1. Board of Health Workshop
Risk Management
Board of Health Workshop
May 27, 2016
Dr. Penny Sutcliffe, Medical Officer of Heath/Chief Executive Officer
Sandra Laclé, Acting Director, Corporate Services
Krista Galic, Specialist, Quality and Monitoring 1

2. 1. Context and Process Ontario Public Health Organizational Standards
3.1 Board of health stewardship
4.2 Board of health member orientation and training
- Risk Management oversight
6.2 Risk management
- Delegated to senior staff
Ontario Government audits of health units have highlighted risk management
Audit recommendation to adopt a Risk Management framework
6.2 The board of health shall ensure that the administration monitors and responds to emerging issues and potential threats to the organization, from both internal and external sources, in a timely and effective manner. Risk management is expected to include, but is not limited to: financial risks, HR succession and surge capacity planning, operational risks, and legal issues.
Risk Management was identified as an area that needed improvement in some of the PHUs that were audited by the Health Audit Services Team (HAST).  One of the audited health units reached out to HAST for help in developing risk management practices.  The ministry agreed that HAST could provide this advisory service.  Given that other PHUs could benefit from this help, alPHa became  involved to promote and coordinate risk management training across PHUs. In the past 12 months, Corinne has presented at 2 alPH sessions and has helped 2 PHUs directly (Kingston and Sudbury).  Given the impossibility of helping all PHUs individually, ALPHA is coordinating a working group of volunteers from a number of PHUs to help implement RM across all 36 units.   

3. 1. Context and Process (cont’d)
SDHU review of Algoma Public Health Assessor’s report
SDHU May 5, 2016 board governance training
alPHa support:
Promoting and coordinating risk management training
Provincial workshops November 5, 2015 and February 24, 2016
alPHa Provincial Risk Management Working Group

4. 1. Context and Process (cont’d)
SDHU Actions to Date:
Participation in alPHa Working Group
April – Senior Management workshop
May 3 – Senior Management workshop
May 6 – Board Executive Committee
May 27 – Board Risk Management workshop

5. 2. Identified Organizational Risks…5

6. 2. …and Risk Mapping 24 risks identified: 14 high risk In 9 categories
7 medium risk
In 6 categories
3 low risk
In 3 categories 6

7. 2. Identified Organizational Risks and Risk Mapping (cont’d)
Financial: Budget pressures, financial forecasting, fraud
Governance/Organizational: Board competencies, consideration of changes in statutes, policies and directions
Human Resources: Succession and business continuity planning, staff competencies, staff engagement, staff working offsite
Knowledge/Information: Incomplete
Technology: Network outage, technology plan
Legal/Compliance: Statutes and regulations
Service Delivery/Operational: Services are value add
Environment: Hazards
Political: Health system transformation
Stakeholder/Public Perception: Indigenous relationships, managing expectations
Strategic/Policy: Strategic plan
Security: Network security
Privacy: Internal controls
Equity: Priority populations 7

8. 3. Reflection Overall Gaps and Priorities:
Are there risks you were expecting to see that are not on the list?
Are there risks on the list that should not be included?
Other comments or questions?

9. 3. Reflection Overall (cont’d)
Risk Appetite: The amount and type of risk that the SDHU is willing to take in order to meet strategic objectives.
Scale
Zero risk
Not willing to accept risk (threats or opportunities)
Low risk
Unwilling to accept even a very limited amount of threat (downside risk) in most circumstances unless the opportunities (upside risk) exceed the threat
Modest risk
Willing to accept some threats in certain circumstances that include opportunity
Moderate risk
Willing to accept some threats commensurate with the potential opportunity
High risk
Willing to accept risk - a high level of inherent downside risk (threats) in circumstances where there are significant or important opportunities
And Risk Tolerance 9

10. 4. “Code Red” Drill Down Questions for each “code red” risk:
Is the evaluation of the risk accurate?
Does this risk fall into the Risk Tolerance/Appetite of the Board?
Are there other controls that should be considered?
Should additional time and resources be invested in future controls to reduce the risk?
Risk appetite filter overall and for each “code red” risk:
After current controls (mitigation strategies).
Are there other controls that should be considered if the Board feels that the risk levels exceed their appetite? 10

11. 4. “Code Red” Drill Down (cont’d)
Financial #1 – Likelihood 5 Impact 5
The SDHU may be at risk as budget pressures are expected to increase over the next several years.
Is the evaluation of the risk accurate?
Does this risk fall into the Risk Tolerance/Appetite of the Board?
Are there other controls that should be considered?
Should additional time and resources be invested in future controls to reduce the risk? 11

12. 4. “Code Red” Drill Down (cont’d)
Financial #2 – Likelihood 4 Impact 4
The SDHU may be at risk of financial forecasting not providing sufficient information for decision making resulting in suboptimal financial management within year.
Is the evaluation of the risk accurate?
Does this risk fall into the Risk Tolerance/Appetite of the Board?
Are there other controls that should be considered?
Should additional time and resources be invested in future controls to reduce the risk? 12

13. 4. “Code Red” Drill Down (cont’d)
Governance #1 – Likelihood 4 Impact 5
The SDHU may be at risk as BoH members, individually or collectively, may not have the required competencies for effective Board Governance.
Is the evaluation of the risk accurate?
Does this risk fall into the Risk Tolerance/Appetite of the Board?
Are there other controls that should be considered?
Should additional time and resources be invested in future controls to reduce the risk? 13

14. 4. “Code Red” Drill Down (cont’d)
Governance #2 – Likelihood 4 Impact 3
The SDHU may be at risk of not systematically ensuring that the governance implications of changes in statutes, policies, and directions have been considered.
Is the evaluation of the risk accurate?
Does this risk fall into the Risk Tolerance/Appetite of the Board?
Are there other controls that should be considered?
Should additional time and resources be invested in future controls to reduce the risk? 14

15. 4. “Code Red” Drill Down (cont’d)
Human Resources #1 – Likelihood 5 Impact 5
The SDHU may be at risk as a result of an insufficient investment in succession and business continuity planning.
Is the evaluation of the risk accurate?
Does this risk fall into the Risk Tolerance/Appetite of the Board?
Are there other controls that should be considered?
Should additional time and resources be invested in future controls to reduce the risk? 15

16. 4. “Code Red” Drill Down (cont’d)
Human Resources #2 – Likelihood 4 Impact 4
The SDHU may be at risk as staff may not have all of the necessary competencies to meet evolving Public Health needs.
Is the evaluation of the risk accurate?
Does this risk fall into the Risk Tolerance/Appetite of the Board?
Are there other controls that should be considered?
Should additional time and resources be invested in future controls to reduce the risk? 16

17. 4. “Code Red” Drill Down (cont’d)
Technology #1 – Likelihood 3 Impact 5
The SDHU may be at risk of a network outage.
Is the evaluation of the risk accurate?
Does this risk fall into the Risk Tolerance/Appetite of the Board?
Are there other controls that should be considered?
Should additional time and resources be invested in future controls to reduce the risk? 17

18. 4. “Code Red” Drill Down (cont’d)
Technology #2 – Likelihood 4 Impact 3
The SDHU may be at risk of not having a comprehensive and future oriented information technology plan and planning processes.
Is the evaluation of the risk accurate?
Does this risk fall into the Risk Tolerance/Appetite of the Board?
Are there other controls that should be considered?
Should additional time and resources be invested in future controls to reduce the risk? 18

19. 4. “Code Red” Drill Down (cont’d)
Service Delivery/Operational #1 – Likelihood 3 Impact 4
The SDHU may be at risk of our service not being perceived as a value add to our clients.
Is the evaluation of the risk accurate?
Does this risk fall into the Risk Tolerance/Appetite of the Board?
Are there other controls that should be considered?
Should additional time and resources be invested in future controls to reduce the risk? 19

20. 4. “Code Red” Drill Down (cont’d)
Political #1 – Likelihood 5 Impact 5
The SDHU may be at risk of significant disruptions and high opportunity costs related to health system transformation.
Is the evaluation of the risk accurate?
Does this risk fall into the Risk Tolerance/Appetite of the Board?
Are there other controls that should be considered?
Should additional time and resources be invested in future controls to reduce the risk? 20

21. 4. “Code Red” Drill Down (cont’d)
Stakeholder/Public Perception #1 – Likelihood 5 Impact 5
The SDHU may be at risk of poorly defined relationships with Indigenous communities.
Is the evaluation of the risk accurate?
Does this risk fall into the Risk Tolerance/Appetite of the Board?
Are there other controls that should be considered?
Should additional time and resources be invested in future controls to reduce the risk? 21

22. 4. “Code Red” Drill Down (cont’d)
Stakeholder/Public Perception #2 – Likelihood 5 Impact 4
The SDHU may be at risk of uncertainty around managing the expectations of the public, ministries, stakeholders, and/or the media to prevent disruption of service or criticism of Public Health and a negative public image.
Is the evaluation of the risk accurate?
Does this risk fall into the Risk Tolerance/Appetite of the Board?
Are there other controls that should be considered?
Should additional time and resources be invested in future controls to reduce the risk? 22

23. 4. “Code Red” Drill Down (cont’d)
Strategic/Policy #1 – Likelihood 4 Impact 4
The SDHU may be at risk of not developing an effective Strategic Plan given the great uncertainty with health system transformation.
Is the evaluation of the risk accurate?
Does this risk fall into the Risk Tolerance/Appetite of the Board?
Are there other controls that should be considered?
Should additional time and resources be invested in future controls to reduce the risk? 23

24. 4. “Code Red” Drill Down (cont’d)
Equity #1 – Likelihood 5 Impact 5
The SDHU may be at risk of not effectively leveling up the health status with priority populations.
Is the evaluation of the risk accurate?
Does this risk fall into the Risk Tolerance/Appetite of the Board?
Are there other controls that should be considered?
Should additional time and resources be invested in future controls to reduce the risk? 24

25. 5. Next Steps First step to systematically assess organizational risk
How do we define success?
What are we aiming for? 25

26. 5. Next Steps (cont’d) June Board Meeting Fall 2016 and Beyond
Briefing note and motion
Direction to develop a Board-level risk management policy
Board risk management policy and plan
Mitigation process, evaluation and reporting plan
Current risk management plan
Staff risk management
Healthy risk culture
Program/project drill down 26

27. This presentation was prepared by staff at the Sudbury & District Health Unit. This resource may be reproduced, for educational purposes, on the condition that full credit is given to the Sudbury & District Health Unit. This resource may not be reproduced or used for revenue generation purposes.
© Sudbury & District Health Unit, 2016 27