Audit of NPP Procurement and Contracting

Back to Table of Contents

1.2 Objective

The objective of the audit was to provide assurance on the effectiveness of the governance framework, risk management practices and internal control processes that support the procurement and contracting activities of NPP.

Specifically the audit considered whether:

• the procurement and contracting accountability framework is appropriate, complete and effective;
• NPP organizations manage procurement and contracting risks appropriately throughout the lifecycle; and
• NPP contracts are compliant with the NPP procurement and contracting accountability framework.

1.3 Scope

The scope of the audit covered the full life cycle of the procurement and contracting activities which involve:

• Requirement definition;
• Procurement planning;
• Solicitation activities;
• Contract award;
• Contract administration; and
• Contract close-out.

The audit examined NPP contracts that resulted in expenditures during FYs 2015/16 and 2016/17, until the end of December 2016.

The scope of the audit did not include CANEX and NATEX procurement of goods for resale in addition to non-binding agreements (e.g., Memorandum of Understanding, Service Level Agreement).

1.4 Methodology

The audit team conducted site visits to CFB Halifax, Valcartier, Borden, Trenton, CFSU Ottawa and CFMWS HQ where document reviews were carried out and supplemented by interviews with management and process owners. Key processes and controls were identified and documented, and those responsible for performing the key controls and managing the risks related to those activities were interviewed.

The design of the controls and the compliance of contracts with the PCAF was assessed by testing a sample of contracts selected from financial transactions within the accounting system. A total of 78 PC files were selected using a judgmental sampling methodology.

1.5 Audit Criteria

The audit criteria can be found at Annex B.

1.6 Statement of Conformance

The audit findings and conclusions contained in this report are based on sufficient and appropriate audit evidence gathered in accordance with procedures that meet the Institute of Internal Auditors’ International Standards for the Professional Practice of Internal Auditing. The audit thus conforms to the Institute of Internal Auditors’ International Standards for the Professional Practice of Internal Auditing as supported by the results of the quality assurance and improvement program. The opinions expressed in this report are based on conditions as they existed at the time of the audit and apply only to the entity examined.

Back to Table of Contents

2.0 Findings and Recommendations

2.1 Governance

The PCAF was developed to reflect the requirements and principles of prudence and probity upon which the Government of Canada's public accountability framework is based. At the same time, the PCAF recognizes the unique and diverse nature of NPP as well as the importance of having PC practices in place that are flexible enough to meet business needs while ensuring openness, fairness and transparency.

2.1.1 Procurement and contracting accountability framework design

The main governing elements of the PCAF are the NPP Contracting Policy, the NPP Contracting Guidelines and the CDS-issued Delegation of Authorities (DoA) for Financial Administration of NPP. Contract administration practices are also supported by the manual A-FN-105-001/ AG‑001, Policy and Procedures for Non-Public Property (NPP) Accounting (hereafter referred to as AFN-105) which is a key control mechanism for effective contract administration.

One of the core NPP PC principles is that competitive tendering is the norm unless there are compelling reasons not to do so. There are policy requirements for openness, fairness and transparency in the PC process and requirements to properly annotate the PC file to demonstrate compliance. Results from the files reviewed by the audit team indicate the need for better demonstration of compliance with these principles, particularly with respect to documenting bid evaluation results, sole source rationales and contract award decisions.

The contracting policy outlines several sound principles in the PC process, and the accompanying contracting guidelines elaborate on requirements to properly manage the contracting process.

A formal and documented Delegation of Financial and Contracting Authority has been established and is updated as required. The DoA instrument within the audit scope was issued on January 4, 2016. The 2016 update included the introduction of clearer language on cursory, pre-payment and post-payment verification requirements.

While the contracting guidelines are generally quite comprehensive, they are not always consistent with other key documents. For example, the contracting guidelines note that all contracts should be submitted to the NPP Accounting Manager (NPPAM) for supporting payment requests, the DoA instrument and Contracting Policy state that only contracts over $50,000 need to be submitted to the NPPAM, and the AFN-105 also specifies that all supporting documents must accompany the invoices.

In addition to the inconsistencies between documents, the AFN-105 content has not been updated to reflect the changes resulting from the adoption of a new accounting system in FY 2015/16. Outdated AFN-105 content may impact contract administration practices and thus affect the application of NPP contracting principles.

The contracting guidelines broadly describe areas of consideration to determine the need for written contracts but leave much room for interpretation. While it is recognized that this approach allows for flexibility in contracting practices in such a diverse environment, it poses a risk in regard to non-compliance with NPP contracting principles. As such, it would be beneficial for the guidelines to include more guidance on a range of circumstances where it would be appropriate to use written contracts and the use of any specific clauses as a risk-management tool.

2.1.2 Training, tools, resources and information to support the discharge of PC responsibilities

In order to enter into contracts under the NPP Accountability Framework, individuals must receive delegated authority for financial administration of NPP. This is accomplished by successfully completing one of the two mandatory prerequisite certification courses and recertifying every three years in order to continue to exercise NPP financial signing authority. In addition, Contracting Awareness training exists for new managers/supervisors who will be involved in the PC process but do not need to approve any part of the process. These training courses are available online.

While training materials and on-the-job tools exist, alignment of training with the most recent policies and encompassing adequate information to enhancef PC personnel’s understanding of requirements/expectations are key. Opportunities to review existing training content would ensure it is sufficiently robust as well as consistent. By including additional information, such as details/examples regarding the contract file verification process, the training would contribute to ensuring that new contracts are complete and have undergone required due diligence for the complexity of the file.

Improved monitoring of delegation of authority training at the base level is also required as the file review revealed situations of missing, outdated or improper delegation of authority for contracting and/or invoice approval. Evidence of proper delegation of authority is essential to provide assurance that due diligence on various aspects of the PC file was done at key stages of the PC process.

It is important to note that management has recognized some of the challenges associated with PC and is being proactive in initiating improvements to the PCAF, including:

• Hiring a full-time NPP Procurement and Contracts Officer in November 2017;
• Creating a Contracting Committee in August 2016 with representation of Divisional Contracting Representatives from each of the CFMWS divisions;
• Making use of the Approval Authority for Directed Contracts form mandatory as of December 2016;
• Updating the mandatory certification courses in May 2017; and
• Updating the Contracting Policy and Guidelines in August 2017.

While these improvements to the PCAF could not be assessed for their effectiveness due to their recent implementation, they are recognized as positive developments in the realm of NPP PC.

2.1.3 Communication of corporate values and ethics, code of conduct or equivalent policy and compliance with policy requirements

The Contracting Policy is principle based, and is consistent with the V&E Code for the Public Sector and the NPP V&E policy.

V&E and Conflict of Interest (COI) training is mandatory and available via an online learning portal. The majority of employees interviewed indicated their participation in courses, sessions and presentations that inform them about conflict of interest, ethics and fraud.

Statistics on V&E related incidents, training, and enquiries are captured on a quarterly basis and reported to the NPP Audit Committee and the NPP Executive Management Board. A year-end report on V&E and COI activities is also issued by the CFMWS Conflict Management office.

2.1.4 Defining contents of a contract file

The results of the file review highlight the need for detailed guidance and/or a checklist to inform and direct PC personnel on contract file content requirements. This would ensure the ability to demonstrate adherence to NPP contracting principles. Results of the sample file review include instances of Capital Expenditure Requests (CER)^{Footnote 1} and witness signatures not included in contract files, invoices to support contract expenses not on file, missing financial coding on the invoices and missing proof of insurance.

The development of guidance and/or a checklist would contribute significantly to improved gathering and storing of PC information, in a consistent manner, as well as contributing to corporate memory.

Back to Table of Contents

2.2 Risk Management

Back to Table of Contents

2.3 Internal Controls

A judgmental approach was used to select a sample of 78 PC files. Attributes such as dollar value, nature of item procured (goods or service, capital or operating expenditure item) procuring organization and geographic area served were used to pick a diversified sample.

It is important to note that when examining the selected PC files, compliance with PC principles could only be assessed based on documentation contained in the PC file and documentation provided as part of follow-up with the client. During examination of the contract files, it became apparent that recordkeeping and information-management practices relating to NPP PC activities are in need of improvement. The most common areas where documentation was not available included the following:

• Capital Expenditure Requests (CER)
• Contract amendments
• Proof of insurance
• Expenditure support
• Evidence of monitoring of contractor’s performance

There were also several instances where the contract files contained scanned electronic supporting documents that were illegible. Approved scanned documents are considered by CFLA to be akin to original documents and as such ensuring legibility is essential.

In addition, the audit team observed contract files where the same individual submitted and approved cheque requests. In the absence of mitigating controls such as a documented supervisory review and documented cursory review of the contract file, this presents a potential segregation of duty concern. An opportunity exists to review current processes, in a risk-based manner, to determine whether or not more segregation of duties can be embedded.

Despite these observations, it is important to note that in the sample reviewed, all procurement and contracts (including contract renewals) were for the provision of MW services.

Back to Table of Contents

3.0 General Conclusion

While an NPP PCAF is in place, there are opportunities to significantly improve its effectiveness. Without improvements, NPP may be exposed to potential risks.

NPP has several initiatives underway which, coupled with addressing the findings of this audit, will contribute substantially to the strengthening of the PCAF.

Back to Table of Contents

Annex A - Management Action Plan

ADM(RS) uses recommendation significance criteria as follows:

• Very High—Controls are not in place. Important issues have been identified and will have a significant negative impact on operations.
• High—Controls are inadequate. Important issues are identified that could negatively impact the achievement of program/operational objectives.
• Moderate—Controls are in place but are not being sufficiently complied with. Issues are identified that could negatively impact the efficiency and effectiveness of operations.
• Low—Controls are in place but the level of compliance varies.
• Very Low—Controls are in place with no level of variance.

Governance

Management Action

The process of amending AFN 105 Policy and Procedures for Non Public Property (NPP) Accounting is a continuous endeavor, and a prioritized plan will be developed by December 31, 2018. Chapter 19 Accounts Payable and Disbursement will be amended on a priority basis by December 2018.

The CDS Delegation of Authorities for Financial Administration of NPP was last amended in January 2016. A revised document will be produced by June 2019, and amendment to training will follow.

The NPP Contracting Policy and Guidelines will be amended to reflect any changes to the AFN 105 and the CDS Delegation of Authorities for Financial Administration of NPP with a target date of December 2019 and will identify situations where formal written contracts are required.

OPI: CFMWS CFO and VP Corporate Services
Target Date: December 2019

Management Action

A contracting checklist for goods and services acquired will be developed. The checklist will clearly outline completeness requirements and accountability. The checklist will be distributed to all CFMWS Division Heads and to Commanding Officers for distribution to Contracting Authorities, and compliance with instructions issued will be monitored.

OPI: CFMWS VP Corporate Services
Target Date: December 2019

Risk Management

Management Action

The CFMWS Procurement and Contracts Officer will initiate engagement with CFLA. CFLA will be invited to attend the NPP Contracting Committee meetings annually and to conduct Procurement and Contracting training for CFMWS employees. The CFMWS Procurement and Contracting Officer in consultation with the NPP Contracting Committee will develop guidance as to when legal services should be sought in order to mitigate risks. A formal delivery framework with clear performance metrics will be established between CFLA and CFMWS.

OPI: CFMWS VP Corporate Services
Target Date: June 2019

Management Action

Finance Division staff will be reminded of the requirement to enforce monitoring mechanisms identified in the CDS Delegation of Authorities for Financial Administration of NPP by formal correspondence (letter). In addition, a Compliance Review will be completed following the issuance of revised NPP Contracting Policies and Guidelines.

All contract ratifications will be staffed through the NPP Procurement and Contracting Officer for visibility and furtherance to Vice President Corporate Services for final approval. Communication will be forwarded to Division Heads and Commanding Officers for distribution on updates/changes to NPP Contracting Policy and guidelines by December 2019 and will identify recurring non-compliance with the PCAF.

The NPP Procurement and Contracting Officer will begin establishing a training framework to be delivered to all Bases/Wings as well as CFMWS HQ.

OPI: CFMWS VP Corporate Services
Target Date: June 2019

Back to Table of Contents

Annex B—Audit Criteria

Governance / Accountability

The procurement and contracting accountability framework is appropriate, complete and effective.

1. Management has designed a procurement and contracting accountability framework that is open, fair and transparent.
2. NPP provides employees with the necessary training, tools, resources and information to support the discharge of their responsibilities.
3. Corporate values and ethics, code of conduct or equivalent policy have been communicated clearly, and employees acknowledge compliance with the policy requirements.

Risk Management

NPP organizations manage procurement and contracting risks appropriately throughout the lifecycle.

1. Processes to identify, assess and mitigate procurement and contracting risks are in place and operating effectively.
2. Procurement and contracting practices are regularly monitored to provide management with reliable information in order to manage risks.

Internal Controls

NPP contracts are compliant with the NPP procurement and contracting accountability framework.

1. NPP contracts are awarded and administered in compliance with the NPP procurement and contracting framework throughout the lifecycle.
2. Transactions are coded and recorded accurately and in a timely manner to support accurate and timely information processing.
3. Records and information are maintained in accordance with the procurement and contracting accountability framework.
4. There is appropriate segregation of duties.
5. Management monitors control effectiveness on a periodic basis.

Sources of Criteria

Government of Canada Management Accountability Framework Core Controls.