2016-17 Management Accountability Framework government-wide report

Multi-year financial planning

Multi-year financial planning is critical in order to proactively manage current and future financial risks an organization may face. Departments and agencies should identify and assess financial risks over a multi-year period as part of their approach to financial planning and budgeting.

Almost all organizations indicated they proactively assessed the multi-year financial risks associated with projected salary expenditures, budgetary changes, revenue fluctuations and funding pressures.

Total adjusted lapse

The amount of lapsed funds at year-end can provide insight into an organization’s planning, budgeting, monitoring, and reporting practices. If an organization regularly lapses amounts less than 2% or greater than 5% of total voted authorities, there may be a need to identify the underlying drivers of the lapses and determine whether action is required.

The amount of funds lapsed at year-end has continued to decline for LDAs, dropping from 6.0% in fiscal year 2012 to 2013 to 2.5% in fiscal year 2015 to 2016. For SDAs, the 2015 to 2016 fiscal year adjusted lapse dropped to 1.5% after being stable at 2.1% for the 2013 to 2014 and 2014 to 2015 fiscal years.

Figure 1 - Text version

Adjusted lapse at year-end as a percentage of annual voted authorities for large departments and agencies was:

• 5.4% in the 2011 to 2012 fiscal year
• 6.0% in the 2012 to 2013 fiscal year
• 3.8% in the 2013 to 2014 fiscal year
• 3.0% in the 2014 to 2015 fiscal year
• 2.5% in the 2015 to 2016 fiscal year

Adjusted lapse at year-end as a percentage of annual voted authorities for small departments and agencies was:

• 3.1% in the 2011 to 2012 fiscal year
• 2.8% in the 2012 to 2013 fiscal year
• 2.1% in the 2013 to 2014 fiscal year
• 2.1% in the 2014 to 2015 fiscal year
• 1.5% in the 2015 to 2016 fiscal year

A further breakdown highlighted the operating adjusted lapse for all organizations assessed: 23 of the 57 organizations assessed reported an operating adjusted lapse of less than 2%, with a 1.4% average for all organizations assessed. These results indicate that departments may have less flexibility in the future to absorb additional pressures to meet operational demands.

Budget allocations

Earlier access to budget enables managers to plan their program and financial implementation effectively. Department or agency managers should have access to their budget within 30 days of the start of the fiscal year.

MAF results suggest that departmental practices vary. While most departments (only LDAs were assessed) allocate budgets within 30 days of the start of the fiscal year, 9 out of 37 LDAs assessed take well beyond 30 days (76 days on average between those 9 organizations) to allocate approved budgets to the lowest-level managers with delegated authorities. Those departments not meeting the 30-day objective should address the issue and strive to significantly improve early access to budgets.

Implementation of a risk-based ongoing monitoring program

There has been a significant improvement in the area of risk-based monitoring, with almost all of the organizations (94%) having put in place an ongoing monitoring program to support the effectiveness of their internal controls over financial reporting in fiscal year 2016 to 2017, compared with less than half (44%) in fiscal year 2014 2015.

Figure 2 - Text version

In 2014, 16 organizations answered “Yes” to whether they had implemented a risk-based ongoing monitoring program, and 20 organizations answered “No.”

In 2015, 27 organizations answered “Yes” to whether they had implemented a risk‑based ongoing monitoring program, and 8 large departments and agencies answered “No.”

In 2016, 32 organizations answered “Yes” to whether they had implemented a risk‑based ongoing monitoring program, and 2 large departments and agencies answered “No.”

Access to salary reports

Organizations should ensure that salary commitments are recorded at the time of expenditure initiation and that delegated managers have ongoing access to salary reports identifying the portion of their salary budget that remains unencumbered.

Managers within all organizations have ongoing access to salary reports that provide information to support staffing decisions. However, the Office of Comptroller General notes that the quality and clarity of the financial information available to managers to support staffing decisions is not consistent government-wide. This directly impacts managers’ ability to understand their salary position, particularly as they move from one department to another.

Outstanding accounts receivable

The outstanding accounts receivable represent debts due to the Crown, excluding debts classified in other sections of the Public Accounts of Canada such as taxes receivable. The Directive on Receivables Management requires that departments recognize and record receivable transactions in departmental accounts and take appropriate, timely and cost-effective collections actions.

Figure 3 - Text version

For large departments and agencies:

In 2015:

• 36% of accounts receivable had been outstanding for 0 to 30 days
• 5% had been outstanding for 31 to 60 days
• 4% had been outstanding for 61 to 90 days
• 10% had been outstanding for 91 to 365 days
• 45% had been outstanding for more than 365 days

In 2015, overall outstanding accounts receivable for large departments and agencies totalled $3.50 billion.

In 2016:

• 44% of accounts receivable had been outstanding for 0 to 30 days
• 2% had been outstanding for 31 to 60 days
• 2% had been outstanding for 61 to 90 days
• 11% had been outstanding for 91 to 365 days
• 41% had been outstanding for more than 365 days

In 2016, overall outstanding accounts receivable for large departments and agencies totalled $4.34 billion.

For SDAs, there has not been much change with regard to outstanding accounts more than 365 days, from 17% in 2015 to 19% in 2016. Although the overall amounts are higher for LDAs, it trended down in 2016.

Overall, while noting the increased focus among organizations on the management of accounts receivable, there is still $1.8 billion of non-tax accounts receivable outstanding over 365 days. Further improvements are still required in this area.

Figure 4 - Text version

For small departments and agencies:

In 2015:

• 59% of accounts receivable had been outstanding for 0 to 30 days
• 2% had been outstanding for 31 to 60 days
• 1% had been outstanding for 61 to 90 days
• 20% had been outstanding for 91 to 365 days
• 17% had been outstanding for more than 365 days

Overall outstanding accounts receivable for small departments and agencies totalled $0.09 billion.

In 2016:

• 60% of accounts receivable had been outstanding for 0 to 30 days
• 2% had been outstanding for 31 to 60 days
• 1% had been outstanding for 61 to 90 days
• 18% had been outstanding for 91 to 365 days
• 19% had been outstanding for more than 365 days

Overall outstanding accounts receivable for small departments and agencies totalled $0.09 billion.

Diversity and inclusion

The Employment Equity Act requires employers to monitor and, where necessary, enhance the representativeness of its workforce for the four designated groups: women, Aboriginal peoples, persons with disabilities, and visible minorities. Workforce availability estimates allow federal organizations to compare the representation of the employment equity designated groups in their organizations with the workforce availability by designated group in the labour pool from which they can recruit.

For federal public service purposes, workforce availability is based on the population of Canadians who are active in the workforce and work in those occupations that correspond to the occupations in the public service. The estimates are derived from the 2011 National Household Survey and the 2012 Canadian Survey on Disability.

Overall, most organizations meet the legislative requirements of the Employment Equity Act in terms of the representation of women, Aboriginal peoples and persons with disabilities. Representation and recruitment levels for women and Aboriginal peoples exceed their availability in the labour force in over 72% of the assessed 34 LDAs and 18 SDAs. These results are consistent with last year’s findings. Representation levels for persons with disabilities exceed their availability in the labour force in 82% of the LDAs assessed, while their recruitment levels exceeds their availability in the labour force in only 39% of the LDAs.

Representation levels for members of a visible minority group exceed their availability in the labour market in only 50% of the LDAs, while their recruitment levels exceed their availability in the labour market in 59% of LDAs. In SDAs, representation levels for members of a visible minority group meet or exceed their availability in the labour market in only 44% of organizations, while their recruitment levels exceed their availability in the labour market in 60% of organizations.

Respectful workplace and prevention of harassment

Departments and agencies are expected to foster a respectful workplace free of harassment and discrimination by ensuring that preventive activities are in place. Overall, organizations have mechanisms in place to foster a respectful work culture free of harassment and discrimination.

Almost all of the LDAs (97% of LDAs assessed) and SDAs (94% of SDAs assessed) conduct department-wide activities to foster a respectful workplace such as workshops, information sessions or group discussions. The vast majority of organizations report offering leadership training to develop accountability and foster an ethical culture and mandate training for employees on harassment prevention and/or respectful communication.

In addition, most organizations reported ensuring easily accessible mechanisms for reporting and resolving incidents of harassment or discrimination.

Official languages

Organizations are expected to create, reflect and maintain a work environment that is conducive to the use of both official languages and in which employees are encouraged to use the official languages of their choice in the workplace. Employees play a vital role in fulfilling their organization’s official language obligations when providing services to or communicating with the public or employees. The organization’s leaders lead by example and promote this objective. The measures on official languages provide an indication of the extent to which departments and agencies meet the requirements of the Policy on Official Languages.

In 48 out of the 52 LDAs and SDAs that were assessed, linguistic profiles of positions reflect the duties of employees and obligations with respect to the public in 70% or more of the cases. In addition, in 98% of organization assessed, oral communications occur in the official language chosen by the public in over 70% of cases. Written communications occur in the official language chosen by the public in over 70% of the cases for all organizations assessed.

Of the 34 LDAs and 18 SDAs assessed, 79% and 70% of executives occupying a designated bilingual position have second language evaluation results that are not expired, respectively.

Workplace health

The average number of paid sick days per full-time equivalent is a key metric that provides useful information for the management of sick leave in the federal public service and the development of workplace and wellness strategies in the workplace. The average number of paid sick days has declined slightly for SDAs (10.9 in 2014, 10.8 in 2015 and 10.3 in 2016), and for LDAs over the 3-year cycle (11.5 in 2014, 11.6 in 2015 and 11.3 in 2016). However, there remains a great variation in paid sick leave usage across organizations depending on their size, mandate and nature of operations.

Figure 5 - Text version

In 2014, the average number of paid certified and paid uncertified sick days per full-time equivalent for large departments and agencies was 4.2 days and 7.3 days, respectively. For small departments and agencies, the average number of paid certified and paid uncertified sick days per full-time equivalent was 3.7 days and 7.2 days, respectively.

In 2015, the average number of paid certified and paid uncertified sick days per full-time equivalent for large departments and agencies was 4.2 days and 7.4 days, respectively. For small departments and agencies, the average number of paid certified and paid uncertified sick days per full-time equivalent was 3.7 days and 7.1 days, respectively.

In 2016, the average number of paid certified and paid uncertified sick days per full-time equivalent for large departments and agencies was 4.1 days and 7.2 days, respectively. For small departments and agencies, the average number of paid certified and paid uncertified sick days per full-time equivalent was 3.8 days and 6.5 days, respectively.

The public service must show leadership in building a healthy, respectful and supportive work environment where concrete actions are taken to support open and stigma-free dialogues on mental health.

In support of open and stigma-free dialogues on mental health in the workplace, organizations have undertaken a number of activities, such as the development of an action plan on mental health, and the appointment of a champion for mental health. Organizations are educating and equipping managers, supervisors and occupational health and safety committee members to manage issues related to mental health. In addition, organizations are offering awareness sessions to employees on mental health and health support services available.

Time to staff an AS-01 and EX-01

The time to staff measure represents the average number of days elapsed between the day the human resources division was contacted to initiate the staffing action and the day the letter of offer was issued for staffing of positions.

Figure 6 - Text version

In 2015:

For large departments and agencies, the average number of days taken to staff indeterminately a vacant position using an internal hiring process at the AS-01 level was 45.6 days. For large departments and agencies, the average number of days taken to staff indeterminately a vacant position using an internal hiring process at the EX-01 level was 64.8 days.

In 2016:

For large departments and agencies, the average number of days taken to staff indeterminately a vacant position using an internal hiring process at the AS-01 level was 55.8 days. For large departments and agencies, the average number of days taken to staff indeterminately a vacant position using an internal hiring process at the EX-01 level was 61.3 days.

Average time to staff an AS-01 position is 56 days within LDAs, an increase from 46 days in cycle 2015 to 2016. This is largely due to 2 organizations with 167 and 434 days. Removing these 2 departments, the average time becomes 39 days in 2016. Average time to staff an EX-01 position is 61 days within LDAs, a decrease from 65 days in cycle 2015 to 2016. Performance on time to staff these positions continues to vary broadly across organizations. Number of days should be consistent with or lower than the previous year’s results. Departments are encouraged to staff positions as efficiently as possible without delays.

Use of existing pools

This measure is an indicator of the effectiveness of collective staffing. For the purpose of this measure, appointments from pools include pools from the department, other government departments, public service-wide pools and partially assessed inventories.

In 2016, 380 individuals were appointed from existing pools to an indeterminate position across the LDAs assessed. The total number of indeterminate appointments was 705 within the same year. 51% of the indeterminate appointments were from the existing pools.

Generic job descriptions

Generic and standardized work descriptions can assist departments and agencies in reducing the time and effort required to write, classify, and update work descriptions; simplify recruitment, staffing, career development, and learning efforts; facilitate mobility within an occupational group. Departments and agencies are expected to implement departmental and interdepartmental standardized job descriptions wherever possible, using unique job descriptions only on an exceptional basis.

Of the 34 LDAs and 18 SDAs assessed, 76% and 68%, respectively, had a generic or standardized job description. 2016-17 was the baseline year for these 2 indicators: use of existing pools and generic job descriptions.

Recordkeeping maturity

Departments are required to perform regular disposition activities for all information resources. The percentage of planned disposition completed is an indicator of an organization’s maturity in the management of its information resources. Although 91% of LDAs have an IM plan, recordkeeping maturity continues to be a challenge 2 years after the deadline to comply with the Directive on Recordkeeping.

Of the 60 organizations assessed, the level of compliance is 77% and is comparable to last year’s results.

Paper records management maturity remains on solid foundation. Since fiscal year 2015 to 2016, the percentage of planned paper disposition completion rates has increased from 43% to 51% for LDAs and from 34% to 42% for SDAs. There is also a slight decrease in paper holdings in LDAs.

By comparison, the government is creating more electronic information but is not managing it as well. In 2016, only 19% of LDAs and 29% of SDAs planned disposition for electronic information resources were completed, which is a slight increase from the 2015 figures (16% and 22%, respectively).

Figure 7 - Text version

In 2014, the average current level of recordkeeping maturity for large departments and agencies and small departments and agencies was 59.6% and 57.5%, respectively. In 2015, the average level of maturity for large departments and agencies and small departments and agencies was 75.1% and 72.3%, respectively. In 2016, the average level of maturity for large departments and agencies and small departments and agencies was 77.2% and 76.4%, respectively.

The average percentage of unstructured electronic information resources that were managed in designated corporate repositories for large departments and agencies was 23.7% in 2014, 11.5% in 2015 and 13.3% in 2016.

The average percentage of planned disposition for electronic information resources completed in 2014 was 14.5% for large departments and agencies and 21.9% for small departments and agencies. In 2015, the average for large departments and agencies was 16.0%, and the average for small departments and agencies was 21.6%. In 2016, the average for large departments and agencies was 18.7%, and the average for small departments and agencies was 29.2%.

Designated corporate repositories

Designated corporate repositories, such as GCDOCS, support departmental recordkeeping requirements throughout the information life cycle. The Directive on Recordkeeping requires that departments identify, establish, implement and maintain repositories in which information resources of business value are stored or preserved in a physical or electronic storage space. The percentage of unstructured electronic information resources maintained in designated corporate repositories is a government-wide performance measure for the IM internal service.

Of the 37 LDAs, over half of them (19) are saving less than 10% of their information in a corporate repository and 82% of total information is saved outside of a corporate repository. Over 60% of LDAs and 48% of SDAs did not undertake any planned electronic disposition during the 3 years of MAF.

The low volume of information in a designated corporate repository and low disposition rates could lead to risks for the government. Risks include the inability to respond to requirements under the Access to Information Act or under the Privacy Act, or to respond to litigation in a timely manner; decreased productivity; increased cost to manage information; and increased difficulties to protect information.

IT stewardship

Effective practices for IT stewardship include maintaining and implementing departmental IT plans, management of IT expenditures and application portfolio management.

Overall, the majority of LDAs (93%) have demonstrated that they have effective IT planning documents in place. This will result in the ability to prioritize demand for Shared Services Canada services.

Figure 10 - Text version

In 2014, 25 large departments and agencies answered “Yes” and 12 answered “No” to whether they had a sustainability plan for all mission-critical applications in the submitted Information Technology Plan.

In 2015, 27 large departments and agencies answered “Yes” and 5 answered “No” to whether they had a sustainability plan for all mission-critical applications in the submitted Information Technology Plan, while 5 large departments and agencies answered “Not Applicable.”

In 2016, 29 large departments and agencies answered “Yes” and 4 answered “No” to whether they had a sustainability plan for all mission-critical applications in the submitted Information Technology Plan, while 4 large departments and agencies answered “Not Applicable.”

Of the 37 LDAs assessed, 36 have provided an annual IT plan. All 37 of the LDAs provided an annual IT expenditure report and an inventory of all applications. In 2016, 29 organizations provided a sustainability plan within their IT plan, while 4 organizations had not provided a sustainability plan and an additional 4 organizations had no mission-critical applications in place, therefore they were not applicable to be assessed on this particular indicator. Of the 37 LDAs assessed, 32 had provided an end-of-life retirement plan within their IT plan.

IT program or service enablement

Regular reporting on the status of IT-enabled projects to the appropriate internal governance bodies supports oversight, effective decision-making and successful execution of projects.

Departments have generally done well in reporting the status of IT-enabled projects over the last 2 years, with fiscal year 2016 to 2017 being the second year for the assessment of this practice. In the 2016 to 2017 fiscal year, 32 of the 37 LDAs assessed had projects with an estimated cost of $1 million or more to which the Standard for Project Complexity and Risk applied. Based on the evidence provided for a sample of their projects, they have demonstrated that they provided the status of key IT-enabled project elements to appropriate internal governance bodies on a regular basis. Five LDAs did not have projects subject to the Standard for Project Complexity and Risk, therefore the assessment of their reporting practice did not apply for fiscal year 2016 to 2017.

The Policy on Acceptable Network and Device Use requires deputy heads to ensure that authorized individuals have open access to the internet, including Government of Canada and external Web 2.0 tools and services that enhance productivity, communication and collaboration.

The majority of the organizations have regularly informed authorized individuals of expectations for acceptable use, electronic network monitoring projects being applied and the consequences for unacceptable use of Government of Canada electronic networks and devices.

Service performance

Service performance measurement gives an indication of how well IT services are meeting the needs of programs and clients. Below are 2 service performance indicators for IT: mean repair times and incident resolution rates.

Mean time to repair for workplace technology device related incidents

Organizations should strive for short times to resolve workplace technology device related incidents. There is a broad range of mean repair times reported by LDAs, ranging from 1 hour to 293 hours, with an average mean time of 52 hours. In 2015, the average was 57 hours, therefore, departments are showing some improvement, although the range is still very broad from department to department.

Figure 11 - Text version

The mean time to repair workplace devices was 56.6 days in 2015 and 51.5 days in 2016. The percentage of incidents resolved by 1st-level support was 50.0 in 2015 and 60.9 in 2016.

Percentage of incidents resolved by 1st-level support for workplace technology device related incidents

Organizations should strive to have a high percentage of incidents resolved by 1st-level support for workplace technology device related incidents. In 2016, on average, 61% of such incidents are resolved by 1st-level support, which is an 11-percentage-point increase from 2015.

Application portfolio health

A continual evaluation of the health of applications in departments’ portfolios, based on the risk level and the criticality of the applications is essential to guard against aging IT. Over half of departments assessed have an application portfolio health index below the departmental average of 23%, indicating many legacy applications require investment by departments.

Reporting on procurement obligations

Departments are expected to report on their procurement obligations in a timely and accurate manner. This includes the Procurement Strategy for Aboriginal Business, Comprehensive Land Claim Agreements, Proactive Disclosure and the Purchasing Activity Report.

Some challenges still remain in the area of procurement reporting. While there has been improvement in timely reporting of the Purchasing Activity Report, many departments still struggle to submit their reports for Comprehensive Land Claim Agreements and the Procurement Strategy for Aboriginal Business.

Service standards have been flagged as an important issue both by departments and by Treasury Board of Canada Secretariat officials. Ensuring that reasonable service standards are in place and are met is an essential component of sound procurement practices.

In 2016, 7 organizations reported their procurement obligations in a timely and accurate manner, which is a slight increase from 2014 and 2015.

Procurement service standards continue to be a challenge government-wide. Of the 10 departments assessed, 6 have internal service standards in place and have measured results against the standard.

Figure 16 - Text version

In both 2014 and 2015, 6 large departments and agencies answered “Yes” to whether they report in a timely and accurate manner on their procurement obligations, while 4 large departments and agencies answered “No.” In 2016, 7 large departments and agencies answered “Yes” to whether they report in a timely and accurate manner on their procurement obligations, while 3 large departments and agencies answered “No.”

Contracts over $25 thousand awarded through a competitive bidding process

The Government Contracts Regulations require a competitive approach to soliciting bids before any contract is entered into, with certain exceptions (for example, contracts under $25 thousand). A best practice is for organizations to have the majority of contracts over $25 thousand awarded through a competitive bidding process. The percentage of all departmental contracts over $25 thousand awarded through a competitive bidding process is a government-wide performance indicator for the Acquisition Services internal service.

In 2016, 83% of all department or agency contracts over $25 thousand were awarded through a competitive bidding process, which is comparable to 2015 results.

Low-dollar acquisitions (under $10 thousand) using acquisition cards

The Directive on Acquisition Cards aims to reduce or eliminate costly and inefficient procurement transaction and payment methods such as the use of Receiver General cheques, requisitions and purchase orders. Accordingly, departments should strive to have the majority of acquisitions under $10 thousand carried out using acquisition cards as a procurement instrument.

In 2016, 55% of department or agency low-dollar acquisitions (under $10 thousand) were carried out using acquisition cards, which is slightly lower than the 2015 average of 58%. In addition, departments range from 6% to 92% in using acquisition cards for contracts valued at $10 thousand or less. Two departments are at 90% and above while 2 departments are under 20%.

Contracts that used mandatory and non-mandatory standing offers

The Treasury Board Contracts Directive prescribes the requirement for the mandatory use of certain standing offers. A best practice is to issue call-ups against standing offers, as frequently as possible, given that this approach promotes transparent and efficient processes. The percentage of all departmental contracts that used mandatory and non-mandatory standing offers is also a government-wide performance measure for the Acquisition Services internal service.

In 2016, 23% of all department or agency contracts used mandatory and non-mandatory standing offers, which is comparable to 2015 results at 26%. Departmental results ranged from 3% to 51%.

Information technology security

The Operational Security Standard: Management of Information Technology Security requires departments to continuously manage the IT security risks to information and IT assets throughout the life of their programs and services.

The formal authorization of applications through which critical services of a department or agency are delivered, as well as vulnerability assessments for IT systems and applications, are key IT security practices which can reduce department or agency risk exposure.

The government-wide average of mission critical applications currently in operation that have been authorized has increased from 52% in fiscal year 2014 to 2015 to 69% in 2015 to 2016, and 81% in 2016 to 2017.

Among the 20 LDAs with a risk remediation plan for mission critical applications operating under conditions, an average of 28% of remediation conditions have been met. Overall maturity tracking progress of remediation plans and activities is weak with 7 of 19 organizations not tracking progress.

Figure 19 - Text version

In the 2014 to 2015 fiscal year, 51.6% of mission-critical applications currently in operation have been authorized for operation. In the 2015 to 2016 fiscal year, 69.4% of mission critical applications currently in operation have been authorized for operation. In the 2016 to 2017 fiscal year, 81.0% of mission-critical applications currently in operation have been authorized for operation.

Physical security

The Operational Security Standard on Physical Security requires that the external and internal environments of a facility be managed to create conditions that, together with specific physical security controls, reduce the risk of workplace violence, protect against unauthorized access, detect attempted or actual unauthorized access and activate an effective response.

Security assessments provide an understanding of the effectiveness of security controls at mitigating risks and serve as the basis for establishing action plans for strengthening the physical security posture within an organization and across the Government of Canada.

Among the assessed LDAs, the percentage of facilities that have an up-to-date security assessment has increased by 12 percentage points from 2015 to 2016. As well, the percentage of facilities with material residual security deficiencies that have an approved and funded risk mitigation plan has increased over the 3 years by 14 percentage points. While this demonstrates positive increasing performance trends, the government-wide performance level remains low and below performance expectations.

Figure 20 - Text version

In the 2015 to 2016 fiscal year, on average, 53.4% of the large departments’ and agencies’ facilities have an up-to-date security assessment. In the 2016 to 2017 fiscal year, on average, 65.3% of the large departments’ and agencies’ facilities have an up-to-date security assessment.

Figure 21 - Text version

In the 2014 to 2015 fiscal year, on average 52.2% of the large departments’ and agencies’ facilities with material residual security deficiencies have an approved and funded (where required) risk mitigation action plan. In the 2015 to 2016 fiscal year, on average, 65.1% of the large departments’ and agencies’ facilities with material residual security deficiencies have an approved and funded (where required) risk mitigation action plan. In the 2016 to 2017 fiscal year, on average, 66.4% of the large departments’ and agencies’ facilities with material residual security deficiencies have an approved and funded (where required) risk mitigation action plan.

Business continuity planning

The Operational Security Standard: Business Continuity Planning Program requires departments to establish a business continuity planning program to provide for the continued availability of services and associated resources that are critical to the health, safety, security or economic well-being of Canadians, or the effective functioning of government.

Business continuity planning practices continue to be a strong area of performance government-wide. Seventeen out of the 20 LDAs reported that all critical services have a business continuity plan in place, and where the majority of business continuity plans were last updated in the 2016 to 2017 fiscal year. Of the critical services with a business continuity plan, the average across the LDAs is 84% that have been tested or exercised, which is a 7-percentage-point increase since the 2015 to 2016 fiscal year. Fifteen out of the 20 LDAs assessed review their business continuity planning on a cyclical basis.

Canada’s Cyber Security Strategy

The Government of Canada’s Cyber Security Event Management Plan outlines the stakeholders and actions required to ensure that cyber security events are addressed in a consistent, coordinated and timely fashion government-wide.

Departments have demonstrated effective records and tracking of cyber security incidents, including tracking when cyber security incidents have been reported to the Government of Canada Computer Incident Response Team. This practice enables the team to optimally support the departments during cyber incidents and supports the Government of Canada’s ability to conduct an enterprise response to cyber security incidents.

Federating identity

The objectives of the Directive on Identity Management are to manage risk, to protect program integrity, and to ensure consistency of experience when delivering an external service to a client. The mandatory use of the external credential management service (GCKey or Commercial Broker Service) provides a consistent, standardized solution that supports these objectives while enabling clients to use their credential of choice to securely access external online services provided by the Government of Canada, reducing cyber security risk.

Completion of assurance level assessments for online external services to clients increased by 22 percentage points between the 2015 to 2016 and the 2016 to 2017 fiscal years. While online external services are being assessed for identity and credential risk, there is still low implementation of the mandatory service for single secure login (username and password) for Government of Canada clients, which increased only moderately over the last 3 years from 31% in 2014 to 47% in 2016.

Figure 22 - Text version

In the 2015 to 2016 fiscal year, on average, 57.7% of the large departments’ and agencies’ online external services that require client authentication have a completed assurance level assessment. In the 2016 to 2017 fiscal year, on average, 80.4% of the large departments’ and agencies’ online external services that require client authentication have a completed assurance level assessment.

Figure 23 - Text version

In the 2014 to 2015 fiscal year, on average, 30.5% of the large departments’ and agencies’ online external services require a client to sign-in with a username and password. In the 2015 to 2016 fiscal year, on average, 42.5% of the large departments’ and agencies’ online external services require a client to sign-in with a username and password. In the 2016 to 2017 fiscal year, on average, 46.6% of the large departments’ and agencies’ online external services require a client to sign-in with a username and password.