Follow-up Audit of the PCH Pay System Control Environment

Office of the Chief Audit Executive

December 2018

Cette publication est également disponible en français.

© Her Majesty the Queen in Right of Canada, 2019
Catalogue Number: CH6-59/2019E-PDF
ISBN: 978-0-660-29740-8

Table of contents

List of acronyms and abbreviations

Risk-based Audit Plan
Executive Committee
Public Services and Procurement Canada
Director General of Human Resources and Workplace Management
Chief Financial Officer
Human Resources
Pay Action Request
Canadian Heritage
Business Intelligence

1.0 Background

In the fall of 2017, the Office of the Chief Audit Executive launched the Audit of the PCH Pay System Control Environment in accordance with the approved 2018-2019 to 2020-2021 Risk-based Audit Plan (RBAP). The findings and respective recommendations of this audit were presented to Executive Committee (EXCOM) in May 2018. At the end of the presentation the Deputy Minister instructed Internal Audit to follow up on the implementation of the recommendations in September 2018 and report back to EXCOM with the results. The importance and sensitivity of this subject matter and the impact the Phoenix Pay System continues to have on employees were given as reasons for the decision. When the audit report was presented to the Departmental Audit Committee in June 2018, the follow-up engagement was identified as an additional project for the RBAP.

2.0 About the audit

2.1 Project authority

The Office of the Chief Audit Executive initiated the Follow-up Audit of the PCH Pay System Control Environment at the behest of the Deputy Minister.

2.2 Objective and scope

The objective of this engagement is to provide assurance that the established management actions are being implemented, that target dates are met, and that any changes or modifications still address the nature of the recommendations.

The scope of this follow-up audit was focused in the current state of the implementation of the management action plans and well as the results of the data analytics conducted by the audit team.

2.3 Approach and methodology

All audit work was conducted in accordance with the Treasury Board Policy and Directive on Internal Audit. In addition, given the overall sensitivity of this engagement and the personal information found in files, the required privacy measures were embedded in the audit activities to ensure conformance with the Privacy Act.

The audit methodology included the following key activities:

  • reviewing the approved updates to the original recommendations and accompanying management action plans;
  • collecting data and evidence to support the completed recommendations; and
  • conducting data analytics using established scripts for applicable criteria and fraud risks.

3.0 Recommendations and updates

In September 2018, the Chief Financial Officer and the Director General of Human Resources and Workplace Management were requested to update their respective action plan providing Internal Audit with a current state. The audit team noted half of the recommendations were completed meeting the targets. It was also observed that the three remaining management actions have been modified to accommodate a new approach issued by PSPC to be implemented in October 2018. The Pay POD, a new service delivery model, was not an option when the recommendations were initially written. The audit team agreed that additional time was required to implement this new approach and that additional work regarding roles and responsibilities is needed.

The original recommendations with accompanying updates are included below:

3.1 Management action plan updates

Recommendations Management assessment and actions Responsibility Target date September update to the management assessment and actions
  1. The Chief Financial Officer and the Director General, HRWMB, should collectively develop a roles and responsibilities document for all matters related to Phoenix pay procedures and possible issues – this document should be endorsed by EXCOM and communicated to all employees.

Form a roles and responsibilities working group (HR, Finance, and RMD) with the objectives of:

  • Defining roles & responsibilities for all parties involved in pay-related transactions;
  • Mapping of current activities and establishing linkages;
  • Mapping of current monitoring and reporting activities as well as key areas that needs focus
  • Identifying any gaps and/or overlap in current activities; and
  • Identifying salary sub-processes that are more at risk (errors).
September 30th, 2018

Revised target date: March 31, 2019

Working group for roles and responsibilities has been formed and regular meetings have begun.

Mapping of current activities, monitoring and reporting activities is still underway.

The implementation of the Pay PODS new service delivery model at the Pay Centre, planned for October 4th, will have an impact on the distribution of the roles and responsibilities. Once fully understood, the exercise to identify gaps/overlap as well as a risk assessment will be untaken.

  1. The Chief Financial Officer, in conjunction with the Director General, HRWMB, should develop, implement, and communicate standard processes for identifying and detecting Phoenix over and under payments.
The roles & responsibilities for all parties involved in pay-related transactions will be defined as part of the new working group. Co-lead
September 30th, 2018 Revised target date: March 31, 2019 (see rec.#1)
PCH has limited access to the information necessary for the identification of over and under payments. Dialogue with the Pay Centre to obtain current and valid information will continue. Co-lead
September 30th, 2018 Revised target date: Ongoing
Continuity of in-house compensation support services to assist employees with the analysis of their overpayments. DG HRWMB On-going CFO and HR are following up on over and underpayment cases when flagged by employees/managers. A dedicated team should be put in place at the Pay Centre in the upcoming months to help departments with the monitoring of these cases.
  1. The Chief Financial Officer should continue the development of the BI tool, improving its functionality and ensuring completeness of the data to aid in the identification of probable or likely pay errors.
The BI tool has been identified as a 2018-19 priority. The functionality of the "Salary Basic Pay Expenditure Monitoring Report" will be enhanced. CFO August 30th, 2018

Revised target date: December 31, 2018

CFO group is continuing to work on developing this report to include salary expenditures other than basic pay. The CFO group has also developed and made available a suite of other types of reports under the BI tool to identify, detect and report on Phoenix over and under payments. These reports continue to be enhanced when required.

  1. The Director General, HRWMB, in conjunction with the Chief Financial Officer, should establish a formal monitoring process for tracking Phoenix-related pay issues.
The roles & responsibilities for all parties involved in pay-related transactions will be defined as part of the new working group. Co-lead
September 30th, 2018 Revised target date: March 31, 2019 (see rec. #1)
Maintain up-to-date the actual HR Business Intelligence (BI) tool to track Phoenix-related pay issues for which the PCH Compensation Liaison Team is made aware. DG HRWMB On-going HR has updated the HR BI tool. This tool is expected to be a source of information between the Department and the Pay Centre about priority cases so that action may be taken in a timely manner.
Maintain on-going communication with the Pay Centre to obtain further delegations to allow PCH Compensation Liaison Team to address a wider range of cases and have more flexibility in how they address issues. DG HRWMB On-going HR is still exploring this possibility. A pilot project is being considered for the upcoming implementation of the Pod model that may address the access issues.
A new salary team under the Accounting Operations division will help enhance the tracking of some Phoenix-related pay issues. CFO July 30th, 2018 Completed
The new salary team is in place and meeting regularly. A dashboard has been developed to track the evolution of Phoenix-related issues.
  1. The Director General, HRWMB, should implement a separate verification process for PeopleSoft data entry in order to reduce errors.
The function of HR Data Quality Assurance Analyst has been put in place to address this issue. DG HRWMB Completed Completed
  1. The Director General, HRWMB, should establish and communicate processes to ensure HR and pay action data are entered within 90 days of the action occurring to reduce Phoenix errors.
Via the Phoenix Mandatory on-line training for all employees and the communication strategy, reinforce the importance of Actions on time which will lead to better results. DG HRWMB On-going Completed
Raise awareness to managers regarding the importance of HR planning and submitting the required documentation on time to ensure timely payments. - - A lean exercise was completed for the PAR process which is expected to ensure more timely payments
Staffing service standards are in place, met and monitored regularly. - - HR will develop tools to raise management awareness towards the impact of late staffing actions on the employees' pay.

3.2 Results of data analytics

As part of the original audit, data analytics were utilized to test for lags in pay related change requests, and whether the existing Business Intelligence (BI) tool had accurate data. Two related findings emerged:

  • A large proportion of pay related changes were being requested more than 90 days after they occurred; and
  • There were discrepancies between the BI tool listed salary's and the maximum salaries for the Pay Classifications.

In September 2018, the audit team re-ran the data related analysis to ensure action was being taken; the results of which are listed below.

Late pay changes review

The below table shows how many changes by year were submitted 90 days after they were effective.

Year Count Proportion 90+ of Total Requested Changes per Year Proportion of Total 90+ by Year Average Minimum Maximum Total Requested Changes per Year
2016 3,216 25% 12% 296 90 6,191 12,832
2017 20,079 60% 77% 398 90 4,145 33,738
2018 Before April 1 1,404 41% 5% 478 90 1,625 3,426
2018 After April 1 1,537 19% 6% 371.2 90 5,372 8,117

BI tool salary accuracy review

Within the reviewed data, there was a significant drop in the number of salaries that were outside of the listed salaries for the given pay classification. The results in the September testing found only 41 salaries to be outside of the respective ranges. This represents a proportion of ~2% of all listed salaries at PCH (non-EX). The maximum difference found ($16,218) is far less than the previous analysis (over double salary).

4.0 Audit Opinion and Conclusion

Based on the follow-up audit findings, my opinion is that PCH has continue to have a functional control environment for the Phoenix Pay System and is meeting the needs of its employees for what is within its control. The findings demonstrate that:

  • there has been concerted efforts undertaken to reduce the number of 90+ day pay change requests;
  • there has been progress in improving Business Intelligence (BI) tool salary accuracy;
  • 50% of the recommendations have been addressed and actions implemented; and
  • the complexity of the Phoenix Pay System environment is ever-present with solutions being issued by PSPC that have an impact on the Department and the implementation the original management action plans.

Statement of conformance

In my professional judgment as Chief Audit Executive, this audit was conducted in conformance with the Institute of Internal Auditors' International Standards for the Professional Practice of Internal Auditing and with the Treasury Board Policy and Directive on Internal Audit, as supported by the results of the quality assurance and improvement program. Sufficient and appropriate audit procedures were conducted, and evidence gathered, to support the accuracy of the findings and conclusion in this report. The findings and conclusion are based on a comparison of the conditions, as they existed at the time, against pre-established audit criteria that were agreed with management and are only applicable to the entity examined and for the scope and time period covered by the audit.

Original signed by


Bimal Sandhu
Chief Audit Executive
Department of Canadian Heritage

Audit team members
Dylan Edgar, Audit Manager
Kossi Agbogbe, Senior Auditor

With the support of external resources.

Page details

Date modified: