Audit of Financial Management and Reporting

The PIC strategy is periodically updated though an annual review process

During the previous audit of Key Financial Controls, there were a number of circumstances in which the testing schedule was not being followed. To ensure continued relevance of the strategy, the Internal Audit Division recommended that the PIC strategy be periodically updated and validated by the CFO and Chief Statistician.

The PIC team has implemented an annual review process. The testing strategy to assess compensatory controls is determined by reviewing business processes to ensure that planned system changes are identified. The annual review process is driven by the PIC team; Business Process Owners (BPOs) are consulted and are provided the opportunity to communicate any planned system changes. The impact of system changes on internal controls are then assessed by the PIC team through the annual review process. Once the annual review of business processes is completed, the PIC team will review and discuss the impact of system changes identified, and determine if the testing plan requires adjustment.

The 2015-2019 ICFR Risk Based Testing Plan replaces the PIC Strategy. It is updated annually, can be further adjusted as required, and is based on the assessment of results, changes and the impact of remediation actions.

The PIC Team's revised approach is effective in ensuring its PIC strategy is periodically updated.

Compensatory controls in place during process and system changes are considered for testing as part of providing ongoing assurance on ICFR

The previous audit of Key Financial Controls recommended that compensatory controls in place during process and system changes are considered for testing as part of providing ongoing assurance on ICFR.

In 2013-14, the PIC Team tested compensatory controls for all processes where testing had been postponed due to upcoming system changes. These processes were: Capital Assets, Salary Reconciliations for Payroll and Benefits, Operating Expenditures and Revenues.

The PIC Team's testing results showed that all compensatory controls were operating effectively with the exception of Payroll and Benefits. These results have been communicated to the appropriate business owners. As a result of the review and update of all ICFR business processes by the PIC team during 2013-14, no additional testing of controls were postponed due to system changes.

On the premise that process controls must continue to exist and be effective before and after changes are made and that in most cases, process controls and control objectives do not change even when accountability or tools are changing, the PIC team's approach going forward will be to follow the testing plan schedule, and not postpone testing. Should key controls become ineffective due to major systems changes, then the decision can be made to postpone regular testing and test compensatory controls. This will ensure that testing of compensatory controls is limited to instances where regular controls are no longer effective.

The PIC Team's revised approach ensures that compensatory controls in place during process and system changes will be considered for testing as part of providing ongoing assurance on ICFR.

The implementation of remediation actions are validated by the PIC team in a timely fashion

In the past, the PIC Team gathered information on the status of implementation of remediation actions through enquiry to the BPOs. The PIC team uses remediation follow-up templates to monitor the progress of the implementation of remediation plans. BPOs are asked to provide an update on the status of remediation plans to the PIC team on a quarterly basis in order to update the follow-up template.

The business process reviews conducted in 2013-14, and the annual review process described in the 2015-2019 ICFR Risk Based Testing Plan, combined with the assessment of PIC issues discussed during PIC team meetings is adequate to ensure that evidence of the implementation of remediation actions are gathered and documented, and that the adequacy of remediation actions are evaluated by the PIC team within a 12-month testing cycle.

The implementation of the PIC Steering Committee is an effective governance and oversight tool, and a leading practice

The new Guideline for PIC requires that internal controls be managed through formal oversight and effective governance, including regular reporting to senior management, the deputy head and the DAC.

During 2013-14, the Financial Reporting Division (FRD) created the PIC Steering Committee. Three meetings have been held as of January 2014. Roles and responsibilities of the PIC Steering Committee have been established and approved at the July 15th, 2013 meeting. Membership includes DGs that oversee areas where process controls are included and tested as part of the PIC framework. The purpose of the Committee is to inform members of proposed changes to the testing strategy and the progress made in various areas of PIC. The expected outcome of this new committee is to increase awareness and buy-in from BPOs' of the importance of PIC.

PIC Committee members receive information on the status of the PIC annual process, and propose changes to the testing plan. They are also reminded of the importance of the timely completion of remediation actions during meetings.

The implementation of a PIC Steering Committee is an effective means to ensure that issues are reported and dealt with at the appropriate level of management, and can be considered a leading practice.

Unresolved remediation actions from prior years' testing should be included in the current year's annex

In the past, information presented in the Annex to the Statement of Management Responsibility including Internal Control over Financial Reporting did not specifically outline the nature of the work that was required to achieve audit readiness, as it pertained to outstanding remediation items. The Internal Audit Division made a recommendation to ensure that the Annex clearly communicate the areas requiring corrective actions in order to achieve the state of audit readiness, and areas where assurance was not attained for any given period.

The information outlined in the 2012/13 Annex to the Statement of Management Responsibility including ICFR follows the template included in the new Guideline for the PIC. However, information pertaining to unresolved remediation actions from prior years' testing has not been disclosed in the current year's Annex.

The template provided in the new Guideline for PIC does not specifically address cases where control weaknesses remain unresolved for periods over 12 months. The core of the Guideline states that once the first full assessment has been completed, the department's Annex should reflect the ongoing monitoring stage; in the section pertaining to Status of Assessment, the Guideline requires information on plans to conduct the assessment work where remediation is to be completed in the years to follow.

Reporting annually on control weaknesses that remain unresolved for periods exceeding 12-months will encourage prompt corrective action and ensure they continue to be brought to senior management's attention.

Recommendation:

The Assistant Chief Statistician of Corporate Services (and CFO) should ensure that:

• The information regarding incomplete or pending remediation actions that had been disclosed in the Annex to the Statement of Management Responsibility including ICFR of previous years continue to be disclosed in the Annex in future years until remediation is completed.

Management Response:

Management agrees with the recommendations.

• The Director, Financial Reporting Division will ensure all pending items from prior years are resolved in a timely manner, using the PIC Steering Committee to ensure rigorous follow-ups, and will disclose remaining remediation actions from previous years in the Annex.
  
  Deliverables and Timeline: Incomplete or pending remediation actions from previous years will be disclosed in the 2013-14 Annex to the Statement of Management Responsibility including ICFR which will be presented to the Chief Financial Officer, the Chief Statistician and the Departmental Audit Committee. This Annex will then be published with the Departmental Performance Report and Financial Statements on Statistics Canada's website, by November 2014.

Objective 2: To assess the adequacy/effectiveness of examination and oversight activities undertaken within the Finance Branch in support of the CFO's attestation for Cabinet Submissions.

New Guideline for CFO Attestation

The Treasury Board Secretariat has issued a new Guideline on CFO Attestation for Cabinet Submissions (the Guideline), effective January 1, 2014. The purpose of this guideline is to provide a framework and practical guidance for the CFOs in the due diligence review and attestation they provide on the financial management aspects of Cabinet submissions.

As the accounting officer for the department, the Chief Statistician is ultimately responsible for the development and preparation of submissions, and for obtaining the sponsoring minister's sign-off. Both the CFO and senior departmental managers play important roles in developing the submission and in supporting due diligence and attestation. The CFO has a dual role of providing financial expertise to client-programs, and providing objective and independent advice to the Deputy Head.

The CFO's challenge and attestation role is based on corporate financial stewardship and as an objective strategic business adviser on matters such as risk management, the examination of financial options and cost containment.

Six fundamental assertions have been identified to characterize the elements of attestation and to convey the CFO's attestation conclusions in support of decision making. The CFO assertions¹ are as follows:

1. The nature and extent of the proposal is reasonably described and material assumptions having a bearing on the associated financial requirements have been disclosed and are supported.
2. Significant risks having a bearing on the financial requirements, the sensitivity of the financial requirements to changes in key assumptions, and the related risk-mitigation strategies have been disclosed.
3. Financial resource requirements have been disclosed and are consistent with the assumptions stated in the proposal, and options to contain costs have been considered.
4. Funding has been identified and is sufficient to address the financial requirements for the expected duration of the proposal.
5. The proposal is compliant with relevant financial management legislation and policies, and the proper financial management authorities are in place or are being sought through the proposal.
6. Key financial controls are in place to support the implementation and ongoing operation of the proposal.

Before providing attestation, CFOs are expected to conduct a robust due diligence review and challenge function in order to attest to the integrity of the financial information and assumptions presented in Cabinet/TB Submissions. The Guideline states that this review should be based at a minimum on the six assertions listed above, and covers a set of criteria and sub-criteria outlined in Annex B of the Guideline (see Appendix B). An objective and independent due diligence review process should be conducted by staff other than those who directly participate in preparing the submission, and reporting relationships should be structured in a way that reduces the potential for influence, subjectivity and partisanship.

It is expected that a management record will be maintained and be sufficiently detailed for a third party to understand the scope of the due diligence and testing of the assertions and assess how the CFO's conclusions and observations in the Attestation Letter are supported. The Office of the Comptroller General encourages the use of a checklist to document the analysis/testing work performed by the CFO Attestation team, for each assertion criteria.

The roles and responsibilities of the due diligence review process and its independence need to be clearly defined

Statistics Canada has two program initiatives which require a Memorandum to Cabinet at the beginning of each five-year cycle and TB Submissions in order to obtain funding. The audit team interviewed key staff within the Finance Branch and program management, and reviewed the Finance Branch's organisational charts and departmental procedures documents in order to identify key employees involved in the preparation of Cabinet/TB submissions and those involved in the conduct of the due diligence review and challenge function. The audit team also assessed whether the roles and responsibilities of the CFO Attestation team and the independent nature of this function have been clearly defined, documented and understood.

At Statistics Canada, financial officers/advisors are directly involved in the preparation of TB Submissions. They are generally FI-02 and FI-03 level staff who functionally report to Financial Planning Division (FPD). They provide strategic financial advice and support to their respective client-program areas and are involved early in the process by providing financial technical assistance, drawing historical information from the departmental financial systems and compiling financial data, and by providing costing services to program managers for the development of financial assumptions for Cabinet/TB submissions. Engaging the finance officers during the development of Cabinet/TB submissions improves the quality of the submission and is considered a good business practice.

Two teams within the Financial Reporting Division (FRD) are also involved in the CFO Attestation process. The Costing Team provides advice to financial advisors/officers on costing methodology and templates to be used for compliance to financial legislation and TB policies. The PIC Team assesses the state of audit readiness for internal controls within programs on an on-going basis. These two teams are not directly involved in the preparation of Cabinet/TB Submissions, and provide an independent and objective outlook on matters related to compliance of the submission and internal controls. The audit found that the support provided for the development of Cabinet/TB submissions is adequate.

The Director FPD attends program meetings throughout the development of the TB Submissions, and performs analysis procedures as required on an on-going basis. Through interviews, it was noted that comparative analysis of information such as the previous project cycle's financial information and the current TB submission had been conducted, and questions had been raised with the program where significant differences/ increases existed. FPD carries out these activities in order to provide advice to the program to ensure that it prepares information to support various costs, in anticipation of potential questioning from TB. While the analysis conducted by FPD is critical, the objectivity required to perform the due diligence review process should be strengthened.

The Finance Branch has developed a checklist which is divided into six sections based on the fundamental assertions. It is to be completed by the program management team and financial staff who are directly involved in the preparation and development of the submission. Once they have compiled and vetted the information, the checklist is signed by various levels of program management, up to the Assistant Chief Statistician (ACS). The results of this exercise yield substantiation binders that are to be used by the Chief, TB Submissions to carry out an independent due diligence review as per the Guideline.

Throughout the TB submission process, the Finance Branch organises debriefing sessions with the ACS and CFO to provide a walk-through of the binder information collected from the program. During this process, the program's management team and assigned financial officers/advisors present information related to key assumptions, costing, financing options, and other details to the CFO, who in turn challenges the information provided.

Currently, reliance is placed on the work performed by the financial officers who compile the financial information for the program in order to meet the requirements of an independent/objective due diligence review. Because they are directly involved in compiling the information for the Cabinet/TB submissions, this impairs their ability to objectively review the information as required by the Guideline. To fully meet the requirements of the new Guideline for CFO Attestation, roles and responsibilities of parties involved in the CFO Attestation need to be clearly defined, and objectivity and independence of the due diligence review process and challenge function should be strengthened.

The Due Diligence Review Process is not sufficiently documented to meet the requirements of the new Guideline

To assess whether a management record supports the due diligence review conducted, as described in section 4.3.4 of the Guideline, the audit team reviewed all available documentation compiled by FPD in support of the CFO Attestation for two recent program initiatives: A Memorandum to Cabinet and one TB Submission. The supporting evidence consisted of substantiation binders which included checklists completed by those involved in preparing the submission, financial and non-financial reports, and tables prepared by the programs.

The audit compared the design of the checklist template developed by the Finance Branch for alignment with the assertion criteria included in Annex B of the Guideline. The audit found that the current design of the checklist template is not totally aligned with the assertion sub-criteria included in Annex B of the Guideline. There are a number of questions where the link to the assertion criteria is not clear. For example, according to Annex B of the Guideline, criteria pertaining to risk management should include:

Key risks have been considered; Likelihood and impact of key risks has been considered; and Risk response and mitigation strategies are clear.

In section 2.1 of the Finance Branch's checklist template, which pertains to risk management, examples of questions that have been included are:

Have all the key stakeholders been consulted? If so, attach a written confirmation from each area; has HR capacity been confirmed? Have resource needs been analysed?

It was not apparent how these questions were linked to risk management in the context of the new Guideline, and how they would yield information that would be useful for the assessment of the assertion criteria on risk management.

During the file review, the audit found a number of gaps in the documentation collected for the due diligence review process and challenge function. There were instances where the program checked-off that the documentation for certain assertions was either not applicable, or that documentation would be available at a later time, or that the information was available but it was not included in the binder. The following are specific examples of criteria for which no documentation had been produced for review: financial sensitivity analysis for cost drivers having a material impact on resource requirements; compliance with relevant financial management legislation and policies; and spending or expenditure authorities. Consequently, a number of assertion criteria could not be assessed by the auditors or a potential third party review.

Through interviews, the audit team was able to corroborate that the Director FPD had raised questions with the program after comparative analysis of the previous project cycle's financial information and the current TB submission. When significant differences existed between the last project cycle and the current financials, the program was directed to prepare sufficient information to support these costs. Conclusions drawn from this analysis are not formally documented through meeting minutes or record of decisions and cannot be linked to results of the CFO Attestation.

Consequently, the audit team could not determine what analysis or testing had been conducted, what rational supporting various costs presented by the program was deemed to be satisfactory, and which conclusions were drawn to support the CFO Attestation.

A sufficient management record documenting the due diligence process and challenge function, from which a third party can understand the scope of the review and testing of the assertions and assess how the CFO reached his conclusions and observations in the Attestation Letter, is needed in order to meet the requirements of the Guideline.

Recommendations:

The Assistant Chief Statistician of Corporate Services (and CFO) should ensure that:

• The roles and responsibilities of staff involved in the CFO Attestation have been refined and documented in a manner that addresses requirements of independence as expressed in the Guideline.
• The maintenance of management records which supports the CFO's analysis, conclusions and Attestation Letter are established and documented, in accordance with section 4.3.4 of the Guideline.

Management Response:

Management agrees with the recommendations.

• The Director, Financial Reporting Division, the Director, Financial Planning Division, the Deputy Chief Financial officer (DCFO) and the CFO will establish, document and communicate clearly the roles and responsibilities of all parties involved in the CFO attestation process, in a manner that addresses requirements of independence as expressed in the Guideline.
  
  Deliverables and Timeline:
  • The roles and responsibilities of all parties involved in a cabinet document submission process will be developed and documented in a manner that will address the requirements of independence as expressed in the Guideline, by September 2014.
  • The roles and responsibilities will be validated with a working group made up of participants from a sample of recent cabinet document submission processes, by October 2014.
  • The final proposal will be reviewed and approved by the DCFO and CFO, by November 2014.
  • The roles and responsibilities will be published on the Corporate Services Hub, by December 2014.
• The Director, Financial Reporting Division, the Director, Financial Planning Division, the DCFO and the CFO will maintain management records which support CFO's analysis, conclusions and Attestation Letter.
  
  Deliverables and Timeline:
  • A protocol for recording the analysis and conclusions from the discussions with the DCFO and CFO will be developed, as part of the formalized review and attestation process. To be implemented by September 2014.
  • More explicit descriptions of supporting documents, included as evidence for each of the checklist sections, will also be included to improve the comprehension by a third party, of the depth of the analysis completed and analyzed by the CFO and his team. To be implemented by December 2014.