Key compliance attributes of internal audit

Internal audit performance results as of December 31, 2023

Do the Department’s internal auditors have the training required to do the job effectively? Are multidisciplinary teams in place to address diverse risks?

Yes. The Department’s internal audit function staff have the knowledge, skills and other competencies required to fulfill their responsibilities. As of December 31, 2023:

• 49% of staff hold the Certified Internal Auditor (CIA) or Chartered Professional Accountant (CPA) professional designation
• 18% of staff are pursuing an internal audit or accounting designation (CIA, CPA)
• 41% of staff hold other professional designations:
  • 6 hold a Certified Government Auditing Professional (CGAP)
  • 4 hold a Certification in Risk Management Assurance (CRMA)
  • 3 hold a Certified Information Systems Auditor (CISA)
  • 3 hold a Certified Fraud Examiner (CFE)
• overall, 92% of staff hold a professional designation

These percentages are not cumulative as audit staff could be in any, all, or none of these categories. For the purposes of this report, the staff composition of the Department’s internal audit function includes 39 staff members. This staff includes:

• Senior management team (Chief Audit Executive and directors)
• Audit Operations (audit principals and auditors)
• Professional Practices
• Special Examinations
• Departmental Audit Committee (DAC), Liaison and management action plans monitoring
• Special Projects (Agile Audit)

Internal Audit favours the hiring of staff who have wide-ranging backgrounds. This brings to the function a diverse skill sets in addition to auditing or accounting. For example, the internal audit function includes:

• 34 auditors with varied master’s or bachelor’s degrees
• 2 auditors with advanced knowledge of data analytics
• 1 auditor with IT security-related professional designation

Is internal audit work performed in conformance with the international standards for the profession of internal audit as required by Treasury Board policy?

Yes. The internal audit work conforms to international standards for the profession. On December 1, 2022, the internal audit function provided a comprehensive briefing to the DAC on:

• the internal processes, tools and information considered necessary to evaluate conformance with the Institute of Internal Auditors’ Code of Ethics and Standards
• the results of the Quality Assurance and Improvement Program

In addition, in January 2021, the internal audit function completed an external assessment confirming that audit work performed is in conformance with the standards.

Is internal audit credible and adding value in support of the mandate and strategic objectives of the Department

Yes. 100% of the Department’s senior management provided a “Good” or “Excellent” rating of the overall usefulness of the engagements completed by the function. The internal audit function uses post-engagement client feedback responses received during the 2023 to 2024 fiscal year to measure satisfaction.

Are the risk-based audit plans submitted to the audit committee and approved by the Deputy Minister implemented as planned with resulting reports published? Is management acting on audit recommendations for improvements to departmental processes?

Risk-based audit plans identify all proposed engagements. The DAC recommends the audit plans for approval by the Deputy Minister.

Engagements are itemized in the table and the lists below:

List 1. Internal assurance engagements previously identified and/or in progress as of December 31, 2023

• Audit of Business Continuity Management
• Audit of Controls around Payment Processes: Program and Plan Payments — Phase 2
• Audit of Departmental Payroll Administration — Phase 2
• Audit of the Identification, Security and Protection of Sensitive Information
• Audit of Information Sharing Agreements
• Audit of IT Supply Chain Risk Management^{Footnote 10}
• Audit of Program Design for Grants and Contributions^{Footnote 11}
• Audit of Program Performance Measurement
• Audit of Retention and Promotion of Persons with Disabilities^{Footnote 12}
• Audit of User Activity Monitoring and Event Logging^{Footnote 13}
• Independent Review of the Canada Pension Plan Enhancement Project^{Footnote 14}
• Review of the Financial Transactions and Financial Statements of the Interprovincial Computerized Examination Management System (ICEMS)^{Footnote 15}

List 2. Planned internal assurance engagements to March 31, 2024, as of December 31, 2023

• Audit of the Common Experience Payment Designated Amount Fund
• Audit of Application Security Vulnerabilities^{Footnote 16}
• Audit of Design Effectiveness of the Departmental Migration and Operations to the Cloud
• Audit of Enterprise Risk Management^{Footnote 17}
• Audit of Occupational Health and Safety^{Footnote 18}
• Audit of Post-Implementation of the Identity and Access Management and the Privileged Access Management Solutions^{Footnote 19}
• Audit of Workforce Planning^{Footnote 20}
• ESDC’s Accessibility Agenda - Audit of Accessible Design and Delivery of ESDC’s programs and services^{Footnote 21}
• ESDC’s Accessibility Agenda - Audit of IT Accessibility