Core Control Audit

Table of contents

• Executive summary
  • Objective
  • Why this is important
  • Overall conclusion
  • Key findings
  • Compliance rates by policy
• Statement of Assurance
• Background
  • Audit objective
  • Audit scope
  • About the audit
  • Senior management's acceptance of residual risk
• Detailed findings and recommendations
  • Finding 1: Acquisition cards
  • Finding 2: Travel
  • Finding 3: Hospitality
  • Finding 4: Compensation
  • Finding 5: Financial management
  • Finding 6: Contracting and procurement
• Appendix A - Documents consulted
• Appendix B – Management action plan

Executive summary

Objective

To ensure that the Public Service Commission’s (PSC) core controls over administration in financial management, contracting, travel and hospitality, and human resources are effective and result in compliance with corresponding legislation, policies and directives.

Why this is important

The President of the PSC, as the deputy head, is the organization’s accounting officer under the Financial Administration Act (FAA). The President is responsible for ensuring that resources are organized to deliver departmental objectives, in compliance with government policy and procedures, ensuring that there are effective systems of internal control, signing of departmental accounts and performing other specific duties assigned by law or regulation to the administration of the department.

The PSC management team has developed a system of Internal Controls over Financial Reporting, as required by the Treasury Board Policy on Internal Control, to give assurance to the President that transactions are authorized, financial records are properly maintained, assets are safeguarded from risks and there is compliance with laws, regulations and policies.

The goal of the PSC’s Core Control Audit is to provide senior management with an independent assessment of the design and operating effectiveness of the PSC’s system of internal controls. The results of the audit will be used to improve the efficiency and effectiveness of control design, control testing and ongoing monitoring.

Key findings

All expenses reviewed were for legitimate government business. The audit found no evidence of irregularities.

Acquisition cards at the PSC are well controlled. Cardholders have been authorized, have acknowledged their responsibility and are using their cards appropriately for government business transactions.

Key financial management controls are in place, including payment and settlement practices, mandatory delegation training and segregation of duties between roles.

Contracting processes are in place and are effective. Sole source contracts were appropriately justified and contract initiation and bid solicitation were well documented. Security requirements and intellectual property rights were properly addressed and applicable contracts were proactively disclosed.

The majority of hospitality expenses are appropriately documented, justified and disclosed in accordance with Treasury Board guidelines.

Documentation and justification of local travel expenses could be improved. The PSC would benefit from further guidance and training and clearly defined expectations in this area.

Some improvements are needed for the management of compensation practices. The requirements for pre-approval of overtime expenditures are not defined, departure procedures are not always followed and salary justification is not always in place for casual employee contracts.

Recommendations

One audit with recommendations for the PSC, largely in its role as a central agency, was completed by the Office of the Auditor General (OAG) during this reporting period. The IAC was briefed on this Audit of Required Reporting by Federal Organizations just prior to the tabling of the audit in the House of Commons in April 2015.

This was the first audit with recommendations for the PSC conducted by the OAG since the turnover of external members and since the current CAEE arrived. In retrospect, the IAC did not engage on this audit as early as it should have to provide external perspective and advice as the PSC was developing its response. However, given its responsibility under the Directive on Internal Auditing in the Government of Canada to provide advice on audits by external assurance providers, the IAC will review PSC’s more detailed MAP for this audit early in 2015-2016.

While the PSC was not included within the scope, the IAC was also briefed on two horizontal audits conducted by the Office of the Comptroller General (OCG) during this period. For one of them, the Horizontal Audit of Financial Forecasting, the PSC did a self-assessment against the findings and presented it to the IAC. For the other, the Horizontal Internal Audit on the Protection of Personal Information, no self-assessment was done because the PSC conducted its own internal audit.

1. The Financial and Administration Directorate (FAD) should ensure that local travel is defined, that PSC managers understand their obligations to justify and document exceptions when approving travel and that they are using the Government of Canada prescribed guidelines for travel.
2. The FAD should define and communicate expectations for documentation of pre-approval of overtime expenses.
3. The Human Resources Management Directorate (HRMD) should ensure that salary exception justifications are documented for each new casual contract.
4. The HRMD should ensure that acting appointments are approved in advance.
5. The FAD should ensure that departure procedures are effectively followed.
6. The FAD should ensure that individuals with the delegated Section 33 authority review the post-payment verification of pay administration transactions.

Statement of Assurance

Background

One audit with recommendations for the PSC, largely in its role as a central agency, was completed by the Office of the Auditor General (OAG) during this reporting period. The IAC was briefed on this Audit of Required Reporting by Federal Organizations just prior to the tabling of the audit in the House of Commons in April 2015.

This was the first audit with recommendations for the PSC conducted by the OAG since the turnover of external members and since the current CAEE arrived. In retrospect, the IAC did not engage on this audit as early as it should have to provide external perspective and advice as the PSC was developing its response. However, given its responsibility under the Directive on Internal Auditing in the Government of Canada to provide advice on audits by external assurance providers, the IAC will review PSC’s more detailed MAP for this audit early in 2015-2016.

While the PSC was not included within the scope, the IAC was also briefed on two horizontal audits conducted by the Office of the Comptroller General (OCG) during this period. For one of them, the Horizontal Audit of Financial Forecasting, the PSC did a self-assessment against the findings and presented it to the IAC. For the other, the Horizontal Internal Audit on the Protection of Personal Information, no self-assessment was done because the PSC conducted its own internal audit.

The Treasury Board’s Policy on Internal Control outlines the roles and responsibilities for the establishment, maintenance, monitoring and review of the departmental system of internal control. This system helps mitigate risks in the effectiveness and efficiency of programs, operations and resource management, including the safeguarding of assets, the reliability of financial reporting and compliance with legislation, regulations, policies and delegated authorities. Compliance with the Policy on Internal Control and its supporting directives is to be monitored through periodic audits and other reviews to ensure their effective implementation.

Annually, the President, as deputy head, must sign a departmental Statement of Management Responsibility Including Internal Control over Financial Reporting (SMR). The SMR outlines the management responsibility for financial statements and other financial information, as well as the financial reporting process that produces such statements and other information. The SMR may be modified or tailored, as required, to suit the department's mode of operation and to properly reflect the departmental context and realities.

The Public Service Commission’s (PSC) mandate is to protect merit, non-partisanship, representativeness and the use of both official languages in the public service. Under the delegated staffing system set out in the Public Service Employment Act (PSEA), the PSC fulfills its mandate by providing policy guidance and expertise and by conducting effective oversight that includes audits, investigations and ongoing monitoring. The PSC also delivers staffing and assessment services for other federal government organizations. Some of these services are provided on a cost recovery basis.

Given the nature of the work, expenses at the PSC are primarily salary-based ($85.3M), with contracted services ($12.9M) and accommodations ($10.3M) making up the largest part of the non-salary component. Revenues from cost recovered services totalled $9.2M.

This audit focussed on internal controls for the authorization of payroll expenses (human resources (HR)), contracting and overall financial management. Additionally, due to the sensitive nature of travel and hospitality transactions, these areas were also tested. Revenues were not tested as they were recently audited and are not considered high risk at this time. This area will be considered for testing in future years.

Audit objective

To ensure that the PSC’s core controls over administration in financial management, contracting, travel and hospitality and HR are effective and comply with corresponding legislation, policies and directives.

Audit scope

A detailed examination phase was conducted using the Acts, policies and directives outlined in Appendix A. Individual transactions taken from FY 2013-2014 were examined for data completeness, reasonableness, accuracy, validity and compliance with applicable legislation, policies and directives. Transactions for testing were chosen on a random statistical basis, with top-up procedures on high dollar value items and potential high risk transactions.

This audit focussed on the financial management processes of all branches, largely from a transactional point of view. For testing purposes, transaction samples were taken from the financial system from April 1^st, 2013 to March 31^st, 2014.

About the audit

The audit was conducted in accordance with Treasury Board’s policies, directives and Internal Auditing Standards for the Government of Canada.^{Footnote 5} otnote

In order to conclude on the adequacy of controls in place, the audit team gathered evidence using the following methods:

• Interviews with management and staff;
• File reviews and analysis of documents, including systems-generated reports; and
• Walk-through of key processes.

Evidence was reviewed and assessed for sufficiency, reliability, relevancy and usefulness. The audit team measured the systems and practices of the PSC against the predefined and agreed-upon audit criteria developed based on the Acts, policies and directives listed in Appendix A.

Senior management's acceptance of residual risk

In accordance with internal auditing standards, findings are provided against pre-established criteria. Auditors make recommendations to management to address the identified risks. Where management believes that costs of the implementation of a recommendation outweigh potential benefits, management can and should indicate that they will accept the risk of not taking action. This should be confirmed by the Executive Management Committee and discussed with the Internal Audit Committee. 

Detailed findings and recommendations

Finding 1: Acquisition cards

We examined whether acquisition cards at the Public Service Commission (PSC) are well controlled and users have acknowledged their responsibility for the cards. We also verified that cards were used for authorized government business expenses for goods, services and hospitality.

Acquisition cards are used to provide a cost-effective, secure and convenient method of procuring and paying for government goods and services, while ensuring effective financial control. Given that cards are assigned to individual employees, there needs to be an agreement in place between the supervisor and the employee to acknowledge roles and responsibilities associated with the card. Acquisition cards are not to be used for personal purposes and are only to be used for authorized government expenses.

Acquisition cards attribution is controlled and cardholders have acknowledged their responsibility in writing

The recommendation from the responsibility center manager recommending an employee to have an acquisition card with a defined credit limit was found in all files reviewed. Responsibility centre managers are responsible for recommending which employees should be cardholders; recommending reasonable credit limits based on planned use and for reassessing the need on a periodic basis or when responsibilities change; and ensuring that there is a sufficient unencumbered balance available before entering into acquisition card transactions. Cardholder agreements were also retained on file in all cases reviewed, ensuring that acquisition card applications and restrictions are specified and communicated to cardholders and that cardholders acknowledge their responsibilities and obligations prior to receiving an acquisition card.

PSC acquisition cards are used for legitimate government business-related expenses

In all files reviewed, cards were used solely for authorized government business-related purchases of goods, services and pre-approved hospitality expenditures.

Expenses for acquisition cards were pre-approved and verified

Section 32 (pre-approval of expenditures) and Section 34 (verification of expenditures) were completed on a timely basis and by someone with the delegated authority for acquisition cards.

Finding 2: Travel

We examined whether PSC business travel expenses were managed in order to minimize costs. We also examined whether travel expenses of senior officials were properly disclosed, in accordance with the rules for Proactive Disclosure.

Government employees travel in order to conduct government business. In accordance with the National Joint Council (NJC) Travel Directive and the Treasury Board Directive on Travel, Hospitality, Conference and Event Expenditures, public servants are expected to ensure fiscal prudence and effective, efficient and economical use of public resources while achieving fair, reasonable and modern travel practices. Travel expenses of senior officials should be disclosed so as to further increase transparency and oversight of the use of public funds.

Meals, incidentals, flight and rail arrangements respected the prescribed limits and travel cards were used appropriately

In the majority of the files reviewed, meal and incidentals allocations were reimbursed in accordance with specified rates, flight and rail arrangements respected the appropriate limits, when applicable, and travel cards were used to the extent possible to prepay travel arrangements.

Accommodation and other expenses were above the prescribed city limit rates^{Footnote 6}  without documented justification in some cases reviewed

Public Works and Government Services Canada maintains a list of recommended hotels and car rentals for various cities and recommended city rate limits. In many cases, there are legitimate business reasons for exceeding these limits, such as safety, security and location of accommodations. This justification should be documented.

Local travel has not been defined

Many local travel expenses were authorized after the travel occurred, without documented justification.

Section 4.2.3 of the Guideline on Travel, Hospitality, Conference and Event Expenditures states that “The department's financial policy instructions should include a definition of ‘local travel’ that supports the department's operational circumstances. This should define the limits under which local travel in those areas would be excluded from travel approvals in the directive. As this definition pertains to expenditure initiation authority for travel, it is independent of the NJC's Travel Directive module definitions related to travel entitlements.”

The PSC has a Standard on Travel, Hospitality, Conference and Event Expenditures, dated November 2013. This standard does not include a definition of local travel, nor does it define the limits or the areas under which local travel would be excluded. Providing a definition of local travel would exclude these expenses from requiring travel approval.

Travel expenses of senior officials are proactively disclosed

All travel expense claims tested for designated senior level Government of Canada employees were proactively disclosed. The total annual travel expenditures for the department were disclosed through its Web site and included a description of the main variances from the previous year's actual travel expenses.

Most travel expenses were verified appropriately

Section 34 (verification of expenditures) was completed on a timely basis by someone with the delegated authority for most travel expenses.

Recommendation

• 1. The Financial and Administration Directorate (FAD) should ensure that local travel is defined, that PSC managers understand their obligations to justify and document exceptions when approving travel and that they are using the Government of Canada prescribed guidelines for travel.

Finding 3: Hospitality

The audit examined whether the PSC’s hospitality expenses were managed with prudence and probity and represented the most economic and efficient use of funds, given the nature of the activity in relation to the achievement of a department's mandate. We also examined whether hospitality expenses of senior officials were properly disclosed, in accordance with the rules for proactive disclosure.

Government employees sometimes provide hospitality in the conduct of government business. In accordance with Treasury Board’s Directive on Travel, Hospitality, Conference and Event Expenditures, public servants are expected to ensure fiscal prudence and effective, efficient and economical use of public resources. Hospitality expenses of senior officials should be disclosed to further increase transparency and oversight of the use of public funds.

Hospitality expenses were planned and conducted in an economical and appropriate way to facilitate government business consistently with the event’s circumstances

The majority of hospitality expenses were planned and conducted in an economical and appropriate fashion. All files conformed to the eligible cost per person, as set out in the directive and no alcoholic beverages were claimed.

Most hospitality expenses are proactively disclosed

Most hospitality expenses were proactively disclosed, in accordance with the directive. Minor exceptions were found where senior management attended events held under their cost centre and did not disclose this on the external Web site. The total annual hospitality expenditures for the PSC were disclosed.

Expenses for hospitality were pre-approved and verified appropriately

Section 32 (pre-approval of expenditures) and Section 34 (verification of expenditures) were completed on a timely basis and by someone with the delegated authority for hospitality expenses.

Finding 4: Compensation

The audit examined whether PSC employee leave was authorized in a timely manner by someone with the appropriate authority. It also assessed whether performance pay was administered appropriately. Furthermore, auditors examined whether key terms and conditions for casual workers were being administered correctly.

Payroll and compensation expenses represent the biggest portion of the PSC’s expenditures. Therefore, adequate financial controls over pay administration are essential to ensure accuracy, integrity and timeliness. Leave, performance pay and new and departed employees should be approved, verified and appropriately documented.

Leave transactions

Leave is authorized in a timely manner by the appropriate authority

With two exceptions, leave with pay transactions were authorized at the appropriate level and in a timely manner. Through our review of the controls in the PeopleSoft system, it was noted that there are no controls in place to ensure that leave is approved by authorized individuals. Leave can be submitted to any individual who has an account in the system. There are also no mitigating monitoring controls that would detect leave approval by individuals without delegated authority.

Casual appointments

Most of the terms and conditions for casual workers were administered correctly

In all cases reviewed, individuals were properly security cleared prior to commencing their work at the PSC. With one minor exception, casual employee terms respected the 90 day limit under the Public Service Employment Act.

It was found that the PSC’s current business practices in cases where employees work multiple casual terms is to use the initial justification developed for the first casual appointment for all subsequent casual appointments above the minimum salary. The PSC does not require managers to develop a new rationale for paying above the minimum for returning casual employees. Each casual term is a new employment contract and, as such, should have a new justification on file or an indication that the previous justification still applies.

Casual appointments were verified appropriately

Section 34 was completed on a timely basis, by someone with delegated authority, for most casual appointments reviewed.

Acting appointments

Some acting appointments are not approved in advance

Section 32 was not always completed in advance for the acting appointments reviewed. In several acting files reviewed, the expense was initiated after the acting period began.

Acting appointments were verified appropriately

Section 34 was completed on a timely basis, by someone with delegated authority for most acting appointments reviewed.

Performance pay

Performance pay is administered correctly

In all cases reviewed, performance pay was only allocated to eligible employees. Annual performance reviews are based on pre-set objectives and are documented. In two cases, there was no assessment of the performance against annual objectives on file for employees who received performance pay. In both situations, the employee left the organization near the end of the fiscal year and prior to the performance assessment exercise. The assessment of the performance against annual objectives was, therefore, not documented. An in-camera discussion was held at the Executive Management Committee for all executives and both of these individuals’ performance pay was discussed and approved by the President in the Executive Talent Management System (ETMS).

Overtime

Processes for pre-approval (Section 32) of overtime expenses are not defined

Auditors reviewed payment transactions and asked managers whether pre-approval of overtime was in place. Most managers indicated that pre-approval of overtime is done verbally and not documented.

There was a total of approximately $400,000 paid in overtime in fiscal year 2013-2014. Documented pre-approvals ensure that there is clarity between managers and employees with respect to overtime. Without this clarity, there are potential disputes over whether overtime was authorized, as required by collective agreements, and can lead to grievances from employees. Additionally, documentation ensures that there is a sufficient audit trail, in accordance with the Directive on Account Verification, and that the manager has confirmed that there is sufficient budget to pay the transaction. Pre-approval can take any form and does not have to be on a transaction-by-transaction basis. With proper planning, managers can institute a monthly or quarterly review and pre-approval system.

Most overtime transactions were verified appropriately

Section 34 (verification of expenditures) was completed, on a timely basis, by someone with delegated authority for most overtime transactions.

Departure procedures

Appropriate departure procedures are not always followed

In the cases reviewed, there were several instances where no departure form was available. Without effective departure procedures there are security risks, including loss of data and information and continued access to networks and facilities, financial overpayment and asset management risks.

Recommendations

• 2. The FAD should define and communicate expectations for documentation of pre-approval of overtime expenses.
• 3. The Human Resources Management Directorate (HRMD) should ensure that salary exception justifications are documented for each new casual contract.
• 4. The HRMD should ensure that acting appointments are approved in advance.
• 5. The FAD should ensure that departure procedures are effectively followed.

Finding 5: Financial management

Section 33 of the FAA is a final confirmation and quality review conducted by finance officials to ensure that managers have properly exercised their authorities prior to payment and settlement of a transaction.

It is expected that there is auditable evidence demonstrating that account verification has taken place and has been certified by an individual with delegated financial signing authority, that all high-risk transactions are subject to a full review of the transaction and that a sample of medium and low-risk transactions are selected, based on a sample selection methodology, and are subject to a review of the most important aspects of each selected transaction.

Managers are required to undergo financial delegation training prior to having authority to sign off on pre-approval (Section 32) and verification of (Section 34) of expenses. Lastly, in order to ensure proper segregation of duties, managers should not sign off on both Section 34 and Section 33 of a transaction.

Section 33– Quality review - Payment and settlement

The quality review process was carried out appropriately for acquisition cards, travel and hospitality transactions reviewed

All acquisition cards, travel, hospitality and contracting expenses went through a quality review process by a financial officer with delegated authority prior to the payment.

The quality review process for pay administration is in place through post-payment verification; this process is not reviewed by individuals who have been delegated the Section 33 authority

Pay administration transaction payments are released prior to payment by a financial officer with delegated authority.

Salary transactions are sampled on a monthly basis, using a risk-based methodology, and are verified for accuracy, using the supporting documentation of a given transaction.

Post-payment verification is an acceptable method of certification, provided that it is performed using a risk-based approach and is reviewed by someone with delegated authority.

There was no evidence provided that financial officers delegated Section 33 authority have reviewed the post-payment verifications conducted.

Financial management controls

Practices are in place to ensure that individuals responsible for exercising signing authority have taken the required training

The Delegation of Financial Signing Authorities Chart was signed by the President of the PSC.

The majority of employees reviewed who exercised their delegated authority in FY 2013-2014 received appropriate training, in accordance with requirements pertaining to financial management, contracting, and HR. It should be noted that, for certain employees reviewed who had left the PSC but had exercised their delegated authority in FY 2013-2014, no delegation training record was available for review.

Adequate segregation of duties is in place

Adequate segregation of duties, such as ensuring the custody and distribution of cheques and direct deposit payment statements, exists in pay administration roles, because Public Works and Government Services Canada releases all payments.

Recommendation

• 6. The FAD should ensure that individuals with the delegated Section 33 authority review the post-payment verification of pay administration transactions.

Finding 6: Contracting and procurement

The audit examined whether PSC contracting practices were in compliance with Treasury Board’s Contracting Policy. For all contracts, it assessed whether the proper contracting vehicles were used and whether contracts were initiated by individuals with delegated authority. For non-competitive contracts, it assessed whether they were properly justified. For competitive contracts, it assessed whether evaluations of proposals were done in an open, fair and transparent manner. Lastly, it assessed whether payments against contracts were properly verified, payables at year end were properly set up and that applicable contracts were proactively disclosed.

The PSC issues contracts to vendors to conduct business with the department and is required to follow a competitive procurement strategy for contracts over $25,000. Contracts should be initiated in advance and payment should be verified by someone with proper delegated authority. Invoices for contracts should be properly accounted for at year end to ensure the financial records are accurate. Proactive disclosure ensures that the department is transparent about its contracting practices.

The proper contracting vehicles were used and non-competitive contracts were justified

Appropriate contracting strategies were used, sole source contracts were justified and evaluations of proposals were done in a fair, open and transparent manner.

Contracts were initiated and verified properly by someone with delegated authority

Section 32 (pre-approval of expenses) and Section 34 (verification of expenditures) were performed appropriately for all contracts reviewed.

Most contracts and amendments were approved prior to receipt of goods and services

With few exceptions, the amendment and/or the contract was issued prior to the goods and services being received and signed for by the appropriate authority. It was noted that procurement officers were delegated the authority to sign off on contracts and amendments by virtue of their position; however, most procurement officers did not have a signature card in place. Signature cards provide a strong audit trail and reinforce controls over procurement activities. This issue was recently identified by FAD and has since been adjusted.

All contracts were proactively disclosed

All contracts valued at over $10,000 were proactively disclosed on the PSC website, in accordance with policy.

Appendix A - Documents consulted

Acts of Parliament

1. Federal Accountability Act
2. Financial Administration Act
3. Public Service Employment Act

TBS Policies, directives, and guidelines

1. Directive on Account Verification
2. Directive on Acquisition Cards
3. Contracting Policy
4. Directive on Delegation of Financial Authorities for Disbursements
5. Directive on Executive Compensation
6. Directive on Expenditure Initiation and Commitment Control
7. Directive on Financial Management of Pay Administration
8. Directive on Leave and Special Working Arrangements
9. Policy on the Management of Executives
10. Directive on Terms and Conditions of Employment
11. Directive on Terms and Conditions of Employment for Certain Excluded and Unrepresented Employees
12. National Joint Council Travel Directive
13. Directive on Travel, Hospitality, Conference and Event Expenditures
14. Directive on Travel Cards and Travellers Cheques
15. Guideline on Travel, Hospitality, Conference and Event Expenditures

Appendix B – Management action plan

Footnotes