Follow-up Audit of the PCH Pay System Control Environment
Office of the Chief Audit Executive
December 2018
Cette publication est également disponible en français.
© Her Majesty the Queen in Right of Canada, 2019
Catalogue Number: CH6-59/2019E-PDF
ISBN: 978-0-660-29740-8
Table of contents
- List of acronyms and abbreviations
- 1.0 Background
- 2.0 About the audit
- 3.0 Recommendations and updates
- 4.0 Audit Opinion and Conclusion
List of acronyms and abbreviations
- RBAP
- Risk-based Audit Plan
- EXCOM
- Executive Committee
- PSPC
- Public Services and Procurement Canada
- DG HRWMB
- Director General of Human Resources and Workplace Management
- CFO
- Chief Financial Officer
- HR
- Human Resources
- PAR
- Pay Action Request
- PCH
- Canadian Heritage
- BI
- Business Intelligence
1.0 Background
In the fall of 2017, the Office of the Chief Audit Executive launched the Audit of the PCH Pay System Control Environment in accordance with the approved 2018-2019 to 2020-2021 Risk-based Audit Plan (RBAP). The findings and respective recommendations of this audit were presented to Executive Committee (EXCOM) in May 2018. At the end of the presentation the Deputy Minister instructed Internal Audit to follow up on the implementation of the recommendations in September 2018 and report back to EXCOM with the results. The importance and sensitivity of this subject matter and the impact the Phoenix Pay System continues to have on employees were given as reasons for the decision. When the audit report was presented to the Departmental Audit Committee in June 2018, the follow-up engagement was identified as an additional project for the RBAP.
2.0 About the audit
2.1 Project authority
The Office of the Chief Audit Executive initiated the Follow-up Audit of the PCH Pay System Control Environment at the behest of the Deputy Minister.
2.2 Objective and scope
The objective of this engagement is to provide assurance that the established management actions are being implemented, that target dates are met, and that any changes or modifications still address the nature of the recommendations.
The scope of this follow-up audit was focused in the current state of the implementation of the management action plans and well as the results of the data analytics conducted by the audit team.
2.3 Approach and methodology
All audit work was conducted in accordance with the Treasury Board Policy and Directive on Internal Audit. In addition, given the overall sensitivity of this engagement and the personal information found in files, the required privacy measures were embedded in the audit activities to ensure conformance with the Privacy Act.
The audit methodology included the following key activities:
- reviewing the approved updates to the original recommendations and accompanying management action plans;
- collecting data and evidence to support the completed recommendations; and
- conducting data analytics using established scripts for applicable criteria and fraud risks.
3.0 Recommendations and updates
In September 2018, the Chief Financial Officer and the Director General of Human Resources and Workplace Management were requested to update their respective action plan providing Internal Audit with a current state. The audit team noted half of the recommendations were completed meeting the targets. It was also observed that the three remaining management actions have been modified to accommodate a new approach issued by PSPC to be implemented in October 2018. The Pay POD, a new service delivery model, was not an option when the recommendations were initially written. The audit team agreed that additional time was required to implement this new approach and that additional work regarding roles and responsibilities is needed.
The original recommendations with accompanying updates are included below:
3.1 Management action plan updates
| Recommendations | Management assessment and actions | Responsibility | Target date | September update to the management assessment and actions |
|---|---|---|---|---|
|
Form a roles and responsibilities working group (HR, Finance, and RMD) with the objectives of:
|
Co-lead CFO / DG HRWMB |
September 30th, 2018 |
Revised target date: March 31, 2019 Working group for roles and responsibilities has been formed and regular meetings have begun. Mapping of current activities, monitoring and reporting activities is still underway. The implementation of the Pay PODS new service delivery model at the Pay Centre, planned for October 4th, will have an impact on the distribution of the roles and responsibilities. Once fully understood, the exercise to identify gaps/overlap as well as a risk assessment will be untaken. |
|
The roles & responsibilities for all parties involved in pay-related transactions will be defined as part of the new working group. | Co-lead CFO / DG HRWMB |
September 30th, 2018 | Revised target date: March 31, 2019 (see rec.#1) |
| PCH has limited access to the information necessary for the identification of over and under payments. Dialogue with the Pay Centre to obtain current and valid information will continue. | Co-lead CFO / DG HRWMB |
September 30th, 2018 | Revised target date: Ongoing | |
| Continuity of in-house compensation support services to assist employees with the analysis of their overpayments. | DG HRWMB | On-going | CFO and HR are following up on over and underpayment cases when flagged by employees/managers. A dedicated team should be put in place at the Pay Centre in the upcoming months to help departments with the monitoring of these cases. | |
|
The BI tool has been identified as a 2018-19 priority. The functionality of the "Salary Basic Pay Expenditure Monitoring Report" will be enhanced. | CFO | August 30th, 2018 |
Revised target date: December 31, 2018 CFO group is continuing to work on developing this report to include salary expenditures other than basic pay. The CFO group has also developed and made available a suite of other types of reports under the BI tool to identify, detect and report on Phoenix over and under payments. These reports continue to be enhanced when required. |
|
The roles & responsibilities for all parties involved in pay-related transactions will be defined as part of the new working group. | Co-lead CFO / DG HRWMB |
September 30th, 2018 | Revised target date: March 31, 2019 (see rec. #1) |
| Maintain up-to-date the actual HR Business Intelligence (BI) tool to track Phoenix-related pay issues for which the PCH Compensation Liaison Team is made aware. | DG HRWMB | On-going | HR has updated the HR BI tool. This tool is expected to be a source of information between the Department and the Pay Centre about priority cases so that action may be taken in a timely manner. | |
| Maintain on-going communication with the Pay Centre to obtain further delegations to allow PCH Compensation Liaison Team to address a wider range of cases and have more flexibility in how they address issues. | DG HRWMB | On-going | HR is still exploring this possibility. A pilot project is being considered for the upcoming implementation of the Pod model that may address the access issues. | |
| A new salary team under the Accounting Operations division will help enhance the tracking of some Phoenix-related pay issues. | CFO | July 30th, 2018 | Completed The new salary team is in place and meeting regularly. A dashboard has been developed to track the evolution of Phoenix-related issues. |
|
|
The function of HR Data Quality Assurance Analyst has been put in place to address this issue. | DG HRWMB | Completed | Completed |
|
Via the Phoenix Mandatory on-line training for all employees and the communication strategy, reinforce the importance of Actions on time which will lead to better results. | DG HRWMB | On-going | Completed |
| Raise awareness to managers regarding the importance of HR planning and submitting the required documentation on time to ensure timely payments. | - | - | A lean exercise was completed for the PAR process which is expected to ensure more timely payments | |
| Staffing service standards are in place, met and monitored regularly. | - | - | HR will develop tools to raise management awareness towards the impact of late staffing actions on the employees' pay. |
3.2 Results of data analytics
As part of the original audit, data analytics were utilized to test for lags in pay related change requests, and whether the existing Business Intelligence (BI) tool had accurate data. Two related findings emerged:
- A large proportion of pay related changes were being requested more than 90 days after they occurred; and
- There were discrepancies between the BI tool listed salary's and the maximum salaries for the Pay Classifications.
In September 2018, the audit team re-ran the data related analysis to ensure action was being taken; the results of which are listed below.
Late pay changes review
The below table shows how many changes by year were submitted 90 days after they were effective.
| Year | Count | Proportion 90+ of Total Requested Changes per Year | Proportion of Total 90+ by Year | Average | Minimum | Maximum | Total Requested Changes per Year |
|---|---|---|---|---|---|---|---|
| 2016 | 3,216 | 25% | 12% | 296 | 90 | 6,191 | 12,832 |
| 2017 | 20,079 | 60% | 77% | 398 | 90 | 4,145 | 33,738 |
| 2018 Before April 1 | 1,404 | 41% | 5% | 478 | 90 | 1,625 | 3,426 |
| 2018 After April 1 | 1,537 | 19% | 6% | 371.2 | 90 | 5,372 | 8,117 |
BI tool salary accuracy review
Within the reviewed data, there was a significant drop in the number of salaries that were outside of the listed salaries for the given pay classification. The results in the September testing found only 41 salaries to be outside of the respective ranges. This represents a proportion of ~2% of all listed salaries at PCH (non-EX). The maximum difference found ($16,218) is far less than the previous analysis (over double salary).
4.0 Audit Opinion and Conclusion
Based on the follow-up audit findings, my opinion is that PCH has continue to have a functional control environment for the Phoenix Pay System and is meeting the needs of its employees for what is within its control. The findings demonstrate that:
- there has been concerted efforts undertaken to reduce the number of 90+ day pay change requests;
- there has been progress in improving Business Intelligence (BI) tool salary accuracy;
- 50% of the recommendations have been addressed and actions implemented; and
- the complexity of the Phoenix Pay System environment is ever-present with solutions being issued by PSPC that have an impact on the Department and the implementation the original management action plans.
Statement of conformance
In my professional judgment as Chief Audit Executive, this audit was conducted in conformance with the Institute of Internal Auditors' International Standards for the Professional Practice of Internal Auditing and with the Treasury Board Policy and Directive on Internal Audit, as supported by the results of the quality assurance and improvement program. Sufficient and appropriate audit procedures were conducted, and evidence gathered, to support the accuracy of the findings and conclusion in this report. The findings and conclusion are based on a comparison of the conditions, as they existed at the time, against pre-established audit criteria that were agreed with management and are only applicable to the entity examined and for the scope and time period covered by the audit.
Original signed by
____________________________
Bimal Sandhu
Chief Audit Executive
Department of Canadian Heritage
Audit team members
Dylan Edgar, Audit Manager
Kossi Agbogbe, Senior Auditor
With the support of external resources.
Page details
- Date modified: