2005 Audit Recommendations  -  Status Tracking 
Document 3
Audit:  Management Control Framework (EMC Lead:  K.Kirkpatrick / Staff Lead:  various)  
  Audit Recommendation Management Response Comments  Budget Implications
2007 or Beyond		 Related Council Motions Status Update
    Audit Management Response Action Required Based on DCM Implementation Plan                    Management Timelines    (Q1- Q4) (Risks, issues regarding implementation, etc) ($$ if known)    
1i) That the Chief Corporate Planning and Performance Reporting (CCPPR) Officer assess the City Corporate Plan and process, and budgeting process for 2006, once completed, to identify lessons learned, and develop an action plan to address issues or outstanding items, including:

a) the planned introduction of performance measures against the key objectives within the City Corporate Plan.		 Management agrees with these recommendations in principle. Plans for a post mortem of the City Corporate Plan (CCP) and related activities were established earlier in 2005, with post mortem workshops scheduled for early in Q1 2006. One of the specific questions addressed will be the link between the corporate planning process, the long-range financial plan and the budgeting process. Recommendations for changes to be considered in the next version of the CCP arising from the post mortem will be reviewed and signed off by the Executive Management Committee (EMC) in Q1 2006 and taken into account in the next refresh of the CCP, which will take place in late 2006.

In addition, in parallel with the CCP post mortem, the Office of the Chief Corporate Services Officer will conduct as assessment of the budget process, as it does each year, and bring forward any suggested changes to Council.

Management agrees with the recommendation regarding the planned introduction of performance measures against the key objectives within the City Corporate Plan. Work on these measures has already begun and a report on the
proposed performance measurement and reporting
framework was submitted to Council in Q1 2006.		 Post mortems of the City Corporate Plan (CCP) and related activities were conducted in January 2006.  One of the specific questions addressed was the link between the corporate planning process, the long-range financial plan and the budgeting process.  

Q2 (June) - performance reporting on goals in Corporate plan.

Q3 (July) - approval of changes to integrated planning framework by CSEDC and Council.		     No Complete:  Recommendations for changes to the planning framework were reviewed & signed off by EMC in Q2 2006 and were included in the Term of Council Planning and Budget Process and Timetable report submitted to CSEDC and approved by CSEDC and Council in July.  The integrated planning framework will be further fine-tuned in the Spring of 2007 to take into account Council decisions about a planned priority setting session, requirements for the next update of the City Corporate Plan and changes regarding the LRFP discussed at Council.  Performance indicators for each of the goals identified in the City Corporate Plan have been established and we reported on these in the City's 2005 annual report, which was issued in June 2006.
1i)  b) the planned linking of the budget to the City Corporate Plan. Management will be linking the budget to the Corporate Plan as part of its Integrated Planning Framework. Following the next election, a “Term of Council” Plan will be developed and approved along with the next iteration of the City’s Long-Range Financial Plan. These will be the basis for multi-year budgeting and for the next version of the Human Resources Plan.

Management notes that capacity planning was included in the planning process and the plan. The planning process followed by Management specifically took capacity constraints into account. The feasibility of implementing each action item included in the CCP and Departmental Business Plans within the existing resource base was evaluated by the City department(s) involved. Where this was not possible, the additional resources required were highlighted and included in the costing of the plans that were submitted to Council. This is a simple, cost-effective approach to capacity assessment. If in future years Management sees that plans have been over committed, Management will re-assess the approach.		 IPF framework provides for link between CCP and LRFP, which will provide direction for budget preparation. Q3 (July) - approval of changes to integrated planning framework by CSEDC and Council.     No Complete:  IPF and Budget Process approved by CSEDC and Council in July 2006. LRFP was tabled the Fall of 2006.  Decision made to defer renewing the CCP until after the Council Priority Setting Session in the Spring of 2007.
1i) c) incorporating capacity planning in the planning process and the plan and, Revised Management Response as approved by CAWG on 17 April 2007:

The City is embarking on a strategic priority setting session starting in April.  Councillors will be setting the corporate priorities for the term of Council, which will become the City's Corporate Plan.  The priority setting session will be based on a number of factors, including the City's financial ability/sustainability to pay and the availability of resources within the organization to complete the work.   Once the session is over, the City will have to determine via an analysis if they require any additional resources and incorporate them as a budget pressure into the 2008 budget process.  As well, the Centres of Expertises (COEs) will continue to develop tools to aid with capacity planning within the COEs.  IT, CSPI and RPAM already have such tools in place.
We disagree with this observation.

N/A     No Capacity planning was included in the planning process and the CCP.  The planning process followed specifically took capacity constraints into account.  The feasibility of implementing each action item included in the CCP and DBPs within the existing resource base was evaluated by the City department(s) involved.  Where this was not possible, the additional resources required were highlighted and included in the costing of the plans that were submitted to Council.  This is a simple, cost-effective approach to capacity assessment.

Subject to further discussion between the Auditor General and the Council Audit Working Group.


April 17, 2007:  Discussed at CAWG and Management  Response was revised accordingly.
Original Management Response:

Management agrees with explicitly identifying key assumptions used in the development of the plan. This will be addressed through post mortem – see response above. This will be implemented as part of the CCP refresh that will take place in late 2006.

Regarding the recommendation that the CCPPR Officer investigate the opportunity to integrate the Corporate Services Priority setting tool, see response regarding capacity assessment above. As noted by the Auditor General, the Corporate Planning process was implemented recently and will evolve over time. Through mechanisms such as the post mortem we are taking a continuous improvement approach and will identify areas where the process can be improved.
1i) d) explicitly identifying key assumptions used in the development of the plan.     Q1 2007 (January) - anticipated date of approval of CCP by Council. Renewed CCP to be developed after Council Priority Setting Session in the Spring of 2007.  Anticipated date of approval by Council is Q3 2007.     No Complete.
Will be implemented as part of the CCP refresh that will take place in late 2006. Will be implemented as part of the CCP renewal by Q3 2007.
1ii) That the CCPPR Officer investigate the opportunity to integrate the Corporate Services priority setting tool more broadly within the corporate planning process.     N/A     No See response regarding capacity assessment above.  As noted by the Auditor General, the Corporate Planning process was implemented recently and will evolve over time.  Through mechanisms such as the post mortem we are taking a continuous improvement approach and will identify areas where the process can be improved. 
1iii) That the Director of Employee Services monitor and report on the timely and appropriate completion of Individual Contribution Agreements (ICA) across the City. Management agrees with the recommendation regarding monitoring and reporting on the timely completion of Individual Contribution Agreements across the City by the Director of Employee Services. As noted in the Auditor General’s report, the City just established its Corporate Planning Framework in 2005. In the first year, we developed the City Corporate Plan and Departmental Business Plans. In subsequent years these will cascade down throughout the organization and branch and unit workplans aligned with the CCP and DBPs will be prepared. At that point the link between ICA’s and business plans will be clearly demonstrated. For the time being the requirement to establish ICA’s for all Management staff remains, but these are based on management accountabilities and negotiated objectives. Management will continue to remind all Branch Management of their responsibility to complete ICA’s for their management staff. At the end of the performance cycle Management will report on the number of ICA’s completed as compared to the number of employees eligible for the performance pay program. This information will
be presented to the Executive Management
Committee in Q2 of 2006.		 As noted in the Auditor General’s report, the City just established its Corporate Planning Framework in 2005. In the first year, we developed the City Corporate Plan and Departmental Business Plans.  In subsequent years these will cascade down throughout the organization and branch and unit workplans aligned with the CCP and DBPs will be prepared.  At that point the link between ICA’s and business plans will be clearly demonstrated.  For the time being the requirement to establish ICA’s for all Management staff remains, but these are based on management accountabilities and negotiated objectives.  We will continue to remind all Branch Management of their responsibility to complete ICA’s for their management staff.  At the end of the performance cycle we will report on the number of ICA’s completed as compared to the number of employees eligible for the performance pay program.  This information will be presented to the Executive Management Committee in Q1 of 2007. Q1-07 At the outset of the next performance management cycle, Employee Services will give clear direction to departments to ensure they indicate whether ICAs have been completed when submitting performance ratings and pay recommendations. None No Complete. 
For the performance year 2005, a column was added to the MPE Merit Pay spreadsheet that requested managers indicate whether they had completed ICAs for their employees. A chart has been developed indicating the number of completed ICAs for each department/branch. This information will be forwarded to EMC during 2007 and will be repeated on a regular basis.
2 That the City Manager ensure there is a review to update the Centres of Expertise Service Level Agreements, including definition of performance levels, monitoring requirements and approach for identifying and resolving issues or disputes. Management agrees with this recommendation. A draft proposed process, addressing all of these elements, will be presented to Senior Management Team (SMT) at the January 2006 meeting. This project is a priority identified in the 2006 Corporate Services departmental business plan and will be included in the 2006 workplan of the Office of the Chief Corporate Services Officer. This project is a priority identified in the 2006 Corporate Services departmental business plan and will be included in the 2006 workplan of the Office of the Chief Corporate Services Officer. Q4 - 2006     No Sept 2007: This recommendation will be reviewed by the EMT in Q1,2008.

May 31, 2007: Due to the recent reorganizational changes, this recommendation will be reviewed by the Executive Director, Business Transformation Services.  Members of EMC and SMT continue to treat this as a significant issue and work on this project will be undertaken as part of transformational initiatives in the last two quarters of 2007.
The Chief Corporate Services Officer and the Members of EMC and SMT continue to treat this as a significant issue.  Work on this project has slowed down as a result of the accelerated 2007 Budget approval process as consideration has to be given to the availability of resources in CS and the availability of Directors. Therefore, the priority timetable will be revisited during Q1 07 and we will proceed to continue with work on this project as resources permit.
3 That the Chief Corporate Services Officer develop a formal financial management control framework that clearly defines financial management accountabilities, control objectives, risks and the related control processes/mechanisms that have been put in place to mitigate the risks.  The roles and responsibilities as they relate to shared services (in particular, the Financial Support Units) should link to those set out in the Service Level Agreements between Financial Services and client departments. Management agrees with the recommendation to develop an overall framework. If this framework is supposed to be broad and intended to describe general control objectives, levels of responsibility, overall control policies and philosophy, then this exercise is achievable in 2006, likely within existing resources. One specific issue that will be addressed, as part of the SLA updates noted in the response above, will be a clarification of the role of the Financial Support Units, so that services will be provided on a consistent basis and their role will be well understood Management will also establish parameters for review of transactions that will be consistently applied. The development of a financial control framework has not been initiated as the Auditor has undertaken an audit of the Financial Control Environment.  This second audit will undoubtedly provide more substance as to the nature of the control framework therefore the work has been put on hold until the completion of the second audit.  Completion in 2007   While the original response indicated that the framework could be developed with existing resources this no longer is possible therefore to undertake this work in 2007 will require one-time funding of $100,000 to hire a consultant to deal with this and whatever arises from the 2nd audit. No Sept 2007 - Management agrees that a financial management control framework is vital to the successful operation of any mature business entity. Financial Services branch has examined alternative approaches to the development of the framework, taking into consideration the potential scope of this exercise and the impact of the framework on the rest of the corporation, and is recommending the adoption of a more holistic approach involving representativess of all management levels. Best practice in this area requires an integrated approach involving the key elements of an effective internal control system.
i.e.  (1) Organizatinal Control Environment, (2)  Risk Assessment , (3) Control Activities, (4) Information and communication, and (5) Monitoring.  The completion of the framework is also predicated on the review of the roles and responsibilities of the Financial Support Units. These activities will  be addressed by the BPRP that is currently underway.
3               May 31, 2007:The development of a financial management framework will be completed in conjunction with the implementation of the recommendations of the 2006 Audit of the Financial Control Environment. The expected completion is Q2 2008.

Since the budget requirement was identified after the tabling of the original report, discussion and approval will be required of CAWG.
4 That the CCPR Officer introduce integrated risk management within the City, as part of the planning and performance management cycle.  This would include such activities as:

a) development of an integrated risk management policy,

b) development of tools and approaches for risk management, and

c) provision of risk management training.		 Although Management agrees with the Auditor General’s recommendation in principle, Management does not believe it would be practical to implement this recommendation at this point. The cost/benefit of implementing a full blown, organization-wide risk management initiative, as suggested by the Auditor General, is not clear, nor is it clear that this is a widely accepted best practice in municipal governance. Recent implementation of these types of programs in the private sector has been driven to a considerable extent by Sarbanes-Oxley requirements in the U.S.  To Management’s knowledge, in the few cases where Canadian municipalities have experimented with them, implementation has not been successful.

Management’s priority at this point, from a management control framework perspective, is on rolling out the planning framework and developing and implementing the performance measurement and reporting framework, throughout the organization over the next 2-3 years. Nonetheless, certain steps Management is taking to enhance the Corporate planning process, such as the presentation of a comprehensive
environmental scan, which will identify risks to be considered in
developing the City Corporate Plan and Departmental
Business plans, will address this issue.		 We do not believe it would be practical to implement this recommendation at this point. The cost/benefit of implementing a full blown, organization-wide risk management initiative, as suggested by the Auditor General, is not clear, nor is it clear that this is a widely accepted best practice in municipal governance.  To our knowledge, in the few cases where Canadian municipalities have experimented with them, implementation has not been successful. Our priority at this point, from a management control framework perspective, is on rolling out the planning framework and developing and implementing the performance measurement and reporting framework, throughout the organization over the next 2-3 years. N/A   $425K WAS NEVER ADDRESSED IN THE ORIGNIAL REPORT - Revised financial implication coming forward in revised business case No Sept 2007 - The required funding for 2008 has been submitted as a budget pressure.  In the meantime, risk management approaches are being built in to the conceptual design which has begun for the branch service review process.
Subject to further discussion between the Auditor General and the Council Audit Working Group. A business case for the potential implementation of an integrated risk management framework was completed in January 2007.  Staff recommendation remains deferring implementation of such a framework to focus on other priorities. CAWG considered the business case at its meeting on January 29th and provided direction.

May 31, 2007 - agreed to with action plan

CPPRO will undertake the following to address the AG recommendation:
i) modify the existing risk management policy or develop a new Corporate integrated risk management policy by 2008;
4 Regarding the development of an integrated risk management policy management, Management believes that the Auditor General’s observations in this area should take into account that the City has a risk management policy, which was approved by Council in 2001, confirms the City’s commitment to sound risk management processes. Some of the specific measures that Corporate Services has taken to explicitly address risks in different areas are outlined in this policy. For example, risk management principles are explicitly applied in investment decisions, in decisions regarding insurance coverage and in providing and maintaining safe conditions in the workplace. In addition, risk management processes are also applied in other key areas. The Emergency Measures Unit has identified catastrophic risks that could impact the City and has developed a program/plan to address them. Moreover, on an ongoing basis, Public Works staff perform construction/maintenance project risk assessments and procedures have been adopted by the City to ensure that risks are reasonably transferred through the tender, contract and agreement process. Both Real Property Asset Management and Public Works and
Services have adopted Comprehensive Asset Management
Strategies that have been approved by City Council and that
include inventories, gap analyses and strategies for
decommissioning and rehabilitating infrastructure
reaching the end of its lifecycle.
 Nonetheless, certain steps we are taking to enhance the Corporate planning process, such as the presentation of a comprehensive environmental scan, which will identify risks to be considered in developing the City Corporate Plan and Departmental Business plans, will address this issue.  We have also developed an estimate of the cost involved in implementing an
integrated risk framework on a
Corporate-wide basis and will include
this activity for consideration by Council in the 2007 budget submission. 		       ii) introduce into its guidance for the preparation of branch business plans, a section that outlines the potential risks to the achievement of the branch objectives;

iii) develop a template that can be used to capture the 3-5 most significant risks for each branch & how those risks are addressed - this will be integrated with the branch business plan templates & will be made available in 2008 for the 2009 business planning cycle;

& iv) develop a course to be offered in the latter part of 2008 on risk management relating to the application of these concepts & the use of the template. 
            Yes   This course will be offered to management staff involved in the the evaluation of risk as part of the business planning process.  We estimate the cost of policy development, training material development & delivery is $150K, which we will include as a budget pressure for 2008.
5 That the Chief Corporate Services Officer complete plans for reviewing and updating corporate administrative policies and developing a new corporate policy framework, which should include a single point of access, common look and feel, the consolidation of by-laws, and defining a timetable for when the process will be completed.  Departments should monitor their plans to ensure that the harmonization of operational policies and procedures are completed on a timely basis. Management agrees. Plans are currently being developed within Corporate Administrative Policy and Performance Management (CAPPM) for reviewing and updating Corporate Administrative Policies and developing a new corporate policy framework. This framework will be completed and presented to EMC for approval in Q4 2006.

In defining a timetable for when the overall policy update process will be completed, consideration has to be given to availability of resources. The same resources to complete work outlined in 4.2 COE, will be deployed to complete this work. The Management Advisory Committee chaired by the Chief Corporate Services Officer will prioritize the updating of policies.		 Plans are currently being developed within CAPPM for reviewing and updating Corporate Administrative Policies and developing a new corporate policy framework. This framework will be completed and presented to EMC for approval in 2006. The Management Advisory Committee chaired by the Chief Corporate Services Officer will prioritize the updating of policies.       No Sept 2007 -
The following activities have been completed:
1.  The Corporate Administrative Policy structure has been reviewed and updated and is now available electronically to all staff on Ozone, the City's Intranet.
2.  This forms the single point of access for corporate administrative policies and procedures, providing a common look and feel with easy to search capability.
3.  Consolidation of by-laws completed and also easily accessible to all staff on Ozone. 

With recent reorganizational changes and direction, the Executive Director of Business Transformation Services will review delegated authority for the approval of policies formerly held by the Chief Corporate Services Officer.  Once completed, the framework will be updated as required.
    By-laws are now consolidated on the City’s Intranet, work being completed by these same resources.

With regard to departments monitoring of their plans to ensure timely harmonization of operational policies and procedures, management agrees but no specific changes or initiatives are required in response to this recommendation. As noted by the Auditor General, this responsibility rests with each department. CAPPM will work with each department regarding Corporate Administrative Policy to share experience, tools and approaches, however operational policies and procedures at the sub-corporate level (Departmental or Branch) are the responsibility of those policy owners. The CAPPM will monitor the implementation of the corporate framework and report on an annual basis to the Chief Corporate Services Officer.		           May 31, 2007: Anticipate the framework will go forward to MAC and EMC in Q3 2007.  With recent reorganizational changes and direction, this recommendation will be reviewed by the Executive Director and CAPPM of Business Transformation Services and will be enhanced with additional efforts to strengthen the quality, monitoring and use of corporate administrative polices across the corporation.  This work will be undertaken as part of a more comprehensive review of accountabilities, as one part of the transformational initiatives in the last two quarters of 2007.

Anticipate the framework will go forward to MAC and EMC in Q2 2007.
6 That the Chief Information Officer, supported by the service departments and administrative branches, follow through on plans to develop a City-wide information management/information technology strategy to support the City Corporate Plan, within a defined timeline. Management agrees with this recommendation. ITS initiated the development of a new IT Strategic Plan in the fall of 2004, replacing the original plan approved in 2000 by the Ottawa Transition Board. However, the new Plan was put on hold in 2005 following announcement of the City Corporate Plan and Departmental Business Planning exercise. ITS will complete the new IT Strategic Plan to support the City Corporate Plan by Q1, 2006. ITS initiated the development of a new IT Strategic Plan in the Fall of 2004, replacing the original plan approved in 2000 by the Ottawa Transition Board.  However, the new Plan was put on hold in 2005 following announcement of the City Corporate Plan and Departmental Business Planning exercise.  The City has already begun developing a new IT Strategic Plan that will support the City Corporate Plan.  The final draft of the plan is now complete and is ready for review by the Chief Corporate Services Officer. Q3-06   No budget implications outside of what is already in place in existing LRFP or capital budget. No Complete