• 2024-2025
  • Quarter ended September 30, 2024
  • Quarter ended June 30, 2024
• 2023-2024
  • Quarter ended December 31, 2023
  • Quarter ended September 30, 2023
  • Quarter ended June 30, 2023
• 2022-2023
  • Quarter ended December 31, 2022Archived
  • Quarter ended September 30, 2022Archived
  • Quarter ended June 30, 2022Archived
• 2021-2022
  • Quarter ended December 31, 2021Archived
  • Quarter ended September 30, 2021Archived
  • Quarter ended June 30, 2021Archived
• 2020-2021
  • Quarter ended December 31, 2020Archived
  • Quarter ended September 30, 2020Archived
  • Quarter ended June 30, 2020Archived
• 2019-2020
  • Quarter ended December 31, 2019Archived
  • Quarter ended September 30, 2019Archived
  • Quarter ended June 30, 2019Archived
• 2018-2019
  • Quarter ended December 31, 2018Archived
  • Quarter ended September 30, 2018Archived
  • Quarter ended June 30, 2018Archived
• 2017-2018
  • Quarter ended December 31, 2017Archived
  • Quarter ended September 30, 2017Archived
  • Quarter ended June 30, 2017Archived
• 2016-2017
  • Quarter ended December 31, 2016Archived
  • Quarter ended September 30, 2016Archived
  • Quarter ended June 30, 2016Archived
• 2015-2016
  • Quarter ended December 31, 2015Archived
  • Quarter ended September 30, 2015Archived
  • Quarter ended June 30, 2015Archived
• 2014-2015
  • Quarter ended December 31, 2014Archived
  • Quarter ended September 30, 2014Archived
  • Quarter ended June 30, 2014Archived
• 2013-2014
  • Quarter ended December 31, 2013Archived
  • Quarter ended September 30, 2013Archived
  • Quarter ended June 30, 2013Archived
• 2012-2013
  • Quarter ended December 31, 2012Archived
  • Quarter ended September 30, 2012Archived
  • Quarter ended June 30, 2012Archived
• 2011-2012
  • Quarter ended December 31, 2011Archived
  • Quarter ended September 30, 2011Archived
  • Quarter ended June 30, 2011Archived
• Supplementary data
  • Supplementary Data on Budget 2012 Implementation

Statistics Canada was established to ensure that Canadians have access to a trusted source of statistics on Canada to meet their highest priority needs. Access to trusted statistical information underpins democratic societies, as it supports evidence-based decision-making in the public and private sectors, and informs debate on public policy issues.

What are we doing?

As a department, Statistics Canada is responsible for the following:

• Acts
  • Statistics Act
  • Corporations Returns Act
• Regulations
  • Corporations Returns Regulations
• Forward Regulatory Plan
• Administrative Burden Baseline
• Interpretation Policy
• Response burden reduction efforts

All of the government's Acts and Regulations can be found on the Justice Laws website.

For more information

• Government-wide Administrative Burden Baseline Counts
• Government-wide Forward Regulatory Plans
• Cabinet Directive on Regulation
• Developing and improving federal regulations
• The Canada–United States Regulatory Cooperation Council

To learn about upcoming or ongoing consultations on proposed federal regulations, visit the Canada Gazette and Consulting with Canadians websites.

Universe

CCOFOG data are presented for all general government sectors: the federal general government sector, the provincial general and territorial government sector, the local general government sector, the colleges and universities sector, and the health, school board and Canada and Quebec Pension Plan sectors. Canadian Classification of the Functions of Government (CCOFOG) coding is applied at the program level for the general ledger accounts, specified purpose accounts, special funds, and income statements of specific entities, such as colleges and universities.

For the province of Nova Scotia, program expenses were estimated from the provincial general government budget documents. This is similar to the methodology used in the previous Financial Management System (FMS) framework.

Data composition

The published CCOFOG data represent only expenses, with the exception of the consumption of fixed capital. They also exclude acquisitions of non-financial assets. The CCOFOG data are currently available for the period 2008 to 2012.

Data reliability

CCOFOG provisional data are being released for the first time in November 2014. This provisional qualifier signals to users that although the data are fit for use, they are subject to revisions. Over the next year these data will be integrated into the rest of the Canadian System of Macroeconomic Accounts (the National Accounts, Balance of Payments, International Investment Position, Input-Output Tables) resulting in revisions as data, concepts and methods are reconciled and aligned within the national accounts framework.

Data limitations

A CCOFOG-based analysis must be limited exclusively to a chronological analysis of a single jurisdiction in a single government sector. Transfers among jurisdictions and among government sectors are not consolidated, which means that, in practice, if the health and education sectors, for example, are added to the general provincial government sector, we are over-estimating expenses as a result of the double-counting of the value of the transfers.

Inter-provincial comparisons are also strictly impossible because the non-reconciliation of transfers means that we cannot compare a government sector that has different responsibilities in two provinces. For example, Ontario delegated a majority of its social housing responsibilities to the local government sector, but British Columbia did not. Thus, comparing CCOFOG data from division 710 – Social Protection, for the general government sector for these two provinces is statistically invalid.

Coding process

The CCOFOG classification has three levels. The highest level is referred to as the division and has 10 separate categories. The second level is referred to as the group and the lowest level is referred to as the class. In this initial CCOFOG release the data are presented at the division level and exclude amortization of non-financial assets expenditures. In November 2015, the data will be presented at the group level.

The primary mandate of a government's program, together with additional information provided by the Canadian Government Finance Statistics (CGFS) coding, is used to assign the CCOFOG classification. When a program has multiple mandates requiring multiple CCOFOG codes, available financial documents are used to determine the main proportion of the observed expense. The total value of the government's program is then assigned to that CCOFOG code.

In general, special funds usually have a single function and thus a single CCOFOG code is assigned. For example, a social housing authority would have all expenses coded to 71069 – Housing.

The assignment is always at the lowest level of CCOFOG detail, which is the class level.

General assignment principles

The 2014 Government Finance Statistics Manual, published by the International Monetary Fund, provides an overview of the COFOG assignment rules in Chapter 6 and its annex. Canada rigorously adheres to the guidelines described in the manual but has introduced certain nuances that more accurately reflect the Canadian reality. The “Detailed assignment decisions” section explains these nuances by class and/or function.

When a program significantly impacts a number of different classes in the same group, or if there wasn't enough detail, an aggregate was sometimes created. For example, aggregate 70459 – Transport n.e.c. was created to represent the sum of transport expenses that could not be specifically allocated to the Road Transport, Water Transport, Railway Transport, Air Transport and Pipelines and other transport systems classes.

Detailed assignment decisions

Division 701- General public services

Centralized services such as Access Ontario are classified under 70133 – Other general services. Services shared by certain departments, such as information technology and human resources, are deemed to be “centralized” if they cover more than two departments.

Government research institutes are generally classified under Basic research (70149); most other research institutes are assigned to applied research or experimental development in their area of expertise (health, agriculture, etc.).

All negotiations of territorial treaties with Aboriginal bands are included in class 70169 – General public services.

All expenses identified under the CGFS classification as interest expense, are classified under 70179 – Public debt transactions.

Transfers to governments for infrastructure expenses are coded under group 7018 – Transfers of a general character between different levels of government. Code 70181 was created to identify transfers to the federal government, while code 70182 identifies transfers to provincial governments and code 70183, transfers to local governments.

Division 702- Defence

Military defence is exclusively a federal government jurisdiction – these expenses will not be found at the provincial/territorial or local level.

Division 703- Public order and safety

In Canada, probation and parole monitoring programs are the responsibility of prison administrations and not the courts as recommended by the Government Finance Statistics Manual. To preserve the comparability of international data, we have left these programs under the courts, but we have set them apart by identifying them by a specific code, 70331. This code will make it easier to transfer the program when Canada publishes its public order and safety expenses under its Justice framework.

Similarly, two key Public order and safety programs in Canada also received their own unique codes: 70332 for legal aid and 70333 for administrative tribunals.

704- Economic affairs

Expenses related to status of women boards and other gender equality initiatives are included in 70412- General labour affairs because, historically, the employment component was the initial focus of these programs.

A CCOFOG group was created to integrate the expenses of programs involving immigration and citizenship, namely, 70413 – Citizenship and immigration.

As mentioned earlier, a special aggregation was created to combine transport expenses when there is not enough detail to identify a specific class: 70459 – Transport n.e.c.

705 – Environmental protection

At the local government level, it is sometimes difficult to separate water supply (70639) and waste water management (70529) expenses; in these instances, a new CCOFOG classification was created to aggregate the two types of expenses (70631).

706 – Housing and community amenities

At the local government level, it is sometimes difficult to separate water supply (70639) and waste water management (70529) expenses; in these instances, a new CCOFOG classification was created to aggregate the two types of expenses (70631).

707 – Health

708 – Recreation, culture and religion

709 – Education

The level of available detail in our source data on education expenses does not allow us to estimate pre-elementary and elementary data or the first and second cycles at the secondary level. We have therefore grouped these classes together in a new aggregated category, 70929 – Elementary and secondary education.

We are also unable at this time to separate non-doctoral higher education (70941) from doctoral (70942); we have therefore combined these two classes into a new aggregated category University education (70949).

Furthermore, when there was not sufficient detail to distinguish college education (70939) from university education (70949), the default choice was to classify this expense under university education (70949).

Internships and apprenticeships were included in division 709 – Education only when such hours were essential to obtain credits toward the degree or diploma. Otherwise, internships and apprenticeships are included in division 704 – Economic affairs under group 70412 – General labour affairs.

710 – Social protection

To accommodate the requirements of public order and safety expenses, under group 7107 – Social exclusion n.e.c. a new class was created 71071 – Victims of crime.

Final audit report
Audit of Data-Sharing Agreements

Statistics Canada
April 15, 2010
Project Number: 80590-60 ( Document (PDF, 195.58 KB) )

• Executive summary
• Introduction
  • Background
  • Objectives
  • Scope and Approach
  • Authority
• Findings, Recommendations and Management Responses
  • DSA Confidentiality Compliance Environment
  • DSA Risk Assessment
  • DSA Information Management and Communication
  • DSA Confidentiality Compliance Status
• Appendicies
  • Appendix A: Audit Criteria
  • Appendix B: Cumulative Number of Active Formalized Statistics Canada Data-Sharing Agreements at the end of 2008
  • Appendix C: Glossary

Executive summary

Data-sharing agreements (DSAs) under sections 11 and 12 of the Statistics Act have been practiced by Statistics Canada since 1976. DSAs have become a key business process. These agreements now number 500, cover nearly all of the business surveys and a majority of household surveys, and enjoy certain exceptions regarding the release of confidential respondent information. In recent years, data-sharing have become a growing and increasingly complex area to manage. Ensuring confidentiality protection of shared data, a key value of Citizen-Focused Service, Public Service Values and Stewardship at Statistics Canada, is a challenge. DSAs are covered by a multi-party management framework, characterized by a distributed management under various responsibility arrangements between the units of Statistics Canada and DSA partners (external Canadian organizations). The risks of non-compliance to the legislative and policy requirements on confidentiality protection and the damage to reputation of Statistics Canada were ranked as high.

The objectives of this audit were to provide the Chief Statistician and the Departmental Audit Committee (DAC) with assurance that Statistics Canada's DSA Confidentiality Management Control Framework (MCF) is adequate and effective over the entire life-cycle of DSAs; and activities supporting the DSA Confidentiality MCF are compliant with the Government of Canada and Statistics Canada acts and policies on confidentiality over the entire life-cycle of DSAs.

The audit was conducted by the Internal Audit Services of Statistics Canada and the evidence was gathered in compliance with the Internal Audit Standards for the Government of Canada and the International Professional Practices Framework (IPPF) of the Institute of Internal Auditors.

The audit found that Statistics Canada and its partners are compliant with the relevant acts and policies. However, opportunities exist to strengthen the management control framework related to DSAs in the areas of risk management, monitoring and information management and communication.

DSA Confidentiality Management Control Framework is composed of 5 elements: planning and reporting, information management and communication, risk assessment, monitoring and the confidentiality compliance environment. DSA confidentiality compliance environment as an element of the management control framework is satisfactory. The audit determined that there is no single comprehensive document or policy on the management of DSAs that would combine all relevant confidentiality compliance requirements, covering the entire DSA life-cycle and establishing an appropriate management control framework.

Systematic risk management is an underpinning of good government. The DSA management control framework has fragmented and often ad-hoc practices related to risk management when assessing confidentiality compliance. Opportunities to advance the risk management practices exist at the departmental and divisional level.

Access to information is a key value of Statistics Canada, which includes access to shared data by DSA partners under the data-sharing agreements. The audit found dormant DSAs and instances when shared data were not being provided to partners in a timely manner. Information management and communication practices would benefit from the improved integration of records and development of integrated protocols.

With respect to the DSA confidentiality compliance status, Statistics Canada and DSA partners are compliant with the legislative and policy requirements, no confidentiality breaches have been detected. However, the information required to assess confidentiality compliance was often fragmented and incomplete at the monitoring stage of the DSA life-cycle. A management monitoring regime would provide sufficient and reliable information for decision-making as it relates to relevance and confidentiality management.

Overall, there is an opportunity to advance to a strategic model of risk management and apply the principles of active monitoring with regards to DSAs, which would improve management effectiveness.

Introduction

Background

For more than 30 years Statistics Canada had exercised its mandate to enter into statistical data-sharing agreements (DSAs) with other organizations under the authority of sections 11 and 12 of the Statistics Act. DSAs have become a key business process. These agreements now number 500, cover nearly all of the business surveys and a majority of household surveys, and enjoy certain exceptions regarding the release of confidential respondent information either with or without the respondent consent, provided that the legal requirements for the provision of data-sharing information, consent rights and confidentiality protection are respected by all parties. In general, data-sharing for statistical purposes occurs when statistical and information inquiry is initiated by joint survey partners, or where a common data resource is equally and jointly owned by two or more partners. Data-sharing is exercised when there are significant reductions in response burden and compliance costs for data-sharing partners, as well as improvements in statistical data accuracy, coverage, relevance and timeliness.

Specifically, the Statistics Act allows for two types of DSAs^{Footnote 1} :

• s.11 DSAs: data-sharing with provincial/territorial statistical offices that are subject to legislation similar to the federal Statistics Act, which provides the authority to collect information for statistical purposes and to compel response from respondents and to request mandatory data-sharing; it stipulates legal requirements to ensure confidentiality protection of the respondent information and to notify respondents of the planned data-sharing;
• s.12 DSAs: data-sharing with other federal government departments, non-statistical provincial government departments, municipal corporations and other legal entities, which either have (according to their own legislation) or do not have the legal authority to compel response and to request mandatory versus voluntary data-sharing; it stipulates legal requirements to ensure confidentiality protection of the respondent information, to notify respondents of the planned data-sharing, and, in case of the voluntary data-sharing, to inform respondents about their right to object to data-sharing.

In 2008, the volume of statistical data-sharing agreements has reached the 500 mark. Most of the DSAs, or 94% of them, are classified as providing for voluntary data-sharing. These fall under s.12 DSAs, where respondents have the right to refuse to share the information. The rest of the agreements are split between the mandatory data-sharing under s.11 provincial/territorial DSAs (4%) and mandatory data-sharing under so-called s.12+ DSAs (2%)^{Footnote 2} . The accumulation of DSAs is a reflection of the need for cooperation between Canadian organizations in the collection, compilation and publication of the statistical information.

At the same time, the federal privacy and security control environment has tightened and became more complex when the Privacy Act (1985), TBS Policy on Privacy Impact Assessment (2002) and Government Security Policy (2002) came into effect. In response, Statistics Canada has established broad control mechanisms^{Footnote 3} for the confidentiality protection of the respondent data, including those obtained under the DSAs.

The DSA Confidentiality Management Control Framework (DSA Confidentiality MCF) is defined as a way in which Statistics Canada and DSA partners organize themselves in order to distribute, coordinate, and manage confidentiality risks associated with the data-sharing processes and to ensure compliance with the relevant acts and policies. There are three major groups of legislative and policy requirements for DSAs that confidentiality management control framework covers: 1) the general DSA information (ISR) and consent rights management; 2) the general DSA confidentiality protection management (i.e. physical, IT and personnel security); and 3) the DSA-specific confidentiality safeguards (in this case, third-party data-sharing or sharing with other parties).

DSA Confidentiality MCF for Statistics Canada is characterized by a distributed management, with separate mandates and various responsibility arrangements among the following key parties:

• STC departmental unit: Data Access and Control Services Division (DACS) in the consulting and legal verification role;
• STC divisions: survey-managing divisions that are responsible for the implementation and operations of associated DSAs (this includes oversight of collection areas and collection partners);
• DSA partners: federal, provincial/territorial or municipal governments and other Canadian legal entities.

Objectives

The objectives of this audit were to provide the Chief Statistician and the Departmental Audit Committee (DAC) with assurance that:

1. Statistics Canada's DSA Confidentiality MCF is adequate and effective over the entire life-cycle of DSAs.
2. Activities supporting the DSA Confidentiality MCF are compliant with the Government of Canada and Statistics Canada acts and policies on confidentiality over the entire life-cycle of DSAs.

Scope and Approach

The audit engagement was conducted in conformity with the Internal Audit Standards for the Government of Canada and the International Professional Practices Framework (IPPF) of the Institute of Internal Auditors. All work was conducted in collaboration with DACS, Statistics Canada's divisions and DSA partner managers responsible for the DSAs selected in the audit sample. The audit approach was inspired by the Government of Canada Management Accountability Framework (MAF) and the Core Management Control Guidelines issued by the Office of the Comptroller General (audit criteria, Appendix A).

The audit universe consisted of 500 active and formalized DSAs, pertaining to s.11, s.12 and s.12 + DSAs for the period of 1976-2008 (see Appendix B). The scope of the audit included:

• the assessment of Statistics Canada multi-party DSA Confidentiality Management Control Framework established for a system of DSAs, covering the period of October 1976 to October 2008 and all DSAs; and
• the conduct of tests of compliance controls for the selected active formalized DSAs: a sample of 39 DSAs, of which 31 agreements were s.12 DSAs (for the period of October 2006-08) and 8 s.12+ DSAs (all of them); the sample covered 80 business and social surveys, 10 DSA managing divisions at Statistics Canada and 32 DSA partners^{Footnote 4}.

Assessing the DSA confidentiality management control framework involved comprehensive examination of multi-party DSA confidentiality compliance practices along such dimensions as DSA confidentiality compliance environment, risk assessment, planning and reporting, information and communication, and monitoring with respect to the three groups of legislative and policy requirements (see Appendix C). To perform the audit work, the following methods were used: audit interviews with Statistics Canada management, audit surveys, examinations of controls and compliance tests.

Excluded from the scope of tests of compliance controls were s.12 DSAs formalized prior to October 2006 due to significant management changes, i.e. introduction of enhanced confidentiality controls and review and audit clauses by Statistics Canada; and all s.11 DSAs due to their relatively lower risk level^{Footnote 5}.

Authority

The audit was undertaken by the Internal Audit Services in accordance with the Statistics Canada's Risk-Based Audit Plan for the fiscal years of 2008/09-2010/11 which was approved by the Internal Audit Committee on March 19th, 2008.

Findings, Recommendations and Management Responses

An adequate and effective management control framework for DSA confidentiality compliance, in relation to three groups of legislative and policy requirements, would include planning and reporting, information management and communication, risk assessment, monitoring and compliance environment.

In relation to objective 1, out of the five MCF dimensions, only the DSA confidentiality compliance environment is fully managed (see Figure 1). The rest of the MCF elements are at various stages of development, with particular weaknesses in risk assessment, information management and communication, and monitoring, requiring a range of improvements.

Description: Figure 1. DSA confidentiality MCF Assessment Snapshot

DSA confidentiality compliance environment as an element of the MCF is satisfactory. However, the audit determined that there is no single comprehensive document or policy on the management of DSAs that would combine all relevant confidentiality compliance requirements, covering the entire DSA life-cycle and establishing an appropriate MCF.

Systematic risk management is an underpinning of good government. The DSA management control framework has fragmented and often ad-hoc practices related to risk management when assessing confidentiality compliance.

Access to information is a key value of Statistics Canada, which includes access to shared data by DSA partners under the data-sharing agreements. The audit found dormant DSAs and instances when shared data were not being provided to partners in a timely manner. Information management and communication practices would benefit from improved integration of the records and development of integrated and standardized protocols.

In relation to objective 2, Statistics Canada and DSA partners are compliant with the legislative and policy requirements on confidentiality protection; however, the information required to assess compliance was often fragmented and incomplete at the monitoring stage of the DSA life-cycle.

All recommendations and management response and action plans (MRAPs) should be considered within the existing Statistics Canada management structure.

DSA Confidentiality Compliance Environment

Adequate and effective management of DSAs would include confidentiality compliance controls, governance structures, accountability and responsibility mechanisms, training and operational processes over their entire life-cycle. The audit identified that DSA confidentiality compliance environment is defined, communicated and managed between DSA parties, especially at the design and negotiation stage of the agreements. However, the environment is complex and difficult to navigate, and characterized by an absence of an integrated policy framework to manage DSAs.

DSA confidentiality compliance requirements are defined by the means of preventative controls found in the Statistics Act, Privacy Act, STC Policy on Privacy Impact Assessments (PIA), STC Policy on Informing Survey Respondents (ISR), STC Policy on Security of Sensitive Statistical Information, STC IT Security Policy, STC Policy on Micro-Data Release, STC Policy on Discretionary Disclosure and associated guidelines. Provisions for DSAs in legislative and policy references are quite fragmented and difficult to piece together for those who are not dealing with them on the daily basis. Specific standards for the confidentiality compliance are defined by the texts of DSAs and associated security appendices. This is further complicated by the fact that DSAs often combine multiple requirements from various jurisdictions which are subject to change, often making standardization difficult.

Strategic DSA governance and oversight framework is established and coordinated among DSA parties. Statistics Canada has a Confidentiality and Legislation Committee^{Footnote 6} that accommodates hearings for DSA concerns and proposals from divisions, DACS and DSA partners resulting in decisions and action plans. Other internal management committees, such as the Policy Committee, also get involved when necessary. DSA partners can be significantly involved during the implementation stages of DSAs via the Steering and Advisory Committees or Technical Groups associated with surveys that are covered by DSAs. This process allows all parties to exchange information about the DSA confidentiality compliance issues.

The operational authorities and responsibilities for DSA confidentiality compliance are distributed among the multiple parties. These responsibilities are limited by the mandates of these parties and are not necessarily carried through the entire life-cycle of a DSA. The departmental function of Data Access and Control Services is dedicated to the legal and policy review, negotiation and approval of DSAs, their modification and termination, as well as coordination of associated requests in between these stages from either subject-matter divisions or DSA partners. DACS has a limited mandate to ensure accountability for DSA confidentiality compliance during implementation and monitoring stages, aside from provision of services to both divisions and DSA partners. Survey and DSA managing divisions consult with DACS during the planning stage and the implementation of DSAs using a set of internal support partners in the fields of collection services, communications, IT, or joint collection with external DSA partners. The joint management of DSAs between two or more Statistics Canada divisions is also practiced depending on the complexity of the DSAs, for which there are no clear guidelines on the roles and responsibilities. DSA partners are responsible for ensuring compliance with the terms of the DSAs during the implementation stages of the agreements.

It was found that DSA confidentiality compliance control processes are incorporated into much larger control mechanisms of survey operations. Compliance of DSAs with general information and consent rights requirements is embedded into the Survey Prescription processes. General confidentiality protection requirements for DSAs are incorporated into generic requirements on the physical, IT and personnel security, for which security checklists and procedures exist. DSA-specific safeguards, such as prohibition of third-party data-sharing or allowance for restricted access for researchers and research organizations of DSA partners under certain conditions, are specified in the agreements. Thus, managers have to combine all of these fragments into their own rules and processes, resulting in rather diverse practices for DSA confidentiality compliance management at the divisional level. Further, 90% of the divisions do not have dedicated managers for DSAs. Rather, responsibility for operational DSA management falls on the shoulders of survey managers. 80% of divisions do not have written manager's guides. There are no integrated operational protocols or manuals dedicated to DSAs in all 5 dimensions of MCF.

To mitigate the complexity of this environment and to ensure compliance, DACS provides extensive training programs in all generic areas related to confidentiality. This training covers the basics of legislative and policy compliance requirements, with some references to DSAs. However, it is not specific and operational enough for managers to be fully confident in its application. This results in DACS being overwhelmed by the constant requests for advice, clarifications, reviews, formal letters, custom training sessions, etc.

The absence of an integrated DSA management policy or framework adds to the complexity of the task of managing DSA confidentiality compliance and increases the risk of misinterpretation and confusion, potentially resulting in breaches of confidentiality. This may also result in heterogeneous and erroneous applications of DSA confidentiality compliance requirements. Having one integrated policy will provide greater overall clarity for the DSA confidentiality compliance environment.

Recommendation #1

Management Response

Management accepts the recommendation.

DACS will develop a DSA governance process guided by a policy or directive, which will be integrated with the risk management framework. In addition, divisions will be asked to report on this element as part of the new Statistics Canada Quadrennial Program Review (QPR) guidelines.

Deliverables and timelines:

• Presentation of the governance process to the Confidentiality and Legislation Committee. Integration of this element into the Quadrennial Program Review (QPR) guidelines.
• Director, Data Access and Control Services and Director, Corporate Planning and Evaluation Division – October 2010

DSA Risk Assessment

An appropriate risk management model would include adequate and effective practices for assessment of the risks of non-compliance and/or non-reporting for breaches and weaknesses related to DSA confidentiality. The audit revealed that systematic and formal mechanisms for the DSA risk assessment are not in place, but are rather fragmented, ad-hoc and managed informally.

At the departmental level (DACS), it was found that the risks of non-compliance for the general DSA information and consent rights management are assessed at the DSA design & negotiation stage by generic or specific Privacy Impact Assessments. The risks of non-compliance for the other two groups of requirements, i.e. general DSA confidentiality protection and DSA-specific confidentiality safeguards are not formally assessed by DACS due to the newness of the risk management initiative at Statistics Canada. At the divisional level, due to limitations in the mandate of DSA-managing divisions, half of the directors assessed their DSA risk assessment processes as managed informally and unsystematically, while the other half admitted that there is no activity in this area. However, all confirmed that the procedures for reporting on the breaches and weaknesses of the confidentiality controls are known and implemented when breaches are reported. It is expected that employees making mistakes will come forward or will be detected. At the DSA-partners level, the evidence is not sufficient to provide a conclusion.

There is a risk that the lack of formal, integrated and continuous risk management practices for DSA confidentiality and non-reporting risks across all DSA parties will not detect confidentiality breaches and may prevent adequate and effective risk mitigation strategies.

Recommendation #2

It is recommended that Assistant Chief Statistician Corporate Services ensure that Data Access and Control Services, in consultation with Corporate Planning and Evaluation, strengthen the risk management practices with respect to DSAs.

Management Response

Management accepts the recommendation.
DACS will conduct a threat and risk assessment with respect to the management of DSAs. This will result in a report outlining the potential threats, and the steps that could be taken to eliminate or reduce the risks.
The process will be repeated regularly.
The report will be presented to the Confidentiality and Legislation Committee.

Deliverables and timelines:

• Presentation of the report to the Confidentiality and Legislation Committee.
• Director, Data Access and Control Services and Director, Corporate Planning and Evaluation Division – October 2010

DSA Information Management and Communication

An appropriate information management and communication model would include adequate and effective systems, processes and protocols to form comprehensive DSA records and to gather relevant statistics on DSA confidentiality compliance performance to facilitate the senior management decision-making process. Data-sharing is exercised when there are significant reductions in response burden and compliance costs for data-sharing partners, as well as improvements in statistical data accuracy, coverage, relevance and timeliness. The audit identified that DSA information management and communication systems and processes are disconnected between DACS and DSA-managing divisions, and are managed according to their mandates. This practice results in heterogeneous records and gaps in information and communication coverage during the DSA life-cycle. Knowledge management systems and processes are predominantly informal.

At the departmental level, it was found that information is spread over several media: paper files, DACS Administrative Database, and server files. Combined, these sources provide information for decision making, but require integration. Indicators found in the DSA database are useful, but are applicable mostly during the beginning and end of the DSA life-cycle, when DACS controls legal processes. However, rather limited information is available in the middle of the DSA life-cycle. There are no provisions in the systems and processes for the collection and analysis of information on DSA confidentiality compliance.

At the divisional level, the audit revealed that DSA managing divisions structure their own operational information and communication processes. It was found that they have not established systematic and integrated information management, communication and record systems and processes, but rather have what they consider as essential records to reflect their transactions with DSA partners, providing incomplete information. Divisional managers over-rely on DACS for information, believing they can always have access to DSA legal files and documentation on request. 60% of the directors see the need for a central DSA electronic database to enable pro-active management and monitoring of the DSAs.

The audit identified that there is a communication issue between DSA parties regarding the timing of the release of the shared data. DSA-managing divisions make an assumption that DSA partners will request the shared data file upon announcement of the release in the external flagship publication of Statistics Canada, the "Daily". However, this was not the case. Additionally, the majority of the DSA partners had difficulty providing information in a timely manner during the audit procedures.

There is a risk that a sub-optimal DSA information management and communication model will not provide a timely, accurate, continuous and holistic "big picture" of DSAs to aid an effective decision-making process.

Recommendation #3

It is recommended that Assistant Chief Statistician Corporate Services ensure that Data Access and Control Services strengthen the information management and communication practices for DSAs.

Management Response

Management accepts the recommendation.
DACS will develop a departmental directive to formally describe the required practices.
The draft directive will be presented to the Confidentiality and Legislation Committee.

Deliverable and timeline:

• Presentation of the draft directive to the Confidentiality and Legislation Committee.
• Director, Data Access and Control Services – October 2010

DSA Confidentiality Compliance Status

We expected to find compliance with the Government and Statistics Canada policy framework, the legislative requirements and the terms and conditions of the DSAs over their entire life-cycle. The audit identified that Statistics Canada and DSA partners are compliant with the legislative and policy requirements, but the information, which would normally be acquired through a monitoring program, is insufficient.

In 2006, DACS started to gradually introduce a review and audit clause into the texts of the DSAs, where the partners would agree to it. However, the capacity to exercise the clause on a systematic basis does not exist. The onus is on Statistics Canada DSA-managing divisions and DACS to verify that partners follow the rules. DSA confidentiality compliance monitoring, defined as practices encompassing evaluations of DSA confidentiality compliance controls, reporting and exchanging information on control weaknesses and their correction, as well as change management, is not envisaged by the current legislative and policy suite. A few years ago, DACS asked the s.11 DSA partners to conduct a self-assessment and submit their reports.

With respect to compliance with general DSA information and consent rights requirements, the audit identified that at the departmental level, the ISR and PIA processes for the verification of survey materials and DSA texts are well managed. At the divisional level, the audit indicated that improvement is required regarding monitoring of the DSA ISR and consent rights requirements during the survey implementation and collection of compliance performance information from the collection areas. A mechanism to collect respondent objections/waivers to data-sharing is in place for all of the divisions in the audit sample. However, only half of them stated that they have a documented procedure for processing these data, collecting reports from collection areas and using this information further in the preparation of shared files.

The audit found that requirements on general DSA physical, personnel, IT security and disclosure management are adequately specified in the texts of the agreements, and compliance by Statistics Canada staff and DSA partners is observed. The audit revealed that 34% of DSA partners reported that they have not established any processes yet, because they have not requested the data or that they are not planning to request the data.

With respect to compliance with DSA confidentiality safeguards regarding conditions for data-sharing with other parties, the audit found that prohibition of third-party data-sharing is specified in the texts of DSAs or clarified during the negotiations process. In exceptional circumstances, third-party data-sharing is allowed on the basis of legislative and security review by DACS. In the "Uses of Information" clause of the agreements, the research contractors and research organizations working directly for the DSA partners can be allowed access to shared data under very strict security and non-disclosure conditions. The audit identified that often research contractors and research organizations are engaged by the DSA partners once the shared data become available well into the implementation or monitoring stages of the DSAs. Regardless of the voluntary or mandatory nature of the DSAs, divisions have rather limited processes for coordination and monitoring of data-sharing with other parties. Managers know the provisions of the DSAs, however, systematic documentation regarding how these processes are managed was not available in all instances during the audit.

Monitoring practices are not systematic, have limited coverage and do not provide complete DSA information as it relates to confidentiality. The risk of insufficient monitoring may result in the failure to detect weaknesses and confidentiality breaches in relation to the DSA legislative and policy requirements. Consequently, timely and effective corrective measures cannot be implemented. The lack of a strong monitoring regime results in an accumulation of dormant DSAs, which would ideally be terminated or modified.

Recommendation No. 4

It is recommended that the Assistant Chief Statistician Corporate Services ensure that Data Access and Control Services implement a DSA monitoring program.

Management Response

Management accepts the recommendation.
DACS will develop a proposal for a DSA monitoring program, including resource requirements. In addition to employee time to manage the monitoring, travel costs will be required.
The proposed monitoring program will be presented to the Confidentiality and Legislation Committee.

Deliverable and timeline:

• Presentation of the monitoring plan to the Confidentiality and Legislation Committee.
• Director, Data Access and Control Services – October 2010

Appendices

Appendix A: Audit Criteria

1.1. DSA multi-party confidentiality compliance environment is adequate and effective and satisfies MAF Citizen-Focused Service CFS-1, CFS-3, CFS-4 and Stewardship ST-22 criteria

1.2. DSA multi-party confidentiality compliance risk assessment practices are adequate and effective and satisfy MAF Citizen-Focused Service CFS-1, CFS-3, CFS-4 and Stewardship ST-22 criteria

1.3. DSA multi-party confidentiality compliance control planning & reporting practices are adequate and effective and satisfy MAF Citizen-Focused Service CFS-1, CFS-3, CFS-4 and Stewardship ST-22 criteria

1.4. DSA multi-party confidentiality compliance information & communications practices are adequate and effective and satisfy MAF Citizen-Focused Service CFS-1, CFS-3, CFS-4 and Stewardship ST-22 criteria

1.5. DSA multi-party confidentiality compliance monitoring practices are adequate and effective and satisfy MAF Citizen-Focused Service CFS-1, CFS-3, CFS-4 and Stewardship ST-22 criteria

2.1. General DSA information and consent rights management by all DSA parties over its life-cycle is compliant with relevant acts and policies and associated guidelines, MAF Public Service Values PSV 1-4 and Stewardship ST-22 criteria

2.2. General confidentiality protection management by all DSA parties over its life-cycle is compliant with Statistics Act, GoC Security Policy, StatCan's Policy on Security of Sensitive Statistical Information, IT Security Policy and associated guidelines, MAF Public Service Values PSV 1-4 and Stewardship ST-22

2.3. Management of DSA-specific confidentiality safeguards by all DSA parties over its life-cycle is conducted according to the terms of the agreement and MAF Public Service Values PSV 1-4 and Stewardship ST-22

Appendix B: Cumulative Number of Active Formalized Statistics Canada Data-Sharing Agreements at the end of 2008

Appendix C: Glossary

DSA Confidentiality Management Control Framework (MCF) - A way in which Statistics Canada and DSA partners organize themselves in order to distribute, coordinate, and manage confidentiality risks associated with the data-sharing processes and to ensure compliance with the relevant acts and policies.

DSA Life-Cycle - Period from the start to the end of activities for the DSA project; divided into the 4 stages:

1. DSA design & negotiation – the period from the start of communications between the DSA partners on the potential DSA project and the signing of the agreement.
2. DSA implementation – conduct of the data collection and data transmission activities.
3. DSA monitoring – monitoring of the compliance of the DSA partners to the terms of the agreement; monitoring of changes in the conditions, etc. It also means conduct of communications with the parties involved in the Management Control Framework, evaluations, inspections, assessments, reviews of the various controls, etc.
4. DSA modification/termination – the period from the start of communications between DSA partners on the changes to the status of the agreement until it is revised or terminated.

Management Control - Any action taken by management and other parties to manage risk and increase the likelihood that established objectives and goals will be achieved. Management plans, organizes, and directs the performance of sufficient actions to provide reasonable assurance that objectives and goals will be achieved.

ISR – Informing Survey Respondents, Statistics Canada policy and associated processes and mechanisms.

PIA – Privacy Impact Assessment, Statistics Canada policy and associated processes and mechanisms.

Notes:

Audit Report
Audit of Research Data Centres Program

Statistics Canada
September 30, 2010
Project Number: 80590-61 ( Document (PDF, 119.78 KB) )

• Executive summary
• Introduction
  • Background
  • Authority
  • Audit Objectives
  • Scope and Approach
• Findings, Recommendations and Management Responses
  • Governance and Strategic Direction
    • Management Control Framework
    • Investment Management/Funding
• Risk Management
  • Access to data
    • Infrastructure
    • Confidentiality
• Appendices
  • Appendix A: Audit Objectives and their Criteria
  • Appendix B: Overview of the RDC Network

Executive summary

The Research Data Centres (RDC) are part of an initiative by Statistics Canada, the Social Sciences and Humanities Research Council (SSHRC) and university consortia to help strengthen Canada's social research capacity and to support the policy research community. RDCs provide researchers with access, in a secure setting, to microdata from population and household surveys. The Centres are governed by a board of directors composed of representatives from Statistics Canada, SSHRC, Canadian Institute for Health Research and the academic directors of each centre. The centres are staffed by Statistics Canada employees.

The objectives of the audit of RDCs are to provide the Chief Statistician and the Departmental Audit Committee with assurance that activities supporting the governance framework are adequate and effective to ensure that services are delivered to researchers; and that access to data follows Statistic Canada policies and procedures. The audit was conducted by Internal Audit Services in accordance with the Government of Canada's Policy on Internal Audit.

Key Findings

Activities supporting the RDC network governance are adequate and effective in ensuring continued delivery of services. The corporate management structure is effective, results are measured and reported on; however, performance is not measured against program operational targets and results are not included in the Departmental Performance Report. Once research proposals are approved by Statistics Canada, the scope of the initiative is managed by stakeholders. Since inception, there have been challenges in maintaining program costs within granted funding limits as the number of centres rose from 9 to 24. As a result, increasing deficits have been incurred within the RDC Program. Through a newly increased annual budget, Statistics Canada has stabilized the costs for this program and established a costing structure to ensure RDCs maintain operational costs within the scope of their budgets.

The RDC program and RDC sites do not have formal risk management practices and risks associated to the continuity of the operations of RDCs have not been assessed as part of overall risk management practices for the program.

Researchers conduct their work in restricted physical and technological infrastructures that are secure, which reduces the risk of confidentiality breaches. Information handled in RDCs is subject to governmental confidentiality and security requirements; however, RDCs have not been inspected periodically for compliance to security requirements following initial inspections. After conducting a number of security checks on site, some deviations from security requirements were observed. Security training is provided to new analysts but there was no evidence of continued awareness programs. Finally the disclosure process in place for the program is applied rigorously and consistently, and no unwanted disclosures were observed.

Conclusion

Overall, the activities supporting the Governance Framework surrounding the Research Data Centres Program are adequate and effective, ensuring that services are delivered to researchers. Nevertheless, we noted opportunities to improve the management control framework as it relates to reporting results and assessing risks, as well as opportunities to ensure that departmental security requirements are met.

Introduction

Background

In the late 1990s Statistics Canada and the Social Sciences and Humanities Research Council (SSHRC) commissioned a task force to examine the state of the quantitative social sciences in Canada. Concern was expressed about the future of Canada's capacity to fruitfully exploit the rich sources of quantitative data on households and individuals to inform public policy and public debate. The joint task force published its findings in 1998 in a report titled "The Final Report of the Joint Working group of the Social Sciences and Humanities Research Council and Statistics Canada on the Advancement of Research using Social Statistics" (Statistics Canada 1998). The report outlines a series of recommendations aimed at building social science research capacity in Canada, improving access to Statistics Canada data in order to support research activity and communicating the research findings.

These recommendations led to the establishment of a Canadian Research Data Centres Network (CRDCN) and the RDC Program within Statistics Canada as the organisational unit that represents the agency within the Network. The first 9 Research Data Centres started offering access to data in secure university-based laboratories across Canada in 2001. A second CFI award (2006), and the joint SSHRC/CIHR 2005-2010 operating grant has supported the Network's rapid expansion, and allowed it to make significant progress. Data access was improved by giving researchers across the country access within Universities to detailed microdata, initially to Statistics Canada longitudinal surveys, and now to a broader range of data sets.

RDCs provide researchers with access, in a secure setting, to microdata from population and household surveys. Statistics Canada employees oversee operations carried out in the centres. They operate under the provisions of the Statistics Act in accordance with all the confidentiality rules and are accessible only by researchers with approved projects who have been sworn in under the Statistics Act as 'deemed employees.' RDCs are located throughout the country, so researchers do not need to travel to Ottawa to access Statistics Canada microdata.

The research data centres provide opportunities to: generate a wide perspective on Canada's social landscape; provide social science research facilities across the country in both larger and smaller population centres; expand the collaboration between Statistics Canada, SSHRC, CIHR, CFI, universities and academic researchers; build on the Data Liberation Initiative and train a new generation of Canadian quantitative social scientists.

The network has grown rapidly since its creation. The number of sites has risen from 9 sites in 2001 to 24 sites in 2010, and the number of projects initiated and completed has risen dramatically. Over 2,600 researchers from a multitude of disciplines and institutions have worked in a growing number of RDCs on over 1500 projects, using an expanding range of micro-data files to examine many health and socioeconomic issues. Statistics Canada is responsible for the protection of the data, confidentiality vetting and researcher support in centres. There are 53 Statistics Canada analysts and statistical assistants in the Centres, and 5 regional managers dedicated to this program across the country. The program is supported by a Head Office Operations Unit with 3 employees.

Authority

The audit was part of the Multi-Year Risk-Based Audit Plan 2008/09-2010/11 and was approved on March 19, 2008 by the Departmental Audit Committee.

Audit Objectives

The objectives of the audit of RDC are to provide the Chief Statistician and the Departmental Audit Committee with assurance that:

• activities supporting the Governance Framework are adequate and effective to ensure that services are delivered to researchers;
• access to data follows Statistic Canada policies and procedures.

Scope and Approach

The scope of the audit was to assess the effectiveness and adequacy of the activities supporting the current governance structure, as well as the compliance to key Statistics Canada policies and procedures relating to security and confidentiality. Relevant policies are: the Security Practices Manual which relates to the departmental security policy, the IT Security Policy, the Record Linkage Policy, the Security of Sensitive Statistical Information Policy, the Discretionary Disclosure Policy and the Statistics Act. The audit was conducted in conformity with the Treasury Board and the Institute of Internal Auditors standards.

The approach consisted of assessing the processes and procedures of the governance framework in place to control access to data. This was achieved through interviews with key departmental staff and external stakeholders managing the university side of the partnership program, detailed testing of processes and procedures and review of relevant documentation.

The RDC program has 24 centres located across Canada. The examination phase included physical inspections of five RDC sites: the Carleton, Ottawa, Outaouais, Local (COOL) Centre at the University of Ottawa, the Quebec Inter-University Centre for Social Statistics (QICSS) at the University of Montreal, the University of Toronto RDC, the University of British Columbia RDC and the Simon Fraser University RDC in British Columbia.

The examination phase for this audit was conducted from February to May, 2010.

Findings, Recommendations and Management Responses

Governance and Strategic Direction

Overall, activities supporting the RDC network governance are adequate and effective in ensuring continued delivery of services. The corporate management structure is effective, and results are measured and reported on. Nevertheless, performance is not measured against operational program targets and results are not included in the Departmental Performance Report. Once research proposals are approved by Statistics Canada, the scope of the initiative is managed by stakeholders. Since inception there have been challenges in maintaining program costs within granted funding limits as the number of centres rose from 9 to 24. As a result, increasing deficits have been incurred within the RDC Program. Through a newly increased annual budget, Statistics Canada has stabilized the costs for this Program and established a costing structure to ensure RDCs maintain operational costs within the scope of their budgets.

An established governance mechanism providing adequate strategic direction would include a clear committee structure to ensure the effectiveness of relationships and escalation of management issues. The audit found that a clear committee structure is established and is effective. The Canadian Research Data Centres Network (CRDCN) is a partnership consisting of participating universities, Statistics Canada (through the RDC Program funding) and two major granting councils: the Social Sciences and Humanities Research Council (SSHRC) and the Canadian Institutes for Health Research (CIHR).

The CRDCN and Statistics Canada have distinct reporting structures and both of them work in a joint partnership (see Appendix B). The CRDCN committee is the main governing body for the Network. It negotiates grants with the major councils and other funding bodies and sets the policies that determine the membership of the Network, the distribution of grant allocations, the strategic directions for the Network while respecting Statistics Canada criteria for confidentiality, and the dissemination of results of research conducted in the centres and the promotion of the Network nationally and internationally. The CRDCN meets twice a year and is composed of representatives of Statistics Canada, Universities, and partners (SSHRC, CIHR). During these meetings, items such as the funding allocation formula, new IT technology initiatives, training for students, RDC conferences, and member voting rights are discussed. The allocation formula is used by the CRDCN to determine grant allocation to RDCs, based on RDC activity workload, measured by the number of contracted research projects underway or suspended, and status on outputs.

In order to increase the efficiency of the decision making process at meetings, the CRDCN went through a re-organisation and implemented a sub-committee structure. The following sub-committees have been created: the Executive Committee, Implementation of CFI Award, Coordinate Information Gathering and Dissemination, Thresholds and Measures for Allocation. The CRDCN Executive Committee was created to address strategic decisions involving the university network. This group meets twice a year prior to the CRDCN Committee bi-annual meetings. Representatives of Statistics Canada attend these meetings. The CRDCN sub-committees were created as a supporting role to the CRDCN Committee. These sub-committees provide subject-matter expertise on research related questions for consideration and decision making at the CRDCN Committee meetings. Statistics Canada representatives often attend these meetings and provide workload information used to set the funding allocation formula.

The RDC Program structure within Statistics Canada consists of the lead program manager and five regional RDC managers. Meetings are held on a weekly basis to discuss day-to-day operations of the RDC Program and ensure that processes and procedures are applied consistently across the program. Members also meet as a working group to discuss and resolve operational issues that may arise. The operations of the centres are managed by Statistics Canada employees in partnership with academic directors from the universities. Universities provide IT support. One representative of the research community in each university holds the function of Academic Director. The Statistics Canada analysts report to the regional RDC managers, who are located in Statistics Canada regional offices. Regional RDC managers are responsible for the management of several RDCs and report to the Assistant Director, Microdata Access Division. Because managers are not on site, management of the centres is done through e-mails, phone conversations and twice-yearly visits to centres.

To access the microdata housed in the Research Data Centres (RDCs), researchers submit a project proposal to the Social Sciences and Humanities Research Council (SSHRC) for peer review and internal review by Statistics Canada. SSHRC invites applications from individual researchers or from research teams led by a principal applicant. The principal applicant is responsible for submitting application forms on behalf of the team. Each proposal is evaluated by two academic peers and a Statistics Canada analyst. The SSHRC facilitates the peer review process and the head office operations unit facilitates the internal Statistics Canada review. The proposals are assessed based on: scientific merit and viability of the proposed research; relevance of the methods to be applied; demonstrated need for access to detailed microdata; and expertise and ability of the researchers to carry out the proposed research as illustrated in the resumes and list of contributions. Statistics Canada is not involved in the prioritization of projects undertaken in RDCs; however, it is the responsibility of each RDC to ensure that resources and funding is available prior to taking on a new research project.

Management Control Framework

An adequate management control framework is required to ensure effective planning, organizing, controlling, directing, communicating, as well as compliance with the Treasury Board Management Accountability Framework and the TBS Risk Management Policy. Clear program objectives should support strategic direction, operational plans and priorities, and should provide clear direction on how resources should be allocated to achieve these plans. Planning for the program involves the production of annual operational plans, budgets, staffing plans, and an annual RDC activity report, which are produced on a timely basis.

To ensure appropriate delegation of authorities, roles and responsibilities need to be documented and communicated. It was found that roles and responsibilities were clearly documented and understood. The organisational chart of the overall structure, including the relationships between the CRDCN and Statistics Canada, are up to date and indicate the linkages between the different stakeholders.

A communication process should be in place to ensure consistency of program activities and compliance to policies and regulations. The CRDCN, Statistics Canada and each RDC have their own websites, and communication for the program is done through the use of web technology. Communication between the RDC Regional Managers and the Statistics Canada analysts is informal. Items discussed are mainly related to RDC management and statistical operational processes. Operational issues not resolved at the regional level are escalated to the RDC Program Manager.

Values and ethics are promoted and communicated on an on-going basis within the researcher community through formal documentation, training, and policy frameworks. Microdata research contracts signed by researchers include several clauses regarding values and ethics. Also, researchers receive an orientation session where values and ethics are introduced and presented. Researchers acknowledge the "Researcher Guide", which includes a section on values and ethics. Values and ethics awareness is also reinforced through the Oath required under the Statistic Act.

An effective performance management system should be in place to measure and report on performance. Relevant performance targets should be identified, and information on results should be gathered and used to make departmental decisions. Program outcomes should also be reported as part of the Departmental Performance Report (DPR). The RDC Program Manager, who reports to the Director General of Census Subject Matter, Social and Demographic Statistics, is accountable for reporting on performance. Different reviews of the RDC initiative have been conducted, such as: the mid-term review produced by SSHRC and CIHR, the Quadrennial Program Review of the program produced by Statistics Canada for 2000-2008, the Program Manager Report, and Satisfaction Survey. Although results are measured and reported on for internal administrative purposes, performance is not measured against comprehensive program operational objectives, nor is it reported in Statistics Canada's DPR.

Investment Management/Funding

The overall initiative is funded primarily by Statistics Canada (through the Research Data Centre Program), the SSHRC, CIHR and the universities. SSHRC and CIHR provide grants to the CRDCN, which then re-distributes funds to the RDCs. An allocation formula is used as a basis to distribute funds, taking into consideration factors determining RDC activity levels such as the number of researchers, branches, and projects. Statistics Canada provides in-kind contributions, by not only providing access to data, but also by assuming the operational costs to manage the program. In the event that costs associated with administrating additional research projects exceed the limits set by the program, RDCs enter into an agreement with Statistics Canada for additional resources on a cost-recovery basis.

Every RDC has its own budget, which is managed by the Academic Director. The Academic Director is a university researcher and does not have authority over the Statistics Canada analysts. A large portion of the RDC budget consists of the cost associated with Statistics Canada analysts and for daily operations. Universities provide IT services and support to RDCs. Enhancements or development of new initiatives in centres are undertaken only if additional sources of funding are received.

The RDC program budget is intended to fund Statistics Canada's head office support for the RDC Network, including: the maintenance of the Management Information System on research activity conducted by deemed employees for Statistics Canada, the administration of contracts, maintenance of the RDC Web site, provision of the data to the RDCs, preparation and maintenance of the documentation required by researchers and RDC project staff, LAN support for head office, and the provision of methodological support to the RDCs.

The demand for Statistics Canada data access has grown over the last ten years, and increasing annual deficits have been incurred within the Program as the number of centres grew from 9 to 24. Over the past three years, deficits incurred by the RDC program were partially covered by funds available in other field programs.

In April 2009, the RDC program was transferred to the Microdata Access Division. For the fiscal year 2009/10, the deficit incurred for the research data centre initiative reached $351,121. In order to remedy this situation, a long-term proposal has been submitted to ensure on-going funding to cover head office costs. Going-forward, the annual funding for the program has been set at $800,000 annually.

From this time forward, RDCs are expected to maintain operational costs within the scope of their budgets.

Recommendation No. 1

It is recommended that the Assistant Chief Statistician (ACS) of Social, Health, and Labour Statistics ensure that performance indicators are measured against operational targets set for the program and that program results are included in the DPR for future target references.

Management Response

Agreed. Performance indicator measures and results are now an integral part of the Performance Program Review with detail in the program logic model of outcomes and how they are measured. Microdata and Access Divison will thus include them in its upcoming Performance Program Review. Performance of the RDC program has been positively reviewed through an external international panel and through client satisfaction feedback.

Deliverables:

• Performance indicators and measures identified in the Performance Program Review and Departmental Performance Report - by March 31, 2011; and
• Program results identified in the Performance Program Review and Report on Plans and Priorities - by March 31, 2011.

Risk Management

The RDC program and RDC sites do not have formal risk management practices, and risks associated to the continuity of the operations of RDCs have not been assessed as part of overall risk management practices for the program.

In a well-controlled program environment, management should have a solid and up-to-date understanding of the internal and external factors that may expose their strategic and operational objectives to risk. Resources and strategic risks should be monitored proactively to assist in decision-making and Statistics Canada's Long Term Planning process. Formal risk management practices enable program managers to identify, assess, monitor and report on risks that may result in threat or opportunity. Although some risks for the RDC program are discussed informally in meetings, there is no evidence of a risk management framework in place or a link to Statistics Canada's Risk Management Model. In the absence of a formal risk management framework in place, management's ability to identify and influence risk throughout the program lifecycle is weakened.

The policy on government Security states: "Continuity of government operations and services is maintained in the presence of security incidents, disruptions or emergencies". The departmental Business Continuity Plan policy also states that "it is the responsibility of the RDC Manager to develop and implement a Business Continuity Plan for each of the Research Data Centres and integrates the plan with those developed by the institution or university in which the centre is located". Although the RDC program is not a mission-critical project, risks associated to the continuity of the operations of RDCs should be identified and assessed as part of the overall sound risk management practices for the program.

Recommendation No. 2

The Assistant Chief Statistician (ACS) of Social, Health and Labour Statistics should ensure that the RDC program be included in Statistics Canada's Risk Management Model and that risks associated to the continuity of the operations of RDCs are identified and assessed as part of the overall risk management practices for the program.

Management Response

Agreed. The RDC program has identified program risks for Statistics Canada's Risk Management document in July 2010. Risks associated with RDC operations will be an integral part of the Performance Program Review, including completion of the Risk Register. The program manager will continue work on a business continuity plan for the program.

Deliverables:

• Inclusion in Statistics Canada's Risk Management document, a Business Continuity Plan, and a risk assessment in the Performance Program Review. - by March 31, 2011.

Access to data

The audit found that researchers conduct their work in restricted physical and technological infrastructures that are secure, which reduces the risk of confidentiality breaches. Information handled in RDCs is subject to governmental confidentiality and security requirements. Nevertheless, RDCs have not been inspected periodically for compliance to security requirements. After conducting a number of security checks on site, some deviations from security requirements were observed. Security training is provided to new analysts, but there was no evidence of continued awareness programs. Finally, the disclosure process in place for the program is applied consistently, rigorously and consistently, and no unwanted disclosures were observed.

It is expected that controls over access to Statistics Canada data in RDCs are in compliance with Government and Statistics Canada policies and procedures on security and confidentiality. Applications are submitted through the Social Sciences and Humanities Research Council, and assessed within Statistics Canada through the SBSD, SM Area, DACS, and the RDC Program divisions. Once access has been granted, Universities provide RDC space and Statistics Canada ensures the site complies with departmental physical security and confidentiality policies. The audit found that researchers conduct their work in restricted physical and technological infrastructures that are secure, which reduces the risk of confidentiality breaches, and no unwanted disclosures were observed. Information handled in RDCs is subject to governmental confidentiality and security requirements.

Infrastructure

Prior to approving the provision of access to Statistics Canada data to RDCs, physical and technological infrastructure of RDCs must meet the security requirements of the department. The universities provide physical sites as well as IT support, Statistics Canada ensures the sites meet the departmental security requirements which are based on the TBS Policy on Government Security. To review the security of the infrastructure, a security inspection checklist has been developed. Inspections include physical security infrastructure items such as site access, locks, and keys; and electronic security infrastructure items such as server access, and passwords. This security inspection checklist is used to ensure departmental security requirements are applied when a new RDC/branch is opened. In summer 2009, the security inspection checklist was reviewed by the Data Access and Control Services Division to ensure that the requirements of the new Policy on Government Security continued to be met. A review of a sample of completed security inspection checklists revealed several forms that were only partially completed; consequently, there was insufficient evidence that complete security inspections were conducted.

The TBS Policy on Government Security referring to the Directive on Departmental Security Management recommends regular security inspections of working sites in order to identify potential security risks. In reality, RDCs have not been re-inspected since their opening, in some cases for the last ten years. After conducting a number of security checks on site, some deviations from security requirements were observed. As an example, the Statistics Canada Security Practices Manual states that "to protect the integrity and data availability of the Agency's information assets, all information should be on servers and network drives that receive daily automatic backup". The audit found that, in some instances, backup storage procedures were not consistently applied as described in the Manual.

The TBS Policy on Government Security states that "A departmental security awareness program covering all aspects of departmental and government security must be established, managed, delivered and maintained to ensure that individuals are informed and regularly reminded of security issues and concerns and of their security responsibilities." Departmental requirement for security training has been enforced through the KLICK security course offered to RDC analysts; however, there was no evidence of mechanisms in place to ensure continued awareness among Statistics Canada analysts since the opening of the centres.

The demand for greater access to data continues to increase. In response, Statistics Canada's program management is examining other means of data access such as remote access and synthetic files as a means to provide improved data access.

Confidentiality

One of Statistics Canada's key values is the preservation of the confidentiality of its data and the respondents. Data handled by RDCs must also meet departmental confidentiality and security requirements. Data requested by researchers is extracted in Headquarters, encrypted on disk and transmitted to RDCs by courier, using confidentiality rules for protected B information. Data is decrypted by the Statistics Canada analyst and installed on the RDC server, which is not connected to a network. Researchers obtain access to Statistics Canada data samples through individual user accounts for each of their research projects. Disclosure guidelines are implemented within the department to avoid publication of protected information to the public. To ensure Statistics Canada information is protected within RDCs, a disclosure analysis process conducted by the Statistics Canada analysts is performed prior to the publishing of results. Researchers submit their information to the analysts, who then review and remove information that could lead to a breach of confidentiality. The audit found that the disclosure process in place for the program is applied rigorously and consistently.

Recommendation No. 3

The Assistant Chief Statistician (ACS) of Social, Health and Labour Statistics should work with Corporate Services to ensure that regular inspections are instituted to ensure infrastructure surrounding the access to data continue to meet requirements of the departmental security policy

Management Response

Agreed. In addition to completeinitial site inspections, the RDC program will conduct regular inspections of all RDCs. The Microdata Access Division has in place a number of procedures to safeguard the physical and electronic security of the centres and their data.

Deliverables:

• Inspector from corporate services will report on the security of RDCs by submitting the completed security checklist - The schedule will start with the first re-inspections of the RDCs in 2011-2012 Fiscal Year. All current RDCs will be re-inspected by 2015-2016.

Appendices

Appendix A: Audit Objectives and their Criteria

Objective 1: The activities supporting the Governance Framework are adequate and effective to ensure that services are delivered to researchers.

Governance and Strategic Direction: Review the adequacy of the management control framework (MCF) of the program including processes and practices related to planning, organizing, controlling, directing and communicating.

• Relationship exists between the strategic plan and the objectives of the programs.
• Roles/responsibilities are defined and communicated through the program.
• A clear organizational structure is established, documented and reporting relationships are effective.
• The values and ethics are promoted among stakeholders.
• There is a communication process in place to communicate program activities.
• There is an effective performance management and accountability framework in place to measure and report on performance.

Risk Management:

• A risk management mechanism should exist to identify, assess, monitor and report on risks.

Investment Management/Funding:

• The current funding planning/budgeting processes are effective. Expected costs are defined and assessed based on expected benefits.

Objective 2: Access to data follows Government and Statistics Canada policies and procedures.

Infrastructure:

• Physical and technological infrastructures are secure.

Information Security and Confidentiality:

• Electronic data access is controlled efficiently.
• Confidentiality is maintained, data are adequately protected.
• Unwanted disclosure is avoided.

Business Continuity Planning:

• Business Continuity should be defined to assure continuity of the operations.

Appendix B: Overview of the RDC Network

Reference: Quadrennial Program Review: 2000 - 2008, page 19.

You can submit your Access to Information or Privacy request online or by mail.

On-line Request

Using the ATIP online Request service, is a faster, easier and more convenient way to submit access to information or privacy requests. Apply online today to save time and postage.

Mailing your Request

Although forms exist for the submission of both access to information and privacy requests, using these forms is not required. You may submit your request in the form of a letter as long as you clearly explain what information you are seeking and under which Act.

There are no fees associated with privacy requests. Access to information requests must be accompanied by a nonrefundable $5 application fee as prescribed by Section 7(1)(a) of the regulations of the Act. Payment may be in the form of a cheque or money order made payable to the Receiver General of Canada or cash.

Before you make a Request

Please note that this is not a service to request statistical information. For statistical information, please contact Statistics Canada's Statistical Information Service by telephone at 1-800-263-1136 or by e-mail at infostats@statcan.gc.ca. The statistical information may already be published or available for purchase by the public and is excluded under the Access to Information Act.

If you are unsure whether your request would be considered an Access to Information Request or a statistical information request, please consult with the Statistics Canada Access to Information and Privacy Coordinator by email at statcan.atip-aiprp.statcan@statcan.gc.ca before you submit your request.

If you want information about Census and/or the 1940 National Registration, you may go directly to this link "Application and Authorization".

Access to Information Request Form

Personal Information Request Form

Please send your request to

Pierre Desrochers
Chief Privacy Officer
Office of Privacy Management and Information Coordination
Statistics Canada
R.H. Coats Building, 2^nd floor
100 Tunney's Pasture Driveway
Ottawa, Ontario K1A 0T6

If you need assistance, contact us using one of the following:

Email address: statcan.atip-aiprp.statcan@statcan.gc.ca
Phone: 613-894-4086

Principles for assisting applicants

In processing your access request under the Access to Information Act, we will:

1. Process your request without regard to your identity.
2. Offer reasonable assistance throughout the request process.
3. Provide information on the Access to Information Act, including information on the processing of your request and your right to complain to the Information Commissioner of Canada.
4. Inform you as appropriate and without undue delay when your request needs to be clarified.
5. Make every reasonable effort to locate and retrieve the requested records under the control of the government institution.
6. Apply limited and specific exemptions to the requested records.
7. Provide accurate and complete responses.
8. Provide timely access to the requested information.
9. Provide records in the format and official language requested, as appropriate.
10. Provide an appropriate location within the government institution to examine the requested information.

Introduction

NAPCS Canada 2012 Version 1.1 updates NAPCS Canada 2012 Version 1.0. In total, there are 271 changes between the two versions. Some categories were split, and others were merged. New categories were incorporated, and some were deleted, for a net addition of 65 product categories at different levels, providing better alignment with survey data collection and publication. In some instances, these modifications created the need to renumber codes. These changes account for about half of the update. The remaining changes relate to editing of class titles adding precision to their formulations. The detailed list of changes can be obtained from Standards Division at standards-normes@statcan.gc.ca.

Standard classification structure

The standard classification structure of NAPCS Canada 2012 comprises four levels: group, class, subclass, and detail. The table below outlines the nomenclature and provides the number of categories within each level of NAPCS Canada 2012 versions 1.1 and 1.0.

Classification variants

Along with NAPCS Canada 2012 Version 1.1, two new regrouping variants are made available: one for the Industrial Product Price Index (IPPI) and one for the Raw Materials Price Index (RMPI). These variants add one level (section) above the standard classification structure; this new level is defined in terms of standard groups (three-digit). The tables below illustrate the nomenclature of the IPPI and RMPI variants and provide the number of categories within each level.

At the time of publishing this note, the plan is to create two regrouping variants for capital expenditures and one extension variant for agricultural products.