Financial Statements for the year ended March 31, 2015

Annex to the Statement of Management Responsibility Including Internal Control over Financial Reporting - Fiscal year 2014-2015

Table of Contents

1. Introduction
2. Departmental system of internal control over financial reporting
3. Departmental assessment results during fiscal year 2014-2015
4. Departmental action plan

1. Introduction

This document provides summary information on the measures taken by Citizenship and Immigration Canada (“CIC” or “the Department”) to maintain an effective system of internal control over financial reporting (ICFR), including information on internal control management and assessment results and related action plans.

Detailed information on CIC’s authority, mandate, and program activities can be found in its latest Departmental Performance Report at [HYPERLINK STILL MISSING] and in its most recent Report on Plans and Priorities.

2. Departmental System of Internal Control over Financial Reporting

2.1 Internal Control Management

The department has a well established governance and accountability structure to support departmental assessment efforts and oversight of its system of internal control. A departmental internal financial control management framework, approved by the Deputy Head, is in place which includes:

• organizational accountability structures as they relate to internal financial control management to support sound financial management and reporting, including roles and responsibilities for senior managers in their areas of responsibility for control management;
• a code of conduct, including values and ethics;
• on-going communication and training on statutory requirements, policies, and procedures for sound financial management and control; and,
• monitoring and regular updates on internal financial control management as well as the reporting of annual assessment results and related action plans to the Deputy Head and the Departmental Audit Committee.

CIC’s senior management recognizes the importance of setting the tone from the top to help ensure that staff at all levels understand their roles in maintaining effective systems of ICFR and are equipped to exercise these responsibilities effectively. The Department’s focus is on ensuring that risks are managed well through a responsive and risk-based control environment that enables continuous improvement and innovation.

2.1.1 Key positions, roles and responsibilities

The key positions and committees responsible for maintaining and reviewing the effectiveness of the Department’s system of ICFR are outlined below.

Deputy Minister: As Deputy Head, the Deputy Minister is the Department’s accounting officer and assumes overall responsibility and leadership for the measures taken to maintain an effective system of internal control. In this role, the Deputy Minister chairs the Department’s Executive Committee, and she is a member of the Audit Committee.

Chief Financial Officer (CFO): The CFO reports directly to the Deputy Minister and provides leadership for the coordination, coherence and focus on the design and maintenance of an effective and integrated system of ICFR, including its annual assessment. The CFO is a member of the Executive Committee and he generally attends the meetings of the Audit Committee.

Senior departmental managers: Senior departmental managers in charge of program delivery or corporate branches are responsible for maintaining and reviewing effectiveness of the portions of the system of ICFR falling within their area of responsibility.

Chief Audit Executive (CAE): The CAE reports directly to the Deputy Minister and provides an independent assurance through periodic internal audits on the effectiveness of risk management, control and governance processes, which are instrumental to the maintenance of an effective system of ICFR. The CAE is a member of the Executive Committee and he attends the meetings of the Audit Committee.

Audit Committee: The Audit Committee is an advisory committee that provides objective advice and recommendations to the Deputy Minister on the Department’s risk management, control and governance frameworks and processes. The Audit Committee is comprised of five members, including three external members. It reviews CIC’s Corporate Risk Profile, and its system of internal control, including the risk-based assessment plan, annual assessment results and progress on implementation of remediation action plans related to the system of ICFR.

Executive Committee (ExCom): As CIC’s senior decision-making body, ExCom reviews, approves and monitors the Corporate Risk Profile and the departmental system of internal control. ExCom is supported, among others, by the following committees: the Policy Committee, which develops policy; the Business Operations Committee, which oversees operational delivery and the innovation agenda; and the Management Accountability Committee, which focuses on a strategic agenda to strengthen departmental accountability.

Departmental Management Committee (DMC): The DMC is a regular information-sharing forum for senior managers to connect on key management and business developments.

Working committees: A number of working committees inform and advise senior management on key segments of the Department’s business.

2.1.2 Key measures taken by CIC

CIC’s control environment also includes a series of measures to equip staff to manage risks effectively by raising awareness, providing appropriate knowledge and tools, and developing skills.

Key measures include the following:

• a Values and Ethics Champions Network, aiming to solidify linkages between values and ethics regional and sector champions across the organization;
• a departmental Code of Conduct supported by the Deputy Minister as Values and Ethics champion;
• the Office of Conflict Resolution under the Deputy Minister;
• a Financial Policies and Internal Controls Division reporting to the Deputy CFO;
• annual performance agreements with clear financial management responsibilities for all executives;
• training programs, communications and tools in core areas of financial management;
• departmental directives, procedures and guidelines tailored to CIC’s business and control environment;
• a periodically updated Delegation of Spending and Financial Authority Instrument;
• the documentation of main business processes and of the related key financial risks and control points to support the management and oversight of its system of ICFR;
• secure financial information technology systems to achieve greater security, integrity, efficiency and effectiveness, based on approved system change plans;
• internal client service standards for the Department; and,
• formal internal quarterly reporting on achievements by senior management to the Executive Committee, as well as the tracking of the use of budgetary authorizations and spending limits effective at the Department.

2.2 Service Arrangements Relevant to Financial Statements

The Department relies on other organizations for the processing of certain transactions that are recorded in its financial statements as follows:

Common arrangements:

• Public Works and Government Services Canada (PWGSC) centrally administers the payments of salaries and the procurement of goods and services, as per the Department’s Delegation of Spending and Financial Authority Instrument, and also provides accommodation services;
• Treasury Board Secretariat provides the Department with information used to calculate various accruals and allowances, such as the accrued severance liability;
• The Department of Justice provides legal services to CIC; and,
• Shared Services Canada (SSC) provides IT infrastructure services to the Department in the areas of data centre and network services.

Specific arrangements:

• The Department of Foreign Affairs, Trade and Development (DFATD) provides common administrative services and support for the Immigration Program outside Canada, under a memorandum of understanding with CIC. Common administrative services include accommodations, revenues and payments processing, accounting and telecommunications. Program support is offered by both Canada-based officers and locally engaged staff in missions abroad. DFATD also prepares periodic financial reports for CIC staff on the revenues collected and the expenses incurred directly in the field;
• The Department of Employment and Social Development Canada (ESDC) provides passport delivery and processing services to CIC. These services are governed by a service level agreement with CIC which ensures optimal and sound financial management of the Passport Program and the recovery of costs associated with Passport Service Delivery and Operations, Receiving Agent Services, Transition and Modernization costs and Internal Services provided by Service Canada, an initiative operating within ESDC; and,
• Medavie-Blue Cross provides claims administration for the Interim Federal Health Program (IFHP). The IFHP reimburses service providers for emergency and essential health-care services in cases where eligible clients, such as refugees, do not qualify for provincial, territorial or private health coverage.

3. Departmental Assessment Results During Fiscal Year 2014-2015

During 2014-2015, the Department has practically completed the design and operating effectiveness testing of all key financial control areas.  On-going monitoring was also performed according to plan.

3.1 Design Effectiveness Testing of Key Controls

In the current year, the department completed design effectiveness testing of the financial controls that are embedded within the following business processes:

• grants to individuals - Resettlement Assistance Program;
• revenue collection, salaries and operating expenses (at one Canadian case processing location);
• revenue and operating expenses from abroad (at one international location);
• accounts payable, accrued liabilities and payments; and,
• employee future benefits.

The existence of relevant and strong financial controls was confirmed through the documentation and design assessment of the above significant accounts or business processes. The main control objectives pertaining to each account or business process were generally well supported by appropriate key control activities. Despite this overall positive assessment, control design remediation requirements were identified in the following areas:

• existence of documentary evidence of the application of certain key controls, such as significant reviews, reconciliations and approvals;
• performance of review of certain documents, transactions and reconciliations;
• full compliance of transactions with the approved delegated financial authorities within the Department; and,
• segregation of duties within the user profiles of certain computer applications.

Remediation of key financial control deficiencies has substantially advanced in these control areas for the above significant accounts or business processes, and they will all have been remediated by the end of fiscal year 2015-2016.

As well, in 2014-2015, CIC substantially advanced the design effectiveness testing of the key financial controls embedded within the transfer payments to other levels of government business process. This work will be completed in 2015-2016, and the results will be disclosed in next year’s annex.

3.2 Operating Effectiveness Testing of Key Controls

In 2014-2015, the Department completed operating effectiveness testing of the key financial controls that are embedded within the following business processes:

• grants to individuals - Resettlement Assistance Program;
• revenue collection, salaries and operating expenses (at one Canadian case processing location);
• revenue and operating expenses from abroad (at one international location);
• immigrant loans;
• accounts payable, accrued liabilities and payments; and,
• employee future benefits.

Several of these processes’ key financial controls operated effectively throughout the periods that were tested. However, some of them were not fully effective and the Department identified remediation requirements in the following areas:

• existence of documentary evidence of the application of certain key controls, such as significant reviews, reconciliations and approvals;
• performance of review of certain documents, transactions and reconciliations; and,
• full compliance of transactions with the approved delegated financial authorities within the Department.

Remediation of key financial control deficiencies has substantially advanced in these control areas for the above significant accounts or business processes, and they will all have been remediated by the end of fiscal year 2015-2016.

As well, in 2014-2015, CIC substantially advanced the operating effectiveness testing of key financial controls embedded within the transfer payments to other levels of government business process. This work will be completed in 2015-2016, and the results will be disclosed in next year’s annex.

3.3 On-going Monitoring of Key Controls

As part of its ICFR Framework, CIC has pursued ongoing monitoring of the key financial controls that are embedded within the main business processes existing at Canadian case processing locations, Canadian regional offices and international locations.

In 2014-2015, the Department completed its planned on-going monitoring by either substantially advancing or completing the assessment of key financial controls exercised at one Canadian case processing location, one Canadian regional office and three international locations.

CIC also completed its planned on-going monitoring of the key financial controls embedded within the Interim Federal Health Program expenses business process.

As a result of on-going monitoring, the Department identified remediation requirements in the following areas at the locations where assessments were completed during the year:

• existence of documentary evidence of the application of certain key controls, such as significant reviews, reconciliations and approvals;
• full compliance of transactions with the approved delegated financial authorities within the Department; and,
• performance of review of certain documents, transactions and reconciliations.

Remediation of key financial control deficiencies is substantially advanced in these control areas, and they will all have been remediated by the end of fiscal year 2015-2016.

As well, in 2014-2015, CIC substantially advanced its planned on-going monitoring of the information technology general controls (ITGCs), and of the key financial controls related to the following business processes:

• transfer payments to service provider organizations (at Headquarters and selected Canadian regional offices); and,
• financial closing and reporting.

This instance of on-going monitoring of the ITGCs and of the key financial controls that are embedded within the above business processes will be completed in 2015-2016, and the results of this work will be disclosed in next year’s annex.

4. Departmental Action Plan

4.1 Progress During Fiscal Year 2014-2015

During 2014-2015, CIC has practically completed all work related to its initial assessment cycle and has continued to bring significant improvements to its key financial controls. Below is a summary of the main progress achieved by the Department based on the plans identified in the previous fiscal year’s annex:

4.2 Status and Action Plan for the 2015-2016 Fiscal Year and Subsequent Years

Building on progress to date, CIC is positioned to complete the initial assessment of its system of ICFR in 2015-2016.  Following that year, the Department will be fully applying its rotational on-going monitoring plan to reassess control performance on a risk basis across all control areas.  The status and action plan for the completion of the identified control areas for the 2015-2016 fiscal year is as follows: