Audit of Internal Controls over Data-Sharing Agreements

Strategic direction and oversight

Strategic direction and an oversight framework with respect to the management and handling of DSAs are in place at the Corporate and Operational level.

Corporate direction and oversight is provided by the Security Coordination Committee. It reviews all proposals for electronic transmissions before final approval by the Policy Committee. The newly formed Electronic File Transfer Dissemination Governance Committee, created by the Dissemination Division in the summer of 2012 provides strategic direction at the operational level. It has the mandate to establish consistent standards for all incoming and outgoing confidential data and to approve the release of survey data covered by a DSA. The committee has been active in approving the release of survey data since 2012.

Roles and Responsibilities

Information Management Division and Other Stakeholders

The primary responsibility for the implementation of the Directive resides with the Director, Information Management Division (IMD). Other stakeholders' responsibilities are also listed in the Directive such as those for directors of statistical programs, physical and IT security managers, Assistant Chief Statisticians, the Chief Statistician, the Chief Audit Executive, as well as heads of organizations receiving data from Statistics Canada under a DSA. The monitoring function is to be shared between IMD and the managers of statistical programs.

The audit revealed that, while many of the responsibilities outlined in the Directive have been implemented by IMD, there are certain sections that have not yet been implemented nor enforced. IMD's current Data Access and Control Services (DACS) database has limited capacity, configuration and reporting functionality to maintain the information required to be provided by the divisions regarding the status of DSAs and data shared under a DSA. Failure to implement and enforce the requirements stipulated in the Directive results in increased risk of not meeting the Directive's objective and expected results.

Statistical Programs

Roles and responsibilities for the operational implementation and management of sections 11 and 12 data-sharing agreements reside with the directors of statistical programs. Section 6.2 and Appendices B and C of the Directive describe in detail the requirements and processes that must be followed by the Director and Operational Manager of a statistical program. Therefore, it is the responsibility of each director to ensure that their divisions comply with the requirements of the Directive. In establishing roles and responsibilities related to the preparation of statistical information, Statistics Canada's Quality Guidelines recommends that certification or validation should be segregated such that validation is completed by individuals who did not take part in the production or preparation of the data.

Interviews revealed that each division has created its own structure based on the size of the division and the volume of DSA activity. In divisions with low DSA activity, only one or two people perform all tasks related to the management of DSAs and the dissemination and transmission of data; while divisions with higher volumes of DSA activity have several employees involved. Some divisions with higher volumes of DSA activity have a decentralized process where each unit within the division performs its own management, dissemination and data transmission functions; while other divisions have elected to centralize these functions within the division to promote efficiency and consistency.

The audit revealed that, regardless of the size or structure of the division or the volume of DSA activity, the roles of the employees involved with DSAs have evolved over time more so than being formally defined and, for the most part, these roles are being adequately performed. However, a lack of segregation of incompatible functions exists within some divisions. Whether a division has centralized or decentralized DSA functions, there were instances where the same employee was preparing and transmitting a share file with no independent verification and approval. Segregation of duties is a key internal control to prevent unintentional errors and ensure timely detection of errors that may occur.

Information Technology

The IT group's main responsibility with respect to the management of DSAs is the secure transmission of data via the Electronic File Transfer (e-FT) service which is the corporate system used by Statistics Canada for the transmission of protected information. The requirements of the users of the e-FT system are outlined in a guide called the e-File Transfer Service – STC Internal User Guide (the Guide). Due to the technical nature of the guide, it is not maintained on the intranet site and is distributed mainly to divisions that have had e-FT training. Due to time constraints and an increased demand for the e-FT services, not all divisions have received training on e-FT.

The audit revealed that, while the roles and responsibilities of the users of the e-FT system are outlined in the Guide, the roles and responsibilities of the Collection Systems Division (CoSD), the Collection Planning and Management Division (CPMD), and the Information Technology Operations Division (ITOD) require some clarification. Interviews revealed that corporately, there is lack of clarity regarding the official business ownership of the e-FT system, including the training function. Over the last two years, certain services had been transferred from CoSD to CPMD, and other services such as service delivery and training that were planned to be transferred had not yet been transferred.

The lack of clarity surrounding the e-FT service process has resulted in an inconsistent e-FT service model to the statistical programs. Some programs are not yet set-up with e-FT service and some of them had concerns about the time-consuming nature and complexity of the e-FT service set-up process. At the time of the audit, CoSD and CPMD were planning to have meetings to determine a course of action. A lack of clarity with respect to the business ownership of the e-FT service process results in users not fully understanding their duties and leads to ineffective or inefficient processes being applied.

Guidance for management of data-sharing agreements

At Statistics Canada, guidance and direction for handling and managing data-sharing agreements are contained in numerous legislative and policy instruments. Specifically:

• The Directive on Data Sharing under Sections 11 and 12 which provides guidance on the development, implementation, and management and monitoring of data-sharing agreements.
• The Statistics Act, Privacy Act, Policy on Privacy Impact Assessments, Policy on Informing Survey Respondents, Policy on Security of Sensitive Statistical Information, IT Security Policy, Policy on Micro-Data Release, Policy on Discretionary Disclosure, and The Security Practices manual which provide guidance on DSA confidentiality compliance; and dissemination and transmission requirements.
• The Policy on Official Release outlines the timing and the conditions under which information can be released to the public in relation to the date specified in The Daily, Statistics Canada's official release vehicle, as well as circumstances under which information can be released prior to the official release date in The Daily.

The audit found that users have difficulty following and piecing together the information contained in the numerous policy instruments. Sometimes, guidance in the numerous policy instruments overlaps, without clearly indicating which policy instrument overrides the others. This combined with lack of clarity arising from legal and undefined terminology has created operational inefficiencies because users are frequently seeking clarification from subject matter divisions i.e. IMD, IT, Communication and Dissemination. For example, a review of the Directive effective May 15th, 2013 revealed that it did not include a section on the recent changes regarding the April 1, 2013 implementation of 2 new forms: Form 1 – Acknowledgement of Transfer by Directors, which is to be signed by the Director of a statistical program each time that information is to be shared with a partner; and Form 2 – Acknowledgement of Transfer by External Partners, which is to be signed by the sharing partner and returned to Statistics Canada upon receipt of data shared. Interviews revealed that users had only recently become aware of the new forms and most of them stated that either they had or would be contacting IMD for clarification and more information on these new requirements.

There is awareness of the Directive and the Policy on Official Release but not familiarity with all of their contents. Users expressed concerns about the limited training on the DSA process and on the requirements of the Directive and Policy on Official Release. A pilot training session on 'Disclosure controls for confidential information' was delivered by IMD in the summer of 2013 to select groups (at the director level) and plans are under way to deliver this training to divisions starting in the fall of 2013. Communications division has also scheduled information sessions in October 2013 for all Statistics Canada staff on the updated Policy on Official Release.

Documented processes and procedures for the management of DSAs

Each division has established its own practices, depending on their respective needs and which, for the most part, are functioning well. For some divisions, data transmission under a DSA occurs infrequently, such as only once a year, every two years or, in one case, every 10 years. In these cases, management and staff indicated that they normally rely heavily on IMD and or IT to assist them with the required steps to follow. Other divisions transmit data on a regular basis such as quarterly, monthly, or even weekly. Generally, these employees, particularly those who had been in their positions for many years, indicated that they are quite familiar with the process and, therefore, they would not require documented processes.

Manufacturing and Energy Division (MED) which has a large volume of DSAs has developed thorough documented processes and procedures. It has centralized the dissemination section to create an ongoing capacity, including trained and experienced staff. They have created an Excel document that is stored on a share drive outlining the specific procedures related to different types of data-sharing under various forms of DSAs. This mechanism helps the subject matter expert to easily consult procedures and inform the partner up-front what can and cannot be shared, thereby promoting a better relationship with the partner.

A summary worksheet outlines the rules and requirements for each type of DSA (i.e. Section 11, 12, 12+) and for Work-in-Progress (WIP) or other advance releases. It also includes hyperlinks to other worksheets, outlining specific rules for each situation.

Separate worksheets are used to maintain an inventory of DSAs for MED surveys by year, and an inventory of MED WIPs by year and ongoing, or for a one-time status. A checklist called Encryption Request Checklist has been developed for completion by the Analyst before it is submitted to the Dissemination section to request the encryption and e-FT of the data to the partner. The Dissemination section handles the e-FT and maintains a data encryption log to meet the requirements of the Directive. A Procedures-File Transmission document provides detailed steps on how to prepare a file for transmission, complete with print screen illustrations using Entrust for encrypting and password protecting the files and the steps to follow to prepare and share data files either via e-FT or CD.

Clearly documented processes and procedures would help statistical programs to establish consistent practices for the management of DSAs and the dissemination and transmission of confidential data. Documented processes are particularly helpful when staff turnover occurs, and would reduce divisions' heavy reliance on IT and IMD when data transmissions are few and far between, making the processes more efficient. Statistical programs that have not documented their own processes, could consider developing their own by leveraging and adapting MED's documented processes and procedures to meet their program's respective needs and practices.

Monitoring activities

The Statistical Agreements, Legislation and Licensing (SALL) section of IMD has the functional responsibility for the management of the DSAs under sections 11 and 12 of Statistics Act and to account for the legal authorizations provided by the Chief Statistician for the collection and release of confidential information. Statistical program areas rely on SALL to maintain an inventory of their data-sharing agreements and to provide them the information they need to manage their responsibilities related to DSAs.

SALL uses the Data Access and Control Services (DACS) database to keep an inventory of all currently valid data-sharing agreements signed by Statistics Canada under sections 11 and 12.

The audit noted that an inventory of all valid DSAs under sections 11 and 12 signed by Statistics Canada at a given point in time was not available; and ongoing review and comparison of the information in the database with actual existing DSAs does not occur. IMD has received approval for the renewal of the DACS database through Statistics Canada's Long Term-Planning process. The renewal initiative will start in April 2014.

Appendix C of the Directive on Monitoring of Data-sharing Agreements outlines the responsibilities related to the monitoring of compliance with DSAs to ensure that due diligence and legal requirements are met, particularly with respect to the protection of confidentiality and respondent information. The Directive states that IMD and managers of statistical programs have shared responsibilities for the monitoring of DSAs. Section 6.1.10 and Appendix B provides steps to follow for the amendment, renewal or termination of an existing DSA under s.12 and outlines the responsibilities for monitoring the term limits of DSAs and informing program managers of agreements nearing the termination date (at least every 6 months).

The audit revealed that 317 out of 495 (64%) DSAs under section 12 are not active but the data shared under these DSAs is still in the custody of the share partners, and are considered 'active' from a legal standpoint. These DSA templates did not have a finite termination period, compared to DSAs using the new template (as of 2010) which specify a termination period of 6 years. Two divisions account for the majority of these DSAs. Interviews with the directors of these divisions revealed that they were not aware of the large number of old DSAs in their divisions, or of the status of these DSAs, and were not clear about what is expected of them regarding the management and the ongoing review of the status of the DSAs, or how to proceed with that duty.

The audit concluded that there is a lack of monitoring and ongoing review of the status of the DSAs. This increases the risk of failure to detect confidentiality breaches in relation to the DSA legislative and policy requirements and failure to implement timely and effective corrective measures.

Recommendations:

The Assistant Chief Statistician Analytical Studies, Methodology and Statistical Infrastructure should ensure that:

• Segregation of duties related to the preparation and approval of data for transmission is in place, where practical.
• All governance instruments related to the management and application of DSAs are cross-referenced and indicate which policy overrides others when there are overlaps, to ensure a consistent understanding and efficient application of DSA requirements.
• The current inventory for DSAs under section 12 is assessed for continued relevance; and the Directive requirements related to sharing of information, monitoring and ongoing review of the status of DSAs occurs on a regular basis in compliance with the Directive on Data Sharing under Sections 11 and 12.

Management Response:

Management agrees with the recommendations.

• The Director of IMD will provide data sharing programs with guidelines and requirements on managing DSAs including segregation of duties where practical, in the context of managing data sharing agreements. Directors of programs with DSAs will be responsible to ensure implementation.
  
  Deliverables and Timeline: DSA toolkit will be developed. This will be completed by March 2014.
• The Director of IMD will conduct a review of relevant governance instruments to ensure clarity of language and to establish precedence as required.
  
  Deliverables and Timeline: Updates to Statistics Canada Policy Suite as well as the DSA toolkit. This will be completed by December 2014.
• The Director of IMD will establish and implement a process for regular and ongoing review of Section 12 DSAs and implement changes to Data Access Control System (DACS) to facilitate review, monitoring and assessment.
  
  Deliverables and Timeline: Implement process for regular and ongoing review of Section 12 DSAs. This will be completed by January 2014. Implement changes to Data Access Control System (DACS). This will be completed by December 2015.

Recommendations:

The Assistant Chief Statistician Census, Operations and Communications should ensure that:

• Governance related to the electronic file transmission service is clarified.

Management Response:

Management agrees with the recommendations.

• The Directive on the Transmission of Protected Information will be strengthened and communicated to all Agency managers by the Director of Dissemination Division and Director of IMD.
  
  Deliverables and Timeline: Update to the Directive on the Transmission of Protected Information. This will be completed by December 31, 2013.
• All exemptions from using the e-FT service will now be approved by the Security Coordination Committee
  
  Deliverables and Timeline: Security Coordination Committee will develop a communication strategy to inform Agency managers on the changes to the Directive on the Transmission of Protected Information and the process to seek exemption. This will be completed by January 2014.

Objective 2: The Agency's Data Sharing Agreements are internally managed to comply with relevant TBS policies, Statistics Canada policies, and legislative requirements.

Practices for Management of the Data Sharing Agreements

The audit tested a sample of 42 out of 557 (7.5%) data-sharing agreement data files shared in fiscal years 2011-12 and 2012-13 to:

1. Verify if the information transmitted was in accordance to the DSA and the survey template.
2. The data transmission date and time did not precede the Official Release date and time.
3. The recipient information matched the contact information; and
4. The method and level of security to transmit the data files followed an Agency approved method.

Data files were randomly and judgmentally selected from 8 divisions out of 17 in Field 5, and 5 divisions out of 9 in Field 8.

Content of share file complies with the DSA and the Survey template

The audit reviewed the data sets for the 42 data files shared in fiscal years 2011-12 and 2012-13 to the data-sharing agreement and the survey template covered by the DSA. The audit confirmed that for all of the 42 data files, the share partner, survey information, reference period and contents of the share files were valid and in compliance with the DSA and the survey template.

Compliance with the Policy on Official Release

The audit assessed if the 42 data files shared in fiscal years 2011-12 and 2012-13 were compliant to the Official Release policy. The audit found that 38 out of 42 files were final releases and confirmed through interviews and documentation review that the date and time of transmission of these files was after the official release date and time in The Daily. 4 out of 38 files were shared prior to official release. The audit confirmed that the conditions, types of arrangements and submission forms of the 4 files were valid and in compliance with the Official Release Policy.

Transmission and data protection

The audit verified the method of transmission and level of security used to transmit the data files to external partners. The audit noted that 8 out of 12 divisions that were included in our testing, are set-up for transmission via electronic file transmission (e-FT), although some statistical programs are still using CDs and DVDs because either the program or the external partner are still not set-up for transmission by e-FT. The audit also noted that the method of encryption and password protection by the programs is Entrust. The audit confirmed that 40 out of 42 files were encrypted and password protected before they were transmitted to the external partners, but 2 of the data files transmitted by CDs had not been encrypted and password protected. The audit also noted that there was no proof of delivery for 3 CDs that were hand delivered. In Statistics Canada's Security Practices Manual, Chapter 2 a "record of delivery" is required.

Data custodian

The Directive on Data Sharing under Sections 11 and 12 notes that the Data custodian is the person who receives the share files from Statistics Canada and has operational responsibility within the organization for the security of the information in these files. Statistical programs are required to update any changes to the contact information at the receiving party on an annual basis. For the 42 data files shared in fiscal years 2011-12 and 2012-13 the audit verified if the recipient name to whom the data file was transmitted was the same as the official contact information. Through documentation review and interviews, the audit confirmed that for 41 out of 42 data files, the recipient name to whom the data file was transmitted was the same as the official contact information. The recipient information for one of the files could not be confirmed as all coordination and confirmation for delivery was done by phone.

Practices for the management of data-sharing agreements are in place and overall, statistical programs are compliant with the relevant TBS policies, Statistics Canada policies, and legislative requirements.

Recommendations:

The Assistant Chief Statistician Analytical Studies, Methodology and Statistical Infrastructure should ensure that:

• Information transmitted by portable storage devices has the appropriate security in place for secure transmission and complies with applicable policies.

Management Response:

Management agrees with the recommendations.

• The Director of IMD will ensure information on security practices for transmission of data, as defined by departmental IT security policies and directives is replicated in DSA toolkit.
  
  Deliverables and Timeline: DSA toolkit will be developed. This will be completed by March 2014.