Audit of Controls Around Payment Processes: Program Payments – Phase 1

Official title: Audit of Controls Around Payment Processes: Program Payments – Phase 1

On this page

• List of abbreviations
• 1. Background
• 2. Audit findings
• 3. Conclusion
• 4. Statement of assurance
• Appendix A: Audit criteria assessment
• Appendix B: Background

Alternate formats

Audit of Controls Around Payment Processes: Program Payments - Phase 1 [PDF - 664 KB]

Large print, braille, MP3 (audio), e-text and DAISY formats are available on demand by ordering online or calling 1 800 O-Canada (1-800-622-6232). If you use a teletypewriter (TTY), call 1-800-926-9105.

List of abbreviations

ADM

Assistant Deputy Minister

BDM

Benefits Delivery Modernization

BISB

Benefits and Integrated Services Branch

CERB

Canada Emergency Response Benefit

CFO

Chief Financial Officer

CFOB

Chief Financial Officer Branch

CPP

Canada Pension Plan

CRA

Canada Revenue Agency

CRB

Canada Recovery Benefit

EI

Employment Insurance

ERB

Emergency Response Benefit

ESDC

Employment and Social Development Canada

FAA

Financial Administration Act

GIS

Guaranteed Income Supplement

ISAMS

Identity Services and Access Management Solution

ISB

Integrity Services Branch

MoU

Memorandum of Understanding

NHQ

National Headquarters

OAS

Old Age Security

OTP-PWD

One-Time Payment to Persons With Disabilities

OTP-Seniors

One-Time Payment for Seniors

ROE

Record of Employment

TB

Treasury Board

TBS

Treasury Board Secretariat

1. Background

Employment and Social Development Canada (ESDC) provides direct services and support to Canadians by delivering statutory programs. The Department must maintain reliable payment procedures and processes to ensure the accuracy of programs payments issued. The Emergency Response Benefit (ERB) delivered by the Department relied on the applicants' attestation of eligibility with limited pre-payment controls to allow benefits to be paid rapidly during the COVID-19 pandemic. The Phase 1 audit scope included payments issued by the 5 programs presented below:

• Employment Insurance (EI) including the ERB delivered by ESDC
• Old Age Security (OAS)
• Guaranteed Income Supplement (GIS)
• One-Time Payment for Seniors (OTP-Seniors)
• One-Time Payment to Persons With Disabilities (OTP-PWD)

1.1 Audit objectives

The objectives of the Phase 1 audit were to assess whether:

• applications are reviewed by the Department to validate the identity and verify the eligibility of the applicants to the ERB program
• payments to recipients are processed and approved in accordance with the requirements of:
• applicable Treasury Board (TB) directives and policies
• the Financial Administration Act (FAA)
• departmental policies and procedures
• Canada Emergency Response Benefit (CERB) and Canada Recovery Benefit (CRB) payments are processed in accordance with the Memorandum of Understanding (MoU) with the Canada Revenue Agency (CRA)

1.2 Audit scope

The scope of the Phase 1 audit included controls related to the processing of payments completed between April 1, 2020, and December 31, 2020, for the 5 programs. The audit scope also included quality assurance activities and monitoring of recipient records. See Appendix B for a description of the 5 programs.

1.3 Audit methodology

The audit was conducted remotely using the following methodologies which included, but were not limited to:

• documentation review, analysis and process observation using virtual screen sharing
• interviews and walkthroughs with management and staff from the implicated branches at National Headquarters (NHQ) completed virtually
• file reviews were completed on a sample of payment batches and program payments issued by the 5 programs
• data analytics was completed on $86.13 billion in payments issued to 18.93 million recipients

2. Audit findings

The results of the data analytics and file reviews completed on the payments processed during the audit period are presented below.

2.1 Reviewing applications and assessing eligibility

• PROTECTED

Recommendation

1. PROTECTED

Management response

PROTECTED

2.2 Processing program payments

• The Department had controls in place during the audit period to ensure that the program payments tested were processed in an accurate and timely manner
• Data analytics were completed on the program payments issued during the audit period and the audit team found that:
• EI recipients were paid only once for the same benefit week
• OAS and GIS recipients receive only one regular monthly payment
• The CRA sends the Department a monthly invoice of CERB and CRB payments administered on behalf of ESDC. The audit team tested a sample of CRA monthly invoices paid by the Department. The audit found that the Department’s payments of the CRA invoices were processed accurately and in a timely manner

Overpayments

• The Chief Financial Officer Branch (CFOB) provided the audit team with a duplicate payments analysis of the CERB and the ERB payments. The Deputy Chief Financial Officer (CFO) of ESDC signed off on the analysis. The analysis compared data to identify benefits that were issued to the same recipient for the same period. A total of $841.3 million in duplicate payments was included in the departmental financial statements as of March 31, 2021
• PROTECTED
• PROTECTED

2.3 Financial Administration Act approvals of payment processed

The FAA requires that Sections 32, 34 and 33 approvals be completed by officers with financial authorities before program payments are issued. FAA Section 32 is the commitment authority to ensure sufficient funds are available before issuing a program payment. FAA Section 34 is the authority to certify, before making a program payment, that the recipient is eligible to receive the program benefit. FAA Section 33 is the authority to release program payments.

• None of the program recipient payments nor the CRA invoice payments tested had a FAA Section 32 commitment authority approval. Upon enquiring with the CFOB, it was explained that legislation commits the Department to administer benefits based on eligibility requirements. Since there are no fixed budgets or expenditure limits, the Department accepts the risks of not completing the required FAA Section 32 approval before issuing program payments
• All of the program payments tested had FAA Section 34 and FAA Section 33 approvals were completed in a timely manner by officers who had proper delegated financial authorities. However, the audit identified a deficiency with the FAA Section 33 process
• The TB Directive on Delegation of Spending and Financial Authorities requires the Department to complete quality assurance activities to fulfill the account verification responsibilities of delegated FAA Section 33 officers. The CFOB informed the audit team that they rely on various quality assurance activities as well as the annual Letter of Attestation of System Controls for Account Verification provided by the Assistant Deputy Ministers (ADM) of the branches. However, the CFOB was unable to substantiate to the audit team whether other existing control activities support the FAA Section 33 account verification requirements for program payments. As a result, the audit found that the CFOB does not have a clearly articulated framework that adequately supports the FAA Section 33 account verification requirements

Recommendation

2. The CFOB should identify existing quality assurance activities, assess whether they adequately support the FAA Section 33 account verification requirements, and document the Department’s updated approach.

Management response

Agreed. While the Department has a framework that outlines the quality assurance activities to support the FAA Section 33 account verification, a review of these activities and an update to the framework will be done to clearly identify all existing assurance activities that the Department has in place to support FAA section 33 of Program payments.

2.4 Memorandum of Understanding with the Canada Revenue Agency

• The MoU with the CRA established the roles and responsibilities of ESDC and the CRA to administer the CERB and the CRB payments on behalf of ESDC. The MoU also defines the information sharing and governance functions required from the Department and the CRA. A joint ESDC and CRA CERB Steering Committee was established to provide direction on the administration of the benefits and public communications
• The CRA provided a letter of attestation on the internal controls over financial reporting for the COVID-19 benefits administered on behalf of the Department for the year ended March 31, 2021. The letter included controls related to benefit payments, transactions data and invoicing. The design of the controls was assessed as effective and the letter indicated that no high or medium risk observations were identified 

3. Conclusion

Overall, the audit concluded that payments issued by the 5 programs assessed in the audit scope and the CRA CERB invoices received were processed in accordance with the requirements of applicable TB policies and directives as well as departmental policies and procedures.

PROTECTED

The audit found that the CFOB needs to identify and assess whether the quality assurance activities support the FAA Section 33 account verification requirements.

4. Statement of assurance

In our professional judgment, the audit team gathered and analysed sufficient and appropriate evidence to support the accuracy of conclusions found in this report. The audit team based these conclusions on observations and analyses at the time of the audit. These conclusions are applicable only for the Audit of Controls Around Payment Processes: Program and Plan Payments – Phase I. The audit team followed the Treasury Board Policy on Internal Audit and the International Standards for the Professional Practice of Internal Auditing.

Appendix A: Audit criteria assessment

2.1 EI, ERB and Simplified EI

Audit criteria	Rating
Reviewing applications and assessing eligibility: It was expected that the Department has implemented controls to: PROTECTED	PROTECTED
Processing payments: It was expected that the Department has implemented controls to: Verify that FAA Sections 32, 33 and 34 approvals of program payments are performed by officers with proper financial authority delegations in accordance with the TB Directive on Delegation of Spending and Financial Authorities Process and issue accurate payments and identify overpayments for recovery in a timely manner	Controlled, but should be strengthened; medium-risk exposure
Monitoring recipient records and payment processes: It was expected that the Department has implemented controls to: Detect errors and prevent unauthorized access to program payment recipient records Perform account verification activities as part of a risk-based quality assurance process that is based on a sound sampling and execution methodology	Controlled, but should be strengthened; medium-risk exposure

2.2 OAS, GIS and One-Time (tax-free) Payments for Seniors and Persons With Disabilities

Audit criteria	Rating
Processing payments: It was expected that the Department has implemented controls to: Verify that FAA Sections 32, 33 and 34 approvals of program payments are performed by officers with proper financial authority delegations in accordance with the TB Directive on Delegation of Spending and Financial Authorities Process and issue accurate payments and identify overpayments for recovery in a timely manner	Controlled, but should be strengthened; medium-risk exposure
Monitoring recipient records and payment processes: It was expected that the Department has implemented controls to: Detect errors and prevent unauthorized access to program payment recipient records Perform account verification activities as part of a risk-based quality assurance process that is based on a sound sampling and execution methodology	Controlled, but should be strengthened; medium-risk exposure

2.3 CERB and CRB

Audit Criteria	Rating
Processing payments to CRA: It was expected that the Department has implemented controls to approve and accurately record invoices received from CRA for CERB and CRB payments administered on behalf of the Department	Sufficiently controlled; low-risk exposure
Monitoring recipient records and CRA MoU administration: It was expected that the Department has implemented controls to obtain assurance that the CERB and CRB payments are processed in accordance with the MoU with CRA	Sufficiently controlled; low-risk exposure

Appendix B: Background

Context

Employment and Social Development Canada (ESDC) provides direct services and support to Canadians during various phases of their lives by delivering programs. The payments provided by the 5 programs included in this audit report are briefly described below:

• Employment Insurance (EI): Provides regular benefits to individuals who lose their jobs through no fault of their own and are available for and able to work but cannot find a job. EI provides stability to Canadian workers during a range of life events such as welcoming a new child or caring for a critically ill family member. Three types of EI payments were examined during the audit period which included normal EI and the following 2 EI payment types:
• Emergency Response Benefit (ERB): The ERB was administered by ESDC and was designed to provide the same benefits as CERB for claimants who were EI eligible from March 15, 2020, to October 3, 2020, during which eligible applicants receive a minimum taxable benefit of $500 per week
• Simplified EI: As part of the CERB transition plan, changes to the EI program were put in place as of September 27, 2020, to better support Canadians looking for work after the CERB benefits ended. Canadians were transferred off ERB to receive a minimum weekly taxable benefit of $500
• Old Age Security (OAS): Provides basic OAS pension to seniors aged 65 and over who meet the legal status and residency requirements
• OAS – Guaranteed Income Supplement (GIS): Provides the GIS to low-income OAS pensioners as well as the allowances for low-income individuals aged 60 to 64 who are the spouses, common-law partners of GIS recipients or who are widows
• One-Time Payment for Seniors: The government emergency response also included a one-time $300 payment for seniors eligible for OAS in June 2020 and an additional one-time $200 payment for seniors eligible for GIS in June 2020 to help cover increased costs caused by COVID-19. The one-time separate payments were issued during the weeks of July 6, 2020, and September 28, 2020
• One-Time Payment to Persons With Disabilities: In recognition of the extraordinary expenses faced by persons with disabilities during the COVID-19 pandemic, a non-taxable, non-reportable, one-time payment of up to $600 was issued to persons with disabilities on October 30, 2020, who were a beneficiary of the Canada Pension Plan (CPP) Disability under the CPP Disability Program as at July 1, 2020, and who met other eligibility factors