Audit of employee offboarding

On this page

• 1. Background
  • 1.1 Context
  • 1.2 Audit Objective
  • 1.3 Scope
  • 1.4 Methodology
• 2. Audit Findings
  • 2.1 Communication and instructions for managers, enabling and support functions should be strengthened to be clear, concise, timely, and role-specific
  • 2.2 The Departures module supports the revocation of system access and return of IT assets. However, delays occurred in both revoking access and returning assets
  • 2.3 Software and information access for departing employees and those changing roles within ESDC needs improvement
  • 2.4 Processes to revoke physical access are decentralized across all regions and the security briefing process needs to be strengthened
  • 2.5 Oversight and monitoring of the employee offboarding process requires enhancement to support timely reporting on results
• 3. Conclusion
• 4. Statement of Assurance
• Appendix A: Audit Criteria Assessment

Alternate formats

Audit of employee offboarding [PDF - 592 KB]

Large print, braille, MP3 (audio), e-text and DAISY formats are available on demand by ordering online or calling 1 800 O-Canada (1-800-622-6232). If you use a teletypewriter (TTY), call 1-800-926-9105.

List of abbreviations

ADM

Assistant Deputy Minister

AMP

Access Management Portal

BMS

Branch Management Services

CFOB

Chief Financial Officer Branch

CIO

Chief Information Officer

ESDC

Employment and Social Development Canada

HRSB

Human Resources Services Branch

ISB

Integrity Services Branch

KPI

Key Performance Indicators

MAP

Management Action Plan

IT

Information Technology

IITB

Innovation Information and Technology Branch

RMS

Regional Management Services

1. Background

1.1 Context

The Treasury Board Secretariat Policy on Financial Management and the Directive on Security Management (June 2024) requires that the Department withdraw all access rights and departmental assets from departing employees, including physical access to facilities and digital access to systems and networks. The Employment and Social Development Canada (ESDC) Asset Management Policy mandates that all managers and employees are responsible for safeguarding assets and for the proper use of assets owned by the Department.

The ESDC employee offboarding process was significantly streamlined in July 2023 following the implementation of the Departures module in myEMS (PeopleSoft). The module provides a single and integrated point of entry for tasks of all involved enablers. It generates a checklist tasking managers and employees, and integrates notifications to key enabling functions, including Human Resources Services Branch (HRSB), Innovation Information and Technology Branch (IITB), Integrity Services Branch (ISB) and Chief Financial Officer Branch (CFOB) for responsibilities within their accountability. The Branch Management Services (BMS) and Regional Management Services (RMS) involvement in supporting managers within their Branches/Regions varies across the Department.

This audit provided an opportunity to assess the functioning and effectiveness of the offboarding process post-implementation of the Departures module and identify areas for improvement.

1.2 Audit Objective

The objective of this audit was to assess the adequacy and effectiveness of ESDC's employee offboarding process including whether: access controls for systems and facilities were in place, IT assets and government owned property were managed appropriately, and oversight, monitoring and reporting processes were established and functioning as intended.

1.3 Scope

The scope of this audit included all enabling functions (HRSB, IITB, ISB and CFOB) and other stakeholders (managers and BMS/RMS) involved in the offboarding process. It included the key elements of the Departures module since its implementation in July 2023 to November 2024.

The scope of this audit excluded the compensation process. Upon review of the associated controls, the residual risk for this element was deemed low. Furthermore, several audits have been conducted in this area in recent years. The scope also excluded acquisition cards, given several controls are in place that limit misuse of the acquisition card.

1.4 Methodology

The audit was conducted using several methodologies including:

• Documentation review and analysis;
• Interviews with management and staff from HRSB, ISB, IITB and CFOB, as well as departmental managers and support stakeholders (BMS/RMS);
• Questionnaires sent randomly to 200 managers from population of managers that completed a Departures request during our scope period, 48 responses were obtained (response rate 24%);
• Questionnaires sent to 43 support staff in the Branch Management Services / Regional Management Services, 25 responses were obtained (response rate 58%); and,
• Data mining and analytics. There were 6,900 departures (5,422 Departures module and 1,478 Access Management Portal (AMP) and 1,099 employee internal moves to other branches during the audit scope period.

2. Audit Findings

When used as intended, the Departures module streamlines the employee offboarding process, improves communication between enabling functions, and facilitates the prompt revocation of access to systems, software, and information, as well as the recovery of IT equipment for departing employees.

2.1 Communication and instructions for managers, enabling and support functions should be strengthened to be clear, concise, timely, and role-specific

While employee offboarding directives, guidelines and guidance exist, they are located across various sources (iService, regional sites and within the Departures module), causing confusion among stakeholders.

Most managers surveyed felt the Departures module has streamlined the offboarding process, however some indicated they did not have sufficient guidance, instructions and training to fully execute their responsibilities.

The BMS/RMS representatives surveyed felt that their support function roles are unclear, with half of respondents not performing any offboarding tasks. Comments provided by the respondents suggested reviewing roles and responsibilities to better distribute tasks between managers and BMS/RMS would be helpful.

2.2 The Departures module supports the revocation of system access and return of IT assets. However, delays occurred in both revoking access and returning assets

A ticket is automatically generated for IITB to request the recovery of IT equipment and to revoke access to systems the day after departure. However, the return of IT assets and the termination of system access was not consistently executed by IITB. Some tickets remained unresolved even after 60 days.

The IT Access Management portal provides employee-level information on assigned IT assets which is used by IT technicians when resolving tickets. However, this tool is not widely known to managers, who could use it to track IT assets during employee offboarding.

Before implementation of the Departures module, individuals without a myEMS (PeopleSoft) account were offboarded through the Access Management Portal (AMP). In November 2023, a control was implemented to prevent managers from offboarding any employee with a PeopleSoft account through AMP. Despite this control, 79 indeterminate employees with a PeopleSoft account were still offboarded using AMP from December 2023 to July 2024.

2.3 Software and information access for departing employees and those changing roles within ESDC needs improvement

The Application catalog manages software licenses and usage by computers/devices rather than by employee. Consequently, the audit team, in consultation with IITB analysts, was unable to verify whether software licenses had been properly managed for departing employees and employees changing roles within ESDC. Based on our analysis, access changes for software and information were identified for only a small number of employees who moved to another branch within ESDC.

Restricting access to information necessary for job responsibilities helps ensure the security and privacy of sensitive data by limiting it to those who need it for their specific roles.

2.4 Processes to revoke physical access are decentralized across all regions and the security briefing process needs to be strengthened

While managers are accountable to return photo ID/Access cards to ISB, there are no national procedures, guidance or set protocols for their recovery. Processes to promptly revoke physical access for former employees are decentralized across National Headquarters and all regions. There are no tickets generated from the Departures module to the ISB prompting action.

Additionally, managers noted that returning photo ID/Access cards is challenging for staff in different regions, as employees cannot provide them directly to their manager.

ISB has initiated a potential mitigation measure to implement a new Integrated Security System, which is anticipated to be complete by July 2028. This system is expected to provide a standardized, secure access control system across all regions.

While the Departures module requires managers to provide a mandatory security briefing for departing employees, managers expressed uncertainty about how to conduct the briefing session and how to complete the Security Screening Certificate Briefing forms.

2.5 Oversight and monitoring of the employee offboarding process requires enhancement to support timely reporting on results

A "Standardized Offboarding Report" was created by HRSB to help BMS/RMS monitor employee departures and was shared with BMS/RMS stakeholders on May 30, 2024. While the standardized offboarding report tracks departures by type, branch, and manager, it does not monitor task completion timeliness. Moreover, results from our BMS/RMS questionnaire indicated that many BMS/RMS staff were unaware of this report.

HRSB's Modernization Programme, Benefits Realization report was issued in May 2024 and covered Departures module results from July 2023 to March 2024. It assessed benefits, cost avoidance, and identified Key Performance Indicators (KPIs), including the recovery of IT assets within 10 days. While KPIs are defined, results are not being tracked or reported on. Data analytics conducted by the audit team showed that a significant number of tickets remaining unresolved for the recovery of IT assets after the 10 day KPI target.

3. Conclusion

Internal Audit recognizes the Department's substantial efforts in implementing the Departures module, establishing key controls and taking major steps to digitize the employee departure process which has enhanced the Department's ability to manage employee offboarding.

The audit concluded that communication and instructions for managers, enabling and support functions should be strengthened to be clear, concise, timely, and role-specific. While, the Departures module supports the revocation of system access and return of IT assets, delays occurred in both revoking access and returning assets. Software and information access for departing employees and those changing roles within ESDC needs improvement. Additionally, the decentralized process to revoke physical access and the security briefing process requires strengthening. Finally, oversight and monitoring of the employee offboarding process requires enhancement to support timely reporting on results.

4. Statement of Assurance

In our professional judgement, sufficient and appropriate audit procedures were performed and evidence gathered to support the accuracy of the conclusions reached and contained in this report. The conclusions were based on observations and analyses at the time of our audit. The conclusions are applicable only for the Audit of Employee Offboarding. The evidence was gathered in accordance with the Treasury Board Policy on Internal Audit and the International Standards for the Professional Practice of Internal Auditing.

Appendix A: Audit Criteria Assessment