Board of Health Workshop Risk Management Board of Health Workshop May 27, 2016 Dr. Penny Sutcliffe, Medical Officer of Heath/Chief Executive Officer Sandra Laclé, Acting Director, Corporate Services Krista Galic, Specialist, Quality and Monitoring 1

1. Context and Process Ontario Public Health Organizational Standards 3.1 Board of health stewardship 4.2 Board of health member orientation and training - Risk Management oversight 6.2 Risk management - Delegated to senior staff Ontario Government audits of health units have highlighted risk management Audit recommendation to adopt a Risk Management framework 6.2 The board of health shall ensure that the administration monitors and responds to emerging issues and potential threats to the organization, from both internal and external sources, in a timely and effective manner. Risk management is expected to include, but is not limited to: financial risks, HR succession and surge capacity planning, operational risks, and legal issues. Risk Management was identified as an area that needed improvement in some of the PHUs that were audited by the Health Audit Services Team (HAST).  One of the audited health units reached out to HAST for help in developing risk management practices.  The ministry agreed that HAST could provide this advisory service.  Given that other PHUs could benefit from this help, alPHa became  involved to promote and coordinate risk management training across PHUs. In the past 12 months, Corinne has presented at 2 alPH sessions and has helped 2 PHUs directly (Kingston and Sudbury).  Given the impossibility of helping all PHUs individually, ALPHA is coordinating a working group of volunteers from a number of PHUs to help implement RM across all 36 units.     

1. Context and Process (cont’d) SDHU review of Algoma Public Health Assessor’s report SDHU May 5, 2016 board governance training alPHa support: Promoting and coordinating risk management training Provincial workshops November 5, 2015 and February 24, 2016 alPHa Provincial Risk Management Working Group

1. Context and Process (cont’d) SDHU Actions to Date: Participation in alPHa Working Group April 14 - 15 – Senior Management workshop May 3 – Senior Management workshop May 6 – Board Executive Committee May 27 – Board Risk Management workshop

2. Identified Organizational Risks… 5

2. …and Risk Mapping 24 risks identified: 14 high risk In 9 categories 7 medium risk In 6 categories 3 low risk In 3 categories 6

2. Identified Organizational Risks and Risk Mapping (cont’d) Financial: Budget pressures, financial forecasting, fraud Governance/Organizational: Board competencies, consideration of changes in statutes, policies and directions Human Resources: Succession and business continuity planning, staff competencies, staff engagement, staff working offsite Knowledge/Information: Incomplete Technology: Network outage, technology plan Legal/Compliance: Statutes and regulations Service Delivery/Operational: Services are value add Environment: Hazards Political: Health system transformation Stakeholder/Public Perception: Indigenous relationships, managing expectations Strategic/Policy: Strategic plan Security: Network security Privacy: Internal controls Equity: Priority populations 7

3. Reflection Overall Gaps and Priorities: Are there risks you were expecting to see that are not on the list? Are there risks on the list that should not be included? Other comments or questions?

3. Reflection Overall (cont’d) Risk Appetite: The amount and type of risk that the SDHU is willing to take in order to meet strategic objectives. Scale Zero risk Not willing to accept risk (threats or opportunities) Low risk Unwilling to accept even a very limited amount of threat (downside risk) in most circumstances unless the opportunities (upside risk) exceed the threat Modest risk Willing to accept some threats in certain circumstances that include opportunity Moderate risk Willing to accept some threats commensurate with the potential opportunity High risk Willing to accept risk - a high level of inherent downside risk (threats) in circumstances where there are significant or important opportunities And Risk Tolerance 9

4. “Code Red” Drill Down Questions for each “code red” risk: Is the evaluation of the risk accurate? Does this risk fall into the Risk Tolerance/Appetite of the Board? Are there other controls that should be considered? Should additional time and resources be invested in future controls to reduce the risk? Risk appetite filter overall and for each “code red” risk: After current controls (mitigation strategies). Are there other controls that should be considered if the Board feels that the risk levels exceed their appetite? 10

4. “Code Red” Drill Down (cont’d) Financial #1 – Likelihood 5 Impact 5 The SDHU may be at risk as budget pressures are expected to increase over the next several years. Is the evaluation of the risk accurate? Does this risk fall into the Risk Tolerance/Appetite of the Board? Are there other controls that should be considered? Should additional time and resources be invested in future controls to reduce the risk? 11

4. “Code Red” Drill Down (cont’d) Financial #2 – Likelihood 4 Impact 4 The SDHU may be at risk of financial forecasting not providing sufficient information for decision making resulting in suboptimal financial management within year. Is the evaluation of the risk accurate? Does this risk fall into the Risk Tolerance/Appetite of the Board? Are there other controls that should be considered? Should additional time and resources be invested in future controls to reduce the risk? 12

4. “Code Red” Drill Down (cont’d) Governance #1 – Likelihood 4 Impact 5 The SDHU may be at risk as BoH members, individually or collectively, may not have the required competencies for effective Board Governance. Is the evaluation of the risk accurate? Does this risk fall into the Risk Tolerance/Appetite of the Board? Are there other controls that should be considered? Should additional time and resources be invested in future controls to reduce the risk? 13

4. “Code Red” Drill Down (cont’d) Governance #2 – Likelihood 4 Impact 3 The SDHU may be at risk of not systematically ensuring that the governance implications of changes in statutes, policies, and directions have been considered. Is the evaluation of the risk accurate? Does this risk fall into the Risk Tolerance/Appetite of the Board? Are there other controls that should be considered? Should additional time and resources be invested in future controls to reduce the risk? 14

4. “Code Red” Drill Down (cont’d) Human Resources #1 – Likelihood 5 Impact 5 The SDHU may be at risk as a result of an insufficient investment in succession and business continuity planning. Is the evaluation of the risk accurate? Does this risk fall into the Risk Tolerance/Appetite of the Board? Are there other controls that should be considered? Should additional time and resources be invested in future controls to reduce the risk? 15

4. “Code Red” Drill Down (cont’d) Human Resources #2 – Likelihood 4 Impact 4 The SDHU may be at risk as staff may not have all of the necessary competencies to meet evolving Public Health needs. Is the evaluation of the risk accurate? Does this risk fall into the Risk Tolerance/Appetite of the Board? Are there other controls that should be considered? Should additional time and resources be invested in future controls to reduce the risk? 16

4. “Code Red” Drill Down (cont’d) Technology #1 – Likelihood 3 Impact 5 The SDHU may be at risk of a network outage. Is the evaluation of the risk accurate? Does this risk fall into the Risk Tolerance/Appetite of the Board? Are there other controls that should be considered? Should additional time and resources be invested in future controls to reduce the risk? 17

4. “Code Red” Drill Down (cont’d) Technology #2 – Likelihood 4 Impact 3 The SDHU may be at risk of not having a comprehensive and future oriented information technology plan and planning processes. Is the evaluation of the risk accurate? Does this risk fall into the Risk Tolerance/Appetite of the Board? Are there other controls that should be considered? Should additional time and resources be invested in future controls to reduce the risk? 18

4. “Code Red” Drill Down (cont’d) Service Delivery/Operational #1 – Likelihood 3 Impact 4 The SDHU may be at risk of our service not being perceived as a value add to our clients. Is the evaluation of the risk accurate? Does this risk fall into the Risk Tolerance/Appetite of the Board? Are there other controls that should be considered? Should additional time and resources be invested in future controls to reduce the risk? 19

4. “Code Red” Drill Down (cont’d) Political #1 – Likelihood 5 Impact 5 The SDHU may be at risk of significant disruptions and high opportunity costs related to health system transformation. Is the evaluation of the risk accurate? Does this risk fall into the Risk Tolerance/Appetite of the Board? Are there other controls that should be considered? Should additional time and resources be invested in future controls to reduce the risk? 20

4. “Code Red” Drill Down (cont’d) Stakeholder/Public Perception #1 – Likelihood 5 Impact 5 The SDHU may be at risk of poorly defined relationships with Indigenous communities. Is the evaluation of the risk accurate? Does this risk fall into the Risk Tolerance/Appetite of the Board? Are there other controls that should be considered? Should additional time and resources be invested in future controls to reduce the risk? 21

4. “Code Red” Drill Down (cont’d) Stakeholder/Public Perception #2 – Likelihood 5 Impact 4 The SDHU may be at risk of uncertainty around managing the expectations of the public, ministries, stakeholders, and/or the media to prevent disruption of service or criticism of Public Health and a negative public image. Is the evaluation of the risk accurate? Does this risk fall into the Risk Tolerance/Appetite of the Board? Are there other controls that should be considered? Should additional time and resources be invested in future controls to reduce the risk? 22

4. “Code Red” Drill Down (cont’d) Strategic/Policy #1 – Likelihood 4 Impact 4 The SDHU may be at risk of not developing an effective Strategic Plan given the great uncertainty with health system transformation. Is the evaluation of the risk accurate? Does this risk fall into the Risk Tolerance/Appetite of the Board? Are there other controls that should be considered? Should additional time and resources be invested in future controls to reduce the risk? 23

4. “Code Red” Drill Down (cont’d) Equity #1 – Likelihood 5 Impact 5 The SDHU may be at risk of not effectively leveling up the health status with priority populations. Is the evaluation of the risk accurate? Does this risk fall into the Risk Tolerance/Appetite of the Board? Are there other controls that should be considered? Should additional time and resources be invested in future controls to reduce the risk? 24

5. Next Steps First step to systematically assess organizational risk How do we define success? What are we aiming for? 25

5. Next Steps (cont’d) June Board Meeting Fall 2016 and Beyond Briefing note and motion Direction to develop a Board-level risk management policy Board risk management policy and plan Mitigation process, evaluation and reporting plan Current risk management plan Staff risk management Healthy risk culture Program/project drill down 26

This presentation was prepared by staff at the Sudbury & District Health Unit. This resource may be reproduced, for educational purposes, on the condition that full credit is given to the Sudbury & District Health Unit. This resource may not be reproduced or used for revenue generation purposes. © Sudbury & District Health Unit, 2016 27