Audit of Investment Planning of Capital Assets at Health Canada

Final Report
March 2022

Table of contents

• Executive summary
  • Executive summary - Context
  • Executive summary - Audit objective.
  • Executive summary - Findings
  • Executive summary - Conclusion
• Prioritization process
  • Prioritization process - Context
  • Prioritization process - What did we expect to find?
  • Prioritization process - Findings
  • Prioritization process - Conclusion
  • Prioritization process - Recommendation 1
  • Prioritization process - Recommendation 2
  • Prioritization process - Management response
• Oversight bodies
  • Oversight bodies - Context
  • Oversight bodies - What did we expect to find?
  • Oversight bodies - Findings
  • Oversight bodies - Conclusion
  • Oversight bodies - Recommendation 3
  • Oversight bodies - Recommendation 4
  • Oversight bodies - Management response
• Monitoring
  • Monitoring - Context
  • Monitoring - What did we expect to find?
  • Monitoring - Findings
  • Monitoring - Conclusion
• Appendix A - Scorecard
• Appendix B - About the audit

Executive summary

Context

The Treasury Board (TB) defines departmental investment planning (IP) as the process to ensure that the Government of Canada has the necessary assets and services in place to support program delivery to Canadians. The TB Policy on the Planning and Management of Investments, which came into effect in April 2019 and was updated in May 2021, governs investment planning across the federal public service. At Health Canada (HC), investment planning (IP) for capital assets is a centralized process overseen by the Cost Recovery and Investment Planning Directorate (CRIPD), within the Chief Financial Officer Branch (CFOB). As this is currently the only centralized aspect of the IP process, this audit focused on the prioritization of vote-5 capital funds at HC at both the asset class and departmental strategic levels, and also examined the tools available to monitor and respond to any variances in investments.

The current HC Investment Plan covers the period of 2018-19 to 2022-23. This plan identified $94.0M of capital investments across four asset classes: IT capital assets, real property capital assets, laboratory equipment, and fleet.

Each asset class performs its own annual prioritization process before the Executive Committee – Finance, Investment Planning and Transformation (EC-FIPT) approves the investments. The Directors General – Investment Planning (DG-IP) Committee supports this oversight role. Capital funding allocations are monitored through three key tools: The Investment Planning Monthly Variance Report (IP-MVR), the Investment Planning Dashboard, and the Capital Dashboard.

Prioritization process overview

• Step1 - Asset Class Prioritization
• Step 2 - DG-IP
• Step 3 - EC-FIPT

Audit objective

To determine if Health Canada (HC) manages its capital investments adequately and in support of its departmental objectives.

The scope of the audit focused on the prioritization of vote-5 capital funds at HC. The most recent investment plan was for the period of 2018-19 to 2022-23 and identified $94.0M of capital investments over the five-year period. This audit reviewed recently approved capital requests in the four asset classes. This audit did not look at project management, nor the acquisitions process.

Findings

Best practices

• The structure of the IP oversight process was found to be appropriate and well aligned with the governance roles identified in Health Canada's Investment Planning (IP) framework.
• Terms of reference were documented for the key oversight committees, detailing their key roles and responsibilities.
• Appropriate monitoring tools have been developed and were used to inform senior management of the status and use of capital.
• Reporting cycles have been established and were operating as intended on a bi-monthly schedule.
• Capital funds were monitored and reallocated throughout the year to respond to emerging needs and balance budget variances (overages and underages).

Areas for improvement

• Updates should be made to the process used to assess and prioritize the capital request from the four asset classes. This includes 1) incorporating a formal, standardized risk assessment component to the capital assessment and prioritization process and, 2) improved documentation of the analysis undertaken in prioritizing the capital spend.
• The material presented to the DG-IP Committee should include risk-based information on capital options and recommendations.
• Terms of reference documents should be updated to reflect the current operations of the oversight committees.
• Records of decisions should be more detailed to reflect the discussions and rationales for key decisions.

Conclusion

Overall, we found that Health Canada has managed its capital investments adequately and in support of departmental objectives. However, we found gaps in the strategic risk-based prioritization of capital funds and the documentation of key analyses and decisions.

Prioritization process

Context

HC relies on subject matter experts, also known as asset class leads, to prioritize investments within four categories (real property, IM/IT, laboratory equipment, and fleet), before they are prioritized at the departmental level. Each investment category is unique and may use different criteria to prioritize the investments within their class. Real property and IT asset class prioritization are led by the Corporate Services Branch (CSB), while fleet is co-led by CSB and the Regulatory Operations and Enforcement Branch (ROEB). Finally, the laboratory equipment asset class is led by the Laboratory Equipment Committee (LEC).

The Cost Recovery and Investment Planning Directorate (CRIPD) sits within the Chief Financial Officer Branch (CFOB) and supports IP processes in various ways, including:

• Providing advice and consultations for asset classes during prioritization processes;
• Analyzing the IP requests from the four asset classes and developing a consolidated and recommended list, which is presented to the DG-IP governance table for challenge and endorsement; and
• Developing and communicating IP monitoring dashboards.

TBS recently updated its policy suite that guides departmental investments. As the lead for investment planning at HC, CRIPD is currently reviewing its IP Framework to ensure it complies with the new requirements and that it continues to guide the departmental IP process.

What did we expect to find?

We expected to find an IP analysis and prioritization process that was clearly established, with documentation to support the rationale for IP recommendations and decisions. We also expected the analysis and decision-making processes to formally incorporate and consider risk.

Findings

CRIPD's role is to provide advice and consultations to the four asset class teams during the asset class prioritization processes, to analyze the IP requests from the four asset classes, and to develop a recommended list for the governance tables.

In developing this list, CRIPD applied the HC IP guiding principles and pillars, as well as their professional judgment to analyze the prioritized lists from each asset class. As part of this analysis, CRIPD aimed to produce options tables, which consider different scenarios under which the capital could be spent. Based on these options, CRIPD produced a "recommended" scenario that prescribes the projects and assets to be included in the capital IP for the year and is to be presented to the DG-IP committee for their review and approval.

Our review of this prioritization process noted that each asset class develops their respective capital request differently. Labs had the most robust process of the four asset classes, providing a priority-based listing of assets and projects, which included context on the impact of not funding the request. While the other classes did not prioritize their requests to the same extent, we found evidence of CRIPD working with the other asset classes to gain an understanding of the risks related to the request and the impacts should it not be funded.

However, while risk is being considered in the process, largely through email exchanges and discussions, a formal, systematic, risk-based approach has not been documented to assess and prioritize the capital request across the four asset classes. More specifically, the current process did not include documentation of the following elements:

• Development of standardized risk-rating criteria that defines what constitutes a "high", "medium", or "low" risk ranking;
• Communication of the risk rating criteria to the four asset classes; and
• Requirement for the asset classes to rate the risk of each item on their capital request, assigning a formal rating for each item, and providing the impact of not funding the request for each individual item.

In addition to the above, we noted that the analysis performed by CRIPD could have been more thoroughly documented and formally linked to the recommended option. The analysis working papers provided did not include the following expected elements:

• The analysis worksheet did not include any instructions or wording to explain the purpose of the analysis, nor how the analysis was performed (i.e., source of the information, steps undertaken, criteria taken into consideration during the analysis);
• The documented analysis was quantitative and did not include any qualitative language to support the thought process related to the numbers (i.e., why the mix was split in that particular way, the pros and cons of respective scenarios);
• The recommended scenario did not document a rationale to explain why it was the preferred option; and,
• The analysis worksheet did not document how the risk profile of each asset or project was considered, nor the short- and long-term impacts of those risks.

As CRIPD conducts a large portion of their analyses through meetings and consultations, related discussions and analyses may have been primarily held verbally. However, we found little evidence of these discussions talking place, other than meeting invites in Outlook.

Documented evidence of thoughtful and thorough analysis is expected to support good stewardship of public funds. Furthermore, the TB Policy on the Planning and Management of Investments requires that investment planning processes are "fair, open, and transparent". In addition, documentation of decision-making processes should be available when governance tables, senior management, or an external reviewer want to better understand the decisions made. Furthermore, proper documentation supports corporate knowledge retention.

Conclusion

While there was evidence to demonstrate that CRIPD was performing a consolidated analysis of IP requests, there are opportunities to add a formal, centralized risk analysis component to the assessment process. Furthermore, the documentation in support of that analysis did not include sufficient detail to demonstrate the parameters of the analysis, the qualitative factors considered during the analysis, or the rationale for the recommendations made.

Recommendation 1

The Chief Financial Officer, with the assistance of the four asset class leads, should improve the current capital prioritization process to integrate the formal assessment of risk in assessing options and prioritizing the request for capital. The risk assessment process should include:

• A formal and documented risk assessment methodology, including risk rating levels (i.e., high, medium, and low risk), and prescribed criteria defining each risk level;
• Communication (and training, as needed) with the four asset class leads on:
  • The risk assessment methodology and use of the methodology; and
  • The requirement to prioritize and rank risks for each item on their respective capital requests, with a description of the impact of not funding them; and
  • Document evidence on the integration of a risk-based assessment process into CRIPD's centralized capital assessment and prioritization processes.

Recommendation 2

The Chief Financial Officer should ensure adequate documentation of the analysis behind, and rationale for capital investment allocation decisions. The analysis should include sufficient information to support the thought process and risk-focused rationale for the preferred option.

Management response

1. CFOB will update the Investment Planning and Reporting Framework. The framework will provide standardized risk assessment criteria and methodology for use by the Investment Class leads and CFOB.
2. CFOB will communicate and provide training, as needed, to the asset class leads on the process and methodology for performing a formal risk assessment of their capital requirements, and ensuring it is included in their prioritization exercises and presentations.
3. CFOB will include documented analysis and a risk assessment in the departmental capital prioritization, the rationale for the recommended approach, and investment options.

Target completion date – March 31, 2022

Oversight bodies

Context

The IP oversight structure at HC is organized into three distinct committees: the Project Review Committee (PRC), the DG – Investment Planning (DG-IP) Committee, and the Executive Sub-Committee on Finance, Investment Planning and Transformation (EC-FIPT). Each committee plays a distinct role in the oversight process.

The PRC Committee membership includes director-level functional heads. The Committee is tasked with conducting quality and completeness checks, recommending projects for gating reviews by DG-IP, and providing regular reports on project performance. While this Committee supports the other two, it is not directly involved in investment planning decisions.

The DG-IP Committee includes director general-level membership and supports the IP process by providing strategic advice on the allocation of the Investment Planning Reserve, ensuring that investments are aligned with departmental priorities and program requirements, and making recommendations to EC-FIPT for approval.

The EC-FIPT Committee includes ADM-level members and is responsible for strategic oversight of IP at HC, and provides final review and approval of recommendations made by the DG-IP Committee.

Each of the committees have a terms of reference (ToR) document to establish the specific role and authority of the committee. Meeting notes for PRC and records of decisions (RoDs) are maintained for all three committees.

What did we expect to find?

We expected to find an appropriate and documented IP oversight structure that provides strategic review and advice as part of decision making and monitoring of IP.

In support of this structure and decision-making process, we also expected to find updated Terms of reference that clearly delineate the roles, responsibilities and operational requirements of the structure, as well as documented RoDs detailing consensus and rationale for decisions.

Findings

Oversight bodies: Structure and role

We found the structure of the committees to be well aligned with the governance roles identified in Health Canada's Investment Planning (IP) framework, including the endorsement of investment priorities by DG-IP before they proceed to EC-FIPT for approval. The IP process is also aligned with TBS's policy, as it is supported by appropriate structures and processes like committees, quality assurance, and the use of independent reviews.

However, we found that, from a role perspective, the DG-IP Committee could have been playing a more strategic role with respect to the decision making and prioritization of projects and assets funded though capital.

As mentioned before, CRIPD is responsible for the consolidation and analysis of the capital funding requests from the four asset classes and presenting a recommendation on the division and allocation of capital funds at HC. However, the analysis performed by CRIPD does not formally document the risk associated with each project or asset, nor the short- and long-term impacts of those risks. As such, the option presented to DG-IP does not document the detailed rationale for the projects and assets proposed, what the impacts of those risks could be in the short and long terms, nor does it demonstrate how the option presented for recommendation best mitigates the high-risk and prioritized areas for capital fund spending.

Additionally, in the past, the DG-IP committee has accepted all recommendations from CRIPD, and those same recommendations have flowed through to EC-FIPT and have been approved there also, with no change. This may indicate that the ability of DG-IP to critically challenge the options has been limited, and that additional, risk-focused information may be needed to enhance the committee's understanding of the impacts of prioritization decisions.

Terms of reference

We found that terms of reference for DG-IP and EC-FIPT were in place. However, they were last updated in 2019 and were found to be outdated. They did not fully reflect the new and updated roles and responsibilities of the committees, nor did they fully align with the committees' operations. As such, we noted instances of nonconformity to the agreed ToRs. First, the frequency of committee meetings did not align with what is stated in the ToR. The DG-IP ToR notes that meetings should be held twice a month, for a total of 24 meetings in the fiscal year. In 2019-20, 17 meetings were held, and in 2020-21, it was 15. However, the COVID-19 response may explain these numbers.

Also, for EC-FIPT, the First Nations Inuit Health Branch is still noted as a member, despite that Branch having been transferred to another department in 2018.

Records of decisions

We found that records of decisions (RoDs) were present for all meetings on record, which is a best practice. However, based on our review of the RoDs, we found inadequate detail for both the DG-IP and the EC-FIPT Committee RoDs. We found that the pros and cons of projects and, ultimately, the final decisions on them were communicated. However, any context or discussion related to the consensus was not included. In instances where capital funds were reallocated, no discussion or rationale was documented to support why reallocations were made to certain projects or asset classes. The RoDs identified approvals of proposed projects, but there was no clear breakdown of how consensus was achieved. Finally, any delegates in attendance were to provide advanced notice to receive voting privileges, yet we found no identification in the RoDs of which delegates had those privileges.

The RoDs have not been structured to capture all key and detailed information from the committee meetings. This lack of explicit rationale for decisions made and lack of documentation on delegates' decision-making authority could put the decisions made by the committees in question.

Conclusion

Overall, the oversight structure is appropriate to oversee investment planning of capital at Health Canada. However, the review found that the DG-IP committee should be playing a more strategic role in the process.

Furthermore, opportunities for improvement were identified related to the administration of the committees and related activities, including updates to the ToRs and documentation of decisions in the RoDs.

Recommendation 3

The Chief Financial Officer should improve the capital decision-making presentation material to ensure that the DG-IP committee receives sufficient documentation from CRIPD as part of the "recommended option" presentation. This presentation material should include: 1) a clear assessment of the risk profile of the prioritized option, 2) the short- and long-term risks associated with the option, 3) how this mix of projects and assets is the best option in mitigating the key risks, and 4) any requests from the asset classes that were ranked "high" risk that were not included in the preferred option.

Recommendation 4

The Chief Financial Officer should improve the administrative function of both the DG-IP and EC-FIPT committees, ensuring that records of decision (RoDs) include key details related to decisions made, and that the terms of reference documents are reviewed and updated to reflect the current state of operations.

Management response

1. CFOB will improve prioritization communication at DG-IP by including a risk assessment of the preferred option, analysis, ranking, as well as options where appropriate. This will also identify risks associated with investments not being funded through the recommended approach.
2. Recent changes have been implemented (September 2021) to ensure that RoDs are more fulsome and include key details related to the decisions that are being made. All terms of reference will be updated to reflect roles and responsibilities and attendance from branches and members. This is expected to be completed by March 31, 2022 to align with the renewal of the Investment Plan and Departmental OPMCA.

Target completion date – March 31, 2022

Monitoring

Context

CFOB produces three monitoring tools that relate to investment planning:

• The Investment Planning Monthly Variance Report (IP-MVR) aims to present the capital situation from the current year's financial forecasting from a branch and project perspective in order to provide transparency on what was spent, and to facilitate decision making at DG-IP and EC-FIPT;
• The IP Dashboard aims to facilitate a review of the status of a project, identify risks and issues, and to discuss mitigation strategies; and
• The Capital Dashboard aims to present the capital situation from the asset class perspective to provide transparency on what was spent and to facilitate decision making at DG-IP and EC-FIPT.

What did we expect to find?

We expected to find the existence and use of monitoring tools, consistent reporting cycles, and response and corrective actions.

Findings

We found that appropriate monitoring tools have been developed and were used to inform senior management of the status and use of capital. Tools have been developed, implemented, and were used in alignment with their intended use.

We found that reporting cycles have been established and were operating as intended on a bi-monthly basis. Reports were communicated in alignment with established cycles. Users noted that the cycles were sufficient and appropriate to meet stakeholder needs.

We found that capital funds were monitored and reallocated throughout the year to respond to emerging needs and balance out budget variances (overages and underages).

Our review of the reallocation of the capital funds throughout the years in scope also found that the large majority of the capital funds available for reallocation during the year were given to lab equipment; with $1.5M reallocated in FY 2019-20 and $3.1M reallocated in FY 2020-21.

Based on discussions with management, funds have been reallocated to lab equipment over the years, as they typically had a readily available listing of capital assets to purchase should funding have become available. The other asset classes were not able to mobilize mid-year capital spend, largely due to resourcing or timing issues, including PSPC procurement limitations. As such, the re-distribution and prioritization of capital funds mid-year was deemed to be appropriate.

Conclusion

Overall, capital funds were monitored throughout the year, and reallocated to respond to emerging needs and balance out budget variances (overages and underages).

Appendix A - Scorecard

Audit of Investment Planning of Capital Assets at Health Canada

Criterion	Risk Rating[1]	Risk to Investment Planning without Implementing Recommendation	Recommendation
1. Processes have been established to support the prioritization of capital funds within each asset class.	3	There is a risk that the analysis and subsequent prioritization of capital assets and projects will not formally and systematically consider the risk and impacts of funding or not funding the capital requests from the four asset classes. Furthermore, there is a risk that the analysis and prioritization process will not be sufficiently robust or detailed to demonstrate the parameters of the analysis, the qualitative factors considered during the analysis, the consideration of risk and impacts of those risks, nor the rationale for the recommendations made. Documented evidence of thoughtful and thorough analysis is expected to support transparency and good stewardship of public funds.	1, 2
2. Oversight bodies provide strategic direction on capital investment planning.	3	There is a risk that the DG-IP committee will not formally receive the risk-based assessment and context via the CRIPD presentation. Without this information, it may be difficult for the DG-IP Committee to critically challenge the options presented by CRIPD, and fully understand and assess the short- and long-term impacts of the prioritization decisions being made.	2
	2	There is a risk that the administration of the committees has not been kept up-to-date, including updated Terms of Reference and detailed records of decisions, diluting the effectiveness of the committees and the quality of the documentation of key discussions and decisions made.	3
3. Information and tools support the monitoring of, and response to capital investment variances.	1	There is a risk that the reallocation of mid-year funds will continue to flow to lab equipment by default. While an internal audit found the reallocation to labs to be appropriate, given the options and circumstances over multiple cumulative years, the amount of money reallocated to labs, and the imbalances it may create, could be significant.	N/A
[1] Residual risk without implementing the recommendation.

Risk Ratings:

1. Minimal Risk
2. Minor Risk
3. Moderate Risk
4. Significant Risk
5. Major Risk

Appendix B – About the audit

1. Audit objective

To determine if Health Canada manages its capital investments adequately and in support of its departmental objectives.

2. Audit scope

The scope of the audit focused on the prioritization of vote-5 capital funds at HC. The most recent HC IP was for the period of 2018-19 to 2022-23 identified $94.0M of capital investments over the five-year period. The audit reviewed recently approved capital requests by the four asset classes.

The audit did not look at project management. The audit also did not look at the acquired services portion of the investment plan.

3. Audit approach

The audit approach included, but was not limited to:

• Interviews with key officials with responsibilities related to staffing.
• Reviews of relevant documentation, policies, standards, guidelines, and frameworks related to staffing.
• Analysis of findings from interviews, document reviews, and detailed testing.

4. Statement of conformance

This audit was conducted in conformance with the International Standards for the Professional Practice of Internal Auditing and is supported by the results of the Office of Audit and Evaluation's Quality Assurance and Improvement Program. The audit criteria were derived from the TBS Core Management Controls and the COSO Enterprise Risk Management Framework. The following audit criteria were used to conduct the audit:

Audit criteria

1. Processes have been established to support the prioritization of capital funds within each asset class.
2. Oversight bodies provide strategic direction on capital investment planning.
3. Information and tools support the monitoring of and response to capital investment variances.