Audit of Policy on Internal Control Implementation (Phase 1)

Acronyms and Abbreviations

Back to Table of Contents

Slide 3

Statement of Conformance

The audit findings and conclusions contained in this report are based on sufficient and appropriate audit evidence gathered in accordance with procedures that meet the Institute of Internal Auditors’ International Standards for the Professional Practice of Internal Auditing. The audit thus conforms to the Internal Auditing Standards for the Government of Canada as supported by the results of the quality assurance and improvement program. The opinions expressed in this report are based on conditions as they existed at the time of the audit and apply only to the entity examined.

Back to Table of Contents

slide 4

Background 1

• The Policy on Internal Control (PIC) took effect on April 1, 2009 for departments and agencies within the Government of Canada.
• The Policy supports the focus on accountability resulting from the Federal Accountability Act, and it is one of the elements in the Treasury Board Secretariat’s Policy Framework for Financial Management.
• Key objective of the PIC: “Risks relating to the stewardship of public resources are adequately managed through effective internal controls, including internal controls over financial reporting.”
• The expected results are as follows:
  • An effective risk-based system of internal control is in place in departments and is properly maintained, monitored, and reviewed, with timely corrective measures taken when issues are identified.
  • An effective system of internal control over financial reporting is operating in departments as demonstrated by the departmental Statement of Management Responsibility Including Internal Control Over Financial Reporting.

Back to Table of Contents

slide 5

Background 2

Figure 1. Process Overview - Assessment of Effectiveness of Internal Controls.¹ This table shows the process overview for implementing the PIC. Process starts at box one and finishes at box seven.

Footnote 1 Policy on Internal Control — Diagnostic Tool for Departments and Agencies (Draft).

Back to Table of Contents

Slide 6

Background 3

• The Department of National Defence (DND) submitted a plan to the Office of the Auditor General and the Standing Committee on Public Accounts to have an effective risk-based system of internal controls in place by fiscal year (FY) 2016/17. The Department recognizes that it is unlikely to achieve full compliance by this date.
• Internal control management is included in the Department’s Management Accountability Framework (MAF) assessment. DND received the following note from the National Defence MAF 2014-15 Departmental Report: “Although PIC has been in place for more than five years, DND has not yet completed its initial design and operating effectiveness testing and required remediation in all three control areas. As such, the Department has not yet put in place a program to continuously monitor the effectiveness of its internal controls.”
• In response, the Department has set up a Project Management Office and developed a three-year integrated plan to ensure PIC compliance by FY 2018/19.

Back to Table of Contents

Slide 7

Background 4

Based on the draft MAF assessment for 2015-16, 70 percent of departments and agencies are PIC compliant.

While other departments and agencies appear to have made further progress on PIC implementation, a direct comparison cannot be made due to inherent differences with DND. Namely, the Treasury Board Secretariat recognizes that departmental size, complexity, risk, capacity, decentralization, and other pertinent factors for departments such as DND can impact the time it takes to implement the policy.

In comparison, the US National Defense Authorization Act of 2010 mandated that the Department of Defense have audit-ready financial statements by September 30, 2017. According to its Agency Financial Report for fiscal year 2014, “[t]he Department of Defense has struggled with effective and timely development and implementation required by the Act, and it will continue to do so until it is able to do the following:

• Resolve material internal control weaknesses to ensure internal controls are properly designed, implemented, and working effectively.
• Sustain improvement in internal controls and systems to provide consistent and repeatable financial data used in decision making and reporting.”

Back to Table of Contents

Slide 8

Objective and Criteria

Objective

To determine whether the governance structure, risk management, and processes are in place to support the successful implementation of the PIC.

Criteria

1. The Department has established clear roles, responsibilities, accountabilities, oversight, and the appropriate governance structures to support the implementation of the PIC.
2. The Department has conducted risk assessments to identify and prioritize risks impacting corporate objectives to achieve an effective, risk-based system of internal control.
3. The Department has identified key internal controls for important risks, tested their effectiveness, and developed remediation activities to strengthen weaknesses to attain an effective system of internal control.

Back to Table of Contents

Slide 9

Scope and Reporting

Scope

Inclusion: Implementation activities completed to date and planned implementation activities as stated in the “Status and Action Plan” in the fiscal year 2014-2015’s Statement of Management Responsibility Including Internal Control.

Exclusion: Activities related to Information Technology General Controls as Assistant Deputy Minister (Review Services) has other audits in its Risk-Based Audit Plan that will cover this area.

Reporting

Phase 1: Findings and recommendations related to criteria 1 and 2.

Phase 2: Comprehensive coverage related to all audit criteria.

Back to Table of Contents

Slide 10

Governance 1

Progress Made

The Department has made significant progress on the implementation of the PIC during 2015, as follows:

• Established a formal Project Management Office (PricewaterhouseCoopers).
• Created a Three-Year Integrated Plan.
• Reorganized/prioritized resources. For example: reorganized resources at Director Financial Policy, proposed prioritization of changes to the Defence Resource Management Information System, continued funding for Assistant Deputy Minister (Materiel)’s PIC initiatives.
• Included PIC-related activities in performance agreements for both civilian(ADM-level) and military (ranks: colonel and above) personnel.
• Embedded PIC activities and requirements in various transformation initiatives.

Back to Table of Contents

Slide 11

Governance 2

Establishment of a Formal Project Management Office (PMO)

Prior to 2015:

No formal project charter or work objective was set out by the Policy on the Stewardship of Financial Management Systems, the Policy on Financial Management Governance, or the PIC.

Lack of robust project management.

Since 2015:

Adequately resourced PMO to manage, track, and monitor multiple PIC implementation activities. Developed a PMO handbook that defines elements such as scope and the role of the PMO, risk and issues management, and project performance monitoring and reporting.

The PMO uses the following tools to support the management of PIC implementation:

• Control Repository² — databank of source files for all financial processes and controls to support PIC.
• Integrated Plan — holistic view and planned execution timing of all tasks required to complete the full cycle of control testing and remediation.
• Risk and Issue Logs — tools used to track and manage risks and issues.
• Change Control Log³ — to track and manage change requests that impact the scope and schedule of the Integrated Plan.

Footnote 2 Existed prior to 2015.

Footnote 3 Designed, but not yet in use.

Back to Table of Contents

Slide 12

Governance 3

Three-Year Integrated Plan

• Provided a sequential overview of activities required for PIC implementation.
• Developed by the PMO in consultation with the working-level staff at Office of Primary Interest (OPI) / Process Level Controls (PLC) owners in consideration of resources and time constraints.
• Updated by PMO (owner of this plan) from input provided by OPIs.
• Included Entity Level Controls, Information Technology General Controls, and 11 PLCs in the implementation plan.
  • 4 of 11⁴ PLC areas and Information Technology General Controls are scheduled in order to complete the remediation of operating effectiveness deficiencies just two months prior to the March 31, 2019 deadline. Any delay in the completion of these tasks may result in the Department not fully meeting its implementation commitment.
  • Unanticipated business process transformations may result in additional work that was not originally factored into the Integrated Plan and may result in the rework of completed activities. This creates a risk that could delay the full implementation of the PIC at DND.

Footnote 4 Result based on analysis of Three-Year Integrated Plan updated on January 12, 2016.

Back to Table of Contents

Slide 13

Governance 4

Reorganized/Prioritized Resources

• ADM(Fin)’s business planning process has specifically included PIC resource requirements in its FY 2015/16 to FY 2018/19 Integrated Resource Plan. In 2015, ADM(Fin) initiated the following activities to optimize resource allocation to implement the PIC:
  • Supporting the implementation of the PIC is one of Director Financial Policy’s top priorities as evidenced by the creation of a new section that will be responsible for the Balance Sheet related to Financial Administration Manual chapters, particularly those impacted by the implementation of the PIC.
  • Director Financial Systems Operations and Integration engaged Assistant Deputy Minister (Information Management) and other Level Ones (L1) to make PIC-related change requirements a priority over other change requirements for the Defence Resource Management Information System.
  • ADM(Fin) continues to provide financial support to fund five Full-Time Equivalent positions within Assistant Deputy Minister (Materiel)’s PIC Team in order to implement the PIC.

Back to Table of Contents

Slide 14

Governance 5

PIC-related Activities Forming Part of Performance Agreements

• Six L1s (five civilians and one military member) were identified as key to the implementation of the PIC. The Performance Agreements for these positions were examined. For FY 2015/16 only five were available for review.
  • Four out of five ADM-level civilian PLC owners had PIC-related activities included in their Performance Agreements.

  • We did not review the L1 military member’s Personnel Appraisal. However, all military personnel at the rank of Colonel or above had “incorporating elements of a sound system of internal controls” as a category in their competency profile for Personnel and Resource Management in the new Personnel Appraisal and Talent Management System.

Embedding PIC-related Activities in Transformation Initiatives

• Transformation activities such as Defence Renewal and Infrastructure and Environment Business Modernization has resulted in changes to processes and control activities requiring the rework of previously documented design effectiveness tested PLC areas.
  • To mitigate the impact of possible future delays, Director Financial Controls actively participates in these transformation initiatives by ensuring that PIC-related activities are considered.

Back to Table of Contents

Slide 15

Governance 6

Progress to be Made

• Provide PIC progress updates to the Defence Management Committee (DMC) and the Departmental Audit Committee (DAC)
• Increase frequency of meetings at ADM Steering Committee and Director General (DG) Steering Committee

Back to Table of Contents

Slide 16

Governance 7

PIC Progress Updates Provided to DMC and DAC

• Director Financial Controls has provided periodic updates on PIC to DAC, and PricewaterhouseCoopers has been contracted to provide annual assessments since 2012. The annual assessments provide an overall summary of the progress of planned activities for the fiscal year and the risks and issues impacting PIC compliance in the Department.
  • This report does not provide a comprehensive multi-year outlook to the reader on the complexity, scope, and schedule commitments required for PIC implementation.
• The PMO has since developed a dashboard to provide a comprehensive status report, which has been provided to senior management. This tool includes the number of control deficiencies, an implementation timeline and a summary of risks and issues.
• Review of DMC meeting minutes indicate that the annual assessment was not provided to DMC members nor was PIC included on the committee’s agenda, thus visibility on PIC progress may have been limited.

Back to Table of Contents

Slide 17

Governance 8

Back to Table of Contents

Slide 18

Governance 9

ADM Steering Committee and DG Steering Committee

• There are terms of reference that describe the roles and responsibilities for the ADM Steering Committee and the DG Steering Committee.
• The DG Steering Committee’s mandate is to resolve issues regarding projects/program approval that will have an impact on ongoing initiatives and the project.
• The ADM Steering Committee convened for the first time on 25 April 2016. Prior to this meeting, there had not been a formal mechanism to address cross-functional issues that cannot be resolved by the DG Steering Committee.

Back to Table of Contents

Slide 19

Risk Management

Establishment of a Formal Risk Register and Issues Log

• Prior to 2015, aside from the independent annual assessment of the PIC presented to the DAC, there was no formal risk register to track risks and issues as they arose.
• Since 2015, ADM(Fin) has developed a strategy that requires all business owners and remediation action owners to identify all program and project risks to the PMO so that they can be recorded and managed.
  • The PMO follows a six-step process that includes: (1) identify risk; (2) log and assign risk; (3) review risk; (4) address risk; (5) monitor and report risk; (6) close risk.

Back to Table of Contents

Slide 20

Conclusion

Reorganized/Prioritized Resources

Based on the evidence examined, during FY 2015/16, the Department made significant progress in the management of PIC implementation. ADM(Fin) is the lead in PIC implementation; however, the remediation and the implementation of controls resides with various L1 organizations across the Department. Transformation activities may delay full implementation beyond FY 2018/19. Improvements in the following areas would further promote the successful implementation of this initiative:

• Provide additional details to DMC and DAC on the progress made on PIC implementation.
• Ensure the overarching governance bodies that address cross functional PIC implementation issues across the Department meet on an agreed-upon periodic basis.

Back to Table of Contents

Slide 21

Next Steps

Proceed with Phase 2 of planned audit activities. This includes examining the processes carried out by the Department in the following areas:

• Evaluate design effectiveness of controls
• Remediate control design deficiencies (Working Group)
• Evaluate operational effectiveness of controls
• Remediate operational effectiveness deficiencies (Working Group)
• Ongoing monitoring of controls, periodic risk-based retesting and remediation

Back to Table of Contents

Slide 22

Management Action Plan

Back to Table of Contents

Slide 23

Management Action Plan 1

Governance

Management Action

In addition to the independent annual assessment, DAC and DMC will be briefed on the PIC status at least once per year supported by the summary level dashboard.

OPI: ADM(Fin) / CFO

Target Date: December 2016

Back to Table of Contents

Slide 24

Management Action Plan 2

Governance

Management Action

The terms of reference for the DG Level steering committee have been reviewed by the committee and it is agreed that meetings will be held quarterly. The terms of reference for the ADM level steering committee have been reviewed by the committee and determined that they will meet twice per year in the fall and spring. ADM(RS) has been requested to attend both committees as an observer.

OPI: ADM(Fin) / CFO

Target Date: June 2016

Back to Table of Contents