Audit of Capital Experience Assets

Capital Celebrations and Program Operations Directorate directions, objectives and mandate

The objective of CCPOD is to foster pride amongst Canadians towards their Capital, while increasing their overall awareness of the Canada’s Capital Region as a destination where people can experience Canada’s heritage, culture and achievements. To meet its objectives, the Directorate delivers the Capital Experience Program that organizes events, such as Canada Day celebrations in Canada’s Capital Region, Winterlude and Christmas Lights across Canada. In addition, CE has festival equipment that can be rented to not-for-profit associations and government agencies within Ottawa, Gatineau and the region. The audit team expected to find that CCPOD, including the RPL objectives and mandate were clearly defined and communicated to employees and management and that there was alignment with PCH’s mandate and strategic objectives.

Through interviews and document review, the audit team found that CCPOD directions, objectives and mandate are clearly defined at the Branch level. The Branch mandate and objectives are articulated and linked to the Department’s mandate and priorities. In addition, the team found that employees and management understood the objectives and mandate of the Directorate. This information is available on the intranet and in key corporate documents.

Performance Measurement and Reporting

Best practices incorporate reporting on asset management activities into their regular management reporting to reinforce the importance of asset management practices, due diligence, and allows management to readily identify and respond to areas of priority to optimize the allocation of its resources.

Through the review of key corporate documents, the audit team observed performance information related to Capital Experience Program; specifically, established and communicated expected results, performance indicators, targets and actual results. The team found that at the operational level, there was an understanding of the need to have assets available in assisting the delivery of planned events to meet CCPOD performance objectives.

The audit team found that expected results, performance indicators, targets and actual results are effectively monitored and reported. Formal, regular, and consolidated reporting on activities and performance enables management to monitor and respond to emerging and systemic issues in a proactive manner.

Compliance with the Policy on Management and Use of Assets

The PCH Directive for the Management of Moveable Assets is the principal instrument applied in the management of PCH assets. The Directive came into effect June 15, 2010 and was established in accordance with the TB Policy on the Management of Materiel. The objective of this Directive is to ensure that moveable assets are effectively and efficiently used, managed and controlled in accordance with the principles of Life Cycle Materiel Management so that PCH can realize maximum benefit from their use in program delivery. The audit team expected to find evidence of compliance to the Policy and Directive because moveable assets represent a significant investment for the Department and their use has a direct impact on program delivery, making it essential that they be used effectively and efficiently.

An examination of CCPOD inventory reports against the requirements indicated in the Directive, found that the CCPOD inventory system is currently not fully compliant with specific sections of the Directive regarding:

1. Requirements of all moveable assets;
2. Recording and Tracking of moveable assets; and
3. Verification of Moveable Assets (partially met).

The Directive indicates that all moveable assets are planned for, acquired, stored, transported and disposed of in accordance with the Management of Assets and Acquired Services Framework, applying the principles of Life Cycle Material Management and modern comptrollership and in manner that adheres to the Government’s objectives, legislation and policies. The audit team found that CCPOD does not have a Life Cycle Management Plan in place. Such a plan for the assets did not exist at the time of the transfer to PCH and was the result of decisions made prior to the transfer. A Life Cycle Management Plan should be developed to determine the effective and efficient management of assets from the identification of a requirement to the disposal and replacement of the asset acquired to meet the requirement. The phases of life cycle management include assessing requirements; analyzing options; planning acquisition; acquiring; operating, using, and maintaining; and disposing and replacing.

Without a Life Cycle Management Plan, there is a risk of inefficient and/or reactive management of assets from requirements to disposal and replacement. This would have a direct impact on CCPOD’s operations and its ability to meet Departmental activities and objectives.

Assets management framework

As per the Policy of Management of Materiel, the basis for the PCH Directive on the Management of Moveable Assets, an asset management framework should be in place that reflects an integrated approach to risk management; provides relevant performance information; sets out clear accountability and decision-making regimes that are consistent with organizational resources and capacity; and supports timely, informed asset management decisions and the strategic outcomes of departmental programs. As part of this approach, risks related to CCPOD assets should be identified, assessed, prioritized, mitigated, monitored and reported.

The audit team found that CCPOD did not have an asset management framework in place, including risk management mechanisms/tools pertaining to CCPOD inventory. In addition, the team found that management and employees were not aware of the Directive and its requirements. The current practice is to mitigate emerging issues and risks on a reactive basis. Without an asset management framework, there is a risk that management would not make timely and informed materiel management decisions consistent with organizational resources and capacity; and this would have an impact on program delivery.

Inventory system access control

As per the Treasury Board Secretariat’s Operation Security Standard: Management of Information Technology Security (MITS), IT and information access must be restricted to individuals who have been screened and authorized, have been identified and authenticated, and have a “need to know.”  The audit team expected to find processes in place to add and remove access, password, sign-on controls, and unique user IDs to ensure that inventory system access is controlled.

The audit team found that IntelEvent is the only inventory system used by CCPOD and access to the system is only granted to CCPOD’s Production Services employees. Passwords are required to log in. Through interviews with CCPOD Management and employees, system walkthrough and inquiries with PCH Chief Information Officer Branch (CIOB), the audit team found that access to the system is only permitted when an employee is provided with a unique ID with the approval from the CCPOD Manager and working with a PCH workstation that has IntelEvent software license installed within PCH network.

In addition, the audit team found that access to privileged user accounts is restricted. The responsibility for adding and removing user access is known and restricted to three (3) administrators. Individual access rights within the system are also appropriate with work responsibilities. Lastly, an operating manual of IntelEvent that provides information on how to fully operate the system is available.

The audit team concludes that the Capital Celebrations and Program Operations Directorate has appropriate access controls and processes in place and operating to secure assets.

Assets controls

CCPOD assets are essential to the delivery of CE activities and represent a significant investment for the Department. The Directive for the Management of Moveable Assets requires that physical security and safekeeping of all moveable assets is established and that physical verification and monitoring of assets are being performed. The audit team expected to find that CCPOD assets were kept in a secure location with controlled access, periodically inspected and counted.

The physical security of the warehouse is managed by PCH Security; access is only granted upon CCPOD Manager’s approval and validation of security clearance. Access to the warehouse is removed by PCH Security once notified by CCPOD Management or receiving employee’s departure form. PCH Security also conducts an access reconfirmation procedure every three months to ensure given access is updated.

To identify anomalies and missing assets, CCPOD also conducts annual inventory count. The count is performed by an external firm and by CCPOD employees; the results from both counts are compared to identify anomalies. Through document review, auditors found that the last inventory count was performed in October 2015. In addition, under the RLP, there is a formal process for reception of returned assets. Upon return of assets from each client, a visual inspection is performed by a CE warehouse employee, who documents any damage and missing assets. For other heavy/lifting equipment, inspection and maintenance is performed on an annual basis.

The audit team concludes that the Capital Celebrations and Program Operations Directorate has appropriate structures and processes in place and operating to secure assets.

Monitoring use of rented assets

CCPOD assets can be rented by not-for-profit associations and government agencies for the festivals or events being held within the NCR unless required by PCH.

Punitive and preventive measures for the misuse of these rented assets through instruments such as clauses, insurances, should be in place to adequately safeguard and monitor the use of rented assets.

The audit team found that the client is required to sign a Loan of Equipment Agreement that includes the borrower's responsibilities, punitive measures in case of damage or loss of equipment, insurance requirements and a termination clause. The client must also sign the agreement to accept the terms and conditions and provide the deposit and proof of insurance before being able to rent the equipment. The audit team also examined 46 Loan of Equipment Agreement files and found that clauses to safeguard the Department’s interests are included in every agreement as required.

In addition to the Loan of Equipment Agreement, the audit team confirms that the RLP prevents misuse of its assets by communicating with the clients and responding to information requests. Evidence was also provided that CCPOD employees communicate with the clients to ensure understanding of terms and conditions and eligibility criteria for the RLP. Issues on misuse, damaged, missing or disposable items and any depreciation should be reported to management, but such events have yet to occur or be reported.

The audit team found that there are controls in place to prevent misuse of rented assets.