Corporate Governance
December 2009
Table of Contents
- Introduction
- Risk Addressed by the Audit
- Objective
- Scope
- Overall Audit Opinion
- Statement of Assurance
- Summary of Internal Control Strengths
- Summary of Internal Control Weaknesses
- A: Audit Criteria and Conclusions
- B: CIHR Governance & Management Committee Structure
- C: Governing Council Committees
- D: TBS Management Accountability Framework
Executive Summary
Introduction
The Internal Audit of Corporate Governance is part of the Risk-Based Annual Internal Audit Plan 2009-10 approved by the Canadian Institutes of Health Research (CIHR) Governing Council (GC).
The Canadian Institutes of Health Research (CIHR)
The CIHR Act that came into force on June 7, 2000, established a corporation known as the Canadian Institutes of Health Research. CIHR is a Departmental Corporation listed in Schedule II of the Financial Administration Act (FAA). An arms-length agency of government, it is accountable to Parliament through the Minister of Health. CIHR has one business line: to achieve excellence in the creation of new knowledge through research and its translation into improved health for Canadians, more effective health services and products, and a strengthened health-care system. As part of the federal government's investment in health research, CIHR supports more than 13,000 researchers and trainees and 13 "virtual" Institutes, each headed by a Scientific Director who is assisted by an Institute Advisory Board (IAB). CIHR's Institutes are neither buildings nor research centres, but networks of researchers brought together to focus on important health problems. Each Institute is dedicated to a specific health-related area and links and supports researchers pursuing common goals.
CIHR Corporate Governance Framework
CIHR's corporate governance framework is laid out in the CIHR Act. CIHR is led by its President. The President serves also as the Chair of Governing Council, which is responsible for the management of CIHR, including:
- developing its strategic directions, goals, and policies;
- evaluating its overall performance, including achievement of its objective;
- approving its budget;
- establishing a peer review process for research proposals made to the CIHR;
- approving funding for research;
- approving other expenditures to carry out its objective;
- establishing policies for consulting and collaborating with persons and organizations that have an interest in health research; and
- dealing with any other matter that the Governing Council considers related to the affairs of the CIHR.
With some exceptions including (a) and (c) and specific responsibilities for the Institutes, GC may delegate any of its powers, duties, and functions to any of its members or committees, the President or an Institute, an Advisory Board or a Scientific Director. Scientific Directors and their Advisory Boards work under the guidance of GC.
To help it in the discharge of its duties, GC has established an Executive Committee and six Standing Committees, namely, Standing Committee on Finance and Planning, Nominating and Governance Committee, Standing Committee on Corporate Performance and Outcomes, CIHR Audit Committee, Standing Committee on Ethics, and Stem Cell Oversight Committee. Day-to-day management of CIHR is led by the President. The Executive Management Committee (EMC), which comprises senior management and is chaired by the President, provides leadership on corporate policy and management. The Scientific Council (SC), a management-level committee, develops, implements, and reports on CIHR's research and knowledge translation strategy, in accordance with the CIHR Act and the overarching strategic directions set out by GC. SC is mandated by GC to approve the funding for research and knowledge translation initiatives. The President and Committee Chairs provide regular accountability reports to GC. Appendix B contains an illustration of the Governance and Management Committee Structure.1 Appendix C contains descriptions of the GC Committees as posted on the CIHR website.
Risk Addressed by the Audit
The audit addresses the risk that the corporate governance framework may not adequately support the achievement of CIHR's mandate. This risk is related to the Governance and Strategic Directions, Accountability, and Results and Performance elements of the Treasury Board Secretariat's (TBS) Management Accountability Framework:
- The essential conditions – internal coherence, corporate discipline, and alignment to outcomes – are in place for providing effective strategic direction, support to the minister and Parliament, and the delivery of results.
- Accountabilities for results are clearly assigned and consistent with resources, and delegations are appropriate to capabilities.
- Relevant information on results (internal, service, and program) is gathered and used to make departmental decisions, and public reporting is balanced, transparent, and easy to understand.
Objective
The audit objective is to assess the adequacy of CIHR's corporate governance framework (structures, processes, and information) necessary for:
- Setting, giving, and managing strategic direction for core activities to achieve CIHR's mandate.
- Holding management to account for implementing the strategic direction.
Scope
The audit focuses on corporate governance and accountability2 relationships internal to CIHR and not between CIHR and the Minister and Parliament. In other words, it addresses the respective and complementary roles, responsibilities, and levels of authority of Governing Council; Executive Committee, Standing Committees of Council; President; Executive Management Committee; and Scientific Council. It spans the CIHR mandate, but excludes subordinate governance and accountability within CIHR's programs and functions.
Overall Audit Opinion
The audit has concluded that the corporate governance framework at CIHR has moderate issues: there are control weaknesses, but overall risk exposure is limited because either the likelihood or the impact of the risk is not high, and because management has already recognized the weaknesses and has initiated its mitigating actions.
Statement of Assurance
The audit of corporate governance was conducted in accordance with the Federal Government Policy on Internal Audit and related professional standards. In my professional judgment as Chief Audit Executive, sufficient and appropriate audit procedures have been performed and evidence gathered to support the accuracy of the opinion provided in this report. The audit opinion is based on a comparison of conditions that existed at the time of the audit against established audit criteria that were agreed upon with management.
Summary of Internal Control Strengths
CIHR has implemented the following key elements of corporate governance:
- There is a corporate governance structure in place to direct, manage, and monitor the activities of the organization toward the achievement of its objectives.
- There is a corporate governance process in place to direct, manage, and monitor the activities of the organization toward the achievement of its objectives.
- The roles and responsibilities of the various elements of the governance structure are clearly defined and communicated.
- The roles and responsibilities for the various elements of the planning process are clearly defined and communicated.
- The planned activities:
- are consistent with the organization's mandate and government priorities,
- give due consideration to factors such as the external environment, risks, options, stakeholders, available resources, organizational strengths and weaknesses, and potential impacts,
- manage risks related to strategic options, proposed courses of action, objectives, and expected results, and
- are communicated to staff and implemented throughout the organization.
- Management uses the strategic and annual plans to manage for results:
- Management has established clear accountabilities and responsibilities for due process and results.
- There is segregation of incompatible duties for key management functions.
- Delegations are appropriate to responsibilities and are regularly reviewed.
- Personal Performance Plans contain cascading commitments and an alignment of individual with corporate commitments.
Summary of Internal Control Weaknesses
The following aspects of corporate governance require management's attention:
- Management recognizes that the strategic planning process needs to incorporate the individual plans of the 13 Institutes, and the 5-year Strategic Plan needs to be supported by measurable annual implementation plans and reports on their progress.
- Operational planning needs to be aligned more clearly at the corporate level with the Strategic Plan so that progress on the achievement of CIHR's objectives can be measured, monitored, and reported to GC for its review and reaction.
- Risks and related mitigating actions contained in operational plans need to be defined consistently, in a manner that enables them to be synthesized, inform the Corporate Risk Profile, and be managed on a corporate-wide basis.
- Roles and responsibilities need to be defined for synthesizing and summarizing the Branch operational plans into a Corporate Plan that is clearly linked to the Strategic Plan, and for monitoring and reporting on the implementation of the strategic direction.
- Accountability needs to be strengthened with periodic reporting by the CIHR President to GC on:
- the implementation of the operational plans and related progress on the Strategic Plan, and
- CIHR's performance against the Treasury Board Secretariat's Management Accountability Framework.
Internal Audit thanks management and staff for their excellent cooperation during this audit.
Dev Loyola-Nazareth, Chief Audit Executive
Steven Nimmo, Manager, Internal Audit
Michael Bazant, Internal Auditor
Canadian Institutes of Health Research
Detailed Report
Methodology and Criteria
The assessment of corporate governance at CIHR was performed through interviews with selected Governing Council members, management, and staff; review of documentation; and analysis of controls against audit criteria. Controls were deemed adequate if they were sufficient to minimize the risks that threatened the achievement of objectives.
The audit criteria are derived from:
- TBS Core Management Controls: A Guide for Internal Auditors.
- TBS Management Accountability Framework (MAF). Please see Appendix C for a graphical representation of the MAF.
- The Office of the Auditor General (OAG) Special Examinations Manual, Appendix 2: Corporate Governance Considerations in a Special Examination.
- The OAG April 2002 Report, Chapter 1: Exhibit 1.2 - A framework for new governance arrangements.
Detailed criteria and conclusions are contained in Appendix A to this report.
The audit was conducted between July and September 2009.
Observations, Recommendations, and Management Action Plan
The following are audit observations, recommendations, and management action plan to address weaknesses in corporate governance at CIHR.
| Observation | Recommendation | Management Action Plan |
|---|---|---|
| 1. Management recognizes that the strategic planning process needs to incorporate the individual plans of the 13 Institutes, and the 5-year Strategic Plan needs to be supported by measurable annual implementation plans and reports on their progress. | ||
|
To replace the Strategic Plan for 2003/04-2007/08, called the "Blueprint," Governing Council outlined the broad strategic directions for a new plan in August 2007. Based on these directions, a draft framework for CIHR's new Strategic Plan for 2009/10-2013/14, titled the "Health Research Roadmap," was developed in consultation with Scientific Directors and presented to Governing Council in June 2008. The draft framework anticipated that the new Plan would have to accommodate the vision of the incoming CIHR President. The new CIHR President arrived in July 2008, bringing his vision for CIHR. The Director, Policy and International Relations assumed responsibility for leading the strategic planning based on this vision. He obtained Executive Management Committee's (EMC) endorsement for the development of a consultative process involving the public, through a web-based survey; key partners; and face-to-face university campus meetings with the research community. The consultative process was endorsed also by Scientific Council's Subcommittee on Planning and Partnerships (SPP). As a result of the consultations, the Director produced a draft Strategic Plan in June 2009. After iterative discussions with EMC and Scientific Council, he delivered a "final" draft to Scientific Directors on July 11, 2009. The draft was submitted for Scientific Council's endorsement on July 23 and was approved by GC on August 21. The Director has identified the following two issues related to the Strategic Plan:
The intended improvements to the planning process are clearly reflected in the Strategic Plan itself. In its last section titled, "Next Steps - Implementation of Strategic Plan," the Plan states: CIHR's Strategic Plan endeavors to build on the organization's success and to support health research across the whole spectrum. We believe that our efforts to meet the health needs of Canadians will succeed only if we continue to apply the excellence-based, comprehensive approach that has become our trademark. To ensure that our Health Research Roadmap truly guides CIHR's activities, we will develop annual implementation plans that align with the directions and commitments we have set out. The desired outcome of these plans is to provide Canada's health researcher community with updates on how we are doing. Each plan will detail how the strategic directions have been addressed by highlighting uptake, progress and completion of the identified initiatives. The annual implementation plans also will identify initiatives that will be undertaken for the next fiscal year. These targeted initiatives will have been identified in consultation with Scientific Directors and senior management. Not only will these initiatives align with CIHR's Strategic Plan, they will also support the work undertaken by each of CIHR's Institutes and described within their specific strategic planning documents. The annual implementation plans will also provide measurements of progress through a series of identified performance indicators developed in association with each strategic direction. We believe that measuring our success is imperative for providing both transparency and accountability to the Canadian public. |
It is recommended that the Director, Strategic Policy and Government Relations develop and implement an action plan for:
|
Responsibility: Director, Strategic Policy and Government Relations Action: An Action Plan is in preparation for Executive Management Committee (EMC) approval on how to build an ongoing strategic planning process within CIHR. Among its key elements is a requirement to ensure that the Strategic Plans of each of CIHR's 13 Institutes are integrated with the Health Research Roadmap as well as the publication of annual implementation plans in support of the Roadmap. The annual implementation plans will set out planned goals, performance indicators and activities for the coming period as well as report on progress achieved in the preceding period. Timelines: The Action Plan and inaugural Annual Implementation Plan will be presented at Scientific Council in Q4 of 2009/10. |
| 2. There is a formal corporate planning process for developing, organizing, and implementing the annual operational plan and the annual budget. The Branch operational plans are referenced to CIHR's Strategic Priorities that are derived from the Strategic Plan. Operational planning needs to be aligned more clearly at the corporate level with the Strategic Plan so that progress on the achievement of CIHR's objectives can be measured, monitored, and reported to GC for its review and reaction. | ||
|
Both operational planning and budgeting are conducted starting at the Branch or Responsibility Centre (RC) level. The first step in developing the operational plan is for staff and the Vice-Presidents (VP) to identify the key priorities for their Portfolio/Branch for the fiscal year. Then goals and objectives of the Branch are confirmed and key risks identified. The key activities and projects that the Branch will carry out in the year are summarized and documented and interdependencies with other units and human resource requirements are determined. Core activities that are not sustainable without additional financial resources are identified. In addition, new activities that cannot be undertaken without additional resources are recognized. The draft plans are submitted to the VPs for approval along with supporting templates. As part of the approval process for the Portfolio Operating Budgets, EMC reviews activities that cannot be undertaken due to financial constraints, the cost of acquiring additional resources, and the impacts of not delivering these activities. Branch operational plans are linked to their respective budgets. Branch budgets are rolled up to the Portfolio level, which is in turn consolidated into the Corporate budget. The Standing Committee on Finance and Planning reviews and recommends the annual Corporate budget to GC. GC approves the annual Corporate budget, which includes operating forecasts. The Branch operational plans for 2009-10 state their goals and objectives and related risks and mitigating actions. Some Branch plans are rolled into the Portfolio plan, but most stand alone. There was no consolidated Corporate Operational Plan for 2009-10. There used to be a consolidation of the Branch and Portfolio plans; however, it was determined that the consolidation was unnecessary because the instructions for the development of the Branch operational plans required the identification of operational priorities that were derived from the Strategic Plan. Now that management has decided to develop annual implementation plans that align with the directions and commitments set out within the Strategic Plan, there is both reason and opportunity to summarize and synthesize Branch operational plans at the Portfolio and then Corporate level in order to show clearly how they link to and support the annualized Strategic Plan. |
It is recommended that the Chief Financial Officer (CFO) establish a process to consolidate Branch and Portfolio operational plans and link the resulting Corporate Operational Plan to the Strategic Plan. |
Responsibility: CFO Action: A process to consolidate Branch and Portfolio operational plans and link the resulting Corporate Operational Plan to the Strategic Plan will be developed as part of the 2010-11 Operational Planning Process. Timelines: Q4 2009/10 |
| 3. In accordance with annual planning and budgeting instructions from Finance, the Branch operational plans are required to state their goals and objectives and the risks and mitigating actions. In 2009-10 plans, the risks were not defined consistently, in a manner that enables them to be synthesized, inform the Corporate Risk Profile, and be managed on a corporate-wide basis. Some plans contained mitigating measures, while others did not. | ||
| Some Branches identified tactical risks (such as a lack of human and financial resources, and workload pressures) that impact the achievement of their own operational goals and objectives. Others defined the strategic risks that the non-performance of their functions would pose to the achievement of CIHR-wide goals and objectives. A process is needed to ensure that the identified risks are assessed, synthesized, and managed appropriately. | It is recommended that the CFO establish a process for managing the risks that affect the achievement of corporate operational goals and objectives. |
Responsibility: CFO Action: A Risk Management Framework was approved by Governing Council on November 19, 2009. The implementation of this framework includes the integration of risk management activities into the Operational Planning process and resulting Corporate Operational Plan. Timelines: Q4 2009/10 |
| 4. Roles and responsibilities need to be defined for synthesizing and summarizing the Branch operational plans into a Corporate Plan that is clearly linked to the Strategic Plan, and for monitoring and reporting on the implementation of the strategic direction. | ||
| Please see observations 2 and 3. | It is recommended that the CFO work with the other members of the Executive Management Committee to assign roles and responsibilities for the consolidation process in operational planning, including the linking of the operational plans to the Strategic Plan, and monitoring and reporting on the achievement of the Plan. |
Responsibility: CFO & Other Members of EMC. Action: CFO to table for EMC approval a table of roles and responsibilities for Operational and Strategic planning. Timeline: Q4 2009/10 |
5. Accountability needs to be strengthened with reporting during the year by the President to GC on:
|
||
|
GC exercises governance and monitors management's performance through its Executive Committee, Standing Committees, and Scientific Council. Executive Committee, Standing Committees, and Scientific Council are delegated with specific oversight mandates, including holding management to account for carrying out strategic direction. They provide accountability information during GC meetings, typically through reports from their Chairs. The accountability reporting needs to address the status of work commitments with more direct reference to the approved Strategic Plan. In addition to GC, the CIHR President is answerable to Treasury Board's expectations of senior public service managers for good public service management, as set out in the Management Accountability Framework. The MAF is structured around 10 key elements that collectively define "management" and establish the expectations for good management of a department or agency. The MAF is intended to provide:
Appendix D depicts the MAF. The CFO presented the 2007 TBS MAF assessment and related CIHR action plan through the Standing Committee on Finance and Planning to GC 2 years ago. |
It is recommended that the CIHR President update Governing Council periodically on:
|
Responsibility:
Action:
Timelines:
|
| 6. Governing Council members and senior management have suggested that improvements in efficiency could be made to the governance committee structure and roles and responsibilities. Director, Governance and Corporate Secretary is leading the improvement initiative. | ||
|
To help it in the discharge of its duties, Governing Council has created several committees, each with specific terms of reference: Executive Committee, Standing Committee on Finance and Planning, Nominating and Governance Committee, Standing Committee on Corporate Performance and Outcomes, CIHR Audit Committee, Standing Committee on Ethics, and Stem Cell Oversight Committee. Appendix C provides descriptions of these Committees. In addition to these committees, there is Scientific Council (SC), a management committee that has been mandated by GC to develop, implement, and report on CIHR's research and knowledge translation strategy, in accordance with the CIHR Act and the overarching strategic directions set out by Governing Council. This includes approving funding for all research and knowledge translation initiatives. SC has established three sub-committees to assist in the discharge of its mandate and decision-making responsibilities: Subcommittee on Programs and Peer Review (SPPR), Subcommittee on Performance Measurement (SPM), and Subcommittee on Planning and Partnership (SPP). The improvements being addressed by management would:
An example of a committee being considered for streamlining is the Executive Committee. The CIHR President is Chair of GC, Chief Executive Officer of CIHR, and Chair of the Executive Committee as well as the Executive Management Committee (EMC). The mandate of EMC is to provide leadership and decision-making for strategic, corporate policy and management areas that support and contribute to the strategic directions set out by GC. EMC could, therefore, assume many of the responsibilities of the Executive Committee. An example of decision-making that could be assigned directly to management is Scientific Council's (SC) role with respect to program funding decisions. In accordance with its mandate, SC makes the initial investment decision on funding a grant and awards initiative. Research implements the decision by designing the program, developing the Funding Opportunity, running the competition for funding (including Peer Review), and compiling the results of the competitive process. Research staff prepare reports on the results for presentation to the Subcommittee on Programs and Peer Review (SPPR). These reports show, inter alia, the number of applications funded and dollars allocated to each. SPPR reviews these results and recommends them for SC approval. The question being discussed was whether this level of review and approval of the results is appropriate or whether SPPR and SC should focus on the implementation of the investment decision and the adherence to due process, leaving operational decisions to program management. At its meeting on September 23, 2009, SC agreed to disband SPPR and receive the recommendations directly from the CFO and Vice-President, Research. |
No recommendation because management has already started action to address this. | |
Appendices
A: Audit Criteria and Conclusions
The audit uses the following definitions to make its assessment of corporate governance at CIHR.
| Conclusion on Audit Criteria | Definition of Opinion |
|---|---|
| Well controlled | Well managed, no material weaknesses noted or only minor improvements are needed. |
| Moderate issues | Control weaknesses, but exposure is limited because either the likelihood or the impact of the risk is not high. |
| Significant improvement required | Requires significant improvements in the area of material financial adjustments or control deficiencies represent serious exposure. |
Overall Conclusion
The audit has concluded that the corporate governance framework at CIHR has moderate issues: there are control weaknesses, but overall risk exposure is limited because either the likelihood or the impact of the risk is not high, and because management has already recognized the weaknesses and has started its mitigating actions.
| Criteria | Conclusions |
|---|---|
| Setting, Giving, and Managing Strategic Direction | |
| 1. There is a corporate governance structure in place to direct, manage, and monitor the activities of the organization toward the achievement of its objectives. | Well controlled |
| 2. There is a corporate governance process in place to direct, manage, and monitor the activities of the organization toward the achievement of its objectives. | Well controlled: Minor issue Observation 1 |
| 3. The roles and responsibilities of the various elements of the governance structure are clearly defined and communicated. | Well controlled: Minor issue Observation 6 |
| 4. There is a corporate planning process in place to organize and implement the activities needed to achieve the organization's objectives. | Moderate issues Observation 2 |
| 5. The roles and responsibilities for the various elements of the planning process are clearly defined and communicated. | Well controlled: Minor issue Observation 4 |
| 6. The planning process incorporates the identification, assessment, and management of risks related to the achievement of objectives. | Moderate issues Observation 3 |
|
7. The planning process produces:
|
Moderate issues Observations 1, 2, and 3 |
|
8. The planned activities:
|
Well controlled |
| 9. The corporate governing body approves the strategic, long-term, and annual plans. | Well controlled |
| Holding Management to Account for Implementing the Strategic Direction | |
|
10. Management uses the strategic, long-term, and annual plans to manage for results:
|
Well controlled |
| 11. The corporate governing body monitors management's performance against the plans and provides corrective direction as required. | Well controlled: Minor issue Observations 1 and 2 |
|
12. In addition to an annual performance review, there is a periodic rendering of account by management to the governing body of the fulfillment of responsibilities. The accountability reporting addresses:
|
Moderate issues Observation 5 |
| 13. Management amends plans to reflect additional, corrective direction from the governing body. | Well controlled |
B: CIHR Governance & Management Committee Structure3

EEMC: Extended Executive Management Committee
RIC: Research Integrity Committee
C: Governing Council Committees (from CIHR Website)
Governing Council has created the following committees, each with specific terms of reference. Members serve three-year terms. GC Committees meet on average three to four times per year. From time to time, membership on these committees may include people who are not members of Governing Council. CIHR's President is an ex officio member of all Standing Committees.
Executive Committee
The Executive Committee ensures that CIHR business flows in an orderly fashion and that Governing Council decisions are implemented.
Nominating and Governance Committee (N&GC)
The Nominating and Governance Committee oversees the competency-based process for recruitment of members for Governing Council, Standing Committees and the Institute Advisory Boards in keeping with succession planning best practices. N&GC is also responsible for the development, maintenance and implementation of governance policies and initiatives. Such measures, in keeping with current best practices, facilitate and improve Council's effectiveness.
Standing Committee on Ethics
The Standing Committee on Ethics identifies and provides advice on emerging ethical, legal and socio-cultural issues in health and health research
Standing Committee on Finance and Planning
The Standing Committee on Finance and Planning provides direction and oversight of CIHR's financial, budgeting and strategic planning activities.
CIHR Audit Committee
The mandate of the Audit Committee is to provide active oversight of core areas of risk, control and accountability at CIHR. The Audit Committee ensures that the President and the Governing Council have independent and objective advice, guidance, and assurance on, the adequacy of CIHR's control and accountability processes.
Stem Cell Oversight Committee
The Stem Cell Oversight Committee reviews research applications for human pluripotent stem cells and other ethically sensitive human stem cell research to ensure that they are in accordance with CIHR's Stem Cell Guidelines.
D: TBS Management Accountability Framework

- Courtesy of the Director of Governance and Corporate Secretary
- Governance is the combination of structures, processes, and information implemented by the board in order to direct, manage, and monitor the activities of the organization toward the achievement of its objectives (Professional Practices Framework, Institute of Internal Auditors (IIA)). It includes related accountability structures, processes, and performance reporting for management.
- Developed by the Director of Governance and Corporate Secretary
Supplemental content (right column)
- Modified: