Presenting and Understanding Risk Management

Transcription

1 The best source of information and training on Aboriginal finance and management The Aboriginal Finance and Management Capacity Development Series Presenting and Understanding Risk Management A Practical Guide for Aboriginal Management

2 2

3 The Aboriginal Finance and Management Capacity Development Series The best source of information and training on Aboriginal finance and management The Aboriginal Finance and Management Capacity Development Series Presenting and Understanding Risk Management A Practical Guide for Aboriginal Management Table of Contents Introduction I Risk Management Overview II Types of Risks III Risk Management Defined IV Principles of Risk Management V Risk Management Tools VI Case Study VII Glossary of Terms

4 The Aboriginal Finance and Management Capacity Development Series Introduction Constant change and development is the norm in First Nations communities. This scenario brings with it an increased element of risk. First Nation communities and organizations are assuming increased responsibilities in a number of areas. This environment suggests there is a real need to proactively manage potential risk rather than continue to place their reliance solely on insurers. This paper reviews the types of risks First Nation communities may be exposed to, and proposes ways in which these risks can be managed to enhance the overall efficiency of community administration. 2 Introduction

5 Risk Management A Practical Guide for Aboriginal Management I Risk Management Overview Today, constant change and development in First Nations communities is a given. This fact exposes communities to increased risk. First Nation communities and organizations are assuming more and more responsibility in a number of areas including; Social development Housing Taxation Business development Child and Family services Land Management All of this increased responsibility brings about a need to proactively manage potential risk. Community members want assurances that Chief and Council are looking out for their best interests and are prepared in the event of an emergency. Putting into place an effective risk management system is common sense for First Nations and other organizations that wish to grow and prosper. In fact, good risk management enhances the capacity of the community to take on new challenges. Risk management ensures the continuity of government operations and the maintenance of services for the benefit of community members. Risk management can also be cost-effective, particularly when an organization assesses their risks properly and determines the most economical way to manage them. In today s environment, risk management is an important component of an effective administration. Risk Management Overview 3

6 The Aboriginal Finance and Management Capacity Development Series II Types of Risks First Nation communities and organizations, due to their complexity, are exposed to a great deal of potential risks, likely more than they actually realize. Given the level of responsibility that First Nation administrations assume on behalf of their community members (community assets and programs), this is not surprising. The following is a list of the types of risk aboriginal financial officers should be aware of; Risk Type Financial Risks related to Service Delivery Business Risks Asset Risks Legal Liability Credit Risks Environmental Risks Health Risks Example: loss of funding due to non-compliance or lack of reporting Cash flow risks Interest Rate exposure Internal control issues Aboriginal Development Corporation s exposure to various risks as a result of business activities Trade Risks Resource related (over reliance on resource-based industries, including forestry and fishing) Need to protect community buildings and equipment and infrastructure from various physical risks including; flooding, fire and theft Could include threats from lawsuits from former employees (wrongful dismissal) or individuals injured on community property Risks associated with First Nations Housing Loan Guarantees Business Risks from loans taken out by your First Nation Non-compliance with federal regulations and legislation relating to environmental issues Health and public safety of community members Housing mould issues III Risk Management Defined Risk Management has been defined as the disciplined approach to evaluating and managing the uncertainties the enterprise faces as it creates value. 1 It is a logical step-by-step process to protect, and consequently minimize risks to the community s property, interests and employees. As noted earlier, risk management has now become a necessary part of sound administrative management. 1 KPMG Enterprise Risk Management 4 Types of Risks

7 Risk Management A Practical Guide for Aboriginal Management IV Principles of Risk Management Risk management is really an ongoing process, with no fixed start or end date. As communities grow and evolve the level of risk changes. It is important that risk management is identified as an important element of community governance and administration, and that a process is established and followed that continually monitors and assesses potential community risks. There are 3 main elements to Risk Management; 1 Risk Identification and Assessment Process of considering and identifying possible risks to the administration and community Understanding and documenting these risks Identifying the level of the risk, and what potential impact it might have on the community (i.e. possible financial impact) 2 Risk Mitigation Includes Risk Management Plans and Policies Internal Control Measures (Accounting) Institution of measures to monitor and measure potential risks Keep the process simple Involve supervisors and directors in the process 3 Risk Communication Need to communicate the value of risk management Use real-life examples Make the connection to daily operations and responsibilities Provide guidance and support When providing information, keep it easy to understand Risk Management Process The following diagram illustrates the Risk Management process, taking into account the above noted elements. You will notice that this is an ongoing process. Different activities will occur depending on whether you are in a period that is; Before an incident occurs This is where the ongoing planning process occurs, including ongoing risk identification and assessment, as well as mitigation activities such as planning and policy development During an incident relates to risk containment activities and the deployment of emergency plans which have been previously developed After an incident dealing with the fallout of an incident, including investigating the cause and impact, dealing with insurance claims and ultimately looking at adjustments to preventative measures Principles of Risk Management 5

8 The Aboriginal Finance and Management Capacity Development Series Figure 1 Risk Identification & Assessment Operations and Assets Perils (Fire,Theft) Risk Factors Types of Risk Before an Incident Occurs (Ongoing Planning Process) Risk Mitigation Risk Planning Risk Management Plans Risk Policies & Procedures Budgets Risk Containment Deployment of Emergency Plans During an Incident Risk Compensation & Recovery Incident Investigation Insurance Claims Asset Replacement Adjustment of preventative measures After an Incident 6 Principles of Risk Management

9 Risk Management A Practical Guide for Aboriginal Management V Risk Management Tools The most important Risk Management Tool is ensuring that risk management issues are incorporated into the ongoing management and strategy of the organization. A risk management strategy should be developed in the same way a community develops an economic development strategy. It is also important the Chief and Council understand the importance and use of a Risk Management strategy and plan. As mentioned earlier, the Chief and Council are ultimately responsible for ensuring that the community s interests and assets are protected. It naturally flows that they should ensure the proper measures and mechanisms are in place to assist in risk management. This begins by incorporating risk management components into the community s strategic plan. Community leaders should consider the following questions: i Do we have adequate measures and controls in place to ensure our community objectives are not threatened? ii Do we have enough information to develop and implement a community risk management system? iii Do we have the resources required to implement a risk management system? With these questions in mind, community leaders can ensure that risk management is addressed in their governance policies and regulations. Specific policies and procedures should be established to address Risk Management. As noted earlier, it is foolhardy to rely upon insurance alone to protect you against risk. Communities should proactively address all potential risks through the development and implementation of a Community Risk Management Plan. The purpose of a risk management plan is to identify all potential risks to the community, and identify how each will be managed. This plan can be prepared by community staff, but it is ultimately the responsibility of community leadership, Chief and Council. The following is an outline of a plan that can be utilized as a guide to assist you in the development of your own Risk Management Plan. Pro-forma Risk Management Plan 1 Executive Summary 2 Risk Background a Describe the possible risk b Key indicators 3 Risk Assessment a Estimate the probability of the risk occurring b Understand the potential cost of the risk c Understand the cost of controlling the risk fully 4 Risk Ownership a Identify what area of the organization is responsible for managing the risk 5 Risk Management Approach a Goals and Description of the approach b Accomplishments c Methodology to control the risk d Schedules, Budgets The risk management plan begins by identifying all of the potential risks, some examples of which were identified earlier. The next step in your risk management plan is to assess and categorize the impact of each of the potential risks. This is a critical exercise in the management of community risks. Risk ownership is key. It is important to identify the department or individual within your administration responsible for ongoing monitoring and identification of potential risks. Let s look at an example - the remote community s diesel generator system. Most likely, the administration s operations and maintenance department is responsible for maintaining the system to ensure that it is running properly. It would be prudent to ensure that the responsibility for risk management is incorporated into their job description and performance review system. Risk Management Tools 7

10 The Aboriginal Finance and Management Capacity Development Series The last part of the plan describes the management approach for each identified risk. As noted earlier, not all risks will be treated the same they may require different control methodologies. It is important to ensure that an optimal amount of resources are utilized to manage potential risk - match the resources you apply to managing the risk to the potential cost of the risk itself. The following Risk Matrix is a template used by the federal government it can be used to assess and categorize risk situations. For example, issues that have a potential severe impact with a high likelihood of occurring would obviously require more attention and resources than those with a minor potential impact and a low likelihood of occurring. It is important that the risk measurement exercise be carried out and incorporated into the community s risk management plan. After all of the risks have been identified and their impacts measured, the community is well positioned to develop an approach for monitoring potential risk. The following two charts are used by Treasury Board Canada to measure and categorize risk situations. This methodology is part of their Risk Management Policy. Qualitative Measures of impact (60 months of time) Level Impact Damage Liability Operational Effects Reputation Loss 3 SEVERE Law suit against the Crown Loss of asset(s) >$100k Disruption of program activities for >30 days Significant diversion of staff to address comments and issues Significant loss of partner support Significant loss of stakeholder trust 2 MODERATE Loss of asset(s) >$10k-100k Disruption of program activities for days Some diversion of staff to address comments and issues Some loss of partner support Some loss of stakeholder trust Negative media attention 1 MINOR Loss of asset(s) <$10k Disruption of program activities for <10 days Setbacks in building partner support and stakeholder trust Some unfavourable media attention Qualitative Measures of Likelihood Level 3 2 Likelihood HIGH MEDIUM Damage Liability The event is expected to occur in most circumstances The event should occur at sometime 1 LOW The event occuring is unlikely 8 Risk Management Tools

11 Risk Management A Practical Guide for Aboriginal Management One method that can be employed as part of a community s Risk Management Approach is the development of Risk Management Policies. It is useful to establish a broad Risk Management policy that captures leadership s responsibility to protect the community s interests and assets (see example), as well as separate policies to address specific issues (e.g. internal control policies). Framework for a Risk Management Policy Component Policy Objective Application Requirements Responsibility Monitoring Description Rationale and purpose for the policy and how it relates to the community s overall objective. The departments and employee positions that the policy applies to. What is required with regard to risk management by those responsible. Should include specific tasks to; Identify and assess risks Manage and minimize risks Contain risks as they occur Risk reporting Who is responsible for the specific risks Level of detail required, timing, and responsibility for reporting risk management issues How to Develop a Risk Management Structure It is unlikely that your First Nation community or organization will have the resources to commit to a full-time risk manager. An alternative is to ensure that all employees have a risk management component to their responsibilities that is included in their job description. For example, Funding/Financial Risk was earlier identified. It should be the responsibility of all accounting staff to ensure that prescribed internal controls and financial policies are followed and understood. Overall, senior management should ensure that the following elements are in place in the organization to ensure that risks are properly identified and managed. Risk Management Structure Internal Controls Policies Plans Budgets Tools Proper Documentation Contracts Risk Assessment Tools 3rd Parties Insurance Resources Staff Resources Proper, Regular Training Financial Resources Risk Management Tools 9

12 The Aboriginal Finance and Management Capacity Development Series VII Risk Management Case Study The following is a fictional representation of a First Nation situation, prepared to present the Risk Management concepts reviewed in this paper. The situation Seymour Wilson, newly elected councillor of the Holden Creek First Nation, was on his way back home after a long day working alongside community members filling and stacking sandbags. It was an unusually wet spring, and the community s namesake was swelling its banks. Seymour got to thinking about the potential damage and impact to the community should a flood actually occur community buildings and equipment could be damaged, and should the road be damaged, community members could find themselves isolated. How much damage could take place? Does our community have a plan in case of a flood? What could damage to the community s assets cost? All of these questions ran through Seymour s mind as he made a mental note to bring these matters up at the next council meeting. Communication Seymour s concerns were well received by his fellow councillor s and the band administrator at the council meeting. Seymour noted that the council had recently approved the development of economic development strategy, had recently implemented a financial management policy and bylaw, but the community did not yet have a formal Risk Management Policy or Strategy in place. Council had lengthy discussion on the different types of situations that could occur and ultimately harm the community. Initially, the focus was on physical situations such as risks of fire and flood, but as they focused on the areas of greatest importance to the community, discussion was widened to include administrative matters. What if we lost our INAC funding? Seymour asked. Although the community had begun to make positive financial improvements, they were still financially dependent on transfers from INAC. The Band Administrator was asked to take the list they had compiled on the flipcharts and give some thought to how the situation might best be addressed. Taking action Two weeks later, at the next council meeting, the administrator presented her findings and her recommendations. She had taken the list prepared at the previous meeting and had grouped the potential risks into the following categories: Financial and Administrative Risks Health Risks Asset Risks (Buildings and Equipment) Physical Risks (Fire, Flood) She took the opportunity to take the project to an even higher level. She advised council that she had recently read an interesting and well-prepared AFOA document on Risk Management, and as a result, she planned to develop a Risk Management Plan and incorporate risk management issues into each of her department manager s job descriptions. For each potential risk that was identified, she told council she was going to measure the potential cost of that risk, and the likelihood of it occurring. She had started this process and had already determined that more insurance was required in a couple of instances and that more staff training to mitigate risk was necessary in another area. Conclusion Everyone at the meeting felt that great steps had been taken to ensure the safety of the community - they were well on their way to implementing a full Risk Management Plan. Stepping out into the cool night air, Seymour began to make his way home, confident in the knowledge that he had made a significant contribution to his community. 10 Risk Management Case Study

13 Risk Management A Practical Guide for Aboriginal Management VI Glossary of Terms Cash Flow Risk Risk to your organization to meet your financial obligations - could be the result of not meeting program or agreement obligations and having your funding suspended Housing Loan Guarantees Financial guarantee provided by the First Nation relating to community or community member on-reserve housing projects Interest Rate Exposure Risks associated with outstanding loans (either term or operating) and rising interest rates, causing higher financing costs, impacting your cash flow Internal Controls From an accounting perspective, these are the policies and guidelines established to ensure that the community s financial resources are properly managed and accounted for Legal Liability Liability under the law as opposed to liability arising from contracts or agreements. In insurance, it is most often used to refer to the liability that an individual has if he or she should negligently injure another party. For example, an owner of an automobile may be held legally liable if he or she is negligent in the operation of the automobile and injures another person or damages another person s property as a result of that negligence Risk Containment The process of addressing an ongoing risk issue, such as damage to community assets, to minimize the amount or degree of damage Risk Assessment Process of identifying the possible risks to the administration and community - involves having these risks understood and documented Risk Mitigation The measures you have in place to monitor and measure the potential risks to the community - includes Risk Management Plans and Policies - could also include internal control measures (accounting) Risk Management Disciplined approach to evaluating and managing the uncertainties the enterprise faces as it creates value. Is a logical step-by-step process to protect, and consequently minimize risks to the community s property, interests and employees Glossary of Terms 11

14

15

16