Standing Committee on Public Accounts: February 21, 2024

Auditor General’s Report 1 on ArriveCAN

Date: February 21, 2024, 3:30 pm to 5:30 pm

Location: In person

General items

Opening statement

By: Michael Mills, Associate Deputy Minister
Public Services and Procurement Canada

Standing Committee on Public Accounts
Report of the Auditor General on ArriveCAN application
February 21, 2024

(Word count: 440)

Introduction

Thank you, Mr. Chair.

On behalf of Public Services and Procurement Canada (PSPC), I welcome the tabling of Auditor General's report into the development of the ArriveCAN app and I look forward to our discussion today.

I'm joined today by my colleagues Wojo Zielonka, Chief Financial Officer, Dominic Laporte, Assistant Deputy Minister of Procurement and Catherine Poulin, Assistant Deputy Minister of Departmental Oversight.

Speaking as 1 of the key senior officials responsible for procurement, I want to acknowledge the complexity of the federal procurement system and recognize the immediate need to make improvements particularly when we acquire professional services.

The Auditor General's report makes 1 recommendation that implicates PSPC. Namely, that PSPC and the Canada Border Services Agency (CBSA) should ensure that tasks and deliverables are clearly defined in contracts and related task authorizations (TAs). This is particularly key for PSPC and speaks to the division of responsibilities between PSPC and client departments.

PSPC is the government's central purchasing agent, ensuring departments and agencies have the goods and services necessary to deliver on their various mandates.

In this role, PSPC establishes and administers central procurement tools, such as Standing Offers and Supply Arrangements, which client departments and agencies can then access directly.

Mr. Chair, we know there are concerns as to how the procurement instruments associated with ArriveCAN were used.

I can tell this this committee that we have already introduced several new control measures that start to address both the observations in the Auditor General's report and that build on those noted in the Procurement' ombud's report:

• in November 2023, PSPC wrote to all the departments, including CBSA, temporarily suspending all delegated authorities to authorize professional services based TAs
• in early December 2023, PSPC provided direction to its procurement officers to ensure that TAs include a focus on clear tasks and deliverables
• federal departments now must formally agree to a set of terms and conditions to obtain access to select professional services methods of supply
• key changes also include the use of new contract provisions to increase costing and subcontractor transparency, and provide important clarifications on the role of departments when using these instruments. The intent is to improve consistency in practices
• PSPC is also updating its guidance to aid departments in procuring effectively and responsibly when using PSPC's procurement instruments under their own authorities

Conclusion

The Auditor General's report, along with the Procurement Ombud's review, underscores the need to strengthen specific areas of our procurement processes related to professional services.

We will continue to building upon the actions we've taken so far, and focus on a path forward to improve training, procurement process, and practices in order to optimize outcomes for Canadians.

Thank you

Procurement Ombudsmen report

Procurement Practice Review of ArriveCAN

Communication messages on the Office of the Procurement Ombudsmen's review of ArriveCAN

Subject: Office of the Procurement Ombud—Procurement Practice Review of ArriveCAN

The Government of Canada is committed to conducting procurements in an open, fair, and transparent manner. This starts by ensuring sound management and integrity of its procurement processes.

PSPC welcomes the Procurement Ombud's findings as part of the review of procurement activities associated with the creation, implementation and maintenance of ArriveCAN.

PSPC is committed to continually improving and strengthening all aspects of the federal procurement process and will use the findings from this report to improve the way the Government of Canada does business with suppliers.

In this vein, the department has already begun to take steps to implement the Procurement Ombud's recommendations and strengthen procurement, including:

• improving evaluation requirements to ensure resources are appropriately qualified
• requiring increased transparency from suppliers around their pricing and use of sub-contractors
• improving documentation when awarding contracts and issuing TAs
• clarifying work requirements and activities, and specifying which initiatives and projects are being worked on

In addition, PSPC suspended delegated authorities for departmental issuance of TAs against contracts awarded by PSPC until new agreements and measures are implemented.

The department is actively engaging with client departments and agencies to ensure the new measures are implemented quickly and efficiently.

Quick facts and statistics

• the Office of the Procurement Ombud's (OPO) review consisted of an examination of contract files for 41 ArriveCAN-related procurements identified by the CBSA. This represented all known contracts under which work was performed for the creation, implementation and maintenance of ArriveCAN during the scope period. Contract files were provided by CBSA, as well as by PSPC and Shared Services Canada (SSC) for contracts issued by those departments on behalf of CBSA
• CBSA was the user (i.e., client) department for all 41 procurements. PSPC was the contracting department for 30 files, SSC was the contracting department for 7 files, and CBSA established a contract under its own contracting authority for 4 files
• 23 of the 41 procurements were contracts that were issued using a competitive process. Of those 23 competitive contracts, 14 were issued prior to March 11, 2020, when the World Health Organization (WHO) declared COVID-19 a global pandemic, while the remaining 9 were established during the pandemic, between April 2020 and December  2022. All competitive contracts were professional services contracts with TA that were issued under a PSPC supply arrangement
• of the remaining 18 ArriveCAN-related procurements reviewed by OPO, 13 were non-competitive sole-source contracts including 4 contracts with TAs. The other 5 procurements were a mix of call-ups, service orders and TA under which work was performed for ArriveCAN
• the OPO found practices for awarding competitive and non-competitive contracts, for issuing TAs and service orders, and for proactive publication of contract information that were inconsistent with government policy and that threatened fairness, openness and transparency of government procurement. The Procurement Ombud has made 13 recommendations to address the issues identified with procurement practices associated with the ArriveCAN application. 7 of these recommendations are directed at PSPC, 5 at CBSA, 1 at both PSPC and CBSA and 1 at SSC

Procurement Ombudsman and Auditor General reports on ArriveCAN

Issue

On November 2, 2022, a motion was passed by the House of Commons that called on the Office of the Auditor General of Canada (OAG) to conduct a performance audit, including payments, contracts, and subcontracts, of ArriveCAN. The report will be tabled on February 12, 2024.

On January 29, 2024, the OPO published its procurement review on ArriveCAN.

Key facts from the Procurement Ombudsman's report

• n/a

Key messages

• PSPC welcomes the Procurement Ombud's findings as part of the review of procurement activities associated with the creation, implementation and maintenance of ArriveCAN
• the Ombud's findings point out that we can further improve our procurement system, particularly when it comes to consulting services in the field of information technology (IT)
• PSPC is committed to continually improving and strengthening all aspects of the federal procurement process, and has already begun implementing the Procurement Ombud's recommendations to strengthen procurement
• nonetheless, we know that more can be done and that is why my officials are not only taking steps to respond to the Procurement Ombud's recommendations, but also taking additional measures to response to the observations of the Auditor General's report, which will become public next week 
• collectively, these measures will help us continue to strengthen federal procurement, particularly in the field of IT consulting services

If pressed on security clearances:

• PSPC confirmed to the OPO in December 2023 that 91% of PSPC awarded contracts were provided to PSPC's Contract Security Program as required by protocol
• furthermore, 99.5% of contractors working on the ArriveCAN application have been confirmed by the Contract Security Program to have held the appropriate clearance

If pressed on media reporting of 76% of ArriveCAN subcontractors did not perform any work:

• resources may have become unavailable for legitimate reasons between the date the bid solicitation period closed and the date the work started
• the terms of the contracts the ombud was referring to limited billing to the actual hours individual worked after the contracts were in place. The vendors were not compensated for proposed resources if they did not work on the contracts
• PSPC accepted the Ombud's recommendation in this area and has implemented measures to resolve the issue in future procurements by reducing the reliance on resumes of specific people to evaluate companies well in advance of work starting

Key facts from the Auditor General's Report

• n/a

Key messages

• PSPC officials continue to collaborate with government officials and the OAG on any reviews related to ArriveCAN
• work with the OAG is nearing completion. It is expected that the report will be tabled in Parliament on February 12, 2024

Background

On November 14, 2022, the House of Commons Standing Committee on Government Operations and Estimates (OGGO) adopted a motion recommending the Procurement Ombud conduct a review of contracts awarded in relation to the ArriveCAN application.

On January 13, 2023, the OPO determined there were reasonable grounds to launch a review of procurement activities associated with the creation, implementation and maintenance of ArriveCAN.

In February 2023, in response to a motion adopted by the House of Commons, the OAG announced it would be conducting a performance audit of ArriveCAN. The OAG audit is looking at whether all aspects of ArriveCAN, including procurement and expected deliverables, were managed with due regard for economy, efficiency, and effectiveness.

In light of the findings of the audits, PSPC took immediate action to strengthen existing controls around the administration of professional services contracts. On November 28th, 2023, other government departments and agencies were informed of new measures, introducing a common set of principles and mandatory procedures that clients must abide by to use PSPC's professional services contracting instruments.

These changes closely align with the recommendations in the OAG and Procurement Ombud audits and are echoed in the resultant Management Action Plans (MAP) PSPC committed to.

Response to Auditor General's Audit

Recommendation 73: PSPC and the CBSA should ensure that TAs and deliverables are clearly defined in contracts and its related TA authorizations.

PSPC accepts this recommendation, and has already taken action with the following (from the Management Action Plan):

• PSPC has provided direction, in a December 4, 2023 communiqué, to procurement staff to ensure that TAs include clear tasks and deliverables, in addition to identifying the specific project(s) or initiative(s) that are included in the scope of contracts
• additionally, PSPC sent a directive to its client departments, via their senior designated official for procurement, indicating this change was immediately being brought into effect for professional services contracts, as of November 28, 2023
• PSPC will also update the Guide to Preparing and Administering Tasks Authorizations as well as the Record of Agreement template for clients by April 2024

Additional key messages, not from the Management Action Plan

PSPC cooperated with the OAG, providing them all relevant information to conduct their independent review of the ArriveCAN contracts.

PSPC is committed to continually improving and strengthening all aspects of the federal procurement process and has already begun to take steps to implement the OAG's recommendation, as well as those made by the OPO.

PSPC took immediate action to strengthen existing controls and oversight for professional services contracting.

Changes include:

• requiring increased clarity from business owners on the scope, TA and deliverables of new professional services contracts and TA
• improving evaluation requirements to more effectively validate that all resources have the required work experience and validated security clearances
• improving documentation requirements at the time of contract award and when TA are issued
• suspending delegated authorities for departmental issuance of TA against contracts awarded by PSPC until PSPC's newly mandated professional services measures are implemented by departments

The department is actively engaging with client departments and agencies to ensure these new measures are implemented quickly and efficiently.

PSPC will continue its review of procurement tools for professional services, while modernizing them to ensure they support best value, and provide appropriate due diligence and control frameworks.

Office of the Auditor General's audit of ArriveCAN

Contracts related to ArriveCAN

Issue

CBSA was responsible for developing and managing the ArriveCAN tool based on Public Health Agency's (PHAC) health requirements enforced by the Quarantine Act.

Key facts

• 46 different contracts were used in support of ArriveCAN. Among these 46 contracts, it has been confirmed that 31 were awarded by PSPC under its authorities
• the majority of the contracts were issued for broader requirements where ArriveCAN was just 1 of many projects delivered under the contracts
• according to CBSA (per OPQ-881, November 2022), the government has spent $29.8 million on contracts for ArriveCAN:
  • 19 contracts were competitive under normal contracting authorities, including 6 that were set-aside for Indigenous businesses under the Procurement Strategy for Indigenous Business program
  • 12 contracts were non-competitive, including 8 contracts to procure software licenses that were sole sourced due to intellectual property rights or urgent need
  • of the 12 non-competitive contracts, 4 used COVID emergency contracting authorities for the contracting of IT consultants
  • 11 of the 31 contracts PSPC issued were awarded before the COVID-19 pandemic and were leveraged by the CBSA to bring in resources to work on ArriveCAN
  • 4 contracts were awarded to GC Strategies, including 3 that were awarded non-competitively, using emergency contracting authorities
• after November 2022, CBSA has continued to manage and maintain the application. PSPC has not been asked to issue any new supporting contracts, though existing contracts may still be leveraged. 16 of the 31 contracts PSPC put in place remain active
• PSPC requested updated information on the use of contracts and expenditures in support of ArriveCAN from CBSA, but the information is not yet available

Key messages

• PSPC is committed to open, fair and transparent procurement processes, while obtaining the best possible value for Canadian taxpayers
• CBSA had an urgent requirement for professional services to support the development, integration and maintenance of a new secure application to support its response to the COVID-19 pandemic
• PSPC provided procurement support to CBSA, who was responsible for defining the business requirements and managing the development of ArriveCAN

If pressed on subcontracting:

• within the IT industry, it is common for firms to subcontract or collaborate with other suppliers or individuals to address particular IT challenges and solutions
• the 31 contracts that PSPC awarded allowed for the contract holder to sub-contract to other firms as necessary
• the Government of Canada does not have a contractual relationship with any subcontractors. The main contractor is responsible for the performance and the contractual obligations of subcontractors

If pressed on why PSPC will not provide the names of subcontractors:

• for confidentiality reasons, the Government of Canada does not disclose the names of companies who have worked as subcontractors for 1 of its suppliers, as this is considered third-party information

If pressed on who made the decision to contract with GC Strategies:

• GC Strategies was selected by CBSA. PSPC was not involved in the discussions that led to this decision
• CBSA submitted a sole source contract request, along with a valid sole source justification, to PSPC for the award of a non-competitive contract due to pressing emergency where a delay would have been injurious to the public
• PSPC reviewed the sole source justification and determined it was valid considering the global pandemic context and the urgent need for a tool to support health requirements at the border. Exceptional COVID-19 Emergency Contracting Authorities were in place at the time
• GC Strategies was previously working on other mobile applications with the agency and were qualified under the Task-Based Informatics Professional Service Supply Arrangement when they were selected by CBSA to develop ArriveCAN

If pressed on the fees charged by GC Strategies for managing these contracts:

• the rates were reviewed by PSPC officials and were deemed fair and reasonable, based on knowledge of the commodity
• the rates submitted by GC Strategies for the most recent competitively awarded contract were similar to those offered under the non-competitive contracts
• on October 20, 2022, GC Strategies stated publicly in parliamentary committee testimony that the standard industry markup on rates are anywhere from 15% to 30% depending on the skill set and the type of resources required

If pressed on contracts set-aside under the procurement strategy for Indigenous businesses:

• the Government of Canada is committed to economic reconciliation with Indigenous Peoples. As part of this commitment, we promote socio-economic outcomes by increasing economic opportunities for First Nations, Inuit and Métis businesses through the federal procurement process
• PSPC is working with Indigenous Services Canada (ISC) and the Treasury Board of Canada Secretariat (TBS) to implement the government-wide commitment for a minimum target of 5% of the total value of federal contracts awarded to Indigenous businesses by March 31, 2025
• PSPC recently asked ISC to conduct post-award audits on active contracts with Coradix Technology Consulting and Dalian Enterprises Inc. across the Government of Canada. This includes prioritizing those where departments and agencies intend to exercise contract options in the coming months

Background

PSPC provided procurement support to CBSA and PHAC in the delivery of the ArriveCAN program. Specifically, PSPC put in place 31 of the 46 contracts used in the development, launch, and maintenance of the ArriveCAN app.

In pressing emergencies where there is significant human and/or financial risks, PSPC may enter into non-competitive contracts under exceptional emergency contracting authorities provided for in the Government Contract Regulations and in accordance with the TBS Directive. PSPC leveraged those authorities for 4 of the ArriveCAN contracts.

It is important to understand that contract management is a shared responsibility PSPC and its clients. While PSPC negotiates and puts contracts in place, departments are responsible for monitoring and certifying the delivery of goods and services under a contract. In the case of professional services contracts, departments also determine what priorities contractors will work on within the allowable scope of each contract.

List of documents already made available to committees

To date, PSPC has sent the following documents to the OGGO in relation to ArriveCAN:

October 2022

• Request for proposals:
  • 47419-198132 001 EL
  • 47419-206529 001 EL
  • 47419-206529 002 EL
  • 47419-218907
  • EP361-191751 B
  • WS3284483925—Request for Proposal (RFP)
• Contracts:
  • HT399-193822-A

January 2024

• List of contracts where PSPC is the client
• List of contracts where PSPC is the contracting authority
• Contracts with Coradix:
  • EP243-200016-002
  • EP243-200016-002—Amendment 001
  • EP243-200016-002—Amendment 002
  • EP243-200016-002—Amendment 003
  • EP886-160137_001_E
  • EP750-150802-002-Parliamentary Protective Service (PPS)
  • EP750-150802-002-PPS—Amendment 001
  • Call-Up 700218231

Questions and Summaries of Responses to order Paper Questions related to ArriveCAN

Parliamentary Returns having to do with ArriveCAN application (as of February 2, 2024)

Question: Q-597

Date: June 1, 2022

From: Chris Warkentin (Grande Prairie-Mackenzie, Conservative Party of Canada (CPC)

Question summary: How much money to initially develop the ArriveCAN app, with breakdown of expenditures. What are the details of expenditures related to the app (for SSC specifically).

SSC response: SSC gave “NIL” as a response.

Question: Q-783

Date: September 20, 2022

From: Leslyn Lewis (Haldimand-Norfolk, CPC)

Question summary: Details of all documents by senior officials related to ArriveCAN. The question also included the following that was not tasked to PSPC: Any Government of Canada (GC) long term plans for the app, applying it to all forms of cross-border travel.  What constitutional or privacy risks. Is the info shared with other organizations.

PSPC response: 1 email sent to then-Minister Tassi. 1 email sent to SSC senior officials. 

Question: Q-881

Date: October 17, 2022

From: Cheryl Gallant (Renfrew-Nipissing-Pembroke, CPC)

Question summary: Details of ArriveCAN application including on how many bids, whether it was sole-sourced, if fair-market value was paid, if not, will any monies be recovered.

PSPC response: As common service provider (CSP), PSPC awarded contracts on CBSA's behalf mainly for the provision of professional services, but also for the provision of software subscriptions and associated maintenance and support. Most contracts undertaken through a competitive process with multiple bids received, however in this case there was insufficient time. Decisions to pursue a sole source contract and the sole source justification are developed by the client department, which in this case is CBSA. The contracts awarded by PSPC on CBSA's behalf are subject to government audit provisions.

Question: Q-913

Date: October 24, 2022

From: Warren Steinley (Regina—Lewvan, CPC)

Question summary: Has the government paid GC Strategies for apps other than ArriveCAN. If so, details. Has the government paid GC Strategies for other goods or services. If so, details.

PSPC response: 1 contract for training materials plus details.

Question: Q-991

Date: November 18, 2022

From: Michael Cooper (St. Albert-Edmonton, CPC)

Question summary: Total expenditures paid by the government related to advertising, promotion, etc. for the ArriveCAN app on traditional and social media. Contract info, whether it was sole-sourced.

PSPC response: PSPC as a department did not issue any promotion contracts. As the CSP, 3 competitive contracts were issued on behalf of Health Canada but nothing solely related to ArriveCAN app.

Question: Q-1990

Date: November 20, 2023

From: Dan Muys (Flamborough—Glanbrook, CPC)

Question summary: What are the details of contracts signed with Dalian Enterprises since November 2015.

PSPC response: Details given. PSPC responded as the Government of Canada and that its response is in compliance with OGGO ArriveCAN Motion for Production of Papers.

Question: Q-2002

Date: November 21, 2023

From: Michael Barret (Leeds-Grenville-Thousand Islands and Rideau Lakes, CPC)

Question summary: What are the details on contracts signed with GC Strategies since November 2015.

PSPC response: Responded as the CSP, 1 of the contracts (among 6 listed) involved IT services to support the incorporation of accessibility into the ArriveCAN app.

Question: Q-2012

Date: November 22, 2023

From: Jeremy Patzer (Cypress Hills-Grasslands, CPC)

Question summary: Number of employees working on ArriveCAN (across all levels) and bonuses paid to them in the years the app was worked on.

PSPC response: No PSPC employees worked on the app. PSPC, on behalf of CBSA, awarded 20 IT contracts and leveraged 11 professional services contracts. The information is public on the TBS website.

Question: Q-2056

Date: December 5, 2023

From: Dan Albas (Central Okanagan—Similkameen—Nicola, CPC)

Question summary: Details on who signed and authorized the ArriveCAN contract to GC Strategies.

PSPC response: Information on the positions (titles) of the signers and authorizers of 3 contracts. A note that the amount listed in the question is not correct.

Question: S-238

Date: September 19, 2023

From: Senator Don Plett (Manitoba, CPC)

Question summary: Was information on ArriveCAN app given to the Prime Minister, and if not, why. Could Government of Canada's IT employees have developed this app. How much spent on sub-contractors, details on amount and dates of contract(s).

PSPC response: ArriveCAN was initially developed by CBSA. GC Strategies was selected by CBSA to work on the app. The Government of Canada does not track total number of IT workers in the public service. Response includes details on amounts and dates of sub-contracts regarding the ArriveCAN app.

Question: Q-2056

Date: January 30, 2024

PSPC received a repeat of Q-2012 on number of employees that worked on the ArriveCAN applications—response is being drafted.