Audit of the Monitoring of Internal Control Over Financial Management: Public Health Agency of Canada

Office of Audit and Evaluation
June 2024

Table of contents

• Executive summary
• Introduction
• Objective 1
• Criterion 1 – Governance, policy, roles and responsibilities
• Criterion 2 – ICFM risk-based monitoring approach
• Criterion 3 – Follow-up on corrective action plans from ICFM monitoring reports
• Criterion 4 – ICFM supported by relationship between HC and PHAC
• Objective 2
• Appendix A – About the audit

Executive summary

Engagement objectives

The objective of this audit was to determine:

• Whether there is effective monitoring of the Public Health Agency of Canada’s (PHAC) system of Internal Controls over Financial Management (ICFM); and
• The extent to which OAE can rely on the assurance over financial controls provided by the internal controls team at PHAC, following the principles of the Institute of Internal Auditor’s 2011 practice guide, Reliance by Internal Audit on other Assurance Providers.

Engagement scope

The audit scope included the following:

• The examination of key aspects of ICFM monitoring during the 2022-23 and 2023-24 fiscal years.
• Governance, risk management, and internal control processes and activities used to assess, monitor, and report on the ICFM system.

The audit did not assess the accuracy of the Agency’s financial statements, the design and operating effectiveness of individual entity-level controls, general controls for information technology, nor business process controls.

What we found - Good practices

The Agency has established the necessary elements for an effective framework for the management of ICFM. The design and implementation of ICFM monitoring practices performed by PHAC’s Internal Control Team (ICT) conform to the Treasury Board’s (TB) Policy on Financial Management and its supporting Guide to Internal Control over Financial Management. Since the formation of the ICT, improvements to the standardization and documentation of ICFM monitoring at PHAC have been realized, and the function has reached the desired level of maturity.

We found that the oversight and governance surrounding ICFM monitoring was appropriate, formalized, and functioning as designed. Furthermore, the relevant roles and responsibilities were clear and consistently documented. Initial risk assessments, an ongoing monitoring plan, and assessment operating procedures were regularly reviewed and updated as required. The results, recommendations, and management action plans stemming from each process assessment were presented and shared with senior management and the Departmental Audit Committee (DAC) on a regular basis over the course of the fiscal year and the ICFM monitoring cycle.

A structured approach, guided by TB and PHAC policies and including a rating system, was used to assess ICFM risks annually. This risk assessment was also informed by other inputs, including the work performed by the ICT in cooperation with business process owners to ensure the documentation of processes and integral controls is accurate. We found clear documentation of confirmations related to the Statement of Management Responsibility, including for internal control over financial reporting (ICFR), for which senior managers, the Chief Financial Officer (CFO), and the Deputy Head were provided appropriate context, support, and information.

We found that PHAC senior management was satisfied with the ICFM-monitoring process and partnership agreement with Health Canada (HC). In 2012, the Shared Services Partnership Framework Agreement was established between PHAC and HC, which consolidated several common functions, including internal financial services. While both PHAC and HC have their own Chief Financial Officer Branches, PHAC does rely on some processes conducted by HC. Together, the internal control groups and other stakeholders at PHAC and HC have established a committee aimed at sharing and collaborating on common priorities in financial and procurement operations related to the partnership agreement. In addition, we found that other efforts were made to continuously improve the ICFR monitoring function and to achieve greater efficiency between the PHAC and HC teams where possible.

Introduction

The Treasury Board (TB) Policy on Financial Management (the Policy) came into effect on April 1, 2017, to ensure that financial resources of the Government of Canada are well managed in the delivery of programs to Canadians, and safeguarded through balanced controls that enable flexibility and manage risks. The Policy requires departments and agencies in the Government of Canada to ensure that a risk-based departmental system of ICFM is established, monitored, and maintained. The Policy also requires PHAC’s President and Chief Financial Officer to sign an annual representation letter acknowledging their responsibilities for maintaining an effective system of ICFR, including the mitigation of risks to the prudent stewardship of public funds, the safeguarding of assets, and reliable reporting.

ICFM is a set of measures and activities that provide reasonable assurance of the effectiveness and efficiency of the financial management activities of an organization, and that the Agency’s objectives will be achieved. ICFR, a subset of ICFM, is a set of measures and activities that allow senior management and financial statement users to have reasonable assurance of the accuracy and completeness of the organization’s financial statements. Without adequate ICFM monitoring, management may be unable to ensure sound and prudent use of public funds in an effective, efficient, and economical manner.

While PHAC began implementing a risk-based monitoring strategy of ICFM in 2018-19, the Internal Control Team (ICT) was established in 2021-22 to lead the implementation of the ICFM framework. TB’s expectation was that departments and agencies would ensure that all key ICFM processes would have reached the ongoing monitoring stage by March 31, 2024. OAE conducted an Audit of ICFR in 2017 and initiated the Audit of Key Financial Controls – Financial Transactions at PHAC in 2022, as per the 2022 to 2024 Risk-based Audit Plan. During the planning phase of that audit, OAE recognized the increased maturity of both PHAC and Health Canada (HC) internal control groups, and noted that through the HC-PHAC Shared Services Partnership Agreement, the Internal Control Unit (ICU) at HC is responsible for the testing and monitoring of eight out of the 15 key control areas making up PHAC’s ICFM. As a result, OAE instead shifted this current audit’s focus to examining ICFM monitoring at PHAC. Also, during this audit we experienced some capacity constraints that contributed to the delay in completing the audit.

This audit provides an independent assessment of the effectiveness of the regime for identifying and addressing deficiencies in the reliable monitoring of financial management and reporting. It supports the Departmental Audit Committee’s (DAC) responsibility for due diligence and constructive challenge of the evidence and action plans underpinning the certification in the annual Annex to the Statement of Management Responsibility. The Office of Primary Interest (OPI) for this audit was the Chief Financial Officer and Corporate Management Branch (CFOCMB).

Objective 1

Determine whether there is effective monitoring of the Public Health Agency of Canada’s (PHAC) system of Internal Controls over Financial Management (ICFM).

Criterion 1 – Governance, policy, roles and responsibilities

There is formal oversight of ICFM monitoring, including clearly identified roles and responsibilities, authorities, governance, and regular reporting to senior management, the Deputy Head, and the Departmental Audit Committee (DAC).

Context

In order for PHAC to deliver on its mission to promote and protect the health of Canadians through the provision of programs and services, a clear and effective system of oversight and reporting of internal controls monitoring is essential. The Treasury Board’s Policy on Financial Management identifies the key responsibilities for the Deputy Head, Chief Financial Officer, and senior departmental managers with respect to ICFM, in line with section 16.4 of the Financial Administration Act. The Deputy Head is responsible for ensuring that a risk-based system of ICFM is established, monitored, and maintained, and is also responsible for approving the Annual Statement of Management Responsibility, including internal controls over financial reporting (ICFR), and a summary of the annual assessment of the system of ICFR. Senior departmental managers and the CFO are required to monitor financial management performance. The DAC is responsible for using a risk-based approach to review and provide advice on areas of responsibility for departmental management, control, and accountability processes.

The Policy on Financial Management specifically asserts the expectation that governance and oversight over financial management must be effective. Internal control management consists of well-established governance and accountability structures that support the assessment and oversight of internal control systems. Internal reporting on regular assessments of ICFM processes is required, as well as on progress since the previous fiscal year, and a high-level picture of the overall status of the complete assessment process should be provided.

What we expected to find

We expected to find that the governance framework supports PHAC’s oversight, accountability, and management of ICFM monitoring. This framework should be consistent with the relevant policies, guidance, and practices. We also expected to find clearly defined, documented, and communicated roles and responsibilities, and evidence of appropriate oversight, including regular and timely reporting and informed decision making.

Why it matters

Canadians expect PHAC’s financial resources to be well managed and safeguarded via internal controls, as well as reliable reporting that provides transparency and accountability for how such public funds are spent. A clear and coordinated governance framework is essential for establishing accountabilities, roles, and responsibilities in managing ICFM monitoring. A lack of clarity could result in inefficiency, effort duplication, and unidentified errors. Effective monitoring of ICFM is fundamental for ensuring that risks to the stewardship of public resources are adequately managed.

Key findings

We found that oversight of ICFM monitoring at PHAC has been appropriately formalized. Since the introduction of the ICT, improvements to the standardization and documentation of ICFM monitoring have been realized with the team’s evolution and continued maturity. We found the framework to be consistent with both relevant TB and PHAC policies, as well as with current generally accepted practices. The levels of review and approval of the framework were as expected, and consistent with the Statement of Management Responsibility of the PHAC Financial Statements, including internal control over financial reporting.

We found that the supporting risk assessments, the ongoing monitoring plan, and assessment operating procedures are regularly reviewed and updated. We observed regular reporting of ICFM monitoring results to many audiences, mandated and otherwise. Feedback was actively sought from stakeholders. We found the many roles and responsibilities related to ICFM to be clearly documented, consistent, and easily accessed in a variety of locations such as job descriptions, policies, committee terms of reference, and the DAC’s mandate.

Conclusion

An internal control management framework has been established and updated as required, and the roles and responsibilities related to ICFM are formally documented, clear, and appropriately communicated. There is oversight of ICFM monitoring, including regular reporting to senior management, the Deputy Head, and the DAC.

Criterion 2 – ICFM risk-based monitoring approach 

Key internal controls are assessed and periodically reassessed for monitoring purposes using a risk-based approach.

Context

The maintenance of effective internal controls is a critical measure for mitigating financial risks. In order for controls to be effective, they must be regularly reassessed and appropriately monitored. Key internal controls must first be identified via a thorough course of communication and documentation involving the owners of every business process. The ongoing plan for assessing and monitoring these controls must be risk-based in nature. Accordingly, it is also necessary to constantly obtain an understanding of the Agency’s risk environment and appetite. Illustrating the importance of the risk-based nature of ICFM monitoring, it is notable that the objective of the Policy on Financial Management is to ensure that financial resources are well managed and safeguarded through balanced controls that enable flexibility and manage risk.

What we expected to find

We expected to find that risk assessment processes have been documented, implemented, and followed consistently to allow the Agency to identify, evaluate, prioritize and mitigate risks related to ICFM. We expected to see evidence that there is a thorough and structured approach for documenting business processes and identifying controls, as well as for conducting and documenting assessments and rating ICFM risks. The risk ratings should be used to inform business process assessments and the monitoring plan. We expected to find that senior management’s risk tolerance was also considered in the development of internal control team processes and priorities.

Why it matters

Formalized processes for strategic planning and risk management reduce the likelihood of key strategic and operational risks not being identified or mitigated. The regular assessment and monitoring of ICFM are critical to an entity’s successful financial management. The identification and prioritization of areas where risks are greater improves the Agency’s ability to optimize resource use and ultimately reduce the impact and likelihood of important risks going unmitigated, thereby protecting the Agency from failing to meet its mandated requirements and stewardship obligations to Canadians.

Key findings

We found that a detailed and updated understanding of business processes was actively and methodically sought, and formally and systematically documented. This process occurs on a prescribed schedule and begins with the internal control team (ICT) and business process owners, then progresses forward to include input and eventual approval from senior management. This documentation forms the basis for the identification of key controls and contributes to the risk assessment process. The risk assessment process is guided by Treasury Board and PHAC policies, frameworks, and plans, and is conducted annually. A structured approach, including a rating system, is used to assess ICFM risks.

We found that, for the sampled process, the documentation of its activities, controls, sequencing, and other characteristics were adequately documented. There was evidence of regular communication and validation with the business process owner. Fraud risks were explicitly considered. As expected, the ICT’s working papers and supporting evidence were generally clear and sufficient, and the design and operating effectiveness of each key control were assessed. We found that a quality assurance process was in place within the ICT for the period tested in the audit, and that this has been better formalized and documented in the time since the audit.

Conclusion

The Internal Control Team conducts ongoing risk-based assessments of the design and operating effectiveness of all business processes. They maintain active communication with the business process owner, as required by the Ongoing Monitoring Plan. In addition, PHAC has established supervisory review controls for ICFM monitoring.

Criterion 3 – Follow-up on corrective action plans from ICFM monitoring reports

Internal control management ensures that corrective actions resulting from the assessment of internal controls are taken when necessary.

Context

PHAC’s Chief Financial Officer (CFO) is responsible for ensuring that prompt corrective action is taken when control weaknesses and unmitigated material risks are identified, and senior management is responsible for notifying the CFO of any such weaknesses. An effective internal control management system ensures that the ongoing monitoring process identifies and reports on control weaknesses, and that necessary corrective actions are taken.

What we expected to find

We expected to find evidence that Business Process Owners (BPOs) validate and prepare remedial action plans, and that these action plans, along with assessment results, are shared with senior management, the CFO, the Deputy Head, and the DAC. The ongoing status of action plans should also be shared, and the remedial actions should be implemented and confirmed on a timely basis. We expected to find that the Statement of Management Responsibility was provided to, and approved by, the appropriate individuals.

Why it matters

An effective ICFM system is critical for managing and meeting organizational goals, mitigating the risk of error and fraud, and building public confidence. Internal controls are fundamental for ensuring that risks to the stewardship of public resources are adequately managed. As such, the failure to take timely and necessary corrective actions to correct findings identified in an internal control assessment could ultimately lead to material errors. 

Key findings

We found that, for the business process sampled, the assessment results were clearly communicated and formally presented to the BPOs, and subsequently to senior management, the CFO, the Deputy Head, and the DAC. In the case of this sample, no remedial action plans were necessary.

We found that the Statement of Management Responsibility, including for internal controls over financial reporting, was provided and explained to senior managers, the CFO, the Deputy Head, and the DAC for information purposes. Clear documentation of confirmations and signoffs was obtained.

Conclusion

Assessment results are validated with the BPOs and shared with senior management, and management ensures that corrective actions resulting from the assessment of internal controls are taken when necessary.

Criterion 4 – ICFM supported by relationship between HC and PHAC

The partnership between HC and PHAC supports effective ICFM monitoring using a collaborative and transparent approach, in accordance with TBS guidance.

Context

HC provides services to PHAC through a shared services partnership agreement. Services provided to PHAC for internal controls over financial reporting (ICFR) include human resources, financial management, and materiel management. HC shares testing results and related follow-up outcomes with PHAC on HC ICFR key controls that apply to PHAC. The PHAC ICT is responsible for assessment of other PHAC controls, which allows them to obtain a comprehensive view of their own ICFR/ICFM processes and report to PHAC management and governance bodies

What we expected to find

We expected to find that the ICFR monitoring services provided to PHAC by HC are appropriate and consistent with the shared partnership agreement. HC and PHAC should be sharing information adequately to support successful ICFM monitoring, and collaborating to improve and standardize the financial management function. 

Why it matters

Optimal multi-stakeholder communication and participation in shared committees supports effective information sharing, collaboration, coordination, and informed decision making. This enhances PHAC’s ability to use its resources most efficiently and take advantage of external innovations. This supports PHAC’s corporate value of stewardship, which describes its responsibility to use and care for public resources responsibly.

Key findings

We found that Health Canada explicitly includes PHAC transactions in their assessments of shared processes, and that the results and findings of these assessments are shared with PHAC’s internal controls team. PHAC senior management is satisfied with the partnership with HC as it relates to ICFM monitoring and communication, and that the approach is transparent and in accordance with relevant policies and agreements. There were no concerns raised about PHAC management’s control over their ability to maintain responsibility over ICFM.

We found that efforts were made on behalf of both HC and PHAC to continuously improve financial management functions, and that the respective internal control groups collaborate to achieve greater efficiency where possible.

Conclusion

HC and PHAC collaborate to improve ICFM monitoring and avoid potential duplication of work, and PHAC senior management is satisfied that ICFM monitoring services from HC are appropriate and aligned with the shared service partnership agreement.

Objective 2

Determine the extent to which OAE can rely on the assurance over financial controls provided by the internal controls team at PHAC, following the principles of the Institute of Internal Auditors’ (IIA) 2011 practice guide, Reliance by Internal Audit on Other Assurance Providers.

Context

During the planning phase of this audit, a second objective was included that would determine the extent to which OAE could rely on the assurance over financial controls provided by the internal controls team (ICT) at PHAC, based upon the principles of the Institute of Internal Auditor’s 2011 practice guide, Reliance by Internal Audit on Other Assurance Providers.

What we expected to find

We expected to find that internal control over financial management (ICFM) monitoring was sufficiently mature and well established to allow the audit team to measure them against the IIA’s 2011 practice guide, Reliance by Internal Audit on Other Assurance Providers, and determine the extent to which OAE could rely on the assurance over financial controls provided by the ICT at PHAC.

Why it matters

Ensuring appropriate coverage and minimizing the duplication of efforts when conducting assurance work within PHAC is important in meeting the 2017 IIA’s Standards, particularly Standard 2050 - Coordination and Reliance: “The chief audit executive should share information, coordinate activities, and consider relying upon the work of other internal and external assurance and consulting service providers to ensure proper coverage and minimize duplication of efforts.” This enhances OAE’s ability to use its resources most efficiently and take advantage of the work of other assurance providers. This supports OAE’s core values by responsibly and wisely managing entrusted resources.

Key findings

We found that the PHAC ICT has implemented the following measures:

• have clearly outlined its purpose and commitment for providing assurance over ICFM monitoring;
• have a sufficient degree of independence and objectivity to carry out its work;
• have ensured the function is competent in carrying out its activities and processes;
• have established policies and procedures that it follows; and
• communicates results and ensures timely action is taken to address any recommendations.

Conclusion

Based on the work conducted and outlined above, we have concluded that the OAE can rely on the assurance over financial controls provided by the ICT at PHAC, following the principles of the Institute of Internal Auditor’s 2011 practice guide, Reliance by Internal Audit on Other Assurance Providers. This means that when OAE is conducting audit work in a relevant area that directly or indirectly implicates ICFM, the audit manager may rely on the work of the ICT based on the work conducted during the audit period.

Appendix A – About the audit

1. Audit objective
   • The audit objective was to determine:
     • Whether there was effective monitoring of the Public Health Agency of Canada’s (PHAC) system of Internal Control over Financial Management; and
     • The extent to which OAE can rely on the assurance over financial controls provided by the internal controls team at PHAC, following the principles of the Institute of Internal Auditor’s 2011 practice guide, Reliance by Internal Audit on other Assurance Providers.
2. Audit scope
   • The scope of the audit included the examination of key aspects of ICFM monitoring during the 2022-23 and 2023-24 fiscal years. The audit focused on governance, risk management, and internal controls processes and activities used to assess, monitor, and report on the ICFM system. However, the audit did not assess the accuracy of the Agency’s financial statements, the design and operating effectiveness of individual entity-level controls, general controls for information technology, nor business process controls.
3. Audit approach
   • The audit was conducted in accordance with the Government of Canada's Policy on Internal Audit, which requires examining sufficient and relevant evidence, and obtaining sufficient information and explanations to provide a reasonable level of assurance in support of the audit conclusion. The audit approach included, but was not limited to, the following:
     • Interviews with key officials with responsibilities related to ICFM.
     • Review of relevant documentation, policies, standards, guidelines, frameworks related to ICFM, as well as walkthroughs.
4. Statement of conformance
   • This audit was conducted in conformance with the 2017 International Standards for the Professional Practice of Internal Auditing and is supported by the results of the OAE’s Quality Assurance and Improvement Program.
5. Audit criteria
   • There is formal oversight of ICFM monitoring, including clearly identified roles and responsibilities, authorities, governance, and regular reporting to senior management, the deputy head, and the Departmental Audit Committee.
   • Key controls are assessed and periodically reassessed for monitoring purposes, using a risk-based approach.
   • Internal control management ensures that correctives actions resulting from the assessment of internal controls are taken when necessary.
   • The partnership between HC and PHAC supports effective ICFM monitoring using a collaborative and transparent approach in accordance with Treasury Board Secretariat guidance.