On a muggy morning which promised a heat warning in the afternoon, Halifax’s auditor general turned up the heat early in council chambers at the Audit and Finance Standing Committee meeting of July 17, 2024. The city’s AG, Andrew Atherton, put the city’s feet to the fire as he dropped two reports, The Management of Business Continuity Audit and the Enterprise Risk Management Audit.
Both of these reports are somewhat theoretical as there’s no direct cost to the city that can be audited if the city is not ready to respond to emergencies. That’s not to say there aren’t direct costs to the city for not being ready, like $11 million in emergency fence rentals, but rather those costs are too dynamic and unpredictable to audit. As a result, these audits were about the risks or vulnerabilities that lead to wasteful emergency fence rentals and the AG’s audits found that we are exposed to some massive vulnerabilities and a lot of risk.
In general, what the AG found was that the city’s bureaucracy loves exposing itself to needless risk due to a lack of central direction in the bureaucracy. This in turn has led to bad continuity planning and inadequate risk management in the HRM.
Business continuity, for those struggling with jargon, is the city’s ability to continue providing municipal services in the event of a disruption and/or emergency. This is something the city tried to address in 2017 when the council of the day approved creating a Municipal Emergency Plan. In 2017 staff were instructed to identify all the services provided by their business unit and come up with a plan to continue delivering those services in an emergency. The first draft of this plan was due back to council by the end of 2018. As of April 2024, this plan has not been completed.
From the AG’s report: “Emergency Management told us business continuity is a priority. However, there are still no detailed plans and timelines to implement the business continuity management program.” Or translated from audit to English: Emergency Management is lying, because if it was a priority, it would have been done at some point in the past six years. Also, it’s pretty easy to tell that Halifax’s business units aren’t doing this work because some units, like Halifax Transit, can’t even figure out how to have continuity of ferry service even when there is no ongoing emergency.
Besides not having a holistic plan for services in the city, the AG also found that no one really knew who was supposed to be doing this work so it just wasn’t being done. And that even if someone in a business unit had come up with a plan for the services in their unit, those plans hadn’t been tested to see if they would actually work.
For the Enterprise Risk Audit, the AG told councillors that the city needs to do a better job of identifying risks, making plans to avoid them, and then following up to see if those plans are working. Also, identifying the risks is important because a city can’t remove all risk, so councillors need to be aware of what level of risk they are accepting. As a city, Halifax emphatically does not do this.
The AG told the committee that it was their job to do oversight into the city’s emergency planning. He told the committee that in the past five years they had received two reports from staff, both were surface level and that he had “concerns about accuracy” of the information in the reports. Translated to English, this means city staff are not doing the detailed planning work they’ve been instructed to do and then lying about it in their reports. This is endemic in every department of the HRM and something staff continue to do and have done as recently as July 9, 2024.
After the AG concluded his reports, there were a few questions and comments from councillors. Chair of the committee, Paul Russell, pointed out that the AG’s report says city staff are choosing not to do training exercises and instead relying on the training opportunities provided by real-life emergencies. This makes about as much sense as teaching minor league hockey players how to body-check by putting them on the ice in an NHL game. The AG also pointed out that emergencies don’t always test every aspect of a municipal response, which means some plans would be tested for the first time in an emergency. Also consider, what happens if the people who dealt with the last emergency retire, quit or transfer before the next one: How do the new people get trained?
Councillor Kathryn Morse asked the auditor general what he saw as the most critical risks to HRM operations. He replied that his job was to assess the HRM’s risk management processes—which he has done and found them lacking. The people who are supposed to determine what the biggest risks are and then lead the bureaucracy in fixing those issues are the people who get elected to do so. His audits also found (unintentionally) that councillors have been failing at this job going back to at least 2018.
But there was a glimmer of hope toward the tail end of the meeting. The city’s chief administrative officer Cathie O’Toole told the committee about the work that she has been doing on this file since she took over. On business continuity, executive directors have been instructed to submit their plans to her office by September which will come to the committee shortly afterwards for review. She told the committee that the city is doing an inventory and prioritization of the services the city provides for the first time since 2016.
As for risk management, she told the committee that “risk management is embedded in everything we do” (citation needed) and that it just needs documentation. She told the committee there was evidence the city is mitigating risk because the city’s fiscal position is improving, and municipal insurance claims and rates are going down. She told the committee that “all is not lost, but there’s a lot of work to be done.”
Deputy mayor Cathy Deagle Gammon told the CAO that she wants this work to be done within three months and instructed the CAO to come back with an action plan. The CAO said that’s doable, so the committee should see that action plan no later than September 17, 2024.
