Annex: Summary of the assessment of effectiveness of the system of internal control over financial reporting and the action plan of the Canada Revenue Agency

Fiscal year 2020 to 2021

1. Introduction

This document provides summary information on the measures taken by the Canada Revenue Agency (the Agency) to maintain an effective system of internal control over financial reporting, including information on internal control management, assessment results, and related action plans.

Detailed information on the Agency’s authority, mandate, and core responsibilities can be found in the Departmental Results Report and the Departmental Plan.

2. Canada Revenue Agency system of internal control over financial reporting

2.1 Internal control management

The Agency has a well-established governance and accountability structure to support the assessment efforts and oversight of its system of internal control. An Agency internal control management framework, approved by the Commissioner and the Board of Management, is in place and includes:

• organizational accountability structures, as they relate to internal control management to support sound financial management, including roles and responsibilities of senior managers in their areas of responsibility for control management
• a code of values and ethics
• ongoing communication and training on statutory requirements and policies and procedures for sound financial management and control
• regular updates on internal control management as well as the provision of related assessment results and action plans to the Commissioner, senior management and the Audit Committee of the Board of Management

The Agency Management Audit and Evaluation Committee endorses the annual plan and reviews significant findings noted as a result of the control assessments. The committee is chaired by the Deputy Commissioner and comprised of Agency executives.

In addition, the Audit Committee of the Board of Management provides advice on the adequacy and functioning of the Agency's risk management, and control and governance frameworks and processes.

2.2 Service arrangements relevant to financial statements

The Agency relies on other organizations for the processing of certain transactions that are recorded in its financial statements as follows:

Common service arrangements

• Public Services and Procurement Canada centrally administers the payments of salaries and the procurement of some goods and services in accordance with the Agency’s Delegation of Authority and provides accommodation services
• The Treasury Board of Canada Secretariat provides the Agency with information used to calculate various accruals and allowances
• The Department of Justice provides legal services to the Agency
• Shared Services Canada provides information technology infrastructure services to the Agency in the areas of data centres and network services. The scope and responsibilities are addressed in the interdepartmental arrangement between Shared Services Canada and the Agency.

Readers of this annex may refer to the annexes of the above-noted departments for greater understanding of the systems of internal control over financial reporting related to these specific services.

The Agency relies on other external service providers and departments for the processing of certain information or transactions that are recorded in its financial statements, as follows:

Specific arrangements

• Revenue Quebec is responsible for the joint administration of the goods and services tax and Quebec sales tax for businesses in the Province of Quebec
• Department of Finance Canada provides the Agency with the federal and provincial shares of Goods and Services Tax/Harmonized Sales Tax revenues that are used to determine provincial payments for the Harmonized Sales Tax
• Canada Border Services Agency provides the Agency with the amount of Goods and Services Tax revenues collected from importers, which is used in the calculation of the provincial portion of the Harmonized Sales Tax revenues
• The Departments of Finance Canada and Employment and Social Development Canada provide estimates of Canada Pension Plan and Employment Insurance revenues respectively for the months of January to March

Other government departments rely on the Agency for the processing of certain transactions or information that affect its financial statements as follows:

• Canada Border Services Agency, for information technology services which includes testing for general computer controls, as well as collection services on their behalf for duties, taxes, fees, penalties, or other amounts owing under the Customs Act, Customs Tariff, Excise Tax Act, Excise Act 2001, and/or related regulations.
• Department of Finance Canada for the determination of tax receivables and payables under tax collection agreements with provincial and territorial governments and First Nations.
• Employment and Social Development Canada, for the collection of its accounts receivable and the administration of a number of activities related to the Canada Pension Plan and Employment Insurance Operating Account.
• Employment and Social Development Canada, for the administration of COVID-19 benefit programs, including the Canada Emergency Response Benefit, Canada Emergency Student Benefit, Canada Recovery Benefit, Canada Recovery Sickness Benefit and the Canada Recovery Caregiving Benefit.

3. Agency assessment results during the 2020 to 2021 fiscal year

3.1 Design effectiveness testing of key controls

During the 2020 to 2021 fiscal year, the Agency completed the design effectiveness testing related to objections and appeals for the Administered Activities. As a result of this testing, it was noted that improved documentation of processes and procedures is required to support the management estimates reported in the financial statements. The deficiencies are known to management and are being addressed.

The Agency also completed design effectiveness testing for the new COVID-19 emergency and recovery measures, including the application collection and entry and financial reporting processes. As a result of the work performed on these programs, no significant issues were noted.

3.2 Operating effectiveness testing of key controls

During the 2020 to 2021 fiscal year, the Agency completed operating effectiveness testing for the disbursements program, which included the payments made under the Administered Activities programs. In addition, operating effectiveness testing was performed for the general computer controls related to the business suite of programs.

As a result of the work performed on these areas, no significant issues were noted.

3.3 Ongoing monitoring of key controls

During the 2020 to 2021 fiscal year, the Agency completed planned ongoing monitoring of the following areas:

1. Corporate Tax (T2) Program, which includes:
   1. Return collection and entry
   2. Assessing and reassessing
   3. Manual disbursements
2. Common Tax Program Controls, which includes:
   1. Legislation management
   2. Reporting management
   3. Segregation of duties
3. General Computer Controls, which includes:
   1. Information security
   2. Continuity management
4. Entity level controls
5. Information technology general computer controls for corporate financial systems
6. Financial reporting for Agency Activities, which includes
   1. Payroll
   2. Procurement to pay
   3. Capital assets
   4. Financial close and reporting

As a result of these assessments, no significant issues were noted.

4. Agency action plan

4.1 Progress during the 2020 to 2021 fiscal year

During the 2020 to 2021 fiscal year, the Agency continued to make significant progress in assessing and improving its key controls. The following table summarizes the Agency’s progress based on the plans identified in the previous fiscal year’s annex.

4.2 Status and action plan for the next fiscal year and subsequent years

The Agency has continued to make progress on assessing its internal controls over financial reporting throughout the numerous programs that the Agency administers. It is recognized that implementation for all its processes requires multi-year initiatives. After design effectiveness and operational effectiveness testing are complete, the Agency will be applying its rotational ongoing monitoring plan to reassess control performance on a risk basis across all control areas.