Annex: Summary of the assessment of effectiveness of the system of internal control over financial reporting and the action plan of the Canada Revenue Agency (unaudited)

Fiscal Year 2024 to 2025

1. Introduction

This document provides summary information on the measures taken by the Canada Revenue Agency (CRA) to maintain an effective system of internal control over financial reporting (ICFR), including information on internal control management, assessment results, and related action plans.

Detailed information on the CRA’s authority, mandate, and core responsibilities can be found in the Departmental Results Report and the Departmental Plan.

2. Canada Revenue Agency system of internal control over financial reporting

2.1 Internal control management

The CRA has a well-established governance and accountability structure to support the assessment efforts and oversight of its system of internal control. A CRA internal control management framework, approved by the Commissioner and the Board of Management, is in place and includes:

• organizational accountability structures as they relate to internal control management to support sound financial management, including roles and responsibilities of senior managers in their areas of responsibility for control management;
• a code of values and ethics;
• ongoing communication and training on statutory requirements and policies and procedures for sound financial management and control; and,
• regular updates on internal control management as well as the provision of related assessment results and action plans to the Commissioner, senior management and the Audit Committee of the Board of Management.

The CRA Management Audit and Evaluation Committee endorses the annual plan and reviews significant findings noted as a result of the control assessments. The committee is chaired by the Deputy Commissioner and comprised of CRA executives.

In addition, the Audit Committee of the Board of Management provides advice on the adequacy and functioning of the CRA's risk management, and control and governance frameworks and processes. 

2.2 Service arrangements relevant to financial statements

The CRA relies on other organizations for the processing of certain transactions that are recorded in its financial statements as follows:

Common service arrangements

• Public Services and Procurement Canada centrally administers the payments of salaries and the procurement of certain goods and services in accordance with the CRA’s Delegation of Authority and provides accommodation services.
• Treasury Board of Canada Secretariat provides the CRA with information used to calculate various accruals and allowances.
• Department of Justice provides legal services to the CRA.
• Shared Services Canada provides Information Technology infrastructure services to the CRA in the areas of data centres and network services. The scope and responsibilities are addressed in the interdepartmental arrangement between Shared Services Canada and the CRA. 

Readers of this annex may refer to the annexes of the above-noted departments for greater understanding of the systems of internal control over financial reporting related to these specific services.

The CRA relies on other external service providers and departments for the processing of certain information or transactions that are recorded in its financial statements, as follows:

Specific arrangements

• Revenu Québec is responsible for the joint administration of the goods and services tax and Québec sales tax for businesses in the Province of Québec.
• Department of Finance Canada provides the CRA with the federal and provincial shares of Goods and Services Tax/Harmonized Sales Tax revenues that are used to determine provincial payments for the Harmonized Sales Tax.
• Department of Finance Canada, based on CRA historical tax revenue information, provides the CRA with forecasted allocation ratios for the current and future years. These ratios are used to allocate income tax revenues between federal, provincial, territorial, and First Nations jurisdictions as part of the CRA’s accrual accounting estimates for income tax revenues.
• Canada Border Services Agency provides the CRA with the amount of Goods and Services Tax revenues collected from importers, which is used in the calculation of the provincial portion of the Harmonized Sales Tax revenues.
• Employment and Social Development Canada provides estimates of Canada Pension Plan and Employment Insurance revenues for the months of January to March.
• Employment and Social Development Canada provides the Allowance for Doubtful Accounts (ADA) methodology and rates used for the COVID-19 benefits that are administered by the CRA on their behalf.
• An external service provider, under contract with the CRA, provides a procurement application that captures related financial transactions and supports a number of controls and reports within the Procure to Pay process.

Other government departments rely on the CRA for the processing of certain transactions or information that affect its financial statements as follows:

• Canada Border Services Agency for information technology services which includes testing for general computer controls, as well as collection services on their behalf for duties, taxes, fees, penalties, or other amounts owing under the Customs Act, Customs Tariff, Excise Tax Act, Excise Act 2001, and/or related regulations;
• Department of Finance Canada for the determination of tax receivables and payables under Tax Collection Agreements with provincial and territorial governments and First Nations;
• Employment and Social Development Canada for the collection of its accounts receivable and the administration of a number of activities related to the Canada Pension Plan and Employment Insurance Operating Account;
• Employment and Social Development Canada for the administration of COVID-19 benefit programs, including the Canada Emergency Response Benefit, Canada Emergency Student Benefit, Canada Recovery Benefit, Canada Recovery Sickness Benefit, the Canada Recovery Caregiving Benefit and the Canada Worker Lockdown Benefit;
• Health Canada for the administration of the Interim Canada Dental Benefit; and
• Canada Mortgage and Housing Corporation for the administration of the Canada Housing Benefit.

3. Canada Revenue Agency assessment results during the 2024 to 2025 fiscal year 

3.1 Design effectiveness testing of key controls

During the 2024 to 2025 fiscal year, design effectiveness testing was performed on activities remaining under COVID-19, the Canada Housing Benefit, and the Interim Canada Dental Benefit. Testing was also performed on a limited number of existing contracting controls related to Procure to Pay, and on information technology general controls for the Financial Planning System.

As a result of this work, no significant issues were noted.

3.2 Operating effectiveness testing of key controls

During the 2024 to 2025 fiscal year, operating effectiveness testing was performed on activities remaining under COVID-19, the Canada Housing Benefit, the Interim Canada Dental Benefit. Testing was also performed on a limited number of existing contracting controls related to Procure to Pay.

As a result of this work, no significant issues were noted.

3.3 Ongoing monitoring of key controls

During the 2024 to 2025 fiscal year, the CRA completed planned ongoing monitoring of the following areas:

1. Goods and Services Tax
2. Excise Taxes and Duties
3. Disbursements
4. Information technology general computer controls for Administered Activities systems
5. Common Tax Program Controls, which included:
   1. Mail room operations
   2. Transfer of data between source systems and Revenue Ledger
   3. Robotic processes
6. Information technology general computer controls for Agency Activities systems 
7. Financial reporting for Agency Activities, which included:
   1. Payroll
   2. Procure to Pay
   3. Segregation of Duties
8. Financial management for Agency Activities, which included:
   1. Investment Planning
9. Entity-level controls
10. Common information technology general controls, which included:
    1. Management of access
    2. Management of service providers
    3. IT Continuity

As a result of this work, no significant issues were noted.

4. Canada Revenue Agency Action Plan

4.1 Progress during the 2024 to 2025 fiscal year

During the 2024 to 2025 fiscal year, the CRA continued to make significant progress in assessing and improving its key controls. The following table summarizes the CRA’s progress based on the plans identified in the previous fiscal year’s annex along with progress on activities requiring remediation from current and previous assessments.

We also noted satisfactory progress regarding action plans for the following:

• Individual Income Tax (T1) program operating effectiveness control assessment;
• Individual Income Tax (T1) unapplied taxes operating effectiveness control assessment;
• Allowance for Doubtful Accounts and write-offs operating effectiveness control assessment;
• Objections and Litigations design and implementation assessment;
• Benefits operating effectiveness control assessment;
• Revenue processing operating effectiveness control assessment;
• Common Tax Program ongoing monitoring control assessment;
• Financial reporting for Agency Activities ongoing monitoring control assessment; and,
• Information Technology General Control assessments.

Overall, results have been positive, with most action plans completed or progressing according to their original or revised approved timelines. Ongoing monitoring will continue for outstanding items.

4.2 Status and action plan for the next fiscal year and subsequent years

The CRA has continued to make progress on assessing its internal controls over financial reporting across the numerous programs that the CRA administers. Having completed design and operating effectiveness testing in all key areas, the CRA applies a rotational continuous monitoring plan. Under this plan, control activities are regularly reassessed and adjusted based on ongoing risk and performance evaluations. This approach may include selective design and operational effectiveness testing tailored to emerging risks.