Internal Audit of Integrated Investment Planning

Internal Audit and Accountability Branch
Citizenship and Immigration Canada
June 2013


Table of Contents


Executive summary

The objective of this audit was to provide assurance that governance, systems and people, and results and performance monitoring of integrated investment planning are in place.

Why this is important

Departmental investment planning is the function of allocating and reallocating resources to new and existing assets and acquired services that are essential to program delivery. Departmental investment planning is a key element in achieving value for money and sound stewardship.

Investments in assets and acquired services have significant strategic, public policy, operational, risk and financial implications. Investment planning is founded in an effective regime for planning, decision-making and governance. It underpins a department’s ability to manage investments of highest priority and greatest risk to the Government.

Approximately 52% of the value of investments made by Citizenship and Immigration Canada (CIC) are considered projects. Implementing a comprehensive approach to managing projects that is appropriate for the level of project risk and complexity enhances the likelihood of realizing project outcomes, and thus achieving the Investment Plan.

Key findings

Investment planning at CIC meets policy requirements. An investment planning framework exists, but could benefit from greater clarity on what should be included in the Plan and what should not. Investment planning is partially integrated into the departmental planning process through centrally gathered financial and performance information. Cost estimates for acquired services are based on historical costs, without estimated forecasts. CIC consults with key federal stakeholders as needed. The progress of the projects within the Investment Plan is monitored regularly.

A committee has been established to oversee projects. CIC has implemented a gating system with two levels of formal project management delivery and reporting requirements to ensure compliance with the Policy on Project Management. However, requirements for this system are not always enforced. The Enterprise Project Management Office (EPMO) has enabled the Department to have access to people with project management skills to support them in their work. Formally managed projects are regularly monitored.

Conclusion

Governance over the department-wide integrated investment planning process has been established and meets Treasury Board policy requirements. CIC would benefit from greater clarity with respect to costing future activities and which activities should be included or omitted from the plan.

Capacity requirements for systems and people are being addressed; however, management process requirements are not consistently applied.

Results and performance monitoring in investment planning exist and are being actively completed. Projects within the Investment Plan are being reported against, while assets and acquired services are not.

Overall, CIC is in full compliance with the Policy on Integrated Investment Planning and the Policy on Project Management. Further work is required to determine how these functions can increase their value to the organization.

Management has accepted the audit findings and developed an action plan to address the audit recommendations. See Appendix B for a copy of management’s action plan to address audit recommendations.

Statement of conformance

The conduct of this engagement conforms with the Internal Auditing Standards for the Government of Canada, as supported by the results of the quality assurance and improvement program. We examined sufficient, relevant evidence to support the conclusions reached.

Gibby Armstrong
Chief Audit Executive
Citizenship and Immigration Canada

Background

Investment Planning in the Government of Canada is guided primarily by two Treasury Board policies: the Policy on Investment Planning – Assets and Acquired Services and the Policy on the Management of Projects. These policies and associated standards are intended to help standardize government procedures. Both policies came into full force for all departments on April 1, 2012.

According to the Policy on Investment Planning – Assets and Acquired Services, investment planning includes all assets that are tangible and intangible and that have a future life beyond one year, whether they are Crown-owned, leased or accessed through other arrangements. Investment planning also includes acquired services that are obtained through formal arrangements, such as contracts, memoranda of understanding and letters of agreement, to support the Department in achieving specific outcomes. Investments are the use of resources with the expectation of a future return, such as an increase in output, income or assets, as well as the acquisition of knowledge or capacity.

The CIC Investment Plan 2012–13 to 2016–17 includes spending of $733.6  million, which includes $353.4  million (48%) in Acquired Services, and $380.2  million (52%) in Projects, of which 87% is estimated to be spent on five major projects. The plan accounts for a $0 investment in assets.

The Policy on the Management of Projects delegates project authority to departments, commensurate with the project management capacity of the department relative to the level of project risks. CIC has an organizational capacity of 2 on a scale of 4. At level 2, departments are considered to have a tactical project management capacity, which includes successfully delivering projects, adjusting operations and meeting planned objectives. According to the Policy, projects with costs exceeding $1 million require a project complexity and risk assessment, using a template developed by the Treasury Board Secretariat. For CIC, projects that obtain a score above 2 require Treasury Board oversight. However, the Board can choose to review any project information for approval even if it is within departmental authority.

Within CIC, EPMO is the centre of expertise for the provision of project management support services. In March 2012, EPMO’s mandate was expanded to include departmental investment planning services. EPMO’s role is to ensure investments are properly prioritized, follow project management best practices and ensure that the investment program is routinely monitored and reviewed.

Audit objectives and scope

The objective of this audit was to provide assurance that governance, systems and people, and results and performance monitoring of integrated investment planning are in place.

The scope of the audit included the processes involved in integrated investment planning – specifically, a review of the investment planning cycle, project portfolio management and monitoring practices in place – up to and including September 30, 2012. The audit also covered activities within the Department that contributed to the development of the current update to the CIC Investment Plan 2012–13 to 2016–17.

Detailed recommendations and findings

Finding 1: Investment planning

Investment planning meets policy requirements.

We examined the governance over investment planning in CIC, including what frameworks are in place to ensure compliance with policy, in order to develop the investment planning system, and what guidance is provided to departmental managers. We also examined how investment planning is integrated into strategic planning and budgeting, and how the projected investment costs included in the Plan are developed. We examined how the investment planning process is coordinated among stakeholders, both within CIC and external to the Department. Finally, we assessed how CIC monitors its investments and the investment planning process.

The Policy on Investment Planning requires that departments implement and maintain an investment planning regime that incorporates governance, systems and people requirements. Investment planning should be aligned with the Department’s strategic outcomes, as well as strategic government-wide initiatives as applicable, while considering areas of greatest risk in achieving departmental objectives. The investment plan should be influenced by an assessment of investment performance, and be within reference levels. The costs for investment activities should take into account the whole-of-life cost of stewardship based on the life cycle of assets and acquired services; those activities should then be monitored and reported to senior management regularly.

CIC’s Investment Plan meets policy requirements.

CIC’s Investment Plan meets the requirements of the Policy on Investment Planning – Assets and Acquired Services. CIC’s first Investment Plan 2011–12 to 2015–16 was approved by Treasury Board ministers without condition in March 2012. It is influenced by and supports departmental strategic planning, and it incorporates a departmental and government-wide perspective. It is also aligned to the Program Alignment Architecture where feasible, is within reference levels and is monitored on a regular basis.

CIC’s first Investment Plan also met policy requirements, but areas for improvement were identified and actively integrated into the Plan’s development process. Some of these improvements include in-house plan development – versus using contracted resources – and further integration into the departmental budget system. Investment planning is at an early stage of maturity and could further benefit from greater clarity on which CIC activities should be included in the Plan, and how to accurately capture the current and future costs of those activities.

An investment planning framework exists.

A framework has been developed that includes a method to rank priorities of investments included in the Investment Plan, an accountability regime, alignment with corporate planning, and roles and responsibilities. Since all activities in the Investment Plan are funded, it is not clear how the investment priority rankings are used by senior management in the delivery of the investments. The framework also does not identify which anticipated CIC activities should be included in the Investment Plan (by materiality or expected future life of an investment), which would provide managers with more guidance and establish future consistency.

Investment planning is partially integrated into the departmental planning process.

CIC’s investment plan draws its data from the same sources as the data used for departmental budgeting and strategic planning, and it is coordinated through the Strategic Planning and Priority Branch. While the information between the processes is consistent, the investment planning process is treated separately from in-year and year-to-year budgeting, as the Investment Plan is considered to be a higher-level – and thus less operational – document. CIC has recently implemented a system for monitoring in-year expenditures, with a prioritized list of potential investments to be implemented should funds become available. This process has also been used to reallocate operational budgets to higher-level priorities and is noted as a good practice. The list of priorities is not incorporated into the Investment Plan. However, as the Investment Plan is considered a longer-term document, the list is instead co-managed between the finance and strategic planning groups.

Acquired services forecasts included in the Investment Plan are based on historical costs.

For Acquired Services – which represent 48% of investments – cost estimates are based on past years’ information (for example, professional and special services, transportation and communication, and information services), versus projected costs for the Department. While some of these costs may represent reasonable estimates for future years, some initiatives – such as the implementation of the global Visa Application Centres (VACs) or the accommodation services in the move to Government Workplace 2.0 – will incur variable and different costs than in recent years past.

Project costs are based on estimates outlined in the business cases and project plans. Therefore, project costs often include Assets and Acquired Services costs, as projects often incorporate costs in all three elements. Some projects, such as the various Global Case Management System (GCMS) projects, will most likely result in capitalized assets for the Department, but the method of calculating these future accumulating assets in investment planning does not exist.

The Integrated Investment Plan does not show what portions of the activities will result in capitalised assets.

Existing departmental assets are currently valued at approximately $145.7 million, while asset investments, including accommodation investments, are projected to be $0 per year in the overall investment summary. However, forecasts are broken down later in the Investment Plan and show leasehold improvements requiring an investment of up to $5 million to $6 million per year. Leasehold improvements are also included in the departmental financial statements (as an asset when spent), but are omitted from the overall investment summary in the Investment Plan.

In addition, IT hardware and software assets are costed as individual assets (i.e. one computer and licence per individual, rather than 2,000 for the Department), and are thus not considered capital assets for the purpose of the Investment Plan, even though there is an ever-greening strategy in place. Based on the Investment Plan, it is unclear what asset commitments face the Department over the next five years. Planning for future assets demonstrates sustainability for the Department, but the inconsistency in accounting treatment between the Investment Plan and the financial statements creates the need for additional clarity on accounting rules for investment planning.

CIC consults with key federal stakeholders as needed.

CIC consults with and reports to Treasury Board Secretariat as required by Policy, and engages other federal departments as needed. CIC also heads a government-wide community of practice on investment planning, which gives the Department the opportunity to learn from and share best practices with other stakeholders and partners. EPMO proactively gathered government partners to begin the community of practice. As a result, CIC is in a position to partner with and share good practices with other government departments.

Projects in the Investment Plan are monitored regularly.

Quarterly reporting regularly provides senior management with up-to-date information on the progress of the projects in the Investment Plan; monitoring of asset investments and acquired services are not reported to senior management. Projects within the investment plan have detailed breakdowns of performance against milestones. Progress on investment activities is reported on several senior management committees – such as the Executive Committee and the Management Accountability Committee – ensuring all target audiences have access to the necessary information.

Recommendation 1 (Medium Risk):

CIC should develop formal guidelines for what should and should not be included in the Investment Plan and ensure it is aligned to the new budget planning exercise.

Recommendation 2 (Medium Risk):

CIC should ensure that the forecasting methodology for the Integrated Investment Plan meets the needs of senior management.

Recommendation 3 (Medium Risk):

CIC should monitor and report to senior management on the progress of spending on assets and acquired services (as is currently done for projects) against the projections included in the Investment Plan to inform decision-makers as to the accuracy of long-term planning.

Finding 2: Project management

A project management regime has been established.

We examined how the project management process was governed across CIC. We examined the project system requirements for project delivery and how accountabilities for the project results were established. We also examined how CIC ensures compliance with the Policy on the Management of Projects. We assessed how CIC has built its resource capacity to meet policy requirements. Finally, we examined how projects are tracked and monitored throughout their life cycles.

A robust governance structure helps to standardize project requirements across the Department and ensure that information to enable monitoring is available and reliable. The Policy on the Management of Projects requires that each planned or proposed project that is subject to the policy be accurately assessed to determine its level of risk and complexity for the purposes of project approval and expenditure authority. Departmental capacity for the delivery of projects is necessary to ensure that projects meet their intended objectives. Without regular reporting on project progress, project performance may not be well understood, as many projects have multi-year time frames and may continue throughout turn-over in senior management.

A committee has been established to oversee projects.

At CIC, there is a tier-3 Project Review Committee that is chaired by EPMO. The mandate of this committee is to provide ongoing monitoring and oversight of all projects within CIC. However, the committee has no authority to challenge or give approval for project management decisions. The committee was originally established to standardize project management in the Department and to share best practices across branches. Senior management has acknowledged that the original goals of the Committee have been achieved, and the Committee is currently reviewing its terms of reference and role in the Department.

CIC has developed a gating system to ensure compliance with Policy.

EPMO and the Project Review Committee promote a standardized gating system for all CIC projects, which is designed to ensure that projects have met targets or produced documented deliverables before proceeding to the next phase. The gating system matches policy requirements. The system allows for projects to be classified as “full,” meaning all accepted professional project management document and process requirements must be followed, or “lite,” which uses a reduced planning phase and lower documentation requirements. While guidance is provided to project leads, because the Project Review Committee does not hold formal governance over projects, it is the project leads who choose whether or not to follow the gating system and which one to follow. Additionally, some projects are allowed to proceed through the gating system without receiving all of the necessary documents, gating requirements or both. For example, 10 of the 12 files in our audit sample were allowed to proceed beyond the Project Identification stage without providing a business proposal, as is normally required by the formal gating process. Some departments have developed project approval delegation matrices to identify governance and oversight accountabilities for all project-related activities and to challenge movements between gates.

There are no established thresholds for defining formal project management requirements.

The Investment Plan framework does not include clear guidance over which projects should be managed formally within the Department’s project management system. The decision to manage a project according to the “full” or “lite” requirements is made subjectively by management without established criteria, as the requirements are not formalized. In addition, the decision to follow “full” or “lite” requirements is made after the project has already been accepted into the project management system. A method to determine objective risk thresholds and process requirements for projects exists for projects valued at less than the Treasury Board $1 million threshold, but it is applied only at management’s discretion and not as part of a formal requirement.

EPMO has enabled the Department to have access to people with project management capacities.

In order to meet the people capacity requirements of the Policy on the Management of Projects, EPMO has established an omnibus contract that allows project authorities to contract project experts on an as-needed basis. CIC has the access it requires to ensure all departmental projects have the expertise needed to successfully deliver their objectives.

Formally managed projects are regularly monitored.

All formally managed CIC projects are entered into and tracked on a project management system. Progress against planned milestones and dollars spent against the Department’s strategic outcomes are monitored. The results of this monitoring are reported to senior management on a quarterly basis and coordinated with the progress reporting of the Integrated Investment Plan.

Recommendation 4 (Medium Risk):

CIC should clarify the role of and accountability for project oversight, either through EPMO or the Project Review Committee, and determine how to challenge a project’s passage from one gating requirement to the next.

Recommendation 5 (Low Risk):

CIC should develop formal criteria to determine whether projects should follow “full” or “lite” process requirements.

Appendix A – Detailed Audit Criteria

The objective of this audit was to provide assurance that governance, systems and people, and results and performance monitoring of integrated investment planning are in place.

Audit Sub-Objective

Governance

Investment planning and project management are in place and maintained.

  • Investment planning and project management support the Department and the Government’s strategies while considering areas of risk and government-wide integration.
  • The Department consults central agencies and other key federal stakeholders, and reports appropriately on investment planning and project management when required.
  • A control and oversight regime is in place to monitor the correct use of and adherence to the Policy on Investment Planning – Assets and Acquired Services and the Policy on the Management of Projects and their associated standards.
  • Departmental investment planning is within delegated expenditure authority.
  • The governance and oversight mechanism over project management is used to manage the initiation, planning, execution, control and closing of projects.
  • The governance regime is appropriate given the scope of activity, its integration into operations and the timeliness of reporting.

Systems and People

The Department has the appropriate capacity of systems and people to support a risk management approach to investment planning and project management.

  • Departmental investment planning takes into account the whole-of-life cost of stewardship, and considers alternative and innovative options for meeting assets and service requirements.
  • Information systems are in place that support planning, budgeting and accounting for resource allocation based on future-oriented activities.
  • Accountability and controls for project outcomes exist, and the contribution to program outcomes and broader government objectives is demonstrated.
  • The Department complies with the associated standards: project complexity and risks are assessed in accordance with approved tools that reflect risk tolerance and are managed appropriately, and the Department has the appropriate project management capacity to manage projects.

Results and Performance Monitoring

There is monitoring and reporting on investment planning within the Department.

  • The Department complies with all Treasury Board reporting requirements.
  • The implementation of the Department’s investment plans, approvals and resourcing decisions is monitored.
  • The effectiveness of the investment planning regime and project management is reviewed on an ongoing basis.
  • The Department reports on the effectiveness of investment planning and on the management of projects.
  • The Investment Plan enables resource allocation decisions for budgeting purposes and provides for prioritization of new projects when resources allow.

Appendix B – Management action plan

Recommendation Risk Ranking Action Plan Responsibility Target Date
1. CIC should develop formal guidelines for what should and should not be included in the Investment Plan and ensure it is aligned to the new budget planning exercise. Medium CIC will develop formal guidelines for what will be included in the Investment Plan. EPMO Q3 FY 2013/14
2. CIC should ensure that the forecasting methodology for the Integrated Investment Plan meets the needs of senior management. Medium CIC will ensure that the forecasting methodologies used for assets and acquired services meet the needs of senior management. EPMO Q4 FY 2013/14
3. CIC should monitor and report to senior management on the progress of spending on assets and acquired services (as is currently done for projects) against the projections included in the Investment Plan, to inform decision-makers as to the accuracy of long-term planning. Medium CIC will monitor and report to senior management on the progress of spending on assets and acquired services (as is done for projects). EPMO Q2 FY 2013/14
4. CIC should clarify the role of and accountability for project oversight, either through EPMO or the Project Review Committee, and determine how to challenge a project’s passage from one gating requirement to the next. Medium CIC will complete a review of project oversight and implement any necessary changes:
  • Complete review (Q2)
  • Implement necessary changes (Q3)
EPMO Q3 FY 2013/14
5. CIC should develop formal criteria to determine whether projects should follow “full” or “lite” process requirements. Low CIC will implement formal criteria to determine whether projects should follow “full” or “lite” process requirements. EPMO Q2 FY 2013/14

Appendix C – Links to Policies, Frameworks, and Standards

Report a problem or mistake on this page
Please select all that apply:

Thank you for your help!

You will not receive a reply. For enquiries, contact us.

Date modified: