Procurement and Contracting Activities at the Office of the Auditor General of Canada

Statement of Assurance and Conformance

This independent assurance report on procurement and contracting was prepared by the Internal Audit, Risk, and Evaluation Office at the Office of the Auditor General of Canada. Our responsibility was to provide objective information, advice, and assurance to assist the organization in assessing the adequacy of its management control framework for procurement and contracting.

In conducting the audit work, we complied with the independence requirements and other ethical requirements of the relevant rules of professional conduct applicable to the practice of internal audit, which are founded on fundamental principles of integrity, objectivity, professional competence, due care, confidentiality, and professional behaviour. In accordance with our regular audit process, we obtained the following confirmation from management:

• management’s responsibility for the subject under audit
• acknowledgement of the suitability of the criteria used in the audit
• all known information that has been requested, or that could affect the findings or audit conclusion, has been provided
• the final audit report is factually accurate

The audit conclusions and recommendations are based on a comparison of the conditions, as they existed at the time, against pre‑established audit criteria that were agreed on by management. Appendix A provides details on the audit approach and methodology used to derive sufficient evidence to conclude on the engagement objectives.

In my professional judgment as Chief Audit Executive, this audit was performed to a reasonable level of assurance in accordance with the Institute of Internal Auditors’ Global Internal Audit Standards that were issued in January 2024. It was also performed in accordance with Treasury Board of Canada’s Policy on Internal Audit and Directive on Internal Audit for the Government of Canada.

I would like to thank my team for their work on this audit. I am also grateful to management and the various teams within the organization for their co‑operation throughout our work on the procurement and contracting engagement.

Julie Bastarache
Chief Audit, Risk, and Evaluation Executive
Office of the Auditor General of Canada

1. Context for the Audit

The Internal Audit on Procurement and Contracting Activities at the Office of the Auditor General of Canada was undertaken in accordance with the approved Risk‑Based Audit and Evaluation Plan for the 2023–24 to 2024–25 Fiscal Years. In May 2024, the Chief Audit, Risk, and Evaluation Executive submitted a proposal to the Audit Committee to recommend adding this audit to the initial plan, in response to the changing organizational and external context. The audit was approved by the Auditor General on the recommendation of the Audit Committee.

1.1 Relevant considerations in undertaking this engagement

Events prior to internal audit approval

• In January 2024, the Office of the Procurement Ombud (OPO) issued a report focusing on the Procurement Practice Review of ArriveCAN. It issued another report on contracts awarded to McKinsey & Company.
• On 12 February 2024, the Office of the Auditor General of Canada released a report on ArriveCAN. It then tabled a report on professional services contracts in the spring.
• On 27 February 2024, the Office of the Comptroller General of Canada (OCG) held a meeting with Chief Audit Executives on the recent findings of the OPO and the Office of the Auditor General of Canada (OAG) related to procurement and the associated findings regarding the systems of internal controls.
• On 28 March 2024, direction was given by the Comptroller General to CAEs regarding procurement. CAEs were asked to include a review of procurement internal controls and governance in their organization’s risk‑based audit plan, if a review has not been completed in the past 12 months. Although the OAG is not subject to the OCG’s directive or part of the horizontal internal audit, it was agreed that the Internal Audit, Risk, and Evaluation Office should conduct an audit on procurement.
• An audit of procurement at the OAG has not been undertaken by the Internal Audit team, but it had completed a review of select controls in 2020.

OAG context during the internal audit work

• In January 2023, a revised internal policy on procurement was developed and approved. The policy was updated in September 2024 to reflect new Treasury Board requirements.
• In August 2024, the Director of Contracting and Procurement left the OAG. A hiring process resulted in the appointment of a new director in fall 2024.
• The Contracting and Procurement team at the OAG is adapting to the changing context and expectations regarding procurement in the federal government. Therefore, it was recognized that this audit would be an audit in flight, to adapt to the rapidly changing context.
• It is also recognized that there is work underway to migrate to a new financial system that would impact current business processes, which would need to be updated.

Events after the internal audit work

• Federal government horizontal internal audit. In March 2025, after the work on this internal audit was completed, the Treasury Board of Canada Secretariat released a report on its Horizontal Internal Audit of Procurement Governance, which began prior to the approval of the internal audit of the OAG’s procurement and contracting activities. The findings from this internal audit align with the results of the OCG‑led horizontal audit. The OCG audit focused specifically on governance while this audit had a broader scope and also included values and ethics, compliance, and value for money.
• Vendor performance management. On 7 May 2025, the Internal Audit, Risk, and Evaluation Office, OAG management, and the organization’s Audit Committee met to discuss this internal audit report. As a result of that discussion, the Internal Audit, Risk, and Evaluation Office and management agreed to work together to ensure that an in‑depth conversation on vendor performance management takes place internally at the appropriate governance committee.
• Performance audit of professional services contracts. On 10 June 2025, the Auditor General of Canada tabled a second performance audit report of professional services contracts in the federal government. The performance audit found issues with how public servants applied federal procurement rules. These findings were similar to findings from previous OAG audits on ArriveCan and Professional Services Contracts.
• Changes to the OAG’s contracting activities. With the coming into force of amendments to section 9 of the Department of Public Works and Government Services Act on 9 June 2025, the OAG obtained a delegation of authority to contract for services (which includes non‑professional and professional services, aside from legal services) from the Minister of Finance effective on that date. That effectively clarifies the contracting authorities for procuring non‑professional services.

2. Audit Objective and Scope

The objective of this audit was to assess whether the OAG has adequate, effective, and efficient procurement and contracting practices. The following are key definitions.

• Adequacy is defined as the sufficiency or appropriateness of the processes, controls, or systems to meet a particular need or requirement.
• Effectiveness refers to the degree to which a process, control, or system achieves its intended outcomes or objectives, that is, whether something is working as intended.
• Efficiency refers to how well resources (time, money, and effort) are used to achieve a desired outcome, often with a focus on minimizing waste or optimizing productivity.

2.1 Period covered by the audit

The audit covered the period from 1 April 2022 to 30 June 2024. This is the period to which the audit conclusion applies. Where appropriate, the audit also considered additional information and events that took place after the end of the audit period to ensure that it reflected additional actions taken by the OAG.

2.2 Areas examined in the scope of the audit

• Authorities
• Roles and responsibilities
• Training and guidance
• Indigenous vendors and federal procurement
• Values and ethics
• Compliance
• Value for money
• Vendor performance evaluation

2.3 Out of scope

Given the timelines for this audit, and in discussion with management, the following elements were scoped out of this engagement. The Internal Audit, Risk, and Evaluation Office may complete work on these elements in the future, if it is deemed appropriate.

• Lifecycle costing. This focus area was identified as being part of broader challenges related to cost forecasting and is beyond the audit’s focus on procurement and contracting.
• Compliance with the use of acquisition cards. Acquisition cards are a payment method rather than a specific procurement and contracting vehicle.
• Green procurement. This was not identified as an area of higher risk because the OAG does not contract for construction, large numbers of vehicles, or other activities that would result in significant pollution or greenhouse gas emissions.

3. Audit Conclusions and Recommendations

Overall, the Office of the Auditor General of Canada has adequate management control over procurement and contracting. However, areas have been identified for improvement to ensure overall effectiveness and efficiency of the process.

The OAG’s procurement operation generally succeeds in fulfilling its core mandate by meeting organizational goals and regulatory requirements, despite challenges, such as the following:

• increases to the Contracting and Procurement team’s workload because they take on additional tasks and work to support and facilitate the contracting process
• low levels of procurement and contract management experience among business owners, which requires more support
• evolving policy requirements
• technological limitations and inefficient processes
• a lack of tools

The following were the audit conclusions and recommendations.

3.1 Procurement authorities

The organization has clear authorities for procuring goods and professional services. However, clarification of its contracting authorities for procuring non‑professional services is needed.

Questions about the Auditor General’s contracting authorities are long‑standing. The organization is engaging proactively with Public Services and Procurement Canada regarding its procurement thresholds. The organization should continue to collaborate with interested parties to further clarify the organization’s contracting and procurement authorities for non‑professional services and take steps to address any gaps.

Clarifying the organization’s contracting and procurement authorities for non‑professional services promotes accountability and efficiency in decision making, reducing risks of mismanagement and legal issues.

3.2 Roles and responsibilities

Roles and responsibilities for procurement and contracting have been established and communicated within the organization. However, the organization could benefit from strengthening its oversight, accountability, and monitoring of the execution of those roles and responsibilities. The following are supporting observations.

• While key roles and responsibilities have been established and documented in the policy framework, some roles have not been included. These include the roles and responsibilities of the Deputy Chief Financial Officer, assistant auditors general, and the Legal Services team.
• The OAG Policy on the Management of Procurement includes the Responsibility Matrix for the Execution of Contracting and Procurement Activities; however, an analysis of the assigned responsibilities reveals that they require clarification in ensuring clear accountabilities have been established.
• There is ambiguity in the execution of some of the roles and responsibilities, in particular section 32 of the Financial Administration Act and contract management.

Recommendation 1. In collaboration with interested parties, the Senior Designated Official for the Management of Procurement should lead a comprehensive review of the current roles and responsibilities related to procurement and contracting across the organization, to ensure that they are clearly defined, up to date in the revised policy, and aligned with evolving processes and systems to facilitate accountability, effectiveness, and efficiency.

Impact. By reviewing and updating roles and responsibilities, the organization can foster a more cohesive, efficient, effective, and accountable procurement and contracting process.

3.3 Training and guidance

Training and guidance for procurement and contracting activities is available. The majority of the relevant courses are offered through the Canada School of Public Service (CSPS). However, the organization has not identified or addressed specific training needs to improve the organization’s overall knowledge and competencies in procurement and contracting, in particular as they relate to business owners. The following are supporting observations.

• The organization developed a policy and framework for procurement in 2023, which was updated in September 2024 to reflect new government‑wide procurement requirements.
• The Contracting and Procurement team has access through CSPS to a comprehensive list of mandatory training and additional training. Overall, training is frequently discussed between team members and their managers to ensure that it is completed in a timely manner.

There may be opportunities to strengthen training and guidance related to procurement and contract management requirements and practices at the OAG.

Business owners indicated that current training and guidance resources are not meeting their needs to ensure that they are able to carry out their responsibilities.

Recommendation 2. The Senior Designated Official for the Management of Procurement, in collaboration with the Director of Professional Development and other interested parties, should develop options for training, guidance and tools to improve the knowledge and competencies in the procurement process and contract management.

Impact. The audit identified gaps in employees’ understanding of organizational-specific processes, leading to inconsistencies in the effective and efficient execution of roles and responsibilities. Developing additional training and guidance on the procurement and contracting processes could yield significant results, which can include enhancing compliance with changing requirements and increasing the efficiency of the process as roles and responsibilities are executed effectively. Overall, this could help increase the maturity of the organization’s procurement activities and the effective execution of the various roles and responsibilities.

3.4 Indigenous businesses and federal procurement

Overall, the organization has established clear measures and mechanisms within its Indigenous business procurement plan to facilitate compliance with the federal 5% annual target. However, there are opportunities for improving the sustainability of the plan. The following are supporting observations.

• On 8 April 2024, the Auditor General approved the OAG’s procurement plan for achieving the mandatory minimum target of 5% for the 2024–25 and 2025–26 fiscal years.
• The organization began tracking the number of contracts it put in place with Indigenous businesses before it was required to meet or exceed the 5% target in the 2024–25 fiscal year.

Although there are no formal recommendations, the opportunities identified by the audit include considering the following:

• Reflecting contingencies in future plans—This adjustment would increase the sustainability of the plan while also addressing any unforeseen issues or events.
• Raising awareness and promoting programs—This would encourage shared responsibility with business owners to use set‑aside programs and common service providers.
• Documenting risks in meeting the target in the plan—The current plan does not recognize the risks the organization faces in meeting the targets in the long term.

3.5 Values and ethics

While the OAG has mechanisms in place to support values and ethics in its procurement and contracting activities, there is a need to formalize and document the mechanisms in place within the organization to foster common understanding. The following are supporting observations.

• Overall, gaps in clear understanding by business owners of mechanisms and processes for resolving ethical issues and conflicts in the procurement and contracting process. We note that within the organization, management of ethical issues and conflicts of interest falls under the OAG Internal Specialist for Values and Ethics. This includes the issues encountered in procurement and contract management. If OAG employees are not aware of how to resolve ethical issues and conflicts, then the mandatory training of the OAG values and ethics needs to be revised to cover this gap.
• Despite elements of values and ethics being incorporated, there was a lack of consistency in the communication of values and ethics expectations in contractual documents. The Contracting and Procurement team indicated that the templates were being modernized during the period covered by the audit. The Senior Designated Official indicated that there is a possibility that the organization has been using a variety of templates and that efforts were underway to modernize the OAG’s templates during this period and continue to leverage Public Services and Procurement Canada’s templates going forward, which include modernized templates that strengthen vendors’ values and ethics obligations.
• Several examples illustrate that the interested parties have actively identified and addressed some ethical issues.
• We note that the updated policy on procurement that took effect at the end of our audit period reflects new requirements regarding values and ethics. Given the timing, we were unable to assess the overall effectiveness of implementation.

Recommendation 3. The Senior Designated Official for the Management of Procurement should collaborate with interested parties within the organization to formally document and raise awareness regarding the mechanisms for ensuring that values and ethics are reflected in procurement and contracting processes, including procedures for resolving conflicts within the organization and with vendors.

Impact. Ensuring that interested parties have access to a formal documentation on the mechanisms in place for values and ethics could improve ethical awareness, responsible decision making, compliance, and the culture of integrity within the organization regarding procurement activities.

3.6 Compliance

The Financial Administration Act includes specific sections that apply to procurement and contracting activities. The audit examined compliance with authorities for commitment (section 32), transaction (section 41), certification (section 33), payment (section 34), and proactive disclosures (section 42(1) e).

Overall, the organization complies with the relevant applicable sections of the Financial Administration Act and with its internal procedures. The following opportunities for improvement were identified during the audit:

• Consider enhanced monitoring of administrative processes regarding section 32 approvals as part of the implementation of the new financial management system.
• Consider opportunities to strengthen business owner awareness of contract exceptions and their responsibilities for reporting policy non‑compliance.
• Consider sharing internal reporting on exceptions with internal committees, such as the Office Operations Committee. Contract exceptions are reported as part of the quarterly report on procurement to the Executive Committee.
• Consider strengthening monitoring and oversight over timeliness on the payment of invoices.

3.7 Value for money

In the context of federal procurement and contracting, value for money is a complex topic that includes the procurement strategy, the selection of a contractor, contract management, and the outcomes of the contract.

Value for money is closely linked to the Directive on the Management of Procurement requirement that procurement decisions demonstrate best value and sound stewardship of funds. Value for money is the consideration of the appropriate balance of minimizing costs, receiving quality outputs, and maximizing the intended outcomes. The audit focused on the OAG’s mechanisms for assessing and documenting value for money, in support of demonstrating best value and sound stewardship.

Overall, the organization’s procurement and contracting activities are guided by the principles of value for money. The OAG has mechanisms in place to demonstrate value for money in its process to establish contracts. However, there are opportunities to clarify its expectations with regard to how it demonstrates value for money in contract management and documentation.

The OAG has established processes and mechanisms for demonstrating value for money in the selection of the procurement strategy and the selection of a contractor.

• There are mechanisms in place for business owners to identify and document operational needs to be met through service contracts.
• Contracts that are not competitively tendered must have a documented valid reason as established in the Government Contracts Regulations.

There are opportunities to support more effective implementation of established responsibilities for demonstrating value for money during the delivery of the contract and contract close‑out.

• Business owners are responsible for contract management and monitoring the delivery of the contract.
• The OAG’s Contract Management Guide requests, but does not require, that business owners document the outcomes and benefits achieved at the end of their contracts.
• The OAG’s Policy on the Management of Procurement does not include accountability mechanisms for contract management or for demonstrating value for money.

We note that in the updated OAG policy that took effect in September 2024, there is a new expectation stating that “Business Owners will preserve documentation demonstrating that the intended outcomes or benefits of the procurement have been achieved. Documentation will be placed on the contracting file where it will be maintained for a retention period of 6 fiscal years following the end of life of the procured material asset or contract termination, whichever is later.”

This new policy requirement was not in place during the audit period; however, the lack of clear processes and guidance for documenting and retaining contract files related to demonstrating that the intended outcomes or benefits of the procurement have been achieved is a risk for complying with the new policy requirement.

Recommendation 4. The Senior Designated Official for the Management of Procurement should work with interested parties to formalize a lifecycle process for assessing value for money, including the following:

• establishing clear procedures
• providing clear definitions, tools, and guidance to identify outcomes and requirements
• evaluating outcomes and lessons learned as part of contract close out
• centralizing contract files to ensure that all relevant records are easily accessible, organized, and up to date

Impact. Establishing a common understanding of value for money in the context of the OAG’s procurement is an important first step to setting expectations of how value for money should be demonstrated and assessed. A more robust process for assessing value for money throughout the lifecycle of the organization’s procurements could help the OAG strengthen the implementation and demonstration of the principles of value for money outlined in its policy.

3.8 Vendor performance evaluation

Although some business owners are informally assessing vendor performance, the organization does not formally evaluate and document vendor performance for future consideration. It is recognized that vendor performance evaluation within the context of public sector procurement is a complex and delicate concept that requires consideration of many different factors. Examples include ensuring consistent approach, not creating bias in vendor selection because of past performance evaluation and considering commercial confidentiality and access‑to‑information obligations. As mentioned in the section on events after the audit, this is an area that has been recommended by the Audit Committee for monitoring by the organization.

4. Management Response and Action Plan

Management accepted the findings and is addressing the audit recommendations. The Internal Audit, Risk, and Evaluation Office will continue to work with management to monitor and report on the implementation of management action plans.

5. Appendix A—Audit Methodology

5.1 Approach

The team used an agile approach to deliver this engagement. This ensured timely collaboration with management in terms of the work and the sharing of the engagement results as work was being completed.

5.2 Focus Areas and Criteria

The following were the criteria and sub‑criteria to conclude against our audit objective by focus area and criteria

Authorities

The organization has clarity regarding its contracting authorities as they relate to procurement and contracting activities.

Roles and responsibilities

Clear roles and responsibilities for procurement and contracting have been established and communicated within the organization.

Training and guidance

The organization has identified training and guidance needs related to procurement and contracting and has taken steps to address these needs to support the implementation of roles and responsibilities for procurement and contracting.

Indigenous businesses and federal procurement

The organization has put measures in place to implement its plan for Indigenous procurement.

Compliance

The organization conducted its procurement and contracting activities consistent with all internal policy and procedures.

Values and ethics

There are mechanisms in place to ensure that procurement and contracting activities are conducted with consideration for

• the integrity of the procurement and contracting process
• conflict resolution within the organization and with vendors
• conflict of interest
• favouritism in the selection and use of vendors

Value for money

The organization identified and documented the operational needs to be met.

The organization demonstrated that the contracts put in place were required as the appropriate tool to meet operational needs.

The contracts awarded clearly communicated intended contractual outputs and deliverables.

The organization conducted adequate monitoring during the contractual phase to ensure that it received the best value.

The organization assessed whether the goods or services provided were used to achieve the intended outcomes and best value.

Vender performance evaluation

The organization evaluated and documented vendor performance information for future consideration.

Sources of the criteria

• Auditor General Act
• Financial Administration Act
• Government Contracts Regulations
• Policy on the Planning and Management of Investments (2022)
• Directive on the Management of Procurement, Treasury Board (2023)
• Policy on the Management of Procurement, OAG (2023)
• Procurement Management Framework, OAG (2023)
• Directive on Conflict of Interest, Treasury Board (2020)
• Values and Ethics Code for the Public Sector, Treasury Board
• Code of Values, Ethics, and Professional Conduct, OAG

Additional documents were used by the audit team to identify other considerations, best practices, or requirements that do not apply to the OAG, to inform recommendations to management or in discussions between the audit team and management for management’s consideration. For example, the audit team considered the Vendor Performance Management Policy by the Public Services and Procurement Canada that came into effect on 1 August 2023.

5.3 Methodology

The methodology used for this audit included performing various procedures to address the engagement’s objective. These include, but are not limited to the following:

1. Review of legislative, policy, and operational documents
2. Walkthroughs of OAG processes, financial system, and contract data
3. Data analytics—We obtained and examined data for all contracts that were executed, amended, or incurred expenses during the 2022–23 and 2023–24 fiscal years. We also obtained and reviewed invoice data for the same period.
4. Interviews with interested parties, including assistant auditors general, principals, directors, and the Contracting and Procurement team
5. Purposive and non‑representative sample selection of contracts for audit work
   • The sampled contracts were used for work in the following focus areas:
     • compliance testing
     • review of contracts for provisions related to values and ethics
     • file review work, including review of statements of work and documentation for value for money
   • The sampling strategy for contracts considered the following:
     • all groups in the office
     • contracts covering goods and services
     • procurement vehicles used, including the award and solicitation methods
     • consideration of different contract values, with a focus on higher contract values, including contracts with significant increases in value because of amendments
   • The 30 files sampled represented 5% of the total number of contracts in place and 32% of the total value of contracts within the scope of the audit:
     • 78% of the 30 contracts were for services, and 22% were for goods
     • 48% were for competitive contracts, and 52% were for non‑competitive contracts
6. Selection of invoices for the 30 sampled contracts. On average, 2 invoices were selected per contract where more than 1 was paid during the period covered by the audit. Key tests included document review for compliance with sections 33 and 34 of the Financial Administration Act.
7. Questionnaires covering roles and responsibilities, training and guidance, values and ethics, value for money, and efficiency were issued to various groups to obtain their perspective.
   • Contract managers for the 30 sampled contracts were asked to complete a questionnaire. Responses were received for 97% (29 of the 30) of contracts.
   • Contracting and Procurement team members were asked to complete a questionnaire, and 80% (8 of 10) of the team members responded.
8. A survey was designed by the internal audit team in consultation with the OAG’s Data Analytics and Research Methodology team to assess the extent to which business owners agreed or disagreed with specific statements related to the focus areas (roles and responsibilities, training and guidance, values and ethics, value for money, and efficiency). To determine who should receive the survey, the internal audit team requested that each group to provide a list of employees who are very experienced with the OAG’s procurement and contracting process. There was no limit to the number of names that each group could propose. Using the information provided, 45 individuals identified as being knowledgeable about the procurement process were asked to complete the survey. Of these, 84% (38 of 45) completed the questionnaire.
9. Use of artificial intelligence (AI) to review, summarize, and analyze public reports related to procurement and contracting. The AI output was reviewed by an experienced auditor who applied professional judgment in the use of the results.
10. Benchmarking of the audit findings to findings from other public reports, including internal audits in other organizations.