City Government

Constitutionally, municipalities in Canada are the responsibility of their respective provincial governments. As such, the City of Edmonton is subject to provincial legislation, mainly the Alberta Municipal Government Act. In 2013 the elected City Council consisted of the mayor as well as a councillor for each of Edmonton's 12 geographic divisions (wards). Reporting to Council is the City Manager, and through him the City's 11,000 employees,⁴ divided into five departments.

The Edmonton City Council operates the two-employee model, the second employee being the City Auditor.

City Auditor's Report

In a 2005 audit report,⁵ the city auditor reported to the City Council's Audit Committee that:

• Known risks were being managed reasonably well.
• Risks that are strategic in nature were not clearly identified.
• ERM results were not consistently incorporated into business plans.

Results-Based Budgeting

ERM assists in resource allocation decisions (as shown in Exhibit 15.1) and so was seen to possibly conflict with budgeting models, including a results-based budgeting (RBB) model concurrently piloted by the Administration. The two models can be reconciled, however. For instance, one of the criteria in the RBB model for evaluating city programs was the amount and likelihood of risk relative to the amount of benefit the program was deemed to provide. Conversely, a program's quartile rating in RBB could be used as an indicator in the ERM model to determine a program's effectiveness in achieving its desired outcome. In this way, both models could inform each other.

Capital Budgeting Models

Edmonton's infrastructure branches use sophisticated risk management models for maintaining and replacing current capital assets, and are introducing risk assessment into business cases for new capital projects. The strategic ERM model needs to incorporate these projects at the strategic level.

A graphic showing the linkages between ERM, Performance Measurement, and Results-Based Budgeting is shown in Exhibit 15.1.

Pilot pm² Risk Scorecard Methodology

The Risk Scorecard consisted of six steps, each dependent on the previous one:

1. Weighting of goals in the plan based on what is the highest priority in the organization to advance
2. Linking of strategic objectives to goals—determine how the strategic objectives contribute to goals, and to what degree (relationship expressed as low/medium/high)
3. Identification of risks to each strategic objective, scored 1 to 5 in likelihood and 1 to 5 in impact
4. Identification of how current programs (processes) contribute to achieving strategic objectives; currently performed—scored 1 to 5 in relationship to strategic objective and in effectiveness in meeting expectations
5. Identification of planned future initiatives—scored 1 to 5 in relationship to strategic objectives
6. Identification of possible future mitigations and risk indicators

Deliverables from this process include a risk register, a heat map, and charts showing each strategic objective's cumulative levels of risk, program contribution, and initiative contribution, to show relative effort toward areas of relative risk. In addition, a list of possible future mitigations and a list of risk indicators (measures to show as early as possible that a risk may be occurring) can be derived. The methodology is shown in Exhibit 15.3.

Ideally, risk assessment would have taken place during the creation of strategic planning documents to help determine the most risk-appropriate actions to achieve the vision and goals. However, the “Ways” documents were created before ERM was conceptualized in Edmonton. Therefore, pilots were conducted to catch up to each Ways document by conducting a Risk Scorecard workshop for each one. Because of the resource commitment of this exercise, workshops could realistically only be done one at a time. By the summer of 2013, pilot Risk Scorecards for two Ways documents had been completed or nearly completed: The Way We Move and The Way We Live.

Initial Planning

After agreeing to the plan between Administration and pm² Consulting, a facilitator conducted workshops. For the first pilot, three staff members from pm² Consulting facilitated the workshop; for the second, the ERM Program Manager was the facilitator. For both pilots, permission for the participation of lead department staff was sought and received from the general manager of the lead department: for The Way We Move, Transportation Services; for The Way We Live, Community Services. Branch managers for strategic planning for both departments were tasked to provide subject matter experts from their staff for the entire workshop; each provided three to five staff members to bring department expertise. In addition, for steps 2 and 3 (risk Identification and Scoring), senior department staff, mainly branch managers, were asked to participate in scoring the likelihood and impact of risk events, and to add to or amend the list of risk events.

Each of the workshops took approximately 60 to 70 hours to complete. To keep time commitments, some portions of steps that were deemed to be less critical were omitted.

Step 1: Identify Strategy

The first step in the process is to identify strategic direction. Edmonton had a 30-year strategic plan, The Way Ahead. Using input from the public as well as subject matter experts, The Way Ahead was approved by the City Council and is the key planning document for the city going forward. To assist in its implementation are the six Ways plans noted previously. These documents made strategy identification straightforward. For the first pilot, The Way We Move (transportation plan) was selected. It was considered the best place to start because it was the most homogeneous of the plans; responsibility for its implementation was overwhelmingly with one department, Transportation Services. As well, its format made it essentially a capital plan, with easily understood objectives and goals.

At this point the ERM team had to decide at what level the strategic weightings were to occur. Options included the six 10-year goals or the 19 strategic objectives, among others. It was decided that the strategic objectives would be the appropriate level of analysis for the risk register. The goals would be at too high a level to be meaningful, and other criteria would not serve the city's purpose in addressing the risk needs of the Ways.

At this point a weighting of the goals was attempted. Subject matter experts, including the department general manager, allocated a percentage of support to each of the six goals. (It should be noted that, for political reasons, this weighting of the goals may be skipped as management may not want to prioritize these at this time.) The goals were then placed on the vertical axis of a table, with the strategic objectives across the top. An example of this table can be found in Exhibit 15.4.

For each strategic objective, the subject matter experts (in this case, four people from the Community Services department) indicated the link to each goal on a scale of 1 to 5. The larger an objective, the more goals it would relate to, and the higher weighting it would receive. When this was completed, each strategic objective had a weighting (C), expressed as a percentage, calculated as:

where:

• A = Goal weighting (expressed as a percentage)
• B = Relationship to objective (1 to 5)

The sums for each column are added together to get a total weighting; the sum for each column is divided into this total to derive its relative weighting (in this example, 4 percent).

This gave each strategic objective a weighting. This weighting was then compared to that of every other strategic objective to arrive at a percentage of the total weighting. This kept the weightings constant in relative terms.

The objectives were then transposed to another table where they formed the vertical axis, then sorted by their percentage of the total objective weighting, with the highest weightings at the top. This allowed the group to select high, medium, or low weightings for each strategic objective. This categorization would be carried on to the next step, risk identification.

Step 2: Identify Key Risk Elements

Using a risk category checklist (a list of categories of potential risks covering all possible types of risk—e.g., financial, political, partner), the workshop group, with assistance from a number of subject matter experts, including branch managers, created a list of risks that could impact the achievement of the strategic objectives.

Step 3: Score Risk Elements

The risks agreed on by the group were then placed across the top of a table with the strategic objectives listed vertically along the left side. Directly below each risk was a measure of likelihood of the risk occurring (again on a 1 to 5 scale). The likelihood score was agreed on by the subject matter experts. The team then scored each risk to each strategic objective, again on a 1 to 5 scale. This provided two outputs: the scoring of risks and the risk weighting of each strategic objective. A sample of this table is shown in Exhibit 15.5.

The risk scores were calculated as:

where:

• D = Strategic objective weighting (1 for low, 3 for medium, 5 for high)
• E = Risk impact on objective (1 to 5)
• F = Risk likelihood (from top of column) (1 to 5)

These were summed vertically for each risk.

The risk weighting of each strategic objective was calculated using the same formula but summed horizontally for each strategic objective.

The risks were then transposed onto a data table with their likelihood and their weighted impact score (the sum of each D × E calculation for each cell in the column). This provided the basis for the risk register and the heat map.

At this point, several graphs can be created to show the relative nature of the risks and the strategic objectives. From a risk-based perspective, a heat map can be created showing the risks with the highest likelihood and weighted impact score. The more strategic objectives a risk can affect, the greater is the weighted impact score for that risk. For strategic objectives, a graph can be produced to show the strategic objectives most impacted by risk. The more risks affecting a strategic objective, and with greater impacts, the greater that objective's weighted risk score.

Step 4: Link Programs, Initiatives, and Risks

The next list required was that of the existing programs currently in place to fulfill the strategic objectives. For the ease of the workshop, it was decided to use the list of programs shown in the annual operating budget. Other program levels could have been used, such as that used in the city's results-based budgeting (RBB) initiative. This initiative divided budget-level programs into smaller components, which would be easier to change but increased the number of programs tenfold. It was for this reason the RBB-level program list was rejected; the number of programs in that initiative was exceedingly high.

Once a program level was agreed on, a new table was created, with the programs across the top and the strategic objectives down the left side. On this table, the subject matter experts scored the impact of the relationship between each program and each strategic objective (on a 1 to 5 scale). In addition, the participants estimated the effectiveness of each program (i.e., whether it fulfilled the requirements of the program), again on a 1 to 5 scale, with 5 meaning the program was performing as required and 1 meaning the program's performance was well below what was required. The difference between what was required of the program and its actual performance (i.e., 5 minus the effectiveness score) was known as the strategic gap. An excerpt from this table can be found in Exhibit 15.6.

At this point a new graph could be created, with a vertical bar for each strategic objective and its cumulative program requirements. Adding the cumulative effectiveness and cumulative strategic gap gave a stacked bar graph whose height was its cumulative program requirement. The bigger the objective, the more programs it had and therefore the higher cumulative program requirements (and likely a proportionally large strategic gap).

The last dimension in step 4 was to list new initiatives the City planned to implement, and rate their importance to each strategic objective. For the purposes of the workshop, it was decided to limit the list to those in the Implementation Plan for each Ways document. Within this set of possibilities, only the initiatives coded as “will do” (not “already done,” “already doing,” “could do,” or “aspire to do”) were used for the initiatives list, to keep it to a manageable size. With this list scored by each strategic objective on a 1 to 5 scale, a graph could be produced showing the cumulative impact of future initiatives on each strategic objective. A table linking initiatives to strategy is found in Exhibit 15.7.

With the strategic gap and initiatives impact established, the two graphs for each objective could be combined on one graph to show the cumulative strategic gap and cumulative initiative impact for each strategic objective. If resources were properly allocated, one would expect to see a correlation between the height of the strategic gap bar and the height of the cumulative initiative impact point for each objective. For viewing purposes, it was necessary to use different scales for each data series, to best show the correlation. Finally, the risk weighting for each strategic objective could be added to the graph. This showed the relative risks associated with each strategic objective in relation to its required programs and initiatives. Overall, a correlation between risk, strategic gap, and initiatives may be observed. For objectives whose risks do not correlate with strategic gap and initiatives, this forms the basis of discussion for the objective; in-depth analysis shows the types of risks, whether they are caused by or independent of the programs comprising the strategic gap, and whether future initiatives address the risks, either directly or indirectly. The graph showing risk, strategic gap, and impact of initiatives on strategic objectives is found in Exhibit 15.8.

Step 5: Determine Indicators and Mitigation Actions

The final step involved completion of a risk indicator worksheet for each risk/strategic objective combination. This sheet required the user to list potential mitigation strategies, including required lead time, as well as indicators of inputs, actions, or outputs that would signal the potential onset of a risk event. The worksheet data were then summarized in a database indicating strategic objective, risk, mitigation, lead time, and whether the organization is already undertaking the mitigation. The database could then be grouped by objective, risk, or mitigation as needed.

On completion of the mitigation database, the final risk scorecard could be completed. This was a table showing strategic objectives on the left and risks across the top. For each data point, the impact of the risk on that objective was indicated, as was its performance (good, fair, or poor shown as medium gray, light gray, dark gray), and showed the risk level for each objective (the level of potential risk of the risk element impacting this strategic objective).

This provided a basis of discussion to identify key risks affecting strategic objectives.

Comparison of pm² and ISO 31000 Frameworks

After two pilots of the pm² framework (with The Way We Move and The Way We Live), the ERM team evaluated the pilots to provide recommendations for strategic ERM going forward. Elements were taken from ISO 31000 and the pilot project. A comparison of the two frameworks is found in Exhibit 15.10.

Key Success Factors

Buy-In by Senior Management

Edmonton's Corporate Leadership Team (CLT, comprised of the city manager and the general manager of each department) has supported the concept of ERM. At a senior management level, staff must be able to perceive the value added by ERM. This makes design of an appropriate ERM process, which can show value to management, critical to its success. An example of the value proposition is found in Exhibit 15.13.

In general, the process must have two properties: it must be simple and it must show the value of doing it.

A critical balance must be struck between model power (i.e., how much information it provides) and user-friendliness. A model can provide large amounts of information but will not be helpful if it is too complex to be understood or too time-consuming to be considered worthwhile by the users. Conversely, a model that is too simple will not be helpful, as it will lack the relevance to achieve buy-in.

The pm² model consists of a number of simple steps performed in sequence to produce powerful results. These results include comparisons of risk, effectiveness of current programs, and the impact of future initiatives on achievement of strategic objectives. The challenge for the ERM team is to show the simplicity of the steps in the model to leaders, to ensure their understanding of the concept and buy-in to the model. Concerns have been voiced by department staff that the model, as followed in the pilot Risk Scorecard workshop, may include steps deemed too complex by branch managers. If necessary, some steps can be removed, and the model stripped to its risk analysis component if other levels of analysis are deemed not to add value to management, without losing the robustness of the model.

Whatever model is used, it must be customizable to the city's circumstances. For example, if branch managers believe a process to be too time-consuming or too difficult, it must be shortened and simplified to overcome this concern. Conversely, if the model is considered too simplistic to add value, rigor must be added to the model to show the value added and to show the time spent to be worthwhile.

Findings on the Process of Selecting and Implementing a Framework

Implementing an ERM framework typically takes longer than expected. More time seems to be spent getting buy-in for the concept from the C-suite and devising an appropriate model than one could ever predict. Rarely do off-the-shelf frameworks exist that can be employed in short order; plans usually have to be tailored to fit the organization's unique circumstances. Some of Edmonton's learnings from this ERM implementation include the following.

There is no perfect system. What works for one organization may not work for another. What is necessary is flexibility. Any system must be simple enough to understand, robust enough to be usable in any area of the organization, and powerful enough to add value in decision making. In addition, it may be preferable to create a hybrid approach, taking the best parts of two or more competing systems to create one that best meets the organization's needs.

No matter how good an ERM framework is, if senior leadership does not buy in to the framework, it cannot succeed, as management will need to see the usefulness and cost justification. Three frameworks were presented to senior leadership between 2005 and 2013; all were sound and based on extensive research and knowledge of risk management principles. All were found by senior leadership to be either too complex or not a fit to Edmonton's needs.

It may be problematic to try to roll out an entire system at once. In the initial ERM planning phases there seems to be a tendency to try to hit a home run; that is, to roll out a perfect ERM system at strategic, project, and operating levels all at once. It may be the most efficient in theory, but in practice it requires a prohibitive amount of up-front resources. It ignores the learning curve managers have in learning about ERM, how it applies to them, and how to do it. This leads to the next point.

It may be preferable to introduce one phase of ERM at a time. In Edmonton's case, previous attempts at an ERM framework were unsuccessful because they went against the stated wishes of the Corporate Leadership Team (CLT). One of the CLT's main drivers for action on ERM was the 2005 city auditor's report, which identified issues mainly with strategic risk. With this in mind, the CLT wanted primarily to focus just on strategic risk, not on an overall framework. In terms of a corporate rollout, then, phase 1 was to be strategic risk; project risk and operational risk could be dealt with later, as these were lower priorities for the CLT and the city auditor.

When working with operating departments on a framework (even a pilot), it is important to define clearly what you want to accomplish with the operating departments in question. In this case, it was clearly defined that the department owned the risk register and was responsible for its content; the ERM team's role was to maintain it. Going forward, the ERM team's role was also that of facilitator, coach, and mentor to the department staff.