Request for information
FOR
Organizational Risk Culture Maturity Assessment
and Industry-specific Risk Culture Benchmarking Services
Date issued: December 24th, 2015
Solicitation File Number:
RFI-2015-02
Solicitation Closes: 2pm EST, January 21st,
2016
Inquiries: Monika Morrison
Senior Advisor, Procurement Services
Tel: (613) 740-5421
Fax: (613) 748-2554
Email: mmorriso@cmhc-schl.gc.ca
Security Classification: PROTECTED
Ce document est disponible en français sur demande
CMHC RFI: Organisational Risk Culture Maturity Assessment and Industry-specific Risk Culture Benchmarking
Services Submission Deadline: 2pm EST, January 21st, 2016
SECTION 1 GENERAL INFORMATION
1.1 CMHC Background
CMHC is the Government of Canada’s National Housing Agency, with a mandate to
help Canadians gain access to a wide choice of quality, affordable homes. It is a Crown
corporation, with a Board of Directors, reporting to Parliament through the Minister of
Families, Children and Social Development, and Minister responsible for Canada
Mortgage and Housing Corporation, the Honourable Jean-Yves Duclos.
CMHC has approximately 1,900 employees located at its National Office in Ottawa, and
at various Business Centres throughout Canada. The Business Centre areas are
divided into five regions: Atlantic; Québec; Ontario; British Columbia; and Prairies &
Territories.
Respondents may visit CMHC’s Web site at: http://www.cmhc-schl.gc.ca/
1.2
Introduction and Scope
Canada Mortgage and Housing Corporation (CMHC) is committed to continually
improve its risk management practices and, as part of the Enterprise Risk Management
(ERM) initiative, has embarked on a journey to better understand and strengthen
CMHC’s risk culture. In support of this goal CMHC is seeking to establish measures
and develop specific five-year targets in order to be a best in class risk manager
supported by a consistent risk culture across the organization.
CMHC is conducting a Request for Information (RFI) to enhance its knowledge about
the supply of professional services;



to design and conduct organizational risk culture maturity assessments in order
to measure CMHC’s system of values and behaviours that shape the
Corporation’s day-to-day risk decisions;
that has established industry-specific risk culture benchmarking metrics in order
to compare the Corporation to industry peers; and
that can conduct a risk culture benchmarking exercise with industry peers.
1.3 Objectives of this Request for Information
CMHC is requesting information from qualified vendor who can respond to the
questions related to Risk Culture Services (Detailed in Section 3). Responses are
intended to aid CMHC to formulate and plan its approach to determine whether a
subsequent Request for Proposal (RFP) will be initiated.
Should CMHC decide to proceed, a Request for Proposal (RFP) will be developed to
evaluate and select a service provider to perform and execute “Organisational Risk
Security Classification: PROTECTED
Page 1
CMHC RFI: Organisational Risk Culture Maturity Assessment and Industry-specific Risk Culture Benchmarking
Services Submission Deadline: 2pm EST, January 21st, 2016
Culture Maturity Assessment and Industry-specific Risk Culture Benchmarking
Services” (hereafter referred to as the “Risk Culture Services”).
Please note:
1. Respondents are not expected to prepare detailed proposals at this time.
2. Pricing should not be addressed/included in responses.
3. This RFI is neither a formal tender nor an intent to contract with any supplier and
must not be interpreted as any form of commitment or obligation on CMHC’s part.
Following the receipt of responses and at its sole discretion, CMHC will determine
whether or not to continue the project described herein.
4. In responding to this RFI, any assumptions that respondents have made should be
clearly explained.
5. Responses to the questions contained in this RFI will not serve as pre-qualification of
bidders for any subsequent potential RFP; however, responses from the industry will
assist CMHC in preparing for a potential RFP and assist the procurement strategy as a
whole. Responses will not be formally evaluated.
6. Respondents are not entitled to compensation for any work related to, or materials
supplied in the preparation of their responses.
7. During the review of RFI responses, CMHC reserves the right to contact or consult
with any respondent in order to obtain clarification or additional information of its
response. CMHC is in no way obliged to meet with any or all respondents for this
purpose.
1.4
Ownership of Responses
All responses and related materials remain the property of the respondent. The
respondent hereby grants CMHC the right and license to use the information for any
purpose related to its business planning and operations, and to incorporate information
included in the responses into its future planning and solicitation documents.
Responses and related materials will not be returned to respondents.
The respondent warrants that the respondent possesses all rights necessary to grant
CMHC the rights set out above.
1.5
Proprietary Information
Information contained in this RFI is to be considered “Proprietary Information” and the
respondent is not to disclose this information to any party other than the respondent’s
employees or agents participating in the response to this RFI.
Security Classification: PROTECTED
Page 2
CMHC RFI: Organisational Risk Culture Maturity Assessment and Industry-specific Risk Culture Benchmarking
Services Submission Deadline: 2pm EST, January 21st, 2016
SECTION 2 SUBMISSION REQUIREMENTS
Delivery Instructions and Deadline
Responses are to be sent electronically to the following e-mail address:
EBID@cmhc-schl.gc.ca
The subject line of the transmission must state: RFI, file # RFI-2015-02.
Format
Proposals may be submitted in MS Word or Adobe Acrobat PDF in English or in French.
NOTE: In certain email programs the “Send” format may need to be specified as either
“HTML”or “Plain Text”. Rich Text formatted or Compressed (Zipped) documents cannot
be opened by CMHC.
Submission Deadline
Responses must be received at the exact location as specified above on or before the
submission deadline set as 2pm EST, January 21st, 2016
Security Classification: PROTECTED
Page 3
CMHC RFI: Organisational Risk Culture Maturity Assessment and Industry-specific Risk Culture Benchmarking
Services Submission Deadline: 2pm EST, January 21st, 2016
SECTION 3
INFORMATION REQUIREMENTS
The following are high level information requirements that should be addressed in a
proponent’s response. Please provide explanations and rationale for each response
provided.
Information Requests
1. Organizational Risk Culture Maturity Assessment Services
1
1.1
1.2
1.3
1.4
1.5
1.6
1.7
When responding to each question below, include or describe any services
that typically provide greater insight into the question and / or assist an
organization in achieving the desired result.
What is Risk Culture?
CMHC wants to make a clear distinction between its performance on risk
management versus its progression and maturity with its risk culture.
Describe how your organization defines “risk culture” and breakdown the
components of risk culture in a way that can be applied and measured
across an organization.
How do we measure it?
CMHC strives to be a best in class risk manager supported by a consistent
risk culture across the organization. Based on the previous response
(question 1) and definition of “risk culture”, how could the Corporation
determine where it stands today from a maturity perspective, track
progress of cultural change and use this information as a performance
metric to drive its vision?
How is it done?
Describe the mechanism / methodology / technique used to capture risk
culture maturity assessments. Seeing as the Corporation’s employees are
currently “over-surveyed” are there other creative ways to capture the
required information to get a comprehensive assessment?
How big is it?
CMHC is trying to determine how “deep” we need to go to get a meaningful
understanding of our risk culture. Describe various scope options that
could be used to capture and assess CMHC’s risk culture maturity and the
associated level of understanding that each scope option delivers.
How long would it take? (Rough order of magnitude)
Based on the previous response (question 4), approximately how long
would each scope option assessment take to design, execute and report
on? What frequency and types of measurements would be recommended
to confirm progress during the five year plan.
What would the results look like?
Once the risk culture maturity assessment is complete, CMHC would need
to report on the results to various audiences including high level executives
all the way to front line workers. What would a typical report look like for
the varying audiences?
What to do with the results?
Security Classification: PROTECTED
Page 4
CMHC RFI: Organisational Risk Culture Maturity Assessment and Industry-specific Risk Culture Benchmarking
Services Submission Deadline: 2pm EST, January 21st, 2016
1.8
What are the typical actions that an organization can measure once the
culture risk maturity assessment results have been fully digested and
understood and how could an organization use these results to achieve its
vision, such as be best in class risk manager supported by a consistent risk
culture across the organization?
For budgetary purposes, what is the range of costs associated with Risk
Culture Maturity Assessment services? (Rough order of magnitude)
Information Requests
2. Industry-specific Risk Culture Benchmarking Services
2
When responding to each question below, include or describe any services
that typically provide greater insight into the question and / or assist an
organization in achieving the desired result.
2.1. Does “Risk Culture Benchmarking” exist?
CMHC is looking to benchmark its Risk Culture in order to compare its
performance with the market and peer organizations. Are there
commercially available benchmark reports that cover “Risk Culture” (not
Risk Management) across companies of all sizes and industries?
2.2. Is there finance and insurance industry-specific benchmarking?
Do “Risk Culture” benchmarks exist specifically for the Finance, Banking
and/or Insurance business sectors?
2.3. Is there government industry-specific benchmarking?
Do “Risk Culture” benchmarks exist specifically for government or programbased public sectors?
2.4. What services are available to perform “Risk Culture” benchmarking?
Describe all of the services available to be able to perform “Risk Culture”
benchmarking.
2.5. How long would it take? (Rough order of magnitude)
Approximately how long would it take to benchmark the Corporation’s “Risk
Culture” against industry-specific peers?
2.6. For budgetary purposes, what is the range of costs associated with Risk
Culture Benchmarking services? (Rough order of magnitude)
Security Classification: PROTECTED
Page 5