Management Response and Action Plan: Audit of Integrated Risk Management at Health Canada

Recommendation 1

The CFO should ensure that the new Risk Management Policy and related Guide:

• Clearly establish minimum expectations for branches regarding risk processes and associated risk management outputs;
• Establish and clarify the roles and responsibilities of CFOB with respect to functional authority over risk management practices across the Department, including monitoring, assessment, and reporting on practices and compliance with HC's Risk Management Policy;
• Define a process for a periodic review, assessment, and reporting on the status of HC risk management practices; and
• Ensure that risk management updates, including the results of CRP annual reviews, are incorporated as standing items on EC and DAC agendas on a regular basis.

Management response

Management agrees with the recommendation.

Recommendation 2

The CFO, in consultation with branch heads, should develop formal risk management procedures and tools that promote standardized branch-level risk management practices and outputs. To ensure that expectations are understood and activities are implemented consistently, the CFOB should collaborate with branch heads to:

• develop and communicate branch-level risk identification and assessment processes that identify key stakeholders, associated responsibilities, and timelines;
• develop and communicate standard risk categories to be considered in the identification process;
• require branch risk registers to include consideration and assessment of risks to operations, in addition to those in the CRP;
• ensure that branch risk registers are clearly linked to and inform the annual CRP review and update process;
• provide guidance on establishing risk tolerance levels and thresholds, and linking them to risk response and monitoring activities; and
• develop and implement training and awareness informed by results of the periodic assessments of departmental risk management practices.

Management response

Management agrees with the recommendation.

Recommendation 3

The CFO, in consultation with branch heads, should establish risk management monitoring and assessment processes at the departmental and branch levels to evaluate and demonstrate the effectiveness of risk management activities across the Department and to ensure that risks and their associated responses are periodically reviewed and updated. Elements that would support the development of such processes include identifying and reviewing the following:

• number of risks, whether they materialized, and if they were mitigated;
• changes to the nature and level of risks, and associated responses due to evolving circumstances;
• progress on implementing risk responses; and
• costs of risk mitigation measures.

Management response

Management agrees with the recommendation.