Final Report - Audit of Key Financial Controls, Year 5 - October 2015

Table of Contents

• Executive summary
• A - Introduction
  • 1. Background
  • 2. Audit objective
  • 3. Audit scope
  • 4. Audit approach
  • 5. Statement of conformance
• B - Findings, recommendations and management responses
  • 1. Progress made on the previous year's recommendations
  • 2. Select key financial controls common to all classes of transactions
    • 2.1 Delegation of financial signing authorities
    • 2.2 Quality assurance process over Financial Administration Act Section 34 certification
    • 2.3 FAA Section 33 certification
    • 2.4 Management review of expenditures and commitments
    • 2.5 Accrued liabilities at year-end
    • 2.6 System access and segregation of duties
    • 2.7 Journal entry review
  • 3. Select key financial controls specific to classes of transactions
    • 3.1 Grants and contributions payments
    • 3.2 Salaries and wages expenses
    • 3.3 Non-insured health benefits
    • 3.4 Purchase of goods and services
    • 3.5 Acquisition card purchases
    • 3.6 Drug submissions and evaluation revenues
    • 3.7 Accounts receivable
    • 3.8 Capital assets
• C - Conclusion
• Appendix A - Lines of enquiry and criteria
• Appendix B - Scorecard
• Appendix C - Health Canada's internal control over financial reporting framework
• Appendix D - Risk profile of transactions
• Appendix E - Corrective actions and follow-up activities
• Appendix F - Overview of progress made on prior year's recommendations

Executive summary

In support of the Treasury Board Policy on Internal Control, Health Canada's (the Department) Deputy Minister and Chief Financial Officer are required to sign an annual representation letter acknowledging their responsibilities for maintaining an effective system of internal control over financial reporting.

The objective of this audit was to provide reasonable assurance that select key financial controls in support of the departmental financial statements are operating effectively. The audit focused on testing the controls that help the Department meet its control objectives and address management's responsibility over the completeness, validity and accuracy of its financial reporting. Select controls from two categories of key financial controls were tested as part of the audit: common key controls and specific key controls. The audit covered transaction processing activities for fiscal year 2014-15.

The audit was conducted in accordance with the Internal Auditing Standards for the Government of Canada and the International Standards for the Professional Practice of Internal Audit. Sufficient and appropriate procedures were performed and evidence gathered to support the accuracy of the audit conclusion.

The audit concluded that select key financial controls in support of the departmental financial statements are generally operating effectively.

Improvements are required to strengthen the management of specimen signature cards; reduce the error rates for acquisition card transactions; ensure that journal voucher entries are supported with appropriate documentation; ensure that reconciliations of the Grants and Contributions Information Management System to the departmental financial management system are conducted; and ensure timely recording of recoveries from contribution agreements in the departmental financial system.

Management agrees with the five recommendations outlined in the report and has provided an action plan that will improve the effectiveness of the Department's internal controls over financial reporting.

A - Introduction

1. Background

Reliable financial reporting provides transparency and accountability for public funds spent to achieve departmental objectives. To this effect, Treasury Board (TB) has put in place policies to strengthen financial reporting, and requires departments to have an effective risk-based system of internal controls. These include:

• The TB Policy on Internal Control requires that the Deputy Head sign an annual departmental Statement of Management Responsibility Including Internal Control Over Financial Reporting; and
• The TB Policy on Financial Resource Management, Information and Reporting requires that the Deputy Head take measures to ensure that the Department can sustain a control-based audit of its annual financial statements.

In addition, Deputy Heads and Chief Financial Officers are required to sign an annual Letter of Representation to the Auditor General and the Deputy Receiver General in support of the Public Accounts, covering their responsibilities for internal control over financial reporting and assertions over the integrity of financial information.

In support of the Policy on Internal Control, at Health Canada, the Chief Financial Officer Branch (CFOB) has developed the Internal Control over Financial Reporting Framework (ICFR). This framework provides direction for the implementation of the ICFR. It identifies and documents the supporting processes, procedures, and related internal controls in place to mitigate financial reporting risks. Six main business processes were identified to support reliable financial reporting (see Appendix C):

• Management of parliamentary appropriations;
• Revenue/receivables/receipts;
• Purchasing/payables/payments including transfer payments;
• Payroll;
• Capital assets; and
• Financial statement, year-end and reporting.

This recurring (annual) audit is aimed at assessing the operating effectiveness of key financial controls. Changes that took effect in fiscal year 2014-15 include the phasing in of a new system for managing transfer payments; and continued migration of pay services to a common service provider.

Notwithstanding the changes, the select key financial controls being tested as part of this audit are fundamental to the operation of the Department and should remain effective in a challenging environment.

2. Audit objective

The objectives of the audit were to:

• Determine whether select key financial controls in support of the departmental financial statements are operating effectively, in order to mitigate the risk of material misstatements in terms of ensuring the validity, completeness and accuracy of the financial transactions reported; and,
• Follow up on the progress made on the implementation of the management action plan developed in response to the previous years' key financial controls internal audit recommendations.

3. Audit scope

The scope of this audit encompassed a review of the operational effectiveness of key financial controls that are either common or specific to the following significant classes of transactions:

• Grants and contribution agreements;
• Salaries and wages expenses;
• Non-insured health benefits;
• Purchase of goods and services;
• Acquisition card purchases;
• Drug submissions and evaluation revenues;
• Accounts receivables; and
• Capital assets.

The audit covered transaction processing activities for fiscal year 2014-15. The controls tested are predominantly within CFOB, but the audit also reviewed control activities that fall under the responsibility of the offices of secondary interest, and cost centre managers.

4. Audit approach

In assessing the effectiveness of key financial controls, the audit conducted interviews with Department employees, reviewed documentation (for example, departmental policies and procedures, relevant documentation in support of financial transactions), observed key processes and controls and analyzed financial and non-financial data using computer-assisted audit techniques and tools.

Where possible, reliance was placed on work performed by other parties such as CFOB's Internal Control Division, to support the Statement of Management Responsibility Including Internal Controls over Financial Reporting.

5. Statement of conformance

In the professional judgment of the Chief Audit Executive, sufficient and appropriate procedures were performed and evidence gathered to support the accuracy of the audit conclusion. The audit findings and conclusion are based on a comparison of the conditions that existed as of the date of the audit, against established criteria that were agreed upon with management. Further, the evidence was gathered in accordance with the Internal Auditing Standards for the Government of Canada and the International Standards for the Professional Practice of Internal Auditing. The audit conforms to the Internal Auditing Standards for the Government of Canada, as supported by the results of the quality assurance and improvement program.

B - Findings, recommendations and management responses

1. Progress made on the previous years' recommendations

Audit criterion: Progress is made on the previous year's recommendations.

Management has fully implemented the committed actions for recommendations made in the previous year's report (see Appendix F).

System access and segregation of duties (recommendation 1)

Management has reviewed security roles and removed access to incompatible duties. Quarterly monitoring of FIRMS' employees with access to Post-Invoice and Payment Run for production support purposes was also performed. Management's action plan for this recommendation has been fully implemented.

Salary and wage expenses (recommendation 2)

Quarterly monitoring and reporting of salary payments was performed. Management's action plan for this recommendation has been fully implemented.

2. Select key financial controls common to all classes of transactions

2.1 Delegation of financial signing authorities

Audit criterion: Controls over the maintenance of specimen signature cards ensure that delegations of financial signing authorities are valid.

Certification under Section 34 of the Financial Administration Act (FAA) requires account verification of all expenditures processed at Health Canada (the Department). Such certification aims to provide assurance over the validity and accuracy of transactions by certifying that goods and services were received or that a grant or contribution recipient is eligible for payment.

Financial signing authority is delegated to various management levels throughout the Department by the Minister and the Deputy Minister. These authorities are then granted to employees at various management levels by creating and activating specimen signature cards, which are maintained in SAP. There were approximately 3,400^{Footnote 1} active signature cards in the database as of March 2015.

Certification under FAA Section 33 (payment authority) ensures that payments are subject to authorized requisitions, are lawful charges against the appropriation and are within the appropriations level. This requires that appropriate processes and controls be in place to verify accounts under FAA Section 34, as stated in the Department's delegation of financial signing authority document. Section 33 of the FAA relies on the specimen signature cards to substantiate whether an employee has valid Section 34 delegation of financial signing authority. Consequently, it is essential that the controls over the creation and activation of specimen signature cards operate effectively, to comply with the FAA and central agency policy instruments and prevent unauthorized expenditures.

Activation of specimen signature cards

Prior to activating a specimen signature card, Specimen Signature Card Editors must verify the validity of the request (for example, approved by a supervisor with delegated authority, mandatory training has been taken and issued to an eligible Department employee, only one substantive card per individual, in most cases).

The audit reviewed specimen signature cards to verify that they were approved by a supervisor with delegated authority and found no significant issues. Tests were also performed to verify that employees have only one active substantive card. The audit found that 3% of cardholders had been issued more than one active substantive card, including instances where cardholders had active specimen signature cards at different management levels (for example, a cardholder with a specimen signature card for the same cost centre(s) at the CCA and the CCM levels.) This reduces the reliability and effectiveness of the signature cards as a preventative control. As noted in Section 2.2, the SAP-P2P process relies on the signature card database to determine whether a user has the appropriate level of delegated authority for FAA Section 34 certification and approval. As such, employees with multiple cards may be able to exercise FAA Section 34 approval on invoices that exceed their delegated authority.

Termination of specimen signature cards

An employee's specimen signature card may be terminated for two reasons: the employee's responsibilities have changed or the employee has left the Department. In the first instance, the signature card is edited to reflect the new responsibilities, provided that the employee retains financial signing authority. In the second instance, the signature card is simply cancelled. A mandatory departure process and departure application tool was implemented to facilitate the timely cancellation of cards. Furthermore, the Chief Financial Officer Branch (CFOB) performs an annual review of specimen signature cards as a mitigating control, to cancel any cards that are no longer required.

Since the financial officers rely on the accuracy of the specimen signature card database when conducting FAA Section 33 certification, the termination of signature cards needs to be completed in a timely manner.

The audit assessed the accuracy of the database throughout the year by analyzing the timeliness of the termination of specimen signature cards for departed employees. The audit found instances where specimen signature cards were not cancelled in a timely manner (for example, more than 30 days after the employee's departure).

A mandatory departure application was implemented in 2014 to streamline and automate the process for notifying Finance (and other areas) of an employee's departure, so that appropriate action can be taken (such as the cancellation of specimen signature cards). The audit found that the use of the departure application was noted as an area for improvement in the Annex to the Statement of Management Responsibility. As a result, management has developed an action plan to monitor outstanding employee departure tickets on a monthly basis.

Overall, improvements are required to ensure the effectiveness of controls over the maintenance of specimen signature cards.

Recommendation 1

It is recommended that the Chief Financial Officer implement controls so that unnecessary specimen signature cards are cancelled on a timely basis.

Management response

2.2 Quality assurance process over Financial Administration Act Section 34 certification

Audit criterion: The quality assurance performed over Financial Administration Act Section 34 certification is effective.

In accordance with the Treasury Board Secretariat (TBS) Directive on Account Verification, when exercising payment authority for payments pursuant to Section 33 of the Financial Administration Act (FAA), Health Canada employs a risk-based approach to performing the quality assurance review over the FAA Section 34 account verification process. A well-functioning quality assurance process is a key control ensuring that a high standard of integrity and accountability is maintained in the spending of public money and supporting sound stewardship of financial resources.

The objective of the quality assurance process is to confirm that the FAA Section 34 certification is properly and consistently performed. This provides assurance that transactions are valid, accurate and properly authorized. For high-risk transactions, it acts as a main control to ensure that the transactions are accurate and valid and that errors (if detected) are corrected prior to payment. For low-risk transactions, the quarterly sampling results provide insight into the effectiveness of the FAA Section 34 certification and, if necessary, action plans are developed. For both types of transactions, errors are corrected where deemed necessary. See Appendix D for the risk profile of transactions.

As illustrated in Figure 1, all transactions undergo a minimum quality assurance, which focuses on verifying the appropriateness of FAA Section 34 authorization, the financial coding and vendor information. The implementation of SAP-P2P has automated the verification of FAA Section 34 authorization for commercial invoices. Minimum quality assurance reviews for payment requests related to contribution agreements are still being conducted manually. Through a "gating" process, a risk profile (low or high) is then assigned, based on the nature and value of the transactions.

Source: Health Canada's Statistical Sampling Training Guide

All transactions deemed as high-risk undergo full quality assurance prior to payment. This includes verifying whether the backup documentation provided supports the payment request, whether the financial coding is appropriate, that claimed amounts are in accordance with the corresponding contract or funding agreement and that procurement documents and payment requests comply with TB and departmental policies.

Those identified as low-risk are paid immediately after a minimal quality assurance is performed; however, they may be subject to a full post-payment quality assurance through quarterly statistical sampling. This process is referred to as the Post-Payment Quality Assurance Process.

Errors identified through quality assurance that call into question the validity of the payment request must be followed-up and corrected, such as inappropriate FAA Section 34 financial signing authority or an invoice price that is not in accordance with the contract or funding agreement.

Table 1 provides a breakdown by risk profile of the transactions recorded in fiscal year 2014-15. It demonstrates that even though the proportion of high-risk transactions was 4% of the total population in terms of numbers, these transactions represented 86% of the total dollar value.

Quality assurance over FAA Section 34 account verification encompasses most payment transactions, including grants and contributions, account payables, travel claims, honoraria, and acquisition cards. However, it does not cover salary and wage expenditures, since they are subject to a different quality assurance process discussed in Section 3.2 of this report.

The main aspects of the quality assurance process include:

• The gating of transactions;
• The identification of errors in account verification;
• The logging of results of the quality assurance review; and
• The quality assurance or statistical sampling on low-risk transactions.

Gating of transactions for the quality assurance process

The gating of transactions is an important aspect of the quality assurance process. It determines whether a transaction presents a low risk or a high risk, thereby determining the level of quality assurance (minimum or full) to be performed prior to payment.

The audit determined that not all transactions were subject to the gating process. Due to system changes to improve reporting on the use of temporary help services and the implementation of the new grants and contribution management system, new document types were introduced in the departmental financial system in 2014-15. The gating profiles were not updated to include these new document types. As a result, transactions for temporary help services paid through acquisition cards were not assigned a risk rating and were not included in the population of low-risk transactions subject to quarterly statistical sampling. Although transactions from the new grants and contributions system were not assigned a risk rating, appropriate quality assurance was performed. Management has since updated the gating profiles for fiscal year 2015-16.

Identification of errors in account verification

The quality assurance review entails verification that FAA Section 34 account verification has been performed properly. This process provides evidence of the effectiveness of FAA Section 34 account verification.

The audit tested transactions recorded in fiscal year 2014-15 and noted one instance of a calculation error; one financial coding error; two instances where payments were not in accordance with departmental policies; and two instances where taxes were not properly applied.

Logging of results of the quality assurance review

Health Canada's Statistical Sampling Training Guide requires that all errors identified during the quality assurance review for both low- and high-risk transactions be logged in SAP. This is regarded as the most significant output of the quality assurance process because it provides the necessary data to report on the overall adequacy and reliability of the account verification process and allows management to develop corrective actions where necessary, in accordance with the TBS Directive on Account Verification.

The audit found that, for the sample of transactions reviewed, errors identified by the quality assurance reviewer had been logged in SAP.

Post-payment quality assurance of low-risk transactions

As noted earlier, all low-risk transactions undergo minimum quality assurance prior to payment. In addition, a sample of these transactions is selected on a quarterly basis to undergo full post-payment quality assurance. CFOB analyzes errors and develops the action plans. The Shared Services Partnership's Statistical Sampling Framework provides guidance on corrective actions and follow-up activities (see Appendix E).

Starting in fiscal year 2014-15, management also took separate quarterly samples of acquisition card transactions from other low-risk payments.

The audit examined the results of the statistical sampling on low-risk transactions for fiscal year 2014-15. The results indicate that the error rate for accounts payable transactions and the quarterly error rates were consistently below the tolerable error rate; however; acquisition card transactions exceeded the Department's tolerable error rate. It should be noted that, as of March 2015, the Department had approximately 600 acquisition cards. Efforts were made to address the error rate for acquisition cards, including communications to all card holders; however, this did not have a significant impact, as demonstrated in Table 2.

Analysis of the errors identified through statistical sampling of acquisition card transactions showed that errors related to expenditure initiation account for the largest proportion of the errors. Corrective actions, consisting mostly of communications with cardholders, have had a limited effect on reducing the error rate at the departmental level. Furthermore, while action plans developed to address identified errors have reduced the errors related to expenditure initiation, other types of errors have increased, thus offsetting any gains made in this area.

In conclusion, post-payment quality assurance is performed over FAA Section 34 certification. However, action plans developed to address identified errors have not succeeded in reducing the error rates for acquisition card transactions.

Recommendation 2

It is recommended that the Chief Financial Officer develop and implement controls to reduce errors for acquisition card transactions to an acceptable level.

Management response

2.3 FAA Section 33 certification

Audit criterion: Certification under FAA Section 33 is performed and an appropriate segregation of duties exists with FAA Section 34 certification.

The authority to request payments in accordance with Section 33 of the FAA is referred to as payment authority. Pursuant to this section, a financial officer with delegated payment authority must ensure that:

• FAA Section 34 has been properly exercised by validating that the Section 34 signatory has a valid delegated authority to authorize the expense and that there is auditable evidence that the quality assurance over the adequacy of the Section 34 account verification has taken place; and
• Expenditures are a lawful charge against the appropriation.

The FAA Section 33 payment authorization performed by financial officers is a key control for ensuring the accuracy and legality of transactions.

The audit found that certification under FAA Section 33 is performed and an appropriate segregation of duties exists with FAA Section 34 certification.

2.4 Management review of expenditures and commitments

Audit criterion: Cost centre managers review commitments and expenditures recorded in SAP for completeness, validity and accuracy.

Health Canada's Policy on Budget Management, which is part of the departmental Budget Management Framework, requires that cost centre managers be accountable and responsible for their assigned budgets. This includes the effective stewardship and control over budgets and commitments and the monitoring of surpluses, deficits and forecasts on an ongoing basis.

Cost centre managers, with the support of branch financial management advisors (in the National Capital Region) and regional financial management advisors (in other regions), are required at month-end to review expenses charged to their cost centres through the Department's management variance reporting (MVR) process. The activity entails a review of the validity, accuracy and completeness of expenses. CFOB is responsible for ensuring that the month-end MVR exercise is adequately conducted and documented through a challenge function. This process is considered a key control over financial reporting.

In conclusion, cost centre managers reviewed commitments and expenditures recorded in SAP for completeness, validity and accuracy.

2.5 Accrued liabilities at year-end

Audit criterion: Review and challenge of payables at year-end are performed to ensure completeness, validity and accuracy.

As per the TB Policy on Payables at Year-End (PAYE), departments and agencies must identify and quantify liabilities to outside organizations and individuals resulting from operations up to and including March 31^st of each fiscal year. In the absence of certainty, estimates must be used to determine the amounts of liabilities, as long as reasonably accurate values can be assigned.

As per the departmental year-end procedures, cost centre managers and administrators must submit PAYE requests for goods and services of value greater than or equal to $1,000 (except for salary-related items, where the minimum threshold is $400, for interdepartmental settlements and for grants and contributions, where there is no minimum threshold), for which an invoice has not been received or when accounts payable or payments cannot be recorded by the required cut-off date. In addition, financial management advisors are responsible for reviewing and challenging PAYE requests to ensure that the appropriate documentation is provided to support a valid liability.

The audit tested the review and challenge function exercised over both PAYEs related to the previous fiscal year that had yet to be cleared and PAYEs recorded as part of the 2014-15 year-end procedures. Sufficient evidence was provided to demonstrate adequate management oversight for both types of transactions at the departmental level.

In conclusion, the financial management advisors reviewed and challenged the completeness, validity and accuracy of transactions payable at year-end.

2.6 System access and segregation of duties

Audit criterion: Access to SAP is restricted and the segregation of duties is enforced.

The segregation of duties is a key concept in internal control that mitigates the occurrence of fraud and errors. Incompatible segregation of duties occurs when the same person or function can perform tasks in multiple phases of a single process. An example of incompatible duties that must be segregated is the creation or maintenance of vendor master files and the recording of purchase orders or vendor invoices. Prior to granting or modifying access, CFOB performs tests to ensure that users do not receive access to incompatible functions. In addition, the Corporate Services Branch (CSB), Information Management Services Directorate (IMSD) and CFOB conduct tests to monitor the segregation of duties on a semi-annual basis. In order to monitor the segregation of duties in the departmental financial system, Health Canada follows tests that have been standardized across the federal government. These tests are based on a matrix of critical functions that rate risk as low, medium or high.

The audit verified that semi-annual monitoring was conducted by CSB and CFOB, and tested the segregation of duties to determine whether individuals had access to incompatible functions. Audit tests of segregation of duties found no users with access to incompatible functions. However, the audit found that the semi-annual monitoring exercise was only completed once during fiscal year 2014-15. An improvement opportunity related to access control was identified in the Annex to the Statement of Management Responsibility, and management developed an action plan to communicate roles and responsibilities and to assess frequency of the periodic monitoring exercise by March 2016. Therefore, no recommendation will be made.

In conclusion, SAP access is restricted but monitoring of segregation of duties needs to be performed semi-annually to ensure that the segregation of duties is enforced.

2.7 Journal entry review

Audit criterion: Journal entries are reviewed by a second person and accompanied by appropriate supporting documentation.

Journal vouchers (JV) are used to make adjustments in the departmental financial system (SAP), to ensure that financial information is accurate and properly coded. As part of the financial policy renewal project, the Standard on Journal Vouchers was developed to formalize the process and the responsibilities for creating, approving, reviewing and entering JVs into SAP. The audit expected to find that effective controls were in place to ensure that journal vouchers were managed in accordance with the Department's standards.

The Standard, approved by CFOB on November 7, 2014, identifies the supporting documentation and approval requirements for routine and non-routine JVs. Requirements of the new Standard include:

• JV request form;
• Written justification that clearly supports the need for the JV;
• Supporting documentation;
• Written approval by the JV Approving Authority (for example, CCM);
• Review of the JV request by the accounting office responsible for processing the JV and the filing of all documentation; and
• JV transactions that have an impact on the departmental financial statements have been validated by a second finance officer.

The audit examined JVs and found that they were reviewed, but noted cases where documentation to support the journal voucher was insufficient.

Recommendation 3

It is recommended that the Chief Financial Officer implement controls to manage journal vouchers, in accordance with the departmental Standard on Journal Vouchers.

Management response

3. Select key financial controls specific to classes of transactions

3.1 Grants and contributions payments

Audit criterion: Reconciliation of payment requests from contributions systems to SAP is performed. Contribution agreements are reviewed and closed out, to ensure that receivables arising from overpayment are recorded.

Reconciliation of payment transactions between the grants and contributions systems and the departmental financial system

In fiscal year 2014-15, grants and contributions programs were managed by the Strategic Policy Branch (SPB - $255 million) and the First Nations and Inuit Health Branch (FNIHB - $1.407 million) through the use of various management information systems. As part of key controls, the audit expected to find that reconciliations between these systems and SAP contributed to providing assurance that grants and contributions agreement expenditures recorded in the departmental financial system are complete and accurate.

SPB managed grants and contributions agreements and payment requests through the Lotus Notes Grants and Contributions Database (Lotus Notes) until August of 2014, when it was replaced by the Grants and Contribution Information Management System (GCIMS). The audit found that reconciliations of the Lotus Notes and SAP expenditures were performed. As well, the audit found that a reconciliation of the August 2014 Lotus Notes to GCIMS data conversion was performed. However, no reconciliations of the GCIMS and SAP expenditures were performed for the period from September 2014 to March 2015.

FNIHB managed grants and contributions agreements and payment requests through the Management of Contracts and Contributions System (MCCS) until March 2015, when MCCS was replaced (April 2015) by GCIMS. The audit found that reconciliations of the MCCS and SAP expenditures were performed for 2014-15.

Review and close-out of contribution agreements

The review and close-out of contribution agreements are necessary to ensure that all the terms and conditions have been met and that receivables arising from overpayment are recorded in the departmental financial system and collected, as required. The timely close-out and the communication of results to Finance are necessary to ensure the completeness and accuracy of the Department's financial information, specifically accounts receivable.

The audit found that the review and close-out of contribution agreements was generally operating effectively. However, as noted in Section 3.7, improvements are required to ensure the timely recording of receivables arising from overpayments on contribution agreements.

In conclusion, during the period under audit, the reconciliation of payment requests from the MCCS to SAP was performed, and the review and closed-out of contribution agreements were also performed. However, reconciliations of GCIMS to SAP financial information have not been completed.

Recommendation 4

It is recommended that the Chief Financial Officer reconcile the Grants and Contributions Information Management System and the departmental financial system, to provide assurance that grants and contributions agreement information is complete and accurate.

Management response

3.2 Salaries and wages expenses

Audit criterion: Compensation verifiers review payroll registers to confirm accuracy of payroll transactions.

Compensation verifier review of pay registers

According to the TBS Directive on Financial Management of Pay Administration and the Guideline on Common Financial Management Business Process for Pay Administration, responsibilities for FAA Section 34 certification are to be shared between cost centre managers and Pay Centre verification advisors at different stages of the pay administration cycle.

Since 2013, as a result of the Transformation of Pay Administration Initiative launched in 2009, the administration of Health Canada pay files, along with the authority to conduct FAA Section 34 certification of pay input components, have gradually been transferred to a common service provider. It is anticipated that all Health Canada pay files will be transferred by October 2015. At the time of the audit, pay files for 3,650 employees remained at the Department.

For those pay files that remain at Health Canada, pay administration is under the responsibility of the Human Resource Services Directorate in the Corporate Services Branch (CSB-HRSD), which includes compensation advisors and verifiers. Compensation advisors are responsible for the accuracy of pay input through FAA Section 34 certification. Compensation verifiers are responsible for reviewing the payroll registers and individual salary payments. This review is the final opportunity to confirm the accuracy of payroll transactions prior to payment.

The audit reviewed employee pay transactions against payroll registers and other output reports for fiscal year 2014-15, and found that the payroll verification to confirm accuracy of payroll transactions was appropriately performed by CSB-HRSD.

For those pay files transferred to the common service provider, this service provider will provide assurance by issuing quarterly Quality Assurance Review Reports and an annual Letter of Representation.

FAA Section 33 quality assurance review

The adequacy and reliability of the account verification process on payroll transactions is the responsibility of CFOB. The TBS Directive on Account Verification states that: "Financial officers are responsible for ensuring that payments and interdepartmental settlements are verified when exercising payment authority for payments pursuant to Section 33 of the Financial Administration Act." The Directive further states that: "although account verification is normally performed prior to payment, completing account verification after the payment has been made is permitted in certain situations."

For pay files physically managed and located at Health Canada, quality assurance review or account verification for payroll transactions is conducted by CSB-HRSD and the results are shared with CFOB. The audit found that the quarterly quality assurance reviews were completed in accordance with CSB-HRSD's Compensation Monitoring Framework - Quarterly Reviews plan.

As noted earlier in the report, for pay files transferred to a common service provider, this service provider provides assurance on the accuracy of payroll transactions by issuing quarterly Quality Assurance Review Reports and an annual Letter of Representation. The audit found that during 2014-15, the Department has not receive assurance that controls over payroll transactions were effective, since the Department received only one Quality Assurance Review Report that covered transactions for March and April 2014. This is a government-wide challenge. The Department relied on the Management Variance Reporting process as a compensating control to ensure the accuracy of payroll transactions.

Since April 2015, quality assurance reviews have resumed with the first 2015-16 Quarterly Quality Assurance Review Report being provided to the Department in August 2015. Management indicated that a government-wide meeting is expected to be held with the common service provider during fiscal year 2015-16, to discuss the Letters of Representation to be issued and the management action plan on quality assurance reviews.

In conclusion, payroll verification to confirm the accuracy of payroll transactions was performed for the pay files that remained at the Department. However, the Department was not provided with such assurance in fiscal year 2014-15 for the pay files transferred to the common service provider. No recommendation will be made, given that a government-wide meeting will be held this fiscal year to resolve the matter.

3.3 Non-insured health benefits

Audit criterion: Non-insured health benefits claims are reconciled with Health Information Claim Processing System (HICPS) funding requests. The external auditor's report on the adequacy of the service provider's controls is obtained and reviewed by management. Recoveries for non-insured health benefits claims are reviewed for accuracy and completeness.

The Non-Insured Health Benefits (NIHB) Program provides eligible First Nations and Inuit populations with coverage for a limited range of medically necessary health-related goods and services that are not provided through private insurance plans, provincial and territorial health or social programs or other publicly funded programs. This includes pharmacy, dental, vision, mental health, medical supplies and equipment, medical transportation, provincial health premiums and other health care benefits. In fiscal year 2014-15, expenditures for non-insured health benefits totalled $689 million.

Reconciliation of NIHB claims processed in the Health Information Claims Processing System with funding requests

Dental, pharmacy and medical supplies and equipment claims, which account for a significant part of all non-insured health benefits expenditures, are mostly processed and paid by an external service provider through the Health Information Claim Processing System (HICPS). The service provider summarizes the claims processed and submits a claim for reimbursement. These claims are analyzed and reconciled with information found in the HICPS and approved for payment (FAA Section 34). Claims are then forwarded to CFOB for FAA Section 33 certification and the payment is processed accordingly. These analyses and reconciliations are key controls aimed at ensuring that non-insured health benefits expenses are accurately recorded and processed, in compliance with FAA requirements. These and other procedures and controls are documented for reference in the NIHB HICPS financial control framework. The audit concluded that the procedures and controls regarding non-insured health benefits expenditures processed through HICPS are applied effectively.

Review of the external audit report over HICPS claim processing

Health Canada obtains an annual audit report from the external service provider. The corresponding audit is carried out by external auditors and provides assurance that the service provider's controls are appropriately designed and operating effectively in a manner that ensures the validity, completeness and accuracy of the claims processed. As in previous years, an unqualified opinion was issued by the external auditors for fiscal year 2014-15. NIHB Program management indicated their acceptance of the audit report.

Recoveries for non-insured health benefits claims are reviewed for accuracy and completeness

As part of the Tripartite agreement between the federal government, the British Columbia (BC) government and the BC First Nations Health Council, responsibility for the design and delivery of First Nations health services in BC (including pharmaceutical, medical supplies and equipment and dental benefits) were transferred to the First Nations Health Authority (FNHA). In order to support a smooth transition to the FNHA in BC, it was agreed that Health Canada would continue to administer and deliver pharmaceutical, medical supplies and equipment and dental benefits to the First Nations community in BC. Costs of providing these benefits are reimbursed by the FNHA.

The Payment Requisition and Reconciliation Committee (PRRC) provides oversight of the recovery for non-insured health benefits from the FNHA. On a bi-monthly basis, the PRRC reviews non-insured health benefit claims and determines the amount to be recovered from the FNHA. The audit concluded that the procedures and controls regarding recoveries for non-insured health benefits claims are reviewed for accuracy and completeness.

In conclusion, non-insured health benefits claims are reconciled with Health Information Claim Processing System (HICPS) funding requests, an external auditor's report on the adequacy of the service provider's controls is obtained and reviewed by management and recoveries for non-insured health benefits claims are reviewed for accuracy and completeness.

3.4 Purchase of goods and services

Audit criterion: Purchase orders over $10,000 are reviewed for accuracy, completeness and validity.

Review of contracts over $10,000

Proposals for the procurement of goods and services are reviewed and/or prepared by procurement specialists. This helps to ensure that contractual documents are in accordance with government contracts regulations and relevant policies and departmental delegation of financial authorities, and that an appropriate procurement vehicle is used. This review also provides assurance over the validity and accuracy of the purchase of goods and services over $10,000.

The audit found that purchase orders over $10,000 were reviewed for accuracy, completeness and validity.

3.5 Acquisition card purchases

Audit criterion: Monitoring of monthly acquisition card reconciliations and quality assurance reviews of acquisition cards transactions are performed.

Official reconciliation report

Acquisition card purchases are paid prior to the reconciliation of purchases by the cardholder and the FAA Section 34 certification, as permitted under the TBS Directive on Account Verification. To provide assurance over the accuracy and completeness of acquisition card purchases, cardholders are responsible for completing transaction reconciliations to their statement of accounts. CFOB monitors these reconciliations to ensure that they are adequately completed. Interviews conducted with CFOB and a document review provided evidence that this oversight role is adequately fulfilled. The audit found that monitoring of reconciliations was performed.

Quality assurance over acquisition cards

In addition to the monitoring of monthly reconciliations, financial officers conduct quality assurance reviews of acquisition card transactions. All transactions are subject to a minimal quality assurance procedure to ensure that all items included on a statement are reconciled in SAP and that FAA Section 34 is appropriately documented. High-risk transactions undergo a full quality assurance review, while lower-risk transactions are subject to a full quality assurance on a sample basis. As noted in Section 2.2, a sample of lower-risk transactions has been included as part of the statistical sampling exercise through the use of SAP, as is the case for accounts payable transactions. Through this review, selected transactions are examined for appropriate supporting documentation and sign-off. Errors identified through this review are recorded, and action plans are developed to address issues noted.

The audit tested a sample of monthly statements, which included transactions that underwent a full quality assurance to determine whether it was performed adequately and appropriately. The audit found that quality assurance reviews of acquisition card transactions were performed adequately. While errors on acquisition card transactions have been identified, as noted in Section 2.2, the error rate on acquisition cards has remained high despite efforts to reduce it. A recommendation has been made in Section 2.2 of this report (Recommendation 2).

Overall, the monitoring of monthly acquisition card reconciliations was operating effectively, and quality assurance reviews were conducted. However, improvements are required to reduce errors on acquisition card transactions.

3.6 Drug submissions and evaluation revenues

Audit criterion: Reconciliation of billing information from the Drug Submission Tracking System (DSTS) and invoices from SAP is performed. Cash receipts are promptly recorded and deposited.

Reconciliation between the Drug Submission Tracking System and SAP

Drug submission and evaluation fees are tracked in the Drug Submission Tracking System (DSTS), which is operated by the Health Products and Food Branch (HPFB) and is outside of SAP. As there is currently no interface between DSTS and SAP, DSTS data has to be input manually into the financial system. The absence of an interface also requires the regular reconciliation of the amounts recorded in the two systems, to ensure accuracy and completeness.

On a monthly basis, CFOB reconciles invoiced amounts in the invoicing system (DSTS) against SAP, to ensure the completeness and accuracy of the revenues recorded in SAP. The audit found that the reconciliations were performed.

Deposit of cash receipts

The TBS Directive on Receipt, Deposit and Recording of Money requires that all money be deposited as soon as possible and within appropriate time frames. In 2014-15, Health Canada's Policy for the Receipt and Deposit of Public Money required that all money received in the Department be sent to Finance within 24 hours of receipt.

As part of its work to support the Annex to the Statement of Management Responsibility, the Internal Control Division found that some receipts had not been forwarded to Finance within the required time frame because of operational constraints. As a result, the Health Canada Policy for the Receipt and Deposit of Public Money was updated to require that all money received in the Department be sent to Finance within two business days. Finance implemented measures to monitor the timely recording of receipts in the financial system.

The audit found that Finance was conducting the monitoring of receipts. The monitoring confirmed that the majority of receipts was forwarded to Finance in a timely manner. However, some receipts for medical device applications were not sent to Finance within the required time frame as a result of administrative issues within the Medical Device Bureau, Health Products and Food Branch. The audit found that management from the Bureau are taking measures to update operating procedures to ensure that receipts are sent to Finance within the required time frame.

In conclusion, tests conducted on fee revenues demonstrated that the reconciliation activities were performed, and receipts are promptly recorded and deposited in all material aspects.

3.7 Accounts receivable

Audit criterion: Suspense and clearing accounts are monitored and cleared.

Health Canada's Policy on Receivables Management and Charging Interest on Overdue Accounts requires that all receivables be recorded promptly in SAP when an amount can be reasonably estimated against a specific debtor. Failure to do so can result in receivables not being collected and inaccurate financial reporting. One of the most significant sources of accounts receivable comes from the recovery of overpayments from contribution agreements.

The audit compared reports from the Monitoring Contract and Contribution System (MCCS) to the accounts receivables recorded in SAP. The audit found instances where recoveries identified in fiscal year 2014-15 were not recorded in the departmental financial system until the following fiscal year. The Department was in the process of implementing a new system for the management of grants and contributions agreements (GCIMS), including a debt management module for improving the accounts receivable process. Management expects the module to be implemented in fiscal year 2015-16. Controls over the recording of receivables, as well as roles and responsibilities, are being updated to align with the system implementation. In the meantime, an estimate of the receivable amounts resulting from contribution agreements recorded at year-end is a compensating control.

In conclusion, improvements are required to ensure that grants and contributions agreement recoveries are recorded in the departmental financial system.

Monitoring and reconciliation of suspense and clearing accounts

CFOB performs the monitoring and reconciliation of various suspense and clearing accounts, including deposits, petty cash and interdepartmental settlements.

These reconciliations are generally performed on a monthly basis, but the frequency of the reconciliation may differ, depending on the nature of the account or the volume of activity. Discrepancies and variances identified through the reconciliation process are raised with cost centres. Regular monitoring and the clearing of suspense accounts help to ensure the accuracy of financial information.

Evidence was obtained to support that reconciliations were performed on a regular basis and that account balances were verified.

The suspense and clearing accounts were monitored and cleared; however, improvements are required to ensure the timely recording of receivables.

Recommendation 5

It is recommended that the Chief Financial Officer and the Senior Assistant Deputy Minister, First Nations and Inuit Health Branch, implement controls to ensure the timely recording and monitoring of receivables arising from recoveries of contribution amounts in the departmental financial system.

Management response

3.8 Capital assets

Audit criterion: The annual capital assets review is conducted to ensure proper accounting of capital assets.

Health Canada's Asset Management Policy Framework defines capital assets as assets with a useful life greater than one year and a per-item cost of $10,000 or greater. The Department holds a variety of capital assets including buildings, machinery, equipment and vehicles. Regular reviews of the capital asset inventory are needed to ensure the accuracy of the information found in the financial statements.

Physical count of capital assets

CFOB conducts an annual review of its capital asset inventory with a view to ensuring that Health Canada's capital assets are well-managed and properly accounted for. Once the review has been completed, the necessary changes and adjustments are made in the departmental financial system. In fiscal year 2014-15, the Materiel and Assets Management Division performed a physical verification on all high dollar value items, as well as a sample of other assets for quality assurance.

The audit reviewed the reports produced as part of the annual review exercise, as well as the quality assurance procedures to ascertain whether appropriate actions were taken to address the issues raised in the reports. The review showed that the physical count of the capital asset inventory was conducted and appropriate actions were taken to address issues raised.

In conclusion, an annual capital assets review is conducted to ensure proper accounting of capital assets.

C - Conclusion

The audit concluded that select key financial controls in support of the departmental financial statements are generally operating effectively.

Improvements are required to strengthen the management of specimen signature cards; reduce the error rates for acquisition card transactions; ensure that journal voucher entries are supported with appropriate documentation; ensure that reconciliations of the Grants and Contributions Information Management System to the departmental financial management system are conducted; and ensure timely recording of recoveries from contribution agreements in the departmental financial system.

The areas for improvement that have been noted will collectively strengthen the effectiveness of the Department's internal controls over financial reporting.

Appendix A - Lines of enquiry and criteria

Appendix B - Scorecard

Appendix C - Health Canada's internal control over financial reporting framework

Internal Control over Financial Reporting Framework (ICFR)

Control Environment

• Entity Level Controls
• Information Technology General Controls

Financial Risk Assessment and Financial Risk Management

• Financial Reporting Objectives
• Financial Reporting Risks

Monitoring

• Ongoing and Separate Monitoring and Assessment
• Reporting and Deficiencies

Control Activities

For each business process below:

1. integration with assessment of risks over financial reporting
2. supporting policies and procedure assessment
3. management of information (e.g., IT Applications Controls and Database and Records Management controls)

Management of Parliamentary Appropriations

• Budgeting/Forecasting
• Funding Resource Allocation

Revenue/Receivables/Receipts

• Revenues
• Accounts Receivable
• Cash Receipts

Purchasing/Payables/Payments

• Transfer Payment
• Contracting/Procurement
• Travel
• First Nations and Inuit Health Benefits

Payroll

• Employee Data Management
• Payroll Processing

Capital Assets

• Asset Lifecycle Management

Financial Statement, Year-End and Reporting

• General Ledger Maintenance
• Year-end Processes
• Financial Statements Preparation
• Accruals and Management Estimates

Information and Communication

• Financial Reporting Information
• Internal Communications
• Internal Control Information
• External Communications

Appendix D - Risk profile of transactions

High-risk transactions include highly sensitive transactions, for example when an error in payment is non-recoverable or when payments are largely judgmental, subject to interpretation, involve very large dollar amounts or are considered highly error prone.

Low-risk transactions include transactions that are not sensitive in nature, have little or no potential financial loss associated with them or have a low error rate with a low dollar-value impact of error, usually to medium dollar value, and are recoverable.

Source of information: Shared Services Partnership's Statistical Sampling Framework.

Appendix E - Corrective actions and follow-up activities

The Treasury Board Secretariat Directive on Account Verification notes that financial officers are responsible for requesting corrective action when critical errors are identified during the quality assurance process for payment authority. Based on the results of the sampling period, accounting offices will take immediate corrective actions and may also determine that an action plan for follow-up be developed.

Corrective actions

All critical errors identified during the pre- and post-payment process must be corrected by the accounting office, and the Section 34 manager must be informed of the error. A critical error is an error serious enough to require that the payment should not be/have been made, for example:

• Section 34 is not signed by an authorized officer for the cost centre.
• Back-up documentation does not support the payment.
• Amount of the payment is not in accordance with or exceeds the price or payment terms contained in the procurement document.

For non-critical errors, corrections will be made by the accounting office when it is considered efficient; however, in all cases the Section 34 manager should be informed of the error. Non-critical error is an error identifying that the requirements of Section 34 account verification were not fully complied with at the time of payment; however, the error was not serious enough to prevent payment or to negatively impact financial information recorded in the financial system.

If the account verification completed by a specific Section 34 signatory is found to be continually inadequate, there may be a requirement to suspend Section 34 authority.

Follow-up activities

Accounting offices will implement follow-up activities aimed at reducing errors, while strengthening the Department's oversight role.  Follow-up will include, for example:

• Reviewing sampling results and identifying problematic areas.
• Working with branches, programs and cost centre managers to further define issues and assist in identifying potential solutions.

Further analysis may be required by the accounting office to identify whether a specific organization, transaction type, etc., is the cause of the error. A separate quarterly sample for continued errors for these transactions may be generated.

Source of information: Shared Services Partnership's Statistical Sampling Framework.

Appendix F - Overview of progress made on prior year's recommendations

Recommendation 1

Review and strengthen access controls for the departmental financial system to ensure that mutually exclusive roles cannot be assigned to a single user.

Accountability: Chief Financial Officer Branch (CFOB)

Recommendation 2

Conduct cyclical and ongoing monitoring activities for salary payments

Accountability: Corporate Services Branch