1. Executive summary
The objective of this internal audit was to assess the effectiveness of the Project Management Framework (PMF) and controls to support the delivery of projects, in compliance with the relevant Treasury Board (TB) policy instruments.
The Audit of project management was approved by the Deputy Minister upon the recommendation of the Departmental Audit Committee, as part of the two-year Risk-based Audit Plan 2019 to 2021. The audit covered the period from September 2018 to the end of October 2019.
Why is it important?
The management of projects is key to providing value for money and demonstrating sound stewardship in program delivery. Insufficient project management increases the risk of untimely delivery, excessive costs or project and program failure. Environment and Climate Change Canada (ECCC) has important new initiatives that require robust project management. While the Corporate Services and Finance Branch has taken measures to improve ECCC’s project management practices, all branches may not have the governance structure and management controls in place to properly apply the PMF for all their planned and ongoing projects.
Furthermore, project management is considered a high-risk area across all of government. The Office of the Comptroller General included an audit of project management in its 2017-2021 Risk-Based Internal Audit Plan. The ECCC Internal Audit Division recently completed an Audit of infrastructure renewal at the Meteorological Service of Canada, which included a recommendation on project management.
What we found
Overall, the audit found that the ECCC PMF and related controls were adequately designed and implemented to support the effective delivery of projects, including well implemented communication, tools and training; and were generally in compliance with the relevant TB Policy instruments. Some areas for improvement were identified under the following five themes:
- design of the ECCC PMF
- identification and tracking of projects
- governance
- risk management
- compliance with ECCC PMF documentation requirements
Design of the ECCC Project Management Framework
The design of the ECCC PMF is adequately aligned with requirements of the TB Policy on the Planning and Management of Investments and the TB Directive on the Management of Projects and Programmes. The audit identified three areas that could benefit from more clarity: conducting independent reviews, requirements for enterprise or joint projects and outsourced real-property and infrastructure projects.
Identification and tracking of projects
A formally defined process to track projects is in place, allowing the Departmental Project Management Office (DPMO) to maintain and update the list of projects subject to the ECCC PMF. However, the audit found that there is a lack of common understanding across the Department regarding what constitutes a project.
Governance
Project governance and oversight have been established to provide projects with structure and direction. Roles and responsibilities for project management have been clearly defined, documented and were generally well understood. The audit identified some opportunities for improvement with respect to the operating effectiveness of project steering committees and the oversight of ECCC project portfolio. The audit also found some inconsistencies in the way that project sponsors carry out their roles and responsibilities and the understanding of stakeholders regarding the DPMO’s mandate.
Risk management
Overall, adequate processes have been developed and implemented to enable effective management and monitoring of risks throughout the project lifecycle. However, these processes are not always operating as intended. In particular, the audit found inconsistencies regarding the documentation of project risks.
Compliance with ECCC Project Management Framework documentation requirements
A review of project documentation for a sample of in-house and outsourced projects revealed that the majority of the projects managed in-house are generally compliant with the ECCC PMF documentation requirements. However, limited documentation was available for review for the outsourced real-property and infrastructure projects.
Communication, awareness and training
Overall, effective communication, training and awareness processes and activities have been designed and implemented to promote the ECCC PMF and project management concepts.
Recommendations
In response to these findings, the audit team has put forward four recommendations.
Recommendation 1
The Assistant Deputy Minister, Corporate Services and Finance Branch, should:
1.1 Update the ECCC Project Management Framework to reflect Treasury Board policy requirements and to support an integrated approach to project management by including the provisions for independent reviews of projects and programs and the governance requirements for joint and enterprise projects
1.2 Determine, in collaboration with ECCC Real-property group, the key project deliverables, governance and monitoring provisions relevant to outsourced ECCC real-property projects in line with TBS policy suite for real-property projects and ECCC Project Management Framework requirements
Recommendation 2
The Assistant Deputy Minister, Corporate Services and Finance Branch, should establish and communicate a common set of criteria to assess from the outset (at the Intake phase) whether a business opportunity or an initiative is a project and is subject to the ECCC Project Management Framework.
Recommendation 3
The Assistant Deputy Minister, Corporate Services and Finance Branch, should:
3.1 Include the mandate, scope and roles and responsibilities of the Departmental Project Management Office in the ECCC Project Management Framework
3.2 Remind senior management of their role as chair of the project steering committee for each of the projects they sponsor
3.3 Ensure that a horizontal overview of the ECCC projects portfolio is presented and discussed periodically at the senior management level
Recommendation 4
The Assistant Deputy Minister, Corporate Services and Finance Branch, should enhance the mandatory requirements in the ECCC Project Management Framework and the gating process with respect to the use of risk logs or other risk management tools at least as comprehensive as the risk logs, to ensure that risks are identified, managed, tracked, reassessed and monitored adequately at the individual project level throughout the project lifecycle.