Enterprise Risk Management Policy 45-000 | Effective Date: September 29, 2016

Purpose 

The purpose of enterprise risk management (ERM) is to support WorkSafeNB in its pursuit of its organizational goals and objectives.  

This will be accomplished by:

• Integrating risk management principles into WorkSafeNB’s culture;
• Embedding risk management into the decision-making process;
• Proactively identifying and managing risks at all levels of the organization; and
• Training employees and raising awareness of the need for proper risk management. 

Scope 

This policy applies to all activities, policies, procedures, plans, property, and individuals that constitute WorkSafeNB. 

Statements 

1.0 Background 

WorkSafeNB has a legislated responsibility to serve New Brunswick’s workforce and its business community in a variety of ways. However, the activities, resources, and infrastructure needed to deliver upon these responsibilities expose the organization and its stakeholders to varying degrees of risk. 

ERM is a proactive and systematic approach to identifying, understanding, managing and communicating risks that may impact WorkSafeNB’s ability to achieve its objectives. 

WorkSafeNB’s disciplined approach to ERM results in more informed decision-making, strengthened management practices, and the consistent achievement of organizational goals and objectives. ERM also supports continuous improvement by enabling WorkSafeNB to manage the risk that is inherent in innovation. 

2.0 Policy Statements 

WorkSafeNB’s ERM discipline enables the organization to understand, manage, and communicate risk from an organization-wide perspective. 

WorkSafeNB is committed to:

• Embedding risk management principles into the culture of WorkSafeNB, making the identification and treatment of risk everyone’s shared responsibility;
• Applying a consistent approach to risk management at all levels of the organization;
• Integrating risk management activities into operations, activity planning, project planning, strategic planning, and resource allocation decisions; and
• Anticipating and responding to external pressures, such as those arising from the social, environmental, political, technological, and legal environment. 

WorkSafeNB develops and advances an ERM policy, process, and framework. Collectively, these define WorkSafeNB’s approach to risk management. WorkSafeNB periodically reviews these components and makes updates as required. 

WorkSafeNB’s Board of Directors establishes the risk appetite and risk criteria for the organization, and provides oversight for the ERM program. 

The Executive Leadership Team ensures that the appropriate level of resources are allocated to support the risk management process and to those accountable and responsible for managing risk. 

Risks are identified through the risk management process, which is integrated into WorkSafeNB’s planning processes and management activities. At a minimum, WorkSafeNB engages in a comprehensive, organization-wide risk identification and assessment activity in conjunction with its annual strategic planning process. Also, projects of significant scope or size require risk management to be incorporated into the project management process. 

Management identifies new risks and reports on changes to existing risks when planning projects, launching new initiatives, and when evaluating operations. Management develops risk treatment plans for risks that are determined to be in excess of WorkSafeNB’s risk appetite. 

Internal Audit monitors compliance to the ERM policy and process, and will recommend improvements to the ERM discipline. 

3.0 Risk Management Principles 

In a mature ERM culture, every member of the organization is familiar with the principles of risk management, participates in the management of risk within their area of responsibility, and escalates those risks beyond their scope of authority. 

WorkSafeNB recognizes the risk management principles articulated in ISO 31000:2009. They are as follows: 

1. Risk management creates and protects value. 

New Brunswickers rely on WorkSafeNB to promote safety and provide care for New Brunswick’s workforce in a responsible and sustainable manner. By assessing and managing its risk, WorkSafeNB ensures that adversity will not erode the value that the organization creates for New Brunswickers, providing assurances that WorkSafeNB will reach its goals and deliver upon its responsibilities, in spite of forces to the contrary. 

2. Risk management is an integral part of all organizational processes. 

At WorkSafeNB, risk management is not a stand-alone activity that is separate from the day-to-day activities of the organization. Rather, risk management is integrated as a key consideration in all aspects of its business including the planning, execution, and evaluation of activities.

3. Risk management is part of decision-making. 

WorkSafeNB uses a structured approach to identifying and evaluating risk as part of its decision-making process, helping decision makers make informed choices.  

4. Risk management explicitly addresses uncertainty. 

WorkSafeNB’s ERM manages the effects of uncertainty on WorkSafeNB’s ability to reach its objectives. By its very nature, ERM deals exclusively with events that have not yet happened – in contrast to organizational responses to those events which have already taken place. 

5. Risk management is systematic, structured and timely. 

WorkSafeNB is disciplined in its approach to ERM ensuring that risk is identified, evaluated, and treated in a consistent, effective, and time-sensitive manner. 

6. Risk management is based on the best available information. 

WorkSafeNB makes every reasonable effort to ensure its risk management is rooted in reliable, accurate, and relevant data. Data can be both qualitative and quantitative, and can be derived from a number of sources including: historical data, experience, forecasts, stakeholder feedback, observation, and expert opinion amongst other sources. 

7. Risk management is tailored. 

Every organization is exposed to risk in unique ways based on the type of activities the firm engages in. WorkSafeNB tailors its risk management strategies and processes to most adequately address the risk it faces. 

8. Risk management takes human and cultural factors into account. 

WorkSafeNB considers the capabilities, perceptions, values, and intentions of its stakeholders (internal and external) as considerations within the risk management process. 

9. Risk management is transparent and inclusive. 

Appropriate and timely involvement of stakeholders and decision makers at all levels of the organization ensures that risk management remains relevant and up-to-date. Involvement of key stakeholders also allows for their views to be taken into account when assessing potential impacts of a particular risk. 

10. Risk management is dynamic, iterative and responsive to change. 

WorkSafeNB will remain agile and flexible in its approach to risk management. WorkSafeNB will continue to adapt its risk management strategies and tactics to adapt to an ever changing landscape in order to adequately manage new and emerging risk. 

11. Risk management facilitates continual improvement of the organization. 

Risk management at WorkSafeNB is designed to facilitate continuous improvement and growth for the organization. This includes continual improvement of the risk management discipline itself. 

4.0 Roles and Responsibilities 

The roles and responsibilities of the parties involved in the risk management process are as follows: 

Board of Directors

• Defines the risk management philosophy, risk appetite, and risk criteria for WorkSafeNB;
• Reviews key risks and determines if they are within WorkSafeNB’s risk appetite;
• Approves the ERM policy and amendments to the policy; and
• Provides oversight to the risk management process.

Executive Leadership Team

• Supports and endorses the ERM policy, framework, and process;
• Ensures integration of risk management into strategic plans, project plans, and objective setting;
• Develops strategic risk management plans;
• Delegates risk management to their management teams; and
• Monitors the effectiveness of the risk management process.

Management

• Incorporates risk management into their planning, processes, and management activities;
• Develops risk treatment plans for risks that are in excess of WorkSafeNB’s risk appetite;
• Develops strategies for capitalizing on opportunities; and
• Monitors and reports on the status of risks and risk management plans.

Internal Audit

• Monitors compliance to the ERM policy; and
• Recommends amendments to the ERM policy, framework, and process.

Planning and Policy

• Develops and maintains the ERM framework;
• Provides risk management training, guidance and direction; and
• Co-ordinates and facilitates the overall ERM process.

All Staff

• Develop and maintain an understanding of WorkSafeNB’s risk management principles; and
• Report identified risks to management.