Audit of Business Continuity Management

1.1 Audit objective

The objective of this audit was to determine whether the Department had established an effective BCM Program to ensure continued availability of its critical services and related assets.

1.2 Scope

The scope of this audit included an assessment of the mandatory elements of a BCM Program as outlined in Appendix D of the TB Directive on Security Management and covered the period of the Department’s most recent BCM cycle.

1.3 Methodology

The audit used the following methodologies:

• Documentation review and analysis
• Interviews with management and staff
• Business Continuity Plan (BCP) Coordinator survey
• Review of a sample of BCM plans and arrangements

2.1 EMBC has established BCM guidance documents and tools that comply with TB Policy requirements

The Treasury Board Directive on Security Management outlines mandatory procedures for BCM. The audit found that the Department’s Operational Directive, supporting guidance, and templates are aligned with prescribed requirements. For example, the Directive clearly defines roles and responsibilities in the BCM process:

• EMBC is the program lead, responsible for functional guidance and direction as well as oversight and reporting of results
• Branch and regional coordinators are assigned critical roles in executing the BCM cycle from start to finish, including in the preparation, coordination, and testing of plans
• Assistant Deputy Ministers (ADM) of branches and regions have overall responsibility for BCM development and approval in support of ESDC’s critical services

2.2 Branches and regions responsible for critical services lack expertise and senior management support

EMBC has a qualified and experienced team with responsibilities for both BCM and Emergency Management (EM). However, in recent years EMBC has prioritized EM and BCM program modernization. Between 2020 and 2023, the National Emergency Operations Centre and Departmental Crisis Management Teams experienced an unprecedented rise in activity. Due to events such as COVID-19 and climate related disruptions, EMBC’s focus was on EM during this time. Additionally, implementation of EMAS began in June 2023. Consequently, EMBC has not met some BCM requirements including the provision of a specialized BCM training program to branches and regions. To address this shortcoming EMBC provided coaching and support to stakeholders throughout the last BCM cycle.

In general, branches that are accountable for critical services did not have proficient teams and structures to support BCM Program requirements. BCM structures varied, but most BCM coordinators were lacking in both expertise and awareness of their responsibilities. Additionally, senior management demonstrated a stronger awareness and emphasis on EM, often overlooking BCM requirements such as BCP testing.

The owners of critical services would improve program outcomes with strong and robust teams. In branches and regions where teams had BCM expertise and support from senior management, the quality of documents and activities supporting BCM was more likely to meet expectations.

2.3 ESDC's BCM Program is not operating as intended

ESDC conducted its most recent BCM cycle between April 2021 and January 2023. During this process, EMBC oversaw the development of Business Impact Analyses (BIA) and BCP for the Department's 23 critical services, while providing support and guidance to branches and regions. EMBC conducted some reviews of process completion, monitored timelines for the completion of BIAs and BCPs, and regularly engaged with stakeholders. However, a formal quality review or challenge function was not in place to confirm the quality, completeness, and regular maintenance of BCM documents and activities.

According to ESDC's Operational Directive, branch-level BCPs should be rolled up horizontally into Program Level BCPs. This initiative was not in place for ESDC's critical services and EMBC indicated their intention to relaunch this process in the next BCM cycle. EMBC is currently implementing EMAS which is a tool capable of enhancing collaboration and monitoring. Strengthening oversight and reporting of completeness and quality will be crucial to realize the benefits of EMAS in support of Program Level BCPs.

Testing and exercising of BCPs is a crucial part of a mature BCM Program. While the audit team sought evidence to verify ESDC's critical services were tested by their owners in the last 2 years, insufficient documentation was available. Over half of respondents to the audit team's survey of BCP coordinators indicated that they had never participated in a BCP test or exercise. Since testing results were neither monitored nor reported to ESDC's Executive Governance Committees, the audit team relied on the 2022 to 2023 Management Accountability Framework which outlined that only 30% of BCPs for ESDC's critical services were tested by their owners in the last 2 years. The EMBC team has mitigated this deficiency by ramping up departmental awareness and corporate exercises over the past year.

In addition, Playbooks were implemented to enhance the Department's readiness in response to specific events impacting the Department and Canadians, such as public service strikes and wildfires. While not a requirement under the current Directive, Playbooks represent a proactive approach to risk mitigation and complement the mandatory BCPs for critical services. They were first introduced in the fall of 2022 in preparation for the 2023 Public Service Alliance of Canada strike and all-hazard playbooks were implemented department-wide in the 2023 to 2024 fiscal year.

ESDC's challenges in meeting prescribed requirements for BCM impacted the quality and reliability of BCPs. Without adequate validation, testing, and maintenance of plans, ESDC faces an elevated continuity risk for its critical services.

2.4 EMBC is not effectively using its established governance committee structure for decision making and oversight

ESDC's BCM governance structure is outlined in the Department's Operational Directive and Strategic Emergency Management Plan. Portfolio Management Board (PMB) is the Department's primary decision-making body, supported by the Enterprise Management Committee (EMC) which has oversight and decision-making authority for BCM. The audit found that the Departmental Crisis Coordinator, in other words, the ADM of ISB, is not consistently engaging EMC in decision making nor for oversight. For instance, the ADM of ISB did not present the Department's critical services list to EMC for approval after the 2021 BIA exercise nor did it provide EMC with periodic updates on the status of the Department's compliance with BCM requirements for ESDC's critical services. Nonetheless, the critical services were approved by the Deputy Minister in February 2022.

Better use of governance committees for BCM oversight would improve accountability, quality, and completeness.