Internal Audit of the Personnel Security Screening Process - Internal Audit Report

Presented by Internal Audit Directorate
September 26, 2023

Table of Contents

• Executive Summary
• Background
• Audit Objective, Scope, Criteria, and Approach
  • Audit Objective and Scope
  • Audit Criteria
  • Audit Approach
• Overall Opinion and Statement of Conformance
• Summary of Findings
  • Key Findings Note
  • Key Findings Criterion 1
  • Key Findings Criterion 2
  • Overall Conclusion
• Management Response and Action Plans
• Appendix A – Compliance Testing Results
• Appendix B – Sampling Strategy
• Appendix C – Key Information Reviewed
• Appendix D – Risk Ranking Methodology

Executive Summary

The Audit of Personnel Security Screening Process was authorized as part of the Department of Finance Canada's (the Department) 2022-2023 Risk-based Audit Plan, which was approved by the Deputy Minister on June 29, 2022.

What we examined

The objective of this audit was to provide reasonable assurance that the Department's personnel security screening process' internal controls are effective and efficient, and that the process is compliant with applicable policies.

Why it is important

Employees at the Department require access to sensitive information to perform their work in support of providing strategic analysis and advice to the Minister of Finance. Effective personnel security screening can provide some level of reassurance that employees can be trusted to safeguard government information, assets and facilities, and to reliably fulfill their duties.

What we found

Up to the granting of a security clearance, the Department has effective controls in place for the personnel security screening process. However, significant control weaknesses were identified regarding the close-out of the process.

Areas of improvement were identified with respect to the overall efficiency of the personnel security screening process. Given the context of the remote work period, processing delays by other involved organizations, and the current resources assigned to the process, these findings are not unexpected.

Also, the Department's personnel security screening process is not compliant with some applicable Treasury Board policy suite requirements. The Department does not currently have a Departmental Security Plan and a security delegation instrument.

The following table summarizes the overall findings and the associated risk to the Department:

Marie-Josée Yelle
Acting Chief Audit Executive

Background

Within the Department of Finance Canada (the Department), employees are required to access protected and/or classified information to perform their work in support of providing strategic analysis and advice to the Minister of Finance. To reduce the risk that protected and/or classified information is inappropriately accessed, used or shared, the Government of Canada has established security controls and policies, including policies related to personnel security screening.

Personnel security screening involves the collection of personal information from individuals, with their informed consent, and information from law enforcement, intelligence sources, and other sources and methods to assess an individual's reliability and loyalty to Canada. Effective personnel security screening can provide some level of reassurance that employees can be trusted to safeguard government information, assets and facilities, and to reliably fulfill their duties.

The management of personnel security screening is primarily governed by the Treasury Board's (TB) Policy on Government Security, Directive on Security Management, and Standard on Security Screening (Standard). The objective of the Standard is to ensure that security screening in the Government of Canada is conducted in a way that is effective, efficient, rigorous, consistent and fair to provide reasonable assurance that individuals can be trusted to safeguard government information and assets and can reliably conduct their work duties, as well as to enable transferability of security screening between departments and agencies.

The Standard also defines the following security status and clearances:

• Reliability status is the minimum standard of security screening for positions requiring unsupervised access to Government of Canada protected information, assets, facilities or information technology systems.
• Secret clearance is the standard of security screening for all positions requiring access to Government of Canada information, assets, facilities or information technology systems classified as Secret.
• Top Secret clearance screening is conducted for positions requiring access to top secret Government of Canada information, assets, facilities or IT systems.

Given the sensitive nature of information within the Department, all its employees are required to have a minimum of a Secret clearance.

Within the Department, the Assistant Deputy Minister, Corporate Services Branch (CSB), has been designated as the Department's Chief Security Officer. The Security Services Division (SSD), within the Human Resources and Security Directorate of CSB, is responsible for the personnel security screening process. In addition, SSD is responsible for security incident management, emergency preparedness, ministerial security, physical security, security event management, business continuity management, and security in contracts and other arrangements. At the time of the audit, the SSD team consisted of five (5) full-time employees (FTEs), with one (1) FTE dedicated full-time to personnel security screenings.

The following government departments also play a role in the security screening process:

• The Canadian Security Intelligence Service's (CSIS) Government Security Screening program investigates and provides security assessments for persons requiring Secret or Top Secret level security clearances as part of their employment.
• The Royal Canadian Mounted Police (RCMP) is responsible for performing the criminal record check portion of the personnel security screening.

Audit Objective, Scope, Criteria, and Approach

Audit Objective and Scope

Audit Objective:

• The objective of this audit engagement was to provide reasonable assurance that the Department of Finance Canada's (the Department) personnel security screening process' internal controls are effective and efficient, and that the process is compliant with applicable policies.

Audit Scope:

• The audit scope included an assessment of the key controls pertaining to the personnel security screening process, as well as a review of personnel security screening transactions (assignment, renewal, and revocation of security clearances) between April 1, 2019, and September 30, 2022.
• The scope did not include:
  • Processes for site access screenings, used for individuals external to government who do not require access to sensitive information but require access to restricted or controlled government facilities.
  • Parts of the personnel security screening process that are owned by other federal organizations (for example, the Canadian Security Intelligence Service and the Royal Canadian Mounted Police).
  • Other preventative, detective or corrective controls that are part of an Insider Risk Program.^{Footnote 1}
  • The efficiency and effectiveness of the Department's Human Resources staffing processes.
  • An assessment of compliance against policy suite requirements not related to personnel security screening.

Audit Criteria

Criterion 1: The Department's personnel security screening process' internal controls are effective; and are in compliance with the Treasury Board (TB) Policy on Government Security, Directive on Security Management, and Standard on Security Screening.

Criterion 2: Personnel security screenings are processed effectively and efficiently.

Audit Approach

In conducting this audit we:

• Reviewed relevant documentation such as legislation, policies and guidance, administrative agreements, and departmental guidance.
• Interviewed personnel from the Corporate Services Branch.
• Identified key controls and developed process maps.
• Tested a judgmental sample of 46 personnel security files from the period examined to assess compliance with relevant legislation, policies, and guidance.
• Performed benchmarking against other federal departments and agencies.

Overall Opinion and Statement of Conformance

Overall Opinion

Sufficient and appropriate procedures were performed, and evidence gathered to support the accuracy of the audit conclusion. The audit findings and conclusion are based on a comparison of the conditions that existed as of the date of the audit against established criteria that were agreed upon with management.

The findings and conclusion are only applicable to the entities examined and for the scope and time period covered by the audit.

Statement of Conformance

The audit was conducted in conformance with the International Standards for the Professional Practice of Internal Auditing, as supported by the results of the quality assurance and improvement program.

Summary of Findings

Key Findings − Note

Given the current resources within the Security Services Division assigned to the personnel security screening process, the internal audit team has issued a formal recommendation for findings non-compliant with policy. Where a formal recommendation has been issued, management has developed a Management Action Plan (MAP). The Internal Audit Directorate (IAD) will follow-up on these MAPs to ensure that they have been implemented.

The IAD will not follow-up on areas of consideration on the overall efficiency and effectiveness of the process as it is management's prerogative to risk-manage these areas.

Key Findings − Criterion 1

We expected to find that the Department of Finance Canada's (the Department) personnel security screening process' internal controls are effective; and are in compliance with the Treasury Board (TB) Policy on government Security, Directive on Security Management, and Standard on Security Screening.

The internal audit team found that the three (3) major verifications that take place during the security screening (criminal record check, credit check and the Canadian Security Intelligence Service (CSIS) security assessment) were conducted 100% of the time in the files that were reviewed. The internal audit team also noted that when adverse information^{Footnote 2} was uncovered or information was incomplete, that there are processes in place to conduct security interviews when necessary or to obtain missing information. The following table outlines findings, as well as recommendations for management's action:

Key Findings − Criterion 2

We expected to find that personnel security screenings are processed effectively and efficiently.

Areas of improvement were identified with respect to the efficiency and effectiveness of the security screening process as a whole. The following table outlines the internal audit team's findings as well as some suggestions for management's consideration.

Overall Conclusion

Up to the granting of a security clearance, the Department of Finance Canada (the Department) has effective controls in place for the personnel security screening process. However, significant control weaknesses were identified regarding the close-out of the process.

Areas of improvement were identified with respect to the overall efficiency of the personnel security screening process. Given the context of the remote work period, processing delays by other involved organizations, and the current resources assigned to the process, these findings are not unexpected.

Also, the Department's personnel security screening process is not compliant with some applicable Treasury Board policy suite requirements. The Department does not currently have a Departmental Security Plan and a security delegation instrument.

Management Response and Action Plans

Overall Management Response:

Management agrees with the findings of the Audit of the Personnel Security Screening Process. The Chief Security Officer will work with the Security Services Division to ensure that audit recommendations are addressed through corrective actions, as described below.

Appendix A – Compliance Testing Results

Appendix B – Sampling Strategy

The internal audit team identified a population of 510 new and renewal security clearances, a population of 484 transfer-in security clearances and a population of 264 transfer-out security clearances for the period of April 1, 2019 to September 30, 2022.^{Footnote 3}

• For the new and renewal security clearances, out of the 510 security clearance files, 30 were selected using a judgemental random sampling method.^{Footnote 4}
• For the transfer-in security clearances, out of the 484 security clearance files, 12 were selected using a judgemental random sampling method.
• For the transfer-out security clearances, out of the 264 security clearance files, 3 were selected using a judgemental random sampling method.

The sample and population distribution is as follows:

Appendix C – Key Information Reviewed

Key Information Reviewed

The following is a non-exhaustive list of key information reviewed by the internal audit team:

Legislation, policies and guidelines:

• Treasury Board (TB) Policy on Government Security
• TB Directive on Security Management
• TB Standard on Security Screening

Documents specific to Department of Finance Canada:

• Departmental Security Policy (2011)
• 2019-21 Departmental Security Plan
• Department of Finance Management Accountability Framework Departmental Reports (2020-21 and 2021-22)
• Department of Finance Canada's Threat Risk Assessments
• Departmental of Finance governance committee documentation, such as Terms of Reference and records of decision
• Security Services Division internal process documentation

Other Documents:

• Canadian Security Intelligence Service's Insider Risk Program Reference Guide

Appendix D – Risk Ranking Methodology

The risks assigned to the findings were based on the Internal Audit Directorate's own assessment of the risks. The following table defines the criteria used in assigning risk/priority: