Compliance recipient audit of Oxaro (Vaccine Injury Support Program): Summary report
On this page
- Context and audit scope
- Observations: Compliance of expenditures
- Observations: Assessment of program management and reporting practices
- Conclusion and opportunities for improvement
- Appendix: Independent auditor’s report
Context and audit scope
Samson and Associates was contracted by the Public Health Agency of Canada (PHAC) to perform a Compliance Recipient Audit of Oxaro Inc. (Oxaro) under the Contribution Agreement No. 2122-HQ-000047 established for the development and administration of the Vaccine Injury Support Program (VISP).
The audit had 2 objectives:
- To provide assurance that the funding provided to Oxaro was used for its intended purposes and in accordance with the terms and conditions of the agreement; and
- To assess whether Oxaro managed the VISP effectively, including the processing of claims and payments to beneficiaries, and the reporting of financial and program information to PHAC.
Financial testing was conducted on a sample of transactions representing over 30% of administrative expenditures claimed by Oxaro in fiscal year (FY) 2024–25 to ensure that expenses were eligible, attributable to the VISP program, incurred, and properly supported. The audit concluded that administrative expenditures claimed by Oxaro were compliant, except for one minor adjustment relating to internal audit costs where the average hourly rate applied exceeded the maximum eligible rate specified in the Contribution Agreement.
Processing testing was conducted on a sample of 36 VISP claims representing just over 30% of total VISP payments to beneficiaries in FY 2024–25 to ensure that claims were processed and paid based on processing principles and procedures established by Oxaro. The audit concluded that claims processing and benefit payments were performed in accordance with procedures, with minor exceptions.
A review of VISP financial and activity reports for FY 2024–25 was also conducted to ensure that Oxaro submitted all reports required under the Contribution Agreement. The audit concluded that Oxaro submitted all required reports to PHAC in a timely manner, except for a few reports that were submitted after the expected timelines.
Observations: Compliance of expenditures
The section below summarizes key testing results and findings from the review of VISP expenditures.
Results and findings
| Expenses category | Budget ($) | Claimed ($) | Adjustment ($) | Amount audited ($) |
|---|---|---|---|---|
| Personnel: Full/part-time employees | 7,430,505 | 7,533,614 | 0 | 7,533,614 |
| Contractual employees | 3,442,148 | 3,293,421 | 0 | 3,293,421 |
| Materials | 749,394 | 756,929 | 0 | 756,929 |
| Other | 352,262 | 390,346 | (11,705) | 378,641 |
| Total | 11,974,309 | 11,974,310 | (11,705) | 11,962,605 |
Key audit findings related to VISP expenditures are as follows:
- Internal audit (other costs): While the internal audit costs were supported and attributable to the program, an adjustment of $11,704.50 was identified as the applied average hourly rate of $204 per hour, exceeded the $150 per hour limit specified in Amendment 8 of the Contribution Agreement.
- Audit readiness: During the audit, additional time was required to obtain supporting documentation for selected samples (e.g., working papers for internal audit services, supporting documentation for external audit allocations related to the International Organization for Standardization). This observation highlights an opportunity to strengthen documentation retention practices to support accountability and conduct of efficient audits.
- Audit trail and supporting documentation: Supporting documentation for expenditures related to the cloud-based Saas system was not available and additional audit procedures were required to obtain sufficient audit assurance. This highlights an opportunity to improve complete retention of documentation in support of program expenses to ensure a robust audit trail.
Observations: Assessment of program management and reporting practices
The section below summarizes key test results and findings from the review of claims processing, and financial and activity reports submitted to PHAC.
Results and findings
| Types of claims | Findings |
|---|---|
Claims approved for causality/compensation at the Medical Review Board (21) |
Two process deviations were identified:
No other processing errors were identified. |
Claims denied at the Medical Review Board (10) |
One process deviation was identified related to a conflict-of-interest (COI) form signed by a physician in December 2025 for a Board meeting that took place in April 2024. No other processing errors were identified. |
Inadmissible claims (5) |
All inadmissible claims reviewed were processed in accordance with documented procedures, and no processing errors were identified. |
Key audit findings related to VISP claims processing and submission of financial and program reports are as follows:
- Claim processing procedures: Oxaro had documented procedures for end-to-end claims processing and key controls were in place to ensure effective management of claims.
- Claim processing timeliness: Timeliness challenges were identified across the claims processing lifecycle, primarily driven by a sustained volume of claims that was expected to decrease over time but remained higher than anticipated. Processing timelines were mostly due to the time taken by health care professionals in providing medical records to Oxaro.
- Service standards and performance tracking: Service standards and performance monitoring requirements for claims processing were not established in VISP procedure documents. While Oxaro tracked certain data points to monitor claims processing timelines, some key milestone dates were not consistently and accurately recorded (e.g. no recording or tracking of dates for initial contact with claimant, initial requests to health care providers, etc.). These gaps limited the ability to fully assess end-to-end processing timelines across the claims processing lifecycle.
- Process improvements: Oxaro has adjusted processes and team roles to improve efficiency and manage operational pressures. One example of such improvements observed during the period includes the assignment of case managers solely dedicated to claims eligibility reviews which allowed for a higher number of eligibility reviews completed in 2024–25.
- Financial and activity reports: Oxaro submitted all required financial and activity reports for FY 2024–25 and PHAC accepted them. All report content required under the agreement was included in the reports. However, a few reports (e.g., financial actuals for Q2 and 4, audit reports) and a budget transfer approval were submitted after required deadlines, resulting in partial non-compliance related with timeliness established under the contribution agreement.
Conclusion and opportunities for improvement
Overall, the audit found that Oxaro complied with the terms of the contribution agreement and effectively managed expenditures, claims processing, and submission of financial and activity reports to PHAC.
However, certain opportunities for improvement were identified during the course of our work.
These opportunities do not represent corrective actions for instances of noncompliance. Rather, they reflect areas where existing management practices could be strengthened to enhance the effectiveness of program oversight and delivery.
- Documentation retention and audit readiness: VISP officials should strengthen documentation management and retention practices to ensure a complete and readily available audit trail for all invoiced amounts.
- Claims processing timeliness and capacity: VISP officials should strengthen claims forecasting and capacity planning to align claims processing resources and workflows with incoming claim volumes, and mitigate delays, including those related to medical records collection.
- Service standards and performance tracking: VISP officials should determine clear service standards for the processing of claims and strengthen the consistent capture of key claims processing milestone dates to support end‑to‑end performance monitoring.
Appendix: Independent auditor’s report
Opinion
We have audited the amounts claimed as presented in the “Observations: Compliance of expenditures” section with respect to the Project for the period of April 1, 2024, to March 31, 2025, of Oxaro Inc. (the Recipient).
In our opinion, the audited amounts as presented in the “Observations: Compliance of expenditures” section present fairly, in all material respects, the expenditures eligible under the financial terms and conditions of the Agreement for the period of April 1, 2024, to March 31, 2025, and the financial information of the Recipient is prepared, in all material respects, in accordance with the financial terms and conditions of the Agreement signed on June 1, 2021, with PHAC and Amendments 1 to 8 to the Agreement.
Basis for opinion
We conducted our audit in accordance with Canadian generally accepted auditing standards. Our responsibilities under those standards are further described in the auditor's responsibilities for the audit of the financial information section of our report. We are independent of the Recipient in accordance with the ethical requirements that are relevant to our audit of the financial information in Canada, and we have fulfilled our other ethical responsibilities in accordance with these requirements. We believe that the audit evidence we have obtained is sufficient and appropriate to provide a basis for our opinion.
Emphasis of matter: Basis of accounting and restriction on distribution and use
We draw attention to the “Observations: Compliance of expenditures” section of this report which is prepared to assist PHAC in assessing the ineligible project expenses audited and establishing its contribution on these expenses. As a result, the financial information presented in the “Observations: Compliance of expenditures” section may not be suitable for another purpose. Our report is intended solely for the Recipient and PHAC and should not be distributed to parties other than the Recipient and PHAC. Our opinion is not modified in respect of this matter.
Responsibilities of management and those charged with governance
Management is responsible for the preparation of the financial information in accordance with the financial terms and conditions of the Agreement, and for such internal control as management determines is necessary to enable the preparation of the financial information that is free from material misstatement, whether due to fraud or error. Those charged with governance are responsible for overseeing the Recipient’s financial reporting process.
Auditor's responsibility for the audit of the financial information
Our objectives are to obtain reasonable assurance about whether the financial information is free from material misstatement, whether due to fraud or error, and to issue an auditor's report that includes our opinion. Reasonable assurance is a high level of assurance but is not a guarantee that an audit conducted in accordance with Canadian generally accepted auditing standards will always detect a material misstatement when it exists. Misstatements can arise from fraud or error and are considered material if, individually or in the aggregate, they could reasonably be expected to influence the economic decisions of users taken on the basis of this financial information.
As part of an audit in accordance with Canadian generally accepted auditing standards, we exercise professional judgment and maintain professional skepticism throughout the audit. We also:
- Identify and assess the risks of material misstatement of the financial information, whether due to fraud or error, design and perform audit procedures responsive to those risks, and obtain audit evidence that is sufficient and appropriate to provide a basis for our opinion. The risk of not detecting a material misstatement resulting from fraud is higher than for one resulting from error, as fraud may involve collusion, forgery, intentional omissions, misrepresentations, or the override of internal control.
- Obtain an understanding of internal control relevant to the audit in order to design audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of the Recipient's internal control.
- Evaluate the appropriateness of accounting policies used and the reasonableness of accounting estimates, if any, and related disclosures made by management.
We communicate with those charged with governance regarding, among other matters, the planned scope and timing of the audit and significant audit findings, including any significant deficiencies in internal control that we identify during our audit.
We also provide those charged with governance with a statement that we have complied with relevant ethical requirements regarding independence, and to communicate with them all relationships and other matters that may reasonably be thought to bear on our independence, and where applicable, related safeguards.
Samson and Associates CPA/Consulting Inc.
Gatineau (Quebec)
March 31, 2026