Internal Audit Committee Annual Report - 2015-2016

Introduction

This annual report of the Internal Audit Committee (IAC) of the Public Service Commission (PSC) covers the period from April 2015 to March 2016.  It follows the guidance provided by the Office of the Comptroller General in the Guidebook for a Departmental Audit Committee and meets the reporting requirements for the IAC as established in theDirective on Internal Auditing in the Government of Canada.

The report will begin by providing some important contextual information about how the operations of the IAC were impacted by internal and external factors in 2015-2016.  It will then provide a summary of the IAC's work during this period.  This will be followed by an assessment of the internal audit and evaluation functions, and an assessment of developments over the year in the IAC's core areas of responsibility.  Finally, the report will present the IAC's overall conclusions about 2015-2016 and its priorities for 2016-2017.  An Annex on the membership and operations of the IAC is also included.   

Context

Two unanticipated developments impacted significantly the operations of the IAC in 2015-16.  The first was the unanticipated departure of the Chief Audit Evaluation Executive (CAEE) for reasons that the IAC understood and supported, along with some significant personnel changes in the Internal Audit and Evaluation Directorate (IAED), and the second was an unexpected delay in the reappointment of two external members.

The CAEE was immediately replaced by an experienced executive who is well suited to lead the IAED.  However, this change at the executive level took place at a time when the IAED was already experiencing some significant staffing challenges, and the new CAEE had to focus on rebuilding his team as his first priority.  As explained in this report, this had a significant impact on the delivery of projects approved in the Three-Year Integrated Risk-Based Audit and Evaluation Plan 2015-2018.

In addition, the initial terms of two external members, including the chair, expired shortly after the IAC meeting held in December 2015.  Due to unforeseen delays in the appointment process following the last federal election, the next scheduled meeting, which was to be held in March 2016 to conclude the business of 2015-2016, had to be canceled.  As explained in this report, this had a significant impact on the implementation of the IAC's annual plan for 2015-2016.

In this context, this report has been written later than in previous years and well into the next reporting period.  For this reason, it includes some text boxes that explain subsequent developments so the reader can understand that the unique situation described in the preceding paragraphs and the impacts on the IAC's operations described in the subsequent sections of this report were temporary. 

It is also important for the reader to understand that 2015-2016 was a critical period for the PSC in transforming the way it does business through the creation of new policy and oversight frameworks designed to simplify and strengthen the staffing process across the public service.  Development of this New Direction in Staffing was a major preoccupation for the organization throughout the reporting period.  Full implementation of the new frameworks took place on 1 April 2016.  At each of its meetings the IAC was updated and consulted on this work.

Another important contextual factor was that the President continued on extended leave throughout the reporting period and the organization conducted its regular business and moved forward with its work on the New Direction in Staffing under the leadership of the Acting President.  As a result, several other senior executives were required to assume acting roles as well.  While this situation was clearly not ideal, the IAC was impressed by how well the organization pulled together and moved forward during this challenging period.

Finally, it is important for the reader to understand that, despite all of these unusual developments, committee members remain encouraged by the transparent and collaborative way in which the organization has engaged them.  The Vice-Presidents have continued to participate in IAC meetings and senior managers, including the Acting President and the Vice-Presidents, have continued to make themselves available for special briefings and discussions with external members prior to IAC meetings.  This has allowed members to engage more effectively on strategic issues such as the New Direction in Staffing and to prepare more thoroughly for discussions related to the IAC's core areas of responsibility.

Summary of IAC Activities

The IAC met three times during 2015-2016.  These meetings were held in June, October and December and each of them involved a half-day pre-meeting program during which the external members received updates or briefings from the PSC staff on specific issues, an in-camera lunch with the President (which included the other two Commissioners at the October meeting) and a half-day formal IAC meeting.

The Three-Year Integrated Risk-Based Audit and Evaluation Plan 2015-2018 recommended by the IAC at its March 2015 meeting and approved by the Acting President shortly thereafter included three assurance engagements for 2015-2016: completion of an Audit of the Priority Administration Program, a second Core Control Audit and an Audit of Aging Information Technology Systems.  At the June 2015 meeting the IAC reviewed an engagement plan for the Audit of Aging Information Technology Systems and recommended that this engagement be conducted as a consulting one with an emphasis on the medium-term sustainability of the Priority Information Management System (PIMS) and the Public Service Resourcing System (PSRS).  The three-year integrated plan also included three evaluation products for 2015-2016: an Evaluation of Second Language Testing, an Evaluation of Strategic Advice to Organizations and an Evaluation Framework for the Public Service Resourcing System.

At the December 2015 meeting, the new CAEE reported steady progress on the Audit of the Priority Administration Program, the Evaluation of Second Language Testing, the Consultation on the Sustainability of PIMS and PSRS, and the Evaluation Framework for the PSRS and proposed a target date of March 2016 for completion of these four projects.  Given the unique circumstances described in the previous section, the IAC supported this revised delivery schedule.  However, the March 2016 meeting was cancelled and completion of all of these projects was delayed to 2016-2017. 

For 2015-2016, the IAC had developed a comprehensive plan to meet its obligations under the Internal Audit Policy and the Directive on Internal Auditing in the Government of Canada. Despite the cancellation of the March meeting, the IAC was able to complete most of the actions identified in this plan.  For example, it provided recommendations with respect to the Management Action Plan (MAP) for the original Core Control Audit and monitored the implementation of MAPs for previously-conducted audits and evaluations.  The IAC also provided advice on PSC's values and ethics program, corporate risk profile, performance measurement framework, financial management framework and key financial reports.

In addition, at the request of the Acting President, the IAC engaged on two other issues of critical importance to the PSC.  At each meeting it was briefed on progress in developing the New Direction in Staffing and a new Performance Management Framework aligned with this new direction.  In both of these areas the IAC provide significant input and advice.

However, the cancellation of the March 2016 meeting had a significant impact in two ways.  First, the new CAEE had no opportunity to bring products forward to the IAC on the revised delivery schedule which meant that no new audit or evaluation reports were considered by the IAC during 2015-2016.  Second, it was not possible for the IAC to engage in a timely way in important follow-up discussions in some key areas of responsibility.  For example, the planned agenda for the March 2016 meeting had included discussions about the ongoing development of the corporate risk profile, performance management framework and values and ethics program. It was also not possible for the Committee to engage on the next version of the integrated audit and evaluation plan before the start of the next cycle or to provide, as required by the Directive on Internal Auditing in the Government of Canada, timely input into the performance of the CAEE.

Internal Audit Function

At the October meeting, at the request of the IAC, the new CAEE presented his initial plans for the audit function.  The most crucial element of his plan was to place the highest priority on rebuilding capacity so that the IAED could deliver over the longer term.  The IAC was highly supportive of this priority and was pleased when he reported at the December meeting that the audit function was back at full capacity.

Other noteworthy elements of the CAEE's plan were the emphasis on developing greater trust and credibility as an independent advisor to management, scoping audits more tightly to promote timeliness and producing products that are more useful in terms of strengthening management practices.  The IAC is also supportive of these other elements and will monitor and encourage the practical implementation of this emphasis over time.

Overall, the IAC is comfortable that the internal audit function is once again positioned to fulfill its mandate and believes that it is heading in the right direction under the leadership of the new CAEE.  However, the real test will be in the quality and value of the assurance products produced over the next year.

In December, the IAC also reviewed the new CAEE's proposed approach to third party quality assurance.  The committee is fully comfortable with the proposed approach which is comprehensive and includes subjecting the recent Core Control Audit to an independent quality assessment by PricewaterhouseCoopers. 

The IAC is also satisfied that the audit function is maintaining an appropriate level of independence from management.  The CAEE continues to report directly to the Acting President and to have unfettered access to senior management, including the CFO, and to members of the IAC.

Evaluation function

During this reporting period, the IAC continued to respond to PSC's request that it also provide advice on issues related to the evaluation function.   In this context, at the October IAC meeting, the new CAEE also presented his initial plans for the evaluation function.  As for internal audit, the first priority in the plan, which the IAC fully supported, was to rebuild capacity to support delivery over the longer term.  The IAC also supported the revised delivery schedule he proposed for evaluation products at the December 2015 meeting.

2014-2015 was the first full year that the IAC provided advice on evaluation issues and, as reported in the Committee's last annual report, members were beginning to develop a positive view of the function and its potential to contribute to the effectiveness and efficiency of PSC's programs.  However, since the IAC did not review any evaluations in 2015-2016, members believe they have still not dealt with a sufficient number of evaluation products to have a clear sense of the extent to which this function is making a positive contribution.  In this regard, the IAC considers this next year to be a critical one and expects to be in a position to provide a more informed view by the end of 2016-2017.

Assessment in Core Areas of Responsibility

With respect to each of the IAC's eight core areas of responsibility as defined in the Directive on Internal Auditing in the Government of Canada, the IAC's assessment is positive and it has no fundamental concerns or recommendations.  The Committee's overall assessment for each of these areas are as follows:

1. Values and Ethics:  Based on its review of the PSC's updated Values and Ethics Plan and Employee Engagement Strategy in response to the most recent Public Service Employee Survey, the IAC is confident that the organization has a comprehensive values and ethics program that is being well implemented.  The Committee made a number of suggestions and requested an update on progress in implementing the plan at its meeting in June 2016. 
2. Risk Management:  Based on updates and discussions about the PSC's evolving corporate risk profile at three meetings during 2015-2016, the IAC believes that thePSC's work on risk management continues to move in the right direction.  However, sustained attention by senior management will be required over the longer term to implement a mature risk-management approach and culture that is aligned with the New Direction in Staffing.  Since this is an area of ongoing interest, the IAC had asked for a more comprehensive presentation on the Corporate Risk Profile and Risk Registry at the March 2016 meeting.
3. Management Control Framework:  Based on its review of the MAP in response to the Core Control Audit and an updated Financial Management Framework, and ongoing dialogue with the CFO and other senior managers, the IAC continues to believe that the PSC is maintaining effective core controls as it transforms the way it does its business.  Since this is another area of ongoing interest, the IAC had asked for more in-depth briefing on internal control over financial reporting, including the results of annual testing, at the March 2016 meeting.    
4. Internal Audit Function:  The IAC's view of the internal audit function is covered in Internal Audit Function section of this report.
5. External Assurance Providers:  The IAC continued to monitor work relevant to the PSC undertaken by external assurance providers and reviewed the PSC's MAP in response to the OCG's Horizontal Internal Audit of Shared Accountability in Interdepartmental Service Arrangements.  This is an area where the discipline around the timing of the IAC's engagements could be strengthened and, at the December 2015 meeting, the Committee asked the new CAEE to provide an update at each meeting on all relevant work being done or planned by external assurance providers.  
6. Follow-up on MAPs:  The IAC monitored the implementation of MAPs at each of its meetings and is generally satisfied with the PSC's commitment and progress.  The new CAEE has proposed some additional steps, which the IAC supports, to further strengthen the clarity and discipline of reporting to the IAC in this area.
7. Financial Statements and Public Accounts Reporting:  The IAC reviewed and provided advice on the PSC's financial statements including the Public Accounts,Statement of Management Responsibility for Internal Control over Financial Reporting, Future-Oriented Financial Statements and Quarterly Financial Reports.  The IAC is fully satisfied with the quality of this reporting and with the way that its advice is taken into account in finalizing these reports.
8. Accountability Reporting:  The IAC also reviewed the PSC's Annual Report and reviewed and provided advice on its Report on Plans and Priorities (RPP) andDepartmental Performance Report (DPR).  The IAC continues to believe, as reported in its previous annual reports, that the PSC's approach to results-based management needs to be strengthened.  In this regard, the Committee is encouraged by the positive steps the organization has taken during this reporting period to develop an approach to performance management that is based on system-wide expected results, performance indicators and annual targets, and is fully aligned with the New Direction in Staffing.

One other important area of interest to the IAC during this reporting period has been information technology (IT) security.  At the December 2015 meeting, the IAC encouraged the PSC to conduct a self-assessment against the ten IT security actions recommended by the Communications Security Establishment to protect government networks, and to report the results of this self-assessment at the March 2016 IAC meeting.  The Committee also expressed a strong interest in seeing the results of the OCG's Horizontal Audit of Information Technology Security in Large and Small Departments and a self-assessment by PSC against the recommendations in this audit.

Priorities for 2016-17

Looking ahead, the IAC has identified the following four key priorities for 2016-2017:

• Ensuring the continued effectiveness of the IAC, and providing advice to help ensure the effectiveness of the audit and evaluation functions, in the aftermath of the hiatus in IAC operations, the appointment of a new member and the changes in key senior personnel in the PSC.
• Supporting the PSC in the implementation of the New Direction in Staffing by following major developments and providing advice on the internal transformation required to ensure the success of this important initiative.
• Continuing to support the PSC in the development of a Departmental Results Framework that aligns with the New Direction on Staffing and is consistent with the new Treasury Board Policy on Results by engaging at each stage and providing advice.
• Continuing to support the PSC in strengthening its approach to risk management by providing advice on the further development of the Corporate Risk Profile and Risk Registry.

A periodic self-assessment by IAC members is recommended in the new Guidebook for a Departmental Audit Committee and the IAC will conduct a comprehensive one at the end of 2016-2017.  This timing will ensure that the Committee takes a close look at how it is performing following the change in membership, the appointment of a new CAEEand several new team members in IEAD, and the restructuring of the PSC's senior management team and appointment of new members to it.  In the coming months, IACmembers will set aside time for in-camera discussion about the methodology for this self-assessment to ensure it is as valuable as possible.

Conclusion

2015-2016 was an unusual year for the IAC with a significant turnover of key personnel and a hiatus in operations.  However, the IAC process has matured well over the past several years and the committee is still well positioned to continue engaging and providing advice on the key risk management, control and governance issues facing the PSC.  While it will take some additional effort in 2016-2017 on the part of both IAC members and the organization, particularly early in this period, to get the IAC back to full stride, members are confident that the commitment on the part of management is strong and that the resumption of IAC operations will be highly successful.

Consistent with the requirements outlined in the Directive on Internal Auditing in the Government of Canada, the views expressed in this annual report for 2015-2016 are entirely and exclusively those of the independent external members.

Annex A: Membership and Operations of the IAC in 2015-2016

Membership

Members

• Keith Coulter, External Member and Chair
• James Lahey, External Member     
• Hélène Fortin, External Member
• Christine Donoghue, Acting President of the PSC

Ex Officio Members:

• Omer Boudreau, Vice-President Corporate Management and Chief Financial Officer (CFO)
• Greg Nesbitt, Chief Audit and Evaluation Executive (CAEE) to July 2015
• John Corbeil, CAEE from July 2015
• Phillip Morton, Director General, Finance and Administration (DGFA)

Attendance at IAC Meetings

The three external members, the Acting President and the ex officio members attended all three meetings of the IAC during this reporting period.

Operations

The IAC's mandate is set out in the IAC Charter.  This Charter was reviewed and updated by the IAC during this reporting period.

The Committee met three times in 2015-2016 at PSC's location in Gatineau.  These meetings took place in June, October and December 2015.

Meetings included an in-camera lunch with members only present.  Following IAC meetings separate in-camera meetings were held with the CFO and CAEE, and an additional in-camera meeting with members only.

To be updated with 2015-16 information:  During this reporting period, the costs specific to IAC operations were $54,630.  This was a significant reduction (approximately 20%) from the previous reporting period due to the meeting scheduled for March 2016 being cancelled.  Most of this amount ($53,330) was for direct compensation to external members in the form of payroll expenses.  The remainder ($1,300) was for travel expenses for one member ($1050) commuting from Montreal and hospitality expenses ($250).