L’Arche Canada’s Audit and Risk Management Plan

Presented by:Bernard L’Abbé

2013 General Assembly

Summary of presentation

• Why has l’Arche Canada chosen to develop an ARMP?• What is a risk?• Examples of major risks• What is risk management?• What is a risk management process?• Importance of corporate ethical values• Risk mapping• Who is responsible for managing risks• How does the Board oversee risk management• L’Arche Canada’s ARMP categories of risks

Summary of presentation (continued)

• L’Arche Canada Risk Register• What should be included in a good ARMP?• Document sources• Thank you• Question period

Why has l’Arche Canada chosen to develop an ARMP?

• The issue of risk management was identified during l’Arche Canada’s last Governance Structure Review process

• L’Arche Canada was lacking a comprehensive risk management plan and appropriate processes

• It was strongly recommended by our Auditors• The implementation of an Audit and Risk Management Plan

is a best practice• It is a structured process the enables the Board to better

fulfill it’s fiduciary responsabilities • It enables better accountability to our funders

What is a risk?

• Risk takes many forms but, essentially, is anything that affects an organisation’s ability to meet their objectives and preserve it’s reputation. (CICA, 2009)

• Risk may appear in a number of categories which include:• Compliance risk • External risk• Financial risk• Governance risk• Information Technology risk• Operational risk• Reputation risk• Strategic risk

Examples of major risks

• Loss of a major source of funding• Unsuccessful fund raising projects• Fraud• Failure of a project or strategic initiative• Inadequate response to emmergencies• Excessive increases in the cost of human or other resources• Actual or alleged sexual misconduct or abuse by an employee or

volunteer• Loss or theft of information• Inability to perform critical functions that depend on technology• Etc.

What is risk management

• Risk management includes the culture, processes, and structures that are directed towards effective management of potential opportunities and adverse effects.

• Risk management involves asking: • What could happen that would affect our ability to meet our

objectives?• How likely is it to occur?• How serious might it be?• What should we do to reduce the risk?• How can we be prepared to respond to risk?

What is a risk management process?

• Risk management process includes the systematic application of management policies, procedures and practices to the task of establishing the context, identifying, analysing, assessing, managing, monitoring and communicating risk.

• Commonly-used approches may include a combination of:• Internal processes – interviews, questionnaires, brainstorming, etc.• Self-assessement and other facilitated workshops• Strenghts , weaknesses, opportunities, and threats (SWOT) analysis• External sources: comparisons with other organisations, bench-marking,

discussions with peers, risk consultants, etc.• Tools, diagnostics, and processes – checklists, flowcharts, scenario analysis• Audits (e.g. a safety, or environmental, or financial audit)

Importance of corporate ethical values

• The integrity of an organisation depends on the behaviour and actions of the people in it, who should all share the same understanding of ethics – the values and standards that determine how board members, staff, volunteers, and other stakeholders behave and treat others.

• Corporate values are set out in a Code of Conduct:• The board approves the Code of Conduct• The board supports the Code and leads by example• Directors should sign the Code of Conduct annually• The Code is communicated to staff, volunteers and stake holders• The Code includes sanctions against those who deviate from it• The Code is enforced• The code contains provisions for whistle-blowing

Risk mapping

Who is responsible for managing risks

• The entire board is responsible for oversight of risk.• The board delegates to the National Leaders and staff most of the

detailed aspects of identifying, assessing, and managing the risks that the organisation faces – subject to board policy and approval.

• Boards may chose to create an ARMC. If this is the case:• The ARMC meets regularly with the external auditor• The group agrees the external audit plan, reviews the external auditor’s

letter, and monitors implementation of actions required as a result• The ARMC is responsible of ensuring that the audit, risk management,

and control processes within the organisation are effective• The ARMC takes a detailed review of the draft annual plan, the Risk

Register, and the Annual Report and Accounts prior to their submission to Council

L’Arche Canada’s categories of risks

• The ARMC has identified eight risk categories pertaining to l’Arche Canada. They are:

• Governance/Organisational Risk• Service Delivery/Operational Risk• Financial Risk• Legal and Compliance Risk• Technology and Information Management Risk• Human Resources Risk• Member Satisfaction/Public Perception Risk• Communication Risk

L’Arche Canada Risk Register

L’Arche Canada Risk Register

What should be included in a good ARMP?

• Corporate and Board approval, and ongoing support• Code of Conduct• Senior management, staff, and volunteer engagement• Audit and Risk Management Committee• Effective risk management and control processes• Audit and Risk Management Register• Written policies and procedures• Plan for responding to crisis• Training and Education

Document Sources

• Canadian Institute of Chartered Accountants• Oxfam• Risk Management, Standards Australia/New Zealand• Learning about Risks, Choises, Connections,

Competencies, 1998• Enterprise Risk Management, COSO, 2004• Ministry of Community and Social Services of Ontario• YMCA of Greater Toronto

Thank You

• I wish to thank the following persons for their precious help:

• Guillaume Richard• Ian MacKeigan• Hollee Card• Joe Egan• Board members of l’Arche Canada

Question Period

QUESTIONS?