Audit of Supervisory Processes – SIBs Management Action Plan
Management Response to the Audit
We appreciate the work completed by Audit. The process has been collegial with good communication between the teams.
The supervision sector is focused on applying a risk-based approach to our processes including planning, review work, and approvals. A focus on risk is the basis of a number of OSFI Blueprint initiatives including the update to the Supervisory Framework, and the introduction of a Risk, Strategy and Governance Office and appointment of a Chief Risk Officer. We agree with Audit’s points on the need to formalize and document our existing approaches and also see an opportunity to rely on planned Blueprint work which will address a number of the findings over the longer term.
We are providing our management action plan below to address the findings.
Recommendation 1 (High Risk):
The SIBs Group should ensure that the annual planning process aligns planned supervisory activities with the frequency and nature of work required by the sector Risk Tolerance Framework, and enhance current tools to support effective resource planning for all activities.
Accountability: Head, Supervision, Methods, Standards and Controls (SMSC)
Target Overall Completion: Q2 2024-25
Planned Actions to Support the Recommendation
The SIB Teams and Supervision sector are focused on making decisions driven by our risk appetite. This will include aligning our planning with our formally defined enterprise risk appetite which is currently in progress as part of OSFI’s blueprint transformation efforts.
Milestone 1
Target Milestone Completion: Q3 2022-23 (planning for 2023-24 cycle)
For the period for Fiscal 2023-24, a planning approach will be utilized that will begin the transition to the new Supervisory Framework. The interim planning process (to be developed) will align with the Conceptual Design, the consolidated Supervision sector Risk Tolerance Framework (RTF) and will include capacity considerations. The development of the Supervision sector RTF will be contingent upon completion of the OSFI wide RTF in the fall of 2022. Once established, the interim approach will be communicated via training/info sessions to Supervision staff.
Milestone 2
Target Milestone Completion: Q2 2024-25
Longer term, the relevant policy instruments and processes will be updated including approaches to risk-based planning. Per the conceptual design, information decay will no longer be a driver of supervisory work. Training/info sessions will be provided to Supervision staff.
Recommendation 2 (Medium Risk)
The SIBs Group should ensure that the annual planning process tracks significant non-review changes to the planned supervisory work, and formally incorporates the risks monitored at the Business Risk Committee
Accountability: Head, SMSC
Target Overall Completion: Q3 2023-24 (for 2024-25 supervisory cycle)
Planned Actions to Support the Recommendation
The SIB Group conducts an annual planning process and adjusts its plans during the year based on the evolving risk environment, among other factors. Adjustments to significant activity reviews are tracked. The Supervision sector plans to incorporate tracking of other, non-review related work per Audit’s recommendation. Additionally, the SIB teams began incorporating a mapping of Business Risk Committee identified risks in its planning process earlier this year. We will formalize this as set out in Milestone (2) below:
Milestone 1: Tracking of non-review changes
Target Milestone Completion: Q3 2022-23
- Given the significant changes that have occurred as a result of the reorganization, and the impending supervisory framework changes, the supervision sector will be undergoing an exercise to revisit both the current year’s plan as well as the manner in which we conduct our future planning. Top-down prioritization needs to occur over the summer to determine how to proceed.
- The supervision central office team (COT) will be engaged in the prioritization of planned work and will work with supervision management to determine the appropriate tracking and ensure it aligns with managements expectations.
Incorporating risks monitored at the BRC as well as the Industry Risk Report into the planning process
Milestone 2
Target Milestone Completion: Q4 2022-23 (planning for 2023-24 cycle)
LS to note the BRC risks related to the FRFI being supervised as part of the FRFI’s supervisory strategy, and/or the supervisory plan for a collective group of FRFI’s. The Supervisory Strategy will clearly outline the institutional-specific and macro environmental risks considered by the LS team when developing the supervisory response/activities.
Milestone 3
Target Milestone Completion: Q3 2023-24 (planning for 2024-25 cycle)
Longer term, the External Factors box in the Conceptual Design of the Supervisory Framework will provide an opportunity for the Strategy, Risk and Governance Sector to provide Supervisors with a direct link to the BRC risks. Details are being developed. Training to all Supervision staff will include the approach related to the External Factors component.
Recommendation 3 (Medium Risk)
The SIBs Group should define and document expectations for the assessment of FRFI action plans, and how the results of the assessments should be communicated to FRFIs when warranted.
Accountability: Head, SMSC
Target Overall Completion: Q2 2024-25
Planned Actions to Support the Recommendation
SIB teams conduct ongoing work related to open FRFI findings and recommendations and review adequacy of action plans. The Supervision sector plans to formalize and document the assessment of FRFI action plans and communication of same:
Milestone 1
Target Milestone Completion: Q4 2022-23
SMSC will prepare a brief one-page interim addendum for supervisors regarding expectations for the assessment of FRFI action plans and how the results of those assessments should be communicated to FRFIs, where appropriate.
Milestone 2:
Target Milestone Completion: Q2 2024-25
The impacted Policy Instruments, including Standards, will be reviewed and updated to align with the revised Supervisory Framework. The updates to the Policy Instruments will align with actions taken to address Internal Audit’s recommendations and apply to the consolidated Supervision Sector. As impacted Policy Instruments are updated, training/info sessions will be provided to Supervision staff.
Recommendation 4 (High Risk)
The SIBs Group should define and document expectations for monitoring target completion dates, target date extensions, and issue closure effort to ensure that issues are followed up according to the agreed-upon target dates and closed in a timely manner and with appropriate supporting documentation.
Accountability: Head, SMSC
Target Overall Completion: Q2 2024-25
Planned Actions to Support the Recommendation
Supervisors within the SIB Group conduct ongoing monitoring of their supervised institution(s) and review and track open issues as part of that process. The Supervision sector will formally document expectations related to this process per Internal Audit’s recommendations:
Milestone 1:
Target Milestone Completion: Q4 2022-23
Short term, SMSC will prepare a brief one-page interim addendum for supervisors in response to the finding.
Milestone 2:
Target Milestone Completion: Q2 2024-25
The impacted Policy Instruments, including Standards, will be reviewed and updated to align with the revised Supervisory Framework. The updates to the Policy Instruments will align with actions taken to address Internal Audit’s recommendations and apply to the consolidated Supervision Sector. As impacted Policy Instruments are updated, training/info sessions will be provided to Supervision staff.
Recommendation 5 (Medium Risk)
The SIBs Group should implement supplementary validation controls to ensure the accuracy and completeness of source data to support performance monitoring and reporting.
Accountability: Head, SMSC
Target Overall Completion: Q1 2023-24
Planned Actions to Support the Recommendation
A number of KPIs are tracked within OSFI’s new system of record (VU). We recognize with the implementation of the system there may be inaccuracies and inconsistencies as the teams adapt to revised definitions and processes. Management is comfortable with existing controls such as required field validation controls. The focus will be on training staff on existing Vu controls and related processes. Given the changes that will be made to Vu to align with the revised Supervisory Framework, management will reassess if additional validation controls in Vu are required.
Milestone 1:
Target Milestone Completion: Q4 2022-23
SMSC to prepare a brief interim addendum/document for supervisors regarding timeliness, type of information to input, cell/location to input.
Milestone 2:
Target Milestone Completion: Q1 2023-24
Once established, training/info sessions will be provided to Supervision staff
Recommendation 6 (Medium Risk)
The SIBs Group should standardize the minimum evidence requirements for review and approval to ensure quality of supervisory work.
Accountability: Head, SMSC
Target Overall Completion: Q2 2024-25
Planned Actions to Support the Recommendation
Milestone 1:
Target Milestone Completion: Q4 2022-23
SMSC to prepare a brief interim addendum for supervisors clarifying/reaffirming the minimum evidence requirements for review and approval across the consolidated Supervision sector. This will take into consideration the restructuring of Supervision, related changes to approval authorities, and the detailed build out of the Conceptual Design. Once updated, training/information sessions will be provided to Supervision staff.
Milestone 2:
Target Milestone Completion: Q2 2024-25
The impacted Policy Instruments, including Approval Authorities Standard and the Exercising Approval Authorities in Vu Guide, will be reviewed and updated to align with the revised Supervisory Framework. The updates to these Policy Instruments will align with actions taken to address Internal Audit’s recommendations and apply to the consolidated Supervision Sector. As impacted Policy Instruments are updated, training/info sessions will be provided to Supervision staff.
Additional Guidance
- The number of milestones will vary based on the actions required. While the template has three milestones populated for each recommendation, this is not considered a suggested number, and proposed actions may have more or fewer milestones.
- For both date columns, it is suggested to use ends of quarters and fiscal years (ex. “Q4 2022-23”) rather than specific dates (ex. “March 1, 2023”), unless there is a predetermined date that has already been accepted.
- The final Target Milestone Completion should be aligned with the Target Overall Completion.