Audit of Contingency Plans for the
Meteorological Service of Canada Weather Prediction Program
Audit of Contingency Plans for the
Meteorological Service of Canada Weather Prediction Program
July 27, 2007
Report Clearance Steps
Planning phase completed / November 2006Report sent for management response / May 2007
Management response received / July 2007
Report completed / July 2007
Report approved by Departmental Audit and Evaluation Committee / July 2007
This report was prepared by Environment Canada’s Internal Audit Division, Audit and Evaluation Branch.
Acknowledgements
The Audit and Evaluation Branch, Internal Audit Division, project leader, Dennis Malchuk, under the direction of Jean Leclerc, Director, would like to thank the staff of Hallux Consulting Inc. for their professional services connected with this audit. He also wishes to thank all those individuals who provided their invaluable contribution to this audit through their comments, opinions and validations.
Original signed by:
______
Stephen McClellan
Chief Audit Executive
Table of Contents
1.0 Audit Background 1
2.0 Audit Objectives 1
3.0 Audit Scope 1
4.0 Key Audit Findings/Risks 1
5.0 Audit Recommendations 2
6.0 Management Response 3
6.1 Recommendation 1 3
6.2 Recommendation 2 4
6.3 Recommendation 3 4
6.4 Recommendation 4 4
Environment Canada ii
Audit of Contingency Plans for the
Meteorological Service of Canada Weather Prediction Program
Environment Canada ii
Audit of Contingency Plans for the
Meteorological Service of Canada Weather Prediction Program
1.0 AUDIT BACKGROUND
According to Section 10.14 of the Government Security Policy (revised February 2002):
Critical services and associated assets must remain available in order to assure the health, safety, security and economic well-being of Canadians, and the effective functioning of government. Departments must establish a business continuity planning program to provide for the continued availability of critical services and assets, and of other services and assets when warranted by a threat and risk assessment.
The Meteorological Service of Canada Weather Prediction Program has been identified as a government mission-critical system, and an audit of contingency plans for the program was included as part of the 2006–2007 Departmental Audit and Evaluation Plan for Environment Canada.
2.0 AUDIT OBJECTIVES
The overall objective of the audit of contingency plans for the Weather Prediction Program was:
1. to assess how effectively contingency plans ensure that the Meteorological Service of Canada Weather Prediction Program provides continuous, uninterrupted delivery of mission-critical services in the event of an emergency or unusual event; and
2. to assess the compliance of the contingency plans with government policies and standards, including the Government Security Policy and the Operational Security Standard – Business Continuity Planning Program.
3.0 AUDIT SCOPE
Key operations included in the audit were the five regional Environment Canada Storm Prediction Centres, two collocated Canadian Meteorological Aviation Centres and a sample of specialized services, such as Nav Canada, the Department of National Defence and the Canadian Coast Guard. To further assess the level of integration and the effectiveness of the Meteorological Service of Canada contingency planning program, the audit also reviewed the three main components of the Weather Prediction Program (monitoring, production and services), as well as Canadian Meteorological Centre operations and the information technology support function.
4.0 KEY AUDIT FINDINGS/RISKS
Traditionally the Meteorological Service of Canada has relied heavily on the professionalism and expertise of its staff, supported by detailed operational procedures for contingency planning, to maintain continuity of operations for the Weather Prediction Program.
Ø This process has served the program well in the past. Sufficient audit evidence confirms that the program has never been shut down, and forecasts have never been missed because of unforeseen events.
Ø However, the Weather Prediction Program faces an increasing risk that it will not be able to maintain continuous, uninterrupted operations without a more formal, standard and integrated contingency planning program.
Ø The risk is being further complicated by such factors as these:
· Recent organizational changes have affected roles and responsibilities. For example, information technology is now the responsibility of the Chief Information Officer Branch; the 2005 departmental business impact analysis needs to be updated to reflect the new organization; and threat and risk assessments for the Meteorological Service of Canada have not been formally updated since 2000, although they are now being updated as part of the Treasury Board Secretariat Management of Information Technology Security initiative.
· Human resources pressures, such as upcoming retirements, increasing staff shortages and slow hiring/recruitment processes will affect operations.
· An increasing reliance upon new technology is having an impact on operations.
Ø The Meteorological Service of Canada Weather Prediction Program is recognized as a government-wide mission-critical system and as such, should exhibit high levels of contingency preparedness, management and response.
5.0 AUDIT RECOMMENDATIONS
All of these factors have created additional pressures and have had an impact on the overall effectiveness of the Weather Prediction Program and its compliance with government policies and standards. As a result of these key findings, we propose four recommendations:
1. That the Weather and Environmental Services Board establish a formal, integrated National Contingency Planning Program that includes a governance structure to
a) address an appropriate framework for contingency planning strategies, processes and procedures;
b) establish a national, standardized approach for the development, implementation, maintenance and testing of an integrated suite of contingency plans for the Meteorological Service of Canada; and
c) ensure formal management sign-off at various stages of contingency planning.
2. That the Weather and Environmental Services Board establish the full-time role of Meteorological Service of Canada National Contingency Planning Coordinator. The coordinator would lead the Service’s National Contingency Planning Program and would
a) report to the Board;
b) develop a national communications strategy for contingency planning;
c) work in partnership with three assigned contingency planning coordinators from the monitoring, production and services components of the Weather Prediction Program;
d) collaborate with the Chief Information Officer Branch and Workplace Services and Contracting; and
e) liaise with the Departmental Security Officer for Business Continuity Planning Program coordination.
3. That the Meteorological Service of Canada National Contingency Planning Coordinator, in conjunction with the departmental Business Continuity Planning Program Coordinator, undertake a high-level risk assessment for the Service. Subsequently, the National Contingency Planning Coordinator would collaborate with the three assigned contingency planning coordinators from the monitoring, production and services components of the Weather Prediction Program to develop formal and approved business impact analyses for each Meteorological Service of Canada component. These analyses would guide the development of contingency plans, measures and arrangements for each of the components, within the scope of the National Contingency Planning Program.
4. That, in order to meet the stated priority for contingency planning, the Weather and Environmental Services Board allocate an appropriate level of resources to successfully implement the Meteorological Service of Canada National Contingency Planning Program.
6.0 MANAGEMENT RESPONSE
The Assistant Deputy Minister of the Meteorological Service of Canada accepts the audit and its recommendations and has provided a preliminary implementation plan for the recommendations.
6.1 Recommendation 1
In response to Recommendation 1, the Weather and Environmental Services Board will establish a formal, integrated National Contingency Planning Program. We propose that this program be situated in the Business Policy Directorate for the following reasons: The Directorate provides the corporate planning and policy activities to support the Weather and Environmental Services Board. In addition, some of the processes being developed in the Directorate as part of Performance Measurement – such as the processes to support the implementation of International Organization for Standardization standards – are essential to the successful development of contingency plans.
Key to implementing Recommendation 1 is the dedicated staff member proposed in Recommendation 2.
6.2 Recommendation 2
The National Contingency Planning Coordinator position will be established. The coordinator will form and lead a Weather and Environmental Services Board Contingency Planning Working Group. The Working Group will include contingency planning coordinators from the monitoring, production and services components of the Weather Prediction Program, a representative of the Chief Information Officer Branch, a representative from Workplace Services and Contracting and the Business Continuity Planning Program Coordinator. The relevant Directors General will be asked to provide the names of qualified staff to serve on this Working Group.
6.3 Recommendation 3
The first task of the Weather and Environmental Services Board Contingency Planning Working Group will be to develop, as suggested in Recommendation 3, formal and approved business impact analyses for each Meteorological Service of Canada component to guide the development of each of their contingency plans, measures and arrangements within the scope of the Service’s National Contingency Planning Program. These analyses will be based on a high-level risk assessment for the Meteorological Service of Canada, as suggested in Recommendation 3, and will be scoped by the National Contingency Planning Coordinator, in conjunction with the departmental Business Continuity Planning Coordinator and the three contingency planning coordinators. Operational security standards relating to Business Continuity Planning Program activities, published by the Treasury Board Secretariat, will be taken into account in developing this work.
6.4 Recommendation 4
At the present time, budgetary pressures on the Weather and Environmental Services Board are extreme. This audit represents an additional pressure as outlined in Recommendation 4. Nonetheless, we will implement the recommendations and report back to the Board on progress. The implementation will be done in a staged manner in order to maximize progress while minimizing the budgetary impact.
Environment Canada 4