Financial Management Capability Model
Part I
The environment in which the federal government operates is rapidly
changing. The effects of limited resources, downsizing and delayering are
placing greater demands on government services to Canadians; the need
for effective financial management may be greater than ever.
A long-standing strategic priority of the Office of the Auditor General has
been to encourage better financial management in government and
improve the understanding of the role it can and should play. Accordingly,
in 1996 we began a study of the current and future financial management
requirements of federal government departments and agencies. Its ultimate
objective was to build a modern framework that would describe the key
elements departments and agencies need to achieve effective financial
management - a framework that would also provide a basis for assessing
the current state of their financial management.
The result, the Financial Management Capability Model presented in this
document sets out the Office of the Auditor General's expectations for
financial management and is the basis on which future audits in this area
will be conducted.
This study focussed on financial management activities in departments and
agencies.
In the course of the study we developed:
-
A clear and detailed definition of what we mean when we use the term
financial management;
-
An audit approach and audit criteria that will permit the Office to assess
the financial management capability of departments and agencies;
and
-
A model that provides those who use it - either as an auditor or as a
manager performing a self-assessment mode - a systematic method
that can be used to assess financial management in government and
provide organizations with a roadmap for improvement
In this document we begin by defining financial management and reviewing
its objectives. It then presents the Financial Management Capability Model
that describes the key elements needed for effective financial
management.
We expect that the ideas in this document will evolve as a result of lessons
learned in the course of applying and using it.
Objectives
of Financial Management
All managers in government are entrusted with public resources to deliver
programs and services. They have a responsibility to manage those
resources with prudence and probity and due regard to economy, efficiency
and effectiveness; they also must account for the way they have used the
resources.
Financial management is an important component of what financial and
program managers in departments and agencies do in delivering programs
and services and exercising stewardship over the resources provided to
them.
Essentially, the objectives of financial management are to:
-
ensure that managers have support for decision making;
-
ensure the availability of timely, relevant and reliable information, both
financial and non-financial;
-
contribute to managing the risks to the organization;
-
help the organization make efficient, effective and economical use of
resources;
-
enable managers to account for their use of resources;
-
establish a supportive control environment; and
-
enable the organization to comply with authorities and safeguard its
assets.
Exhibit 1
elaborates on each of these objectives.
Defining
Financial Management
Experience has shown that "financial management" has almost as many
meanings as people who use the term. Indeed, the lack of clarity about
what the term encompasses has probably contributed over the years to the
difficulty of making progress in this area. Accordingly, we began our study
by suggesting a definition of financial management in terms of the activities
that we believe it includes.
In the private sector, financial management is often thought to include two
areas of activity frequently covered by the terms "treasury" and
"comptrollership". In government, the activities usually associated with the
treasury function - debt management, investment and corporate budgeting
- are carried out jointly by central agencies (the Department of Finance,
Receiver General and the Treasury Board Secretariat). Our focus here is
on only the financial management activities carried out by line departments
and agencies.
Exhibit 2
sets out the key elements that constitute financial management
and shows how they relate to the objectives of financial management.
Financial
Management: Three Essential Elements
The following are the three essential elements of financial management:
-
Risk management and control.
It is essential that an organization
identify the risks it faces (anything that could interfere with its
ability to achieve its established objectives); and that it establish a
framework designed to manage and control those risks. An essential
part of risk management and control is an environment that
communicates the purpose, values and ethics of the organization.
-
Information.
It is essential that the organization establish procedures to
manage and protect the integrity of its data and to produce the type
of information needed by managers to conduct their business and
account for their responsibilities. The organization must also present
this information when it is needed. This element includes
management of information systems and financial and non-financial
(operational and program) performance information.
-
Management of resources.
This component of financial management
focusses on managing and directing the organization's resources
economically and efficiently to achieve corporate objectives. It
includes strategic planning, analysis and support for decisions.
Clearly, financial management does not exist in isolation. Rather, it works in
concert with other important components of the organization's
management. Indeed, these three essential components of financial
management overlap and relate to the other elements of management.
Ultimately, an organization must have good management overall before it
can have good financial management.
Principles
of Financial Management
A number of principles underlie our Financial Management Capability
Model:
-
Financial management is an integral component of an effective
management framework that helps organizations achieve their
objectives and account for the cost of doing so.
-
Management is responsible both for determining the financial
management capability appropriate to the organization, and for
establishing the processes and practices needed to achieve and
maintain that capability.
-
Not every organization requires the same financial management
capability. The appropriate level will be commensurate with the
nature and complexity of the organization and the risks to which it
may be exposed. We recognize that "no one size fits all".
-
Financial management activities must be cost-effective. In other words,
the cost of maintaining controls should be commensurate with the
risk the controls are intended to address.
-
Financial management is the responsibility of everyone in the
organization. In carrying out their duties, all managers are
responsible for considering the financial implications of their actions
- for managing their resources in a cost-effective way.
The
Financial Management Capability Model
The Financial Management Capability Model (FMCM) is based on an
adaptation of the Software Engineering Institute's "®Software Capability
Maturity Model". The Institute developed the model as a tool for assessing
an organization's ability to build software applications. We saw that this
approach could be used to create a model for assessing the financial
management capability of government departments.
®
CMM and Capability Maturity Model are registered in the U.S. Patent and Trademark Office.
The FMCM is a framework that describes the key elements of effective
financial management. It sets out a path that an organization can follow to
develop progressively more sophisticated financial management practices,
as needed. It shows the steps in progressing from a level of financial
management typical of a start-up organization to the strong, effective,
financial management capabilities associated with a more mature and
complex organization.
In addition to its use in auditing, the Financial Management Capability
Model also provides a tool that a government organization can use to:
-
determine its financial management requirements according to the
nature, complexity and associated risks of its operations;
-
assess its existing financial management capabilities against the
requirements it has determined; and
-
identify any gaps between those requirements and its existing financial
management capabilities. Having identified these gaps, an
organization can then address any significant ones and work toward
developing the appropriate level of financial management capability.
Structure
of the Financial Management Capability Model
The Financial Management Capability Model is a framework for
strengthening financial management through many small evolutionary
steps. The model illustrates the stages through which an organization can
evolve as it defines, implements, measures, controls, and improves its
financial management processes. These steps have been organized into
five progressive "capability levels". Each level represents a well-defined
stage toward developing a mature financial management regime.
The following are the five levels of the Financial Management Capability
Model (see
Exhibit 3
).
-
Start-up
-
Control
-
Information
-
Managed
-
Optimizing
Each capability level consists of a cluster of "key process areas" (KPAs).
When an organization has instituted all of the KPAs associated with a given
level of financial management capability, it may be considered to have
achieved that level. Note that each KPA has a purpose and one or more
goals. Certain activities and results or outcomes are also associated with
every KPA. Essentially, therefore, KPAs are the main building blocks that
determine the financial management capability of an organization. They
identify what must be in place at that capability level before the
organization can advance to the next level.
The
Start-Up Level
The Start-up Level describes the financial management characteristics of
an organization that has not yet established its key policies and practices or
its control framework. At this level, in the absence of established practices,
the organization's ability to achieve its business or program objectives
depends on the often-isolated efforts and accomplishments of individuals.
In these circumstances there is no certainty that such accomplishments
would be repeatable or sustainable.
This situation might exist if an organization has experienced dramatic
changes in its operations - for example, if it has implemented a new
program or policy, amalgamated with another department or relocated its
operations. If it has not effectively managed the increased risks associated
with the change, the organization could be at the Start-Up Level of financial
management capability.
The lack of repeatable, sustainable practices of financial management and
control means that any data produced may not be complete, accurate or
reliable. Similarly, without an adequate control framework in place, assets
may not be adequately protected or resources adequately controlled.
The key challenge the organization faces in progressing to Level 2 is to
develop realistic, useful financial and operational business plans and to
establish a basic control framework that allows it to monitor and control
resources and safeguard and protect assets.
The Start-Up Level, unlike other levels in the Financial Management
Capability Model, is not a stable environment in which it is desirable to
remain.
The
Control Level
At the Control Level (Level 2), the focus is on ensuring that adequate
resources are available, assets are safeguarded, data are reliable, and
operations are monitored and controlled and conducted with prudence and
probity. Organizations at the Control Level are able to meet statutory and
regulatory reporting requirements.
Organizations that have instituted the key process areas for this level have
established a control framework that provides a stable environment and
ensures that control practices are repeatable and sustainable. The control
framework includes financial, operational and management controls. When
these basic controls are operating as intended, they will help the
organization to control or reduce risks and to produce complete and
accurate financial and operational data.
With sound financial and operational data, the organization can carry out its
basic stewardship responsibilities and meet its reporting obligations. The
integrity of the data supports operational planning decisions and monitoring
activities. It ensures that sufficient funds have been obtained to meet
budget and cash-flow requirements, and it satisfies statutory and
operational reporting requirements.
An organization at the Control Level will be able to answer "Yes" to the
following key questions:
-
Do we have a control framework to ensure that our assets are
safeguarded, our data are accurate and reliable, and our operations
are conducted with prudence and probity?
-
Are transactions processed and controlled in accordance with applicable
legislative and/or regulatory requirements?
The primary activities that the organization's Finance group performs at the
Control Level involve the traditional accounting functions - processing
transactions, bookkeeping and general accounting functions. Finance
focusses on ensuring that controls over the financial systems are adequate
to produce complete, accurate and timely financial data and to provide
functional guidance to operational groups as required.
At the Control Level, operational managers play a role in achieving basic
financial management capabilities. This involves establishing realistic
financial plans based on expected results, and estimating the resources
required to achieve those results. At Level 2, the data on which these plans
are based are typically historical in nature, drawn from past experience. At
this level, operational managers would also track actual progress and
resource use against planned results.
At the Control Level, reliable historical data are available. However, they
are not generally available as "information". Although ad hoc analysis can
be carried out, the effort to collect information may be extensive and
time-consuming because it may be fragmented, scattered and not easily
accessible.
The
Information Level
At the Information Level (Level 3), key process areas focus on integrating
the organization's financial and non-financial systems, practices and
procedures to provide information that can be used to manage resources
with prudence and probity and in an efficient and economical manner.
At Level 3, an organization will be capable of both measuring and
managing its risks, and can tailor management practices within its various
operating units to manage and reduce risk cost-effectively. At Level 3, the
organization will have information on the cost of producing a product of a
given quality or delivering a service at a given level.
A key aspect of Level 3 is the changing role of Finance. The role begins to
move away from performing only the traditional accounting functions to
performing as a team player providing valuable support to operational
managers. Finance works with operational managers to develop a
financial structure that provides them with cost-effective controls and
information which meets their day-to-day needs - for example, information
on product costs.
At the Information Level, operational managers have a broader
understanding of their financial management responsibilities. They also
recognize their responsibility to contribute to the organization's financial
management capabilities.
Critical to achieving this level of capability is a climate that institutionalizes
financial management practices throughout the organization's culture. This
would require that senior management explicitly demand and promote
effective financial management and demonstrate its value. Such a culture
is developed by formalizing financial management policies and practices
across the organization and supplementing them with appropriate training -
and a system of rewards, recognition and sanctions that reinforces the
culture.
In addition to being able to answer "Yes" to the Control Level questions, an
organization at the Information Level will be able to answer "Yes" to the
question, "Do we have the financial management systems, practices and
information that we need to measure and monitor the cost and quality of
our outputs and the use of our resources?".
At the Information Level, organizational standards for all processes and
activities have been established to allow for measurement and comparison
between similar business units across the organization. These standard
financial management practices can be tailored to each unit's nature and
unique risks.
One of the key processes at the Information Level is to provide consistent
and comparable financial and operational (non-financial) information and
reports that meet the needs of managers. This information provides a basis
for developing performance indicators, cost and quality measures and
monitoring performance, to ensure that intended results are being achieved
and to demonstrate accountability.
The
Managed Level
At the Managed Level (Level 4), the organization uses the information
developed at Level 3 to balance two competing objectives: using its
resources economically and efficiently, and producing cost-effective results
- for example, goods or services of acceptable quality. The organization
understands the financial implications of the choices and trade-offs it
makes between these objectives. Such information also allows the
organization to better account for the way that it uses the resources
entrusted to it.
An organization at the Managed Level can better manage its financial and
operational performance because it has - and uses - the "right"
information. It has information and analyses on the relative costs of
different approaches to achieving its objectives. An organization with Level
4 capabilities uses that information and impact analyses to make informed
decisions on cost versus quality and risk versus opportunities, or decisions
on levels of service.
An organization with Level 4 financial management capabilities also has
mechanisms for measuring the impact of variables such as cost, quality,
productivity and degree of success in achieving its stated objectives. This
capability flows from a history of having measured and managed
organizational performance, which includes, for example:
-
managing the organization's information and knowledge resources as
assets, so that information needed to make informed decisions is
available (for example, by using simulations, historical trends and
manipulating variables to see how they affect results);
-
defining the relationships among variables that affect cost, quality and
level of service and understanding how they impact on the
organization's desired results;
-
using information to make informed choices among competing
objectives like cost, quality and schedule;
-
understanding the financial implications of decisions before making
them, and monitoring their outcomes;
-
using quantitative information to control variances (for example,
fluctuations or changes) in the organization's production or service
delivery processes; and
-
using quantitative information to balance among competing business line
objectives (for example, to reduce cost, increase productivity,
improve quality, reduce risk, increase opportunities).
An organization at the Managed Level will be able to answer "Yes" to the
question, "Do we know what it cost to achieve a given result, and did we
follow the most cost-effective approach in achieving it?".
The
Optimizing Level
An organization at the Optimizing Level (Level 5) uses information from
inside and outside the organization to set and achieve strategic targets or
objectives for improvement. Achieving these targets enables the
organization to increase the value of its services or products to clients or
consumers.
Thus, at the Optimizing Level the focus is on continuous improvement. The
organization uses what it has learned from past experience to identify
areas for future improvement. This involves:
-
developing prospective information to anticipate both internal and
external changes that may affect the organization's performance
(instead of reacting to changes) and making the necessary strategic
or tactical decisions to manage their effects;
-
measuring the organization's performance against that of others in the
same industry and setting strategic targets for improvement;
-
finding best practices and learning from other organizations
(benchmarking); and
-
finding ways to minimize costs and maximize revenues, and to improve
the quantity and quality of outputs, by introducing new technology
or improving existing processes.
The key question that an organization at the Optimizing Level asks itself is,
"How can we as an organization improve our performance?".
Achieving
a Capability Level
Achieving a given capability level involves mastering the key process areas
associated with it and ensuring that these key processes are
institutionalized within the organization.
An organization can reach a given level or financial management capability
by mastering all of the key process areas included in that level.
As illustrated in
Exhibit 4
, each KPA has certain goals. To achieve the goals
in one or more key process areas, an organization must carry out certain
activities. Typical activities include:
-
identifying requirements - such as the need for a certain control system
- and developing plans and procedures to meet them;
-
carrying out those plans and procedures;
-
tracking and monitoring the work being done; and
-
correcting any problems that may arise.
In turn, these activities produce immediate outputs (for example, a control
system) or longer-term outcomes (for example, careful management of the
cost of products or services). Once an organization has done the
necessary work and achieved the outputs or outcomes associated with a
KPA, we can say that it has "mastered" that KPA: it has in place a basic
building block that contributes to reaching a particular capability level.
By itself, mastering one or more KPAs is not enough. It is also essential to
"institutionalize" the KPA and all of the activities associated with mastering
it. By institutionalizing, we mean weaving the KPA and related activities into
the fabric or culture of an organization. Only in doing so will the
organization make the KPA sustainable, repeatable and lasting.
Institutionalizing the KPA requires the "right" organizational climate. As
indicated in
Exhibit 5
, some prerequisites or characteristics of such a
climate are:
-
a
commitment
to master the KPAs associated with reaching a particular
capability level;
-
the
ability
to carry out the necessary
activities
competently, for example,
through training and development;
-
ongoing
measurement and analysis
of activities and progress toward
goals; and
-
continuous
verification
to ensure that activities have been carried out in
accordance with established policies and procedures.
Such a climate provides the support or foundation for reaching a financial
management capability level appropriate to the organization.
Establishing
Financial Management Requirements
We would expect that in determining and establishing the financial
management capabilities their organization needs, managers would assess
the nature of their operations and the risks they face. In this context, we
consider risk to be any factor that may affect the organization's ability to
achieve its objectives. Risks are identified through a process of first
identifying potential hazards, then assessing the consequences to the
organization should one occur, and finally determining the likelihood of the
hazard's occurrence, given the control environment of the organization.
Such a process is outlined in
Exhibit 6
.
As a first step, senior management would determine the organization's
financial management requirements by defining its broad purpose and
direction and assessing its risks (both financial and non-financial). The
purpose of this assessment would be to determine three things:
-
what risks the organization faces and which of those must be controlled;
-
what financial and non-financial information the organization needs to
meet internal and external accountability requirements; and
-
what financial and non-financial information management needs to fulfil
its operational and policy responsibilities.
The second step would be for management to establish an overall
management framework, based on the results of its assessment. This
would include determining the financial management capabilities the
organization needs, given the nature of its business and the inherent risks
involved. This step would involve using the FM Capability Model to:
-
establish the financial management capability the organization needs;
-
assess the organization's existing capability level; and
-
provide guidance for closing any gap between the required and the
existing levels of financial management capability.
Once financial management requirements have been established,
management would identify any residual risks that exist and assess their
acceptability. The existence of unacceptable residual risks would require
management to reconsider its financial management requirements and the
capabilities needed to meet them.
The third step would be for management to implement the financial
management framework. This step involves monitoring processes and
activities to ensure that financial management requirements and existing
capabilities are still in balance and that they reflect the risks and needs of
the organization. Any imbalance that this monitoring might reveal would
have to be dealt with - for example, by modifying the risk analysis or
financial management framework, as required.
Auditors of an organization as well as its senior management could use the
framework outlined in
Exhibit 6
to apply the Financial Management
Capability Model. Auditors could use the Model to assess the audited
organization's level of financial management capability relative to its
requirements.
1. Price Waterhouse
Control Environment Questionnaire
, December 1996.
2. Joint Financial Management Improvement Program (JFMIP)
Framework for Federal Financial
Management Systems
, FFMSR-0, January 1995.
3. Joint Financial Management Improvement Program (JFMIP),
Managerial Cost Accounting System
Requirements
, FFMSR-8, February 1998.
4. Management Advisory Board/Management Improvement Advisory Committee (MAB/MIAC),
Guidelines for Managing Risk in the Australian Public Service
, October 1996.
5. The Society of Management Accountants of Canada, Highlights of a Monograph by A. R.
Montazemi, PhD,
Information Systems in Small Business
, May 1988.
6. Certified Management Accountant (CMA), Management Accounting Guideline # 14,
Managing
Quality Improvements
, 1992.
7. Certified Management Accountant (CMA), Management Accounting Guidelines # 43,
Redesigning
the Finance Function
, 1997.
8. Certified Management Accountant (CMA), Management Accounting Guideline # 46,
Implementing
Ethics Strategies Within Organizations
, 1998.
9. The Society of Management Accountants of Canada, Management Accounting Issues Paper # 13,
Codes of Ethics, Practice and Conduct
, 1997.
10. CMA Magazine, Dave Desormeaux, CMA, Redefining Future Executive Information Systems,
New
World Order
, October 1998, pp. 29-33.
11. Report of the Auditor General of Canada,
Ethics and Fraud Awareness in Government
, Chapter 1,
May 1995.
12. Report of the Auditor General of Canada,
Crown Corporations: Making Performance Measurement
Work
, Chapter 22-December 1997
.
13. Report of the Auditor General of Canada,
Revenue Canada - The Financial Management Regime
,
Chapter 31 - December 1997
.
14. Report of the Auditor General of Canada,
Promoting Integrity in Revenue Canada
, Chapter 15 -
September 1998
.
15. Office of the Comptroller General,
Guide to Costing of Outputs in the Government of Canada
,
February 1994.
16. State of Texas Audit Office, Report # 95-139,
Guide to Cost-Based Decision-Making
, August 1995.
17. FMI Journal, Volume 9, Number. 2, James Q. McCrindell,
A Strategic Approach to Control and
Performance Measurement
, pp. 22-27, Winter 1998.
18. Canadian Standards Association/Standards Council of Canada, CAN/CSA-Q850-97, a National
Standard of Canada,
Risk Management: Guideline for Decision-Makers
, 1997.
19. Alice O. Nakamura and William P. Warburton, Canadian Business Economics, Volume 6, Number 2,
Performance Measurement in the Public Sector
, pp. 37-48, Winter 1998.
20. Canadian Institute of Chartered Accountants (CICA), S. J. Gaston, FCA, Successful Management
Strategies for Creating the Knowledge-Oriented Organization,
Mining Data for Knowledge
, 1997.
21. Office of Management and Budget (OMB-US), Circular No. A-127 Revised, 1993
Financial
Management Systems
, 1993
.
22. Software Engineering Institute (SEI),
Capability Maturity Model (Draft B)
, 1997.
23. Robert S. Kaplan and David P. Norton,
The Balanced Scorecard
, 1996.