CSC Audit of Procurement and Contracting Processes: Phase 1, March 2026

Official title: Audit of Procurement and Contracting Processes: Phase 1 - Management Framework – Internal Audit and Evaluation Sector, March 2026

Catalogue number: PS84-105/2026E-PDF
ISBN: 978-0-660-99909-8

Alternate format

Note to reader

For the purposes of this report, the term procurement is used throughout and may include activities related to contracting.

The terms procurement and contracting are often used together in the Government of Canada context. Procurement refers broadly to the acquisition of goods, services, and construction services. Contracting is a component of procurement that involves the creation of a formal agreement between a contracting authority and a person or firm to provide a good, perform a service, or undertake a construction project for appropriate consideration.

Executive summary

What we examined

The Audit of Procurement and Contracting Processes - Phase 1 was conducted as part of the Correctional Service of Canada (CSC) 2024 to 2029 Risk-based Audit and Evaluation Plan.

The Audit of Procurement and Contracting Processes will be conducted over two phases. The objective of this phase of the audit, which was national in scope, was to provide reasonable assurance that CSC has a management framework in place that supports effective procurement and contracting. The scope of this audit included the procurement policy framework, accountabilities, roles and responsibilities, oversight, internal controls and compliance monitoring, and training.

This audit did not assess whether the proper procurement method was used, nor whether the policy requirements surrounding a specific contract were followed. The frameworks in place at common service providers, such as Public Services and Procurement Canada and Shared Services Canada were not assessed. Additionally, government acquisition cards and contractual arrangements were not included.

Phase 2 of this audit will include a focus on compliance with policies and legislation.

Why it’s important

Procurement within the Government of Canada has been under significant scrutiny in recent years following several high-profile contracting issues that have drawn significant attention from Parliament, the media and central agencies.

It is within this context that the Audit of Procurement and Contracting Processes was included in CSC’s 2024 to 2029 Risk-based Audit and Evaluation Plan.

This internal audit provides reasonable assurance to management regarding CSC’s procurement management framework at a time when federal procurement practices are facing heightened attention for transparency and integrity.

In fiscal year 2024 to 2025, CSC reported issuing approximately 5,000 large value contracts (over $10,000), totalling approximately $673 million in addition to more than 80,000 low-value procurement transactions, totalling approximately $129 million. Given CSC’s responsibilities for managing and housing federal inmates and supervising offenders under conditional release in the community, CSC is required to procure a diverse set of goods, services, and construction contracts each year. CSC has many specific procurement needs including, but not limited to, health and dental care, drugs and biologicals, food, clothing, and security equipment. Procurement is necessary for CSC to fulfill its legal obligations.

What we found

Overall, the first phase of the audit found that several management framework elements are in place that supports effective procurement and contracting, although some areas for improvement were identified.

A procurement policy framework has been established and it is generally aligned with legislative and central agency requirements. Roles and responsibilities for individuals with procurement duties are clearly defined and communicated. Contract review boards are active, with meetings held regularly. An internal control framework supports oversight, and mechanisms exist for reporting and addressing wrongdoing and possible conflicts of interest. Additionally, processes are in place to identify and escalate cases of non-compliance.

However, the audit noted some elements within the management framework that could be improved to more effectively support procurement and contracting:

• Some policy documents are outdated and lack clarity
• Monitoring of procurement data is limited and could be strengthened
• Service level standards are defined but are not being monitored to identify timeliness concerns
• There is no documented process for identifying and mitigating procurement risks
• Current training does not adequately meet user needs
• There is no systematic process to validate whether required procurement training has been completed

Management response

1.0 Introduction

1.1 Background

The Audit of Procurement and Contracting Processes was conducted as part of the Correctional Service of Canada (CSC) 2024 to 2029 Risk-based Audit and Evaluation Plan.

This audit links to CSC’s corporate risk that:

" CSC will not be able to implement its mandate and ensure the financial sustainability and modernization of the organization."

It also links to the CSC’s priority of:

" Efficient and effective management practices that reflect values-based leadership in a changing environment."

Procurement within the Government of Canada (GoC) has been under significant scrutiny in recent years following several high-profile contracting issues that have drawn significant attention from Parliament, the media and central agencies. In March 2024, the Treasury Board Secretariat acknowledged concerning reports regarding government contracting. At that time, the president of the Treasury Board (TB) announced that the Comptroller General of Canada would undertake a horizontal audit to assess governance, decision-making, and controls associated with professional services contracts. Although CSC was not included in the horizontal audit, the Comptroller General of Canada directed all chief audit executives to assess their departmental procurement processes in the coming year.

In fiscal year 2024 to 2025, CSC reported issuing approximately 5,000 large value contracts (over $10,000), totalling approximately $673 million in addition to more than 80,000 low-value procurement transactions, totalling approximately $129 million. Given CSC’s responsibilities for managing and housing federal inmates and supervising offenders under conditional release in the community, CSC is required to procure a diverse set of goods, services, and construction contracts each year. Examples of unique services CSC procures includes Elder and chaplaincy services, health and dental care, as well as contracts with community-based residential facilities; while unique goods include drugs and biologicals, food, clothing, and security equipment.

There are several methods which can be used to procure goods, services, and construction services within the GoC. This includes but is not limited to Request for Proposals which is a form of bid solicitation that is used when the bidder selection is based on best value rather than on price alone, standing offers which allow for goods and supplies to be purchased at pre-arranged prices or pricing methods, and supply arrangements which allows government departments to solicit bids from a pool of pre-screened suppliers. A competitive or a non-competitive process is used depending on the requirement. Depending on the value of the procurement, as well as the procurement method utilized, the process and controls vary.

Similar to other GoC departments, procurement at CSC can be complex, involving several stakeholders. At CSC, budget managers generally have a delegated authority of up to $10,000. Above this amount and depending on the value, type, instrument used, and complexity of the procurement, assistance and coordination from regional Contracting and Materiel Services (CMS), national CMS, and GoC departments such as Public Services and Procurement Canada (PSPC) and Shared Services Canada (SSC) may be required. The responsibility for contracting authority can reside with any of these groups, depending on the procurement needs and requirements.

At CSC, there are several boards and committees that are to provide governance and oversight over procurement activities, with contract review boards (CRB) being the most prevalent. CRBs exist at both the national and regional levels and are the formal challenge and governance mechanism at CSC for contracts above a budget manager’s contracting delegation. They review and approve submissions prior to contract preparation and award. Other boards and committees that link to procurement include the National Investment Prioritization Committee (NIPC), the Investment Steering Committee (ISC), and the Investment Management Board (IMB).

1.2 Legislative and policy framework

There are several legislative and policy requirements that guide the procurement and contracting processes within which CSC operates, including:

Legislation

Financial Administration Act: an act to provide for the financial administration of the GoC, the establishment and maintenance of the accounts of Canada, and the control of Crown corporations.

Government Contract Regulations: set the conditions on the entry into goods, services, and construction contracts by the GoC and the deemed terms that form part of every such contract.

Treasury Board policy framework

Directive on the Management of Procurement: ensures that procurement of goods, services, and construction obtains the necessary assets and services that support the delivery of programs and services to Canadians, while ensuring best value to the Crown.

Policy on Green Procurement: seeks to reduce the environmental impacts of government operations, promote environmental stewardship, and adapt to climate change by integrating environmental considerations in the procurement process.

CSC policy framework

• Delegation of Spending and Financial Authorities Instrument
• Procurement and Materiel Management Framework
• Financial Directive (FD) 350 - Contracting and Materiel Management
• FD 350-3 - Contracting
• Contract Review Boards (CMS-INST-2015-017)

Additionally, there are several other applicable CMS instructions and FDs related to procurement.

1.3 Organizational structure and responsibilities

National headquarters (NHQ)

The National Comptroller, who reports to the Assistant Commissioner, Corporate Services and Chief Financial Officer (ACCS), has been designated as the Senior Designated Official (SDO) and has the primary responsibility of establishing, implementing, and maintaining CSC’s procurement and materiel management framework. The Senior Director, CMS has the primary responsibility of acting as the functional authority for procurement and materiel management activities for the department. CMS' responsibilities also include supporting business owners and budget managers throughout the procurement processes.

Regional headquarters (RHQ)

The regional managers, CMS, who report to the regional comptrollers have the primary responsibility for the planning, managing, and coordinating the provision of regional contracting, procurement and materiel management services to regional clients.

Budget managers/business owners

Business owners are responsible for the business or program area for which the project, procurement, or program is established. They are responsible for defining the intended outcomes of the procurement and ensuring the achievement of the procurement taking place. The budget managers, who may or may not be the business owners, are responsible for planning, monitoring, and controlling departmental finances while ensuring compliance with financial policies.

Budget managers/business owners may work at an institution, in the community, RHQ, or NHQ.

1.4 Risk assessment

The Audit of Procurement and Contracting Processes was conducted as part of CSC's 2024 to 2029 Risk-based Audit and Evaluation Plan.

A risk assessment was completed based on interviews with the office of primary interest, members of CSC senior management, national and regional Contracting and Materiel Services managers and staff, and budget managers. As well, a review of policies, past audit work, previous fraud risk assessment work, and other documentation related to financial controls was conducted. Overall, the assessment identified that the main risks to CSC relate to policies, roles and responsibilities, monitoring and reporting, oversight and governance and training.

2.0 Objective and scope

2.1 Audit objective

The objective of the first phase of this audit was to provide reasonable assurance that CSC has a management framework in place that supports effective procurement and contracting.
Specific criteria are included in Annex A.

2.2 Audit scope

Phase 1 of the audit was national in scope across all five regions and NHQ. This phase focused on an examination of the management framework of the procurement processes, which includes the procurement policy framework, accountabilities, roles and responsibilities, oversight, internal controls and compliance monitoring, and training.

Phase 1 did not assess whether the proper procurement method was used, nor whether the policy requirements surrounding a specific contract were followed. As this audit focused on the procurement framework at CSC, the frameworks in place at common service providers, such as PSPC and SSC, were not assessed.

Given the inherent differences between government acquisition cards transactions and other forms of procurement, government acquisition cards' controls were scoped out. Contractual arrangements, such as service level agreements with other government departments and memoranda of understanding with colleges and universities, were also scoped out, as these agreements are often not legally binding agreements and follow different processes than those in place for procurement.

As this audit is being conducted in two phases, compliance with the procurement and contracting policies and legislation was not examined as it will be the primary focus of phase 2.

3.0 Audit findings and recommendations

3.1 Policy framework

The audit expected to find that CSC's policy framework is up to date, clear, consistent, and aligns with legislative and central agency requirements.

The audit team assessed this criterion as being partially met.

The procurement policy framework ("the framework") consists of several documents, including:

• the Procurement and Materiel Management Framework (PMMF)
• the Delegation of Spending and Financial Authorities Instrument
• FDs
• Financial Instructions
• CMS Instructions
• Memoranda

The framework collectively details the rules and policies that are to be followed, from when procurement is planned until after the transaction has taken place and reviews are completed.

The audit found no significant inconsistencies between the framework and applicable legislation and central agency requirements; however, some components were not fully aligned. For example, certain responsibilities outlined in the TB Directive on the Management of Procurement are assigned to specific positions such as contracting authority or budget managers, but the framework does not consistently identify these positions as being responsible for the corresponding duties. This may lead to staff being unclear who, between budget managers and contracting authorities, may be responsible for specific tasks. Additionally, the audit team found that many of the framework documents had aspects that were out of date, were assessed as unclear, or had inconsistencies with other CSC framework documents. Issues identified included: references to rescinded TB policies, instructions indicating that documents are to be mailed although a digital option is now available, and references to training programs that are inconsistent between various documents or no longer exist. These inconsistencies may lead to staff confusion or non-compliance if decisions are based on outdated or conflicting documents.

The audit also noted that CSC does not have a structured process to update the elements of the framework. While major updates occur in response to TB changes, the lack of a structured process increases the risk of piecemeal revisions, inconsistencies within policy documents, and confusion amongst users. Given the large number of documents in the framework, and the reported workload constraints of CMS staff, CMS typically focusses its resources on critical updates and core procurement activities.

Overall, maintaining a clear, current, and well-aligned framework can help staff better understand their roles, reduce the risk of misinterpretation, and promote greater consistency across the procurement process.

Current versions of the framework documents, along with corresponding memoranda and other pertinent information are posted on CSC's intranet.

CSC communicates policy and process changes through emails to budget managers and memoranda to members of the executive committee. Additionally, CMS prepares a monthly newsletter which highlights framework updates, provides reminders to procurement staff and budget managers of processes, and identifies compliance concerns.

This communication process helps to ensure staff are aware of important changes and updates that should be incorporated when procuring.

3.2 Accountabilities, roles and responsibilities

The audit expected to find that accountabilities, roles and responsibilities for procurement and contracting are defined, documented, communicated, and understood.

The audit team assessed this criterion as being met with exceptions.

CSC has defined and communicated procurement-related roles and responsibilities. These are generally well documented within the framework, job descriptions, and supporting materials. Staff responsibilities related to procurement are communicated through various channels, including training, internal guidance, and performance management tools. Additionally, CSC's defined roles and responsibilities are generally aligned with central agency requirements.

Although the framework does not explicitly distinguish accountabilities from roles and responsibilities, The PMMF states that employees:

"…are accountable for their decisions in accordance with legislation, policy instruments, authorities, and operational and fiscal responsibilities." ^{Footnote 1}

Roles and responsibilities, on the other hand, describe the specific tasks and functions assigned to individuals or positions.

Interviews with staff revealed that most individuals understand their procurement-related responsibilities. This understanding is reinforced through peer reviews, training, and performance evaluations, which collectively promote integrity and compliance. Standardized work objectives for the purchasing and supply group (PG) classification include upholding and enforcing the GoC's procurement policy framework and enabling CSC's operational effectiveness. These objectives help to align individual performance with overall organizational goals. The audit has identified a few areas for consideration related to accountabilities, roles and responsibilities:

• Responsibilities are often defined throughout multiple documents, which include relevant FDs, financial instructions, CMS instructions, and memoranda within the framework, with no single source providing a comprehensive overview. The need to refer to multiple documents increases the risk that staff may overlook certain responsibilities
• Although regular meetings are held between national and regional CMS, there is no direct administrative reporting relationship between the national and regional operations. This may hinder coordination of work and reporting and reduce the effectiveness of oversight
• Work objectives and performance indicators related to procurement are not consistently identified within the formalized performance agreements for all staff with procurement responsibilities, particularly budget managers outside the PG classification. These inconsistencies can impact management's ability to hold staff accountable for their procurement activities

Although roles and responsibilities are spread across multiple documents within the framework, overall, they were found to be defined and communicated and staff indicated that they generally understand their roles and responsibilities.

3.3 Oversight

The audit expected to find that accountabilities and roles and responsibilities for procurement governance and oversight bodies are established and support procurement and contracting; and that a process is in place to identify, communicate, and address the results of monitoring activities.

The audit team assessed this criterion as being partially met.

CRBs provide national and regional oversight over procurement activities at CSC. CRBs operate under defined direction as outlined in CSC’s CRB Instructions (CMS-INST-2015-017). CRBs act as a formal challenge and governance mechanism for contracts above a budget manager's contracting delegation. These boards are expected to review and approve submissions prior to contract preparation and award within their applicable authority, provide advice on procurement and materiel management strategies and recommend options, and offer guidance and direction on any procurement related issues.

There are four types of CRBs to oversee procurement activities, with each having distinct roles based on the value of the procurement, type of procurement, and location of the proposed procurement:

National CRB – oversees high-dollar value, sensitive, or high-risk procurement requests from across CSC, and acts as the CRB for NHQ.

Auxiliary CRBs – located in each region and NHQ, these boards review low-dollar value and low-risk procurement requests that exceed a budget manager’s delegation.

Regional CRBs – handle higher-value or more complex procurement requests beyond the Auxiliary CRB’s limits.

NHQ Express Lane – this board reviews NHQ-specific and nationally scoped low-risk procurement requests.

The audit found that CRBs are providing oversight across CSC, meetings are held consistently, and they are a control for ensuring that procurement decisions are reviewed by appropriate authorities. Prior to CRB meetings being held, procurement documentation is provided to committee members for review. At some meetings the audit team observed that thorough discussions were being held, and proposed procurement methods were being challenged. However, where fulsome discussions were not observed, the audit team did not validate the work completed in advance by CRB members when reviewing files ahead of time.

Furthermore, the composition of the CRB members were primarily finance and procurement staff which could limit diverse perspectives, such as operational or program insights. As a result, there is a risk that these are more of a procedural checkpoint as opposed to a forum for substantive assessment.

Additionally, it was found that Regional CRBs were not always being chaired by the appropriate level. Policy requires that the assistant deputy commissioner, integrated services chair these boards, however, when the assistant deputy commissioner, integrated services was not the chair, the minutes indicated that the regional comptroller chaired them in two regions. In June 2024 CMS issued communication to the regions reminding them of this requirement, and compliance with this requirement has improved.

The PMMF has identified additional oversight bodies which include a procurement component. These include the IMB which provides enterprise oversight and decision-making authority for investments, the ISC that provides an enterprise view on project prioritization and governance, and the NIPC which plays a challenge function for regional/sector investments. Although the primary focus of these oversight bodies is not on procurement, individuals from the CMS group attend meetings and will raise procurement related concerns as required.

The PMMF states that:

"An effective oversight regime is necessary to actively monitor the state of procurement and materiel management practices and controls across the CSC. This is effected through sound governance structures, an objective oversight functions provided by the SDO, the Senior Director, CMS as the functional authority of procurement and materiel, and by review boards." ^{Footnote 2}  

CSC has implemented several monitoring activities to ensure compliance with the framework. For example, the Integrated Financial and Materiel Management System (IFMMS) performs automated funds verification to confirm delegated authority and sufficient funds before commitments are made, helping to prevent unauthorized transactions. In addition, CSC conducts quarterly post-payment verification (PPV) reviews to identify errors or irregularities after payment and monthly quality assurance (QA) reviews to confirm adherence to procurement policies.

While these controls demonstrate that CSC has mechanisms in place to monitor transactions, it is unclear how this data is analyzed and reported on to identify systemic trends and areas for improvement. Monitoring remains largely transactional and focused on compliance at the file level. However, when significant issues are identified, CSC has demonstrated the ability to communicate and address them. Escalation mechanisms exist to ensure that major gaps or risks are brought to the attention of the organization and corrective actions are implemented.

CSC has also developed a national dashboard to monitor procurement related commitments and track progress on these activities. This tool provides visibility into procurement performance and supports oversight at the enterprise level, particularly for commitments and contract management.

CSC has identified service level standards in the framework, however, it was found that they were not being monitored or analyzed. Reporting on these standards would provide greater visibility into performance, timeliness, and efficiency; and would support accountability across regions and at the national level.

The reactive approach means that while individual issues are addressed when detected, opportunities to identify patterns, address root causes, and implement preventive measures at the departmental-level may be missed. As a result, CSC’s ability to proactively identify systemic issues or emerging risks is limited.

3.4 Internal controls and compliance monitoring

The audit expected to find that a system of internal controls is designed to assist CSC in complying with procurement and contracting requirements, and that a second line of defence and quality control process is in place and operating to help ensure that procurement is carried out in accordance with policy instruments. Additionally, it was expected that follow-up actions are taken when the monitoring and reporting identifies non-compliance.

The audit team assessed this criterion as being met with exceptions.

CSC has established internal controls that span the procurement lifecycle. This includes key controls such as expenditure initiation approval, budget manager review and validation, purchase order creation and approval, CRB oversight, and documentation and tracking requirements. These controls are designed to ensure that procurement activities are authorized, properly documented, and compliant with policy requirements.

CSC’s internal control processes are well-documented and the compliance monitoring controls were consistently applied across regions and NHQ. They incorporate both preventative controls, which are intended to avoid errors before they occur, and detective controls, which identify and correct errors after they occur.

• Preventative controls include automated funds verification in the IFMMS which ensures delegated authority and sufficient funds before commitments are made; and MACRO scripts which automatically test all procurement files, providing an additional layer of oversight by reviewing procurement practices for compliance and control effectiveness
• Detective controls include PPV which identifies errors or irregularities after payment, and QA reviews which ensure all documentation requirements are met throughout the procurement process

As per the TB Directive on the Management of Procurement, contracting authorities must ensure that accurate and comprehensive records are created and maintained to facilitate oversight. CSC has developed two checklists to support these controls. The Contract File Documentation Checklist, prepared by CMS, is completed for all procurement files to ensure that required documentation is present and accurate. The Contract Quality Assurance Review Checklist, prepared by the QA review team, is applied to a sample of files selected for QA review to verify compliance with policy requirements and internal standards. The audit compared these checklists against the TB requirements and identified gaps where required elements were missing in CSC's checklists. Specifically, the checklists were missing requirements to include documentation related to wrongdoing allegations, risk and mitigation reports, communication of the Supplier Code of Conduct, and vendor performance evaluations.

CSC has also established processes for reporting and addressing wrongdoing and conflicts of interest. Wrongdoing involves serious procurement breaches such as fraud, abuse of authority, or violations of the Values and Ethics Code for the Public Sector. Mechanisms for reporting wrongdoing are in place through the Office of Integrity Risk at CSC and the Office of the Public Sector Integrity Commissioner, providing staff with confidential avenues to report concerns. When wrongdoing is reported, a fact-finding investigation is conducted, and if substantiated, recommendations are provided to the Commissioner of Corrections for appropriate action. Similarly, CSC has processes for reporting possible conflicts of interest, which are reviewed by the Office of Values and Ethics at CSC to determine appropriate mitigation measures. These mechanisms strengthen internal controls and promote a culture of accountability and ethical compliance.

CSC currently has not fully identified and documented procurement risks. Although fraud risks are identified within CSC's Fraud Risk Management Framework, this document does not include non-fraud procurement risks. Additionally, a clearly documented process for the identification, escalation, and mitigation of procurement and related risks has not been established. Without this documented process, CSC's ability to proactively manage fraud and other procurement risks at both the enterprise level and the individual project level is limited.

Overall, CSC’s internal controls are well-documented and provide a strong foundation for compliance and oversight. The gaps identified represent opportunities to strengthen the controls but do not undermine the overall design of the framework.

CSC employs a multi-layered approach to compliance monitoring, incorporating both preventative and detective controls. These processes help to identify and address non-compliance at the individual file level. If issues are identified through PPV, QA, or other review mechanisms, they are escalated for resolution. They also include defined steps for notifying management, implementing corrective actions, and tracking resolutions, which helps maintain accountability and supports continuous improvement within the procurement environment.

The audit identified areas where CSC can improve its non-compliance reporting. National PPV reports, which were previously issued quarterly, have shifted to an annual reporting cycle for the 2024 to 2025 fiscal year. This change in reporting timeline delays the identification and resolution of systemic compliance issues. While the QA review process is a positive development, it is still relatively new and lacks a formal reporting structure to identify trends or systemic issues.

Overall, CSC’s preventative and detective controls help to identify and correct individual file-level issues. However, reliance on annual PPV reporting and the absence of a standardized reporting structure for QA reviews reduces the timeliness and consistency of compliance oversight. This creates a risk of delayed corrective actions and limits management’s ability to maintain real-time visibility over compliance activities.

3.5 Training

The audit expected to find that training and support for stakeholders involved in the procurement and contracting processes are established, responsive to their needs, and training is being taken as required.

The audit team assessed this criterion as being not met.

CSC’s training framework includes courses offered by the Canada School of Public Service (CSPS) and by CMS. The CSPS courses that are required to obtain financial delegation authority include:

• Using Public Funds Responsibly
• Practising Responsible Procurement and
• Managing People Effectively

These CSPS courses provide a general overview of procurement, but they do not address CSC specific processes or fully meet user needs. Additionally, CSC requires that three additional courses be taken by budget managers to hold financial delegation. These include: Green Procurement offered by the CSPS, and CONTRA2 and CONTRA3 which are owned and developed by CMS.

• CONTRA2 provides employees with an overview of CSC's contracting/procurement principles, values and ethics, financial and contracting authorities, various contracting and acquisition tools, and how CSC achieves value for money when planning, acquiring, using and disposing of materiel assets
• CONTRA3 provides CSC budget managers with an understanding of various legal requirements of the contracting process, the ability to identify major concerns and considerations of the contracting process, and an awareness of CSC's contracting delegation and processes

These courses are currently under review and contain references to rescinded policies, incorrect information, and references to documents which no longer exist.

To address concerns with national training, some regions have developed supplemental training materials. While this demonstrates initiative from these regions, it highlights the need for additional CSC-specific training to better meet the needs of the user. CMS identified that limited resources and a rapidly changing environment are creating difficulties in maintaining training that is up to date. These gaps can affect employees’ understanding of their roles and responsibilities, which may increase the risk of inconsistent practices across the organization. When training content does not align with user needs, it can reduce confidence in decision-making and introduce inefficiencies in the procurement process. Furthermore, outdated or generic training materials may limit the value that staff receive from completing the required courses. While the CSPS mandatory training may be up to date, it is more generic and lacks content tailored to CSC's internal processes.

The financial delegation signature card outlines specific training requirements, including CSPS training as well as referring users to Section 61 of the FD 350-3. The FD 350-3 requires that prior to issuing purchase orders and contracts, budget managers will complete the training courses CONTRA2, CONTRA3, and Green Procurement.

The audit team conducted a review of training records and compliance reports. This included analysis of the National Training Standards (NTS) compliance report, CSPS training data, and supporting documentation from all regions and NHQ. Samples were selected proportionally from key groups including contracting officers, CMS employees, regional staff, managers with delegated signing authority, and business owners. Training records were reviewed to determine whether required training had been completed prior to assuming procurement responsibilities.

The review of training records revealed considerable variability in compliance across the CSPS courses and those outlined in FD 350-3, which includes CONTRA2 and CONTRA3. The CSPS courses had a higher recorded rate of completion when compared to the training developed by CSC.

While some tracking mechanisms do exist to monitor what training is being completed, CSC does not have a systematic process in place to validate whether all staff have completed all the required training. Tracking practices vary significantly across regions and organizational units.

A contributing factor to this inconsistency is the fragmentation of training requirements across multiple documents with some procurement related courses, such as CONTRA2 and CONTRA3, not being included as part of the NTS. This creates challenges for CSC to monitor, provide oversight, and validate whether all required staff have completed the required procurement training.

Overall, the absence of a centralized and systematic tracking process increases the risk of non-compliance and can reduce the effectiveness of CSC's procurement policy framework.

4.0 Conclusion

Overall, audit results demonstrated that elements of a management control framework are in place.

A procurement policy framework has been established and it is generally aligned with legislative and central agency requirements. Roles and responsibilities for individuals with procurement duties are clearly defined and communicated. CRBs are active, with meetings held regularly. An internal control framework supports oversight, and mechanisms exist for reporting and addressing wrongdoing and possible conflicts of interest. Additionally, processes are in place to identify and escalate cases of non-compliance.

However, the audit noted some elements within the management framework that could be improved to more effectively support procurement and contracting:

• Some policy documents are outdated and lack clarity
• Monitoring of procurement data is limited and could be strengthened
• Service level standards are defined but are not being monitored to identify timeliness concerns
• There is no documented process for identifying and mitigating procurement risks
• Current training does not adequately meet user needs
• There is no systematic process to validate whether required procurement training has been completed

Recommendation 1: The Assistant Commissioner, Corporate Services (ACCS), should conduct a review of the procurement policy framework and update it as needed, and should implement a formalized, cyclical review process to ensure that the procurement policy framework remains up to date.

Recommendation 2: The Assistant Commissioner, Corporate Services (ACCS), should document procurement risks and ensure that performance data, which includes service-level standards and procurement monitoring results, is used systematically to identify trends in the procurement environment.

Recommendation 3: The Assistant Commissioner, Corporate Services (ACCS), should review and update training content to meet the needs of the user, and should ensure that the completion of training is being monitored.

5.0 Management response

6.0 About the audit

6.1 Approach and methodology

Audit evidence was gathered through several methods such as: interviews with staff at NHQ, in the regions, in the community, and at institutions; review of documentation; observations; and file testing.

Interviews: interviews were conducted with management and staff. This included the SDO, Senior Director of CMS, national and regional contracting managers, contracting and procurement officers, business owners/budget managers, and members of oversight bodies.

Review of documentation: relevant documentation, such as legislation, TB policies and directives, financial directives, corporate documents, position descriptions, procedural documents including process maps and control documents, meeting minutes, training material, and monitoring and reporting information were reviewed.

Sampling strategy: in order to develop a sampling approach that addressed the audit criteria identified in Appendix A, a sampling approach using a mix of judgmental, random and stratified random sampling was used.

Observations: observation of contract review board meetings was performed.

File testing: reviewed and tested post-payment verification, quality assessment review, and training files.

6.2 Past audits on procurement and contracting processes

Past CSC internal audits and external assurance works were used to assist in scoping the audit work. This included:

• CSC’s Audit of Contracting and Processes (January 2014)
• CSC’s Audit of Low Value Contracts (January 2014)
• Auditor General of Canada Professional Services Contracts (June 2024)
• Office of the Comptroller General Horizontal Internal Audit of Procurement Governance (April 2025) and
• relevant audits from other government departments

6.3 Statement of conformance

This internal audit engagement was conducted in conformance with the International Standards for the Professional Practice of Internal Auditing, the Treasury Board of Canada Policy on Internal Audit, and the Treasury Board of Canada Directive on Internal Audit, as supported by the results of the Quality Assurance and Improvement Program of Correctional Service of Canada.

Daniel Giroux, CIA
Chief Audit and Evaluation Executive

Annex A: Audit criteria