Welcome and Introduction
alPHa executive director Linda Stewart welcomed attendees, noting that 24 boards of health were represented today. This skill-building workshop will help participants –board of health members and senior health unit staff – explore risk management from the governance perspective and learn from the case studies of Algoma and KFL&A Public Health, both of which have been assessed by the Ministry for different reasons. Attendees will also an opportunity to self-assess their own health unit’s level of risk management.
Corporate Governance and Risk – Graham Scott, Chair, Institute for Research in Public Policy, Canada Health Infoway / Algoma Public Health Assessor
Mr. Scott began his presentation with the qualifier that good governance is not easy; it is hard work. Nonetheless, all public health units should strive for good governance. This includes, among other things, actively engaging in risk management. Risk management is the systematic approach to setting an organization’s best course of action under uncertainty by identifying, assessing, understanding, acting on, and communicating risk issues. A risk is the chance of something happening that will have an impact on the achievement of organizational objectives. Unlike the Health Protection and Promotion Act, the Ontario Public Health Standards (OPHS) and Organizational Standards explicitly state the governance requirements for health units and their boards. The OPHS references the following fiduciary duties of the board of health: care, good faith and loyalty. (Not coincidentally, these duties form the foundation of the Corporations Act.) That said, it’s helpful to know what bad governance looks like. An example of this is illustrated by the former Muskoka Parry Sound board of health whose members took it upon themselves to examine the human resource records of the health unit when they had no business doing so.
Fundamentally, when it comes to corporate governance:
- The Board of Health (‘the board’) is responsible for providing policy and oversight – Once policies are set, the board monitors to see if these are carried out effectively. To ensure quality performance, the board must ask questions.
- The Medical Officer of Health (MOH) and management are responsible for operations – Senior management gives the board information and support which is then used as the basis for determining the policy agenda. There is no role in Operations for the board of health.
- The CEO is the only employee of the board – The MOH / CEO is responsible for the success or failure of the operations of the organization unless the failure is due to specific board policy direction. This is fundamental to clear accountability. In Algoma’s case, the MOH informed the board she had hired a CFO (who turned out to have a criminal background). Though the board had no role in hiring staff, it was the board’s responsibility to ensure that the proper hiring process (e.g. reference check) was followed by asking relevant questions.
- Board of health members must act in the best interests of the organization – The best interests of the health unit are served only when board of health members put the health unit’s interest first. This is a duty. Even when facing other pressures, municipally elected officials on boards of health must support decisions that serve the health unit’s best interest (e.g. more funding for the health unit) even if those decisions might be unpopular with competing interests or groups.
To start on the path toward good governance, board of health members need a common, shared understanding of their roles, responsibilities and accountabilities. They need strong support mechanisms (committees on finance and audit, governance, etc.) to help manage the work of effective oversight. They will need tools such as functional agendas, work plans, reporting templates, and a board of health policy manual. They also need to monitor the board of health’s performance through guidelines for the selection of members and annual performance questionnaires.
However, there remain challenges to achieving good governance. And the greatest risk to an organization is the failure to have or to follow good governance practices. Risk is an integral part of governance best practices. It is everyone’s responsibility because the range of risks faced by organizations is large, and can be strategic, reputational, and operational in nature. The next speaker, Corinne Berinstein, will cover this topic in greater detail.
A lively Q&A with Mr. Scott was held. Following are some highlights:
- While it was recognized that the OPHS adequately addresses risk, Mr. Scott noted that the challenge lies in how a board of health delivers the Standards.
- Roselle Martino from the Public Health Division, MOHLTC, confirmed that the OPHS and Organizational Standards will be reviewed (in parallel processes) with the intent to ‘modernize’ them by the end of 2016. Minister Hoskins will be issuing a communique to the field as early as next week with details on the review process. Broad sector engagement in the process will include alPHa.
- Ms. Martino also confirmed that boards of health should not assume that the 2016 funding for health units will be subject to the funding formula that was imposed for 2015 budgets. Mr. Scott acknowledged that given the funding constraints on all sectors, it will be all the more pertinent for organizations, including health units, to show that they have done due diligence and that their house is in excellent order.
- In answer to a question on how Algoma’s large sum of missing funds could have gone undetected by the hired auditing firm, Mr. Scott indicated that it helps to develop a checklist to ensure you are a getting a good, quality auditor because one cannot assume all auditors will be high quality.
Participants took time to complete a self-assessment tool (click here for the tool), sections of which they were asked to complete after each speaker. They answered the questions as individuals on the board of health for their own personal reflection.
Click here to view the presentation by Graham Scott.
Managing Uncertainty – Corinne Berinstein, Senior Audit Manager, Ontario Internal Audit Division, Treasury Board Secretatiat
Risk intelligence is the organizational ability to think holistically about risk and uncertainty. It uses forward looking concepts and strategies. It is essential to the survival and success of organizations. It can be an opportunity and a threat. Reasons for doing risk management are: it helps your organization meet objectives and improves outcomes, allows you to consider and forecast risk and prioritize efforts more effectively, and enables you to mitigate threats and take advantage of opportunities, helps you prepare for risks, and shows you are practicing good management. Risk management is done at all levels of the organization, from front line staff all the way up to the board of health. Therefore, fostering a healthy risk culture in the health unit where risk is talked about at every level is essential.
In terms of the overall roles and responsibilities, the health unit implements all the steps in risk management while the board of health maintains oversight of risk management. The Ministry of Health and Long Term Care sets the standards of expectations through its OPHS, Organizational Standards, and Accountability Agreements.
The five steps of the risk management process are:
- State objectives; Identify risks (there are 14 categories, e.g. legal compliance, equity, financial, HR, political, privacy, etc.); Assess risks (use Risk Prioritization Matrix, which measures likelihood, impact, timing)
- Plan and take action (employ mitigation strategies of detection, prevention and recovery/correction); and
- Monitor and report risks.
The Integrated Risk Management Quick Reference Guide is a handy two page tool for developing a risk management approach for the organization.
Board of health responsibilities regarding risk management are as follows:
Approving the risk management policy and framework;
Ensuring staff has the capacity to manage risks;
Ensuring that all significant risks are identified and mitigation strategies are proposed;
Ensuring that the board of health has input into risk discussions; and
Ensuring the board of health has adequate information to monitor the progress of the implementation and effectiveness of mitigation strategies.
Afterward, a Q&A session with Ms. Berinstein was held. Some key statements included:
While an organization would benefit in having an explicit statement on risk management, it’s more important to implement the risk management process (i.e. just do it).
- Boards of health can move in the right direction by forming a Risk Management Committee or renaming their financial/audit to “Financial, Audit and Risk Management Committee”.
- To help build a risk management culture in the health unit, Ms. Berinstein urged boards to get senior management’s buy-in of and commitment to risk management, identify risk management champions, train them and assign them responsibilities, ensure all staff complete Risk Management 101 training, ensure risk management is an employee performance plan requirement, communicate and report on risk management (e.g. team meetings), and get staff feedback on the risk management culture (what works, what doesn’t).
- When asked to recommend a governance model to adopt with risk management in mind, Graham Scott mentioned the Pointer-Orlikoff Healthcare Governance Model. He believes that the Carver model, in comparison, is outdated in a number of respects and therefore less ideal.
- Northwestern Health Unit is willing to share the Ministry’s risk monitoring tool with other boards.
Click here to view the presentation by Corinne Berinstein.
“The Perfect Storm”: Lessons Learned – Tony Hanlon, CEO, and Justin Pino, CFO, Algoma Public Health
Tony Hanlon and Justin Pino from Algoma Public Health described in detail the perfect storm of events and factors that led to the crisis that unfolded at their health unit in early 2015. The crisis revolved around the hiring of an interim Chief Financial Officer with a criminal background. The severe fallout of the scandal prompted the province to appoint Graham Scott to conduct a governance assessment of Algoma. Findings from the assessment were released in June of this year (click here for the report). Dr. Hanlon and Mr. Pino explained how poor governance, inexperience, and a near-complete lack of due diligence on the part of the Algoma board of health laid the foundation for the crisis. It was also these factors that gave rise to the former business administrator committing fraud over time from 2006 to 2013.
As a result of the crisis, three reviews of the health unit and board were conducted, including the assessment by Mr. Scott. By his recommendation, a new board of health was formed and an interim leadership (MOH, CEO) was installed with staff from Sudbury & District Health Unit. (Since then, Dr. Hanlon has taken on the Interim CEO role on a contract basis and Mr. Pino the CFO role on a permanent basis.) The new leadership has made good governance a priority and implemented a number of best practices (see below).
The lessons learned in Algoma have been many. Boards of health should have the following:
a membership that is skills-based (members have specific professional expertise in areas such as financial, legal)
an orientation process for new board members
professional development program just for board members
a focus on risk management
a robust board performance evaluation
board sub-committees (e.g. Financial, Audit & Risk; Governance, etc.)
board policies and procedures
flexibility in the type of board (e.g. regular rotation of board chair)
operational policies (e.g. Financial, HR)
employee engagement processes
plans to hire an executive coach/mentor for new executive hires (MOH, CEO, etc.) and a professional development plan for these positions
a communications plan for internal and external audiences
commendable front-line staff
In the Q&A that followed, questions mainly concerned the lack of safeguards and accountability regarding health unit finances as well as the role of the health unit’s auditors during the embezzlement of funds. It was suggested that from a system perspective, health units need to think about ways in which they can support each other, particularly weaker health units, to ensure that we have a strong public health system overall in place. In the name of improvement, it was further recommended that every senior public health manager and board of health member read Graham Scott’s Algoma Assessment Report.
Click here to view the presentation by Tony Hanlon and Justin Pino.
Risk Management: A Process Perspective – Hazel Gilchrist, Director, Corporate Services, KFL&A Public Health
Hazel Gilchrist walked attendees through her health unit’s journey to date in risk management. The journey began as a result of one of the recommendations by the provincial Treasury Board in their 2014 audit of KFL&A Public Health. A risk management working group was established to engage the agency in a risk management process that is expected to be completed by 2016. Currently, KFL&A is in the stage of assessing risks.
A risk framework was developed that identified risks, organizational priorities, and organizational strategies. The board of health was involved early on in the risk identification and assessment processes, and posed a number of initial questions. A current risk heat map was generated, which was well received by the board. The heat map revealed a Top 10 list of agency-level risks (strategic planning, performance management, client service standards, security of IT/IM systems and assets, funding, etc.). Although many of these areas are already addressed, there is still room for improvements, the impact of which would be substantial.
After assessing existing controls, future controls and consequences for each of the Top 10 risks, a future risk heat map was created. KFL&A Public Health’s next steps include developing and implementing a risk management policy and risk mitigation strategies as well as engaging in risk monitoring, reporting and evaluation. KFL&A will also address program-level and project-level risk management, and cultivate a healthy risk culture across the agency.
Attendees were encouraged to pick up a handout of KFL&A’s Organizational Risk Framework (outlines their 35 risks), Current Risk Heat Map, and Future Risk Heat Map.
In the Q&A that followed, Ms. Gilchrist acknowledged Corinne Berinstein’s invaluable assistance on the risk management journey. She further underscored that although it has been time consuming and challenging, the journey has also been a great learning opportunity and a chance for KFL&A to maximize its impact in the community.
Click here to view the presentation by Hazel Gilchrist.
Group Discussion – Insights, Comments and Next Steps
Attendees participated in a panel discussion with Ms. Berinstein, Ms. Gilchrist, Dr. Hanlon and Mr. Pino. The following are highlights:
- Health units were advised to move forward with risk management and not wait for the province to complete its review of the OPHS.
- To develop a public health system approach to risk management (and avoid reinventing the wheel), it’d be helpful to develop a common framework with input from those health units that have already established frameworks. A common risk management framework would not only contain generic components applicable to all health units, but it could also be customized by individual health units for their own use. Linda Stewart of alPHa suggested that she could approach the Ministry for resources to aid this process. Ms. Berinstein also offered her assistance with this project.
- There was a suggestion that alPHa hold a follow-up meeting next year on risk management. It could include a celebration of successes.
- Reviews of the health unit’s risk management process should be done annually if risks don’t change much year to year. They can be done more frequently, if the need arises.
- KFL&A did not invite media to its board education session on risk management as the health unit continues to lay the groundwork.
- KFL&A Public Health is willing to share its audit report by the Ministry. Ms. Berinstein advised that health units inform the Ministry if they plan to share their audit reports with other agencies.
- It’s beneficial to get employee buy-in to risk management, and don’t make it too onerous for staff to implement.
- Boards should consider if a first-time MOH would benefit from an executive coach.
Speakers were thanked for participating in today’s program. It was announced that the alPHa Board of Directors will be holding follow-up discussions. Special thanks were given to Ms. Berinstein for helping alPHa design the event program.