Annex to the Statement of Management Responsibility Including Internal Control Over Financial Reporting Treasury Board of Canada Secretariat Fiscal Year 2021–22

2.1 Internal control management

The Secretariat has a well‑established governance and accountability structure to support departmental assessment efforts and oversight of its system of internal control. This structure is formalized in the Secretariat’s Framework for Internal Controls Over Financial Management, approved by the Secretary, and includes the following:

• organizational accountability structures as they relate to internal control management to support sound financial management, including the roles and responsibilities of senior managers in their areas of responsibility for internal control management
• a Values and Ethics Office, which provides educational and awareness programs and has developed a departmental code of conduct
• ongoing communication and training on statutory requirements, policies, and procedures for sound financial management and control
• monitoring of, and regular updates on, internal control management, as well as the provision of related assessment results and action plans to departmental senior management and the Secretariat’s Audit Committee

The Audit Committee is an independent and objective advisory committee to the Secretary. It is responsible for providing advice to the Secretary on the adequacy and functioning of the Secretariat’s risk management, control and governance frameworks and processes.

2.2 Service arrangements relevant to financial statements

The Secretariat relies on other organizations for the processing of certain transactions that are recorded in its financial statements as follows.

Common service arrangements

• Public Services and Procurement Canada (PSPC) centrally administers the payment of salaries and the procurement of goods and services in accordance with the Secretariat’s Delegation of Authority and provides real property services.
• The Department of Justice Canada provides legal services to the Secretariat.
• Shared Services Canada provides information technology (IT) infrastructure services to the Secretariat, such as data centres and network services.
• The Secretariat, a central agency, provides services related to insurance plans for federal public service employees and centrally administers payment of the employer’s share of contributions to statutory employee benefit plans (the Public Service Pension Plan, Employment Insurance (EI) Plan, Canada Pension Plan or Québec Pension Plan (CPP/QPP), and the Supplementary Death Benefit Plan) on behalf of other departments and agencies.

Readers of this Annex may refer to the annexes of the above-noted organizations for a greater understanding of the systems of ICFR related to these services.

The Secretariat relies on other external service providers and departments for the processing of certain transactions or information that are recorded in its financial statements as follows.

3.1 New or significantly amended key controls

Currently, TBS is transitioning to a hybrid work model as the employees continue to work remotely. The transition to hybrid requires TBS to strengthen its control framework related the stewardship of IT asset management. The design and operational effectiveness testing of this process are expected to be completed in the late fall 2022. Furthermore, the hybrid work model will likely to have an impact on other business processes such as operating expenses and accounts payable. The internal control unit is planning to undertake a detailed risk assessment to determine the impact of the hybrid model on other TBS business processes in the fall 2022.

3.2 Ongoing monitoring program

As part of its rotational ongoing monitoring plan, the Secretariat completed its reassessment of the financial controls related to the departmental Entity Level Controls, IT General Controls, the Public Service Health Care Plan, the Public Service Dental Care Plan, the Pensioners’ Dental Services Plan, and TBS Vote 20 - Program Administration Costs. For the most part, the key controls that were tested performed as intended, with remediation (where required) as follows:

ELCs

• Ensure that TBS Code of Conduct reflects the future of work environment (e.g., hybrid work model).

IT Assets Tracking

• The initial phase of the assessment indicates the existing IT assets tracking process requires an overhaul and an automated tool to manage the IT assets and office furniture effectively; the assessment is expected to be completed in the fall 2022.

Departmental ITGC

• A process be formalized and monitored to provide assurance that accesses to Cognos BI will be removed in a timely manner following the employee’s departure.
• A process be formalized and documented to periodically review user access (e.g., annually, at minimum) to determine whether current access, and access privileges are appropriate.
• Management performs a review of existing system roles to ensure that privileged access granted to only authorized users.

TBS Vote 20 – Program Administration Costs

• The process for the salary calculation and performance pay associated with Vote 20 should be documented.
• The breakdown for FTEs chargeability to Vote 20 should be revised once there are changes to salaries.
• Update the Charging guidelines to reflect the current practice of establishing the materiality.

Public Service Health and Dental Care Plans

• No remedial action needed - key controls were found to be operating effectively during the period examined.

Pensioners’ Dental Services Plan

• Develop a tracking sheet to monitor expected adjustments from the other government departments (OGDs) to ensure that all revenues owed to TBS by OGDs are received.
• An action plan addressing the remediation described above is underway.
• The Secretariat also completed a risk assessment in fiscal year 2021–22 using an environmental scan. The results of the risk assessment were used to update the Secretariat’s risk-based ongoing monitoring plan (see sections 4 and 6).