Audit of the Financial Management Controls and Practices of the Canadian Army

August 2018

1259-3-0017 (ADM(RS))

Reviewed by ADM(RS) in accordance with the Access to Information Act. Information UNCLASSIFIED.

Acronyms and Abbreviations
Results in Brief
1.0 Introduction
2.0 Findings and Recommendations
3.0 General Conclusion
Annex A—Management Action Plan
Annex B—Audit Criteria
Annex C—Sample Size

Alternate Formats

PDF Version
(243 KB, 26 pages)

Assistant Deputy Minister (Review Services)

ADM(Fin): Assistant Deputy Minister (Finance)
ADM(RS): Assistant Deputy Minister (Review Services)
CA: Canadian Army
CAF: Canadian Armed Forces
CDAO: Corporate Departmental Accounting Office
CFO: Chief Financial Officer
DND: Department of National Defence
DOA: Delegation of Authority
DRMIS: Defence Resource Management Information System

EMR: Expenditure Management Review
FAA: Financial Administration Act
FAM: Financial Administration Manual
FY: Fiscal Year
OPI: Office of Primary Interest
PPV: Post Payment Verification
RDAO: Regional Departmental Accounting Office
SIV/SAV: Staff Inspection Visit/Staff Assistance Visit

Overall Assessment

Financial management controls and practices are effective in some areas at ensuring the integrity of financial management and supporting the resource management process of the CA. Training, monitoring and guidance should, however, be improved to better support this process.

Results in Brief

With annual expenditures of nearly $1 billion, the Canadian Army (CA) accounts for roughly 6 percent of the expenditures of the Department of National Defence and the Canadian Armed Forces (DND/CAF) and is the largest element of the CAF. Effective financial management is an important factor in ensuring sound and prudent use of public funds in an effective, efficient and economical manner. There is also an increased importance placed on financial management in DND due to anticipated spending arising from Strong, Secure, Engaged: Canada’s Defence Policy. As part of the departmental Risk-based Internal Audit Plan for fiscal years (FY) 2016/17 to 2018/19, Assistant Deputy Minister (Review Services) (ADM(RS)) conducted an audit of the financial management controls and practices of the CA. Similar audits were conducted of the Royal Canadian Air Force in March 2015 and of the Royal Canadian Navy in October 2016.

Findings and Recommendations

Internal Controls. While some financial management controls were operating effectively, some were not working as intended. A review of a sample of transactions found that the Financial Administration Act (FAA) requirements for account verification and payment, acquisition cards, revenues, payables at year-end and segregation of duties were generally well managed. Some instances of non-compliance with financial management policies in the areas of expenditure initiation and commitment control, contracting, and delegation of authority (DOA) were identified, though there was no evidence of misappropriation or misuse of public funds. Inconsistent training and guidance for personnel with financial management responsibilities and who have varied backgrounds are contributing to these recurring errors.

Financial Management Workforce. The financial background and experience of financial management employees in the CA is inconsistent. As such, it is important to have in place the appropriate guidance and training to ensure that the various steps of the financial management process are applied consistently by all personnel performing the same tasks.

In order to improve its internal controls and manage risks related to the differing backgrounds of its financial management workforce, it is recommended that the CA implement a more risk based and consistent approach to financial management training and better organization of guidance to ensure uniform knowledge levels across financial management positions in the CA. This should include a needs analysis by type of positions informed by results of monitoring activities.

Oversight and Risk Management. Although there are currently several monitoring and oversight practices established within the CA, the frequency at which they were conducted depended upon resources available at each of the locations visited. Additionally, even though there was an overall awareness of the main financial risks and risk areas, these risks were not formally recorded or tracked. A more regular and formal approach to oversight activities and risk management respectively would strengthen financial management within the CA.

It is recommended that the CA conduct monitoring activities more consistently, on a risk basis, and use the results to identify areas for remedial action, including improved training or guidance.

The issues identified in this audit were consistent with previous audits of the Royal Canadian Air Force and the Royal Canadian Navy. While the findings and recommendations relate only to the organizations audited, they may have broader applications across the DND/CAF.

**Figure 1. CA Financial Management Organizational Structure.^{Footnote 1}** This figure illustrates the financial management structure of the CA.

Figure 1 Details – CA Financial Management Organizational Structure

Figure 1 Summary: This figure is an organizational chart that shows the financial management reporting relationships of the CA and the reporting relationships to the ADM(Fin)/CFO organization.

The Commander of the CA is at the highest level of the CA financial management organizational structure. At the same level is the ADM(Fin)/CFO, connected with a dotted line representing a functional reporting relationship.

The CA Comptroller is at the second level of the CA financial management organizational structure with a direct reporting relationship to the Commander of the CA.

The Division Comptrollers are at the third level of the CA financial management organizational structure with a functional reporting relationship to the CA Comptroller.

Base/RDAO Comptrollers are at the fourth level of the CA financial management organizational structure with a functional reporting relationship to the Division Comptrollers. At the same level is the CDAO, from the ADM(Fin)/CFO organization, connected sideways with a dotted line representing a functional reporting relationship. There are two organizational levels between the CDAO and ADM(Fin)/CFO.

The ADM(Fin), in his role as CFO, has functional authority over financial management and comptrollership in the Department, including the CA.

The Army Comptroller is responsible to the Commander of the CA. Some of the responsibilities of the Army Comptroller include providing strategic financial advice, establishing budgetary controls and processes, delivering financial planning for the CA and assuming the lead in comptrollership practices.

Five Division Comptrollers report functionally to the Army Comptroller. The Division Comptrollers work closely with Base Comptrollers and Canadian Division Support Group Comptrollers and are the link between them and the Army Comptroller. The Division Comptrollers are more or less divided geographically:

Canadian Army Doctrine and Training Centre;
2^nd Canadian Division – Quebec;
3^rd Canadian Division – Western Canada;
4^th Canadian Division – Ontario; and
5^th Canadian Division – Atlantic Canada.

The Base Comptrollers and Canadian Division Support Group Comptrollers are responsible for the existence and effectiveness of the local financial management control framework. They are also responsible for the day-to-day comptrollership and financial management functions of their respective Bases or Division Support Groups. Many of these comptrollers are also assigned the role of RDAO. This role reports functionally to the ADM(Fin)/CFO through the CDAO on various financial management areas. RDAOs are responsible for the control, processing and monitoring of financial transactions in their assigned geographic area. Additionally, the RDAO is responsible for the execution of payment authority as well as monitoring and oversight activities for their geographic area.

Day-to-day financial management activities such as budget management, purchasing and additional reporting within the organization are devolved further to other elements of the CA such as Responsibility Centre Managers and Responsibility Centre Administrators within operational organizations.

Back to Table of Contents

1.2 Rationale

Financial management includes finance-related activities undertaken to ensure sound and prudent use of public funds in an effective, efficient and economical manner.^{Footnote 2} It is especially important given the significance of CA expenditures — approximately $930 million^{Footnote 3} for FY 2016/17. Expenditures within the CA are expected to increase as a result of long-term investments and new initiatives as described in Strong, Secure, Engaged: Canada’s Defence Policy.

This audit is the third in a series of audits on the financial management controls and practices within the military environmental commands. ADM(RS) previously completed audits of financial management within the Royal Canadian Air Force and the Royal Canadian Navy in 2015 and 2016, respectively. Given the importance of this subject, the audit was included in the Risk-based Internal Audit Plan for FYs 2016/17 to 2018/19.

1.3 Objective

The objective of this audit was to determine if the financial management controls and practices of the CA are effective in ensuring the integrity of financial management and supporting the resource management process.

1.4 Scope

The scope of this audit included current CA financial management practices, including internal controls in expenditure and revenue management, risk management, governance activities such as monitoring and oversight, guidance, training as well as the financial management workforce.

The audit examined financial transactions for FY 2016/17. This is the period for which any conclusions on internal controls apply. Audit work was performed during the period from December 2016 to November 2017. The audit included consideration of internal controls within the following financial management areas:

expenditure management process (including expenditure initiation, account verification and payment);
DOA management;
segregation of duties;
commitment accounting;
acquisition cards;
contracting practices;
travel claims;
hospitality;
revenue management; and
payables at year-end.

The audit did not examine budget management processes or personnel salaries and wages for civilians and military members. Budget management was not examined as it was previously audited in the 2012 ADM(RS) Audit of Departmental Budget Management. Personnel salaries and wages were excluded from the scope as pay administration and related controls are managed primarily in other areas of the Department. The total population in the scope of this audit included $444 million of the CA’s $930 million in expenditures.

1.5 Methodology

The audit approach included the following:

analysis of data extracted from the departmental financial system, the Defence Resource Management Information System (DRMIS);
site visits to four CA locations, which included Canadian Forces Base Kingston, 3^rd Canadian Division Support Base Edmonton, 5^th Canadian Division Support Base in Gagetown and Moncton Garrison;
interviews with individuals in key positions holding financial management responsibilities at all levels of the CA financial management structure;
testing of a non-statistical sample of 132 transactions, consisting of expenses, revenues, purchases of assets, and payables at year-end transactions;
reviews of financial management policies, including Sections 32, 33 and 34 of the FAA, pertinent chapters from the DND Financial Administration Manual (FAM), and CA-specific financial policies and procedures; and
reviews of documentation provided by the CA, including financial reports, training material, operating procedures, and monitoring and oversight guidance and reports.

The sample included 132 transactions. Transactions were chosen randomly as well as on a directed basis (i.e. high dollar value, timing at year end). The results are not intended to be statistically representative. Not every audit test for internal controls was applicable to every transaction. Any conclusions formed relate only to the transactions reviewed. Annex C includes more information on the sample.

1.6 Audit Criteria

The audit criteria can be found at Annex B.

1.7 Statement of Conformance

The audit findings and conclusions contained in this report are based on sufficient and appropriate audit evidence gathered in accordance with procedures that meet the Institute of Internal Auditors’ International Standards for the Professional Practice of Internal Auditing. The audit thus conforms to the Institute of Internal Auditors’ International Standards for the Professional Practice of Internal Auditing as supported by the results of the quality assurance and improvement program. The opinions expressed in this report are based on conditions as they existed at the time of the audit, and apply only to the entity examined.

Back to Table of Contents

2.0 Findings and Recommendations

2.1 Internal Controls

2.1.1 FAA and Departmental Policy Compliance

The FAA is the cornerstone of the legal framework for financial management within the federal government and confers financial authorities on Ministers and Deputy Heads. As it is not practical for these individuals to carry out all of these responsibilities, they delegate their authority through the DOA process to positions within the Department. Authority limits are conferred on positions within the Department through the Delegation of Authorities for Financial Administration Matrix. DOA forms are then used to identify the specific individuals occupying those positions, confirm that required training has been completed, and allow individuals to exercise the authorities associated with their positions. By 2017, DOA forms were centrally stored in the DRMIS, though the system does not include automated controls to restrict authorities based on the forms. The DOA process helps to ensure that financial controls are put in place to regulate the expenditure of public funds. Sections 32, 33 and 34 of the FAA describe the financial authorities for the expenditure process. Table 1 describes the key controls in expenditure management and the audit tests performed.

During this audit, a sample of transactions was reviewed to determine if internal controls were operating as intended. For transactions reviewed, internal controls were operating effectively in many areas, including Section 34, Section 33, acquisition cards, revenues, payables at year-end, financial coding and segregation of duties. Areas requiring improvement included Section 32, delegation of financial authorities, contracting and supporting documentation.

Table 1. Expenditure Management Process. This figure describes the controls in the expenditure management process, and the audit tests performed for each control.
Control	Responsibilities	Tests Performed
Section 32 – Expenditure Initiation and Control of Commitments	Ensure expense is legitimate, represents most efficient and economical means and provides best value. Ensure budget has sufficient funds available and set up a commitment in DRMIS.	Commitment is established. Documentation indicating Section 32 exists. Certified by person with delegated authority. Expense is approved prior to the event.
Contracting	Authority to enter into a contract.	Valid contract provided. Contract or call-up signed by person with delegated authority. Contract was in place before the provision of goods or services. Terms and conditions of the contract or call-up have been met. Minimum number of quotes have been obtained.
Section 34	Verification of accounts and preparation of requisitions for payment or settlement. Certification of an account pursuant to FAA Section 34.	Invoice total is calculated correctly. Vendor information is accurate and complete. Documentation exists indicating Section 34 approval. Certified by person with delegated authority.
Section 33	Certification of requisitions for payment or settlement pursuant to FAA Section 33.	Payment on due date. Documentation exists indicating Section 33 approval. Certified by person with delegated authority. Payment of correct amount to the correct vendor and is within contract limits.

Table 1 Details – Expenditure Management Process

Section 32 – Expenditure Initiation and Control of Commitments

Section 32 of the FAA requires that, before any transaction takes place, the expenditure is determined to be a legitimate business requirement, a sufficient balance is available in the budget, and that funds are secured through a financial commitment in the Department’s financial system.

A sample of transactions was tested to determine if they had been authorized in accordance with Section 32 of the FAA. Of the 119 transactions tested, 30 percent (36/119) had an error that meant that Section 32 was not properly executed. This included issues in the establishment of a commitment, approval of the expense after the transaction had taken place, or expenses approved by an individual without a valid DOA. Errors in this area were not limited to any particular type of expenditure examined for the transactions reviewed. For this audit, a transaction was defined as any entry to the DRMIS.

By not employing proper control of commitments prior to expenditure, there is a risk that legitimate operational or business requirements may not be met as sufficient funds may not be available. Also, the risk of misuse or misappropriation of public funds increases when expenditures are not approved by individuals with valid authorities. Nevertheless, no evidence of misuse or misappropriation of funds was uncovered in the course of the audit procedures performed.

Section 34 – Certification for Performance of Work, Goods or Services and Eligibility for Payment

Section 34 of the FAA looks to ensure that work has been performed or goods or services have been delivered according to the terms and conditions of the contract or agreement. For Section 34, the audit team verified documentation for a signature to ensure the transaction had received Section 34 approval based on an appropriate DOA. Additionally, transactions were verified to confirm that invoice information such as total amounts and vendor information had been entered correctly in the DRMIS.

Transactions reviewed were treated appropriately, except for 8 percent (9/119) of cases where the individual signing Section 34 did not have an appropriate DOA due to expired pre-requisite training, missing DOA forms, or the transaction was outside of the individual’s approval limits. These exceptions were identified in routine expenditures such as utilities and professional services.

Section 33 – Payment for Work, Goods or Services

Section 33 of the FAA defines the requirements that must be met in order to authorize a payment for goods or services. Authorization for payments in the Army is given by the RDAOs. The purpose of this provision is to control the requisition of payments made by the Department. Transactions were checked to ensure that evidence of approval existed based on an appropriate DOA. Only 3 percent (2/75) of transactions examined had not been approved by an individual with the necessary authority. These two transactions related to transportation, materials and supplies.

Contracting Requirements

Contracting requirements are set out in the Procurement Administration Manual, a departmental guidance document which is based on a set of key Government of Canada instruments including the FAA, the Government Contracts Regulations and the Treasury Board Contracting Policy. The goal of these documents is to ensure that contracting is done in a manner that enhances access, competition and fairness and results in the best value or in certain cases the optimal balance of overall benefits to the Government and the people of Canada. Compliance with contracting requirements is a key component of effective stewardship of public resources.

For each of the applicable transactions sampled, the related contracts or call-ups against standing offers were examined to determine whether:

the contracting authority signature was present and was provided by someone with a valid DOA;
the contract was in place prior to the expenditure;
the goods and services ordered and payments made were in conformance with the terms and conditions of the contracting instrument;
contract splitting did not occur; and
the regulations for competitive and sole source contracts were followed.

All tests relating to terms and conditions of contracts and standing offers demonstrated a high level of compliance. A variety of errors were found in other contracting areas, although error rates were not significant in any one area. Two of the higher error rates observed related to the lack of documented contracting authority in 10 percent (10/97) of instances, and transactions occurring prior to the contract being put in place in another 10 percent (9/95) of instances.

Additional Control Areas

The review of sampled transactions demonstrated a high level of conformance to internal controls in the following areas:

Acquisition cards. Forty acquisition card transactions were verified to ensure that the card was within its balance limit, that a monthly reconciliation had been prepared and that purchases were supported by receipts. These steps were appropriately completed in all but one of the transactions reviewed.
Revenue transactions. A limited sample of invoices for revenue transactions were checked against their entry in the financial system to ensure correct timing and amounts. No errors were found in any of the six revenue transactions verified representing about $24,000.
Payables at year-end. A limited sample of six payables at year-end transactions totalling about $19,000 were checked to confirm that goods and services had been provided before, and that payment was made after the fiscal year end. No errors were found for any payables at year-end transactions in the files reviewed.
Financial coding. Transactions were reviewed to ensure that the financial coding was appropriate. The financial coding was correct for all but 4 percent (5/131) of the transactions examined, representing approximately $13,600 out of $6,315,000 in the total sample.
Segregation of duties. Transactions were verified to ensure that there was an appropriate segregation of duties. Exceptions were identified in only 4 percent (5/131) of transactions, totalling about $7,600 of $6,315,000.

Supporting Documentation

A total of 132 transactions were checked to ensure that the supporting documentation for Sections 32, 33, 34 and acquisition card transactions were complete and provided a proper demonstration of due diligence. Additionally, where it was applicable, either a contract or a call-up against a standing offer was requested for each transaction in the sample.

In total, 12 percent (16/132) of the transactions in the sample were missing an element of required documentation, such as receipts, invoices, contracts, call-ups against standing offers, certifications, or other source documents. Financial management policies and legislation require that paperwork for all transactions and contracts be maintained. These records are needed to verify that transactions were properly approved, executed and recorded, and that internal controls were working as intended. The inability to produce supporting documents also brings into question the quality of the Section 34 certification that had been performed, as the records would have been required for verification at the time.

2.1.2 Conclusion

Compliance with FAA and departmental financial policies is important to ensure that sufficient funds are available for a transaction, and that transactions are properly approved and verified. Internal controls were working well with low error rates in many areas. However, some control areas were not operating as intended, representing risks to effective financial management.

The varied backgrounds of financial management employees and inconsistencies in training and guidance were considered to be contributing factors to the internal control weaknesses identified. In order to improve compliance in the control areas that were not operating as intended, targeted training must take into account the background of financial management employees. This should help to make sure that employees performing the same tasks have a consistent knowledge base, and lead to reduced errors. These issues and associated recommendations are further discussed in sections 2.2 and 2.3 of this report.

ADM(RS) Recommendation

Recommendations related to improving training, guidance and monitoring as described in section 2.2 and 2.3 of this report are expected to address identified weaknesses in internal controls.

OPI: CA

2.2.1 Background of Financial Management Employees

The background and extent of experience of employees involved in the financial management process varies. Some employees enter these positions having little experience and no background in finance even though in some cases, these positions have important financial management responsibilities delegated to them, such as the responsibility for a cost centre.

Military members are assigned to positions through a centralized posting process that may be based on factors other than the specific needs of the position. As a result, it is important for DND/CAF organizations, including the CA, to have in place a systematic process to ensure that personnel are provided the appropriate training and guidance to carry out their responsibilities. Additionally, Non-Commissioned Members filling finance positions had been qualified under the Resource Management Support Clerk occupational structure, which may have included more generalist backgrounds in finance or human resources. In October 2016, this structure was replaced with the creation of a Financial Services Administrator occupational structure, which should deliver, over time, qualified personnel with a more financial orientation.

Lastly, personnel with financial management responsibilities are often not specialists in this field, but are managers working in other disciplines with management roles. As a result, the financial background that they bring to the role is varied and may be limited in some cases.

2.2.2 Guidance

Financial management policies and procedures are numerous, varied and located in many different locations. Foundational guidance documents were designed for use by the entire federal government by the Treasury Board of Canada Secretariat. As these were intentionally created as high-level documents, it has led to the development of more specific policies, procedures, and other interpretations at many different levels, which in turn are stored in many different locations by the owners of the documents. As each guidance document contains different details, employees must be aware of the location of each to access the information required to do their jobs. This is especially important for employees without a strong background in financial management. As a result, some CA bases have made efforts to organize this information centrally on their SharePoint sites.

2.2.3 Training

The financial management training in place for the CA is not needs-based and does not take into account the background of employees. Employees with varied financial backgrounds will have different skills and competencies requiring different training in order to perform the same tasks in a similar manner. At the time of the audit, the training for financial management employees did not account for these differences.

There are mandatory courses across the Department for employees with a delegated authority. These include the Expenditure Management Course (for employees with a delegated Section 32, 33 or 34 authority), Authority Delegation Training (for all military officers and civilian managers), the Contracting Certification Course (for directors and above who have contracting authority), and Contracting Direct With Trade (for personnel who have contracting authority). This ensures that employees with a delegated authority have an awareness of the basic financial management controls and practices in place. Nevertheless, different mandatory training in other areas of financial management exists for civilians, officers or non-commissioned members, despite potentially occupying similar positions, roles and functions.

These differences are partly because the training each group receives is in some cases not available to the others and partly because the mandatory courses have different focuses. For example, civilian employees receive most of their financial management training through the Canada School of Public Service. Topics covered include areas such as budgeting, the reporting cycle, and the internal control process which includes expenditure initiation, expenditure verification and the payment process. Though courses through the Canada School of Public Service are now available to military members, responses from interviews suggest that not all military members were aware of this training.

In contrast, military Logistics Officers attend training through the Canadian Forces Logistics Training Centre where they learn about financial management topics including procurement, warehousing, distribution and financial services in an introductory course on logistics support. As this is part of the training for a Logistics Officer, it is only available to that group. Non-commissioned members also attend the Logistics Training Centre. They learn about different financial management areas as part of the Basic Occupational Qualification Training. This training is part of the development plan for the Financial Service Administrators role and includes topics such as financial regulations, authorities, payables and receivables, corporate cards, etc.

An analysis of course outlines of the mandatory courses revealed that, although similar in some aspects, the mandatory training for each group has a different focus. These differences in training pose an important risk given that employees of each group may have varied backgrounds and experiences yet could be responsible for similar financial management activities.

2.2.4 Conclusion

Inconsistent backgrounds for personnel with the same financial management responsibilities may lead to different interpretations and application of steps in the financial management process. Without sufficient guidance or needs-based training to address this issue, the likelihood of non-compliance errors such as those discussed in the previous section on internal controls is increased, leading to a further risk that decisions are made based on inaccurate financial evidence. Considering the size of the organization, it is important that the CA has in place a strong system of financial controls and practices, which includes ensuring that individuals with financial management responsibilities are qualified to exercise the authorities delegated to them by the Deputy Minister.

ADM(RS) Recommendation

Good Practices

The Army Comptroller uses a reporting schedule that outlines the reporting mechanisms for effective decision making, to which the Divisions must adhere. This schedule helps to manage the process and ensure timely and complete reporting from the multiple organizations involved in the financial management process.

2.3.1 Monitoring and Oversight

Monitoring and oversight activities help to assess financial management controls and practices by providing assurance that an organization is compliant with policies and is operating efficiently and effectively. They are intended to promote sound stewardship of resources and to maintain institutional credibility.

The monitoring and oversight activities for financial management are clearly defined processes designed to identify and report on key issues and ensure corrective action and follow-up to facilitate improvements. Monitoring and oversight activities used by the CA include:

Staff Inspection Visits (SIV)/Staff Assistance Visits (SAV);
Expenditure Management Reviews (EMR); and
Post Payment Verifications (PPV).

At the three bases and two divisions visited/examined, these monitoring and oversight activities were not consistently conducted. SIV/SAVs and EMRs were rarely performed during the period examined, whereas PPVs, while conducted, were of inconsistent quality. Staff indicated that the frequency of monitoring and oversight conducted within or by the CA is dependent upon resources available at a location. Some locations reduced their monitoring activities due to staffing issues.

SIV/SAV. The CA or Division Comptrollers conduct these visits. The visits focus on verifying the accuracy of the Working Capital Account and the Receiver General Transfer Account, the efficiency and effectiveness of the Base and Canadian Division Support Group verification process, and the effectiveness of the decision support provided to commanders. For FY 2016/17, SIV/SAVs had not been completed by two of the four comptrollers visited, while one had restarted them after having completed none in the previous year. The comptrollers indicated that this was due to staff shortages. One additional division visited had subsequently restarted its SIV/SAVs in FY 2017/18. There is, however, no departmental guidance or expectations from the CA on how often inspections should be carried out. As the purpose of SIV/SAVs is to improve financial management processes, a report is provided to the unit inspected. A copy of any SIV/SAV report is also delivered to the Army Comptroller’s office. Corrective action should then be taken based on the recommendations of the inspection team.

EMR. The intent of these reviews is to ensure the effectiveness of the expenditure management process. The CDAO’s Standard Operating Procedures on EMRs establish criteria that determine whether an EMR should be conducted. If any of the following six criteria are met then an EMR is to be conducted by the RDAO:

the identification of a Responsibility Centre manager as high risk by the RDAO;
identification of ongoing non-compliance with controls;
changes are made to the RDAO structure;
by request from a higher level comptroller;
when units have not been identified as part of the PPV during the fiscal year; and
by request of the ADM(Fin)/CFO.

No evidence that EMRs had been conducted was identified for the audit period. This was also attributed to staff shortages.

PPVs. The CDAO, on behalf of the Department, has developed a risk-based account verification process in response to the Treasury Board Directive on Account Verification, which requires departments to develop a process to ensure sound stewardship of financial resources. These verifications are monthly department-wide reviews of high-risk and low-risk transactions identified based on a statistical sample selected by the CDAO. It is the responsibility of the RDAOs to conduct and complete the PPV based on the monthly sample selected by the CDAO, which is based on the Annual PPV Sampling Plan as reviewed and approved by the ADM(Fin)/CFO.

A sample of transactions previously selected for PPVs were retested. In 60 percent (18/30) of transactions, the findings of the PPV did not agree with the retesting performed through the audit. In most cases, the audit team found additional errors that the PPV had not; however, there were six instances where the PPV uncovered errors that the audit team did not. In these instances it is possible that a previous error had been corrected or that there were different interpretations between the audit team and the PPV. Most instances where the results from the audit and PPV did not agree related to DOA issues uncovered by the audit. Other additional errors found by the audit include late Section 32 signatures, segregation of duty issues, late payments which would have incurred interest charges or missing documentation. The differences in findings indicate that the quality of PPV verifications is inconsistent and potentially unreliable. Since the completion of the audit work, the CDAO has implemented a new PPV checklist as well as new error codes with the aim that PPV results will be improved.

2.3.2 Risk Management

There is no formal financial risk management plan or risk register for financial management at the various comptrollership levels within the CA. While the operating plans of the CA and Divisions include considerations of risk at a broader level, this leads to focus mainly on risks related to funding and budget management.

Based on interviews with employees at the base level, comptrollers are aware of the financial management and control risks, and consider them in their comptrollership activities. However, the risks are not formally recorded or tracked. Recording key risks related to financial management is an important practice to increase the likelihood that they are effectively managed, that important risks are not overlooked, and that risk levels are updated on a routine basis to account for changes in the financial management landscape.

A more formalized risk management process could be used to identify and manage risk areas such as specific transaction types, units, or previous problem areas. It could also be used to ensure that important risks are not overlooked and that risk levels are updated on a routine basis to account for any changes to the financial management landscape. A more formalized risk management process would also help identify systemic issues to be targeted as well as their root causes through additional training and guidance, process improvements, or increased monitoring.

2.3.3 Conclusion

When monitoring and oversight practices are not completed regularly, important issues or financial reporting inaccuracies cannot be identified in a timely manner. In addition, areas for improvement and root causes of problems may not be identified on a timely basis leading to the recurrence of errors. The comptrollers at the Army Headquarters, Division and Base levels have indicated that low staffing levels have resulted in missed inspections within FY 2016/17 but that they would like to do more once resources permit. Additionally, having a more formalized risk management process could also help to identify systemic issues and their root causes and ensure they are being properly managed.

ADM(RS) Recommendation

Back to Table of Contents

3.0 General Conclusion

The financial management controls and practices of the CA were found to be effective in some areas at ensuring the integrity of financial management and supporting the resource management process. No evidence of misappropriation or misuse of public funds was identified through the audit. Training, monitoring and guidance should be updated to ensure consistent application of internal controls.

Internal controls were functioning well in some areas such as Section 34, Section 33, acquisition cards, revenues and payables at year-end. Some controls related to expenditure initiation and commitment control, contracting and delegation of authority were not operating as intended. As personnel are assigned into positions with financial management responsibilities, a more needs-based and consistent approach to training and guidance would help to ensure that these responsibilities are fully understood and properly executed.

Finally, a more regular, consistent and risk-based approach to monitoring activities would help to identify systemic issues and areas for improvement which could be incorporated into an improved training and guidance strategy.

This report continues to reinforce the messages from the previous audits on the Royal Canadian Navy and Royal Canadian Air Force, with recommendations in the areas of training, guidance and monitoring. The findings from this audit are consistent with these previous reports, and while applicable only to the organizations audited, should be considered for broader relevance across the Department.

Annex A—Management Action Plan

ADM(RS) Recommendation (Moderate Significance)

Management Action

In FY 2018/19, the CA will initiate a review of all monitoring and oversight practices and amend as necessary to ensure a risk-based approach is utilized pan-Army that is consistent with Treasury Board and departmental policy guidelines. Further, the CA will conduct a training needs analysis to identify the financial management knowledge gaps that currently exist across its financial capability. Once the needs analysis is completed, the CA will formalize its own financial professional development program, supplemental to existing training, which will address the non-compliance issues indicated in the report. A more rigorous monitoring plan will be used to monitor the results of the professional development program, to ensure it remains relevant to the needs of the CA financial community, with a focus on improving financial management processes.

With respect to guidance material, in FY 2018/19, the CA will review its own financial guidelines and amend as necessary to ensure it is comprehensible for use at all levels. Additionally, an initiative will be launched to accumulate and communicate financial guidance material in one location for easy access and comprehension by the CA financial community at large.

OPI: CA
Target Dates:

December 31, 2018 – accumulate and communicate financial guidance material in one location
March 31, 2019 – complete review of all monitoring and oversight practices
June 30, 2019 – complete training needs analysis
August 31, 2019 – formalize a risk-based financial monitoring/oversight directive based on results of review
September 30, 2019 – formalize CA financial professional development program to supplement existing training
November 30, 2019 – complete review of all CA financial guidelines/directives

Oversight and Risk Management

ADM(RS) Recommendation (Moderate Significance)

Management Action

In FY 2018/19, the CA will initiate a review of all monitoring and oversight practices and amend as necessary to ensure a risk-based approach is utilized pan-Army that is consistent with Treasury Board and departmental policy guidelines. Results of the monitoring activities will be used to identify areas of remedial action, with a view to taking necessary steps to improve CA financial administration and ensure financial compliance going forward. Additionally, as part of the review, the CA will collaborate with CDAO, L2 and RDAO organizations to identify and correct systemic issues with the focus on improving financial management process across the CA.

OPI: CA
Target Dates:

March 31, 2019 - complete review of all monitoring and oversight practices
August 31, 2019 - formalize a risk-based financial monitoring/oversight directive based on results of review, including action to be taken with respect to results of monitoring and oversight activities

Back to Table of Contents

Annex B—Audit Criteria

Criteria Assessment

The audit criteria were assessed using the following levels:

Internal Controls

1. An adequate system of internal controls and practices is maintained to promote effective resource management and integrity of financial information.

Assessment Level 3 – Although internal controls and practices are in place, some are not effective. A more risk-based approach to financial management training, monitoring and guidance is required to improve controls in areas such as Section 32 authorization, commitment control, delegated authorities, and contracting.

Risk Management

2. A risk management framework is in place to ensure that financial management risks are identified and adequately management.

Assessment Level 2 – While financial management and control risks are considered as part of comptrollership activities, there is no formal financial risk management framework in place at the various comptrollership levels within the CA.

Governance

3. A governance structure is in place to promote an effective CA financial management framework. Elements of governance examined included monitoring and oversight activities, financial management guidance and reporting structure.

Assessment Level 4 – A more regular and consistent approach to oversight activities is needed including ensuring that recommendations developed from the results of monitoring activities are implemented.

Human Resources

4. Employees with financial responsibilities are adequately managed to ensure qualified employees are hired, trained and retained.

Assessment Level 3 – The background of employees in positions with financial management responsibilities is inconsistent and the training does not adequately account for these differences.

Sources of Criteria

Internal Controls:

Reference to: Financial Administration Act (FAA)
Reference to: Department of National Defence, Financial Administration Manual (FAM)
Reference to: Committee of Sponsoring Organizations of the Treadway Commission (COSO), Internal Control – Integrated Framework, March 2013

Risk Management:

Reference to: Committee of Sponsoring Organizations of the Treadway Commission (COSO), Internal Control – Integrated Framework, March 2013

Governance:

Reference to: Committee of Sponsoring Organizations of the Treadway Commission (COSO), Internal Control – Integrated Framework, March 2013

Human Resources:

Reference to: Committee of Sponsoring Organizations of the Treadway Commission (COSO), Internal Control – Integrated Framework, March 2013

Back to Table of Contents

Annex C—Sample Size

The sample included 132 financial transactions,^{Footnote 4} split between the sites chosen for reviews (44 transactions at each of 3 sites: Canadian Forces Base Kingston, 3^rd Canadian Division Support Base Edmonton, and 5^th Canadian Division Support Base in Gagetown). Of the transactions sampled for the 5^th Canadian Division Support Base, 8 transactions were selected from the Moncton Garrison, which reports functionally to it. These sites were chosen based on feedback from interviews, error rates from PPVs, volume of transactions and dollar value of transactions.

The results are not intended to be statistically representative. Any conclusions formed relate only to the transactions reviewed. The total number of transactions selected for review is consistent with two previous audits of financial management. Experience from prior audits indicated that this size would provide sufficient information to inform audit conclusions and recommendations, and be achievable within one-week site visits.

The 132 transactions were chosen randomly but also on a directed basis. The sample was chosen from the population of transactions for CA expenditures, revenues, assets and liabilities for the 12 month period beginning April 1, 2016 and ending March 31, 2017. The 132 transactions were drawn randomly to ensure coverage across eleven expenditure types (i.e. professional services, travel, supplies). Directed sampling was then applied to replace lower value transactions with higher risk transactions, including:

four transactions per site occurring in March, the fiscal year end; and
six high dollar value transactions per site.

Due to the nature of the testing, not every audit test was applicable to every transaction. The applicable sample size for each internal control area that was tested is outlined in Table 2.

Table 2. Internal control test and sample size. This table lists the applicable sample size for each internal control area tested.
Internal Control Testing	Sample Size
Proof of Section 32 authorization	119
Expense incurred after Section 32 authorization, including appropriate DOA	119
Proof of Section 34 authorization including appropriate DOA	119
Proof of Section 33 authorization, including appropriate DOA	75
Appropriate segregation of duties	131
Compliance with acquisition card requirements	40
Compliance with contracting requirements, including appropriate DOA	102
Compliance with revenue and payables at year-end requirements	12
CDAO PPV transactions	30
Appropriate supporting documentation	132

Table 2 Details – Internal Control Test and Sample Size

Back to Table of Contents

Footnotes

Footnote 1

The ADM(Fin) has functional authority over financial management and comptrollership in the Department. The solid lines represent reporting relationships while the dotted lines represent functional reporting relationships. While comptrollers within the CA report functionally to the Army Comptroller, they report organizationally within the military chain of command.

Return to footnote1 referrer

Footnote 2

Treasury Board Policy on Financial Management.

Return to footnote2 referrer

Footnote 3

Total expenditures including operations and maintenance, military and civilian salaries and wages.

Return to footnote3 referrer

Footnote 4

A transaction was defined as any monetary entry to the DRMIS where a good or service was either bought or sold.

Return to footnote4 referrer

Page details

Date modified:: 2019-03-08

Language selection

Search

Audit of the Financial Management Controls and Practices of the Canadian Army

Table of Contents

Alternate Formats

Assistant Deputy Minister (Review Services)

Overall Assessment

2.1.1 FAA and Departmental Policy Compliance

ADM(RS) Recommendation

ADM(RS) Recommendation

Good Practices

ADM(RS) Recommendation

ADM(RS) Recommendation (Moderate Significance)

ADM(RS) Recommendation (Moderate Significance)

Page details