Internal Audit of the Management of Discipline

Final report

To print a copy of this report, use the printable version (PDF, 779 KB).

Audit, Evaluation, and Risk Branch
May 2014

Table of Contents

• Executive Summary
• Introduction
• Audit objectives
• Methodology
• File selection methodology
• Findings, Recommendations, and Action Plans
  • 1.0 Comparative analysis
  • 2.0 Program oversight, administration, and management
  • 3.0 Compliance with policies and procedures
  • 4.0 Monitoring, quality review, and reporting
  • 5.0 Communications
  • 6.0 Timeliness of the internal investigation process
• Conclusion
• Appendix A

Executive Summary

Background:

Through the administration of tax, benefits, and other programs, the work of Canada Revenue Agency (CRA) employees affects the lives of all Canadians. As public servants, employees are held to a high standard of conduct and are accountable to the public for the way that they conduct themselves. It is by behaving ethically and with good conduct, as prescribed in the Code of Ethics and Conduct and CRA policy instruments, that employees exemplify the CRA's values of integrity, professionalism, respect, and co-operation, and contribute to the public's confidence in the integrity of the CRA.^{Footnote 1}

To maintain the public's trust and to ensure the reputation of the CRA is upheld, the Agency has put in place an Integrity Framework that defines a culture of integrity. Integrity is defined through various instruments that establish standards of conduct for dealing with external and internal stakeholders, and describe what acting with integrity means.

The Integrity Framework is intended to enable the Agency to be more consistent, effective, and responsive in meeting two significant responsibilities: fostering the CRA's culture of integrity; and preventing, monitoring, detecting, and managing integrity lapses. Integrity lapses include failures by employees to adhere to CRA policy instruments (i.e. all CRA policies, directives, standards, procedures, and guidelines) that describe the expected standard of conduct for all CRA employees.^{Footnote 2} "The CRA is committed to sustaining a respectful workplace and a culture of integrity. Misconduct will not be tolerated."^{Footnote 3}

It is important for the CRA to maintain a high standard of values and ethical behaviour in order to ensure the public's continued trust and willingness to comply with tax legislation. To preserve the public's trust in CRA and continued compliance with tax legislation, the Discipline Policy and associated disciplinary processes to manage integrity lapses must be fully implemented, communicated, followed, and monitored for efficiency and effectiveness.

In 2013, a new corporate committee, the Integrity Advisory Committee (IAC), was established. The IAC is chaired by the Commissioner of the CRA and membership includes an external and independent integrity advisor with an extensive background in law enforcement.

The IAC is responsible for providing advice on Agency issues and initiatives through an integrity lens. Its objective is to facilitate impartial reviews, open discussions, and ethical considerations surrounding the Agency's day-to-day business, including operational and personnel areas.

Paragraph 51(1) (f) of the Canada Revenue Agency Act authorizes the CRA to establish standards of discipline for its employees and prescribe penalties, including suspension and termination of employment, that may be applied for breaches of discipline or misconduct.^{Footnote 4} The CRA Discipline Policy and the Procedures for Addressing Employee Misconduct contained in the Table of Suggested Disciplinary Measures (the table), were updated and approved in 2011.

The Policy and Procedures are scheduled for full review by the Human Resources Branch (HRB) every five years. A full review was last completed in June 2011. In July 2013, HRB updated the Policy and Procedures to support consistency in the application of the table, including required consultation on accepting resignations in cases subsequent to alleged misconduct or in lieu of discipline or in cases when rendering discipline that is outside of the table.

All branch and regional Assistant Commissioners are responsible for ensuring the policy is implemented, monitored and accessible to managers and employees.

In HRB, the central point of contact for labour relations policies and programs, as well as values and ethics, is the Integrity and Workplace Relations (IWR) Division, Workplace Relations and Compensation Directorate.

The Internal Affairs and Fraud Control Division, Security and Internal Affairs Directorate (SIAD), Finance and Administration Branch, supports the administration of discipline in the CRA by conducting independent, administrative investigations into high-risk allegations or suspicions of employee misconduct.

A key finding from the publically available Integrity Survey conducted by KPMG in 2013^{Footnote 5} was that having formal ethics and compliance programs in place continues to make a positive difference. Employees who work in organizations where such programs exist generally reported more favourable results than employees who work in organizations without such programs. The CRA has a formal values and ethics program in place.

Out of the total population of more than 40,000 CRA employees, there was a total of 832 Labour Relations discipline cases for the four fiscal periods (2009-2010 to 2012-2013), or an average of .5% of the total population for each fiscal year.

Objectives:

The objectives of this audit were:

1. to assess the extent to which the internal controls in place are efficient, effective and functioning as intended for the consistent administration, application, and reporting (internal and external) of discipline in the CRA;
2. to determine the extent of employee awareness and understanding of discipline and related policies, procedures and recourse and reporting mechanisms; and
3. to assess the extent to which the internal affairs investigations process supports the administration of discipline.

Examination activities were conducted from July to September 2013 at select offices in all regions, including Headquarters. File reviews were completed on a judgemental, non-statistically valid sample of disciplinary cases for fiscal years 2009-2010 to 2012-2013 (Appendix A provides additional details on the file review methodology).

This audit was conducted in accordance with the International Standards for the Professional Practice of Internal Auditing.

Conclusion:

Integrity is key to the effective administration of tax, benefits, and other programs to the Canadian public. The confidence and trust of the Canadian public in the CRA has been the cornerstone of Canada's tax system, largely due to the exemplary conduct of its employees.

Employees of the CRA are held to a high standard of conduct and are accountable to all Canadians for their behaviour. It is in the CRA's interest to assist its employees wherever possible to maintain this expected standard.

Throughout the audit, Internal Audit (IA) has identified opportunities for improved control, communication and collaboration in the spirit of strengthening the Agency for the benefit of all Canadians.

As a result of the audit findings, recommendations have been made to improve internal control over the consistency, application, and reporting of discipline in order to strengthen the CRA's response to misconduct and reinforce the message that it will not be tolerated.

In an effort to improve communication of the CRA's message, recommendations have been made to increase awareness and understanding of the well-developed CRA Discipline Policy and related procedures.

In order to improve Internal Affairs' ability to support the administration of discipline, which is to conduct independent administrative investigations into high-risk allegations or suspicions of employee misconduct, Internal Audit recommends improvement in its communications with stakeholders to clarify and improve discipline processes to meet the timelines outlined in policies and procedures.

Management agrees with all the recommendations and has developed action plans to address them.

By addressing the findings from the audit, the Agency will strengthen its commitment to upholding the integrity of Canada's tax system. IA has reviewed management's action plans and concluded that they are adequate and reasonable to address the recommendations. To ensure the complete implementation of these plans, IA plans to conduct a full follow-up audit in 2015-2016.

Action plan:

As part of the action plan, measures have been taken to renew and increase efforts in communicating and promoting standards of integrity at the CRA and to reinforce the Agency's values.

In response to the conclusions presented, HRB has developed an action plan to address outstanding issues outlined in the audit findings. Ongoing work over the last several months has effectively addressed some of the findings requiring action. In particular, internal controls have been implemented to further complement the expected outcome of a consistent application with the administration of discipline. These controls include: identified steps for consultation involving serious misconduct, development of a checklist for labour relations to assist with efficient file management; active review of the delegated managers' decision; identification of concerns to address gaps in a timely manner; development of communication tools; and reporting discipline measures related to serious misconduct on a monthly basis to senior management.

Introduction

Through the administration of tax, benefits, and other programs, the work of Canada Revenue Agency (CRA) employees affects the lives of all Canadians. As public servants, employees are held to a high standard of conduct and are accountable to the public for the way that they conduct themselves. It is by behaving ethically and with good conduct, as prescribed in the Code of Ethics and Conduct and CRA policy instruments, that employees exemplify the CRA's values of integrity, professionalism, respect, and co-operation, and contribute to the public's confidence in the integrity of the CRA.^{Footnote 6}

To maintain the public's trust and to ensure the reputation of the CRA is upheld, the Agency has put in place an Integrity Framework that defines a culture of integrity. Integrity is defined through various instruments that establish standards of conduct for dealing with external and internal stakeholders, and describe what acting with integrity means.

In addition to the Code of Ethics and Conduct, Integrity Framework policy instruments include the Conflict of Interest Policy, Internal Investigations into Alleged or Suspected Employee Misconduct Policy, Monitoring of the Electronic Networks' Usage Policy, Employees' Access to their Own Tax Information and that of their Relatives and Acquaintances Policy and the Gifts, Hospitality and Other Benefits Policy.

The Integrity Framework is intended to enable the Agency to be more consistent, effective, and responsive in meeting two significant responsibilities: fostering the CRA's culture of integrity; and preventing, monitoring, detecting, and managing integrity lapses. Integrity lapses include failures by employees to adhere to CRA policy instruments (i.e. all CRA policies, directives, standards, procedures, and guidelines) that describe the expected standard of conduct for all CRA employees.^{Footnote 7} "The CRA is committed to sustaining a respectful workplace and a culture of integrity. Misconduct will not be tolerated."^{Footnote 8}

It is important for the CRA to maintain a high standard of values and ethical behaviour in order to ensure the public's continued trust and willingness to comply with tax legislation. To preserve the public's trust in CRA and continued compliance with tax legislation, the Discipline Policy and associated disciplinary processes to manage integrity lapses must be fully implemented, communicated, followed, and monitored for efficiency and effectiveness.

Paragraph 51(1) (f) of the Canada Revenue Agency Act authorizes the CRA to establish standards of discipline for its employees and prescribe penalties, including suspension and termination of employment, that may be applied for breaches of discipline or misconduct.^{Footnote 9}

The objectives of the Discipline Policy are:

• to deter employees from engaging in acts of misconduct;
• to have a clear and consistent approach to address employee misconduct; and
• to promote a progressive and corrective approach to discipline as appropriate.^{Footnote 10}

The policy defines the roles and responsibilities of the stakeholders:  

All Assistant Commissioners (ACs) and Regional Assistant Commissioners (RACs)

• Ensure the policy is implemented, monitored and accessible to managers and employees.

The Workplace Relations and Compensation Directorate (WRCD), Human Resources Branch

• Coordinates activities required to monitor and report on the application of the Discipline Policy and the Procedures for Addressing Employee Misconduct;
• Coordinates activities required to monitor and report on incidents of high-risk related to employee misconduct (investigated by Internal Affairs and Fraud Control Division) and associated disciplinary measures in conjunction with the Director General, Security and Internal Affairs Directorate;
• Makes the Discipline Policy accessible to all CRA employees; and
• Coordinates the development of communication and training material for the Discipline Policy.^{Footnote 11}

Integrity and Workplace Relations (IWRD) Division, WRCD

• Central point of contact for labour relations policies and programs, as well as values and ethics. Their activities include providing advice, direction, and recommendations to senior management on the development and maintenance of national labour relations policies and programs that aim to correct inappropriate behaviours through the application of disciplinary measures.

The Internal Affairs and Fraud Control Division (IAFCD), Security and Internal Affairs Directorate (SIAD), Finance and Administration Branch

• Supports the administration of discipline in the CRA by conducting independent, administrative investigations into high-risk allegations or suspicions of employee misconduct. For allegations or suspicions that require a criminal investigation, referrals are made to the police agency having jurisdiction.

It should be noted that from more than 40,000 employees in the CRA, there was a total of 832 Labour Relations (LR) discipline cases over the four fiscal years (2009-2010, 2010-2011, 2011-2012, and 2012-2013), or an average of .5% of the total population for each fiscal year.

Audit objectives

The objectives of this audit were:

1. to assess the extent to which the internal controls in place are efficient, effective and functioning as intended for the consistent administration, application, and reporting (internal and external) of discipline in the CRA;
2. to determine the extent of employee awareness and understanding of discipline and related policies, procedures and recourse and reporting mechanisms; and
3. to assess the extent to which internal affairs investigations process supports the administration of discipline.

Examination activities were conducted from July to September 2013 at select offices in all regions, including Headquarters.

This audit was conducted in accordance with the International Standards for the Professional Practice of Internal Auditing.

Methodology

Comparative analysis was performed against the key findings and responses from the publically available Integrity Survey conducted by KPMG in 2013. The purpose of this analysis was to determine what is in place with respect to values and ethics in the CRA, with particular attention on discipline.

Interviews were conducted with select managers and employees in each region and Headquarters. Participants included union representatives and senior executives. We reviewed investigation files to assess compliance with procedures and standards for completion. In addition, documentation relevant to the administration of the CRA's Discipline Policy was also reviewed.

File selection methodology

The assessment criteria used for audit testing was based on the 2006 Discipline Policy, the 2011 Discipline Policy, the Procedures for Addressing Employee Misconduct, and the Manager's Case File Checklist. To assess the extent of compliance with policy and procedures, file reviews were completed in each region and headquarters on a judgemental, non-statistically valid sample of disciplinary cases for fiscal years 2009-2010 to 2012-2013. A total of 209 out of 832 (25%) LR discipline files were reviewed.

A total of 147 SIAD investigation files were reviewed to assess the extent to which the internal investigations process supported the timely administration of discipline.

Audit testing could not be performed to assess the quality of decision-making, including consistency and adherence to LR advice and recommendations in terms of discipline rendered, as documentation was not sufficiently complete in all files selected, particularly with respect to LR discipline cases.

Appendix A provides additional details on the file review methodology followed to review LR and SIAD files.

Findings, Recommendations, and Action Plans

1.0 Comparative analysis

In 2013, KPMG conducted an independent Integrity Survey with responses from more than 3500 U.S. working adults from 13 industry sectors and 5 thresholds of organizational size. Eleven percent of the Respondents' Industry Classification was from the Government and Public Sector. The information presented in the survey was derived from the experiences and perceptions of the respondents. The survey provides program elements required to guard against risks of fraud and misconduct and on the effectiveness of ethics and compliance programs and related anti-fraud programs and controls.

Internal Audit completed an analysis which compared the Agency Ethics and Compliance Program Element against the key findings and responses in the 2013 KPMG Integrity Survey, focusing on those that relate to the oversight and administration of discipline in an organization.

The aim of the exercise was to determine what is in place, highlight the gaps, and make recommendations for either closing identified gaps or strengthening existing internal controls in place for the management of discipline in the CRA.

A key finding from the publically available Integrity Survey conducted by KPMG in 2013 was that having formal ethics and compliance programs in place continues to make a positive difference. Employees who work in organizations where such programs exist generally reported more favourable results than employees who work in organizations without such programs.

A comparison of the Agency Integrity Framework to the expected elements of a formal ethics and compliance program from the 2013 KPMG Integrity Survey showed that all eight elements are in place in some form at the Agency.

The following chart presents the results from comparing the elements with what is in place at the CRA.

Observations and comments

• Although the existing disclosure line in place for reporting misconduct is confidential, it is not anonymous.
• Compliance with the code of conduct is assessed informally and indirectly on an exception basis such as by annual average number of misconduct cases.
• A formal auditing or monitoring program specific to the Code of Ethics is not in place.

In addition, the 2013 KPMG Integrity Survey found that the "tone at the top" set by senior management is often cited as a determining factor in creating organizational commitment to high ethics and integrity.

In the CRA, management has taken clear actions to show leadership and demonstrates a commitment to comply with behavioural standards to promote an ethical culture. Performance agreements of senior managers include the responsibility for creating and fostering a work environment that reflects the Agency's values through integrity-based leadership and by promoting ethical values.

The CRA has been taking a proactive approach with regards to integrity and integrity related topics. The Commissioner and Assistant Commissioners in the regions and branches communicate regularly with employees through InfoZone and emails to remind them about the CRA values and ethics, with specific references to the Discipline Policy.

An InfoZone website called "Integrity at the CRA" has been created. The website is the central repository with links to all integrity-related policy instruments, tools and guidance from various internal and external sources to the Agency. More importantly, the site includes a section called "CRA Integrity - it starts with me" with a key message that everyone in the Agency has an important role to play to maintain the public's trust in our integrity.

2.0 Program oversight, administration, and management

2.1 Oversight

Program oversight of the management and administration of discipline and associated roles and accountabilities are clearly defined, documented and communicated at the CRA.

The Agency Management Committee (AMC) has oversight responsibility for program development and delivery and for the day-to-day business operations of the Agency. The Human Resources Committee (HRC) provides advice and makes recommendations to AMC on all aspects of human resources management. The Assistant Commissioner (AC) of HRB is a member on both committees.

The Human Resources Branch Policy Committee is a forum to discuss issues surrounding HRB policy instruments. The committee serves as a focal point for providing consolidated HRB feedback on corporate policy instruments, templates and other tools as they are developed by the Agency Secretariat and International Affairs^{Footnote 12} (presently called Corporate Secretariat).

In 2013, a new corporate committee, the Integrity Advisory Committee (IAC), was established. The IAC is responsible for providing advice on Agency issues and initiatives through an integrity lens. Its objective is to facilitate impartial reviews, open discussions, and ethical considerations surrounding the Agency's day-to-day business, including operational and personnel areas.

2.2 Administration and management of the Discipline Policy

HRB has functional responsibility for the administration of the Discipline Policy. HRB reports to AMC on a yearly basis on disciplinary issues and statistics.

Roles and responsibilities for senior management, and all stakeholders are clearly defined and communicated through the Policy and Procedures. While HRB has functional authority over the policy, the administration of the policy is delegated to the ACs and RACs.

The Discipline Policy is part of the Integrity Framework of the CRA. The Policy, the Procedures, and related policy instruments are well developed. It is built on relevant federal legislations and includes information from relevant CRA corporate policies of the Agency, such as the Code of Ethics and Conduct, Conflict of Interest Policy, and Terms and Conditions of Employment in the CRA.

The goals and objectives for the management and administration of discipline are established, clearly documented in the Discipline Policy, and communicated. The Policy is reviewed on a 5-year basis by HRB for continuous process improvement. Changes are made in consultation with and based on feedback from multiple sources that include the unions (PSAC and PIPSC^{Footnote 13}) and regional LR, and reviews of case law and jurisprudence.

In support of the objectives in the Policy, major changes made in June 2011 included:

• Clarifying CRA's approach to addressing misconduct and aligning the policy with other CRA initiatives (e.g. Integrity Framework);
• Promoting a fair, consistent, transparent and timely approach to discipline management; and
• Revising the Table of Suggested Discipline Measures to align with other CRA policy instruments, and to ensure groups are commensurate with the seriousness of the misconduct (including disciplinary demotion as a potential measure).

In 2013, the Policy and Procedures were further revised to include procedures and guidance to support consistency in the application of the table and for required consultation with the HRB AC and/or the RACs when discipline is rendered outside of the table or when resignation is accepted in lieu of discipline.

Although the discipline process is a management responsibility, the discipline procedures stipulate that managers must consult with their LR advisor prior to making the final decision for the appropriate disciplinary measure. In February 2014, HRB informed AMC of the 2013 changes to the Discipline Policy and Procedures and highlighted the expectation for delegated managers to understand their roles and responsibilities and utilize the required procedures and tools that support the Agency's approach to discipline.

2.3 Risk management

In the Corporate Risk Profile (CRP) for 2013-2014, risk #21 states that instances of serious misconduct will occur when the CRA employees do not act with integrity and/or in accordance with the CRA Code of Ethics and Conduct. A risk management process should be in place to ensure that areas of high risk with respect to the administration and management of discipline are identified and managed.

Because HRB conducts risk management on an ad hoc and informal basis, a documented comprehensive risk management exercise has not been undertaken to ensure that results are captured and documented in a systematic manner. Consequently, all high risk areas in regards to employee misconduct may not be identified or known, including anticipating threats from new technological advancements such as social media. Information is not available to enable the Agency to be proactive in putting preventive measures in place to mitigate risks.

Recommendation

HRB should undertake a risk assessment exercise to evaluate risks associated with the management of discipline.

Action Plan

The HRB will be undertaking an appropriate risk assessment exercise in relation to the management of discipline. Completion date: Fall 2014.

During the 2013-2014 fiscal year, several HRB initiatives were completed to foster responsible, ethical behaviour by employees and to mitigate associated risks.

Completed initiatives include the following preventive measures:

• The addition of supplementary wording to all letters of employment regarding the protection of taxpayer and Agency information, which commenced November 1, 2013;
• An information sheet titled "Social Media" what you should know, published in February 2014; and
• A new module in CAS (ESS/MSS) titled "My Commitment", which was launched March 1st, 2014, to better manage and administer filing of conflict of interest confidential disclosure forms and responses to those forms.

3.0 Compliance with policies and procedures

3.1 Policies and procedures support the discipline process

It is recognized that consistency among related policy instruments is a challenge, particularly when needs and expectations vary among numerous stakeholders, policy owners, and administrators with respect to the discipline process.

For managers, the procedures should provide detailed guidance on how to address employee misconduct, how to conduct an investigation, and recommendations for disciplinary measures based on the type and severity. To be effective, definitions and expectations should be clearly defined to facilitate the administration and application of the Discipline Policy.

Documentation review of select policies and procedures revealed that certain policy and procedural elements need clarification and supporting criteria such as:

• In the Monitoring of the Electronic Networks' Usage Policy the meaning of "limited personal use" or parameters for social media is defined but the parameters are not clear.
• The criteria to determine when SIAD will be involved in the investigation (complex versus non-complex cases) are not sufficiently clear.^{Footnote 14}
• Documentation requirements expected from management-led investigations to SIAD as part of the investigation process are not specified.^{Footnote 15}

3.2 Compliance with collective agreements' provisions for employee rights

Notification to attend the disciplinary meeting and hearing

"When an employee is required to attend a meeting, the purpose of which is to conduct a disciplinary hearing concerning him or her, or to render a disciplinary decision concerning him or her, the employee is entitled to have, at his or her request, a union representative attend the meeting. Where practicable, the employee shall receive a minimum of one day's notice (for PSAC)^{Footnote 16} and two days' notice (for PIPSC)^{Footnote 17} of such a meeting."

Based on the file review, the required amount of notice for the employee to attend the disciplinary meeting was given in 140 (67%) of the total 209 cases. In 2 cases (1%), the required amount of notice was not given to the employee. For the remaining 67 cases (32%), we were unable to determine whether there was adherence to this requirement due to lack of documentation.

Discipline letter

"Any document or written statement related to disciplinary action, which may have been placed on the personnel file of an employee, shall be destroyed after two (2) years have elapsed since the disciplinary action was taken, provided that no further disciplinary action has been recorded during this period.^{Footnote 18}"

In 75 (36%) of the total 209 LR discipline files reviewed, a discipline letter should not have been on file as the 2-year time frame had elapsed. Out of these 75 cases, 61 cases (81%) had the Disciplinary Letter removed from the employee personnel file after the appropriate 2-year time frame. In 14 cases (19%), the discipline letters were still on file.

For 117 cases (56%), the 2-year time frame had not yet expired at the time of the file review. For the remaining 17 cases (8%), we were unable to determine whether a discipline letter was actually issued.

3.3 Requirement to consult with LR advisors

The Discipline Policy and Procedures require managers to consult with LR so that the interpretation and application of policies and procedures is consistent within the Agency.

Consultation with LR advisors is not performed or documented on a consistent basis. Regional LR involvement varied from file to file and region to region. In 161 LR discipline files (77%), there was evidence of LR analysis work, while the other 48 LR discipline files (23%) did not have any evidence of LR analysis. Guidelines for LR consultation do not clearly define the documentation requirements.

Managers did not always follow LR recommendations in their discipline decision making. Based on the file review, management tends to render discipline at the lower end of the range even though LR recommendations may be at the higher end of the range. However, managers were still in compliance with the Discipline Policy and Procedures in existence at the time of this audit as these policy instruments allowed for this flexibility.

Recommendations

HRB should clearly communicate expectations as outlined in the Discipline Policy regarding the requirement for LR consultations in discipline cases.

HRB should ensure that LR discipline files clearly document the consultation between the manager and labour relations advisor.

HRB should monitor LR discipline files to ensure and report on adherence to consultation requirements as outlined under Discipline Policy.

Action Plans

The following actions have been completed to address these recommendations.

In June 2013, a consultation requirement process was communicated and implemented within the Procedures for Addressing Employee Misconduct to ensure consistency in the application of disciplinary measures.

In February 2014, communication was sent by HRB to RACs and the LR community to remind them of their roles, their obligations to document and consult, as well as the available tools.

Subsequent to the February 2014 communication, a supplementary checklist for LR Advisors was created to ensure a more consistent approach to file documentation, and with regards to consultation between management and labour relations advisors.

The supplementary checklist, titled Labour Relations' Case File Checklist, is to be formally implemented in April 2014 and is complementary to the Manager's Case File Checklist, available in the Procedures' toolbox since June 2011.

Monitoring of the consultation requirement is included in the improved reporting activities that were implemented as of April 1, 2014 to capture more complete data.

3.4 Documentation

Documentation should be complete and consistent to ensure adequate records management in terms of providing evidence and ensuring that an audit trail is available to demonstrate adherence to the discipline process and procedures. These factors are especially important if legal proceedings ensue. Lack of proper documentation and inadequate audit trails could potentially impact the Agency's ability to be successful if cases proceed to grievance.

Ultimately, adequate records management supports the efficient and effective application of and adherence to the requirements in the CRA Discipline Policy, Procedures, and the Table of Suggested Disciplinary Measures.

For LR discipline files, an Agency-wide standard is not in place to ensure consistency in file documentation and records management. Results from file review indicate that documentation and records management are not adequate and not complete (e.g. undated and unsigned documents, lack of evidence to support communications between management and labour relations), including local management-led investigations work. Out of the 209 LR discipline files reviewed, supporting documentation was not on file for discipline hearings in 34 cases (16%) and discipline meetings in 84 cases (40%). Documentation was adequate in the remaining 91 files (44%).

For SIAD files where the investigations were conducted by SIAD, documentation is adequate. However, documentation requirements for investigations performed by local management are not clearly stated to ensure that both LR and SIAD files contain sufficient information that provides a complete audit trail for all disciplinary cases. Consequently, regions are inconsistent in their approach as to what and how management transmits information regarding their fact-finding and investigation to SIAD. Results from file review showed that information was transmitted in various formats, including formal reports, briefing memos, analysis in emails, or limited to the interview notes or minutes only.

Recommendation

HRB should establish and implement clear national direction for documentation of files in accordance with the nature of the files to ensure that LR files are complete and adequate.

Action Plan

The action plan to address this recommendation has been completed.

A supplementary checklist for Labour Relations Advisors was formally implemented on April 1, 2014 for a more complete file management process.

HRB will remind all regions and Branches to use the existing Manager's case file checklist provided in the Procedures tool kit.

3.5 Compliance with the 30-working day requirement in rendering discipline

"If misconduct is founded, the manager should meet with the employee to render discipline within 30 working days from when the employee received the completed investigation report or was made aware of the facts for which discipline is being rendered. If delays are unavoidable, the delegated manager must inform the employee and the labour relations advisor in writing, of the reason(s) for the delay, and of when a final decision can be expected.^{Footnote 19}"

When employees do not receive fair and timely treatment, the Agency is at risk for increased grievances due to non-compliance with employees' notification rights under the collective agreements and the length of the investigation process.

Results from file review to assess the extent of adherence to these requirements confirmed that the 30-working day requirement to render discipline was not consistently met and rationale for not meeting the requirement was not always documented.

The time frame from the completion of the investigation (misconduct was founded) to the date the employee was notified (discipline was rendered) was within the 30-working day requirement in 146 cases out of 209 (70%).

The time frame from the start of the preliminary disciplinary meeting to the disciplinary hearing with the employee was within 30 working days in 68 cases (32%). A total of 72 cases (35%) took more than 120 working days. The time frame for the remaining 69 cases (33%) was between 30 and 120 working days.

Recommendation

HRB should communicate the importance of meeting the 30-working day requirement and to document the rationale when the requirement is not met.

Action Plan

Actions have been completed to address this recommendation.

In February 2014, communication was sent by HRB to RACs and the Labour Relations (LR) community to remind them of their responsibilities with respect to guiding principles such as timeliness and the importance of documentation.

On April 1, 2014, the supplementary checklist for LR Advisors was formally implemented to track and document rationale when the 30-working days outlined in the procedures is not met.

The 30-working day requirement in the procedures is based on case law outcomes and the principle of reasonableness. The procedures instruct managers and LR to document the rationale for delays. This requirement is also outlined in the Procedures and included in the Guiding Principles (within the Procedures' Toolbox).

4.0 Monitoring, quality review, and reporting

4.1 Monitoring

During the examination phase of this audit, a national monitoring framework was not in place to track and report on progress towards the achievement of goals and objectives of the CRA's Discipline Policy and Procedures. Various quality review efforts (of LR discipline files) were performed at the regional and local management levels. However, national guidelines for quality review were not in place to ensure the activity was performed on a consistent and continuous basis. Informal national monitoring efforts were conducted for the appropriateness of the discipline measures rendered, including the HRB AC's involvement, which was subsequently communicated to senior management through the Discipline Overview for 2011-2012 and 2012-2013. Although a corrective measure template was submitted to WRCD for each discipline rendered, local files did not include evidence that an ongoing review process was in place to test the extent of compliance with the administration of the discipline process in the application of the Discipline Policy and Procedures.

In July 2013, additional rigour was added to the discipline process through revising the discipline procedures. The revisions are expected to enhance the monitoring of the application of discipline. As of February 2014, WRCD commenced the formal development of a monitoring framework for each of its human resources disciplines. The data currently collected to assess the proper application of discipline will form the basis of the framework. The framework data includes:

• employee group, and level, region;
• type and details of misconduct;
• corrective measures taken;
• relevant factors considered (mitigating/aggravating);
• timeliness and delays of discipline process;
• consultation requirements undertaken; and
• associated Internal Investigations.

4.2 Performance measures and reporting

Performance reporting should include data that is meaningful, complete and accurate to support informed decision-making by management at all levels. Currently, reports are not prepared to meet the needs at the regional and operational levels.

To facilitate record keeping and data analysis, HRB LR developed a Discipline Reporting Template (DRT) effective Oct 18, 2011. However, the use of the DRT is inconsistent. In the summer of 2013, modifications were made to the DRT contents, making it more extensive and changed its name to Corrective Measures Reporting template (CMRT).

At the time of this audit, HRB prepares statistical reports for senior management on a regular basis. In addition, a yearly summary by region, branch, category of misconduct, top 10 misconducts, and consequence, is prepared. However, the statistical data is presented with minimal analytical information.

Results from review of reports, such as the Discipline Overview provided to senior management, indicate that the data presented are manually compiled, primarily quantitative, and contain minimal qualitative and analytical information. Automated data capture and reporting solutions are not in place.

Consequently, relevant and sufficient data is missing to enable a full assessment on the effectiveness of the interpretation and application of the CRA's Discipline Policy and Procedures, and the Table of Suggested Disciplinary Measures. Performance reports may not be complete and do not provide sufficient information to tactically support management decision-making with respect to the management and administration of discipline in the Agency.

Although HRB captures key information, reports communicated to management during the audit review period do not include information specific to the quality of decisions made (e.g. inside/outside of the table based on mitigating and aggravating factors or in agreement with LR's advice, etc.). While data monitoring results are reported to AMC, it is not evident that these results are shared with the managers who are administering the policy to enable them to use the information to correct or mitigate risks when they are faced with a disciplinary action.

Recommendations

HRB should develop and communicate a comprehensive set of performance measures to ensure that complete and useful information is available for management decision-making.

HRB should ensure that appropriate and accurate data are captured consistently to enhance data integrity and facilitate analytical efforts for trends and patterns.

Action Plan

The annual Discipline Overview for 2013-2014 that is shared with the Agency Management Committee will include quantitative and qualitative results. Completion date: August 2014.

During 2013, modifications have been completed to HRB's reporting tools. They have been fully implemented as of April 1, 2014. These modifications will enable the collection of more comprehensive data to help facilitate the analytical efforts for trends and patterns.

Also in 2013, HRB strengthened its monitoring approach to build on what was in existence already, i.e. specifically measuring the timeliness of discipline, whether discipline measure was appropriate, and that relevant and sufficient information is captured.

The IWRD has focused on serious misconducts and the related discipline over the last fiscal year, by reviewing whether these cases were grieved, the outcome of each level, and if referred to Adjudication. No adjudication decision has been rendered to date.

On a quarterly basis, HRB shares discipline data, that provides an overview of the management of discipline at the CRA, with the Integrity Advisory Committee.

5.0 Communications

5.1 Communications strategy

A communications strategy should be in place to support the administration and application of discipline in the Agency to ensure that all employees are informed of the CRA's Discipline Policy and Procedures, including the Table of Suggested Disciplinary Measures.

To communicate the changes made in 2011 to the CRA's Discipline Policy and related procedures, HRB developed a strategy that involved several corporate communications such as nationwide broadcast emails from the Commissioner, followed by announcements from the HRB AC. Communications products included presentations to various levels of management and notification to the unions, as well as the e-learning product, "Discipline – What You Should Know".

An integrated communications strategy is in place to provide guidance to employees and ensure awareness to support the administration of discipline. An annual reminder is sent to all employees to acknowledge and sign the Code of Ethics and Conduct. The Code of Ethics and Conduct outlines the expectations of employees and provides information on the discipline consequences of not meeting those expectations.

Communications to the field included the Reference Guide for Labour Relations Advisors in the Workplace Relations Centres of Expertise. In the regions, the RACs have regular email communications and reminders to their regions on integrity and discipline.

Communication initiatives, around the Agency's approach to the management of discipline, have two purposes:

1. to demonstrate that the Agency will not tolerate misconduct and will take appropriate action to uphold the integrity of the Agency; and,
2. to provide examples of lapses of integrity and the seriousness with which the Agency views these lapses.

Understanding the drivers of misconduct, which is a wilful action, would enable the Agency to be more proactive and focused in its communications strategy for integrity. Currently, it appears as though communication is one way only as feedback mechanisms are not in place to assess the efficiency and effectiveness of the communication. Agency-wide surveys or similar methodology is used to collect integrity related data from employees' perspectives. However, integrity-related data collected through the Public Service Employee Survey is very limited and not sufficient for assessment purposes.

Recommendation

HRB should implement feedback mechanisms that will provide the Agency with information from managers' perspectives to assess the effectiveness of planned efforts taken to ensure awareness and understanding with the management of discipline as outlined in the Discipline Policy and Procedures.

Action Plan

HRB will provide, through SRMS (Service Request Management System), the ability for management to provide feedback or seek clarification on the discipline tools and policy instruments. Completion date: April, 2015.

5.2 Communication of guidance and resources

Comments from interviews indicate that InfoZone is the first source of reference for CRA managers and employees when seeking integrity related information such as the Integrity Framework and the CRA Discipline Policy, particularly in the Manager's Corner and the Employee Corner websites.

The Manager's Corner website links to relevant policy instruments such as the CRA's Discipline Policy, the CRA Code of Ethics and Conduct, the Procedures for Addressing Employee Misconduct, and the Manager's Guide to Conducting Internal Investigations.

The Procedures section includes the Manager's Case File Checklist with documentation that should be included in a discipline case file and additional links to resources such as the Terms and Conditions of Employment.

For employees, the information is more limited in regards to discipline as there is no direct link on the main page of Employee Corner to the Integrity Framework, the Discipline Policy, and the Code of Ethics and Conduct. Through the actual Discipline Policy, other discipline related procedures and other tools are accessible. Support and guidance were not evident for employees who are going through the discipline process.

Available training such as the "Discipline – What You Should Know" e-learning product, is not referenced in the Employee Corner website. This specific learning product was designed to help employees understand their obligations regarding discipline. Consequently, employees may not be well informed of their responsibilities with regards to values, ethics, and integrity and how the discipline policy aligns with the overall Integrity Framework in the Agency.

Available mechanisms within the Agency to report or disclose wrongdoing and misconduct, such as the Internal Disclosures Office, are not well known and used. Comments from interviews indicated that employees and managers do not know about the office or have very vague information about its existence, purpose and mandate. The InfoZone website does not prominently display information related to the Internal Disclosures Office.

If employees are not fully aware of all avenues for disclosure, wrongdoing and misconduct may ultimately go unreported.

Recommendation

HRB should ensure that the Employee Corner on InfoZone provides complete and comprehensive reference material and resources on all aspects of discipline including avenues for reporting of misconduct.

Action Plan

Links to relevant policies, procedures, tools will be added on the employee corner as appropriate. Completion date: June 2014.

Currently, links to Internal Disclosures and Internal Affairs and Fraud Control Directorate (IAFCD) are included in the references section of the Procedures' toolbox.

Since the implementation of the "Discipline – What You Should Know" e-learning product in 2011, almost 11,000 employees have taken the course and achieved an 80% or more pass mark. The course also allows employees to provide feedback on the learning activity and its relevance.

6.0 Timeliness of the internal investigation process

6.1 Compliance with the 45- and 120-calendar day standards

SIAD supports the administration of discipline in the CRA by conducting independent, administrative investigations into high-risk allegations or suspicions of employee misconduct. The internal investigations conducted by SIAD has potential impacts on the overall discipline process. Adherence to the established service standards for SIAD-led investigations is particularly important when administrative measures such as leave without pay or removal of system accesses are used.

For the Electronic Networks Monitoring investigations, the expectation is that these types of investigations will be completed "in no more than 45 days. Other, less complex administrative investigations should be completed within 120 days if all parties are available to be interviewed when approached by the investigator. Should an investigation extend beyond the 120-day period, the employee and their manager will be informed in writing every 30 days"^{Footnote 20}.

However, a formal communication protocol between SIAD, HRB and management is not in place to ensure that these standards and requirements are met. Without a communication protocol, responsibilities and accountabilities between SIAD, HRB and management may not be clear, particularly with respect to investigations that are led by either SIAD or local management.

A formal workload prioritization and management process is not evident to ensure that investigation files are selected and completed in a timely manner.

Results from review of SIAD investigation files revealed the 45-calendar day and 120-calendar day standards were not met consistently. In addition, required update notification every 30 days to management (and employees) from SIAD was not always found when investigations went beyond 120 days.

A system is not in place to track aged inventory with respect to SIAD investigations. In some instances, delays such as employee illness are beyond SIAD's control. However, lengthy investigations can be a burden on both the employee as well as the manager, especially if administrative measures have been taken. Lengthy investigations may be used as a mitigating factor for the employee in the grievance process.

120-Day standard

To test the extent of compliance to the 120-day (or 4 months) standard, Internal Audit (IA) tracked the amount of time it took from the initiation date of the investigation to the date that the Final Investigation Report was sent from SIAD to LR, management or the ACs. When the date of initiation could not be identified, the date of SIAD notification was used for this test.

As depicted in chart below, out of a total of 147 SIAD files, 81 were led solely by SIAD. Of these 81 files, 21(35%) were investigated and completed within 0-4 months, 30 (37%) were between 4-12 months, 21 (26%) files were between 12–24 months, and 2 (2%) took longer than 24 months. For joint investigations (i.e. led by SIAD and local management), 12 out of a total of 28 (43%) files were completed within 0-4 months, while 12 (43%) were between 4-12 months. For 4 (14%) files, IA was unable to determine the duration.

45-Day standard

To test the extent of compliance to the 45-day standard for investigations on misconduct for Misuse of Electronic Network, the SIAD investigation files were categorized by type of misconduct.

From the 147 SIAD investigation files reviewed, 34 were misconduct on the Misuse of Electronic Network that were primarily investigated by SIAD. Eleven of the 34 files that involved multiple misconducts were not included in this test as they could be considered as more complex investigations. However, 7 (30%) of the remaining 23 files were completed in less than 45 calendar days and 16 (70%) of the 23 took longer than 45 days.

Recommendations

FAB/SIAD should consult with HRB LR and create a formal communication protocol that outlines roles, responsibilities, and accountabilities.

FAB/SIAD should enforce the standards they have established for completion of investigation files, and monitor and report upon compliance with the standards.

Action Plans

SIAD agrees with the recommendation as it pertains to the creation of a formal communication protocol with HRB to clearly define roles, responsibilities and accountabilities. Completion date: June 2014.

In 2013-2014, the IAFCD and Workplace Relations instituted the practice of having "touch point" conference calls with workplace relations and management at any point in an investigation when a decision is required. The practice has not been formalized in a communication protocol. SIAD will obtain feedback from Workplace Relations on the current practice and formalize a written protocol.

SIAD agrees with the recommendation to enforce standards for the time it takes to complete an internal investigation, and monitor and report upon compliance with these standards.

All changes and approval to policy instruments and IAFCD's Case Management System required to formalize, communicate and report on these standards will be completed by the end of May 2014. Completion date: May 2014

The internal audit report's observation was based on the standards found in the current Manager's Guide to Internal Investigations of 45 days for electronic network monitoring investigations and within 120 days for other types of investigations. In 2013-2014, SIAD drafted a new set of timeliness standards based on the known scope and complexity of an investigation. The AMC was consulted on these standards. Starting in 2014-2015, FAB will be reporting to the Board of Management against these standards.

Conclusion

Integrity is key to the administration of tax, benefits, and other programs to the Canadian public. The confidence and trust of the Canadian public in the CRA has been the cornerstone of Canada's tax system, largely due to the exemplary conduct of its employees.

CRA employees are held to a high standard of conduct and are accountable to all Canadians for their behaviour. It is in the CRA's interest to assist its employees wherever possible to maintain this expected standard.

Throughout the audit, Internal Audit has identified opportunities for improved control, communication and collaboration in the spirit of strengthening the Agency for the benefit of all Canadians.

As a result of the audit findings, recommendations have been made to improve internal control over the consistency, application, and reporting of discipline to strengthen the CRA's response to misconduct and reinforce the message that it will not be tolerated.

In an effort to improve communication of the CRA's message, recommendations have been made to increase awareness and understanding of the well-developed CRA Discipline Policy and related procedures.

In order to improve Internal Affairs' ability to support the administration of discipline, which is to conduct independent administrative investigations into high-risk allegations or suspicions of employee misconduct, Internal Audit recommends improvement in its communications with stakeholders to clarify and improve discipline processes to meet the timelines outlined in policies and procedures.

Management agrees with all the recommendations and has developed action plans to address them.

By addressing the findings from the audit, the Agency will strengthen its commitment to upholding the integrity of Canada's tax system. IA has reviewed management's action plans and concluded that they are adequate and reasonable to address the recommendations. To ensure the complete implementation of these plans, IA plans to conduct a full follow-up audit in 2015-2016.

Appendix A

File selection

The sample chosen was not a statistically valid sample. The full range of misconduct or disciplinary measures reviewed in this engagement would not necessarily have been included by using a statistically valid sample.

The judgement sample was chosen based on criteria including: type of misconduct, seriousness, impact to reputation, involvement from Security and Internal Affairs Division (SIAD), and progressive discipline. The purpose was to cover a wide range of various misconducts and note the management, documentation, and the entire decision making process. The sample selection also included a range of CRA employees at various levels across the five regions.

As a result of a full review by the Human Resources Branch (HRB) in June 2011, the Discipline Policy and the Table of Suggested Disciplinary Measures were modified. Therefore, a four-year sample period was scoped in: 2009-2010, 2010-2011, 2011-2012, and 2012-2013. This range of scope allowed for a variety of discipline cases under the 2006 policy and 2011 policy.

LR discipline files selected for review

Between April 1, 2009 and March 31, 2013, a total of 832 disciplinary measures were rendered in the Canada Revenue Agency. Charts 1 and 2 depict the breakdown of discipline cases by year and by region:

A total of 209 out of 832 (25%) LR discipline files were reviewed, categorized as follows: (Chart 1)

• 75 Unauthorized Access
• 59 Electronic Network Usage
• 53 Fraud and Financial Management
• 13 Behaviour
• 9 Proper Discharge of Duty

The regional breakdown of LR discipline files was as follows: (Chart 2)

• 36 Ontario
• 30 Headquarters (HQ) 
• 35 Pacific (one was a duplicate)
• 36 Prairies
• 36 Atlantic
• 36 Quebec

SIAD investigation files selected for review

For the 147 SIAD investigation files, the breakdown between SIAD led, management led and jointly led investigations are as follows:

• SIAD investigated a total of 81 files
• Local management investigated a total of 38 files (Note: These were not included in audit testing as the focus was on the investigations that involved SIAD.)
• Jointly led investigations totalled 28 files

Chart 3 below depicts the breakdown of the investigation files by region.