Halifax auditor general says city not properly managing risks, service disruptions

New reports from Halifax's auditor general say the city is not properly prepared for interruptions to services, or managing risks to the municipality.

Andrew Atherton delivered two reports to the city's audit and finance committee Wednesday that examined business continuity and risk management.

Business continuity is how city services should be delivered when things go wrong, including cyber attacks, a pandemic or supply chain interruptions. Risk management involves looking at both large-scale risks to the strategic priorities of the city, and operational risks that pop up in day-to-day city business.

In both reports, Atherton's office found few, if any, policies or procedures on these issues.

"Much like we all pay our insurance, we have our 72-hour emergency kits at home, we do our general preventative maintenance on our houses and cars — it's important that HRM properly plan and prepare for future uncertainties," Atherton told councillors.

"Unfortunately we found that was not happening in either audit."

Current situation adding stress in emergencies: AG

On business continuity, Atherton said the city is often reactive when emergencies arise, and must rely on staff members' own experience rather than a written procedure.

"While these folks do amazing work, failure to have a plan puts stress on them in already stressful situations," Atherton said.

On risk management, the report said there's a lack of oversight and while risks are sometimes identified, there aren't plans for how to manage them or who is in charge of those controls.

The audit and finance committee has a direct responsibility for risk management, but Atherton said they have gotten sporadic updates from staff in recent years. They also had "concerns with the accuracy of some of the information" in the most recent January update, Atherton said.

According to Atherton's report, staff had made references that implied "strong oversight and management of enterprise risks, and a suggestion that treatment plans were in place," when they weren't.

"I think the most basic step is this committee has to be more assertive in asking for regular reporting from management, and more incisive in its questioning," Atherton said.

The city accepted all 24 recommendations in both reports.

Work will be undertaken: CAO

Chief administrative officer Cathie O'Toole said risk management is present all over the municipality, even though it's not documented in an organized way. She also said Halifax has delivered services successfully with minimal disruptions for 275 years, but agreed more policies on business continuity will be created.

"That will help future-proof us because we're very dependent upon the staff knowing how to do their jobs," O'Toole said.

Mayor Mike Savage noted that many of the concerns and suggestions were similar to those in a consultants' report in May that suggested improvements for the city's emergency management overall.

"We've got a lot of good people, they're doing some great work, but we need to document these processes in a formal way to make sure that we're following them," Savage said.

O'Toole said some work is underway or planned now, and staff will return to the committee within three months with an action plan to tackle all 24 recommendations.