Annex to the statement of management responsibility including internal control over financial reporting for the fiscal year ended March 31, 2016

Table of Contents

1. Introduction
2. Departmental system of internal control over financial reporting
3. Canadian Heritage assessment results during fiscal year 2015-2016
4. Departmental action plan

1. Introduction

This document provides summary information on the measures taken by Canadian Heritage to maintain an effective system of internal control over financial reporting (ICFR), including information on internal control management, assessment results and related action plans.

Detailed information on Canadian Heritage’s authority, mandate and program activities can be found in the 2015-16 Departmental Performance Report and the 2015-16 Report on Plans and Priorities.

2. Departmental system of internal control over financial reporting

3. Canadian Heritage assessment results during fiscal year 2015-16

Canadian Heritage being at the ongoing monitoring stage for all of its control areas presents its key findings and significant adjustments required from the current year’s assessment activities are summarized below.

New or significantly amended key controls: In the current year, there were significantly amended key controls in existing salary processes due to the implementation of a new pay system (Phoenix). A reassessment will be required once the pay system stabilizes and once the documentation is completed by PWGSC and guidance is received from the Office of the Comptroller General (TBS). This reassessment is now planned for fiscal year 2017-18.

On-going monitoring of key controls

As part of its rotational ongoing monitoring plan, Canadian Heritage completed its reassessment of Information Technology Applications Controls. The reassessment of the financial reporting process was started in 2015-16 but will only be completed in early 2016-17 as it was decided to use the most recent year-end financial information (2015-16) for the testing of controls in order to have the most current information possible. The reassessment of two salary sub-processes (hiring and termination) was also commenced in 2015-16 as scheduled; however, testing has been postponed to 2017-18 because the key controls have significantly been amended due to the implementation of the new pay system (Phoenix). Finally, the reassessment of the tangible capital assets has been extended to 2016-17 to take into account the tangible capital assets audit completed in 2015-16 by the Office of the Chief Audit Executive.

Key controls tested as part of Canadian Heritage’s ongoing risk-based monitoring plan in 2015-16 were found to be operating effectively with no significant deficiencies identified. However, opportunities for improvement were identified in the following areas:

• Information Technology Application Controls
  1. SAP – Recommendations were made to review user access for key functionality to help ensure that access is restricted based on the least privilege principle. Further recommendations were made to examine the block and release configuration in the context of the entire purchase to payments business process control environment for certain purchase order document types. A management action plan addressing recommendations was developed by the process owners.
  2. AAPMIS – Recommendations were made to review user access for key functionality to help ensure that access is restricted based on the least privilege principle. Further recommendations were made to consider performing a secondary review over the accuracy of the calculation of deferred tuition amounts for each athlete impacted by the recent policy change. A management action plan addressing recommendations was developed by the process owners.

4. Departmental action plan