Key compliance attribute for the Policy on Internal Audit: technical bulletin 2018

Purpose: The Key Compliance Attributes are published in accordance with the Office of the Comptroller General of Canada (OCG) Technical Bulletin 2018-1: Policy on Internal Audit:

• A.2.2.3 Departments must meet public reporting requirements as prescribed by the Comptroller General of Canada and using Treasury Board of Canada Secretariat prescribed platforms, including:
  • A.2.2.3.1 Performance results for the internal audit function; and
  • A.2.2.3.2 A list of planned audit engagements for the coming fiscal year.

Requirement: The Technical Bulletin outlines information to facilitate compliance with the requirements set in the Policy and Directive on Internal Audit. This bulletin applies to departments and agencies subject to the Treasury Board Policy on Internal Audit. Starting in the 2018-19 fiscal year, compliance attributes are to be published by departments beginning no later than the end of the first quarter (June 30th).

Key compliance attributes

Performance indicators	Key compliance attribute	2017-18	2018-19 (Q1)	Internal audit comments (if necessary)	Definitions
Do internal auditors in departments have the training required to do the job effectively? Are multidisciplinary teams in place to address diverse risk?	Number of IA employees	26	26	The number of current full-time equivalent positions.	N/A
	% of staff with an internal audit or accounting designation (Certified Internal Auditor (CIA), Charter Professional Accountant (CPA))	50%	54%	N/A	N/A
	% of staff with an internal audit or accounting designation (CIA, CPA) in progress.	35%	31%	N/A	In progress: the staff member (an indeterminate employee) has formally registered with and has been accepted by the certifying body to complete the requirements of the professional designation in a prescribed time frame and has registered for at least one component of the certification process.
	% of staff holding other designations (CGAP, CISA, etc)	19%	23%	Several staff with CPA and/or CIAs also held other designations (CISA, CGAP, CFE, CRMA, CEP).	N/A
Is internal audit work performed in conformance with the international standards for the profession of internal audit as required by Treasury Board policy?	Date of last comprehensive briefing to the Departmental Audit Committee on the internal processes, tools, and information considered necessary to evaluate conformance with the IIA Code of Ethics and the Standards and the results of the quality assurance and improvement program (QAIP).	April 2017	May 2018	2016-17 result was reported in April 2017 to the SDAC. 2017-18 result was reported in May 2018 to the SDAC.	Last comprehensive briefing: A comprehensive briefing includes updates on all pertinent elements of the QAIP. In accordance with IIA Standard 1320, this comprehensive briefing would include: the scope and frequency of both the internal and external assessments the qualifications and independence of the assessor(s) or assessment team, including potential conflicts of interest conclusions of assessors corrective action plans External assessments (practice inspections) must be conducted at least once every five years by a qualified, independent assessor or assessment team from outside the organization.
	Date of last external assessment.	GCAC- December 2013 SDAC- January 2014	N/A	2018-2019 is next external assessment GCAC (Government of Canada Audit Committee) SDAC (Small Departments Audit Committee)
Is internal audit credible and adding value in support of the mandate and strategic objectives of the organization?	Average overall usefulness rating from senior management (ADM-level or equivalent) of areas audited.	Good	N/A	No audit was finished during the 2018-19 Q1	Average “overall usefulness” rating: Post-audit surveys to senior management of the area audited should include a question on the overall usefulness of the audit. For all audits approved in the applicable fiscal year.

2018-19 Internal audit status

Internal audit title	Audit status	Report approved date	Report published date	Original planned MAP completion date	MAP implementation status
This requirement applies only to internal audits that will begin in the 2018-19 fiscal year and after. Departments have the option, as applicable, to include a statement to the effect that “additions and adjustments to the internal audits listed in the Departmental Plan may have occurred in order to address emerging risks and priorities of the organization”. Going forward, audits from past fiscal years will remain listed in the table until 100% MAP implementation is achieved. Audit engagements will remain listed on the site for a minimum six-month period after 100% implementation has been achieved and published.
Horizontal Internal Audit of Information Technology Security in Large and Small Departments Phase II	In-progress	TBD	TBD	TBD	TBD
Horizontal Internal Audit of Project Management in Large and Small Departments	In-progress	TBD	TBD	TBD	TBD
Horizontal Internal Audit of Regulatory Compliance and Enforcement Frameworks in Large and Small Departments	Planned	N/A	N/A	N/A	N/A
Horizontal Internal Audit of Information Decision Making in Large and Small Departments	Planned	N/A	N/A	N/A	N/A
Horizontal Internal Audit of Departmental Performance Measurement in Large and Small Departments	Planned	N/A	N/A	N/A	N/A
Horizontal Internal Audit of Human Resource Planning in Large and Small Departments	Planned	N/A	N/A	N/A	N/A
Core Control Audit: Administrative Tribunals Support Services of Canada Phase I	In-progress	TBD	TBD	TBD	TBD
Core Control Audit: Administrative Tribunals Support Services of Canada Phase II	Planned	N/A	N/A	N/A	N/A