Risk-Based Internal Audit Plan 2016-2017 to 2018-2019

[ * ] An asterisk appears where sensitive information has been removed in accordance with the Access to Information Act and Privacy Act.

[ PDF version ]

1 Introduction

1.1 Purpose

This document presents the Privy Council Office (PCO) 2016-19 Risk Based Audit Plan (RBAP) which replaces PCO’s existing 2015-18 RBAP. This new RBAP identifies and describes the internal auditing engagements PCO’s Audit and Evaluation Division (AED) will conduct over the next three fiscal years to provide independent assurance to the Clerk of the Privy Council and PCO senior management on risk management, control and governance processes within the department. 

Robust risk based audit planning lays the foundation for a strong internal audit function and is necessary to provide the Chief Audit and Evaluation Executive (CAEE) with information needed to plan value added assurance engagements that are both meaningful and relevant to the department. The engagements included in this plan were selected on the basis of a comprehensive analysis of key PCO and other documents supported by consultations with PCO senior executives, the external members of the PCO Audit Committee, the CAEE at Shared Services Canada, and the CAEEs from two departments with which PCO is proposing to conduct joint audits. The engagements identified herein focus on areas of risk and significance and on PCO priority areas.

1.2 Internal audit policy

The Treasury Board (TB) Policy on Internal Audit (2012) defines internal auditing in the Government of Canada as a professional, independent and objective appraisal function that uses a disciplined, evidence-based approach to assess and improve the effectiveness of risk management, control and governance processes. This is also referred to as providing assurance. It is intended to assist decision-makers with exercising oversight and control over their organizations and with applying sound risk management.

The Policy and its supporting Directive on Internal Auditing in the Government of Canada and the Internal Auditing Standards for the Government of Canada confer planning responsibilities on Chief Audit Executives, Departmental Audit Committees (DAC), Deputy Heads and the Comptroller General for Canada. PCO’s CAEE prepares the department’s RBAP and ensures it is vetted with PCO’s Executive Committee and DAC prior to it being jointly recommended by PCO’s CAEE and DAC Chair for approval by the Clerk.

1.3 Profile of the Department

PCO provides professional, non-partisan advice and support to the Prime Minister, the ministers in the Prime Minister’s portfolio and Cabinet. PCO supports the development of the Government of Canada’s policy and legislative agendas, coordinates responses to issues facing the Government and the country, and supports the effective operation of Cabinet. PCO is led by the Clerk of the Privy Council. In addition to serving as the Deputy Head for PCO, the Clerk also acts as Secretary to the Cabinet and the Head of the Public Service.

PCO has three primary roles:

1. provide non-partisan advice to the Prime Minister, portfolio ministers, Cabinet and Cabinet committees on matters of national and international importance;
   
2. support the smooth functioning of the Cabinet decision-making process and facilitate the implementation of the Government’s agenda; and
   
3. foster a high performing and accountable Public Service.

1.4 The PCO Internal Audit Function

AED has an annual budget of just under $700,000 for 2016-17 and for each of the two subsequent fiscal years. The budget includes salaries of the Division’s four staff and the three external members of the Audit Committee, as well as the operating budgets for both AED and Audit Committee.  

AED will manage its financial resources prudently while keeping its focus on delivering the auditing engagements outlined herein. Should financial resources become a constraint to delivering planned projects, the CAEE will work with PCO Finance, management and with the Audit Committee to effectively manage any budget or project delivery issues in light of established audit priorities.

1.5 Performance relative to Last Year’s RBAP

In 2015-16, AED worked forward on a variety of diverse projects from the earlier 2014-17 RBAP. This included completing three projects that were in progress at the start of 2015-16; launching and completing one project during the year; launching two other projects that were nearing completion at year end; and launching an additional project just before year end that is being completed in 2016-17.  The table below provides additional details.

2 Audit Planning Approach, Methodology and Priorities

2.1 Planning Approach

PCO’s first RBAP was prepared in 2008. That RBAP, and all which have followed it, were prepared based on guidance from the Office of the Comptroller General (OCG) and based on audit planning requirements outlined in the TB Internal Audit Policy Suite. 

When developing the RBAP two years ago, AED adopted and used expanded audit planning consultations (see Section 2.2), a more streamlined audit universe reflective of PCO’s Program Alignment Architecture (Section 2.3), and a more objective approach to assessing risk and internal controls (Section 2.4). These elements were repeated during the development of last year’s RBAP, and were maintained during the development of this new 2016-19 RBAP. Consistent with a change in the RBAP clearance process implemented last year, this year’s RBAP was vetted first with Executive Committee members and then at DAC before being jointly recommended by the DAC Chair and CAEE for Clerk approval.

2.2 Planning Inputs

As in past years, several information sources were used to develop this RBAP:

• ongoing priority areas for audit coverage identified by the Clerk to Audit Committee;
  
• input from Deputy Secretaries and other senior managers provided to Audit Committee;
  
• CAEE interviews with Deputy Secretaries, the Assistant Deputy Minister, Corporate Services Branch (ADM-CSB), the external members of PCO’s DAC, and the CAEE at Shared Services Canada;
  
• areas of risk identified in PCO’s evolving Risk Profile, and coverage of management priorities in documents such as PCO’s Report on Plans and Priorities, its Departmental Performance Report, and PCOs Integrated Business and Human Resources Plan;
  
• Management Accountability Framework assessment results;
  
• information on OCG and other external assurance provider audits; and
  
• results from prior internal audits including management’s self-reporting on corrective actions implemented in response to prior audit recommendations.

2.3 The PCO Audit Universe

The audit universe below is based on PCO’s Program Alignment Architecture and includes auditable entities that may be audited in whole or in part.

2.4 Ranking the Audit Universe

Next, audit planning ranked the various auditable entities in the audit universe using a three step process. The following describes the process and criteria, and the manner in which they were applied.

Step 1: Assessing Risk Exposure

First, using the indicators below, the CAEE assessed all auditable entities for their risk exposure based on known risk information and the risk environment: 

This analysis provided information on the risk exposure of auditable entities. Internal controls in place to mitigate risk were assessed next.

Step 2: Assessing the Internal Control Framework

Step 3: Bringing it all together

The systematic application of the steps described above produced risk information on each auditable entity in the audit universe. The CAEE and the AED team then considered this risk information in relation to the various planning inputs described in Section 2.2 above, and applied professional judgement in categorizing each auditable entity within one of the three Audit Priority categories in the table below. Once this analysis was completed and the auditable entities were prioritized, individual projects were identified for inclusion in this 2016-19.  The table below presents the three Audit Priority categories.

3 Three-Year Audit Plan

3.1 Audit Plan Summary

Under the TB Directive on Internal Auditing in the Government of Canada, CAEEs are responsible for “…..establishing and updating at least annually a multi-year plan of internal audit engagements….which is focused predominantly on the provision of assurance services…”.  Internal auditing is designed to add value and improve an organization’s operations by providing assurance on those areas to which internal audit resources are applied. However, recognizing that a “one size fits all” approach is not always best, this RBAP includes two forms of assurance engagements which are widely accepted within the internal audit community – audit engagements and review engagements. 

Audits and reviews are similar in that they are both conducted to provide assurance on a given subject. They differ in that a review will not normally involve the extensive data gathering and in‑depth substantive testing which are typical characteristics of an audit. For this reason, a review will generally be shorter in duration and less costly than an audit, but an audit will provide a higher level of assurance than a review.

The focus of an assurance project (audit or review) may be at the auditable entity level, or it may be on a component organization, operation or activity within an auditable entity. An assurance project may also cut across auditable entity lines if the organization, operation or activity being audited or reviewed similarly cuts across auditable entity lines.

Within the subset of audits proposed here-in, PCO plans to undertake its first two (2) joint audits in partnership with other federal departments.  This RBAP also proposes other types of projects including risk assessments, a self-assessment of PCO against a new government’s framework, and a required evaluation project that will use the output from a 2015-16 Performance Measurement Strategy project.  The table below outlines the PCO audits, reviews and other engagements proposed over the next three years.

The “Planned Engagements After Priority Ranking of the Audit Universe” table on the next page depicts the results from the CAEE’s priority ranking process and indicates in which Auditable Entity the engagements identified above are planned within the overall audit universe over the next three‑year cycle.  Auditable Entities in which no engagements are contemplated will be reconsidered for coverage during successive annual audit planning exercises. Should circumstances change in a given Auditable Entity during a given year, audit resources can be reassigned as required.

In the following section 3.2 of this RBAP, each planned engagement (other than the Fraud Risk Assessment (which is a project being repeated) and the Preparation for the 2018-19 Practice Inspection (which is work internal to the Audit and Evaluation division) is presented in a separate “Project Profile” table that outlines the engagement’s preliminary objective(s) and scope, information on the rationale for selection, and additional relevant information. 

The objective(s) and scope are considered preliminary because they are based only on information gathered to date. Once an engagement is launched and AED staff are engaged both in gathering detailed information and documents and conducting project planning interviews, the objective(s) and/or scope of that engagement may be refined to target audit and evaluation resources to the areas of highest risk or significance.

3.2 Project Profiles

2016-2017

2017-2018

2018-2019

Appendix A – Risk Factors