Unaudited Financial Statements for the period ending March 31, 2019, Environment and Climate Change Canada, chapter 7

Statement of Management responsibility including internal control over financial reporting 2018-19

1. Introduction

This document provides summary information on the measures taken by Environment and Climate Change Canada (ECCC) to maintain an effective system of Internal Control over Financial Reporting (ICFR), including information on internal control management, assessment results and related action plans.

Detailed information on ECCC’s authority, mandate and program activities can be found in the last Departmental Results Report and the current Departmental Plan.

2. Environment and Climate Change Canada's system of internal control over financial reporting

2.1 Internal control management

ECCC has a well-established governance and accountability structure to support departmental assessment efforts and oversight of its system of internal control. A departmental internal control management framework, approved by the Deputy Head, is in place and includes:

• Organizational accountability structures as they relate to internal control management to support sound financial management, including roles and responsibilities of senior managers in their areas of responsibility for control management;
• Values and ethics code;
• Ongoing communication and training on statutory requirements, and policies and procedures for sound financial management and control; and
• Semi-annual monitoring of, and regular updates to, internal control management, with related assessment results and action plans provided to the Deputy Minister and senior departmental management, and as applicable, the Departmental Audit Committee (DAC).

The DAC provides advice to the Deputy Minister on the adequacy and functioning of the department’s risk management, control, governance and processes.

2.2 Service arrangements relevant to financial statements

ECCC relies on other organizations for the processing of certain transactions that are recorded in its financial statements as follows:

Common service arrangements

• Public Services and Procurement Canada (PSPC) provides accommodation services and administers the procurement of goods and services, and the payments of salaries in accordance with ECCC’s delegation of authorities. ECCC relies on the effectiveness of the PSPC Phoenix pay system and related activities and practices;
• Shared Services Canada provides information technology (IT) infrastructure services to ECCC in the areas of data centre and network services. The scope and responsibilities are addressed in the interdepartmental arrangement between Shared Services Canada and ECCC;
• The Department of Justice provides legal services to ECCC;
• The Public Prosecution Service of Canada provides prosecution services to ECCC; and
• The Treasury Board of Canada Secretariat provides services related to public sector insurance for ECCC employees and centrally administers payment of the employer’s share of contributions toward statutory employee benefit plans on behalf of ECCC (i.e. the Public Service Pension Plan, Employment Insurance Plan, Canada Pension Plan, Quebec Pension Plan and Public Service Supplementary Death Benefit Plan).

Readers of this Annex may refer to the Statement of Management Responsibility (SOMR) Annexes of the above-noted organizations for a greater understanding of the systems of ICFR related to these specific services.

Specific arrangements

• Agriculture and Agri-Food Canada (AAFC) provides ECCC with a SAP financial system platform to capture and report all financial transactions. Under this arrangement, ECCC relies on AAFC for the management of certain IT controls and procedures (e.g. security, configuration, change management, business continuity) and also of various master data functions in SAP.

3. Departmental assessment results during fiscal year 2018-19

The following table summarizes the status of the ongoing monitoring activities according to the previous fiscal year’s rotational plan.

The key findings and significant adjustments required from the current year’s assessment activities are summarized below.

3.1 New or significantly amended key controls

Significant efforts, including the use of data analytics, were deployed this fiscal year to enhance the control framework for the Pay Administration process. Key changes made to the ECCC process include the establishment of a quality assurance program for monitoring the accuracy of pay transactions and reviewing the internal control descriptions. Also, ECCC established a Business Continuity Management Program for Essential Financial Functions as well as a Fraud Awareness Guide for ECCC employees to enhance awareness and provide guidance.

3.2 Ongoing monitoring program

In 2018-19, ECCC followed its rotational ongoing monitoring plan of internal controls over financial management as per the Treasury Board Financial Management Policy Suite requirements. This plan is consistent with the SOMR and is reviewed based on emerging priorities.

As such, the Department performed an assessment of the following business processes: Pay Administration, Operating Expenditures, Capital Expenditures, Revenue, Receivables and Receipts, Budgeting and Forecasting, and Chief Financial Officer (CFO) Attestation for Cabinet Submissions.

Pay administration

The Department continues to be proactive in addressing potential issues around the implementation of the Phoenix pay system. ECCC reviewed the Pay Administration process and implemented additional controls to better align the process with TBS requirements. The updated Pay Administration process mirrors the TBS Guideline on Financial Management of Pay Administration requirements and is aligned with the March 2019 TBS Practitioners’ guide on implementing a departmental financial management control framework for pay administration.

Enhancements included establishment of a quality assurance program on Pay Administration, including post payment verification of pay transactions, periodic analysis, payment issues reporting and clarification of roles and responsibilities in order to provide additional assurance on the accuracy of salary expenditures. Furthermore, additional ECCC resources continue to analyze data from Phoenix and the departmental human resources management system to identify root causes and to mitigate against future issues.

ECCC is planning to reach the ongoing monitoring status on Pay Administration during 2019-20 as presented in the departmental action plan for the next fiscal year and subsequent years.

Operating expenditures

Operating Expenditures include: Procure to Pay; Travel; Administration of Acquisition and Fleet Cards; and Delegation of Financial and Spending Authorities. At ECCC, these types of expenditures are subject to a quarterly account verification. An Account Verification Awareness Program is in place and contributes to communicating the quarterly results to delegated managers.

This year’s assessment concluded that controls on high risk expenditures were effective. In addition, new control measures are being implemented to support ECCC delegated managers in reducing error rates in the low and medium-risk category, such as referring to central repositories to confirm the existence of supporting documentation and issuing awareness for delegated managers on the proper claiming of travel expenses.

Capital expenditures

The Capital Expenditures process is at the ongoing monitoring stage. This year’s assessment was extended to the following business processes: Manage Other Capital Assets; Real Property; Inventory; Equipment; and IT Assets, Equipment and Inventory.

The assessment concluded that roles and responsibilities were broadly defined but not implemented or communicated at the operational level and that financial delegated authorities for disposals or write-offs were not always applied as intended.

A new full assessment of Capital Expenditures is planned for 2022-23, following the implementation of the related remediation action plan.

Revenue, receivables and receipts

ECCC has completed the operational effectiveness testing of the Revenue, Receivables and Receipts process and is now at the ongoing monitoring stage.

This year’s assessment concluded that ECCC management action plans following recommendations made in 2015-16 were generally implemented as intended. Bank deposits and all funds received were reconciled on a regular basis and credit memos and adjustments were properly used, with minor exceptions.

Budgeting and forecasting

Budgeting and Forecasting was part of ECCC’s 2018-19 ongoing monitoring plan.

ECCC has already assessed the design of the process and the assessment of the effectiveness of related key controls is underway.

CFO attestation for cabinet submissions

CFO Attestation for Cabinet Submissions was part of ECCC’s 2018-19 ongoing monitoring plan.

ECCC has completed the review of documentation pertaining to the CFO Attestation for Cabinet Submissions process and has developed internal templates and checklists to improve the process. Completion of the assessment for this process is underway.

4. Departmental action plan for the next fiscal year and subsequent years

In 2016 and as validated by Management Accountability Framework assessment results, ECCC reached the ongoing monitoring status on all processes related to ICFR. Since then, ECCC implemented a risk-based ongoing monitoring program and conducted an annual risk-based assessment to monitor the effectiveness of its ICFR. In 2018, the scope of this monitoring was extended to include its Internal Control over Financial Management (ICFM).

Ongoing monitoring involves:

• using a risk-based approach
• assessing the design and operating effectiveness of internal controls regularly in accordance with the monitoring plan
• determining whether any actions need to be taken to address weaknesses

Ongoing monitoring of internal controls begins after completion of initial control assessment. The control assessment involves:

• documenting the controls
• testing for design effectiveness and operating effectiveness
• developing a management action plan to correct gaps or weaknesses

ECCC’s five-year risk-based ongoing monitoring plan is rotational and it is based on the 2018-19 risk assessment results of ICFM processes (including ICFR processes), the departmental priorities, the available resources and workload and other considerations that have an impact on the plan.

In addition, ECCC will continue to enhance its approach to monitoring of controls through the use of data analytics to support sound financial management practices and decision-making.

Finally, ECCC will also continue to strengthen its control of salary expenditures, notably through participating in Government of Canada horizontal initiatives.