on your host, Paul Hartle. And today we take a call from the Canada revenue agency. We'll be speaking with Brian Fielding, who is the Audit and Evaluation and Risk Branch Assistant Commissioner, as well as the chief audit executive. Joining him is Wendy Sashin, Brecker Tang.
She's the Risk Management Director. And I will say we have a little technical difficulty here in the middle, so I apologize for a little shift in the sound quality, but, you know, that's risk management. Good things I had to back up. We're going to get risk management, always have.
You're now well, and you guys will enjoy this one here in another country's perspective on governmental risk management. So without further ado, let's start the podcast. Welcome to the podcast. I appreciate you all calling in.
And why don't we go ahead and start off with Brian? Good morning, Paul. Thank you. Yes, and nice to meet you virtually over the phone.
Same here. And I enjoyed when you came down to our firm conference in DC. So we enjoyed that very much. Well, I'm actually drinking out of my firm water cup this morning.
I'm well, it's good. That's good. Very good. Okay.
So why don't we start off, Brian, did you want to kind of give us a high level, or should we introduce, I guess, both of you there, just to kind of give us a little background on your roles in the program? Okay. So my role is basically as assistant commissioner of the audit evaluation and risk branch. I report to the commissioner of the agency, so the CEO, we also have a board of management, and I have a reporting relationship, a dotted line with the chair of the audit committee.
So I'm in charge of all internal audit evaluation and enterprise risk management activities and programs at the Canada revenue agency. Good morning. My name is my name is my supervisor. I'm currently to Brian.
My division is in charge of a picture that the CRAs management and are supported to make informed decisions considering their risks as well as to build and maintain the risk management capacity throughout the organization and to manage their risks. Okay. Great. Well, I think what we'll do is I'll just kind of start off.
We have a couple questions here just about your program and maybe if Brian wants to take the first response and when you can jump in there too, but just since we're on the phone, it'd be a little easier if we kind of do one at a time. Okay. That's fine. Very good.
So my first question for you all was really just to give us a little bit of insight into why you all decided to even implement a NERM program. How far back does that go and what was the impetus to start your program? Okay. Great question.
So in 2004, the government of Canada introduced new policies and guidelines around enterprise risk management and they were basically integrated across the government of Canada, including the Canada revenue agency. There was also, so that's the first sort of important timeline. The second one was around 2008. A couple of things were pretty significant.
First of all, we had the worldwide financial crisis that was a very significant event across the planet. But there was also the maturing of first management as a practice driven in large part by the basal accords over banks. And I would say that those two factors were incentive for the senior leaders of the Canada revenue agency to essentially say maybe this is a good practice that we should, a good emerging management practice that we should proactively implement in our organization. And because we really would like to know, understand more about the risks that do face us.
So over since 2010, a new branch was created. I was hired to lead it. It was the enterprise risk management branch which was subsequently merged with the corporate audit and evaluation branch in 2013. So since we started the branch, we've really built our level of expertise and engaged in agency risk management processes.
Such as the corporate risk profile, we're senior managers across the agency, assess enterprise level risks, and develop action plans where required to mitigate them. We also monitor and report on the realization of the action plans themselves. And we make the corporate risk profile available to all employees and other stakeholders through our employee portals. So the corporate risk profile is available to all 45,000 employees.
So by understanding our risk, anything effectively, the CRA can capitalize on exploring new opportunities, knowledge of risk information at all levels of the organization, help the agency meet its objectives and deliver the results that check. Absolutely. So I guess going back to that corporate risk profile and in general, when you did start this program up, were there some challenges you faced gathering the information or getting folks to really speak about their risks? Well, because it was essentially a new management practice, a new senior leader sitting at the senior table, a new branch, there was a fair amount of change management involved.
And I would say that the agency was somewhat ahead of the game as far as actually investing in a function like that. So a lot of education was involved. And one of the ways we decided to go about it is to be helpful for folks. There was a preoccupation that the risk managers were going to go in and tell people experts in their field, tell these experts how to do their job.
So we purposely avoided that type of approach. And what we did was we tried to find strategic opportunities with various partners around the agency who could benefit from our assistance. And what we did is we never imposed ourselves. We just made ourselves available to them and demonstrated what we could do, gradually gained their trust and confidence like that.
But we had to do it one partner at a time. And one example was we had a very strong support from the Information Technology branch because they live and breathe the risk all the time. It's embedded in what they do. So they were actually quite happy to have a risk management function internally that they could rely on.
Another area where we were successful, there was a very significant branch with which we had no relationship at all to speak of. But they were launching a multi-year, a very large project. So what we did is we embedded a senior risk analyst in their project team for the first six months of the project, basically as a free resource that helped them to get their whole, I guess, the risk tools and the risk assessment and also build a culture of risk into that project. We've had nothing but excellent relationships with that branch ever since.
That one initiative, that one person who was absolutely fantastic, created a solid foundation that we've been able to build on ever since. Okay, that's very interesting. So it sounds like in that case you embedded some risk staff in that organization. I mean, in general, how are you all organized?
You know, who does your office report to? You know, what's your team look like? Okay, I'll take that question for you. So our Enterprise Risk Management Division, as I mentioned, I report directly to Brian and then Brian at the VISTA Commissioner reports to our Commissioner.
So then there is a very clear line right to the top. But my division is broken up into two sections. So one, it is probably a little bit more traditional. It's a corporate risk management section.
Here, you know, we focus a lot on understanding and management of the Enterprise-level risk. We support the management of these risks to value protection and using sound and child risk intelligence at the enterprise level. We also work with key stakeholders to inform overall planning reporting. But the second arm of my team, this is a little bit more unique.
This is a risk management center vectority. This is basically our internal consulting shop. We support managers and employees to really meet their responsibilities. We provide a facilitation services advisory consulting to help them develop tools, help them work through risk identification, and even help prioritize their key deliverables.
So the center must receive great value and tool the methodologies by continuously scanning. We even produce a monthly risk watcher that does the scanning. These reports and services help inform CRA staff of relevant changes to the external landscape. And we also do internal fraud risk adoption.
I think that's an excellent way to organize that. I think consulting approach, I think a lot of our government folks here in the US would be interested in doing a similar model because we want to make sure that we're gathering the risks and making sure management is apprised and taken direction. But I think those organizations can really see the value when you reach out to them and really help them organize their thoughts around risk. I think that's a great way of approaching it.
I think Paul, we've gotten it to the point now where we're almost a first stop for potential solutions when some of our colleagues have some challenges that they're having difficulty dealing with themselves. I'll give you an example. Last year, one of our assistant commissioners, one of my colleagues reached out to me to help, because they had a fairly significant issue that they were not able to resolve and was creating some issues and tension that was not necessarily healthy. So he reached out to me and basically asked if we could provide some sort of assistance.
One of the advantages of our structure is we don't really have any skin in the game and any particular risks that are running our own team, so do I have the right workforce and that sort of stuff. Basically, what we did is we developed a prioritization model for them that used a set of criteria to group high priority requests into categories that were developed with input from across the agency. What happened was a tool resulted in this area increasing its efficiency in meeting deadlines from about 65 to 70 percent of the time before 95 percent. I understand even some quarters, some months they had 100 percent of meeting the deadlines on time.
What it's done is just brought down the level of friction and stress and running very well now and people are off worrying about other things, because this is great. I love to hear the success stories. And actually along those lines, so for your agency, I guess our closest equivalent would be the IRS. Is that correct?
Yeah. Right. So I'm just thinking from your perspective, for that type of a mission, I think you talked a little bit about this now at the firm conference. There was some reputation risk, was it was an important feature, that's something you guys really thought about a lot about.
Are there some lessons learned that you've taken from your approach to reputation risk? Basically the lessons learned were, it was really, I mean it was something that we wanted to address, because tax administrations that rely on a voluntary compliance system, in other words, any country that you file or return, you don't get a bill from your tax, administration you file or return, and then you get some sort of confirmation or assessment, but the ball is in your court to go first. Reputation and trust in the fairness of the organization is paramount. And so we were looking to develop a tool that would help us, sort of measure how we were doing and managing our reputation.
So we were very closely with the IRS. We're co-leaders, our two organizations are co-leaders of a specialized community of interest that's part of the OECD. Okay listeners, this is where we have a slight technical difficulty. So I did ask Brian to start again to discuss a little bit more about the community of interest of the OECD.
Sir, is there? Absolutely. I'm sure they would. Well, we just had one more question for you today, and it kind of goes along the maturity scale, but in general, how would you all kind of rate the mature of your program, and in general, what are you looking to do next?
What is sort of the future for your program? Self assessment tools. So we have an error prevention self assessment. Chair, our tool is not only with other government about tools that are disheaning people, I have a host of them.
Yeah, another thing that's really happened to you just for us. Well, great. Well, Brian and Wendy, I really appreciate you all calling in today. I think you have some really interesting things to share with us and some best practices and things that some of our agencies can hopefully put in place themselves.
So once again, thank you very much today. Thank you. Good pleasure. Well, that's our show.
Thanks for tuning in. Check us out firm.org. I want to ask a good podcast there for you to look at. Listen to.
Looking forward to exciting 2020 with lots of good guests. Requests, please feel free to reach out. I'll launch those signing off for a recent chat with a firm.