Internal Audit of the Passport Program for Official Travel

Internal Audit & Accountability Branch
11 June 2019

I. Background

Introduction

1. The Audit of the Passport Program for Official Travel was included in the Department’s 2018-2020 Risk-Based Audit Plan and approved by the Deputy Minister.
2. Effective 2 July 2013, the control and management of Passport Canada was transferred from Global Affairs Canada (GAC and formerly Foreign Affairs, Trade and Development Canada) to Immigration Refugees and Citizenship Canada (IRCC) under the Public Service Rearrangement and Transfer of Duties Act. Concurrently, the Canadian Passport Order (1981) and the Diplomatic and Special Passports Order (1956) were amended to substitute all references of GAC to IRCC.
3. Under the provisions of the Canadian Passport Order, the Passport Program issues regular (blue) passports to Canadian citizens. Under the provisions of the Diplomatic and Special Passports Order (DSPO), the Passport Program issues and safeguards Diplomatic (red cover) and Special passports (green cover) for official travel (see Figure 1). Representatives of the Government of Canada, such as personnel of Departments and Agencies, as well as people travelling on Government of Canada-related business should travel using an official passport. The official passport informs international border officials that the bearer is travelling on official business and is representing Canada abroad.

Figure 1: Travel documents issued under the Passport Program

4. The DSPO contains a provision that allows the Minister of Immigration, Refugees and Citizenship to issue special instructions, not inconsistent with the DSPO, in order to provide additional guidance on the issuance and control of official passports. Since the DSPO was made by Order in Council in 1956, Ministers of Foreign Affairs (formerly responsible for the Passport Program) have issued a total of 27 Ministerial Instructions regarding the issuance and control of official passports between 1958 and 2011.

Operating environment

Governance and oversight

5. The Passport Program governance structure includes a number of committees and working groups that discuss the direction and delivery of services, as well as results of the Passport Program. Given the scope, areas of concern for Official Travel may be raised as part of these meetings. These include the Internal Passport Program Committee, Passport Program Service Delivery Committee, Passport Program Management Committee and the Passport Program Reporting Working Group.
6. As part of the broader Passport Program, the governance and administration of Official Travel involves the following Branches within IRCC’s Operations and Strategic and Program Policy Sectors:
   • The Citizenship and Passport Program Guidance (CPPG) Branch, Operations Sector, is responsible for providing oversight and guidance for Official Travel, including the administration of the Memoranda of Understanding with other government departments and units.
   • The Admissibility Branch, Strategic and Program Policy Sector, is responsible for maintaining the legal framework of the Official Travel Program, including the Diplomatic and Special Passports Order.
   • The Centralized Network (CN) Official Travel Unit, Operations Sector, is responsible for processing, printing, and issuing official passports, in addition to safekeeping official passports for other government departments.
   • The Geographic Support Unit of the International Network (GSU-IN), Operations Sector, is responsible for the safekeeping of official passports issued to IRCC personnel. In July 2011, IRCC and Passport Canada (GAC) signed a Memorandum of Understanding to outline IRCC’s administrative and safekeeping expectations for official passports. On 13 February 2018, an intradepartmental agreement was signed by GSU-IN, CPPG and CN to establish an updated administrative framework intended to clarify roles and responsibilities and improve control over the safekeeping of official passports for IRCC personnel.
   • Domestic Network (DN) reviews and holds decision making authority on complex and high-risk cases, and also conducts administrative investigations to determine if grounds exist that may merit administrative sanctions (cancellation, refusal, revocation, imposition of a period of refusal of service) under the Canadian Passport Order (CPO). DN may also suspend an official passport under the Family Orders and Agreements Enforcement Assistance Act.

Service delivery

7. In 2017-2018, the Passport Program received approximately 4.95 million travel document applications. As one of the seven service channels within the Passport Program, the Official Travel operations received 0.3 percent of the applications. As of December 2018, there was a total of 62,325 valid official passports in circulation, which was made up of 11,035 Diplomatic passports and 51,290 Special passports^{Footnote i}. As of December 2018, personnel from the Department of National Defence, Global Affairs Canada, and the Royal Canadian Mounted Police have been issued the largest volume of Official Passports. (See Figure 2)

Figure 2: Percentage of passports issued to each department

8. Canadian passports remain the property of the Government of Canada at all times. As such, section 4 of the Ministerial Instruction of January 2011 on the rules of use identifies that all Diplomatic or Special passports are expected to be returned to the Passport Program Official Travel office immediately after completing travel for an official business trip. The official passports are held in safekeeping at the Official Travel office until retrieved by the bearer for official travel purposes. There are 16 departments and agencies that have entered into a Memorandum of Understanding with IRCC’s Passport Program, which enables departmental safekeeping of official passports for their own personnel.
9. Global Affairs Canada personnel and other specified individuals are entitled to maintain custody of their own official passports following official travel^{Footnote ii}. In these cases, personnel are required to sign the Agreement between the IRCC’s Passport Program and Global Affairs Canada regarding continued custody of Diplomatic and Special passports. Upon signing the Agreement, the responsibility for appropriate usage and safekeeping of the official passport is transferred to the individual.
10. Since the transfer of primary responsibility of Official Travel to IRCC in 2013, the system used to process passports has been the Integrated Retrieval Information System (IRIS). As part of the Passport Modernization Initiative, effective 5 November 2018, Official Travel transitioned to the Global Case Management System (GCMS) for processing. The decision to transition Official Travel processing onto the Department’s global processing platform is aligned with the departmental objectives to improve service delivery and enhance program integrity across IRCC’s operations.

Significance of control over official passports

11. When travelling on official business and representing Canada abroad, any misuse, loss, or other compromise of the Diplomatic or Special passport risks serious impact to the national interest and Canada’s reputation in the global economy. The impact could result from increased border restrictions impacting Canada's economic interests and decreased trust, which could affect Canada’s political interests and diplomatic relations.

II. Audit objective, scope and methodology

Audit objective and scope

12. The objective of the audit is to assess whether IRCC has controls in place to effectively manage the Passport Program for Official Travel.
13. The audit included an examination of the controls in place for the following:
    • Process for issuing the Diplomatic and Special passports;
    • Monitoring usage and safekeeping of passports for Official Travel; and
    • Reporting the performance of the Passport Program for Official Travel.
14. The audit scope covered the time period from 1 April 2016 to 31 December 2018.
15. The audit scope did not include IRCC’s role in obtaining country specific visas for official government travel.

Methodology

16. The following audit procedures were performed:
    • Interviews with key personnel and stakeholders;
    • Sampling strategies were developed to determine the number of passports to be reviewed as part of the audit;
    • File reviews on passport applications to assess the controls over issuance;
    • Reviews and inventory counts of blank passports;
    • Review and analysis of documentation such as the Diplomatic and Special Passports Order, Ministerial Instructions, Memorandum of Understanding with other government departments, Functional Guidance;
    • A walkthrough of the Official Travel unit was performed to observe the overall process in place for the issuance and safekeeping of Official Travel documents.
    • A walkthrough of the Geographic Support Unit was performed to observe the processes in place for the safekeeping of Official Travel Passports; and
    • Collaborated audit work with the Department of National Defence, Department of Fisheries and Oceans, and Canada Border Services Agency.
    The audit observations, conclusions and recommendations are based on the work performed.

Statement of conformance

17. This audit was planned and conducted in conformance with the Institute of Internal Auditors International Professional Practices Framework, as supported by the results of a quality assurance and improvement program.

III. Audit findings and recommendations

Issuing diplomatic and special passports

18. Having controls in place for the issuance of passports is important because controls ensure that the right government documents such as Diplomatic and Special passports are being provided to the right individuals and for the right reasons. A lack of controls could result in the issuance of official passports without proper rationale, which could cause reputational risks to the Department and to the Government of Canada. Having the controls in place to track the usage of the Diplomatic and Special passports is important to ensure that they are used as expected. Furthermore, as per the Treasury Board Standard on Identity and Credential Assurance, in February 2013, Passport Canada determined that the Diplomatic and Special passports require the highest level of assurance that credentials are properly controlled and that they are issued with the correct identification of the individual. The assurance level remained relevant upon transfer of the Official Travel Program to IRCC in July 2013.
19. The Diplomatic and Special Passport Order (DSPO) currently lists categories of eligible individuals entitled to a Diplomatic or Special passport based on their position or based on the nature of their trip for official travel. A comprehensive review of the DSPO has not been done since 1956. Over the years, issues not directly addressed in the DSPO, such as questions on eligibility and use of Diplomatic and Special passports, have been addressed through ad hoc operational policies, operational changes or Ministerial Instructions. These have led to inconsistent practices, as well as unclear and outdated eligibility categories. The Department is currently leading the policy work to review the DSPO so that authorities regarding passport entitlement under the DSPO are clear, updated, and reflect current operational requirements to better support passport officers making decisions on issuing passports. This work is in progress, and it is anticipated that the briefing to the Minister on the scope of proposed amendments and on next steps will take place at the beginning of the next mandate in fall 2019 and winter 2020.
20. When a government official requires a passport for travel outside of Canada on official business, Passport Officers in the Department’s Centralized Network are responsible to determine the applicant’s eligibility to obtain either a Diplomatic or Special passport. Passport Officers receive training and have internal process manuals to conduct their work. To become a Passport Officer, individuals complete a two week passport training on the Canadian Passport Order, conducted by Employment and Social Development Canada. Following their training on issuing the regular (blue) passports, the candidates complete a five-week qualification process focused on the official passports issuance process within the Official Travel office. As of 31 December 2018, there were ten Passport Officers qualified to assess and make eligibility decisions for official passport applications. Following the end of the audit scope period, two additional Passport Officers were qualified, for a total of 12 Passport Officers within the Official Travel unit as of March 2019.
21. Since December 2018, Operational Coaches in the Centralized Network’s Official Travel unit randomly review applications processed to determine quality and completion of information and determine if there is a need for further training. This process also expects to provide assurance that applicants are assessed consistently and decisions are made in line with the legislative and policy requirements. In 2017, CPPG implemented a Passport Quality Management Program through which it performs general and targeted quality management exercises of all types of passports. Two targeted exercises included samples of Diplomatic and Special Passports.
22. It is important for Passport Officers to have accurate information on file to make the right decision about an application in order to issue an official passport. A review of a sample of 15 applications processed in IRIS and 15 applications processed in GCMS was conducted to determine the completeness and accuracy of information. While all of the 30 applications that were examined have been accurately entered in the system when compared with the applicants’ details (for example, name, date and place of birth, and observation), two of 30 applications had incomplete documentation on file within GCMS. For example, GCMS records were missing a photo or notification of travel document. Upon verification with Official Travel, the missing documents were submitted as part of the assessment process but were stored elsewhere and were later provided to the audit team. Without the proper documentation on the file, there is a risk that there is not adequate information to support the issuance of the official passport.
23. Of the 62,325 official passports valid as of 31 December 2018; 8,026 passports were issued to 3,826 unique names. Examples where this would be acceptable include: the operational need to request more than one visa at the same time; to enter into a designated country where an additional passport may be required (for example, Taiwan or Israel); and to be prepared for urgent work requirements and multiple work locations. The audit selected 20 passports to determine if the rationale for multiple issuance was valid. It was concluded that 19 out of 20 multiple issuances had sufficient rationale for the decision to issue more than one passport to the same individual. Subsequent to the audit examination, one was cancelled as it was not supposed to have been valid. As a result, the issuance of multiple passports is supported by valid information.
24. A billing form is required to be submitted for every application so that fees for the official passport can be properly charged to the departments and agencies. The billing forms require proper authorization under the Financial Administration Act, which confirms that there are sufficient funds available for discharge. The audit assessed the billing forms for authorization and 91 percent (43 of 47) of forms reviewed for IRCC employees were compliant. An example of non-compliance included improper authorization and signatories that could not be verified due to illegible signatures. The Department has not identified a process to verify that signatories are eligible to sign off on the billing forms. The lack of verification impacts the Department’s ability to effectively report the expenditure or variances regarding the revolving fund, and unauthorized expenditures may impact resources from other initiatives within the overall Passport Program.

Safekeeping of diplomatic and special passports

25. Once an official passport has been issued by Official Travel, or returned after it has been used, the safekeeping of the document is imperative to the integrity of the overall program for Official Travel. Physical safekeeping is important because unauthorized access and fraudulent use of the passport could result in misrepresentation of Canada in a diplomatic context, and result in damage to Canada’s reputation. As such, Diplomatic and Special passports must be physically protected and maintained appropriately at all times.
26. The Official Travel unit in the Centralized Network is responsible for the safekeeping of all official passports. There are three exceptions to this: official passports for IRCC employees which are safe kept by the Geographic Support Unit in the Department’s International Network (GSU-IN); official passports for employees of other government departments that have safekeeping arrangements under a Memorandum of Understanding; and official passports for certain individuals who have been allowed to permanently keep the official passports upon signing the Agreement between the Passport Program, IRCC and Global Affairs Canada regarding continued custody of Diplomatic and Special passports.
27. In February 2018, a pilot for the safekeeping of official passports was initiated through an Intradepartmental Agreement in IRCC to clarify and enact safekeeping standards, including passport storage security requirements for GSU-IN. Under the pilot, GSU-IN is responsible for the safekeeping of IRCC personnel’s official passports. At the time of the audit, the independent assessment of the premises of the GSU-IN by IRCC’s Departmental Security Officer had not been conducted, which is a requirement in the Intradepartmental Agreement. The independent assessment is important because it provides assurance that the official passports are physically protected and maintained appropriately so that unauthorized access or fraudulent use is mitigated. The assessment is also important to ensure the effectiveness of the pilot agreement in terms of decentralizing the safekeeping of official passports while ensuring the integrity of the Official Travel Program. While the independent assessment by IRCC’s Departmental Security Officer has not yet been performed, tests conducted as part of the audit of the existing storage and protective measures at GSU-IN demonstrated that the standards were met.
28. The Official Travel unit has not implemented a process to track official passports. For example, monitoring to ensure that official passports are returned for safekeeping after they have been removed for the purposes of travel; ensuring that the official passport holders sign the Agreement between the Passport Program, IRCC and Global Affairs Canada regarding continued custody of Diplomatic and Special passports, which holds them accountable for the safekeeping of the official passport; and recovery of expired passports held by non-Canadian dependents^{Footnote iii}. Due to the absence of adequate monitoring to track and monitor the use and safekeeping of official passports, information may not be available to effectively manage the program. A manual tracking process was in place at GSU-IN to support the monitoring of official passports that had been removed for use for official travel. The manual tracking process also permitted the GSU-IN to identify, remove and renew (if required) passports that were expiring.
29. The safekeeping and security requirements for official passports at the Official Travel unit were not identified in any guidance or legislative documents, and independent security inspections have not been conducted. However, the audit sought to determine if the Official Travel unit was safekeeping and storing official passports based on the requirements in the pilot for the Intradepartmental Agreement for GSU-IN. The audit determined that the Official Travel unit’s facility met the security measures required for the proper storage of both the blank and issued passports. Examples of expected security measures included requirements for secure storage of personalized official passports and inventory records at the Protected B level.
30. Having appropriate technological tools and information systems is important to support the ability to perform efficient tracking and monitoring of the safekeeping of official passports. Without the ability to track and monitor the safekeeping of official passports, the Department may not have the information it needs to provide assurance that official passports are being used and then safe kept accordingly in order to mitigate the risk of misuse if passports are not returned or safe kept.
31. To determine the extent of the concern and risks from the lack of tracking, the audit reviewed 110 passports held in safekeeping; 60 were held in safekeeping by the Official Travel unit, and 50 were held in safekeeping by the Geographic Support Unit in the Department’s International Network (GSU-IN), which is responsible for safekeeping Diplomatic and Special passports for IRCC staff. The passports were selected to determine if certain conditions were in place, namely: is the status update on the record accurate, are the passports removed from safekeeping for travel returned upon completion of travel, are the records on passports held by IRCC staff consistently reflected in both the electronic system used by Official Travel (the Global Case Management System or GCMS) and a separate passport database used by GSU-IN, are the passports identified with status “in custody of applicant” either recorded with a return date close to end of official travel or have on file a signed Agreement between the Passport Program, IRCC and Global Affairs Canada for continued custody of passports by holder.
32. Inconsistencies in the information in GCMS and GSU-IN’s database were noted in the review of the 110 passports. For example, 12 passports had not been returned upon completion of travel. Four passports were cancelled and were not in safekeeping even though they were identified as “held in safekeeping” in GCMS. Two passports were recorded in the GSU-IN database with incorrect passport numbers. Two regular (blue) passports of dependents of those travelling on official passports were tracked in the GSU-IN database. As a result of some weaknesses in the tracking of official passports, there is a risk of unauthorized access, misuse, or misrepresentation of Canada in a diplomatic or special travel context, which could damage the integrity of the program and Canada’s reputation.
33. Several other government departments and agencies have signed a Memorandum of Understanding, which includes the roles and responsibilities to retain and safe keep official travel passports for their personnel. The Memorandum of Understanding identifies the safekeeping requirements and storage security standards. The current Memoranda of Understanding are in the process of being updated. The revised Memoranda of Understanding are expected to improve accountability and identify roles within other government departments and IRCC for the monitoring of passports retained by other government departments.
34. Through liaison with departments and agencies with signed Memoranda of Understanding for safekeeping the official passports of their personnel, safekeeping practices for two other government departments and one agency were assessed against the Memoranda of Understanding. Included in the assessment were the Department of National Defence, the Department of Fisheries and Oceans, and the Canadian Border Services Agency. Examination of selected passports and review of safekeeping practices in these Departments and the Agency identified that, in the absence of reporting requirements and oversight by IRCC, each of the Departments’ and the Agency’s internal controls such as inventory records and activity logs were in place within the organizations.
35. Overall, the process of issuing Diplomatic and Special passports had sufficient controls in place to ensure effective processing and service excellence. Strengthening operational level monitoring, especially related to safekeeping requirements, will enable the Official Travel unit to demonstrate accountability over the effective safekeeping of official travel passports. Tracking and ongoing monitoring of the use and safekeeping of official passports also ensures quality management of the Official Passport Program.
36. Recommendation 1: The Assistant Deputy Minister, Operations Sector, should improve the agreements in place with other government departments so that Official Travel can implement necessary monitoring controls to manage the Passport Program for Official Travel. Improvements to the agreements should include implementing tools to track and monitor the use and safekeeping standards for official passports.
37. Recommendation 2: The Assistant Deputy Minister, Strategic and Program Policy Sector, should advance the policy work on the DSPO amendment for implementation so that the DSPO is up to date and reflects the current operating environment. The amendments will provide a framework upon which to build improved operational policies and guidance on the issuance of Diplomatic and Special passports.

Oversight and reporting on the Official Travel Passport Program

38. Identifying and communicating roles, responsibilities and authorities not only helps direct how each of IRCC’s Branches must act to achieve the objectives of the Passport Program for Official Travel but they help ensure that there is proper oversight of the operationalization of the key internal controls. Effectively communicated roles, responsibilities and authorities also facilitates consistent roles implementations and new key employee orientations.
39. The Passport Program for Official Travel involves numerous stakeholders at various levels within the Department who are responsible for the delivery of the program. These include the Official Travel unit in the Centralized Network, which carries out the operations; CPPG with oversight and management responsibility, supports the broader delivery of the program internally and with other government departments through guidance, reporting, and oversight of the Memoranda of Understanding; and the Admissibility Branch, which are responsible for the policy work on the revised DSPO. The roles, responsibilities and accountabilities of each stakeholder are generally understood although they are not defined in a guidance document. Without documented roles and responsibilities, there is a risk of confusion or duplication around common processes. Defined roles and responsibilities support accountability and reporting on the effectiveness of the program.
40. The Passport Program for Official Travel is responsible for less than one percent of the annual passport applications processed within the Passport Program. As a result, the likelihood of a risk event is low but the impact in the event of a misuse or compromise is high. Identifying issues and control weaknesses proactively is important in order to keep possible risk events constrained. Sufficient oversight is therefore imperative to the program’s integrity and success. Oversight at the program level also provides assurance that key controls are in place and are functioning as intended.
41. Recommendation 3: The Assistant Deputy Minister, Operations Sector, should strengthen oversight of the Passport Program for Official travel to ensure that management is responsible for implementing the policies and procedures for the issuance, usage and safekeeping activities of Diplomatic and Special passports. Operations sector must ensure that the oversight role is supported with quality information resulting from ongoing monitoring of the program at the operational level.

IV. Conclusion

42. In conclusion, IRCC has some controls in place to support effective issuance of official passports. However, operational level monitoring was not sufficient particularly in order to comply with safekeeping requirements and inventory monitoring. Improvements are needed in the areas of oversight for the program, including program level identification of roles, responsibilities and authorities to strengthen controls over the program.

Management has accepted the audit findings and developed an action plan to address the recommendations.

Appendix A – Management response