Horizontal Audit of Information Management at Health Canada and Public Health Agency of Canada
Final Report: Executive Summary and Management Response and Action Plan
August 2025
Prepared by the Office of Audit and Evaluation
Health Canada and the Public Health Agency of Canada
Note: The complete audit report is available upon request. Please send an email to oae-bae@phac-aspc.gc.ca.
On this page
Executive summary
Engagement objective
The objective of this audit was to determine whether Health Canada ("HC" or "the Department") and Public Health Agency of Canada ("PHAC" or "the Agency") have implemented an effective information management control framework that includes, but is not limited to accountability, roles, responsibilities, policy framework, monitoring, and reporting to mitigate information management (IM) risks.
Engagement scope
This audit included assessments of IM frameworks, including its governance structures, controls and tools, and IM resources within HC and PHAC. The audit covered fiscal years 2022-2023 and 2023-2024.
The scope did not include the following:
- The assessment of ATIP requests and litigation readiness, as these processes are complex in nature and are being considered for inclusion as part of the Risk-Based Audit Plan.
- The assessment of technologies to efficiently and effectively store and protect information, as this aspect was deemed a lower risk and is being considered for potential future audit coverage as part of the Risk-Based Audit Plan.
What we found
The audit found that Health Canada and the Public Health Agency of Canada generally adhere to the TBS requirements and policies on information management. The roles and responsibilities of employees are clearly defined, and the Digital Transformation Branch (DTB) is making efforts to improve its information architecture. However, the audit found that the following areas could be improved:
- Apart from performance metrics on the implementation of SharePoint as a Corporate Repository (SACR), there was no formal monitoring or reporting of compliance with IM policy requirements across the Department and Agency.
- The 2023 to 2025 IM Plan is still in draft format, and DTB needs to either update the plan, or develop another way to reflect current IM plans and activities for the Department and Agency. DTB should also add specific mechanisms to measure progress of deliverables.
- There are currently two mandatory IM training courses available: Fundamentals of Information Management and Introduction to SACR. The Fundamentals of Information Management course is only completed upon initial hiring at the Department or Agency. While there are additional IM courses available, they are only recommended, and none of them are mandatory for IM advisors or employees.
Management Response and Action Plan
Recommendation 1
The ADM of the Digital Transformation Branch should ensure that an Information Management plan or strategy is formalized, updated, and published so that information of business value is properly stored and accessible to adhere to TBS requirements.
Management Response and Planned Management Action
Management agrees with this recommendation.
Action: Publish IM Strategy for 2025 to 2030
Deliverable: IM Strategy published on mySource.
Expected Completion Date: Q1 (2025-2026)
Responsibility: Digital Transformation Branch (DTB)
Recommendation 2
The ADM of the Digital Transformation Branch should ensure that an IM Plan and an IM Strategy include mechanisms to measure IM deliverables. Additionally, a formal monitoring process should be implemented to ensure that classification, categorization, storage, and disposal of IBV is done effectively and correctly.
Management Response and Planned Management Action
Management agrees with this recommendation.
Actions:
- Create an 'IM Prioritization Map' as mechanism to measure and align IM Program components and deliverables against the 5-year timeline of the IM Strategy. Deliverable: Append IM Prioritization Map to the published IM Strategy as mechanism to track priorities and related deliverable for the IM Program.
Expected Completion Date: Q1 (2025-2026)
Responsibility: Digital Transformation Branch (DTB) - Develop a monitoring SOP for key IM requirements, in line with IM standards, policies, and behaviours for responsible management of IBV at HC and PHAC.
Deliverable: Reporting requirements inform IM KPIs which align to enterprise standardization rules and demonstrate effective management of IBV at HC and PHAC.
Expected Completion Date: Q2 (2025-2026) Define Reporting Requirements and Q4 (2025-2026) Operationalize Reporting Requirements.
Responsibility: DTB
Recommendation 3
The ADM of the Digital Transformation Branch should ensure that IM training courses are made mandatory for all employees in IM Advisor roles and tracked for all other employees at the Department and Agency.
Management Response and Planned Management Action
Management agrees with this recommendation.
Action: Add the IM Specialist course to list of mandatory training requirements for the IM Program at HC and PHAC.
Deliverable: Statistics are tracked and used to report on status of mandatory IM Training requirements at HC and PHAC.
Expected Completion Date: Q3 (2025-2026)
Responsibility: DTB