Targeted Audit of Selected L2 Business Practices

Back to Table of Contents

Statement of Conformance

The audit findings and conclusions contained in this report are based on sufficient and appropriate evidence gathered in accordance with procedures that meet the Institute of Internal Auditors’ International Standards for the Professional Practice of Internal Auditing. The audit thus conforms to the Internal Auditing Standards for the Government of Canada as supported by the results of the quality assurance and improvement program. The opinions expressed in this report are based on conditions as they existed at the time of the audit and apply only to the entity examined.

Back to Table of Contents

Background

• Outreach activities enable Canadians to interact directly with Canadian Armed Forces (CAF) members. These events can support effective Public Relations (PR) by helping to foster a better understanding of military roles or missions, a positive image of the CAF, and a continued legacy of CAF engagement with the Canadian public.
• Within DND/CAF, several groups conduct activities that support PR and outreach activities:

• Since 2005, the PR Operations (PR Ops) Program has managed numerous PR functions and events in support of the CAF.
• At the time of the audit, the Program resided within the Chief of the Defence Staff Office (CDSO), and was comprised of four full-time employees with an annual operating budget of approximately $400,000.
• In May 2019, following the completion of audit conduct, the PR Ops Program was moved from the CDSO to Strategic Joint Staff (SJS).
• SJS Director General Operations (DGO) will be accountable for the PR Ops Program going forward, and is responsible for developing and implementing the applicable Management Action Plans to address the audit recommendations, as summarized in Annex A.
• PR Ops has three key lines of business. The nature of each line of business activity differs, and participants and locations are varied. Some events, such as CAF Appreciation events happen more frequently, (e.g., 28 events were held in FY 17/18), while other events, such as Team Canada Visits occur less frequently (e.g., two events were held in FY 17/18).

Back to Table of Contents

Objective, Criteria, Methodology and Scope

Rationale for Engagement: In October 2018, the Offices of the Chief of the Defence Staff (CDS) and the Vice Chief of the Defence Staff (VCDS) jointly requested that Assistant Deputy Minister (Review Services) (ADM(RS)) perform an engagement to provide assurance on PR Ops business practices by reviewing the following: business practices currently in place; practices meet the needs of the PR Ops Team; practices conform to DND/CAF and Government of Canada regulations, and meet external expectations.

Table 1. Objective, Criteria, Methodology and Scope.

Objective To provide assurance that the governance mechanisms and business practices currently in place within the CDS PR Ops Team are adequate, and to identify opportunities for improvement.	Criteria Governance structures, training and mechanisms are in place to provide effective oversight, and to support event planning and implementation of PR Ops events. Risks to the achievement of program objectives have been identified, mitigated, monitored and reported in accordance with departmental policies and guidelines. Controls are in place to support the accurate, timely, valid and consistent processing of PR Ops Program events, in accordance with mandatory requirements.
	Methodology Identify relevant business practices, governance and control mechanisms in place, assess adequacy and conformance with DND/CAF and Government of Canada regulations. For Fiscal Year (FY) 2017/18 to FY 2018/19, analyze a sample of event authorization documentation. Two Team Canada Visits and six CAF Appreciation events were randomly selected for analysis. Interview key stakeholders and consult subject matter experts. Obtain and review historical investigation reports to be used for context. Reviewed Defence Resource Management Information System information to validate event costing.
	Scope All business practices, including governance mechanisms, for PR Ops events and activities, from FY 2017/18 to FY 2018/19.

Table 1. Objective, Criteria, Methodology and Scope. This table outlines the objective, criteria, methodology and scope of this audit.

Back to Table of Contents

PR Ops Program Stakeholders

Table 2. PR Ops Program Stakeholders.

Stakeholder	Role
PR Ops	CAF Office of Primary Interest (OPI) for all CAF Appreciation and other public recognition events - the Chief of Protocol determines the level of CAF participation in and support to proposed events, on behalf of CDS.Footnote 1  Delegated authority by CDS to plan, coordinate and execute these events, often in collaboration with SJS. Collaborate with SJS and event stakeholders on Team Canada visits on behalf of CDS. Fund specific costs to support these events, such as participant travel costs to and from Ottawa.
CDSO	Home of PR Ops Program during audit scope (2016 - May 2019).
VCDSO	Provides independent oversight of CDSO administrative functions, including PR Ops.
SJS	Current home of PR Ops Program (May 2019 – Present). Previously housed PR Ops Program; managed activities (2012-2016). Provide PR Ops with operational support to Team Canada events.
ADM(PA)	Functional authority for DND and CAF public affairs. Original home of PR Ops Program; managed activities (2005-2012).
Environments	Lead for certain CAF Appreciation events, galas and public events.

Table 2. PR Ops Program Stakeholders. This table outlines the various stakeholders and their roles.

Back to Table of Contents

Summary of Findings

The PR Ops Program was tested against the most recent policies, guidance and standards to provide assurance that the governance mechanisms and business practices currently in place within the PR Ops Team are adequate, and to identify opportunities for improvement.

Table 3. Summary of Findings.

PR Ops Program - ◐	1. Governance While program-level directives and mandatory guidance are in place, they require review and updating to ensure that accountabilities, responsibilities and authorities (ARA) are clear, accurate and compliant with DND and Government of Canada requirements. At the time of the audit, senior management within the VCDSO and CDSO had awareness of the PR Ops Program. While required training is not always taken, training occurs on-the-job. There is no reference manual to guide military or civilian PR Ops staff. As well, there is no mechanism for knowledge transfer to support longer-term requirements of the program and ensure the effectiveness of the PR Ops Program.
PR Ops Program - ○ Team Canada - ○ CAF Appr. - ○ Galas – n/a	2. Risk Management Risks are not identified, mitigated or managed to ensure that the PR Ops Program delivers on its objectives. Risk management information is not reported to senior management to support informed decision making.
PR Ops Program - ◐ Team Canada - ○ CAF Appr. - ◐ Galas - ●	3. Controls Informal processes, administrative tools and mechanisms to support the planning, coordination and documentation of events exist for some lines of business. Formal controls are required to ensure events are conducted in compliance with all applicable DND/CAF and Government of Canada requirements.
Processes generally in place and operating effectively / ◐ Some deficiencies or areas for improvement / ○ Processes to be developed or implemented

Table 3. Summary of Findings. This table outlines the processes currently in place and whether or not the are operating effectively.

Back to Table of Contents

Governance

Expectation:

Governance structures, training and mechanisms are in place to provide effective oversight and to support event planning and implementation of PR Ops events.

Context:

• PR Ops team must adhere to Government of Canada, DND and program-level policies and guidance, such as:
  • Travel, Hospitality, Conference and Event Expenditures (THCEE);
  • Environmental tasking orders and Defence Administrative Orders and Directives;
  • Contracting policy and regulations.
• Oversight of the program is performed by VCDSO.

Findings:

ARAs require updating and clarification.

• Both the Directive on CAF Public Outreach (2018) and CDS Directive for Support to Team Canada Visits (2013) identify SJS as responsible for PR Ops. From 2016 to Summer 2019, this responsibility rested with the PR Ops staff within the CDSO. It has since been transferred back to SJS in 2019.
• The Amendment – CDS Directive for Support to CAF Appreciation and Other Public Recognition Events Honouring Canadian Armed Forces Members (2016) identifies the PR Ops Chief of Protocol and staff as the authority to approve costs associated with CAF Appreciation and other public recognition events. This directive needs to be revised to ensure alignment with Treasury Board (TB) and DND requirements.

PR Ops events are not clearly defined as an event or operational activity in departmental guidance.

• As per TB policy, events are gatherings of public servants and non-public servants, in activities other than the operational activities of the Department (see Annex C).
• Current departmental guidance related to events is, in some instances, subject to interpretation. For example, it does not explicitly define PR Ops activities, such as Team Canada Visits, as events.
• Should an activity be defined as an event it is subject to higher authorities and approvals than an activity that is defined as operational.
  • DND’s Delegation of Authority matrix (Refer to Annex B) and other mandatory guidance show that higher-level financial authority is required for some program expenditures. For example, Deputy Minister (DM) approval is required for all events over $25,000; Minister approval is required for events over $50,000.

Risks:

Without well-defined roles and responsibilities, clear definition of which activities are considered events, and up-to-date guidance, there is a risk that PR Ops events may not be conducted in compliance with applicable Government of Canada and Departmental guidance, including the appropriate exercise of delegated authorities.

Recommendations:

1. To support the effective implementation of PR Ops events, ADM(RS) recommends relevant program directives be reviewed and updated in accordance with DND/CAF and Government of Canada requirements to ensure that ARAs are clear and accurate.
OPI: Director of Staff (DOS) of SJS

2. To support the effective implementation of PR Ops events, ADM(RS) recommends relevant financial directives and guidance be updated to clearly define and distinguish between operational activities and events for the PR Ops lines of business.
OPI: ADM(FIN)/CFO

Back to Table of Contents

Governance – Training

Expectation:

Formal training and reference materials are in place to support knowledge transfer and an effective PR Ops Program.

Context:

• PR Ops Program operates in a specialized area; some staff are subject to the military posting cycle.

Findings:

Much program corporate knowledge currently resides with a single full-time civilian employee.

Training is required to support staff.

• As per interviews, relevant training would be helpful to support them in fulfilling their program-related responsibilities.

Risks:

• Departure of the civilian employee would result in significant loss of corporate knowledge.
• Lack of guidance and training to ensure knowledge transfer could jeopardize the continuity of the program.

Recommendation:

3. To ensure PR Ops staff have the knowledge and skills needed to perform their jobs effectively, ADM(RS) recommends relevant training be identified and guidance provided.
OPI: DOS SJS

Back to Table of Contents

Risk Management

Expectation:

Risks to the achievement of program objectives have been identified, mitigated, monitored and reported in accordance with departmental policies and guidelines.

Context:

• The PR Ops Program currently has a staff of four and an annual operating budget of approximately $400,000 with which to achieve its objectives.
• PR Ops events are varied, occur at different frequencies and have different inherent risks.
• PR Ops events are designed to be highly visible and subject to public scrutiny.
• There is a high level of trust placed on the PR Ops team, based on previous event coordination and implementation.

Findings:

No evidence of risk management conducted for the program, lines of business or individual events.

• Interviews revealed that risks are not formally discussed or documented when planning events. For example, when event authorization is sought, documentation does not include risk information such as possible risks of public scrutiny, and potential conflict of interest.

Monitoring and reporting activities observed are informal and occurring on an ad hoc basis.

• At the time of the audit, senior management within the VCDSO and CDSO had awareness of the PR Ops Program.
• No formal structure is in place for the monitoring and reporting of program risks to the DM and CDS.

Risks:

• Despite the small size and budget of the PR Ops Program, the purpose of PR events is to generate high visibility and as such, are subject to greater public scrutiny, resulting in potential reputational risk to DND/CAF.
• Without proactive risk management or reporting, information for decision making may be limited and increases the risk that possible issues or concerns could go unreported or undetected.
• Opportunities for continuous improvement of the efficiency and effectiveness of the program may be missed.

Recommendation:

4. To support decision making and ensure that senior management is aware of risks that may prevent the program from meeting its objectives, ADM(RS) recommends incorporating risk management practices into policies and procedures. This should include:

• Identification of overall PR Ops Program risks, including mitigation strategies, to address identified issues;
• Inclusion of risks and mitigation strategies in briefing/approval materials for all events conducted under the program. These risks should include:
  • Project risks (e.g., budget, schedule, scope);
  • Reputational risks (e.g., conflict of interest); and
  • Volunteer risks (e.g., bodily injury).
• Monitoring and reporting of risks on a regular basis, which are communicated to senior management, including the DM and CDS, as part of the event approval process.

OPI: DOS SJS

Back to Table of Contents

Controls

Expectation:

Controls are in place to support the accurate, timely, valid and consistent processing of PR Ops Program events, in accordance with mandatory requirements.

Context:

• There is a focus on obtaining results in a fast-paced environment, in accordance with mandatory requirements, including DND/CAF directives and the Code of Ethics, the Financial Administration Act, National Joint Council Directive, and the TB Guide to THCEE.
• The role of the PR Ops Program (See Annex D) varies according to the line of business:
  • CAF Appreciation – coordinates between the event organizer (e.g., the professional sports team) and the tasked environment, and advises on protocol;
  • Team Canada – authorizes expenses and manages attendees’ flight and accommodation bookings, along with expense travel claims; and
  • Galas and Public Events – advises on protocol and seeks advice regarding possible conflicts of interest pertaining to CAF attendees.

Note that the findings in this section relate to the PR Ops Program roles only, as associated with said events.

Findings:

CDSO finance clerks use a variety of general financial and budgeting procedures and tools.

• Monthly budgets and quarterly reports to COS CDS are created.
• Event costing information is not always comprehensive and complete.

PR Ops staff continually recreate operating procedures for each subsequent event.

• While some common SOPs, checklists, procedural guidelines and file structures are in place, clear guidance is required in certain areas, such as:
  • Instructions to support consistent event planning and coordination, including financial estimation and tracking; and
  • While hospitality approval forms require the disclosure if alcohol is purchased with public funds - as these requests are subject to higher level approval - the forms do not require a separate disclosure as to whether or not alcohol will be available during the event.
    • This disclosure is now required by the Financial Administration Manual (FAM), chapter 1017-1, section 5.5, as of July 2019.

PR Ops documentation retention practices are inconsistent and insufficient.

Areas notably lacking include:

• Financial event documentation was not consistently used to support budgeting and obtain required financial authorizations and commitments;
• Signed Letters of Agreement which outline expectations for all Team Canada participants, as required by CDS Directive for Support to Team Canada Visits (2013);
• Approved travel authorization forms; and
• Written approval for military members to attend CAF Appreciation events as required by Defence Administrative Order and Directive 7021-3.

Risks:

• Without full disclosure of event costs, including the source(s) of funding, there is a risk that PR Ops activities may not be correctly defined (e.g., event or operational activity) and that appropriate approval authorities may not be obtained.
• As PR Ops staff continually recreate operating procedures due to the lack of SOPs, there is a risk that events may be processed inconsistently and inefficiently.
• Without formal administrative controls such as SOPs and guidelines, events may not be planned and executed in accordance with mandatory requirements, including obtaining appropriate expenditure authorities.
• Without complete, reliable and relevant documentation, DND/CAF is unable to demonstrate sound stewardship of funds or demonstrate its accountability as to how decisions were made.

Recommendation:

5. To ensure the proper exercise of authorities and accountabilities of program events, in accordance with mandatory requirements, ADM(RS) recommends revising and implementing SOPs that will support accountability. Specifically:

• Procedures to budget, plan and coordinate events, with sufficient details, including event itineraries;
• Checklists to confirm that event files contain all relevant and required documents, including risks and mitigation strategies, as well as financial information to justify expenditure authorities and commitments; and
• Lessons learned (after action reports) to inform senior management and improve future PR Ops events.

OPI: DOS SJS

Back to Table of Contents

Conclusion

The PR Ops Program performs a number of PR functions, on behalf of CDS, to boost morale of CAF members. Given the significance of these events, as well as the increased public scrutiny they attract, the governance mechanisms and business practices supporting this program need strengthening to ensure program objectives are met, and events are conducted in compliance with all applicable departmental and Government of Canada requirements.

While some governance structures and mechanisms are in place, ARAs require clarification, and program-level directives and guidance need updating. While required training is not always taken, training occurs on-the-job. The development of reference materials will provide PR Ops staff with the necessary skills, knowledge and understanding to perform their duties, and will ensure knowledge transfer to support the longer-term requirements of the PR Ops Program, and ensure its effectiveness.

Within the PR Ops Program, risks are not identified and documented, or formally reported to senior management. Inclusion of risks and mitigation strategies in briefing and approval materials for all events is required to support the program and its operational delivery. Monitoring and reporting of risks, including to the DM and CDS, should be implemented as part of the event approval process to improve oversight of the PR Ops Program.

Control testing found that informal processes, administrative tools and mechanisms to support the budgeting, planning and coordination, and documentation of events exist for some lines of business. SOPs are required to ensure events are conducted in compliance with all applicable departmental and Government of Canada requirements.

Back to Table of Contents

Annex A – Management Action Plan

ADM(RS) uses recommendation significance criteria as follows:

• Very High—Controls are not in place. Important issues have been identified and will have a significant negative impact on operations.
• High—Controls are inadequate. Important issues are identified that could negatively impact the achievement of program/operational objectives.
• Moderate—Controls are in place but are not being sufficiently complied with. Issues are identified that could negatively impact the efficiency and effectiveness of operations.
• Low—Controls are in place but the level of compliance varies.
• Very Low—Controls are in place with no level of variance.

1. Governance (High)

Recommendation:

To support the effective implementation of PR Ops events, ADM(RS) recommends relevant program directives be reviewed and updated in accordance with DND/CAF and Government of Canada requirements to ensure that ARAs are clear and accurate.

Management Action

1. SJS will work with DND Corporate Secretary to seek guidance on establishing proper ARAs for the PR Ops program and lines of business.
2. SJS will work with DND Corporate Secretary to analyze which governance committee SJS could report to on PR Ops matters.
3. SJS will ensure the Directive on CAF Public Outreach (2018) and the CDS Directive for support to CAF Appreciation and Other Public Recognition Events Honouring Canadian Armed Forces Members (2016) will be amended to reflect the responsibilities of PR Ops and its transfer from CDSO to SJS.
4. SJS PR Ops will update financial procedures to be in accordance with SJS financial directives and practices.

OPI: DOS SJS/DGO
Target Date: April 1, 2020 (There is no target date on item 3 and subject to other stakeholders timelines)

2. Governance (High)

Recommendation:

To support the effective implementation of PR Ops events, ADM(RS) recommends relevant financial directives and guidance be updated to clearly define and distinguish between operational activities and events for the PR Ops lines of business.

OPI: ADM(FIN)/CFO

Planned Action:

ADM(Fin)/CFO agrees with ADM(RS)’s recommendation.

ADM(Fin)/CFO is in the process of updating its Financial Administration Manual (FAM) Policy on Conference and Event Expenditures in alignment with the recently issued TB Directive on THCEE and as part of the Department’s Financial Management Policy Renewal.

Milestone (FY 2020/21):

As part of the update of this FAM, ADM(Fin)/CFO will engage with various key DND/CAF stakeholders to clearly define and distinguish between operational activities and events for PR Ops lines of business in alignment with the TB Directive and Guide on THCEE. All changes will be documented and communicated by October 31, 2020.

Target Date: October 31, 2020

3. Governance (High)

Recommendation:

To ensure PR Ops staff have the knowledge and skills needed to perform their jobs effectively, ADM(RS) recommends relevant training be identified and guidance provided.

Management Action

Understanding no specific military training exists within DND/CAF for the skillsets required for public relations or the organisation of events:

1. PR Ops will create terms of reference for each individual position of PR Ops which will facilitate personnel transfers and interoperability.
2. PR Ops will create an “On the Job Training” package for each individual position based on their primary responsibility. Given the small size of the team, the training package will also address interoperability.

OPI: DOS SJS/DGO
Target Date: June 1, 2020

4. Risk Management (Very High)

Recommendation:

To support decision making and ensure that senior management is aware of risks that may prevent the program from meeting its objectives, ADM(RS) recommends incorporating risk management practices into policies and procedures. This should include:

• Identification of overall PR Ops Program risks, including mitigation strategies, to address identified issues;
• Inclusion of risks and mitigation strategies in briefing/approval materials for all events conducted under the program. These risks should include:
  • Project risks (e.g., budget, schedule, scope);
  • Reputational risks (e.g., conflict of interest);
  • Volunteer risks (e.g., bodily injury); and
• Monitoring and reporting of risks on a regular basis, which are communicated to senior management, including the DM and CDS, as part of the event approval process.

Management Action

1. PR Ops will develop directives on program and project risks and will include risks and mitigation strategies in the PR Ops Event planning process
2. SJS will monitor risks on a regular basis and SJS will communicate those risks to senior management as part of the approval process or when deemed necessary

OPI: DOS SJS/DGO
Target Date: December 1, 2020

5. Controls (High)

Recommendation:

To ensure the proper exercise of authorities and accountabilities of program events, in accordance with mandatory requirements, ADM(RS) recommends revising and implementing SOPs that will support accountability. Specifically:

• Procedures to budget, plan and coordinate events, with sufficient details, including event itineraries;
• Checklists to confirm that event files contain all relevant and required documents, including risks and mitigation strategies, as well as financial information to justify expenditure authorities and commitments; and
• Lessons learned (after action reports) to inform senior management and improve future PR Ops events.

Management Action

1. PR Ops will develop an event planning process which will be based on lessons learned and will ensure that procedures are followed in terms of budgeting, risk management, coordination and contingency planning. Checklists will be established in order to ensure proper documentation is captured for each event.
2. Checklists will also be established for the execution phase referencing the event plan and contingencies.
3. A PR Ops lessons learned program will be established to capture the lessons learned for each event and to establish trends in order to develop mitigation strategies and adapt the planning process accordingly.

OPI: DOS SJS/DGO
Target Date: December 1, 2020

Back to Table of Contents

Annex B – DND Authority Matrix

Table B-1. DND/CAF Travel, Hospitality, Conference and Event Expenditures Approval levels.

APPROVING AUTHORITY	Minister	Deputy Minister	Chief of the Defence Staff, Associate DM, Ombudsman, Level 1 Advisor	Level 2 Advisor (Mil) with Authority of Commander of Command	Other Level 2 Advisor (Mil & Civ)	Director, Base Commander & Equivalent	Other Responsibility Centre Manager
EVENT APPROVAL	Over $50,000	$50,000	$25,000	$25,000	$25,000	$25,000	$10,000
HOSPITALITY APPROVAL	Over $50,000	$50,000	$3,000	$3,000	$2,000	$1,000	$1,000
HOSPITALITY/ EVENT with ALCOHOL	Required if DM attends	Required	X	X	X	X	X

Table B-1. DND/CAF Travel, Hospitality, Conference and Event Expenditures Approval levels.^{Footnote 2} 

Back to Table of Contents

Annex C – Definitions

Definitions

• TB and the Department defines events as gatherings of individuals (public or non-public servants) engaged in activities other than operational activities of the department. For PR Ops, this may include awards, recognition ceremonies, departmental ceremonies or outreach activities.^{Footnote 3}  Operational activities are not considered events.^{Footnote 4} ,^{Footnote 5} 
• Operational activities are directly undertaken to deliver departmental programs and services and are not considered events.^{Footnote 6}  This may include military exercises; internal services to support program delivery, such as internal audit; meetings to plan or coordinate military operations; or governance activities essential to departmental oversight, such as Departmental Audit Committee meetings.

Event Approval Considerations

• TB mandates four principles to guide the planning, approval, recording and reporting of THCEE: public scrutiny, value for money, accountability and transparency.^{Footnote 7} 
• Event OPIs must obtain a single event approval that discloses total departmental costs - all incremental costs included, plus other relevant costs disclosed.^{Footnote 8} 
• Avoid “event splitting” - seek single event approval when there is reasonable doubt.
• An event participant is not allowed to self-approve.^{Footnote 9} 
• Provision of alcohol and entertainment is restricted, and requires DM approval.
• Consult with Assistant Deputy Minister (Finance) staff for clarification of specific requirements.

Back to Table of Contents

Annex D – PR Ops Event Roles

Table D-1. PR Ops Event Roles.

	CAF Appreciation	Team Canada	Galas and Other Public Events
PR Ops Team	Coordinates event proceedings and CAF participation between event hosts and tasked environment.	Responsible for event authorization and administrative details, including the planning and coordinating of volunteer hospitality and travel.	Provide protocol advice pertaining to CAF attendees.
SJS		Responsible for operational activities while in theatre.
ADM(PA)	Original home to program, no longer consulted on events. ADM(PA) guidelines are still referenced.	Original home to program, no longer consulted on events. ADM(PA) guidelines are still referenced.	Original home to program, no longer consulted on events. ADM(PA) guidelines are still referenced.
Environments	Responsible for taskings, including the distribution of tickets to CAF members.

Table D-1. PR Ops Event Roles. This table outlines the roles each stakeholder has for various PR events.

Back to Table of Contents