ESDC Department Audit Committee 2015 – 2016 Annual report

Alternate formats

Message from the independent Committee members

The Departmental Audit Committee (DAC) is pleased to present the fiscal-year (FY) 2015-2016 Annual Report to the Deputy Minister (DM). This eighth consecutive report for Employment and Social Development Canada (ESDC) highlights the continued success of the DAC due in large part to the commitment, and attentiveness of the DM and of senior management. The DM sets the tone for how management responds to and supports the DAC. As a member of the Committee, and an ardent supporter and listener, the Deputy has engendered an environment where the DAC can operate effectively and efficiently. The independent Committee members appreciate this support.

Our role is to provide constructive advice and guidance to the DM and senior management. This past year the DAC focused on audit entities as described in the 2015-17 Risk Based Internal Audit Plan (RBAP) tied to the three areas of focus: Financial stewardship and compliance with the Financial Administration Act (FAA); Safeguarding and protection of information, assets, and people; and Maintaining program and service delivery commitments. In addition, the themes of Information Management (IM) / Information Technology (IT), risk management, corporate coherence, Human Resources (HR) capacity, and the Policy on Internal Control (PIC) continue to be areas of interest for the DAC in FY 15-16.

Critical to the role of the DAC is ensuring there is appropriate coverage of the FAA compliance through the audits; consideration was given to this throughout the year. The annual Technical Briefing to review and make recommendations on the financial statements and related Office of the Auditor General (OAG) financial audits took place in August, 2015.

For the third year in a row the OAG has had a presence at DAC meetings providing a venue for discussions on their strategic multi-year audit plan which outlines potential future ESDC audits. Management has had in-depth discussions with the OAG on their audit findings and has accepted all 37 recommendations presented at DAC meetings this past FY. The OAG brings differing perspectives than that of Internal Audit (IA) which is healthy in providing additional observations on risk. We look forward to continued collaboration with the OAG and achieving a better understanding of their priorities to enable the DAC to focus its approach and assessment of OAG insights into the future.

We are thankful for the collaborative relationship and are appreciative of the support received from the Chief Audit Executive (CAE) and his team. Once again we have found the CAE and his staff to be professional and responsive and their work of critical importance to the committee. We look forward to the year ahead and to addressing the challenges to come with the same rigour and collaboration as in past years.

Finally, we would like to thank the outgoing DAC Chair, Mr Rod Monette, for his commitment and service to the DAC over the last four years. Rod has brought invaluable insights to the table thanks to his extensive experience in both the private and public sector. Rod’s leadership, thoughtful contributions and character will be missed by all. We wish him the best of luck in his future endeavours and adventures!

Issues and observations

Our Annual Report provides an opportunity for an overview of DAC activities, advice, and recommendations provided to the DM and CAE each FY. Monitoring and challenging the Department, positions the DAC to provide invaluable and comprehensive advice to the DM. We believe our recommendations and engagement continue to have a positive impact on the Department.

IA did significant work this past year related to IT Security, Security Management, Privacy Management, Enterprise Risk Management, Integrated Planning and Performance Measurement, Financial Management, among other areas. The IA function continues to identify opportunities for efficiencies and risk mitigation.

For FY 15/16, all IA findings and recommendations were accepted by senior management. We believe that management’s receptivity to IA observations and their commitment to address and respond to findings and recommendations reflects the collaborative relationship the IA function has with its clients and the confidence that management has in the audit function. Additionally, the DAC plays an active and critical assessment role through an annual review of management’s progress in implementing their action plans developed in response to audit recommendations.

Themes for 2015-2016

Reflecting on the activities and operations of the committee throughout FY 15/16, the following themes emerged whereby the DAC provided advice and recommendations to senior departmental officials and the DM.

Assessment of the internal audit function

As outlined in the CAE 2015-16 Annual Report; IA met all its obligations under the Treasury Board Policy on Internal Audit, and remained compliant with the Internal Auditing Standards for the Government of Canada and International Standards for the Professional Practice of Internal Auditing, as validated by the external practice inspection of the ESDC internal audit function, which took place between November and December 2015. The results were presented to the DAC on March 1, 2016.

IA completed a variety of assurance and advisory engagements over the past FY which provided senior management with sound advice and guidance on the effectiveness and efficiency of their overall operations.

The CAE and the IASB senior management team continue to demonstrate their commitment to ensure appropriate resources are available through recruitment, retention, and succession planning. This has had a direct correlation on the volume and quality of work being produced.

From our unique external vantage point in reviewing the 2015-2016 audit projects, we were able to provide recommendations and advice of value to senior management. The regular updates of the RBAP and the IA status reports allow the DAC to remain apprised of the status of audit projects and of changes in the departmental risk environment.

We continue to view the IA function as highly successful and of great value to ESDC and appreciate the high-degree of professionalism of the CAE and his staff.

Follow-up on Management Action Plans

The CAE tabled the results of the annual Management Action Plan (MAP) follow-up exercise to the Committee for discussion and information at the March 2016 meeting. This provided an opportunity for the committee to receive valuable and critical information pertaining to the Department’s progress in implementing its action plans and the risks of exposure of outstanding action plans.

The DAC was informed that the majority of outstanding MAPs experienced significant implementation delays. While many of these delays can be attributed to significant system enhancements or transformational initiatives, we nonetheless are concerned that MAP implementations may not be getting the attention they require. As a result, we suggested that updates be provided to senior level committees on a regular basis, particularly for those planned actions experiencing significant delays. It is worth noting that the Department has received several IT-related recommendations which are dependent on the infrastructure support provided by Shared Services Canada. This can create challenges for ESDC as the Department is often reliant on activities outside of its direct control. We look forward to the results of the additional analysis and management engagement efforts IA plans to undertake in FY 16-17 to continually strengthen its approach to MAP follow-up.

Values and ethics

Since the launch of the ESDC Code of Conduct (the Code) in April 2012 the Department has focused on employee awareness initiatives including employee training. At our March 2016 meeting, the Code’s effectiveness was demonstrated in the results of the Public Service Employee Survey which indicated that not only are employees reporting more code breaches but that the overall instances of breaches are low and continue to decrease (from a total of 120 in FY 2013-14 to 71 in FY 2014-15). This demonstrates increased and ongoing confidence in the system.

External assurance providers

Regular status briefings as well as engagement results were provided to the DAC in order to facilitate our ability to monitor and make inquiries into external audit activity of the various external assurance providers throughout 2015-16.

Due to the size and complex nature of ESDC, the Department’s input is often considered for inclusion in external audit engagements. From our unique position as an external advisory body to the DM we will continue to offer our scrutiny and insights related to external assurance provider engagements.

Financial statements and public accounts reporting

Following our request outlined in the 2014-15 DAC Annual Report, the CFO has utilised DAC meetings as an opportunity to advise on notable seasonal and cyclical patterns and to highlight significant material difference from one quarter to the next.

The annual Technical Briefing was held in August 2015 and proved once again to be a positive opportunity to review in detail the following financial statements (F/S):

• 2014-2015 Unaudited Departmental Consolidated F/S;
• 2014-2015 Employment Insurance (EI) Operating Account F/S;
• 2014-2015 Canada Pension Plan (CPP) Account F/S;
• 2014-2015 General Annuities Account (GAA) F/S; and,
• 2014-2015 ESDC Public Accounts.

During the Technical Briefing, the DAC received a comprehensive overview of the unaudited 2014-15 Departmental Consolidated Financial Statements prepared by CFOB.

The OAG tabled their annual financial audit results of the EI Operating Account, the CPP Account, the GAA, and the ESDC portion of the Public Accounts of Canada for the year ending March 31, 2015. Although Management Letters issued by the OAG at the conclusion of their annual 2014-15 financial audits recommended some internal control enhancements, once again no significant audit or accounting matters were identified.

Accountability reporting

We reviewed and received briefs on several key departmental reports throughout 2015-16 including:

• Reports on Plans and Priorities 2016-2017;
• Departmental Performance Report 2014-2015;
• 2014-15 Management Accountability Framework assessment results; and
• 2015-16 to 2018-19 Departmental Evaluation Plan

We noted a continuing improvement in the reports and we feel that this is a direct result of the Department’s commitment to improving the clarity and usefulness of its reporting.

Moving forward

For 2016-2017, as part of our annual report process, our areas of ongoing interest are outlined below and align with those identified by IA in the 2016-18 RBAP. We feel that these key areas will be of utmost importance not only to the DAC but to the Department.

• Demonstrated strong project management oversight and achievement of expected results for key departmental IM/IT transformational initiatives;
• Ongoing departmental focus in securing and protecting information, assets and people; and
• Continued management efforts towards robust HR planning resulting in the required capacity complement and skill-sets to successfully achieve departmental priorities while maintaining ongoing program delivery commitments.

Conclusion

The DAC is confident it has met its mandated responsibilities in addition to having provided advice to the DM and the DM’s management team on a number of issues. In this respect, the 2015-2016 year has been success.

In the upcoming year the DAC will focus on the areas of risk identified in the 2016-18 RBAP and will continue to ensure the FAA, which has been and will remain as one of our “bread and butter” responsibilities, receives ample visibility and is allotted sufficient time for discussion and deliberation.

We appreciate the fulsome support of the DM, the DM’s management team, the CAE, and the internal audit team and look forward to continuing the excellent and professional relationships we have forged.

Annex A - Departmental Audit Committee composition, operations, and biographies

Annex B: Departmental Audit Committee operations per key area of responsibility

The following table depicts the various Departmental Audit Committee (DAC) agenda items and presentations to their corresponding area(s) of responsibility. As the DAC’s areas of responsibility are not independent, linkages between these areas must be achieved in order to for the committee to succeed in its advisory role. Due to these linkages, certain agenda items will be reported under more than one area of responsibility.