Audit of the Determination of Recoverable Amounts for Grants and Contributions at the Public Health Agency of Canada - Report presented to the Departmental Audit Committee, July 5, 2019

Table of Contents

• List of Acronyms
• Executive summary
• A - Introduction
• B - Findings, recommendations and management responses
  • Roles and Responsibilities
  • Recipient Audit Plan
  • Professional Auditing Standards
  • Recipient Audit Findings
• C - Conclusion
• Appendix A - Scorecard
• Appendix B - About the Audit
  • 1. Audit Objective
  • 2. Audit Scope
  • 3. Audit Approach
  • 4. Statement of Conformance
• Appendix C - Audit Criteria

List of Acronyms

CA

Contribution Agreement

CFO

Chief Financial Officer

CGC

Centre for Grants & Contributions

FDDR

Financial Due Diligence Review

G&Cs

Grants and Contributions

OAE

ce of Audit and Evaluation

OCFO

Office of the Chief Financial Officer

PHAC

Public Health Agency of Canada

RAP

Recipient Audit Plan

RCRR

Recipient Compliance Review Report

SOP

Standard Operating Procedures

VP

Vice President

Executive Summary

Grants and contributions (G&Cs) are part of a category of expenditures called Transfer Payments and are one of the Government of Canada's key instruments used to further its broad policy objectives and priorities. Recipients are expected to use contribution funding in accordance with the terms and conditions of their contribution agreement (CA). The Public Health Agency of Canada must have an effective process in place to review the expenses claimed by recipients to determine their eligibility and recover ineligible expenses.

What we examined

We reviewed the appropriateness of the recoverable amounts established for each of the 14 recipient audits conducted in 2015-16. In addition, we reviewed nine recipient audits conducted in 2017-18 to determine whether improvements were made in the process for determining the amounts for recovery as they relate to:

• clarity of roles and responsibilities;
• methodology for selecting recipient audits;
• adherence to professional auditing standards for the conduct of recipient audits; and
• compliance with governing authorities.

Why it is Important

The Office of Audit and Evaluation (OAE) conducted an Audit of the Management of Grants and Contributions at the Public Health Agency of Canada in 2017. The report found significant reductions in the potential amounts to be recovered identified through recipient audits, with limited justification for the changes. The recovery of ineligible expenses demonstrates sound stewardship of public funds.

What we found

Overall, we found that although recipient audits appropriately identified expenditures that deviated from the terms and conditions of the CA, documentation supporting the final amount identified for recovery was not always available, including the programs' justification for discrepancies with recipient audit findings and the terms and conditions of the CA. We reviewed the determination of recoverable amounts and concluded that, despite the lack of documentation, the decisions were appropriate as they were within the spirit and intent of the CA and did not contravene the Financial Administration Act.

Management processes and practices were effective in the following areas:

• recipient audits were selected from the complete population of Contribution Agreements (CAs) and the selection methodology was risk-based;
• recipient audits were conducted in accordance with professional auditing standards; and
• recovery amounts recommended by the Centre for Grants and Contributions (CGC) complied with governing authorities.

We also identified opportunities for improvement in the areas of:

• strengthening the clarity of the interrelated responsibilities and accountabilities of the Chief Financial Officer and the programs;
• ensuring that the communication of audit findings and recovery amounts with recipients is clear and consistent;
• ensuring that appropriate financial assessments are performed;
• raising recipient awareness with regard to eligibility of expenses through the distribution of the recipient guide; and
• documenting and approving the rationale for any discrepancies between the recipient audit findings and the amount identified for recovery.

The areas for improvement noted in this audit report and associated recommendations will collectively strengthen the Agency's capacity to determine amounts to be recovered from recipients.

A - Introduction

1. Grants and contributions (G&Cs) are part of a category of expenditures called Transfer Payments and are one of the Government of Canada's key instruments used to further its broad policy objectives and priorities. They are governed by the Treasury Board's Transfer Payment Policy and Directive on Transfer Payments to ensure that they are managed in a manner that respects sound stewardship and attains the highest level of integrity, transparency, and accountability.
2. The Public Health Agency of Canada (PHAC, or the Agency) uses G&Cs to fund community, voluntary, not-for-profit, and private sector organizations for activities that support government policies and priorities. In 2012, significant changes to the Agency's G&Cs framework were initiated to address inconsistencies between programs and regions in the application of policies related to the delivery of G&Cs, which included the standardization of operating procedures and a re-alignment of roles and responsibilities amongst programs, regions and the Centre for Grants and Contributions (CGC).
3. During fiscal year 2017-18, PHAC funded approximately 880 recipients across the country, with expenditures of $212 million. Recipients must use funding in accordance with the terms and conditions of the Contribution Agreement (CA). The recipient audit is one of several components of monitoring and an essential part of the Agency's risk-based monitoring strategy of G&Cs. It is an independent assessment designed to provide assurance on a recipient's compliance with the CA.
4. The Office of Audit and Evaluation (OAE) conducted an Audit of the Management of Grants and Contributions at the Public Health Agency of Canada in 2017. The report found significant reductions in the potential amounts to be recovered identified through recipient audits, with limited justification for the changes. This audit was initiated to determine whether the amounts identified for recovery were appropriate.
5. The appendices for this audit report provide additional information on the results of the audit and how it was conducted: Appendix A - Scorecard, Appendix B - About the Audit, and Appendix C - Lines of Enquiry and Criteria.

B - Findings, recommendations and management responses

Roles and Responsibilities

6. Clearly articulated roles and responsibilities help ensure that employees effectively discharge their stewardship responsibility.
7. We expected that the roles and responsibilities of the CGC, within the Office of the Chief Financial Officer (OCFO), and of programs in determining recoverable amounts were clearly articulated and well understood.
8. We found that the roles and responsibilities for key players involved in the recipient audit process were outlined in the Business Management Model (BMM) and the Standard Operating Procedures (SOP). The CGC was responsible for developing the Recipient Audit Plan (RAP), conducting recipient audits, communicating the preliminary audit findings to the recipient, and issuing the final report to the program director, with a recommended recovery amount to be considered for follow-up and collection.
9. For the period under the scope of this audit, programs reviewed the final report, decided whether to agree with the audit findings, recommended a recovery amount, and communicated to recipients the management response to the audit findings and final recovery amount, if any. We noted that the SOP was revised in July 2018 to include that all recipient audit findings and recommended recovery amount that programs disagreed with must be approved by the program's Vice President (VP) and the Chief Financial Officer (CFO), and that programs must document the rationale for changes to the recommended recovery amount and have appropriate approvals on record.
10. This matrix approach for the delivery of recipient audits resulted in the OCFO and programs having interrelated responsibilities and accountabilities. While the OCFO was the Agency's focal point of accountability to ensure rigorous stewardship of resources, the programs had financial accountability, as well as responsibility for program activity and policy. Interview results highlighted that this relationship has created some tension among key players, as well as confusion in regard to ownership of decisions, especially where adjustments to the recommended recovery amount were involved.
11. Furthermore, programs highlighted that, with the new process to obtain approval by the VP and the CFO for adjustments to recipient audit findings and recommended recovery, it was not clear who was responsible for developing the processes, guidance, and tools for documenting rationales and obtaining concurrence. We found that a few programs had developed program-specific processes, resulting in inconsistencies in the depth and appropriateness of the documentation, as discussed in the Recipient Audit Adjustments Section.
12. Overall, we found that roles and responsibilities were clearly outlined in various documents. However, the interrelated responsibilities and accountabilities between the CFO and the programs created confusion regarding ownership of decisions, especially where adjustments to the recommended recovery amount were involved.

Recipient Audit Plan

13. The selection process of recipient audits that puts emphasis on recipients who are most at risk of non-compliance with the terms and conditions of their contribution agreement (CA) allows an organization to demonstrate sensitivity to risks and economic use of resources.
14. We expected to find that the selection of recipient audits considered the Agency's complete population of CAs and was based on a risk analysis.
15. The Financial Oversight Group (FOG) within the CGC was responsible for the development of the annual Recipient Audit Plan. According to the Risk-Based Monitoring Strategy, all recipients may be subject to recipient audits. For low and medium-risk recipients, selection was subjective, while high-risk recipients were subject to an audit every three years.
16. A recipient's risk level was assigned through the completion of the Agreement/Recipient Risk Assessment Tool (ARRAT). The assessments were done in collaboration with program consultants and CGC Operations officers.
17. Our analysis of the 2017-18 Recipient Audit Plan (RAP) confirmed that audits were selected from the complete population of CAs. Furthermore, the plan was based on the risk profiles of recipients and on a series of other factors, including materiality, program funding distribution, and regional coverage. We also found that program consultants, regional and CGC officers recommended audits based on specific issues and risk factors, including:
    • results of the last site visit;
    • findings from ongoing project monitoring activities;
    • missing or erroneous information on claims;
    • recipient activities not compliant with terms of the CA; and
    • suspicion of fraud.
18. Overall, we found that the selection of recipient audits was performed using the complete population of CAs, and that a risk analysis was the basis for selection.

Professional Auditing Standards

19. An independent auditor plans, conducts, and reports the results of an audit in accordance with professional auditing standards. These standards provide a measure of quality assurance and specify the objectives to be achieved.
20. We expected to find that the planning, examination, and reporting phases of recipient audits met generally accepted auditing standards.
21. We performed a review of recipient audit files completed in 2015-16 and in 2017-18. We confirmed that qualified auditors, who were independent of the recipient, conducted the audits. We also noted that the auditors obtained sufficient audit evidence by performing audit procedures to provide a reasonable basis for an opinion on the financial information under audit.
22. We also found that the audits underwent quality assurance through the completion of the initial review, which was designed to encompass the engagement objectives and the entire working paper file, as well as the summary review, which ensured that the report and findings were consistent. Although we saw evidence of a quality review in each file, we noted that the initial and summary review certificates were not consistently signed for several files.
23. Results of the audit were presented in a Recipient Compliance Review Report (RCRR), which included an opinion paragraph, as well as the total amount of adjustments made for ineligible expenses. In addition, the RCRR included the recipient's response to the audit findings.
24. Overall, we concluded that recipient audits conducted by the CGC adhered to professional auditing standards.

Recipient Audit Findings

25. Recipient audits are an independent assessment of a recipient's compliance with the financial terms and conditions of its CA. In the event of non-compliance or misuse of funds, departments determine the amount owed by the recipient to the Government of Canada. Recovering amounts that are ineligible demonstrates an organization's sound stewardship and financial accountability.
26. We expected that the determination of amounts to recover was compliant with governing authorities, including the Financial Administration Act (FAA), the Transfer Payment Policy, and the terms and conditions of the CA.

CGC's recipient audit findings and recommended recovery amounts

27. We reviewed the CGC audit files for both the 2015-16 and 2017-18 sample items. In our examination, we found that reports were consistently documented, supported by audit working papers, and included expenses that were not in accordance with the financial terms and conditions of the CA. For 2015-16, ineligible expenses were most commonly attributed to prepaid costs and cut-off errors (30.8%), ineligible personnel costs, including retention bonuses, severance pay, and extended benefits (27.6%), and unsupported or excess costs (32.2%). For 2017-18, the preliminary adjustments accounted for 33.4%, 2.2%, and 27.2% of the respective categories.
28. We found that the audit findings identified by the CGC in the RCRR were, in fact, ineligible expenses that were deemed recoverable. However, we noticed that the CGC's recommended recovery amount often differed from the total amount of audit findings stipulated in the RCRR. This was mainly attributed to prepaid costs and cut-off errors. Although these ineligible expenses were identified as audit findings in the draft RCRR, the CGC and programs jointly agreed not to recover these costs, as they were the result of a timing difference and did not put into question the eligibility of the expenses. To ensure this does not become a standard practice, CGC and the programs communicated to recipients that reimbursement claims must be for expenses incurred in the fiscal year for which payments were being requested.
29. Furthermore, in three instances, auditors decided to extend the scope of the review to ensure that an observed practice was not isolated to one fiscal year, but rather was a common practice spanning a number of fiscal years. As per the CA, CGC officers were able to examine records within the last six years; however, the auditors were usually able to note a trend with just one additional fiscal year. We observed inconsistencies in how these prior year adjustments were communicated in the RCRR. For instance, in one report, the adjustment was included in the total amount reported in the opinion paragraph, while in the other two reports, the adjustments were only mentioned in the general comments section of the report. This made it difficult for recipients to determine whether the prior year adjustments were being recovered. Unclear or inconsistent communication of audit results may affect the Agency's ability to recover funds.
30. Following the completion of recipient audits, we found that the auditors provided recipients with the draft RCRR for concurrence before programs reviewed the final report to determine whether they agreed with the recipient audit findings and recommended recovery amount. The intent of having CGC communicate the RCRR first was to distinguish the recipient audit results from the programs' response to the recipient audit findings. However, we noted that it was not clearly articulated to recipients that programs had yet to review the report to decide whether it agreed with the audit findings and recommended recovery amount and that the amount to be recovered had yet to be finalized. Results of interviews with program representatives highlighted that recipients were often confused and alarmed as they assumed that the amount reported in the draft report was the amount owed, causing unnecessary stress. This lack of clarity in the communication of recipient audit findings may hinder the Agency's ability to demonstrate a united approach, and may affect the Agency's relationship with recipients.
31. Recipient responses to the audit findings demonstrated that the CA did not convey various expenses, that recipients were not made aware that various expenses were ineligible, and that ineligible expenses identified in the recipient audit had been previously approved in the detailed budget of the CA and in subsequent cash flow reviews when payments were processed.
32. The issues raised by recipients were confirmed by a Financial Due Diligence Review (FDDR) conducted by the CGC in October 2017. The purpose of the FDDR was to determine if there were inconsistencies and weaknesses in the CGC on how financial verifications were performed prior to issuing a payment. The overall results indicated that, out of the 49 CA files reviewed, eight lacked the required documentation to perform a detailed review, while the other 41 files contained errors that represented a small portion (1.36%) of the total funding provided to recipients.
33. To address issues related to recipients' understanding of their CA requirements, possibly stemming from the Agency's previous lack of consistent application of internal policies and practices, a recipient guide was developed to assist recipients in planning and managing projects funded by PHAC, and to help them understand and meet the obligations of the CA. The guide also included a detailed list of eligible and ineligible expenses, in an effort to raise recipient awareness. However, the guide had not been shared with recipients as of November 2018.
34. Overall, recipient audit findings and recommended recovery amounts identified by the CGC were in accordance with the financial terms and conditions of CAs. However, recipient audit findings were likely the result of insufficient communication with recipients pertaining to eligible and ineligible expenditures. In addition, the lack of clarity in the communication of recipient audit findings may hinder the Agency's ability to demonstrate a united approach to its recipients.

Program changes to recipient audit findings and recommended recovery

1. As the content experts, programs have the authority to agree or disagree with the recipient audit findings and recommended recovery amount, based on program activity and policy. Overall, we found that programs reduced the amount stipulated in the final RCRR by an average of 53% (60% in 2015-16; 45% in 2017-18), with individual adjustments ranging from $450 to $245,600.
2. For 2015-16, 12% of reductions were attributed to cut-off errors and pre-paid costs, 24% to unsupported costs, and 6% to non-eligible salary costs, including retention bonuses, severance pay, and extended health benefits. For 2017-18, 20% of reductions were attributed to cut-off errors and pre-paid costs, 7% to unsupported costs, while there were no reductions associated with non-eligible salary costs. The remaining balances (58% in 2015-16 and 73% in 2017-18) could not be determined due to insufficient documentation.
3. Common rationales provided by programs for rejecting or only partially accepting recipient audit findings and recommended recovery amounts included:

• one-time exceptions;
• insufficient communication to recipients of the ineligibility of certain expenditures;
• consistent treatment of previous recipient audit findings and recommended recovery amounts;
• previous approval of the detailed budget and subsequent cash flow that included ineligible expenditures; and
• prepaid and cut-off errors.

1. Although the majority of these explanations were not considered to be consistent with the terms and conditions of the CA, they were not indicative of misuse of funds by recipients. Instead, they were linked to insufficient communication of the ineligibility of certain expenses, as well as the challenge of reclaiming amounts that had previously been approved. Where recommended recovery amounts were reduced for various reasons, they were within the spirit and intent of the CA and did not contravene the FAA.
2. Certain extended benefits determined ineligible by the CGC in 2015-16 were allowed by five programs on the grounds that the PHAC Directive on Eligible Expenditures was soon to be updated. The revised version allowed extended benefits of up to 20% of salary, in contrast to the 10% allowed in the Directive during fiscal year 2015-16. Programs recommended not recovering these costs to ensure fairness between recipients.
3. Programs frequently disagreed with the recipient audit findings and recommended recoveries related to severance pay, on the basis that recovering these costs would put the recipient in a dire financial situation. As a result, programs allowed recipients a one-time exception. However, making exceptions was not consistent with the financial terms and conditions of a CA, and could lead to recipients justifiably expecting the Agency to make similar exceptions on their behalf in the future.
4. We also noted inconsistencies in how various recipient audit findings and recommended recovery amounts were treated by programs. For instance, in two projects subjected to a recipient audit, costs were incurred prior to the starting date of the CA, which did not include a clause that would allow them to claim expenses retroactively. The CGC determined these expenses to be ineligible. However, one program concurred with the recipient audit findings and recovered the funds, while the other program allowed the expenses on the basis that significant work was required prior to the approval of the CA to ensure the success of this high-profile project. This resulted in inconsistent treatment between recipients.
5. Rationales for program adjustments were not consistently documented or located within the recipient audit files. For example, one program only had strings of emails from the Program Director indicating the final amount to be recovered, with no rationale, thus leading to a lack of transparency. By contrast, a best practice was observed in one directorate whereby programs designed a business process to provide the Executive Director with a memo that included rationales for each change to the recipient audit findings and recommended recovery amounts for concurrence.
6. Overall, the amounts identified for recovery by programs were often inconsistent with the financial terms and conditions of the CA. However, the decisions were within the spirit and intent of the CA and did not contravene the FAA. In addition, evidence justifying the reduction of recommended recoverable amounts was inconsistently documented and applied across programs, which may affect the Agency's ability to demonstrate prudent and effective use of public funds.

C - Conclusion

Overall, we found that, although recipient audits appropriately identified expenditures that deviated from the terms and conditions of the Contribution Agreements (CA), documentation supporting the final amount identified for recovery was not always available, including the programs' justification for discrepancies with recipient audit findings and the terms and conditions of the CA. We reviewed the determination of recoverable amounts and concluded that, despite the lack of documentation, the decisions were appropriate as they were within the spirit and intent of the CA and did not contravene the Financial Administration Act.

However, management processes and practices were effective in the following areas:

• recipient audits were selected from the complete population of CAs and the selection methodology was risk-based;
• recipient audits were conducted in accordance with professional auditing standards; and
• recovery amounts recommended by the CGC complied with governing authorities.

We also identified opportunities for improvements in the areas of:

• strengthening the clarity of the interrelated responsibilities and accountabilities of the Chief Financial Officer and the programs;
• ensuring that the communication of audit findings and recovery amounts with recipients is clear and consistent;
• ensuring that appropriate financial assessments are performed;
• raising recipient awareness with regard to eligibility of expenses through the distribution of the recipient guide; and
• documenting and approving the rationale for any discrepancies between the recipient audit findings and the amount identified for recovery.

The areas for improvement noted in this audit report and associated recommendations will collectively strengthen the Agency's capacity to determine amounts to be recovered from recipients.

Appendix A - Scorecard

Audit of the Determination of Recoverable Amounts for G&Cs
Criterion	Rating	Conclusion	Rec #
Recipient audits are selected on the basis of risk.	No deficiencies	Selection of recipient audits was performed using the complete population of contribution agreements (CAs) and a risk analysis served as the basis for selection.
Recipient audits comply with professional auditing standards.	No deficiencies	Recipient audits conducted by the CGC adhered to professional auditing standards.
The determination of recoverable amounts is compliant with governing authorities.	One major deficiency	Audit findings identified by the CGC were in accordance with the financial terms and conditions of CAs. However, audit findings were likely the result of insufficient communication with recipients pertaining to the eligibility of expenditures. In addition, the lack of clarity in the communication of audit findings and recovery amounts may hinder the Agency's ability to demonstrate a united approach to the recipient. Furthermore, the amounts identified for recovery by programs were often inconsistent with the financial terms and conditions of the CA. However, the decisions were within the spirit and intent of the CA and did not contravene the FAA. In addition, evidence justifying the reduction of recommended recoverable amounts was inconsistently documented and applied across programs, which may affect the Agency's ability to demonstrate prudent and effective use of public funds.	2, 3, 4 5
The roles and responsibilities of the CFO and Programs in determining recoverable amounts are clear and understood.	Minor deficiencies	Roles and responsibilities were outlined in various documents. However, the interrelated responsibilities and accountabilities between the CFO and the programs created confusion with regard to ownership of decisions, especially where adjustments to the recommended recovery amounts were implicated.	1

Appendix B - About the Audit

1. Audit Objective

The audit objective was to provide reasonable assurance that amounts identified for recovery from grants and contributions recipients were compliant with governing authorities and appropriately documented.

1. Audit Scope

The scope of the audit included the 14 recipient audits conducted by the Centre for Grants and Contributions (CGC) in 2015-16. The audit also included 9 of the 32 audits conducted in 2017-18 to determine whether improvements had been made in the process for determining recoverable amounts. The scope also included an examination of how recipient audits were identified.

The audit did not involve contacting or gathering new information from the recipient organizations. The information audited was internal to PHAC.

1. Audit Approach

We conducted this audit in conformance with the Treasury Board of Canada's Policy on Internal Audit and with the Institute of Internal Auditors International Standards for the Professional Practice of Internal Auditing. The audit was conducted at the Public Health Agency of Canada's headquarters. The principal audit procedures included, but are not limited to:

• A review and analysis of policy frameworks, recipient audit planning documents, and relevant documentation;
• Inquiry and review of the specific recoverable amounts and the process for the determination of these amounts; and
• Interviews with key program personnel.

1. Statement of Conformance

This audit was conducted in conformance with the International Standards for the Professional Practice of Internal Auditing and is supported by the results of the Office of Audit and Evaluation's Quality Assurance and Improvement Program.

Appendix C - Audit Criteria

Audit of the Determination of Recoverable for Grants and Contributions

Audit Criteria

1. Identification of recipient audits is based on risk.
2. Recipient audits comply with professional auditing standards.
3. Determination of recoverable amounts is compliant with governing authorities (FAA, Transfer Payment Policy, Contribution Agreement).
4. Roles and responsibilities of the Chief Financial Officer and programs in determining recoverable amounts are clear and understood.