Annex: Summary of the assessment of effectiveness of the system of internal control over financial reporting and the action plan of the Canada Revenue Agency

Fiscal Year 2018-2019

1. Introduction

This document provides summary information on the measures taken by the Canada Revenue Agency (CRA) to maintain an effective system of internal control over financial reporting (ICFR), including information on internal control management, assessment results, and related action plans. 

Detailed information on the CRA’s authority, mandate, and core responsibilities can be found in the Departmental Results Report and the Departmental Plan.

2. CRA system of internal control over financial reporting

2.1 Internal control management

The CRA has a well-established governance and accountability structure to support the CRA’s assessment efforts and oversight of its system of internal control. A CRA internal control management framework, approved by the Commissioner and the Board of Management, is in place and includes:

• organizational accountability structures as they relate to internal control management to support sound financial management, including roles and responsibilities of senior managers in their areas of responsibility for control management;
• a code of values and ethics;
• ongoing communication and training on statutory requirements and policies and procedures for sound financial management and control; and 
• regular updates on internal control management as well as the provision of related assessment results and action plans to the Commissioner, senior management and the Audit Committee of the Board of Management.

The CRA Resource Management Committee provides support to the Chief Executive Officer (CEO) and Chief Financial Officer (CFO) in relation to control activities. It is chaired by the CFO and has representatives from each branch and region at the executive level.

In addition, the Audit Committee of the Board of Management provides advice on the adequacy and functioning of the CRA's risk management, and control and governance frameworks and processes.

2.2 Service arrangements relevant to financial statements

The CRA relies on other organizations for the processing of certain transactions that are recorded in its financial statements as follows:

Common Arrangements

• Public Services and Procurement Canada centrally administers the payments of salaries and the procurement of some goods and services in accordance with the CRA’s Delegation of Authority and provides accommodation services.
• Treasury Board of Canada Secretariat provides the CRA with information used to calculate various accruals and allowances.
• Department of Justice provides legal services to the CRA.
• Shared Services Canada provides information technology (IT) infrastructure services to the CRA in the areas of data centres and network services. The scope and responsibilities are addressed in the interdepartmental arrangement between Shared Services Canada and the CRA.

Specific Arrangements

• Revenu Québec is responsible for the joint administration of the goods and services tax and Quebec sales tax for businesses in the Province of Quebec.
• Department of Finance Canada provides the CRA with the federal and provincial shares of Goods and Services Tax/Harmonized Sales Tax (GST/HST) revenues that are used to determine provincial payments for the HST.
• Canada Border Services Agency provides the CRA with the amount of GST revenues collected from importers, which is used in the calculation of the provincial portion of the HST revenues.
• Department of Finance Canada and Employment and Social Development Canada provide estimates of Canada Pension Plan and Employment Insurance revenues respectively for the months of January to March.

Other government departments rely on the CRA for the processing of certain transactions or information that affect financial statements as follows:

• Canada Border Services Agency for information technology services which includes testing for general computer controls, as well as collection services on their behalf for duties, taxes, fees, penalties, or other amounts owing under the Customs Act, Customs Tariff, Excise Tax Act, Excise Act 2001, and/or related regulations;
• Department of Finance Canada for the determination of tax receivables and payables under Tax Collection Agreements (TCAs) with provincial and territorial governments and First Nations; and
• Employment and Social Development Canada for the collection of its accounts receivable and the administration of a number of activities related to the Canada Pension Plan and Employment Insurance Operating Account.

3. CRA assessment results during fiscal year 2018-2019

3.1 Design effectiveness testing of key controls

In 2018-2019, the CRA completed the design effectiveness testing of return collection and entry, assessment and reassessment and master data maintenance of the Individual Income Tax (T1) Program, including the Unapplied Tax Program. The CRA also completed the design effectiveness testing of general computer controls related to the T1, Trust Income Tax (T3) and Benefits Programs. As a result of this testing, no significant issues were noted.

3.2 Operating effectiveness testing of key controls

In 2018-2019, the CRA completed operating effectiveness testing of the return collection and entry, assessing and reassessing and master data maintenance processes for the T3 Program. Furthermore, the CRA completed operating effectiveness testing of the legislation management, reporting management and segregation of duties processes, which are common amongst all tax programs. Operating effectiveness testing was also completed on the common general computer controls, including information security and continuity management.

No significant issues were noted for the T3 Program or common business process controls.

During testing of the common general computer controls, the CRA identified that stronger controls are required with respect to account monitoring and timely removal of access.

The deficiencies above are known to the management and the CRA is taking action to address them.

3.3 Ongoing monitoring of key controls

In 2018-2019, the CRA completed planned ongoing monitoring of the following processes:

1. Entity-level controls;
2. IT general computer controls for corporate financial systems; and
3. All other business processes:
   1. Payroll
   2. Procurement to pay
   3. Capital assets
   4. Budgeting and Projections
   5. Financial close and reporting

As a result of the ongoing monitoring of key controls, the CRA noted a significant improvement in the processing of payroll-related issues, however, continued improvement is required with regard to addressing payroll and overpayments related issues with the Phoenix pay system in a timely manner.

The deficiencies above are known to the management and the CRA is taking action to address them.

4. CRA Action Plan

4.1 Progress during fiscal year 2018-2019

The CRA continued to make progress in assessing and improving its key controls. The following table summarizes the CRA’s progress based on the plans identified in the previous fiscal year’s Annex.

4.2 Status and action plan for the next fiscal year and subsequent years 

The CRA has continued to make progress on assessing its internal controls over financial reporting throughout the numerous programs that the CRA administers. It is recognized that implementation for all its processes requires multi-year initiatives. After design effectiveness and operational effectiveness testing are complete, the CRA will be applying its rotational ongoing monitoring plan to reassess control performance on a risk basis across all control areas.