Internal Audit of the Private Sponsorship of Refugees Program

Internal Audit & Accountability Branch

28 June 2021

Table of contents

1. Background
2. Audit objective, scope and methodology
3. Audit findings and recommendations
   • Program Oversight
   • Program Risk Management
   • Policies, Procedures and Regulations
4. Conclusion

I. Background

Introduction

1. The Audit of the Private Sponsorship of Refugees (PSR) Program was included in the Department’s 2020-2022 Risk-Based Audit Plan, which was recommended by the Departmental Audit Committee at the June 2020 meeting and subsequently approved by the Deputy Minister.
2. In accordance with Canada’s annual Immigration Levels Plan, Immigration, Refugees and Citizenship Canada (IRCC) facilitates the admission of a targeted number of refugees as Permanent Residents under the Refugee Resettlement Program. Refugees are individuals who reside outside of their home country and are unable to return for fear of persecution based on race, religion, nationality, political opinion or membership in a particular group, or those who are seriously and personally affected by civil war, armed conflict or massive human rights violations. Canada accepts Convention refugees (CRs) and those in refugee-like situations for humanitarian reasons, according to the following principles: fulfilling Canada’s international obligations and commitments to protect refugees and those in need; supporting successful settlement and integration in Canada; and, reuniting refugee families.
3. A privately sponsored refugee is a person who has been identified for sponsorship by a private sponsor or group in Canada and selected for resettlement to Canada as a member of the CR or Country of Asylum class. Canada’s resettlement of refugees through the PSR Program is one means by which humanitarian traditions with respect to displaced and persecuted persons are expressed.
4. IRCC collaborates with a number of partners and stakeholders in delivering the PSR Program, including international organizations such as the United Nations High Commissioner for Refugees (UNHCR) and the International Organization for Migration (IOM), as well as a number of other Non-Governmental Organizations (example, Canadian Council for Refugees, Sponsorship Agreement Holder Council, Refugee Sponsorship Training Program), community groups, and umbrella organizations.
5. There are three types of sponsorship groups within the PSR Program:
   • Sponsorship Agreement Holders (SAH), which are organizations who have signed a sponsorship agreement with the IRCC Minister to sponsor refugees on an ongoing basis. SAHs may choose to work with constituent groups (CGs), which are groups or individuals who the SAH authorizes to sponsor under its agreement and provide support to the refugees, and/or individual co-sponsors;
   • Community Sponsors (CS), which are organizations located in the community in which the refugee is destined to settle and has committed to sponsoring the refugee. Community sponsors may choose to work with individual co-sponsors; and
   • Groups of Five (G5), which are groups of five or more Canadians and permanent residents who come together to sponsor refugees.

Operating Environment

6. Historically, the PSR Program was a small, niche program, for example, admitting about 4,000-6,000 refugees between 2011 and 2014. However, in response to the Syrian refugee crisis and consistent growth in sponsor demand, the PSR Program has recently quadrupled in size and now represents two-thirds of Canada’s resettlement program admissions, with 18,770 PSRs admitted in 2018 and 19,150 PSRs admitted in 2019. With this significant growth, the program has experienced an increase of observed integrity concerns, shortfalls in supports provided to refugees post-arrival (example, income support, adequate housing), fraud (example, use of falsified financial or identify documents) and cases of exploitation (example, sponsors requiring refugees to self-fund or pay to be sponsored). In 2018 and 2019, the Department ramped up its monitoring of the PSR program by undertaking an approach that included centralizing an operational unit with a mandate to undertake post-arrival monitoring activities. These activities were reactive in nature (i.e., responding to reported concerns and conducting reactive monitoring of organizations with known concerns), and later a more proactive approach was taken, where a sample of active cases from all three streams were reviewed to understand how well the program is working.
7. As a result of the program integrity concerns that became evident during post-arrival assurance activities conducted, there have been increased engagements and consultations with external stakeholders and partners to address program integrity concerns, strengthen external guidance materials, and give consideration to policy and regulatory changes for the PSR Program. As the PSR Program proceeds with its policy responses identified, following the increased program assurance activity and policy review, there are factors that may impact the program. For example, anticipated continuation of high levels of refugees seeking permanent residency for the next several years, as well as uncertainty due to the COVID-19 pandemic (i.e. travel restrictions).
8. It should be noted that, at the time of writing the report, more recent initiatives were in progress which are expected to address certain audit findings. A new branch, Resettlement and Asylum Strategic Operations Branch, was created effective May 3, 2021 to deliver refugee resettlement programs, which is outside the scope period of this audit. This should be taken into consideration with respect to references to the International Network – Resettlement Operations Division (IN-ROD) in the report. Furthermore, a proposal is in progress to strengthen strategic advice, as well as the efficiency and effectiveness of end-to-end management and delivery of the Refugee Resettlement Program across Sectors. This includes: (1) making focused structural adjustments; (2) strengthening governance and reporting; and (3) enhancing stakeholder engagement with the goal of improving program cohesion.^{Footnote 1}

II. Audit objective, scope and methodology

Audit Objective and Scope

9. The audit objective was to determine if a management framework is in place and operating effectively to enable the PSR Program to achieve its objectives and comply with program requirements.
10. The audit included an examination of the following audit criteria:
    • A program governance structure has been established and reporting lines, authorities, roles and responsibilities have been defined and communicated.
    • Risks pertaining to PSR program integrity (including fraud risks) are being identified and analyzed, and mitigation measures are developed and implemented to manage the identified risks, so that program objectives are attained.
    • Effective controls^{Footnote 2} are in place, and adjusted as necessary in order to respond to evolving risks.
11. The audit scope covered the period from January 2019 to March 2021.
12. The audit scope did not include an examination of the monitoring activities performed by the migration office for pre-arrival assessments. Although the audit examined the pre-arrival assessment performed by the Resettlement Operations Centre, a more complete review in a future audit engagement will be required to provide assurance on the pre-arrival work of PSR.

Methodology

13. The following audit procedures were performed:
    • Interviews were conducted with key stakeholders from the Refugee Affairs Branch (RAB), International Network – Resettlement Operations Division (IN-ROD), and Settlement and Integration Policy (SIP) Branch;
    • Review and analysis of documentation such as the Refugee Resettlement Program Performance Information Profile (PIP), PSR SAH Sponsorship Agreement, internal standard operating procedures, external guidance (example, guides, websites), presentations to senior management and Executive Committee, among others; and
    • Walkthroughs of the pre-arrival assessment completed by Resettlement Operations Centre – Ottawa (ROC-O) and post-arrival case review and assurance conducted by Resettlement Services Assurance Team (RSAT) were performed to observe the overall processes in place.
14. The audit observations, conclusions and recommendations are based on the work performed.

Statement of Conformance

15. This audit was planned and conducted in conformance with the Institute of Internal Auditors’ International Professional Practices Framework, as supported by the results of a quality assurance and improvement program.

III. Audit findings and recommendations

Program Oversight

16. Defined roles, responsibilities and authorities provide clarity on discharging responsibilities and delegated authorities, maintain segregation of duty and enable effective flow of information to manage the activities of the program. As well, oversight by senior management, who are independent of the program’s operational activities, ensures that the program is able to meet its established requirements and expectations in alignment with Department’s strategic objective.
17. Given that program management spans various branches and sectors, it is important to identify key roles and ensure horizontal integration among stakeholders when discharging responsibilities. This would include establishing appropriate program authorities, roles and responsibilities and a program oversight body, with responsibility to set strategic direction and oversee program design, implementation and maintenance of internal controls, such as pre-arrival assessments and post-arrival assurance, to provide reasonable assurance regarding the achievement of operational, reporting and compliance objectives related to the program.
18. Currently, the governance, roles and responsibilities for oversight and management of the PSR Program is shared between the Strategic and Program Policy (SPP) Sector and Operations Sector. As the branch responsible for overall refugee program policy and direction, RAB within SPP is accountable for the Refugee Resettlement Program, including the PSR Program. This includes establishing strategic priorities and plans and providing horizontal coordination and advice on resettled refugee targets for the immigration levels plan. In addition, RAB consults with external stakeholders including advocacy groups, sponsors, clients, and interested parties, serving as a focal point to bring together partners on resettlement issues. The branch is also accountable for renewing program terms and conditions, and developing national performance measurement and reporting strategies and coordinating evaluations of the program.
19. Within the Operations Sector, IN-ROD is responsible for providing functional guidance and operational support to migration offices on resettlement operations, coordinating resettlement processing operations, and providing strategic advice on resettlement operations to senior management. IN-ROD manages both ROC-O, which is responsible for reviewing and assessing PSR sponsorship applications as well as pre-arrival program integrity activities, and RSAT, which is responsible for post-arrival assessments and monitoring activities of individual cases and sponsor organizations within the PSR program to ensure support is provided to newcomers by their sponsors. In addition, IN-ROD liaises with external stakeholders related to the PSR Program, including federal partners, the UNHCR, the IOM, and sponsorship groups.
20. In terms of oversight, the program management reports to the Issues Management Committee (IMC)^{Footnote 3} at the ADM level and the Program Management Table (PMT)^{Footnote 4} at the DG level. IMC is a forum for discussion and decision making at the senior management level on specific issues and challenges related to program, policy and operational priorities and this is co-chaired by ADM Operations and ADM SPP. A review of the records of discussion at the IMC meetings held between January 2019 and April 2021 identified that of the 40 bi-weekly meetings held during this period, an update of the PSR Program initiatives and control issues were presented at three meetings. This included a presentation to IMC in November 2019 to discuss the rapid scaling up of the program leading to integrity issues. As there was a need for program review along with a regulatory framework and enforcement tools, program management was expected to return to IMC or the Executive committee in early 2020 to present the proposal regarding the policy review. However, there was no evidence of subsequent return to either committees to continue to discuss the progress on the work on policy review.
21. Similarly, the PMT is chaired by Director General of RAB and attended by DGs and Senior Directors, including IN-ROD. PMT is intended to provide guidance and oversight for programs, including PSR, and support planning, reporting and priority setting. A review of the PMT meeting discussion identified that there were two meetings held in 2019, but there have been no further meetings since then.
22. Although roles and responsibilities have been identified among the sectors and branches involved in the management of the program, strengthening senior management oversight and program reporting would facilitate horizontal integration on program objectives, collaboration amongst stakeholders for program risk management, establish responsibility and accountability for executing policies and procedures and provide traction on program initiatives.
23. Recommendation 1. The Assistant Deputy Minister (ADM), SPP Sector, in partnership with the AADM, Operations Sector, should strengthen oversight of the PSR Program by leveraging existing governance, for example, senior management committees, to facilitate discharging of roles, responsibilities and accountabilities, to improve horizontal collaboration and coordination of strategic priorities, program direction and risk management, and to formalize regular reporting.
24. As mentioned, a proposal and strategy is in progress to strengthen governance and reporting which are expected to help address this recommendation.
25. Management Response. Management agrees with the recommendation. In response, the Department proposes the development of a new oversight body supported by integrated reporting tools, and an annual ADM-level stakeholder forum focused on issues management in the PSR Program. The Refugee Resettlement Board will provide a formal governance structure to enhance program coherence and planning, and allow for an integrated view of program challenges and results for senior management.  A dedicated, ADM-led forum will provide stakeholders with an avenue to raise key issues and obtain a broader perspective on the program, while allowing senior officials to set direction with stakeholder feedback and manage issues that do not require Ministerial intervention.

Program Risk Management

26. Risk assessment involves a process for identifying and assessing risks, including fraud risks that impede the achievement of established objectives. A risk assessment approach takes into consideration established risk tolerances, while assessing the magnitude of the possible impact to determine if a mitigation control is necessary and how risks should be managed in response to changes in the internal and external environment related to the program. This involves considering both strategic and operational risks.

Integrated Risk Management

27. Within IRCC’s Framework for Integrity Risk Management, effective January 2021, policy branches, which in the case of PSR would be RAB, are tasked with setting policy parameters for establishing risk appetite, risk tolerances and contributing to program integrity and strategic risk management policy design by monitoring the strategic context, program outcomes and strengthening policy design in consequence of risks.
28. At the program-level, the IRCC Directive on Managing Integrity Risk in Operations Sector, effective September 2019, identifies program branches within the Operations Sector as responsible for leading integrity risk management. As the operational program branch responsible for delivery and management of the PSR Program, IN-ROD is the lead for PSR program integrity within the Operations Sector and is tasked with managing integrity risk as part of its operations. In order to fulfil this role, IN-ROD is expected to work with the Integrity Risk Management Branch (IRMB) who is identified in the directive as the functional authority for managing program integrity risk within program operations and the horizontal hub for integrity risk business intelligence. The directive identifies that IRMB is required to provide program integrity risk direction and oversight to support other operational branches in managing program integrity risks.
29. Integrated risk management promotes a continuous, proactive and systematic process to understand, manage and communicate risk from an organization-wide perspective in a cohesive and consistent manner. This supports informed strategic decision-making that will contribute to the achievement of program objectives. This requires an ongoing assessment of risks at every level and all implicated sectors. These aggregated results then inform decision-making and business practices within the organization.
30. The audit noted the need to strengthen horizontal integration amongst IN-ROD, RAB and IRMB when considering risks. The PIP for the Resettlement Program, including PSR, identifies the program risk profile; however, this information was compiled in 2017 and is outdated. The current risk management practices are operationally driven and although embedded into day to day program decisions, processes and activities, are not necessarily formalized, ongoing or targeted to specific risks to the program that have been identified and assessed. For example, the program has not established risk tolerances and thresholds to help determine the risks that need to be addressed and the appropriate risk responses to be put in place.
31. IN-ROD is leading the development of the PSR Program Integrity Framework, which will require coordination with internal risk partners such as IRMB and RAB to consider strategic risks, their impacts and mitigation strategies. The audit also notes, more recently, the Operations Sector Integrity Management Authority (OSIMA) of IRMB completed a preliminary review of the Resettlement Program’s integrity risk management, bringing together expertise from IN-ROD and RAB. This inquiry based engagement developed a program risk table identifying some pre-arrival risks such as fraud, inadmissibility and post-arrival risks, such as insufficient or no financial and non-financial support to refugees. At the time of the audit, the work was pending finalization but there is potential that this initial work by OSIMA could support the PSR Program in developing a risk assessment approach within its program management.

Program Integrity Risk - Post-Arrival Monitoring

32. The audit’s review of program documents and examination of program procedures, such as pre-arrival assessment and post-arrival case review processes identified that the program has historically taken a reactive approach to monitoring PSR sponsorships and post-arrival, intervening only when made aware of a potential problem regarding the support received by the refugees upon arrival in Canada.
33. Monitoring activities and related day to day risk management at the post-arrival phase of the PSR Program are carried out by RSAT in IN-ROD to ensure that sponsors are providing adequate financial and non-financial support to the refugees to resettle in Canada. This may include assisting sponsors and newcomers in cases of dispute and assessing and declaring sponsorship breakdowns^{Footnote 5} or default^{Footnote 6} in the event the sponsor is non-compliant with the program requirements. Initially, key monitoring activities conducted by the RSAT team included “reported cases” and “reactive monitoring” which assess sponsorship groups with reported concerns.
34. In January 2019, the PSR Program for the first time conducted an assurance activity referred to as “proactive monitoring”. The audit recognizes that this was a positive step for the Department to confirm some of the known integrity issues and weaknesses within the PSR Program. The integrity issues are planned to be addressed through a PSR Program Integrity Framework and strategic issues are expected to be addressed through policy framework modernization. However, the audit noted that it was unclear how results from all monitoring activities are analyzed and used to document and assess risks. Further, it was not clear whether consideration is given to changes in the internal and external environment that may affect the design or operating effectiveness of existing controls. The impact being that the monitoring and control framework for the PSR Program may not be regularly reviewed and updated to ensure its effectiveness to identify and mitigate key risks.
35. A monitoring regime with a risk-based approach will strengthen program monitoring. This includes establishment and use of risk indicators, such as sponsor capacity, sponsor financial management, case complexity, previous sponsorship history and performance, etc., and consideration of the impact of relevant risk triggers. This will help the program, for example, to determine which sponsor organizations will be monitored. As well, to determine which risks and mitigating controls to focus program resources on.
36. Recommendation 2. In conjunction with the work being undertaken by OSIMA, the AADM, Operations Sector in consultation with the ADM, SPP Sector, should establish an ongoing and integrated risk assessment approach so that risks to the integrity of the PSR Program are formally identified, assessed, mitigated and monitored.
37. Management Response. Management agrees with this recommendation. In response, the creation of a working group to further discuss and develop formal mechanisms to identify, assess and ultimately mitigate risks in the program, is proposed. Continued work with OSIMA will be beneficial, reviewing their findings to assist with informing further risk-based approaches to pre- and post-arrival monitoring activities in the PSR Program. The Program Integrity Framework in development will be an important implementation tool towards building more rigour in the program and mitigating risks such as newcomers receiving inadequate support upon arrival.

Policies, Procedures and Regulations

38. While program policies and regulations enable organizations to establish what is expected from stakeholders, procedures put those policies and regulations into action.
39. There are policies, procedures, regulations and guidance established for the PSR Program. Internally, there are program delivery instructions, and standard operating procedures to interpret and operationalize program policies and regulations. Externally, there are regulations and program guidance communicated through direct stakeholder engagements, departmental and external websites and sponsorship guides.
40. Privately sponsored refugees are informed of their support entitlements initially as part of the Canadian Orientation Abroad (COA) sessions, and by their sponsors. They are also informed of their entitlements by Officers during their post-arrival communications with IRCC. Additional mechanisms to communicate program requirements and expectations to external partners and stakeholders, including refugees, exist through IRCC websites, program application and eligibility guides, and information provided by the Refugee Sponsorship Training Program (RSTP) which includes webinars, newsletters and online resources and updates.
41. However, as a result of the program assurance activities over the course of the past few years, the program identified areas for improvement and most importantly recognized the need to review existing policies, procedures and regulations to provide more clarity on the program expectations and compliance requirements for the resettlement of sponsored refugees. For example, integrity challenges, such as use of falsified financial and identity documents, shortfalls in supports provided to refugees, and sponsors requiring refugees to pay to be sponsored.
42. Within the SAH sponsorship stream, sponsors enter into an agreement with the Department, which provides some clarity on program requirements and expectations, as well as the potential outcomes if sponsor non-compliance is identified. However, these program elements are less clear within the CS and G5 sponsorship streams where formal sponsorship agreements are not required. Furthermore, the audit noted that there is a lack of clarity and there is a need to update existing regulations to respond to sponsor non-compliance within the PSR Program. Specifically, at an IMC meeting it was noted that there are limited means within the existing PSR policy framework to prevent ill-intentioned actors from accessing the program and to detect and address abuse and integrity issues. The impact of such gaps in the policy and regulatory framework may result in legal risks (i.e., legal issues and court challenges) and potential impact on meeting program objectives resulting in reputational risk for the Department.
43. In 2019, the program performed a strategic review including a policy review of the program to identify the root causes and advance towards options to modernize the policy framework. The results of the review were presented to the IMC in November 2019.
44. As part of communication and engagement activities with sponsors, the program continues to conduct quarterly meetings and annual conferences with the sponsoring community to communicate IRCC expectations, provide clarifications and consult sponsors on potential changes to the program requirements. As well, starting in 2018, IRCC initiated direct engagement with the PSR community through in-person meetings, i.e. “road shows”, held with sponsorship groups and stakeholders across Canada. Strengthening external stakeholder communications and engagement, to both sponsors and refugees, will contribute to addressing program integrity issues through awareness, education and most importantly sponsor buy-in and compliance. However, apart from this, advancement towards finalizing this policy modernization was still outstanding at the time of this audit. For example, as mentioned earlier, the program was to return to IMC or the Executive Committee early in 2020 with detailed regulatory parameters, a consultation plan and an implementation strategy, however, as of the date of this report, this has not taken place.
45. Although the program is communicating with sponsors about program expectations and compliance requirements through annual conferences and meetings, it is vital to assess current conditions and replace outdated policies and procedures in a timely manner. Policies and procedures are important for the Department to deploy its control activities to mitigate risks and therefore timely updates will not only ensure their continued relevance to the achievement of the program objectives.
46. Recommendation 3. The ADM, SPP Sector, in collaboration with stakeholders, should review and update the PSR program policy framework to address program integrity and management challenges. There should be more clarity with respect to program requirements, expectations and response to non-compliance to support consistent interpretation and application of policies and procedures, both internally and externally.
47. Management Response. Management agrees with this recommendation. Work is underway to update the policy framework, including changes to the regulations to support program integrity and the development of a program integrity framework that will clarify the Department’s approach to oversight, monitoring and compliance in the PSR Program.  The Department is also investing in tools and resources to better educate and inform sponsors of program requirements and expectations, and support increased involvement and collaboration of stakeholders in program management.

IV. Conclusion

48. Overall, the audit found that the PSR Program has a governance structure in place; however, formalized mechanisms for alignment and coordination are required to support strategic direction and discharging of responsibilities. Risk management activities, although embedded into certain program activities, should also be formalized to identify, assess and mitigate existing and potential risks to the achievement of PSR Program objectives. This would include the establishment of risk tolerances and thresholds to support program management activities
49. The audit also found there is a need to address program integrity issues and support the regulation of non-compliance within the PSR Program, through policy review and modernization.

Management has accepted the audit findings and developed an action plan to address the recommendations.