Dec.4, 2024

back to Jutta's Blog main page

Dec.4, 2024

Item AU7.6 – “Status Update on Enterprise Risk Management” https://secure.toronto.ca/council/agenda-item.do?item=2024.AU7.6

Dear Audit Committee,

This City staff report on Enterprise Risk Management (ERM) is concerning, since it could be read as a “how-to” manual of institutional overreach, when applied to municipal governance.

It may make sense for a bank to consider every person who actually or virtually enters a bank as a potential bank robber or criminal depositor, and therefore to keep the money actually or virtually locked up. But when a method devised for banking seeps out of its boundaries and starts to colour the approach City management takes to its entire way of operating, that should raise some alarms.

An example, showing that this seepage has been going on for quite a while: In 2010, when recreation staff at Dufferin Rink were found to be collaborating with the community in adding good soup, cookies, and cheap skate lending to the rink operations, management said “fraud” was the first level of concern. According to an internal Briefing Note, if Dufferin Grove continued with these elements of the rink program, “the City will be non-compliant on many approved policies, procedures, and legislative requirements… ...vulnerable and open to major risk factors.” Each rec staff cook or skate rental helper was seen as a “potential fraud perpetrator” (the designation used in the current ERM staff report). So city managers went to considerable trouble to wind down this popular approach to winter fun. More recent attempts to introduce similar amenities at other recreation locations have been blocked before they could even get a trial, except for a few that slipped under the radar for a year or two.

We are alarmed by the staff report’s various “Risk Category Definitions,” “Risk Impact and Probability Criteria,” and “Control Classifications and Categories.” But these terms are also enlightening. They help us to understand, for example, the multiple barriers to “Inclusive Economic Development (IED)” that City Council has been promoting.

ERM as a total system leaves middle management in a most confusing situation, where it seems like the safest course of action, in the case of any new idea, is to stop it. This can lead to a state of paralysis. Or to more high-level meetings, which can be the same.

The ERM approach could also end up backfiring. For example, the staff report is very concerned with something it calls “reputational risk.” But the City can suffer reputational risk as easily by blocking popular initiatives as it can by making risk the be-all-and-end-all.

Optics are a two-edged sword, but are not in any case a sufficient standard for evaluating what the City should be doing. The report warns that City actions have “the potential to impose significant losses on brand, reputation, morale, and revenue.” So does a culture focused on compliance, risk aversion, and inertia.

We hope that the audit committee will reject this ERM report and recommend that Council take a different approach.

Jutta Mason

Lead researcher, CELOS