Audit of Human Capital Management

1. Background

OSFI relies on a highly skilled workforce in order to deliver on its mandate and to maintain its reputation as a principles-based, prudential regulator and supervisor of Canada’s financial services industry. In alignment with its priorities, OSFI’s operations should be effective and agile, which means the organization must have the people, skills and infrastructure to meet its needs and be able to leverage them in a timely and effective manner.

Over the past decade, OSFI has not only doubled in size, but has done so while operating in a highly complex, fast-evolving environment, and while facing competition for its highly skilled labour from the private sector. Effective Human Capital Management (HCM) is crucial to OSFI to ensure it can hire, cultivate and retain the right people with the right skill set to meet organizational needs. With a strategic outlook that includes significant transformation initiatives, such as the transition to a hybrid work environment and the OSFI Blueprint, effective and efficient HCM processes are essential to OSFI’s ability to achieve its goals.

Defining Human Capital Management

Based on relevant sources such as Treasury Board’s Policy on People Management, HCM was defined to include the following elements for the purposes of this audit:

• Recruitment: the process of actively seeking out and hiring candidates for a specific position or job, from initiating the hiring process to the individual’s onboarding.
• Talent management: the processes through which organizational human capital needs are identified, and the planning to meet those needs.
• Performance management: an ongoing process that involves planning, coaching employees, providing feedback, evaluating performance, and enabling employee development.
• Learning and development: processes to support ongoing learning in the workplace, including delivering courses and events, providing training resources, and identifying growth opportunities.
• Succession planning: the process of identifying key positions in the organization and developing a talent pipeline, through employee development and training, to fill those positions as they become vacant.

In addition to a number of internal policy and guidance instruments, OSFI’s HCM activities must respect certain government-wide policies and frameworks in place over people management, which include but are not limited to:

• Public Service Employment Act
• Public Service Commission Appointment Delegation Accountability Instrument

The goals of these policies and frameworks are to establish accountability and provide a foundation for developing and sustaining a high-performing workforce, while ensuring good governance, and service to Canadians. While the policies and frameworks outline various compliance elements, roles and accountabilities, each organization is responsible for the design and implementation of their own compliant HCM practices.

Human Capital Management at OSFI

The Human Resources Division (HR) at OSFI is responsible for developing policies and programs to support effective HCM, as well as providing administration and other support services to OSFI employees in all areas of human capital management. The operating model for HR is currently mixed, acting both as a centre of expertise for sectors and as a functional service provider. This has resulted in some human capital management activities being centralized within HR and others being led by the individual sectors.

HR is also responsible for the creation and implementation of the OSFI Human Capital Strategy, which includes six current priority areas:

• Leadership Development
• Integrated Talent Management
• Learning and Development
• Culture and Community Building
• Enterprise Change Management
• Workforce Planning (released in 2021)

As HCM at OSFI has both centralized activities within the HR function and decentralized delegated authorities and activities within OSFI sectors, both areas were included within the scope of the audit.

Previous audit engagements

There has been no internal audit coverage over the elements of HCM in the previous 5 years.

2. About the audit

2.1 Objective

The objective of the audit was to assess the adequacy and effectiveness of OSFI’s human capital management operating model in supporting alignment with TB’s Policy on People Management.

2.2 Scope

The audit covered OSFI’s HCM operating model inclusive of policies, programs, procedures, tools and related processes (both at the organizational and sector levels), including HR planning, related to the following elements of human capital management:

• Recruitment
• Performance management
• Talent management
• Learning and development
• Succession planning

The audit focused on the period from April 1, 2019 to June 30, 2021 and included an assessment of the following:

• The design and operating effectiveness of key human capital management programs, policies, guidance and tools across OSFI sectors; and
• The integration of planning and reporting, both formal and ad hoc, on human capital management activities.

Based on recent inception or creation, the following two areas were excluded:

• Diversity, Equity, and Inclusion, as it is a new program created in May 2021.
• OSFI’s Workplace Harassment and Violence Prevention Policy and supporting directives, as this policy came into effect in February 2021.

The audit also did not include detailed testing of transactions, such as staffing activities, pay files or performance management assessments.

2.3 Approach and methodology

The audit was conducted through performance of the following procedures:

• Reviews of applicable policies, procedure, tools and guidance;
• Interviews with various employees within HR and representatives for each sector, responsible for HCM; and
• Reviewing established programs and process-level activities, including design and implementation.

2.4 Statement of conformance

This audit was conducted in conformance with the Institute of Internal Auditors’ International Standards for the Professional Practice of Internal Auditing, consistent with the TB’s Policy on Internal Audit, and as supported by the results of the Quality Assurance and Improvement Program.

3. Overview of audit results

3.1 Summary of results

There is a defined Human Capital Strategy in place and policies, programs, guidelines and tools are available to support Human Capital Management (HCM) at OSFI. HR has defined processes in place to support clients in areas such as staffing, performance management, and learning and development. Opportunities for improvement were identified in areas such as process integration and performance measurement for new and established HCM initiatives, a cohesive approach to risk management, defining roles and responsibilities, and modernizing systems to inform HR operations.

3.2 Management response

Management accepts the findings and has identified Management Action Plans with associated timelines for each recommendation as outlined in the relevant sections.

4. Observations and recommendations

4.1 Operating model

Human Capital Strategy

In 2016-17, HR developed the Human Capital Strategy (“Strategy”), which is intended to be a roadmap to ensure that OSFI has the right workforce to position it for the future. As part of this undertaking, HR identified a number of priority areas, identified goals within each of these areas, and implemented a variety of new initiatives and programs to achieve these goals. These include a succession planning exercise for Executive Committee members, talent management initiatives, a new learning and development (L&D) model, and compliance monitoring over hiring and promotion related policies.

However, when these new initiatives were launched, existing programs and processes were not formally integrated. Consequently, while HR has since undertaken a variety of exercises and initiatives, these activities do not appear to inform or rely on each other. Additionally, while new initiatives are being introduced, there are no mechanisms to ensure that existing initiatives remain current or become effectively integrated. As a result, activities may be duplicative, or their results may not be aligned.

A lack of clarity in these areas has also impacted HR’s ability to consistently implement initiatives across sectors, and sectors indicated a lack of clarity around how centralized HCM initiatives are to be integrated into their individual processes. HR-developed tools to support sector-level processes were also suggested to be limited by sectors, and some sectors indicated that they have developed their own processes or tools to replace or supplement HR’s tools.

For example, although both were launched as part of the 2017 Strategy, talent management processes were not presented as being linked to the L&D program, limiting how learning opportunities were used to support effective talent management. Due to the lack of integration between talent management and L&D, sectors have implemented supplementary processes to link the two areas. Similarly, Sectors have also developed additional tools to support talent management processes as HR tools were felt to be insufficient. Due to these gaps, sectors may not meaningfully engage with HR initiatives, resulting in inconsistent processes across OSFI.

Without a defined integrated approach for HCM, which demonstrates how individual programs are driven by organizational goals and how sectors play a role in these programs, HCM practices may not be consistent across sectors and degrade OSFI’s ability to meet its strategic and business objectives.

Performance measurement of Human Capital Management

HR has implemented a number of new initiatives as a result of the Strategy, as well as to address emerging areas of focus, such as Diversity, Equity, and Inclusion (DEI). For these initiatives and the Strategy as a whole, completion progress is provided to senior management and oversight committees. As these new initiatives are being implemented, there are also some elements of monitoring in place, including establishing timeline targets, progress monitoring, and Key Performance Indicator (KPI) reporting to oversight committees.

However, there is no defined process for monitoring and evaluating how effective these initiatives are at meeting the program and organizational goals. While the implementation of the Strategy was estimated to be 90% complete, this measurement does not assess whether the implementation of the Strategy was effective at meeting the goals that were outlined, and whether OSFI’s overall positioning is now more aligned to its operational goals.

For programs that have already been fully implemented, HR collects some on-going performance information and feedback for some programs through manual processes, including the Learning and Development (L&D) program post-completion surveys, the annual employee survey, and lessons learned exercises conducted after pilot programs/activities. However, without defined performance criteria, these results are not linked back to the Strategy or measured against established goals, so it is unclear whether these initiatives continue to achieve program and strategy-level objectives.

Without defined measures in place to measure, monitor and report on success, the effectiveness of new initiatives at achieving strategic goals may not be understood and could prevent OSFI from meeting its HCM objectives.

4.2 Human capital risk management

 

In 2018, OSFI defined its human capital risk as the risk that OSFI doesn’t have the right people in place with the right skill set to meet organizational needs. This risk impacts every sector of the organization as all sectors rely on their staff to meet organizational goals. Although human capital risks have been defined as a specific risk area, there are various gaps in OSFI’s ability to perform effective risk management over these areas.

Current risk management practices for human capital risks are not cohesive and operate independently of each other, without tying into a broader organizational risk management process or reporting to senior management. While this has been identified to be an issue across OSFI, a lack of strategic direction and defined risk appetite related to human capital risks limit HR’s ability to assess and respond to risks in an appropriate manner. This is especially relevant as HR has undertaken a number of new programs in recent years, and OSFI has experienced significant growth, both of which impact the level of risk undertaken.

There are multiple HR activities that could inform a cohesive risk management approach, such as: the annual employee engagement survey; focused surveys, such as those undertaken in relation to DEI initiatives; and internal focus group exercises, such as those conducted to create the Strategy and the L&D model. Additionally, during the succession planning exercise and the TM exercise for executive employees, critical positions were identified and ranked for risk areas related to potential departure and ability to resource.

Human capital risks are also discussed informally within sectors as part as everyday people management discussions or hiring discussions. For specific elements of human capital risk, such as retention and risk managing positions, sectors have their own divisional or sector-level processes. While most of these are also informal, processes over staffing at a division level were noted to be well-defined and implemented.

All of the above activities could help to inform OSFI’s overall HCM risk posture, but without a cohesive approach and alignment to overall objectives, OSFI may not be in a position to identify strategic HCM risks effectively, or to develop mitigation strategies to address them.

4.3 Roles and responsibilities for HCM

 

The operating model for HCM at OSFI is a mixture of some centralized activities and some activities undertaken by individual sectors. For example, learning and development programs reside both within HR and within sectors, such as the Managing Essentials Program (managed by HR) and the Regulatory Officer Development Program (managed by a sector). Additionally, staffing requires advice, process management, and coordination from HR, while sectors develop much of the candidate assessment tools, and own the ultimate decision. As a result, people leaders and managers are essential partners in the delivery and success of HCM initiatives and must clearly understand their roles and responsibilities in order to fulfill them.

HR undertook an internal review of their operating model in 2020, which included surveying clients as well as the internal HR team. This exercise identified several service level enhancements and opportunities for efficiencies that both clients and the HR team felt were required to fulfill OSFI’s HCM needs. One of the opportunities for efficiency identified by both the clients and the HR team related to clarifying roles and responsibilities related to HCM.

Management indicated through this exercise that they required additional support from HR in relation to HCM, and HR identified there was no additional capacity in the current decentralized model to provide this support, as managers and people leaders are intended to perform HCM. It was felt by both HR and the sectors that people managers were not fully empowered to perform HCM. Sectors also had varying opinions on how HR supports them in fulfilling their role in the processes, with some indicating that support was effective, while others indicated that support was impeded by layers of administration.

While roles and responsibilities are documented for some programs, including sector-level development programs and talent management programs, both sectors and HR expressed concerns about the level of clarity regarding overall roles and responsibilities for HCM. The level of engagement in HCM activities varies across people managers and in turn the requirement for HR to take on the additional responsibilities related to operational HCM varies across OSFI clients. HR indicated there is an expectation of providing OSFI clients with a “white glove service,” which requires significant involvement from HR and less from people managers.

Additionally, there are no mechanisms to establish accountability for the role that people leaders and managers are expected to play within the HCM process. Without defining a process to link HCM responsibilities to other accountabilities in their role, people managers’ performance in this area cannot be measured. This can not only result in a potential lack of fulfillment of roles and responsibilities, but also reduces OSFI’s ability to assess when people managers may not have the right training or skills to fulfill their responsibilities.

As OSFI evolves and transforms, its HCM needs will become more complex and further highlight the need for a common understanding of how HR and the sectors fit into the HCM processes. Without clear and measured roles, responsibilities, and accountabilities for HCM objectives for people managers, there is greater risk of inconsistencies, leading to potentially inefficient or ineffective processes.

4.4 Information available to support HCM

 

When leveraged effectively, HR data is a key tool in generating insights related to HCM, and can have a huge impact on OSFI’s ability to achieve its strategic goals. HR collects various kinds of data, including employee data, staffing activities, pay data, and leave information. However, this data is not currently used to support planning or decision-making.

Current HR systems are dated, with some being over 20 years old, and these systems operate independently from each other and without integration. These systems are reliant on manual data entry and review processes to ensure consistency and accuracy, and have little capacity for automation. Due to these system limitations, reporting options are limited, and generating reports creates a resource burden and reduces the capacity available for other HR activities. For example, staffing information is manually entered and significant resources are required for basic KPI tracking and reporting. As a result, there are only a few defined metrics using data, which include year-end reporting on annual turnover and length of time for staffing processes.

Information limitations are also felt at the sector level, and sectors do not feel that they receive sufficient HR information to support their HCM activities. While some sectors have established reporting metrics, these rely on ad-hoc information requests from HR, which are not easily generated in a timely fashion. For example, one sector has defined a retention metric as time spent in the position, which relies on information collected by HR. However, this information is often provided past their reporting cycle and has to be reported separately to sector senior management.

While systems modernization has been identified as a goal in internal planning, limited investments in HR systems have been made. A new HR metrics project is set to be launched in Q1 2022-23, with the goal to better enable reporting through establishing a common database. However, the project is still in early stages, and benefits cannot currently be measured.

The capacity of current HR systems is limited and requires significant manual manipulation which restricts HR’s capacity for other priorities, and provides limited information on HCM. Without timely, accurate, and easily accessible information, people managers’ ability to make effective and well-informed decisions has likely already been impacted, and will continue to be impacted for the foreseeable future.

Appendix A – Recommendation ratings

Recommendations are ranked in order to assist management in allocating resources to address identified weaknesses and/or improve internal controls and/or operating efficiencies. These ratings are for guidance purposes only. Management must evaluate ratings in light of their own experience and risk appetite.

Recommendations are ranked according to the following definitions:

• High Risk: should be given immediate attention due to the existence of either a significant control weakness (i.e. control does not exist or is not adequately designed or not operating effectively) or a significant operational improvement opportunity.
• Medium Risk: a control weakness or operational improvement that should be addressed in the near term.
• Low Risk: non-critical recommendation that could be addressed to either strengthen internal control or enhance efficiency, normally with minimal cost and effort. Individual ratings should not be considered in isolation; and their effect on other objectives should be considered.