Management Response and Action Plan (MRAP) - Audit of Integrated Risk Management

December 2008

Help on accessing alternative formats, such as Portable Document Format (PDF), Microsoft Word and PowerPoint (PPT) files, can be obtained in the alternate format help section.

Audit of Integrated Risk Management

Recommendations	Management Response: (1) Accept (2) Accept with conditions (3) Reject	Planned Management Actions	Deliverables	Expected Completion Date	Accountability
Recommendation No. 1 It is recommended that the Chief Financial Officer establish a formal process for reporting on the progress of integrated risk management in the department and that they present, at least annually, the Corporate Risk Profile to the Senior Management Board for review, discussion and approval.	Accept	A. Consult with Branch Heads, planners, risk managers, IRM Network, and sub-committees of SMB to update and review risks and related risk assessment tool. B. PresentCRP with corporate risks and related tool for review and approval of SMB. C. Present theCRP to the DAC. D. See point A - below for IRM progress reporting.	I. 2008 Corporate Risk Profile	Dec. 11 2008	Chief Financial Officer DG-Planning and Corporate Management Practices Directorate (PCMD)
Recommendation No. 2 It is recommended that the Chief Financial Officer: i.) update the IRM Framework; and ii.) revise and expand the Corporate Risk Profile to include risks beyond functional support risks.	Accept	A. Review current IRM Framework, progress to date within Department, and recently updated direction on IRM from Central agencies (e.g., TBS). B. Consult with Branch Heads, planners, risk managers, IRM Network, and sub-committees of SMB to update and review IRM Framework and the IRM Network. C. Present IRM Framework and the IRM Network for review and approval of Senior Management Board and its risk related sub-committees (SMB-FEA and SMB-RM). D.  Present the IRM Framework and the IRM Network to the DAC. E.  See point A and B above for revisedCRP review and approval process	I. IRM considerations reflected in Terms of Reference of SMB and its sub-committees. II. Updated IRM Framework with governance structure, integration of processes, performance measures, and tools to promote and support IRM across Department. III. Updated IRM Network membership and terms of reference.	June 2009	Chief Financial Officer DG-Planning and Corporate Management Practices Directorate (PCMD)
Recommendation No. 3 It is recommended that the Chief Financial Officer work with corporate planners throughout the planning cycle so that departmental operational plans take into account the operational and strategic risks as identified in the Corporate Risk Profile, and that key departmental reporting documents, such as the Report on Plans and Priorities and the Departmental Performance Report discuss these risks and mitigating strategies.	Accept	A. Review and refine process for theCRP within Department’s integrated planning process. B. Consult with departmental leads for strategic and operational planning, as well as performance reporting.	I. CRP considerations identified and scheduled within Department’s Integrated Planning Process. II.  Upgraded templates and /or guidance documents to facilitate linking priorities, risks and mitigation strategies for each of the following: i) Fall Bilateral Meetings on Priorities with Branch Heads; ii) Departmental Operational Plans; iii) Report on Plans and Priorities; iv) Integrated Business Plan; v) Departmental Performance Report.	March 2009	Chief Financial Officer DG-Planning and Corporate Management Practices Directorate (PCMD)
Recommendation No. 4 It is recommended that the Chief Financial Officer develop strategies for informing Health Canada management on IRM developments, including learning events and sharing of information, tools and best practices.	Accept	A.  Review and update current IRM Internet website for Health Canada and public. B.  Development of IRM Intranet website for departmental managers and staff. C.  Promote piloting of TBS proposed tools to assess IRM capabilities, competencies and risk thresholds (tolerances) within Branches, Regions and Corporate Support areas.	I.  Updated departmental Internet site with IRM related information and contacts for public. II. Incorporate existing IRM database tools and references in new IRM Intranet site for internal managers and staff. III. Develop and/or promote training based on gaps identified with piloting of IRM tools.	June 2009	Chief Financial Officer DG-Planning and Corporate Management Practices Directorate (PCMD)