Audit of Management Controls and Governance around Border Reopening
Organization: Public Health Agency of Canada
Date published: 2022-10-25
Final report
May 2022
Table of contents
- List of acronyms
- Executive summary
- Planning documentation
- Governance structure
- Roles and responsibilities
- Appendix A – About the audit
List of acronyms
- DQF
- Designated Quarantine Facilities
- PHAC
- Public Health Agency of Canada
- REC
- Regional Executive Committee
- RO
- Regional Operations
- ToR
- Terms of Reference
Executive summary
Context
Canada closed its borders to most non-essential travel on March 21, 2020, due to the COVID-19 pandemic. Since then, Canada gradually reopened its borders in a four-phased approach, starting on August 9, 2021, for fully vaccinated U.S. citizens and permanent residents residing in the US and, as of September 7, 2021, the borders reopened for fully vaccinated travellers from any country to enter Canada for discretionary travel. Reopening the borders involved the Public Health Agency of Canada (PHAC) who provided planning and guidance at every stage.
All of the strategic decisions regarding the reopening were made at higher levels of government. Within the Agency, this audit focused on the Health Security and Regional Operations Branch (HSROB), which had responsibility for operationalizing and implementing some of the decisions. Coordinating the reopening of borders has involved contributions from the Regional Operations (RO) Directorate, the Centre for Biosecurity, the Centre for Border Travel Health, the Testing Directorate, and the Data Hub. Activities relevant to border reopening within HSROB included collaborating with other federal departments (e.g., Canadian Border Services Agency), and stakeholders (e.g., airports, cruise lines) to operationalize government decisions. Although these were not part of the scope of this audit, various governing bodies continue to oversee, provide guidance and make decisions to support the border measures including DM, ADM, and DG working groups.
This audit was conducted at the same time as management was coordinating the reopening of the borders. We provided advice in real time as management was dealing with the dynamic complex environment.
Audit objective
The objective of this audit was to determine if appropriate plans and management controls were in place to facilitate border reopening to non-essential travel successfully.
The scope of this audit engagement was limited to readiness at ports of entry, and included a review of the related governance structure, risk management strategies, monitoring, and reporting activities done from May 1, 2020, to September 30, 2021.
Findings
Good processes
- The Agency's governance structure allows for timely discussions around key issues
- The Agency's committee roles and responsibilities are clearly defined in Terms of Reference (ToR)
- Ongoing consideration of resource needs at ports of entry through committee discussions and trackers
- A documented process for providing recommended changes required for border reopening
- Continuous monitoring of key metrics and the evolving border context during committee discussions
Areas for improvement
- Documenting decision making from start to finish, especially for operational decisions or outputs from committees
- Appropriately documenting risk considerations and mitigation strategies in planning documents and committee Records of Decisions
- Reviewing and assessing the governance structure for adequacy and streamlining
- Ensuring that all ToRs for committees have been approved at the proper level
Conclusion
We found that the necessary elements of planning and management controls were in place to support border reopening to non-essential travel. Planning processes were developed and documented and management controls were, for the most part, implemented. For example, processes to allow for operational adjustments and monitoring of key metrics for the evolving border context were in place.
We identified weaknesses in the documentation of decisions at the implementation level, in risk management, and in the Agency's governance structure, including the approval of committee ToRs. For example, it was uncertain if the Agency's committees in place were operating as efficiently as they could, given the number of committees and the similarities between the issues they discussed.
Planning documentation
Context
To ensure borders successfully re-opened, PHAC had the responsibility to develop and coordinate a planned approach taking into consideration all partners, such as other government departments at the federal, provincial, territorial and municipal levels. This planning included the development of guidance, contingency plans and processes to help ensure a smooth transition to the implementation of the phased approach.
What did we expect to find?
We expected to find sufficient planning documentation, including guidance, procedures, and recommendations, to facilitate the transition to border reopening at ports of entry. We also expected to confirm that these plans were developed, analyzed, or reviewed through the appropriate governance process, and that decision making was appropriately documented. We also expected to find that risks to border reopening were discussed, identified, assessed, and mitigated.
Findings
Overall, planning documentation was in place to help guide activities related to the border reopening. A deck presented to senior management in June 2021 included a three-phased approach to border reopening. This document also provided context, examples of existing pressures, tools for risk mitigation, and a proposed communications and stakeholder engagement approach. The three-phased approach for reopening was driven by vaccination rates across the country as the pandemic progressed, with a general outline of steps to be taken in each phase. In July 2021, an updated deck was presented at a Deputy Minister Interdepartmental Borders Committee, which signaled a shift from a three-phased to a four-phased reopening approach. This deck outlined circumstances that may warrant a pause in border reopening or a scaling back of border reopening, along with a proposed framework with indicators and next steps for each scenario. The deck also included strategic and risk considerations, a proposed communications approach, and next steps.
In addition, the PHAC 2021-22 Departmental Plan included commitments to identify and mitigate travel-related public health risks by maintaining a presence at ports of entry, continuing to develop and enforce PHAC's Emergency Orders in Council (OICs), enabling traveler compliance to federal requirements at the border, and continuing to monitor and report on border measures.
Other key documents for guiding the response at the border include a Blueprint for Organizational Efficiency, a Human Resource Support Action Plan, a Framework for scaling down use of Designated Quarantine Facilities, and other logistical planning documents. The Office of Audit and Evaluation's attendance at Regional Operations committee meetings confirmed that operational planning documents were discussed as needed.
The majority of the documents reviewed were strategic in nature, and did not necessarily provide specific courses of action, such as processes, Standard Operating Procedures, and specific indicators. Therefore, while guidance was provided around planning and procedures, they were not always defined. In addition, the Office of Primary Interest confirmed that decisions on planning documentation were made by discussing their content in meetings, combining input from various groups into one document, and submitting documents to HSRO senior management. As a result, discussions regarding the drafting of planning documents (e.g., version control, breakdown of input provided) was not consistently documented.
Lastly, most of the documents reviewed did not consider risks in a consistent manner. For instance, although risks were considered in both presentations mentioned above, risks were not sufficiently documented in the other documents reviewed. Even though risks related to planning were discussed during meetings, there was no evidence that these were considered during the drafting or revision of planning documents.
Conclusion
There was significant planning documentation in place, as well as some guidance provided, to facilitate the reopening of borders to non-essential travel. Committee meetings also discussed the content and development of these planning documents. However, documents were largely strategic in nature and did not always prescribe a specific course of action. In addition, risk considerations and management, as well as decision making were not always consistently documented.
Recommendation 1
We recommend that the Vice President of the Health Security and Regional Operations Branch review processes to ensure that specific courses of action, risk considerations, and decisions are documented and appropriately archived.
Management response
A review of the processes will be implemented to enhance current practices to document and appropriately archive specific courses of action, risk considerations and decisions taken at the Branch and Centre level Committees.
Governance structure
Context
The same governance structure (interdepartmental DM and ADM level committees, including Industry leaders like airports and cruise lines) put in place for the response to the pandemic continued to operate and were also involved in the decision making piece for border reopening.
Although these committees were important to the overall strategic piece of the reopening of borders, the scope of this audit only included what was under the Agency's responsibilities as well as the Regional Operations role. The Regional Operations governance structure has multiple committees in place which includes the Regional Executive Committee (REC) and its supporting sub-committees help implement border decisions at ports of entry. Sub-committees of the REC provide input and recommendations around human resources, real property and security, policy and implementation issues, compliance and enforcement, and the logistics surrounding DQFs and Government Authorized Accommodations.
Additional committees in place in HSRO to support border reopening include the Border Measures Implementation Committee, the Land Ports of Entry Testing Implementation Committee, the Data Management Working Group, the Health Portfolio DG Borders Committee, and weekly policy development meetings.
What did we expect to find?
We expected to find that the governance structure in place facilitated timely decision making and communication of these decisions. We also expected that the committees would monitor their decisions and revisit them as required. Lastly, we expected that the governance structure would facilitate discussions around resource needs, identify any gaps at ports of entry and adjust as necessary.
Findings
Governance structure – Overall
Overall, the audit team found that there was a governance structure in place to support border reopening to non-essential travel. Committees in place included committees such as: the REC and its sub-committees; as well as others listed in the context section of this page. Committees met at the frequency determined in their Terms of Reference, ensuring that issues were discussed in a timely manner. OAE's attendance at committee meetings found that issues of concern were discussed, although the majority of committees focus was for information sharing rather than decision making. We noted overlap between the committees, as some discussed the same issues and had similar memberships (i.e., REC and its sub-committees).
The committees in place allowed PHAC to raise significant risks, though next steps or mitigating measures were not always discussed. The documentation review found that various risks were incorporated into some of the planning documents reviewed by the audit team. In addition, resource and funding needs were identified during committee meetings on an ad-hoc basis. Certain operational committees, such as the REC HR Sub-Committee, the Real Property Advisory Committee, and the Border Data Leads Working Group were in place specifically to discuss HR, IM/IT, and real property needs.
The committees supporting border reopening demonstrated continuous monitoring of the evolving border situation, as outlined in the documentation reviewed and OAE's meeting attendance. However, in general, decisions regarding corrective actions were not made during committee meetings. Rather, key issues were flagged to management for follow-up after meetings. Given that decision making during meetings was limited, communication of decisions to staff outside of membership lists was not observed.
Decision-making process
The operational decision-making process largely consisted of compiling input from various groups into one document, which was then approved by HSROB's senior management. Previous iterations and versions of documents were not always available, making it difficult for the audit team to follow the trail of some of the changes from start to finish.
The proposal process for PHAC's broader recommendations on border measures was well defined and documented. We reviewed three examples of recommendations and found that they had followed the process, were sufficiently documented, and had received the proper approvals. In addition, debriefs were provided to key stakeholders.
Conclusion
The Agency's governance structure facilitated timely discussion of risks and resource needs, and the evolving border context was monitored and discussed during committee meetings. However, we found decision making during the Agency's committee meetings was limited, and there was some overlap in discussion across different committees. In addition, the trail of documents for branch decision making was not readily available.
Recommendation 2
The Vice President of the Health Security and Regional Operations Branch should conduct a review of the governance structure to ensure committees have minimal overlap, and that efficiency regarding decision-making is optimized.
Management response
The Regional Operations' governance structure was adapted quickly to respond to the pandemic and the growth of the organization. Adjustments are required to not only reduce overlap and optimize decision-making, but also to re-balance the focus to other programs delivered and align to PHAC and HSRO's new organizational structures.
A review of Regional Operations governance structure has already begun to limit overlap, clarify roles and responsibilities and optimize decision making by the Regional Executive Committee (Tier-1) and include limited number of key Sub-Committees (Tier-2) with clear and approved Terms of References, with strong documentation management practices, and participation of key internal partners from other Centres in HSRO, PHAC, and HC.
Roles and responsibilities
Context
PHAC is responsible for implementing changes at the operational level with the help of the different committees in place. In the context of border reopening, committees were responsible for providing oversight for PHAC's implementation of COVID-19 border measures:
- Securing contracts for DQFs or Government-Authorized Accommodations;
- Ensuring that sufficient resources were present at ports of entry;
- Securing appropriate funding;
- Drafting appropriate guidance for travelers;
- Monitoring of PHAC's implementation of border measures; and
- Participating in discussions within the Agency, across the public service, and with relevant stakeholders.
What did we expect to find?
We expected to find defined roles and responsibilities within HSRO for supporting border reopening. We also expected that committee members were made aware of their roles and responsibilities.
Findings
Overall, roles, responsibilities and accountabilities for governance structures involved with border reopening to non-essential travel were found to be clear, well communicated, and understood. The team reviewed Terms of Reference (ToR) and Records of Decisions (RoD) for eight committees within Regional Operations that were involved with border reopening. Due to the complexities of border reopening, responsibilities were largely shared between teams in PHAC and with other government departments.
Given the reactive and fast-paced nature of the COVID-19 pandemic, the majority of the committees assessed by the audit team were created in the past year, the earliest being created in December 2020. In addition, one pre-existing committee had amended their ToRs to reflect a shift in activities towards a pandemic response. While all the documentation was up-to-date, none of the ToRs have been finalized. In committee meetings attended by the audit team, there was still discussion around the vision and role of the committees, highlighting the fact that the purpose of the various committees outlined in the ToRs was not final and still changing. In general, committees met at the frequency determined in their ToRs, ensuring that issues were discussed in a timely manner.
In the governance structure, the Regional Executive Committee (REC) was a Tier 1 level committee and was responsible for leadership, accountability, and decision making for Regional Operations. The roles and responsibilities of this committee were clearly defined in the ToR and well understood by members.
All the other committees fell below the REC in the governance structure. As Tier 2 level committees, these sub-committees reported directly to the REC. The creation process for the sub-committees and working groups was adaptable, with their structure responding to current needs as they arose. Sub-committees and working groups were created on an as-needed basis, with some being formalized after several ad-hoc discussions on a particular topic. The creation of these sub-committees or even working groups did not always come from the REC but also from other committees or even from sub-committees, based on the needs at that particular instance. While this quick and flexible response has allowed for timely responses to the ever-changing COVID-19 situation, it might lead to some overlap between committee roles and responsibilities. For example, OAE's attendance at committee meetings demonstrated that the same issues were discussed at multiple committees and that some committees had similar memberships (i.e., REC and its sub-committees) which created possible redundancies and inefficient use of limited resources. Additionally, there does not appear to be an up-to-date governance chart for all the committees involved with border reopening within Regional Operations. Three documents were provided to the audit team that capture some of the committees involved, but they were out-of-date and did not provide a complete overview of the governance structure for border reopening.
Conclusion
The roles, responsibilities, and accountabilities for committees described in ToRs were clear, communicated in committee meetings, and shared through the RoDs. Some of the same issues were discussed at multiple committees, thus creating possible redundancies and inefficient use of resources. Although the ToRs had been recently updated, they were still labelled as draft and had not been approved.
Recommendation 3
We recommend that the Vice President of the Health Security and Regional Operations Branch finalize and have the proper level of authority approve the ToRs.
Management response
As noted under Recommendation 2, management agrees with the observations and the recommendation in the report which is focused on the Regional Operations (RO) Governance Structure.
A review of Regional Operations management governance structure has already begun to limit overlap, clarify roles and responsibilities and optimize decision making by the Regional Executive Committee (Tier-1), and include limited number of key Sub-Committees (Tier 2) with approved Terms of References.
Appendix A – About the audit
Audit objective
To determine if an appropriate plan and management controls were in place to successfully facilitate border reopening to non-essential travel.
Audit scope
The scope of the audit was limited to the ports of entry for non-essential travel, its related governance, risk-management, monitoring and reporting, from May 1, 2020, to September 30, 2021. This included files, documents, and data pertaining to decisions made for the reopening of the borders in this timeframe.
Audit approach
The audit approach included, but was not limited to:
- Interviews with senior management and employees
- Reviews of relevant documentation and related controls
- Observing relevant meetings
Statement of conformance
This audit was conducted in conformance with the International Standards for the Professional Practice of Internal Auditing and is supported by the results of the Office of Audit and Evaluation's Quality Assurance and Improvement Program.
Audit criteria
The audit criteria were derived from the Treasury Board Secretariat's (TBS) Core Management Controls and the Committee of Sponsoring Organizations of the Treadway Commission (COSO) Enterprise Risk Management Framework. The following criteria were used to conduct the audit:
- Planning documents, procedures, and guidance exist within PHAC to allow for successful border reopening to non-essential travel.
- Roles, responsibilities, and accountabilities for governance structures involved with border reopening to non-essential travel are clear and communicated.
- The governance structure in place facilitates decision making and timely communication of decisions made.
Page details
- Date modified: