Internal Audit of the International Delivery of the Passport Program

Internal Audit & Accountability Branch
1 June 2017

I. Background

Introduction

1. In July 2013, the Canadian Passport Order that establishes the administration and delivery of the passport program was amended to provide the Minister of Immigration, Refugees and Citizenship Canada (IRCC) the authority over the refusal, revocation, withholding, recovery, and provision of instructions regarding Canadian passports and with the power to authorize the Minister of Global Affairs Canada to exercise specific administrative power over the delivery of the program outside Canada. Employment and Social Development Canada (ESDC) delivers the passport program in Canada.
2. Prior to July 2013, the administration and delivery of the passport program was performed by Passport Canada, a Special Operating Agency that reported to the Minister of Global Affairs Canada (GAC). The delivery of the program outside of Canada was governed by a Memorandum of Understanding (MOU) that was established in 2009 and expanded upon in an Annex that was signed in 2010.
3. Once IRCC assumed accountability for the program in 2013, a separate MOU was signed by IRCC, GAC and ESDC to transfer accountability to IRCC and serve as a written agreement to record the common understanding of the participants. This MOU re-affirmed that the delivery of the program outside Canada would continue based on the 2009 MOU and 2010 Annex. The IRCC and GAC roles and responsibilities are outlined below.

IRCC roles and responsibilities

4. IRCC is accountable for the passport program, including program policy design, service delivery, decisions on passport eligibility, refusal and revocation, and management of passport service fee revenues through the Passport Canada Revolving Fund, including reporting to Parliament under the User Fees Act and the Revolving Funds Act. In addition, IRCC is responsible for providing functional guidance to GAC on program and service delivery; and conducting on-going program performance monitoring, measurement and reporting, as well as audit and evaluation.
5. Furthermore, IRCC is responsible for program integrity and security matters related to passport and other related travel documents, entitlement quality assurance, and managing passport business technology systems.

Global Affairs Canada roles and responsibilities

6. GAC oversees the delivery of consular services to Canadians outside of Canada. For the delivery of passport and related travel document services, GAC is responsible for the following:
   • Passport application intake, validation and examination;
   • Processing applications;
   • Producing temporary passports and emergency travel documents;
   • Issuing passports on behalf of IRCC as prescribed in the Canadian Passport Order;
   • Forwarding applications that require further examination to IRCC officials;
   • Electronically forwarding completed applications to IRCC for transmission to ESDC for printing; and
   • Receiving passports for distribution to applicants.
   In fiscal-year 2015-16, these services were provided at 134 missions outside of Canada. It should be noted that IRCC also has an MOU with ESDC for the delivery of the passport program inside Canada and for applications for Canadian passports from the United States of America.
7. For 2015-16, approximately 186,800 passports were issued outside of Canada (see Table 1). For comparison purposes, 4.8 million passports were issued in Canada during the same period.

II. Audit objective, scope and methodology

Audit objective and scope

8. The audit objective was to examine the implementation of selected internal controls to provide reasonable assurance that the administration and delivery of passport program services outside Canada complied with established agreements and policies.
9. The audit included an examination of passport program administration by IRCC National Headquarters and delivery by GAC officials located at 13 missions outside Canada. The internal controls under examination were:
   • Decision-making authorities, guidance and staff training related to processing travel documents;
   • Passport and related travel document inventory management controls;
   • Fee collection and reconciliation controls; and
   • Service delivery performance against established targets.
10. The scope covered the period from October 1, 2015 to September 30, 2016 and the report includes information and data obtained up to March 31, 2017. The number of passports issued in 2015-16 for the missions that were included in the audit scope was 57,594 or approximately 31 percent of the total issued outside Canada (See Table 2 for details).

11. The audit scope did not include an assessment of the delivery of the passport program in-Canada by ESDC, and did not assess the overall governance of the program, such as the GAC-IRCC Working Group that was established to coordinate the administration and delivery of the program.

Methodology

12. The following audit procedures were performed:
    • Interviews with a number of IRCC National Headquarters officials as well as GAC Canada-Based Staff (CBS) and Locally-Engaged Staff (LES) at 13 missions;
    • GAC internal audit staff conducted site visits to Seoul, Moscow, Algiers, Abuja and New Delhi; and IRCC internal audit staff conducted site visits to Singapore, Hong Kong, Shanghai, Beijing, Mexico City, Lima, Sao Paulo and Beirut;
    • A reconciliation of travel document inventories was performed at 13 missions;
    • A review and analyses were performed on various policies, guidance documents, and the processes and procedures in place related to fee reconciliations;
    • An analysis of service delivery against established 20 business day standards for all missions that processed passport and related travel document applications in 2016; and
    • A review of 659 completed passport applications was conducted – approximately 50 at each mission visited to test compliance with processing policies and guidance.

Statement of Conformance

13. The audit is in conformance with the Internal Auditing Standards for the Government of Canada as supported by the results of the quality assurance and improvement program.

III. Audit findings and recommendations

Policy guidance, training and decision-making authorities

14. Criteria. It was expected that CBS and LES who provided passport and related travel document services outside Canada were provided guidance, training, certification to process applications, and had the appropriate delegated authority to make decisions.
15. Conclusion. Overall, IRCC provided guidance and policy direction to GAC staff responsible for processing passport and related travel document applications outside Canada. All staff received initial training and certification to perform their roles and responsibilities. The areas for improvement related to communicating passport program policy changes across the global processing network and developing a strategy to support quality assurance reviews.

Guidance provided to GAC employees that process travel documents

16. At IRCC National Headquarters, the Passport Planning and Foreign Operations Division (PPSF) of the International Network Branch is responsible for providing guidance and policy direction to support program delivery outside Canada. The PPSF team works with their GAC counterparts to coordinate the administration of the program abroad. Furthermore, the PPSF division issues approximately three major policy changes / updates per year and is responsible for disseminating these to ensure that the new instructions are implemented outside Canada.

Training and certification

17. The PPSF division develops and delivers a one week training course to all CBS that have not been certified prior to being posted to missions overseas where they will have responsibilities for delivering the passport program. At the end of the course, the CBS must pass an examination to receive certification to fulfill their delegated authorities with respect to making decisions on passport and related travel document applications. This mandatory training has been in place since 2007. The PPSF also provides the same training to LES outside Canada to ensure that they receive certification to perform their roles and responsibilities.
18. Once the CBS and LES obtain certification, they are provided the appropriate level of access to the Passport Management Program (PMP) information technology (IT) application used to process passport applications outside Canada.
19. For the 13 missions visited, all CBS decision-makers and LES had attended the mandatory training and obtained the required certification. It was noted that once a CBS or LES is certified following their initial training, there are no further formal training requirements. As such, some staff at missions obtained their certification more than ten years ago and have had no further formal training.
20. PPSF does provide refresher training upon request. In addition, refresher training is mandatory for CBS who have not processed passport or related travel document applications for more than two years and who are posted to locations where they will have responsibilities to deliver the passport program.
21. The risk of not having a continuous formal training structure in place is that CBS and LES who deliver the program may not have complete knowledge of all policy or processing guidance changes. Changes are usually made to address emerging risks to program delivery and specific changes to application information requirements such as the acceptable size of applicant photographs or how an applicant’s name should be written in the passport document.
22. The normal process for communicating these changes and updates to missions is via email followed by conference calls with missions across the processing network. However, these calls were not conducted in 2016-17. Staff at missions indicated that receiving updates only by email was not the most effective manner to gain a full understanding of the policy and procedures updates and how they should best be implemented.
23. PPSF officials at IRCC informed the audit team that the past year was particularly challenging due to the amount of time that staff spent out of Ottawa on temporary duty overseas to assist missions with the implementation of the electronic travel application (eTA). PPSF plans to reinstate the formal conference calls in 2017-18.
24. Furthermore, with the current approach to updating overseas staff, there was no process to verify whether staff at missions read and understood the policy and procedural changes. A good practice could be to have staff sign-off that they have read and understood the changes and that local procedures have been revised accordingly. At present, there is no formal mechanism in place to ensure that policy and processing guidance changes are being received and understood across the global processing network.
25. Recommendation 1. Immigration, Refugees and Citizenship Canada should develop and implement formal training measures to inform staff processing passport and related travel document applications outside of Canada of updates to policies and procedures and ensure that staff understand and implement changes.

Decision-making authority

26. The 2009 MOU and 2010 Annex identifies that for passport and related travel document applications received at missions outside Canada, GAC CBS are responsible for approving all completed applications by reviewing all data, images, hardcopy files, and entitling authorized applicants to passport services. Entitlement includes verifying an applicant’s citizenship and identity before a passport file is approved and forwarded to Canada electronically for printing. In addition, the MOU Annex identifies that under exceptional circumstances and at the sole discretion of Passport Canada (now IRCC), some LES may be given passport approval authorities.
27. As of March 31, 2017, [Redacted].
28. Recommendation 2. [Redacted].

Quality assurance over applications processed outside of Canada

29. For in-Canada passport delivery, IRCC has a quality assurance program in place with ESDC to review application processing compliance; results are used to strengthen compliance, inform future changes to policies and procedures as well as identify potential training requirements. For applications received outside of Canada there is no systematic quality assurance approach in place with GAC to monitor program delivery compliance.
30. Based on the results of the audit review of 659 applications, a number of processing errors were identified that may have been identified in a formal quality assurance process. For example, 13 percent of the 659 accepted applicant photographs did not meet the established size criteria. In other instances the official passport program worksheet that should be used by passport assistants and officers was not fully completed in approximately 30 percent of the cases. The impact of not properly filling out the worksheet is that the mission does not have a complete record of the transactions that occurred with a client.
31. Along with the audit results, the audit team was informed that in March 2017 when IRCC officials were processing applications to support missions overseas, 35 percent of the completed applications had to be sent back due to applicant data entry errors which should have been identified and corrected by mission passport program assistants.
32. Recommendation 3. Immigration, Refugees and Citizenship Canada should develop and implement a quality assurance strategy to monitor passport and related travel document processing outside Canada to strengthen compliance to the policies and procedures, and program integrity. Quality assurance results should be used to inform future changes to policies and processing procedures as well as identify potential training requirements.

Travel document inventory management

33. Criteria. It was expected that key passport program assets such as blank travel documents and information technology system application access were controlled and safeguarded.
34. Conclusion. Overall, access to the information technology system used to process applications and blank travel document inventories were controlled and safeguarded at the missions visited.

Access to the PMP system used to process applications

35. For the 13 missions visited all CBS and LES had obtained the required certification and their access to PMP was in line with their responsibilities.

Management of blank travel documents outside of Canada

36. An inventory count was performed by the audit team at all 13 missions visited. Each mission’s number of blank emergency travel document and temporary passport booklets reconciled with expected inventories. The majority of the blank travel document inventories were stored in the high secure zone as required. In addition, the responsible CBS at each mission performed their roles with respect to the receipt of blank travel documents as well as monthly and quarterly inventory reporting.
37. [Redacted].

IRCC Headquarters blank travel document inventory management

38. Blank temporary passports and emergency travel documents are tracked using two separate IT system applications. At IRCC, blank travel documents are managed through a module in SAP – the IRCC financial management system. Outside Canada, inventories are managed by GAC officials in PMP. These applications are not fully interoperable and manual data checks are required. As such, each month after inventory reports are provided by missions, an IRCC Headquarters official manually verifies that the expected inventory data in SAP corresponds to the actual inventory data reported by missions.
39. As part of the audit team’s blank travel document inventory control test at the missions, an inventory list generated from SAP was provided to the audit team by IRCC officials. This list was used to perform expected inventory reconciliations with actual stocks on hand at missions.
40. [Redacted]. IRCC officials immediately addressed the inventory data issue. New internal controls have been put in place, which include verifications of the status of shipments and the locations where they were received.

Internal controls over the management of passport fees

41. Criteria. It was expected that fees were appropriately collected for passport and related travel document services and internal controls were in place to safeguard funds once collected
42. Conclusion. Overall, there is no means for IRCC to determine whether the appropriate fees are collected for passport and related travel document services. At missions, there were varying processes and procedures established with respect to linking completed application forms to the collection of fees and at IRCC Headquarters there is no overall reconciliation of passport fees collected to actual passports issued.

Management of the collection of fees outside of Canada

43. GAC officials are responsible for collecting fees for passport and related travel document services performed and accounting for these funds until they are transferred to IRCC. At most missions visited fees were collected from applicants by debit card, credit card or cheques. Some of the missions still could only accept cash from applicants and most other missions were moving away from accepting cash.
44. The procedures for end of day reconciliations between passport and related travel documents processed and associated fees varied across the processing network. In some instances, end of day reconciliations were performed by LES program assistants and submitted directly to the mission Finance section. In other instances, CBS reviewed reconciliations performed by the program assistants before submitting the documentation to the mission Finance section. The fact that the GAC financial management system and the PMP application are not interoperable further complicates the reconciliation process at missions outside of Canada.
45. There is also a risk associated with accepting cash payment for services. At two of the missions visited, there were internal control weaknesses related to the acceptance of cash, and, in both instances there were discrepancies between fees collected and travel documents issued. In one mission visited, the audit team could not trace receipts for cash payments for 25 percent of the completed passport applications reviewed. GAC Headquarters officials conducted a further review of the factors that contributed to this situation and have subsequently resolved the issue.
46. In another mission, the CBS responsible for overseeing the delivery of the program was unaware that the mission had changed procedures to accept credit card payments in addition to cash. The lack of awareness of methods of payments is a control weakness with respect to the reconciliation of fees received to passport and related travel documents issued at that mission. Overall, these control weaknesses present risks related to accounting for the overall revenues collected in delivering the program outside Canada.

IRCC Headquarters reconciliation of fees collected to passports issued outside Canada

47. The current processes to administer the transfer of fees collected from outside Canada to GAC Headquarters, and then to IRCC Headquarters does not allow for a proper reconciliation on the part of IRCC. The timing of the transfer of fees collected by GAC to IRCC varies depending on the mission. In addition, IRCC Finance officials do not have direct access to the PMP application that would provide the information needed to reconcile the number of travel documents issued to the funds received.
48. IRCC Finance officials informed the audit team that they did not reconcile the funds received from GAC to the number of passport and related travel documents issued outside Canada. As such, there is no control in place to ensure that IRCC collects the approximately $38.6 million per year in revenues related to the approximately 186,000 passports issued outside of Canada. An initial review of this issue by IRCC officials indicated that there was a discrepancy of approximately 1 percent when comparing the funds recorded as being received from GAC to the number of passports issued in fiscal-year 2016-17.
49. Recommendation 4. Immigration, Refugees and Citizenship Canada should assess the risks related to not reconciling the overall amount of the fees collected from GAC to the number of passport and related travel documents issued to clients outside of Canada and develop an appropriate mitigation strategy to address the inherent risks.

Performance in meeting client service standards for passports issued outside of Canada

50. Criteria. It was expected that passports were provided to clients who applied outside Canada within approved service standards.
51. Conclusion. In 2016, 92 percent of the passport applications received outside Canada were processed within the established service standards. When missions were at risk of not meeting the service standard, IRCC officials provided application processing support.
52. In accordance with the Canadian Passport Order, fees are collected for the provision of passport program services outside Canada. Accordingly, IRCC has the obligation to establish and communicate service standards to Canadians submitting applications for passport and related travel document services. The established service standard for applications received outside of Canada is: 90 percent of complete applications are to be processed within 20 business days.
53. The MOU and related Annex identifies the service standards that GAC and IRCC staff must meet in processing travel document applications. The 20 day service standard has 5 days of contingency built into the process and is outlined below:
    • Mission staff have five business days between the date the application is considered complete and the rendering of a decision to approve or reject the travel document application;
    • When the application is approved at the mission the officer transfers the file to IRCC’s PPSF. The Passport Division has three business days to clear security alerts and print the passport at the processing centre in Canada; and
    • The processing centre then has seven business days to return the passport to the mission once printed.
54. The audit team reviewed data from all missions that processed passport and related travel documents outside Canada in 2016. The results demonstrated that 92 percent of the passport applications received outside Canada were processed within the established service standard.
55. Eighty-seven (87) percent of the missions met the service standard. One large mission visited and a small number of other missions had challenges in meeting the 20 business day service standard during the past two years. This became a significant program risk with the introduction of the eTA, which increased the demand for passport and related travel document services at some missions. IRCC sent temporary duty personnel to these missions to support application processing as required. At one point, the application backlog was so large that some missions sent client applications directly to IRCC Headquarters for processing. The support provided to these missions enabled them to return to meeting the 20 day service standard.
56. The application processing support provided to missions by IRCC officials in fiscal-year 2016-17 was funded by IRCC through the Revolving Fund. Under normal circumstances, the MOU specifies that GAC is responsible for funding IRCC support to missions when required. In fiscal-year 2017-18, the MOU provision that GAC funds IRCC support has been re-instated. This may present risks to a select number of missions that have required support to meet processing standards.

IV. Conclusion

57. The administration and delivery of the passport program outside Canada is based on agreements that were put in place in fiscal-year 2009-10, prior to IRCC assuming overall program accountability. The audit found that the administration and delivery of the passport program agreement provisions and updated policy guidance could be improved. While passport and related travel document service delivery is generally meeting the established performance standards, there are a number of areas that require attention. These include: enhancing the communication of policy changes and updates to missions; [Redacted]; assessing the risks of not reconciling the fees collected by GAC and transferred to IRCC to the number of passports and emergency travel documents issued; and, putting in place a systematic quality assurance process.

Appendix A – Management response