Audit of Regions (Ontario and Pacific)

September 2012

Recommended for Approval to the Deputy Minister by the Departmental Audit Committee on October 12, 2012

Approved by the Deputy Minister on October 18, 2012

Table of contents

• 1.0 Executive Summary
  • 1.1 Introduction
  • 1.2 Main Findings and recommendations
  • 1.3 Audit Opinion
  • 1.4 Statement of Conformance
• 2.0 About the Audit
  • 2.1 Background
  • 2.2 Objective and Scope
  • 2.3 Audit Approach
• 3.0 Findings and Recommendations
  • 3.1 Introduction
  • 3.2 Governance
  • 3.3 Internal Control
  • 3.4 Risk Management
• 4.0 Overall Conclusion
• Appendix A: Audit Criteria
• Appendix B: Management Action Plan

1.0 Executive Summary

1.1 Introduction

The regional offices of Industry Canada are the Department's main presence throughout Canada, serving a key role in advancing regional economic interests. As the Department's eyes and ears in the regions, the offices support strategic policy development and decision making through the gathering and dissemination of regional intelligence and analysis. The regional offices also serve as the Department's main service delivery arm in the regions.

In support of Industry Canada's mandate, regional offices serve the needs of their regional clients through the delivery of programs and services, and support the development and understanding of national policies, programs and regulations. Regional staff work in Industry Canada's five regions: Atlantic, Quebec, Ontario, Prairie and Northern, and Pacific. Each region is led by a Regional Executive Director.

In accordance with the approved Industry Canada 2012–13 to 2014–15 Multi-Year, Risk-Based Audit Plan, the Audit and Evaluation Branch (AEB) undertook an audit of Corporate Services in the regions. In this, the second of two planned regional audits, AEB examined the Ontario and Pacific regions.

The objective of this audit was to provide reasonable assurance that the management controls for Corporate Services (Finance and Administration) in the two regions, Ontario and Pacific, are operating effectively.

The audit revealed that the management controls identified in the audit criteria for Corporate Services (Finance and Administration) in the Ontario and Pacific regions are operating effectively with minor exceptions, and that transactions are processed in a manner that is compliant with the applicable policies, procedures and regulations.

1.2 Main Findings and Recommendations

Governance

Authority, Responsibility and Accountability

Roles and responsibilities are clearly defined and understood within the Finance and Administration directorate.

Performance Standards

Performance standards have been developed and communicated but are not measured and monitored.

Recommendation 1:

The Director/Manager of Finance and Administration should determine which performance measures are measurable, periodically monitor them, and take corrective action where necessary.

Internal Controls

Expenditures are generally in compliance with Treasury Board and Industry Canada policies and directives, including Industry Canada's Financial Control Framework.

Management oversight and controls over the use of prepaid airline credits or batch tickets

Directives and guidelines on the purchase, use and controls over prepaid airline credits or batch tickets have not been established in the regions.

Recommendation 2

The Director/Manager of Finance and Administration, in cooperation with Comptrollership and Administration Sector, should develop and communicate guidelines for the purchase and use of prepaid transportation services.

Expenditure initiation, commitment, approval and payment

Approvals under Sections 32, 33 and 34 of the Financial Administration Act are carried out by authorized individuals.

Although formal authorities are in place and approval practices are documented, an opportunity exists to reinforce proper implementation of these approvals.

Recommendation 3

The Director/Manager of Finance and Administration should reinforce the requirements of the Financial Administration Act for expenditure initiation, commitment, receipt and payment of goods and services.

Section 33 Officers ensure that an adequate account verification process is in place.

Risk Management

Risk management at the Finance and Administration directorate level is carried out informally in a manner that results in the identification of risks and the development of mitigation strategies.

1.3 Audit Opinion

In my opinion, the management controls audited for Corporate Services (Finance and Administration) in the two regions, Ontario and Pacific, are in place with no material weaknesses. Improvements are required to address low to moderate risk exposures in the areas of governance and internal controls.

1.4 Statement of Conformance

The audit was conducted in accordance with the Internal Auditing Standards for the Government of Canada. A practice inspection has not been conducted.

Susan Hart
Chief Audit Executive, Industry Canada

2.0 About the Audit

2.1 Background

In accordance with the approved Industry Canada 2012–13 to 2014–15 Multi-Year, Risk-Based Audit Plan, the Audit and Evaluation Branch undertook an audit of Corporate Services in the regions.

The regional offices of Industry Canada are the Department's main presence throughout Canada, serving a key role in advancing regional economic interests. As the Department's eyes and ears in the regions, the offices support strategic policy development and decision making through the gathering and dissemination of regional intelligence and analysis. The regional offices also serve as the Department's main service delivery arm in the regions.

In support of Industry Canada's mandate, regional offices serve the needs of their regional clients through the delivery of programs and services, and support the development and understanding of national policies, programs and regulations. Regional staff work in Industry Canada's five regions: Atlantic, Quebec, Ontario, Prairie and Northern, and Pacific. Each region is led by a Regional Executive Director (RExD).

All regions share a common departmental mandate, although individual regional priorities may differ. Some regions use satellite offices in addition to their district offices to ensure goals and objectives are met. As per the regional office 2011–2012 Business Plan, there are 68 staff in the Ontario Region and 34 in the Pacific Region.

The regional offices comprise Corporate Services (Finance and Administration); Communications; and Policy, Analysis and Intelligence. They provide varying levels of corporate services to the following programs:

• Canadian Intellectual Property Office
• Chief Informatics Office
• Competition Bureau
• Measurement Canada
• Office of the Superintendent of Bankruptcy
• Spectrum, Information Technologies and Telecommunications
• Corporations Canada.

These programs operate with three regions – Eastern, Ontario and Western – instead of five. Their regional staff do not report to the RExDs but rather to the heads of the programs at national headquarters. (In Ontario, the Ontario Business Network call centre, part of the Canada Business Network, reports directly to the RExD and not to national headquarters. No other regional offices have responsibility over a Canada Business Network call centre.)

The level of service provided depends on the region and the program, ranging from a full slate of corporate services to simple advice provided on an as-required basis.

Finance services include financial planning and analysis, accounting operations, financial policy and systems.

Administration services include accommodations, security, health and safety, access to information and privacy, mail, reception co-ordination, inventory control, asset management, central file co-ordination, relocation advice, tenant services, telecommunications, procurement, petty cash and contracting.

In 2011–2012, regional offices negotiated Common Services Memorandums of Understanding (MOUs) for corporate services with each of the programs. They identified the services to be provided, compared the processes for delivering the services, identified any anomalies, and determined how to deal with the anomalies.

This audit examined management controls that support finance and administrative services provided by the Ontario and Pacific regions. AEB conducted an audit of Corporate Services in the Atlantic, Quebec, and Prairie and Northern Regions in 2010–2011.

2.2 Objective and Scope

The objective of this audit was to provide reasonable assurance that the management controls for Corporate Services (Finance and Administration) in the two regions, Ontario and Pacific, are operating effectively.

The scope of the audit included the Corporate Services (Finance and Administration) management controls that have been assessed as medium high and medium risk in the Ontario and Pacific regions. For sampling purposes, the audit examined the fiscal year 2011–2012.

Contracting and Departure Process were excluded from the scope of this audit due to other audit work performed in these areas. Program clients were excluded from the scope of the audit however; program financial transactions were included in the population used for sampling purposes to test S.33.

Although the audit scope was determined prior to the Deficit Reduction Action Plan, the audit considered, where relevant, the likely impacts of the plan on the audit results and recommendations.

2.3 Audit Approach

The audit was conducted in accordance with the Internal Auditing Standards for the Government of Canada. Sufficient and appropriate audit procedures have been conducted and evidence gathered to support the accuracy of the conclusion and opinion provided and contained in this report. The opinion is based on a comparison of the conditions, as they existed at the time, against pre-established audit criteria that were agreed on with management. The opinion is applicable only to the entities examined and within the scope described herein.

The audit approach consisted of the following:

Planning Phase

The planning phase for this audit took place from January to April 2012. A risk assessment of the core management controls was conducted using Treasury Board's Core Management Controls as defined in March 2011, and Industry Canada's 2009 and 2012 Financial Control Framework.

Evidence gathered through document review and interviews with key stakeholders was synthesized to identify areas of medium high and medium risk within governance, risk management and internal controls. The results of the risk assessment contributed to the development of audit criteria and the audit program used during the conduct of the audit. Appendix A of this report lists the audit criteria.

Conduct Phase

The conduct phase for this audit took place from May to July 2012. AEB reviewed documents, conducted interviews, visited both regions, tested key controls, and gathered and analyzed data from various sources.

The audit team performed several tests on operations and maintenance expenditures (excluding salaries and related costs). These tests covered compliance with the Financial Administration Act (FAA), Treasury Board policies and directives such as those for travel, hospitality, and memberships, Industry Canada's Financial Control Framework, and applicable regional policies and procedures including service/performance standards.

Debrief meetings were held with each region separately in August and September 2012 to validate the accuracy of the findings in this report.

3.0 Findings and Recommendations

3.1 Introduction

This section presents detailed findings from the audit of the Ontario and Pacific regions. The findings are based on evidence and analysis from both the initial risk assessment and the detailed audit.

In addition to the findings below, AEB has communicated observations of conditions that were non-systemic and of low materiality and risk to management, orally and/or in a management letter, for consideration.

3.2 Governance

Authority, Responsibility and Accountability

Region, Finance and Administration:

Roles and responsibilities for the Finance and Administration staff in the regions are documented and communicated through signed job descriptions and Employee Performance Management Agreements.

Interviews during the planning and conduct phases of the audit provided evidence that employees know and understand their roles and responsibilities.

Policies and procedures that define authorities and responsibilities for Finance and Administration in the regions are in place. These include:

• Industry Canada's Financial Control Framework
• Financial Administration Act
• Delegation of Authorities policy, and
• Various financial policies (e.g. travel directive, acquisition cards, hospitality, membership).

Region, Finance and Administration as a service provider for program clients:

Regional offices, Finance and Administration have been responsible for the regional delivery of corporate services since the creation of the Department in 1993. This role was confirmed during the Regional Review concluded in 2007. The RExD is accountable for the delivery of services and provides line direction to the regional corporate staff.

The level of corporate services a regional office provides to regional programs varies slightly from client to client and region to region. Services in each region are based on historical offerings and have evolved accordingly.

As noted above, regional offices have negotiated standard "common services" MOUs with each program across the country. The MOUs outline the roles and responsibilities of both the regional Finance and Administration offices and each program client. One region has also developed a detailed implementation plan that further enhances the description of the roles and responsibilities contained in the MOUs.

Performance Measurement

Performance Standards

As a result of a client satisfaction survey it conducted, one region has developed performance standards for the delivery of services in consultation with its clients. The standards include:

• Response times for financial services, e.g. accounts payable, journal vouchers, specimen signature cards, etc.
• Processing travel claims, requests for Amex cards and relocation services
• Financial systems access requests
• Accommodations services, contracting and fleet management
• Security services, e.g. government photo ID cards and employee departure forms
• Procurement services, e.g. requisitions and orders
• General office services, e.g. boardroom bookings, inventory control, telephone services
• Mail and records services, e.g. courier.

The standards were communicated to program clients during their development phase and then posted on the intranet.

After this one region developed the standards, they were shared with the Regional Finance and Administration Community of Practice. This committee of Finance and Administration managers from each region, which meets regularly to discuss common issues, risks and best practices, then worked together to develop cross-regional service standards.

The standards were in effect for the one region during the period audited and were implemented in the other region as of April 1, 2012 in conjunction with the Common Services MOU.

Interviews with the Finance and Administration staff indicated that performance results are not measured and resources have not been assigned to regularly measure and monitor compliance to the standards. In addition, no system is in place to capture, record and report the information needed to measure the standards. One region has asked to have additional functionality incorporated into the next version of SAP. The interviews indicated, however, that regions investigate service performance on an exception basis.

The result of the audit file testing of the accounts payable performance standard indicated that some of the transactions tested did not meet the standard and others could not be measured as the invoices did not indicate the date they were received.

By not measuring and monitoring compliance with the communicated performance standards, and taking corrective action where necessary, Finance and Administration runs the risk of having dissatisfied program clients.

Recommendation 1

The Director/Manager of Finance and Administration should determine which performance measures are measurable, periodically monitor them, and take corrective action where necessary.

3.3 Internal Controls

Compliance with Treasury Board and Industry Canada policies, directives and guidelines

In general, the audit found that expenditures tested for compliance with hospitality, acquisition card, membership, and travel policies were in compliance with the relevant policies.

• Acquisition card purchases were in line with Treasury Board's Directive on Acquisition Cards and Industry Canada's Policy on Acquisition Cards regarding allowable expenses and expenditure limits; there was no apparent contract splitting and payments were made to avoid interest costs.
• No issues were identified with respect to membership fees and hospitality expenses.
• Petty cash transactions were in compliance with Treasury Board's Directive on Accountable Advances, which includes petty cash.

Some exceptions were noted, as a result of the expenditure testing, in relation to travel.

• Some travel claims that included personal travel were approved and processed without cost comparison to ensure that no additional costs would be incurred by the Department as a result of the personal travel.
• One expense claim for meal per diems for a two-week period was approved and processed even though the employee was not entitled to receive them.
• Some expense claims were paid through petty cash without using the appropriate forms.

Management oversight and controls over the use of prepaid airline credits or batch tickets

The sample of transactions selected for audit purposes included the lump sum purchase by an employee of prepaid airline credits with a particular airline. These credits are drawn down each time the employee flies with that airline.

During the review of this transaction, it was also determined that an employee could also purchase a batch of tickets from another airline in that region. The batch of tickets would be maintained by the employee and could be used at any time.

In both situations the purchases are made through Travel AcXess, the approved Government of Canada travel service. There is no reconciliation of the credits or batch of tickets and no monitoring of the use and remaining inventory of tickets.

Directives or guidelines on the purchase, use and controls over a block of airline tickets have not yet been established in the regions. Without guidelines and controls, there is a risk that the tickets are not properly safeguarded and/or utilized.

Recommendation 2

The Director/Manager of Finance and Administration, in cooperation with Comptrollership and Administration Sector (CAS), should develop and communicate guidelines for the purchase and use of prepaid transportation services.

Expenditure initiation, commitment, approval and payment

During the audit, tests were performed to verify that approvals under S.32, 33 and 34 of the FAA were carried out by authorized individuals, were signed and dated in the appropriate sequence, and were for the appropriate amount (the funds were available for commitment, the invoice amount was paid, the expenditures were entitled per agreements, etc.).

Industry Canada uses an electronic Financial Signing Authority system. This system maintains the approved specimen signature cards and is updated annually.

As part of the testing, a review of specimen cards for each transaction sampled was completed. The review included verifying:

• the signature
• the training required
• the date authority was granted
• the cost centres for which the individual was authorized to approve transactions
• the FAA authorities delegated, and
• that the delegation was in line with the Delegation of Authorities.

The audit found that individuals have been delegated authorities in accordance with the established procedures. Of the expenditures examined, approvals under S.32, 33 and 34 of the FAA were carried out by authorized individuals.

Management has documented approval practices for S.32, 33 and 34 for both high and low risk transactions in Industry Canada's Financial Control Framework.

During the audit, a sample of financial transactions was reviewed to ensure evidence was available that clearly supported delegated and appropriate approvals. The review noted the following exceptions:

• For a few low risk transactions, documents for delegated commitment/expenditure initiation, receipt of goods/services, and payment (S.32, 33 and 34) were not always signed and/or dated.
• In a few instances, documents were processed out of order, e.g. S.33 was signed before S.34, and in others goods/services were ordered before S.32 was signed or expenditure initiation was received.
• Early in the 2011–2012 fiscal year, commitments were set up for less than the actual value of the services to be received. In May 2011, because of free balance and operating and maintenance funding issues, the Regional Operations Sector in the National Capital Region asked the regional offices to decommit funds that did not absolutely have to be committed. One region, in interpreting this request, issued contracts and funds commitments in April for less than the actual costs of the services for that month. In another instance, funds were committed in May 2011 for services received in April 2011.

Recommendation 3

The Director/Manager of Finance and Administration should reinforce the requirements of the Financial Administration Act for expenditure initiation, commitment, receipt and payment of goods and services.

Account Verification Process

Section 33 Officers in both regions have taken steps to ensure that Section 34 has been completed appropriately, including account verification (e.g. general ledger and cost centre coding), by completing the high risk and the quarterly monitoring.

As per Industry Canada's Financial Control Framework, recurring monthly/quarterly monitoring activities (auto-post, acquisition card, Amex travel cards, random transactions, etc.) are designed to provide assurance to the regions, sectors and the CFO that controls are in place and working as intended. Section 33 Officers in the regions are conducting monthly/quarterly monitoring activities as required by the FCF.

The audit noted that corrective action is taken each time an error is found during the monitoring process. In one region, however, errors that have been corrected are not identified or communicated as errors on the test sheets submitted to CAS.

The other region has incorporated a process of communicating to CAS the corrective actions taken when errors are found during monitoring.

3.4 Risk Management

According to interviews conducted in each region, the Directors/Managers of Finance and Administration meet their managers weekly, when possible, to identify, discuss and take action on operational risks. Operational risk assessments and mitigation strategies are also discussed in weekly/monthly Regional Operations Sector management meetings, regular regional management meetings, Community of Practice sessions, and Integrated Financial and Materiel System (IFMS) user group communications.

Documents/reports prepared for such meetings include:

• Procurement – aging report for payables
• Budget – business unit monthly status report, ceiling report, free balance report, outstanding commitments report, variance report, salary forecast, etc.
• High risk transaction areas – overtime trends, travel trends, etc.

The key risk of budget overspending or lapsing is reduced because of the budget monitoring controls in place at both the Finance and Administration directorate level and the regional (e.g. RExD) level. In both regions, financial managers communicate regularly with each directorate (under the RExD) to review the financial situation and estimates.

Examples of other internal controls developed and implemented to mitigate risks regarding financial and administrative activities include:

• weekly meetings between RExDs and Directors/Managers
• meetings with the Community of Practice group (a cross-region group that meets regularly to discuss best practices, common issues, and risks and possible mitigation strategies)
• postings through the IFMS User Group (an on-line group that discusses common issues, risks and mitigation strategies)
• the Financial Control Framework, including regular monitoring by the regional finance group and CAS
• the designation in each region of at least two individuals authorized to sign Section 33—this allows for proper segregation of duties and for back-up during holidays, illness, etc.
• training (both formal and informal)
• a Business Continuity Plan
• Threat Risk Assessments performed by Security.

Similarly, management communicates its risk and risk management strategies to key stakeholders through:

• regular management meetings
• monthly/quarterly monitoring
• the Community of Practice, and
• IFMS working groups.

4.0 Overall Conclusion

This audit revealed that the management controls identified in the audit criteria for Corporate Services (Finance and Administration) in the Ontario and Pacific regions are operating effectively with minor exceptions and that transactions are processed in a manner that is compliant with the applicable policies, procedures and regulations.

Appendix A: Audit Criteria

Appendix B: Management action plan