Annex to the statement of management responsibility including internal control over financial reporting Treasury Board of Canada Secretariat Fiscal Year 2017–18

1. Introduction

This document provides a summary of the measures taken by the Treasury Board of Canada Secretariat (the Secretariat) to maintain an effective system of internal control over financial reporting (ICFR), which includes information on internal control management, assessment results and related action plans.

Detailed information on the Secretariat’s authority, mandate and programs can be found in its most recent Departmental Plan and Departmental Results Report.

2. Departmental system of internal control over financial reporting

3. Departmental assessment results during 2017–18

The Secretariat reached the ongoing monitoring stage in 2015–16 upon completing its first full assessment of the whole departmental system of ICFR. Since then, the Secretariat has been performing rotational ongoing monitoring activities in accordance with approved plans while concurrently addressing any new remediation required in response to ongoing monitoring activities. In 2017–18, all activities were carried out as planned.

Table 1 summarizes the status of ongoing monitoring activities carried out by the Secretariat for its corporate business processes, according to the previous year’s rotational plan. A similar summary of the Secretariat’s ongoing monitoring activities as a common service provider is provided in section 5.

In addition to the progress made in 2017–18 on ongoing monitoring activities as detailed in section 3.2, the Secretariat also made the following improvements to its control framework: 

• The Secretariat uses a common SAP financial system that is part of the Central Agency Cluster Shared Systems (CAC-SS) administered by the Office of the Comptroller General on behalf of cluster departments. An external audit of IT General Controls (ITGC) for this common financial system was conducted by Ernst and Young in 2017–18 in accordance with the Canadian Standard on Assurance Engagements for Reporting on Controls at a Service Organization, as set out by the CPA Canada Handbook – Assurance. This audit covered only ITGCs that are common to all cluster departments; it did not cover department-specific controls because CAC-SS departments separately assess the ITGCs that they are individually responsible for as part of their own ongoing monitoring plans (see section 3.2). Similarly, Shared Services Canada (SSC) provides network and infrastructure management services for the CAC-SS, and the ITGCs associated with these services were also not covered in this audit because they are assessed separately by SSC as a common service provider. The audit identified control deficiencies related to change management, user access and operations management, and the business process owner has developed an action plan for remediation.
• The Internal Audit and Evaluation Bureau (IAEB) initiated a department-wide fraud risk assessment, including a review of roles and responsibilities related to governance for fraud-related administrative investigations. This assessment has involved consultations with stakeholders from across the Secretariat, including functional experts from program areas and internal services (for example, Finance, Human Resources, Security, Procurement and IT). The assessment is raising awareness and renewing emphasis on the importance of managing fraud risks effectively. The assessment is expected to be completed by fall 2018.
• In response to a 2016–17 IAEB audit of Low-Dollar-Value (LDV) Contracting, the Secretariat established and implemented a three-year management action plan that will enhance the oversight and performance measurement of LDV contracting. This action plan was in addition to activities undertaken in 2016–17 and reported in that year’s Annex to the Statement of Management Responsibility Including Internal Control Over Financial Reporting.
• In 2017–18, IAEB completed a targeted review of contracting to assess higher-risk transactions based primarily on data analysis. The review concluded that there were no significant issues (for example, potential contract splitting or payments exceeding contracted amounts). It noted, however, some data integrity and information management issues, similar to those found in the 2016–17 LDV audit. Because a whole-of-contracting view was taken in addressing the issues identified in the LDV audit, no additional recommendations were made as a result of this review of higher-risk transactions.
• The Secretariat continued to enhance risk information provided to senior decision makers. Specifically, the Secretariat revised the template for presentations to the Resourcing Committee and drafted related guidance for presenters. The revised template and the new guidance will increase the quantity and quality of the risk information that the committee receives for decisions on Treasury Board submissions, projects and forecasts.
• In response to a coordinated audit of IT security conducted by the internal audit groups of the Secretariat and SSC in 2016–17, controls over the management of departmental IT security were further strengthened by implementing a responsibilities matrix to clarify Secretariat and SSC accountabilities. In addition, the Secretariat launched the My Profile self-service application in March 2018; this new application is a more efficient way to manage user accounts and access permissions.
• New functionality for valuated goods receipt and for service entry sheets was implemented in SAP, the Secretariat’s financial system. This functionality will help the Secretariat better align our practices with accrual accounting requirements, improve financial reporting, and strengthen internal control by recognizing expenses when goods are received and services are rendered (as opposed to when invoices are paid).

The key findings and significant adjustments required from the current year’s assessment activities are summarized in sections 3.1 and 3.2.

4. Departmental action plan for the next fiscal year and subsequent years

The Secretariat’s rotational ongoing monitoring plan for the next three years, presented in Table 2, is based on an annual validation of the assessed level of risk related to the Secretariat’s corporate financial processes and controls, with adjustments to the ongoing monitoring plan as required. The Secretariat’s activities related to ICFR are carried out under the direction of the Chief Financial Officer. The ongoing monitoring activities that the Secretariat carries out in its capacity as a common service provider are reported separately in section 5.

The new Policy on Financial Management puts greater emphasis on the importance of internal control over financial management (ICFM). Although the policy contains no specific new monitoring or reporting requirements in relation to ICFM, departments are encouraged to incorporate ICFM into their internal control activities. The Office of the Comptroller General is developing guidance to help departments do this. The Secretariat already regularly assesses several key ICFM activities under its ongoing monitoring plan, specifically, the business processes related to budgeting, forecasting, financial reporting and the financial closing cycle.

The Secretariat has also added salary overpayments to the ongoing monitoring plan as a new sub-activity under the Revenues and Accounts Receivable business process to strengthen the Secretariat’s control framework and provide additional assurance with respect to pay-related activities. The Revenues and Accounts Receivable business process will be assessed as part of ongoing monitoring activities in 2018–19.

5. Common service providers annual assessment results during 2017–18

The new Treasury Board Policy on Financial Management came into effect on April 1, 2017. The policy strengthens the management of the Government of Canada’s financial resources.

With the introduction of the new Policy on Financial Management, the Policy on Internal Control (PIC) was rescinded and existing policy requirements from the PIC were incorporated into the new policy. Most changes to the internal control requirements related to the definition of key stakeholder responsibilities and the clarification of assurances provided by chief financial officers with respect to internal control over financial reporting (ICFR) and internal control over financial management (ICFM).

In addition to these changes, the Policy on Financial Management introduced a new requirement for common service providers to report, in their annual Annex to the Statement of Management Responsibility Including Internal Control Over Financial Reporting, the results of their assessment of common services as part of their annual assessment of the departmental system of internal control.

The Secretariat provides common services related to the administration of public service insurance plans (TBS Vote 20) and administration of the cost-recovery process for statutory employee benefit plans (EBP). Because the Secretariat manages government-wide funds and public service employer payments, other government departments and agencies rely on the Secretariat to process transactions that impact their financial statements with respect to the insurance, employee benefits and statutory pay-related transactions outlined in Table 3.

Key business processes related to the provision of these common services are included in the Secretariat’s rotational ongoing monitoring plan. In accordance with the Policy on Financial Management, the Secretariat assesses its departmental system of internal control over a rolling five-year period and conducts an annual risk-based assessment of individual business processes. Therefore, the internal controls for all common services are assessed at least once every five years, with the frequency of assessment determined according to the risk level assessed for each. The Secretariat assesses risk for each business process annually and adjusts the risk rating and assessment schedule accordingly.

In delivering these common services, the Secretariat uses data produced by federal pay systems, including Phoenix which is centrally administered by PSPC. Significant interdependencies exist between PSPC’s and the Secretariat’s pay administration processes because many of the key controls related to the processing of insurance premiums, employee benefits and other pay-related transactions are automated in the pay system. Although the Secretariat carries out ongoing monitoring activities for controls that are under its responsibility, it must rely on the PSPC control environment for assurance as to the integrity of the data it uses in delivering common services. Compensating controls are also in place to mitigate risk, and the Secretariat is working with PSPC to strengthen the control environment as pay administration processes continue to evolve. Readers may refer to the Annex of PSPC for a greater understanding of their control environment related to the central administration of pay.

In 2017–18, the Secretariat, as a common service provider, completed a risk-based assessment of internal controls related to these services. Specifically, it reassessed, with the assistance of Ernst & Young, the operational effectiveness of financial controls for the Public Service Management Insurance Plan and Provincial Payroll Taxes as part of its rotational ongoing monitoring plan. During the period examined, all of the tested key controls were found to be operating as designed, and no new deficiencies or remediation activities were identified. These positive results are due, in large part, to the formalization and documentation of key control activities. The Secretariat will continue to work with PSPC to strengthen the internal controls associated with these business processes. 

In addition to the Secretariat’s ongoing monitoring activities, a new process was implemented in 2017–18 to strengthen controls related to the administration of payments for employer contributions to the Public Service Pension Plan. This new process was developed in consultation with internal and external stakeholders, including PSPC, to enhance oversight on charges to the Public Service Pension Plan.