 based on the framework.

June 2009: The ERM Committee has had several meetings and a risk assessment demo was held on May 12, 2009 with participation from most City departments. Neither the ERM policy nor TOR for the Steering Committee went to Council in Q2 2009. Corporate Risk Management was transferred to Organizational Development and Performance branch on July 2, 2009. It is anticipated the ERM framework will be complete in Q4 2009.

December 2008: Further to the August 2008 update, the following actions have taken place:
a) City Council approved the permanent funding of $120K for both the ERM program and the Coordinator, Corporate Risk Management position as part of the 2009 budget deliberations in December 2008.
b) A new Corporate Enhanced Risk Management policy has been drafted and will be forwarded to Council for approval in Q2 2009. Once approval has been granted, the new policy will replace the 2001 Risk Management policy.
c) The Coordinator, Corporate Risk Management continues to provide strategic advice and assistance to the SBR project. Specific assistance is rendered with the Risk Management Module to capture the three to five most significant risks per Branch and identify how those risks will be addressed.
d) A "Risk Review" of the Parks and Recreation Program Delivery function has been completed.
e) The first meeting of the ERM Steering Committee was held on November 13, 2008.
f) The first ERM report to Council is being drafted together with an implementation plan. This is expected to go forward in Q2 2009.
g) Development of an ERM framework is underway and is expected to be complete in Q2 2009.

August 2008: Further to City Council approval of Phase 1 of an Enhanced Risk Management (ERM) program, the following actions have taken place:
a) A Corporate Risk Management Officer has been hired to implement Council's directives;
b) The Corporate Risk Management Officer has been providing strategic advice and assistance to the Strategic Branch Review (SBR) project;
c) One of the two risk reviews scheduled for 2008 has been completed as directed by Council;
d) The composition of the Corporate Risk Management Committee as well as the draft terms of reference have been finalized.
A report on the progress of this initiative, together with recommendations for next steps, including the permanent funding of the Corporate Risk Management Officer position is expected in the late fall of 2008.

May 2008: As part of the 2008 budget, City Council approved the implementation of Phase 1 of an Enhanced Risk Management (ERM) program, which would include:
a) developing an ERM framework aligned with the Strategic Branch Reviews;
b) training around the framework;
c) two risk reviews with key clients; and

d) the establishment of a Risk Committee.

Council approved one-time funding of $150K and one FTE for a Corporate Risk Manager to implement the above. It is anticipated that a status report will be presented to Committee and Council in Q4 2008.

January 2008: The required funding for 2008 has been provisionally approved pending completion of the Operational Budget Reviews for Administrative Services. On March 7, 2008 a presentation will be made to Long-Range Financial Planning Sub-Committee outlining the planned approach to the broader, systems-wide initiative of "Enterprise Risk Management". Risk management approaches have been included in the detailed design for the strategic branch review process that will go to Council on March 13, 2008.

September 2007: The required funding for 2008 has been submitted as a budget pressure. In the meantime, risk management approaches are being built in to the conceptual design that has begun for the branch service review process.

May 31, 2007: Agreed to action plan. Subject to further discussion between the Auditor General and the Council Audit Working Group. A business case for the potential implementation of an integrated risk management framework was completed in January 2007. Staff recommendation remains deferring implementation of such a framework to focus on other priorities.

March 6, 2007: Resolution. Briefing note provided to CAWG. AG and CAWG confirmed that proposed actions met the intent of the audit.

January 29, 2007: CAWG considered the business case

CPPRO will undertake the following to address the AG recommendation:
i) modify the existing risk management policy or develop a new Corporate integrated risk management policy by 2008;
ii) introduce into its guidance for the preparation of branch business plans, a section that outlines the potential risks to the achievement of the branch objectives;
iii) develop a template that can be used to capture the 3-5 most significant risks for each branch & how those risks are addressed - this will be integrated with the branch business plan templates & will be made available in 2008 for the 2009 business planning cycle; &
iv) develop a course to be offered in the latter part of 2008 on risk management relating to the application of these concepts & the use of the template.

Since the budget requirement was identified after the tabling of the original report, discussion and approval will be required of CAWG. This course will be offered to management staff involved in the evaluation of risk as part of the business planning process. We estimate the cost of policy development, training material development & delivery is $150K, which we will include as a budget pressure for 2008.