Statistical information is used to:

• analyze economic performance
• develop fiscal, monetary, and foreign exchange policies
• shape international tariffs and trade negotiations
• develop policies and programs to assist small businesses
• support policy development and evaluate government programs on economic and social well-being
• improve allocation of government program funding by determining their social and economic effects
• support the regulatory and legislative requirements of government;
• draw electoral boundaries
• determine equalization payments and other federal-provincial fiscal transfers
• adjust inflation-indexed contracts and entitlements
• develop programs to promote domestic and international competitiveness
• support immigration policies and programs
• support tourism strategies and programs
• assess the cost-effectiveness of health care and education programs
• monitor the justice system's effectiveness and efficiency
• select sites for schools and public transportation
• develop programs such as day care and subsidized housing.

Statistics Canada's stakeholders include

• The Canadian public and media
• Government
• Businesses and labour unions
• The academic sector
• Foreign and international bodies
• Other client groups

The Canadian public and media

Statistics Canada's basic information on the Canadian economy and society—economic growth, employment, inflation, balance of payments, population, family income, health, education, justice and many other topics—is communicated to the public largely through the media.

Government

Federal, provincial, territorial and municipal governments use our data extensively to develop policies and plan the services from which Canadians benefit every day. These may be social services, education, public transit, urban planning or employment and work force training programs. Governments, like people and businesses, are major data users as well as suppliers.

Businesses and labour unions

Businesses and labour unions are important sources and users of the Agency's information. Reducing the burden of surveys on the business community continues to be an important factor in the design of statistical programs. Many communication channels are maintained with this sector, including close collaboration with small businesses.

The academic sector

For both research and teaching purposes, the academic sector is a significant user of Statistics Canada data. It is also a prime source of advice to the Agency.

Foreign and international bodies

Statistics Canada maintains extensive contacts with international, scientific and intergovernmental organizations, to share professional expertise and to promote common concepts, standards and practices.

Canada's membership in international organizations, such as the United Nations and the Organisation for Economic Cooperation and Development, requires that the Agency's outputs meet international standards, ensuring that Canadian data continue to be comparable with those of other countries. Links to many of these organizations can be found at External links.

Other client groups

There are many other users of Statistics Canada's data whose interests are taken into account, such as regional and local governments, libraries, professional associations, research institutes, special interest and voluntary groups.

An interpretation policy is an overarching document that outlines the commitments, practices, and tools to be applied by a department or agency when providing Canadians and businesses with information and guidance on regulatory obligations to be met. It also identifies the conditions under which written responses to questions will be provided.

• Departmental/Agency context
• Predictability
• Service
• Stakeholder engagement
• Improvement
• Frequently asked questions

Departmental/Agency context

Statistics Canada, a member of the Innovation, Science and Economic Development portfolio, produces statistics that help Canadians better understand their country—its population, resources, economy, society and culture.

Under the Statistics Act, the Agency is required to "collect, compile, analyse, abstract and publish statistical information relating to the commercial, industrial, financial, social, economic and general activities and conditions of the people of Canada.” Statistics Canada conducts the Census of Population and the Census of Agriculture and about 350 surveys on virtually all aspects of Canadian life.

In addition to the Statistics Act, the Chief Statistician of Canada under the authority of the Minister of Industry administers the Corporations Returns Act.The purpose of the Corporations Returns Act is to collect financial and ownership information on corporations conducting business in Canada and to use this information to evaluate the extent and effect of non-resident control of the Canadian corporate economy. The Corporations Returns Act requires that an annual report be submitted to Parliament summarizing the extent to which foreign control is prevalent in Canada.

Statistics Canada is responsible for only one regulation: the Corporations Returns Regulations. These regulations outline the reporting requirements and the various reporting thresholds for the Corporations Returns Act.

Predictability

Plain language commitment

Statistics Canada is committed to communicating with Canadians and businesses in a clear and effective manner. As articulated in the Communications Policy of the Government of Canada, to ensure clarity and consistency of information, plain language and proper grammar are used in all communication with the public. At Statistics Canada, guidance and support on this matter are provided by the Agency's Communications Division.

Correspondence with the public related to the Corporations Returns Act, such as introductory and follow-up letters, are reviewed by communications specialists prior to implementation. In addition, as required by Statistics Canada's Policy on the Review and Testing of Questionnaires, survey forms, questionnaires and schedules are reviewed by the Agency's Questionnaire Design Resource Centre to ensure they are well understood by respondents and written at the appropriate literacy level.

Providing guidance and building awareness

Statistics Canada uses several different tools and approaches to help build awareness and understanding of the regulatory requirements of the Corporations Returns Regulations.

On the Agency's website under the module 'Information for Survey Participants', Canadians and businesses can find information on all surveys conducted by Statistics Canada including information on the Information for Survey Participants - Corporations Returns Act.

In an information package sent to respondents, the Agency includes a user guide which explains the regulatory requirements of the Act, provides instructions on how to complete the forms, and lists contact information.

Finally, Statistics Canada takes a proactive approach in determining who should be reporting information required by the Corporations Returns Act. To assist corporations in fulfilling their responsibilities under the Corporations Returns Act, the Agency uses administrative data and internal survey data to identify which corporations need to report. These corporations are then contacted by Statistics Canada and provided with the necessary forms to be filled out. This proactive approach helps to ensure corporations are able to meet their obligations under the Corporations Returns Act.

Responding to questions

Statistics Canada has established a centralized unit to respond to questions related to the Corporations Returns Act and the Corporations Returns Regulations:

Statistics Canada
C/O Industrial Organization and Finance Division
170 Tunney’s Pasture Driveway
Ottawa ON K1A 0T6

statcan.corpreturnsact-loidpm.statcan@statcan.gc.ca

1-866-825-5957
613- 951-9858

All requests are responded to in accordance with the Agency’s Standards of Service to the Public, and in the manner (by email, letter, telephone call, etc.) requested by the client.

Service

Service commitment

Statistics Canada is committed to providing Canadians and businesses with excellence in service. Requests received from the public are treated in a prompt, reliable, courteous and fair manner. The Agency has established centres of expertise, such as Advisory Services and the Enterprise Portfolio Management Program, to support service requests.

All requests by Canadians and businesses are responded to in accordance with the Agency's established Standards of Service to the Public.

Service accountability

As part of Statistics Canada's efforts to efficiently manage its relationships with businesses, the Agency established the position of an Ombudsman for businesses.

The role of the Ombudsman for businesses is to investigate complaints from business survey respondents, including respondents under the Corporations Returns Act, who believe they are unduly burdened or have been treated unprofessionally by Statistics Canada. The Ombudsman's services are impartial and free of charge.

Business survey participants can contact the Ombudsman for businesses by calling at 1-855-634-236 or 1-800-263-1136 or by emailing statcan.ombudsman-ombudsman.statcan@canada.ca.

Staff training

An ongoing training program ensures Statistics Canada officials have the necessary skills and technical knowledge to provide quality service and accurate regulatory guidance. This training encompasses both subject specific training related to the Corporations Returns Act as well as client service related training.

Stakeholder engagement

Commitment to stakeholder engagement

Stakeholder engagement and consultation are long-standing practices of Statistics Canada. This open and inclusive engagement helps to identify concerns, minimize implementation burden, test and improve solutions and facilitate understanding.

When exploring potential changes to the materials which provide information and guidance on the Corporations Returns Act, including how they are delivered, Statistics Canada actively engages stakeholders to obtain their feedback.

Stakeholder engagement mechanisms

To effectively engage stakeholders in the development and review of regulatory information and guidance, Statistics Canada may use a number of vehicles. These include focus groups, direct consultation with a sample of stakeholders and online response mechanisms.

Improvement

Statistics Canada is committed to working with the Treasury Board Secretariat and the Community of Federal Regulators to improve its interpretation policy services and tools and will continue to liaise with clients and stakeholders on regulatory requirements.

For the collection of information under the Corporations Returns Act, Statistics Canada proactively identifies and contacts businesses which should be adhering to the regulation. The Agency sends a letter of invitation which includes links to guidance materials, Q and As, etc. Respondents are asked to complete and return forms, and to contact the Agency if clarification or assistance is required. The Agency gathers feedback through the comment sections on the paper and electronic questionnaires (EQ) as well as through direct requests for information received by phone, e-mail and regular mail. Statistics Canada uses this feedback to improve its documentation and processes on an ongoing basis.

For the collection period which began in January 2015, the Agency received feedback which was used to improve the way information is collected under the Corporations Returns Act. In particular, the following items related to the Agency's interpretation practices/materials were identified:

• a new user guide specifically for EQ
• additional question-level help for EQ
• additional FAQs responding to specific questions on the scope of the regulation.

Statistics Canada has implemented the following items:

• a new user guide specifically for EQ. The use of EQ allows Statistics Canada to pre-fill a significant portion of the questionnaire. This reduces respondent burden and it also requires that respondents are provided with more focused guidance when completing EQ. The new user guide incorporates this more focused guidance and will provide considerable assistance to Statistics Canada's EQ respondents.
• additional question-level help for EQ. Statistics Canada is providing respondents with additional background on the questions asked in order to facilitate the completion of electronic questionnaires. This new resource is in keeping with Statistics Canada's long-standing commitment to maintaining positive respondent relations. Question-level help is found on Schedule I - Ownership Corporations Returns Act.
• It was determined not necessary to develop additional FAQs. This decision was taken in light of the positive feedback received following the success of Statistics Canada's conversion to the EQ format. All FAQs relating to information collection under the Corporations Returns Act are available on the Information for survey participants — Corporations Returns Act — Frequently asked questions

To measure the effectiveness of these changes, Statistics Canada will systematically monitor feedback through the channels noted above to ensure issues specific to the improvement items decrease in number.

Metrics for evaluating implementation:

• Number of inquiries related to the use of EQ
• Number of inquiries related to the scope of the regulation.

Frequently asked questions

The questions below are meant to provide Canadians and businesses with basic information about Statistics Canada's regulations.

The following list will be updated periodically to reflect any new recurring enquiries.

Corporations Returns Regulations

1. What is the purpose of this regulation?

1. What is the purpose of this regulation?

The Corporations Returns Act mandates Statistics Canada to collect information on ownership and control of Canadian businesses for the purpose of determining the level of foreign control in the Canadian economy.

The purpose of the Corporations Returns Regulations is to inform Canadians and Canadian businesses on how the Corporations Returns Act is applied. The Corporations Returns Regulations describe the current financial thresholds under which Canadian businesses are required to file returns containing the information set out in sections 4 and 5 of the Act. This regulation also provides the required forms, Schedule I – Ownership Return and Schedule II – Financial Information.

2. What are the key elements of this regulation?

2. What are the key elements of this regulation?

The Corporations Returns Regulations cover three key elements:

• the financial thresholds,
• the schedules (I & II), and
• the timeline for filing the information.

Canadian businesses are required to file returns if they have:

• assets of 600 million dollars or more; or
• revenues of 200 million dollars or more; or
• debt obligations or equity owning to non-residents of 1 million dollars or more.

Schedule I – Ownership Return is the key component of this Act. The information collected in this return relates to the share capital of the corporation, ownership of the share capital, its directors and officers and its subsidiaries.

Schedule II – Financial Information is a secondary component that must only be filed if such information has not already been provided to Statistics Canada or the Canada Revenue Agency. The information collected in this return relates to financial statements details such as assets, liabilities, operating revenues and expenses, dividends, depreciation and investments.

Businesses have 90 days following their fiscal year end to file the returns.

3. How does this regulation affect Canadian businesses?

3. How does this regulation affect Canadian businesses?

Every individual business that is part of a group of commonly controlled businesses is required to file a Schedule I – Ownership Return if they meet one of the following criteria:

• Has combined assets of 600 million dollars or more; or
• Has combined revenues of 200 million dollars or more.

In addition, individual business with debt obligations or equity owning to non-residents exceeding 1 million dollars are also required to file a Schedule I – Ownership Return.

Furthermore, Canadian businesses that have not filed a set of financial statements with Statistics Canada or filed their income taxes with Canada Revenue Agency, are required to file a Schedule II – Financial Information Return, regardless of their assets, revenues or debt obligations or equity owing to non-residents.

4. What is the timeline for implementation?

4. What is the timeline for implementation?

The Corporations Returns Act and the associated regulations are currently in effect.

The Corporations Returns Act, formerly known as the Corporations and Labour Unions Returns Act, was first introduced in 1962 to address concerns of rising foreign control. Since that time, Statistics Canada has prepared annual reports to Parliament monitoring the state of foreign control in the Canadian economy. In January 1999, Parliament officially amended the Act, deleting the requirement of labour unions to report under the Act.

In January 2014, the Corporations Returns Regulations were made by the Governor in Council, and replaced the Corporations Returns and Labour Unions Regulations. These regulations set the new reporting thresholds, renumbered the schedules, and aligned the regulations with the Act. The regulations will be reviewed on a periodic basis to ensure the thresholds and reporting requirements remain valid.

5. Where can I get more information?

5. Where can I get more information?

• Corporations Returns Act
• Corporations Returns Regulations
• Corporations Returns Act - Foreign Control in the Canadian Economy - Annual Report to Parliament

Information can be obtained by contacting Statistics Canada at:

Statistics Canada
C/O Industrial Organization and Finance Division
170 Tunney's Pasture Driveway
Ottawa ON K1A 0T6

statcan.corpreturnsact-loidpm.statcan@statcan.gc.ca

1-866-825-5957
613- 951-9858

6. Additional Frequently asked questions (FAQs)

6. Additional Frequently asked questions (FAQs)

Information for survey participants — Corporations Returns Act — Frequently asked questions

This figure depicts the 2011 Census Field Structure. It is the shape of a pyramid.

Starting at the bottom and moving upwards there are the:

• Statistics Act Employees:
  • Enumerators (30,000)
  • Crew Leaders (including recruitment crew leaders) and assistants (2,500 CL, 2,500 assistants)
  • Field Operation Supervisor Assistants (300)
• PSEA (Public Service Employment Act) Employees:
  • Field Operation Supervisor Supervisors (300)
  • Assistant Managers Field Operations (including First Nations enumeration managers and Collective dwelling enumeration managers)(45)
  • Local Census Office Managers (37)
  • Area Managers (including special population area managers)(14)
  • Assistant Directors - census (5)

Final audit report
Confidentiality of Sensitive Statistical Information

Internal Audit Services
September 30, 2009

Executive Summary
Introduction

• Background
• Authority
• Audit Objectives
• Scope and Approach
• I – Physical access controls
• II – Electronic access controls
• III – Personnel controls
• IV – Operational controls

Appendix A - Audit Criteria
Appendix B - Acronyms

Executive summary

Statistics Canada is committed, and legally required, to protect the confidentiality of sensitive statistical information entrusted to the agency under the Statistics Act. It is crucial for the agency to develop and maintain a trust relationship with survey respondents in order to be able to deliver its mandate successfully, and provide Canadians with statistical information of high quality. Confidentiality is the affair of everyone in the organization.

The objective of this audit was to assess whether controls are in place and are effective to protect the confidentiality of sensitive statistical information including:

• physical access controls,
• electronic access controls,
• personnel controls, and
• operational controls

The controls were examined both at the departmental and selected survey levels.

The audit was conducted by Internal Audit Services in accordance with the Government of Canada’s Policy on Internal Audit.

The audit found that the controls protecting the confidentiality of sensitive statistical information are adequate. Opportunities exist to advance the risk management practices in two areas; however this does not affect the overall assessment. These areas include physical and electronic access controls. Additionally, a divisional best practice was identified.

Physical access controls are satisfactory, but some weaknesses have been identified. Opportunities exist to improve the risk management practices related to securing work areas beyond the baseline level. Also identified were: a postcard type questionnaire requiring confidential information from respondents that is mailed in an open fashion, creating confidentiality issues; the security practices of field interviewers need to be tightened; and divisional employees working in an environment, secured beyond the baseline level, do not lock up confidential information after work hours.

The audit found that electronic access controls contain some weaknesses, and that opportunities exist to strengthen the control framework. The required encryption program to protect the confidentiality of data is not installed on all portables. Managerial monitoring of access rights and permissions to workstations and servers should be improved.

A best practice was observed within the Labour Statistics Division and is worthy of consideration by other divisions. Electronic access rights in the division are closely monitored and reviewed continuously.

The audit found that personnel and operational controls are effective.

Introduction

Background

The confidentiality of sensitive statistical information is a key value and a legal necessity at Statistics Canada (StatCan)¹. In 2005, a middle management task force was created to recommend measures that would enhance and strengthen the culture of confidentiality within Statistics Canada. The task force made recommendations to increase awareness of risks and responsibilities, and to promote and improve good security practices.

Statistics Canada's mandate derives primarily from the Statistics Act. The Act requires that the Agency collect, compile, analyse and publish statistical information on the economic, social, and general conditions of the country and its citizens. Statistical information is crucial as it enables Canadians to make informed decisions and governments at all levels to develop appropriate policies. Survey respondents range from Canadian households to private and public organizations. Most business surveys require mandatory participation, whereas most of the agency’s household surveys are voluntary (exceptions are the Census of Population and the Labour Force Survey). It is crucial for the agency to develop and maintain a trust relationship with survey respondents in order to deliver its mandate successfully, and provide Canadians with statistical information of high quality. Safeguarding the information provided in confidence is vital, since it is the key factor for obtaining respondents’ cooperation.

Personal and business information is collected using various methods: paper questionnaires, in-person and telephone interviews conducted by agency personnel, electronic data reporting by respondents, and administrative sources. Information collected outside headquarters’ premises is transferred to Ottawa for centralized processing, analysis, and dissemination by different survey and service areas. In addition to agency employees, other external parties also have access to sensitive statistical information under strict conditions described in the Statistics Act. Examples are provincial statistical agencies, sponsoring federal departments, and university researchers. The confidentiality of sensitive statistical information must be protected throughout these various modes, locations, and processes.

The control framework is multi-layered. The first level is the Statistics Act which protects respondents’ information. To support the Act, the agency has put in place a number of policies and practices to manage risks of unauthorised access, loss, theft, disclosure, copying or use of sensitive information. Policies in place include: the Policy on the Security of Sensitive Statistical Information, the Policy on Microdata Release, the Discretionary Release Policy, the Policy on Record Linkage, the Policy on Informing Survey Respondents, the Policy on the Use of Deemed Employees, and the IT Security Policy. Furthermore, Statistics Canada’s Security Practices Manual provides more detailed and complementary information to agency policies and the Government Security Policy. A number of management committees with mandates related to security are also in place: the Confidentiality and Legislation Committee and its Microdata Release Sub - Committee, the Informatics Committee, and the Security Coordination Committee. Finally, the Data Access and Control Services Division provides advice to managers, and serves as the focal point for matters relating to the confidentiality of statistical information.

During the conduct of the audit, Statistics Canada hired a consulting firm to conduct a Threat and Risk Assessment of access to buildings, and to recommend options for the replacement of the existing technical access control system which had been in place since 2002. This assessment did not include the regional offices. The firm presented a report in July 2007 which included a number of recommendations. This document served as additional reference material for the audit.

Authority

The audit was undertaken by the Internal Audit Services, and the Terms of Reference were approved by the Internal Audit Committee on March 28, 2007. The audit was conducted in accordance with the Government of Canada’s Policy on Internal Audit.

Audit Objectives

The objective of this audit was to assess whether controls are in place and are effective to protect the confidentiality of sensitive statistical information including:

• physical access controls
• electronic access controls
• personnel controls, and
• operational controls

The controls were examined both at the departmental and selected survey levels.

The table found in Appendix A provides a summary of the audit criteria used. These were selected during a pre-planning review with StatCan management, based upon potential risks, and an understanding of the management control framework, Statistics Canada operational requirements, and previous reviews and/or audits.

Scope and Approach

There are three buildings at head office in Ottawa, and three regional offices with satellite offices attached to them. The scope of the audit included an assessment of the three buildings at head office, one regional office ( the Eastern Regional Office in Montreal), and one of its satellites (Sherbrooke).

When the Terms of Reference were approved in March 2007, the Government Security Policy referred to sensitive statistical information as "protected B". This included:

• data obtained directly from respondents or from third parties in identifiable mode under the authority of the Statistics Act;
• data holdings stripped of identifiers but held in a detail or geographical structure or format which could permit a direct relation to be established between such data holdings and identifiable units;
• official statistical information in the pre-release stage.

During the course of the audit, it was determined that paradata² was included in the above. This change was taken into account during this audit.

Due to operational reasons, official statistical information in the pre-release stage and statistical information in research data centres were not included in the scope. Some of these areas will be covered by other audits found in the 2008-2009 / 2010-2011 Risk-Based Audit Plan.

The audit was designed to gather data on the measures actually used to safeguard the confidentiality of sensitive statistical information, and employees’ awareness of the importance of that confidentiality. The audit was conducted at the departmental level, and at specific survey levels. Five surveys were selected, taking into consideration the collection method, collection period, survey periodicity, and survey type. They were the International Travel Survey, the Labour Force Survey, the National Longitudinal Survey of Children and Youth, the Survey of Environmental Protection Expenditures, and the Trucking Commodity Origin and Destination Survey.

The work included:

• Conducting personal interviews with all levels of employees in the various divisions at Head Office which were involved directly with the surveys selected, or that provided the agency with central services associated with the security of sensitive statistical information;
• Conducting personal interviews with all levels of employees at the Montreal Regional Office and the Sherbrooke Call Centre;
• Reviewing electronic and paper files, including testing of electronic data access and encrypted laptops;
• Conducting a sweep (physical inspection) of the Head Office locations most likely to have sensitive statistical information from the five surveys; and
• Analyzing the results of a questionnaire sent to a sample of 59 interviewers, representing all three regional offices.

Findings, Recommendations and Management Responses

I – Physical access controls

Physical access controls include: access to buildings is restricted; access to secured areas within the premises is restricted; information is physically transmitted to, within, and outside StatCan according to approved standards; information is stored, marked and disposed of according to approved standards; physical access to servers and mainframe is restricted; and repair of computer equipment is carried out on StatCan premises by StatCan employees.

The physical access controls were working as intended. Building entrances are secured and information is kept confidential; however, opportunities exist to advance the risk management practices relating to the confidentiality of statistical information. Improving the effectiveness of the confidentiality framework requires management to focus on secured work environments and the safety of information.

Buildings are secure but secured areas within require directives

Statistics Canada’s building access controls, including those at Head Office, the Montreal regional office, and the Sherbrooke location, are effective. The system of controls includes gates, guards and video cameras, including a new security and camera system installed at Head Office in 2008, to enhance monitoring in the buildings.

The audit found that the requirements of Statistics Canada’s policy on Security of Sensitive Statistical Information are met; however, the agency is not compliant to the criteria outlined in paragraph 10.7 of the Government Security Policy relating to safeguard beyond the baseline level³. This paragraph states that "Departments must conduct ongoing assessments of threats and risks to determine the necessity of safeguards beyond baseline levels. They must continuously monitor for any change in the threat environment and make any adjustment necessary to maintain an acceptable level of risk and a balance between operational needs and security". The audit team did not find any monitoring or assessments of threats and risks to support this requirement.

Instances of controls beyond the baseline level were identified, but they are random decisions rather than risk based. For example, secured areas in the Main building are the results of other tenants occupying the premise. Additionally, the decision to secure access to divisions in the other buildings is primarily made by the director, based on perceived risks and funds available. Some areas may be facing higher risks but may not have a secured access.

As an additional control to complement secured areas with baseline level secured entrances, employees are asked to challenge unknown people in their work areas. This control might be effective in small work areas; however, in a building such as the Jean Talon where floors are large and are shared by many divisions with no recognizable perimeter between them, this control has its limitations.

Two divisions handling surveys in our sample did not have secured entrances within the building. The Labour Force Survey (LFS) was in final processing mode during the sweep that we conducted. Additionally, the Survey of Environmental Protection Expenditures was not in production, therefore it was challenging to assess whether a secured work area was necessary. In both cases, a threat and risk assessment to determine the necessity of safeguards beyond the baseline levels would be helpful to advance the risk management practices.

The agency should determine the baseline level of security required in relation to the sensitivity of data holdings. A threat and risk analysis should then be conducted to determine zones exposed to greater risks and requiring enhanced security beyond the baseline level. Based on the threat and risk analysis, areas not at high risk would continue to be protected by baseline security.

The agency faces a situation where an incident could have a significant impact. With the absence of agency guidelines on what areas should be secured beyond the baseline level, and the lack of an integrated approach to managing risks emerging from visitors, employees, other tenants, and potentially contractors, the agency exposes itself to greater confidentiality risks that could lead to loss of reputation. Considering the very high number of people working within the complex, there is a risk that someone could have unauthorised access to an area secured at the baseline level, and to sensitive statistical information.

Recommendation #1

The Assistant Chief Statistician, Corporate Services Field, should ensure that Data Access and Control Services Division (DACS) develop corporate guidelines to ensure a common approach across the agency, and assist the Policy Committee⁴ through the Security Coordination Committee, in determining the high risk zones by performing threat and risk assessments periodically.

Management Response and Action Plan

Management accepts the recommendation.

DACS proposes a corporate approach to establishing a standard for access control using the "progressive security zones", as per the Policy on Government Security. The standard would be used to approve additional access control devices.

This proposal will be presented to the Security Coordination Committee in the fall.

Deliverable and timeline:
Presentation of directives to the Security Coordination Committee
Results will then be presented to the Policy Committee
Director, Data Access and Control Services – Fall 2009

Safety of information

Sensitive information is physically transmitted inside and outside Statistics Canada according to approved standards, but the audit team found two issues requiring specific attention.

A "postcard" type questionnaire used by the International Travel Survey (ITS), which respondents are asked to mail once completed, is a confidentiality risk. ITS divisional employees ask respondents to complete and mail the postcard. On the postcard, it says "Confidential once completed". This process is ambiguous at best, and does not project an image of discipline and rigour when transmitting information deemed confidential. If this peculiar situation is noticed by the Canadian public, and specifically by the press/media, Statistics Canada’s reputation may be tarnished. The risk is that our respondents may perceive that we do not treat confidentiality with the attention it requires.

It is also expected that sensitive statistical information should be locked up after working hours. An audit test consisting of a sweep of selected areas was conducted after hours on January 28 and 31, 2009. The intent was to determine whether confidential material was locked up using approved containers and locks, and to ensure that keys to containers and locks were properly secured. Usage of A/B switches, and of personal digital assistants, was also verified to ensure compliance with policies.

The sweep results demonstrated that the Operations and Integration Division, which is a secured area with restricted access, was not in compliance with the expectation of adequate storage of sensitive statistical information at the end of the work day.

Management indicated that the area is secured with restricted access, and that storing all sensitive statistical information at the end of each day would be time consuming and counterproductive. Should access to the secured area be breached, there would be no mitigating controls to secure the information. In addition, within the secured area, information should only be made available on a "needs to know" basis. Management of the area is working on an implementation plan that would see the paper questionnaires scanned, with only the electronic version circulating afterwards.

Field interviewers receive strict written directives from Statistics Canada regarding the handling of confidential material such as questionnaires, laptops, and address lists, when working outside the home, and regarding the securing of this material at home. To assess the directives, the audit team conducted a survey of field interviewers. The survey results indicated that field interviewers, when outside the home, ensured the confidentiality and security of material effectively; however, the survey results also indicated that 50% of field interviewers do not lock up their material at home when completing their work day.

Re-enforcement of directives and enhanced attention is required with regards to the storage of confidential material in the home of field interviewers. Loss of sensitive statistical information by field interviewers would affect the confidence of respondents in Statistics Canada, and could prevent the department from attaining its objective.

Recommendation #2

The Assistant Chief Statistician, Social, Health and Labour Statistics Field, should ensure that the Tourism and the Centre for Education Statistics Division, in conjunction with Data Access and Control Services Division, find a solution to the visible discrepancy found on the International Travel Survey postcard.

Management Response and Action Plan

Management accepts the recommendation.

TCESD agrees that "confidential once completed" on the postcard questionnaire is illogical. Since there is no identifiable information on the completed questionnaire, we agree to drop this wording. Furthermore, the issue will disappear with the current redesign of the survey, as we will get rid of the postcard questionnaires.

Deliverable and Timeline:
Revised questionnaire
Assistant Director, Tourism and Centre for Education Statistics Division – August 2010

Recommendation #3

The Assistant Chief Statistician, Census and Operations Field, should ensure that regional office management increase the awareness of field interviewers regarding the importance of the confidential material in their possession as well as their accountability and consequences.

Management Response and Action Plan

Management accepts the recommendation.

We will revise our documentation and interviewer training materials concerning the importance of protecting documents/confidential information, and the various mechanisms to be introduced for this purpose. Accordingly, we will adjust the content of the training manual to reflect what is set out in the Code of Conduct.

When new employees receive basic training, supervisors or managers will ensure that everyone has a good understanding of his/her roles and responsibilities, as an interviewer or senior interviewer, in Statistical Survey Operations relating to confidentiality, protection of information, and security.

Using various means of communication (pamphlets, meeting with employees, etc.), we will further emphasize the importance of confidentiality and data security to employees, and reinforce their accountability with respect to managing information in the collection process.

Deliverable and Timeline:
Reinforcement of confidentiality of information
Revision of our guidelines and preparation of an action plan
Director, Regional Management Services Division - Fall 2009

Implementation
Regional Directors - Winter 2010

Recommendation #4

The Assistant Chief Statistician, Census and Operations Field , should ensure that Operations and Integration Division store the confidential material at the end of the day.

Management Response and Action Plan

Management accepts the recommendation.

OID is in the process of removing the risk for paper questionnaires by moving our imaging equipment to a secured room, with the plan to image all questionnaires at this entry location. Paper questionnaires would then be moved to secure storage until they can be disposed of appropriately. The equipment is to be moved the fall of 2009, and a schedule for converting all paper surveys to digital images will be prepared. This process should be completed within 1 year. All access to questionnaires will be via digital images in the content management system FileNet where access is tightly controlled.

Deliverable and Timeline:
Digital images of all questionnaires
Director, Operations and Integration Division - September 2010

II – Electronic access controls

Electronic access controls include: workstations and servers are configured with access controls; information is transmitted electronically within and outside Statistics Canada according to approved standards; storage of information on removable storage media follows ITSD approved security procedures; information is processed, stored, accessed or transmitted only on Network A; all portable computers have full storage encryption approved by ITSD; and computers are sanitized before disposal using ITSD approved methods.

The audit team observed that workstations and servers have electronic access controls maintained by the Informatics Technology Services Division (ITSD); however, monitoring performed by the divisions to grant or remove permissions is performed sporadically. Furthermore, the audit found that only 75% of non-interviewer laptops had the approved encryption program installed.

Workstations and servers have access controls

ITSD electronically maintains access to workstations and servers; however, the authority to grant and/or remove accesses is the responsibility of the divisional directors. The audit team observed that the managerial monitoring to grant or remove access permissions to workstations and servers vary from one division to the next. Consequently, the monitoring of electronic access to workstations and servers is performed sporadically.

The process for granting permissions is efficient, and runs well. Improvements are required in the removal of permissions when access is no longer required. In most cases, those responsible for removing access rely on the employees who originally asked for access to inform them of changes. Controls are effective for employees leaving their division, but the controls become ineffective for service area users, and other users from outside the division. Management monitoring, consistent with processes in place for the Labour Force Survey (LFS – identified further in this section), would improve the monitoring and risk management of confidential files.

The audit team identified a best practice within the LFS management of access rights. LFS managers assess the electronic files according to risks and confidentiality. Very few employees have access to the most confidential files. To gain access, a request must be submitted through the case management system, and an authorization form signed by the director is required. Upon submitting the request, a password to access the files is issued. Permissions to access the LFS confidential files are given for a three month period, and monitoring of access rights to servers is performed continuously.

Recommendation #5

The Assistant Chief Statisticians, Corporate Services Field and Informatics and Methodology Field should ensure that:

• Data Access and Control Division, in conjunction with Informatics Technology Services Division, issue clear guidelines relating to the sensitivity of data and the management of permissions to access servers/shared folders;
• Informatics Technology Services Division will continue to grant and remove access when requested to do so, and to develop tools to further automate this process.

All the Assistant Chief Statisticians must ensure that the guidelines are implemented.

Management Response and Action Plan

Management accepts the recommendation.

Divisional directors are responsible for the implementation of the need to know principle regarding file access. DACS, in collaboration with ITSD, will develop a set of guidelines regarding file access management. DACS will communicate these guidelines to divisional directors. This should be completed by the end of December 2009.

ITSD will continue to grant and remove access to servers and shared folders as per the divisional requests.

ITSD will automatically reset permissions and group access when an employee changes division.

Deliverable and timeline:
Guidelines sent to divisional directors – December 2009
Director, Data Access and Control Division
Director, Informatics Technology Services Division

Installation of Encryption Programs on Portables

Statistics Canada has a directive to have an encryption program installed on all portables. The audit team expected to find the ITSD approved encryption program (Pointsec technology) installed on all portables.

During the conduct of interviews with the LAN administrators and departmental IT security, the auditors were informed that most portables had the encryption program installed. A further audit test was conducted on a judgmental sample of portables. The test results indicated that the majority of portables in the sample had the encryption program installed. Further interviews were conducted with representatives of the departmental IT security; additionally, a comparison of the departmental portable key file with AMMIS (the inventory system) was performed. The results indicated that only 75% of non-interviewer portables have the program correctly installed. It should be noted that all interviewer portables have the encryption program installed. The auditors verified if the encryption program could be deactivated by the employees. The test results demonstrate that the encryption program cannot be deactivated or removed by the employees. IT security has sent an e-mail to directors asking for their support in this matter.

A breach of confidentiality may occur should a portable without an encryption program and containing confidential information be lost.

Recommendation #6

The Assistant Chief Statistician, Informatics and Methodology Field, should ensure that Informatics Technology Services Division security monitor the progression of the installation of the Pointsec technology on laptops, and report the results to the Security Coordination Committee on a quarterly basis until full compliance is achieved.

Management Response and Action Plan

Management accepts the recommendation.

The Statistics Canada laptop inventory can be divided into two broad categories: Those for use by interviewers in the field, and non-interviewer laptops. The interviewer laptops are managed and maintained by Collection and Planning Management Division (CPMD); and as part of their deployment process, all the laptops are encrypted.

Non-interviewer laptops are maintained by the ITSD Enterprise Desktop Support Section (EDSS). As of July 2009, 84% of these laptops were reported compliant and had their encryption recovery file recorded in ITSD. As for the remainder of the laptops, they are either not encrypted, or they are encrypted and their encryption recovery file simply had not been reported. The following action plan is proposed to address those.

The general tasks include locating each of the laptops, making sure they are encrypted, and copying over the recovery file. The AMMIS system will be used to identify the active laptops. The ITSD EDSS group will work with each Field, and identify a Field representative that will be responsible for ensuring compliance. Reports will be provided to Field representatives to monitor progress.

The Director of ITSD will report to the Security Coordination Committee on a quarterly basis on the progress made on compliancy.

Deliverables and timeline:
Monitoring reports for Field representatives – December 2009
Quarterly report to Security Coordination Committee - Ongoing
Director, Informatics Technology Services Division

III – Personnel controls

Information on confidentiality is regularly communicated to all employees.

Statistics Canada uses a variety of methods to promote security and confidentiality of statistical information. These include training, manuals, e-mails, articles in the @statcan, special events, and posters. The audit team found that the methods used to communicate to departmental and Regional Operations Branch employees in order to promote security and confidentiality are effective. Interviews conducted with employees located in Ottawa, and in the Regions, indicated that security and confidentiality is understood by employees.

The evidence collected indicated that personnel controls are in place and are effective. Accordingly, recommendations are not necessary.

IV – Operational controls

Personal identifiers are removed from statistical master files as soon as no longer required, and breaches of confidentiality are reported to the Chief Statistician.

The audit team expected to find that personal identifiers are removed from statistical master files. The audit test conducted indicated that social surveys identifiers are removed early in the process, while economic surveys personal identifiers are removed much later. Auditors were concerned with this issue and probed further. It was established that economic surveys’ personal identifiers are required throughout the analysis stage, but they are removed when no longer necessary.

There are many sources of information instructing employees to report potential breaches of confidentiality. This includes the 2007 Policy on the Security of Sensitive Statistical Information, the Security Practice Manual, chapter 2 (revised in summer of 2007), and the Confidentiality Awareness Web Site.

Regionally, the risk of having a breach of security is much higher during the collection phase. The audit team found evidence that clear procedures exist to report a breach of security. Interviewers and senior interviewers receive written instructions on how to report any lost confidential material, including reporting the loss or theft of laptops immediately. Ultimately, the regional director is informed, and corrective measures are taken. The audit team observed documented corporate files relating to confidentiality breaches. The procedures in place were followed, and appropriate correctives measures were implemented.

The evidence collected indicated that operational controls are in place and are effective. Accordingly, recommendations are not necessary.

Appendix A

Audit Criteria

Objectives	Audit criteria
Physical access controls	1. access to buildings is restricted 2. access to secured areas within premises is restricted 3. information is physically transmitted within and outside StatCan according to approved standards 4. information is stored, marked and disposed of according to approved standards 5. physical access to servers is restricted 6. repair of computer equipment is carried out on StatCan premises by StatCan employees
Electronic access controls	7. workstations and servers are configured with access controls 8. information is transmitted electronically, within and outside Statistics Canada, according to approved standards 9. storage of information on removable storage media follows ITSD approved security procedures 10. information is processed, stored, accessed or transmitted only on Network A to prevent unauthorised access from the public 11. all portable computers have full storage encryption approved by ITSD 12. computers are sanitized before disposal using ITSD approved methods
Personnel controls	13. information on confidentiality is communicated regularly to all employees
Operational controls	14. personal identifiers are removed from statistical master files and stored separately from master files as soon as they are no longer required for data processing 15. breaches of confidentiality, should they occur, are reported formally to the Departmental Security Officer who informs the Chief Statistician

 

Appendix B

 

Acronyms

AMMIS	Automated Materiel Management Information System
CAPI	Computer Assisted Personal Interview
CATI	Computer Assisted Telephone Interview
DACS	Data Access and Control Division
DARS	Data Access Request System
EDSS	Enterprise Desktop Support Services
ITS	International Travel Survey
ITSD	Informatics Technology Services Division
LFS	Labour Force Survey
NLSCY	National Longitudinal Survey of Children and Youth
OID	Operations and Integration Division
PAPI	Paper and Pencil Interview
RO	Regional Office
SEPE	Survey of Environmental Protection Expenditures
StatCan	Statistics Canada
TCOD	Trucking Commodity Origin and Destination Survey

 

Note

 

1. Acronyms are defined in Appendix B
2. Paradata is information related to a statistical data collection or production process that is linked to an identifiable person, business or organization. Usually this is the type of information that is useful to interviewers (i.e. best time to call, type of respondent, etc.)
3. The baseline level for Statistics Canada consists of the perimeter security, which includes cameras, guards and gates.
4. Committee structure is a critical aspect of governance at Statistics Canada. Issues are first discussed at a management committee such as the Security Coordination Committee. The Security Coordination Committee Chairperson(s) will then present the results of the deliberations to the Policy Committee which will render a decision if required. The Policy Committee is chaired by the Chief Statistician and oversees all the committees.

Final report
Original Report Approved by Internal Audit Committee on August 30, 2006
Addendum Approved January 18, 2008

Internal Audit Division
December 2005

• Auditor's statement
• Background
• Objective
• Scope
• Approach
• Results
• Findings and recommendations
• Accounts payable and procurement
• Inventories
• Interviewer pay
• Physical security
• Staffing under the Public Service Employment Act (PSEA)
• Staffing under the Statistics Act for Statistical Survey Operations (SSO) (criteria 9.1 and 9.2 in Appendix A)
• Appendix A
• Appendix B
• Addendum - September 2007

Auditor's statement

We have completed the Audit of Central Regional Office (Toronto) Administrative Processes. The objective was to assess the degree of compliance of financial and human resources processes and practices and other general administrative processes and practices with relevant Government of Canada and departmental regulations, policies and directives. We examined the following areas: accounts payable; interviewer pay; travel, including the use of individual travel cards; procurement; inventory control, namely compliance with the Automated Material Management Information System (AMMIS); selected physical security elements, for example, access controls and the application of basic security measures; human resources (HR) staffing including file documentation; HR modernization training; and information technology (IT) access control. As the same management team is responsible for administrative practices and procedures in both Toronto and Sturgeon Falls, the audit was conducted in Toronto only. This audit concentrated on regular regional office activities and excluded the 2006 Census operations.

This internal audit was carried out in accordance with the Internal Auditing Standards for the Government of Canada. Key activities during the conduct of the audit carried out from November 21 to December 2 in Toronto, focussed on the regional office’s financial, human resources and other administrative operations. The auditors interviewed approximately 30 Statistics Canada employees, 11 interviewers and one security guard, observed practices and reviewed documents.

In examining selected regional office’s financial and human resources processes and practices and other general administrative processes and practices with relevant central agency and departmental regulations, policies and directives, we are satisfied that the areas examined are mainly in compliance. In a few areas, however, the findings indicate that there is a moderate level of risk to the organisation. These include: the lack of evidence that a best price was sought when using Local Purchase Orders (LPO) (page 8); the storage of Protected B information (page 11), and; the management of A/B switches (page 12). The audit report presents recommendations for all the findings identified by the auditors. Managers of the Central Regional Office prepared an action plan to address all recommendations (Appendix B). An audit team will monitor the progress of this plan and report back to the Internal Audit Committee.

These conclusions are based on the assessment of findings against pre-established criteria agreed to by the Internal Audit Committee in October 2005 and reflect the audit work conducted principally between November 21 and December 2, 2005.

The audit team was comprised of Mylène Belzile, Maria Escobar Rivera, Johanne Grégoire, Bev Prentice, Fadi Hélou and Jacques Lepage, who was the principal auditor.

In our opinion, sufficient and appropriate audit work has been performed and evidence gathered to support the conclusions contained in this audit report.

Background

Regional office audits have been conducted in Statistics Canada on a rotating basis since the mid-nineties. Regional offices, like our Head Office, process financial, human resources and administrative activities. The delegation of signing authority chart reflects the unique nature of the regional offices.

From a data collection perspective, the regions (Eastern Region, Central Region and Western Region and Northwest Territories) are responsible for the management of survey operations in eight centres: Halifax; Montreal, Sherbrooke; Toronto, Sturgeon Falls; Winnipeg, Edmonton; and Vancouver. This is done through the hiring, maintaining, training and scheduling of a workforce capable of handling a wide range of continuing and ad hoc surveys; providing cost estimates; providing advice and guidance on local situations; providing and maintaining respondent relations; managing the day-to-day collection operations including expanding and contracting the interviewer workforce as required; keeping within cost, quality, and timeliness objectives; maintaining samples; maintaining local offices; monitoring data quality; and collaborating with Survey Operations Division (SOD) in identifying ways and means to improve survey data collection.

The regions are one of the two main collection arms of the Agency. As such the regions provide a service vital to Statistics Canada's mandate which is to provide Canadians with objective and non-partisan statistics and statistical products, services and analyses on Canada’s economy and society which are relevant, responsive to emerging issues, fulfilling legal requirements and are of high quality. The regions provide data collection services to several divisions responsible for economic and socio-economic surveys.

The Central Regional Office is comprised of the Toronto centre, which also provides administration services for this region, and the Sturgeon Falls centre.

Before initiating the Central Regional Office (Toronto) audit, items audited in previous regional office audits were assessed in consultation with managers from the Communications and Operations Field as well as financial management and human ressources management in terms of threats and risks to the organization. Most financial items included in previous audits have been maintained. New items added to the list cover HR issues.

Objective

The objective of this audit was to assess the degree of compliance of selected financial and human resources management and other general administrative processes and practices with relevant central agency and departmental regulations, policies and directives.

Scope

The audit examined processes and practices followed by the Central Regional Office to ensure that selected financial, human resources and administrative activities comply with Government of Canada regulations, policies and directives as well as with Statistics Canada policies and directives. Areas examined include: accounts payable; interviewer pay; travel, including the use of individual travel cards; procurement; inventory control, namely compliance with the Automated Material Management Information System (AMMIS); selected physical security elements, for example, access controls and the application of basic security measures; HR staffing including file documentation ; HR modernization training; and IT access control. As the same management team is responsible for administrative practices and procedures in both Toronto and Sturgeon Falls, the audit was conducted in Toronto only. This audit concentrated on regular regional office activities and excluded the 2006 Census operations.

Approach

This audit was guided by criteria and review frameworks based on Treasury Board audit guides and analysis. An audit plan was developed and included detailed activities for all components identified within scope.

The auditors made use of administrative databases (e.g. Common Departmental Financial System (CDFS), Automated Material Management Information System (AMMIS), Survey Operations Pay System (SOPS)). The auditors interviewed financial, human resources and administrative staff in the Central Regional Office (Toronto). The test of compliance, in some cases, involved selecting and reworking adequate samples (e.g. travel claims, accounts payable, acquisitions) and recording results on the corresponding data collection tools. The work also involved inspecting files (mainly paper) to ensure that the proper documentation was maintained. Various visual inspections (e.g. work area, procedures, bulletin boards) were also conducted. With respect to security, the auditors conducted interviews with a sample of employees and on-site inspections of the physical security arrangements. Upon their return, personnel screening was conducted in the Head office security office and a review of travel card holders was conducted with the help of administrative files.

Before leaving the Toronto office, the auditors discussed the preliminary findings with the Regional Director and the Management Services and Informatics (MSI) Manager (also acting Assistant Regional Director, Operations).

To ensure that the scope of the audit was properly covered, the audit plan was comprised of a number of sub-objectives. These were:

• To ensure that accounts for payment and settlements are verified in a cost effective and efficient manner while maintaining adequate controls
• To ensure that procurements of goods or services are made in the most cost efficient manner while maintaining proper financial controls
• To ensure that travel is effectively managed and controlled
• To ensure the economical and efficient use of individual travel card (ITC)
• To ensure that inventories are properly managed
• To ensure that interviewer pay is properly managed
• To ensure the security of regional employees, information and assets
• To ensure that staffing for open and closed competitions are in accordance with Section 10 of the Public Service Employment Act, that acting appointments and extensions are in accordance with Section 7 of the Public Service Employment Regulations and that term extensions were made pursuant to Section 7 of the 2003 Term Employment Policy
• To ensure that key STC Staffing Guidelines for Statistical Survey Operations have been applied for hiring interviewers from outside, for promotions from interviewer to senior interviewer and for acting assignments and extensions of Statistical Survey Operations (SSO) employees.
• To ensure that managers and HR personnel are being prepared for the introduction of HR Modernization

The sub-objectives, their accompanying criteria and results are listed in Appendix A.

Results

Overall, the audit confirmed within the defined scope that the Central Regional Office (Toronto) financial and human resources processes and practices and other general administrative processes and practices are mainly in compliance with relevant central agency and departmental regulations, policies and directives. In a few areas, however, the findings indicate that the organisation could be at risk. The findings include:

• The auditors found no physical evidence that the best prices were obtained when using LPOs. We expected to find at least two quotes in the files. There were none, so it was impossible to know if the best price was sought (page 8).
• The users of A/B switches had not signed the declaration. We did not find an A/B switch on machines that would normally contain confidential information but there were no signed declarations by the users (page 12).
• Protected B information must be stored carefully after working hours and according to proper practices. We noticed survey and personnel-type information not stored securily after working hours (page 11).

All the findings are discussed in greater detail in the findings and recommendations section of this report.

Some of the sub-objectives examined for travel, the use of individual travel cards, and HR modernization training were found to be fully compliant.

Findings and recommendations

The criteria used for the audit are listed by sub-objective in Appendix A. In this section of the report, findings and recommendations are presented by groupings of sub-objectives. The report only presents findings that are accompanied by recommendations.

Accounts payable and procurement

Many criteria in these two sub-objectives were analyzed with the help of samples of transactions that were run through templates. The samples were selected at random within stratified lists.

Results of the samples run through the template are presented in the following tables. Please note that only the criteria that were verified with the template and that were not 100 percent compliant are shown (a complete list of the criteria can be found in Appendix A). Recommendations often group more than one criterion and are presented after the description of findings.

Accounts payable

A number of criteria measured with the help of the template were found to be 100 percent compliant. These include:

• The documentation shows compliance with section 34 (signed by officer with delegated authority)
• Financial coding is correct (FRC, authority, line object, and project code match the section 34 stamp)
• Invoices for payment received in the mailroom are date stamped and promptly forwarded to finance where they are stamped again.
• Invoices are matched to purchase order forms to verify that prices match those quoted in the purchase order.
• PST exemptions are taken and GST calculation is correct.
• Requests for payment are signed off by Financial Officer under sect 33 of the Financial Administration Act (FAA). No person shall exercise signing authority pursuant to both section 33 and 34 of the FAA with respect to a particular payment.
• Payments are promptly processed through CDFS by Finance. Cheques should be sent to the employee's home address or company's direct address.
• Transactions must follow a logical flow (i.e. purchase order, application & appraisal forms dated before invoice date).

Other criteria, not measured with the help of the template, were also met. These include:

• Signature forms showing delegated authorities are maintained and kept in a locked cabinet. The new forms must be filled and signed by October 31, 2005.
• Access to supplier files is restricted and files are kept under lock and key
• Acquisition cards monthly statements are reconciled with individual purchases and paid promptly to avoid payment of interests.
• There is a separate file maintained for the acquisition card.

Criteria in the following table were not compliant

Criteria (criteria number in Appendix A)	Compliant (N)	Total (N)	Percent compliant
Acquisitions are signed off by officer with delegated authority1. (1.2)	23	33	70
The release date of the payment should be 30 days after the receipt of the invoice (right away for employees), or acceptance of the goods/service, whichever is later. The invoice should be date stamped upon receipt and when payment is processed. The invoice receipt date should match CDFS receipt date. (1.10)	6	40	15
Files of all suppliers are maintained and contain all supporting documents for all acquisitions (Order form (including Local Purchase Order (LPO)), Invoice, Bill of Lading, Packing Slip with evidence that it was verified). (1.11)	23	33	70
Invoice date and number are entered correctly on CDFS. (1.16)	6	40	15

These findings and associated recommendations are discussed after the procurement sub-section.

Procurement

A number of criteria measured with the help of the template were found to be 100 percent compliant. These include:

• Standing offers or contracts if amount exceeds $5K for goods and $25K for services have been negotiated with principal suppliers
• Invoices or packing slips when separate are verified for accuracy of quantities and quoted prices
• Managers sign off under sect. 34 confirming receipt of goods or services
• Stamped invoices and packing slips are promptly forwarded to Finance for payment

Other criteria, not measured with the help of the template, were also met. These include:

• There is a designated officer responsible for all acquisitions
• Procedures exist for the receipt and verification of goods or services received
• Refer to payables criteria for Finance responsibilities prior to payment
• There is designated co-ordinator for the use of acquisition cards (Master Card) who is not the purchasing officer. The cards are in the name of current employees within the administration unit and must be used by the cardholder only for official government purchases only and must be kept in a secure location with controlled access when being used.
• The co-ordinator is fully responsible for all acquisitions using the card and there is a signed agreement to that effect. Each cardholder must sign a written acknowledgement.
• A separate log or inventory exists for all acquisitions made by LPO, standing offer and acquisition card.
• The card is not used for certain type of acquisitions specified by TB Policy e.g. travel related expenses, repairs, cash advances or interdepartmental transactions (this was verified with Sub-Objective 1 Accounts payable).
• Payments to the credit card company are made promptly to avoid interest payments.

Criteria in the following table were not compliant

Criteria (criteria number in Appendix A)	Compliant (N)	Total (N)	Percent compliant
When Local Purchase Orders (LPOs) are used, there is evidence that the best prices were obtained (4.3)	0	15	0
Internal request forms and LPOs are signed by officer with delegated authority2 (4.4)	23	33	70

Acquisitions (including with Local Purchase Orders (LPO)) not always signed by officer with delegated authority (criteria 1.2, 1.11 and 4.4 in Appendix A)

The MSI and the financial officer stated during their respective general interview that internal request forms and LPOs were signed by an officer with delegated authority or that an e-mail was sent to the purchasing officer. The purchasing officer stated the same thing but admitted that he did not keep a copy of the e-mail in his files (either electronic or paper). This was confirmed by the sample analysis (see template results above).

In 10 cases (30%), there is no evidence on file of an internal requisition form, a Local Purchase Order (LPO) signed by an employee with delegated authority under section 32 of the FAA or an e-mail sent to the purchasing officer. In the case of the print shop, the current procedures are not congruent with requirements. Currently, print jobs are ordered on an ongoing basis, often more than once a day and records are not kept of the quoted prices or of the approval by an officer with delegated authority.

Recommendation 1: The MSI manager should establish proper acquisition procedures to ensure that an officer with delegated authority signs an acquisition form or sends an e-mail before any acquisition is made.

Invoices almost always paid before 30 days (criteria 1.10 and 1.16 in Appendix A)

We found that there was no problem with payments due to employees or with the application of stamps on the invoices. All invoices contained the proper stamps. The travel sample indicated that the employees travel claims are processed when received in the finance section of the regional office as they should be. Other employee claims, such as petty cash, were also handled in a timely fashion by the financial section.

However, invoices from suppliers are almost always paid before the required 30 days (85%). The invoice receipt date seldom matched the CDFS receipt date. Suppliers are paid before the required 30 days, contrary to the Policy on Payment Requisitioning and Payment on Due Date. In order for this to happen, the invoice date must be incorrectly entered in CDFS. This is done deliberately. Originally, this procedure was applied so that suppliers, especially small ones, get paid before 30 days. However, the evidence shows that now this practice extends to all suppliers (small and large).

Recommendation 2: The Director should take immediate steps to stop the early payment practice. He should ensure that clear procedures are in place that respect the 30 day release date for payments required under the Policy on Payment Requisitioning and Payment on Due Date and he should monitor the situation to ensure that this has been corrected.

No evidence that the best prices were obtained when using LPOs. (criterion 4.3 in Appendix A)

We expected to find at least two quotes per purchase in the files. The files did not show any quotes. LPO transactions did not have any bid documentation or any evidence that the best price was researched. Both the MSI and the financial officer stated during their respective general interview that bids were being sought when using LPOs. The purchasing officer stated the same thing, but he admitted that he did not keep this information in his files (either electronic or paper). This was confirmed by the sample analysis (see template results above). 

Recommendation 3: The MSI manager should establish a set of procedures that would ensure that the best prices are obtained when using an LPO. The results of this process must be kept on file. Such procedures could include the pursuit of bids for each LPO. The MSI manager must also monitor the situation regularly to ensure that these new procedures are followed and that the problem has been corrected.

Inventories

A number of criteria were fully met. These include:

• An officer is identified as being responsible for the safe custody of the inventory of high value items and there is formal acceptance of that responsibility.
• Periodic stocktaking is performed
• Inventories are properly safeguarded

Accurate records not maintained for all items in the inventory and written procedures lacking (criteria 5.2 and 5.6 in Appendix A)

Inventory for which there are screen charges (PC) or which are important to manage from an operational point of view (laptops) are accurately recorded, as are monitors which generally work in conjunction with PCs. Inventory for A/B switches is not maintained and this represents a security concern which will be discussed with security findings below. The printer inventory is not accurate.

AMMIS is the only inventory used for non-computer items and locally-acquired items are not reliably entered. Accurate records are not maintained for this part of the inventory as a number of items do not have a C number. The persons responsible for maintaining inventory items do not have access to AMMIS.

Recommendation 4: We recommend that the MSI manager provide the individuals responsible for inventory items (both computer and non-computer) with written procedures and Read-only access to AMMIS should also be provided. In the case of non-computer inventory, the procedures should include a step that requires obtaining a C number before any equipment is deployed. The MSI manager should regularly monitor and provide feedback as required to the persons responsible for inventory items.

Interviewer pay

A number of criteria were fully met. These include:

• Managers conduct a verification of pay and expense claims (section 34 of FAA) before forwarding to finance
• Financial officer is exercising its responsibility to ensure that a system of account verification exists
• There is a process to follow up on overpayments (to do so requires an accurate records system and capacity to identify errors)
• Expense elements of interviewer pay correspond to the appropriate line items in CDFS

Tighten interviewer pay procedures for data collection managers (DCM) (criterion 6.1 in Appendix A)

We found written procedures and directives related to the method to process an interviewer pay claim. For example, there is a draft SOPS (Survey Operations Pay System) User Guide, dated December 2004 that explains the technical steps. It is not however designed to address section 34 responsibilities. There is also an ROB procedure for the payment of overtime. We were shown the PWGSC on-line pay site used by regional HR compensation advisors as a key tool.

One cannot write a standard recipe for all DCM to follow—there isn’t a mechanical set of steps that will apply generally. However, there should be procedures to remind DCM of their responsibilities. As a minimum, it should contain basic checks to perform when verifying pay claims. 

Different levels of authorization exist in SOPS (recommendation by senior interviewer, approval by DCM, review by project managers (PM4)) and various edits are built in the process. There seems to be enough checks to satisfy the requirements and assure the financial officer that section 34 is being handled properly. However, there are no written directives covering this issue.

Recommendation 5: Regional Office Branch (ROB) should prepare guidelines for data collection managers (DCM) on their section 34 responsibilities and for the financial officer regarding section 33 and interviewer pay.

Physical security

A number of criteria were fully met. These include:

• Emergency numbers are posted in central locations where staff can easily find them
• Strangers are challenged
• Staff members wear their ID according to security directives
• Procedures are in place to ensure that employees do not receive a user ID granting access to Network A or confidential information until personnel screening is completed
• A Committee on Occupational Safety and Health is established and is operational Meetings are conducted on a regular basis
• There are trained personnel on first aid and their names are posted
• Fire extinguishers are in place and there are signs clearly indicating their locations
• Employees have been trained on the procedures to follow when the alarms go off
• Signs are posted indicating the location of emergency doors which are easily accessible

Storage of protected B information (criterion 7.4 in Appendix A)

Security measures described in the Security Practices Manual are not always applied when it comes to storing protected B files after hours. While the risk of outsiders seeing protected information is low because of perimeter security, access to information is on the basis of a "need to know", which is respected when documents are properly stored. Confidentiality is a key value for all Statistics Canada employees who have to protect information received from respondents as well as any other protected information.

We noticed that protected B files (e.g. survey data, personnel-type) were left on desks after employees had left for the day. Some cabinets were unlocked overnight and some employees with offices with doors choose not to lock them, even though protected information is kept in the office and not stored in cabinets. Regarding personnel-related information, the Human Resources section is located in the MSI area which has controlled access, but personnel files should not be left unlocked overnight. This type of information should be treated with the same care as survey data.

We also noticed that all the filing cabinets used to store protected B information are not meeting the standards described in the Security Practices Manual.

Recommendation 6: The Regional Director takes action to ensure that employees appropriately secure protected B data after hours, whether this is information provided in confidence, sensitive statistical information or other types of protected information such as personnel files. We also recommend that the RO either purchase a number of filing cabinets suitable for storing protected B information or consult with HO security to see how the present cabinets can be retro-fitted to meet security requirements.

Personnel screening falls short (criterion 7.7 in Appendix A)

As part of the physical security sub-objective, personnel screening was reviewed. The criterion is taken directly from the Government Security Policy. This can be considered as a follow-up to the 2002 Personnel Screening audit that covered the entire department.

During the current audit, on the employee side, we concentrated on new hires over the past year (November 2004 to November 2005) excluding Census employees. There were 18 names on our list and our findings indicate that 3 of these employees started to work without a valid security clearance. In addition, only one of the three signed the security clearance form before starting to work. The two others signed their forms after their first day of work (one and ten days).

For interviewers, the same time period was used and is summarized:

The results indicate that 44 (6+38) out of 93 interviewers, or 47%, did not comply with the Government Security Policy at the time of the audit. This can be considered as an improvement over the results of the 2002 Personnel Screening Audit, but requires some specific action to rectify the situation.

The risk to the agency is that someone without proper security clearance is hired. The degree of risk is not high, but could become a problem in the long run if rules are not adhered to. Should an event occur, the impact on the reputation of Statistics Canada could be significant.

Recommendation 7: The director should introduce procedures to ensure that employees and interviewers be security cleared before they start working for the RO. This should be monitored on an ongoing basis to ensure full compliance.

Conditions for A/B switch use should be improved (criterion 7.9 in Appendix A)

The MSI manager noted that all requests for A/B switches must be approved by a senior manager and that the distribution was very limited. During inventory work, we did not find an A/B switch on machines that would normally contain confidential information.

We were told that employees who use A/B switches are not required to sign a declaration in advance. This declaration is required as described in the EDP Security Policy, Appendix A section 11 ii. There is no list of who has an A/B switch within the RO.

Having signed declarations shows that employees understand their obligations and a complete list of who has switches helps ensure that they are not left inadvertently where they do not belong.

Recommendation 8: The IT manager should maintain a list of A/B switch users and declarations should be filled out in accordance with the EDP Security Policy, Appendix A section 11 ii. This practice should be monitored on an ongoing basis.

Staffing under the Public Service Employment Act (PSEA)

The following was met but documentation can be improved (see below):

• Open and closed competition files contain all the key documents listed in the PSC Staffing Manual, Chapter 8. Key documents are duly completed and signed and show evidence that a process took place to apply relative merit, pursuant to the PSEA, section 10 (1). Gate-keeping and Senior Personnel Review Committee (SPRC) approvals have been obtained when necessary.

Documentation can be improved for open and closed competitions (criterion 8.1 in Appendix A) and files on actings, actings extensions and term extensions are hard to locate (criteria 8.2 and 8.3 in Appendix A)

For closed and open competitions, we found most of the evidence required to demonstrate that processes have been carried out properly.

However, steps that managers are to carry out are not always done; for example, signing board member statements and screening selection forms, and in one case, documenting that a candidate met qualifications even though that person was the only candidate.

Recommendation 9: The HR function should not issue competition results before all required documents are received from managers.

For other forms of PSEA staffing - term extensions, acting appointments and acting extensions - we are not able to draw a conclusion since an insufficient number of staffing files in our sample could be located. We found that the filing system is not in good order due to moves and scarce resources being placed on priorities such as current staffing actions, including census staffing.

Recommendation 10: The HR manager should ensure that the filing system is put into proper order and maintained.

Staffing under the Statistics Act for Statistical Survey Operations (SSO) (criteria 9.1 and 9.2 in Appendix A)

We expected to find that competitive processes in keeping with the merit principle are being used for employees hired under the Statistics Act, and that interviewers hired had passed a selection test. We found that the interviewer selection test is administered and that qualified candidates obtained at least 65%. However, we were unable to locate enough of the information required to draw a conclusion on the extent to which SSO competitive processes have taken place to establish merit. What we were told indicates that the merit principle is being applied, but there is insufficient evidence on which to base a conclusion.

Our difficulties stem from the fact that there are no centralized staffing files and standards about information to be kept on file for employees hired under the Statistics Act, similar to those that exist for public servants hired under the Public Service Employment Act.

Recommendation 11:  The Assistant Director, Operations should create and maintain a central filing system and associated procedures for SSO staffing actions. Doing this in conjunction with Regional Office Branch headquarters would foster consistent standards across regional offices.

There have been changes in the HR employee complement and responsibilities since many of these staffing actions were completed. This, coupled with file location problems and the desire of the director to ensure that staffing is carried out according to standards, as well as an invitation by the director to return, suggests that Internal Audit Division should consider more audit work in this area in its next multi-year audit plan.

Appendix A

Criteria by sub-objective and result

Sub-objective 1: To ensure that accounts for payment and settlements are verified in a cost effective and efficient manner while maintaining adequate controls

Criteria	Summary result
1.1 Signature forms showing delegated authorities are maintained and kept in a locked cabinet. The new forms must be filled and signed by October 31, 2005.	Yes
1.2 Acquisitions are signed off by officer with delegated authority.	Not met. (see recommendation (rec 1)
1.3 The documentation shows compliance with section 34 (signed by officer with delegated authority)	Yes.
1.4 Financial coding is correct (FRC, authority, line object, and project code match the section 34 stamp)	Yes.
1.5 Invoices for payment received in the mailroom are date stamped and promptly forwarded to Finance where they are stamped again.	Yes.
1.6 Invoices are matched to purchase order forms to verify that prices match those quoted in the purchase order.	Yes, when a purchase order is present. (see criterion 1.11)
1.7 PST exemptions are taken and GST calculation correct.	Yes.
1.8 Requests for payment are signed off by Financial Officer under sect 33 of the FAA. No person shall exercise signing authority pursuant to both section 33 and 34 of the FAA with respect to a particular payment.	Yes.
1.9 Payments are promptly processed through CDFS by Finance. Cheques should be sent to the employee’s home address or company’s direct address.	Yes.
1.10 The release date of the payment should be 30 days after the receipt of the invoice (right away for employees), or acceptance of the goods/service, whichever is later. The invoice should be date stamped upon receipt and when payment is processed. The invoice receipt date should match CDFS receipt date.	Not met. (see rec 2)
1.11 Files of all suppliers are maintained and contain all supporting documents for all acquisitions (Order form (including LPO), Invoice, Bill of Lading, Packing Slip with evidence that it was verified). A unique CDFS ID must be recorded on the invoice.	Not met. (see rec 1)
1.12 Transactions must follow a logical flow (i.e. purchase order, application & appraisal forms dated before invoice date).	Yes.
1.13 Access to supplier files is restricted and files are kept under lock and key	Yes.
1.14 Acquisition cards monthly statements are reconciled with individual purchases and paid promptly to avoid payment of interests.	Yes.
1.15 There is a separate file maintained for the acquisition card	Yes.
1.16 Invoice date and number are entered correctly on CDFS.	No, date entered to effect early payment. (see rec 2)

 

Sub-objective 2: To ensure that travel is effectively managed and controlled

Criteria	Summary result
2.1 All travel is approved in advance and signed by officer with delegated authority or a current Blanket Travel Authority form exists.	Yes
2.2 Travel Advance and Approval forms are completed and include purpose of travel	Yes
2.3 Amounts requested are reasonable and given to the traveller within a reasonable timeframe (2 days before trip).	Yes
2.4 Expenses identified are within those described and allotted in TB Directive	Yes
2.5 A Blanket Travel Authority to travel if used is included in the employee file	Yes
2.6 Emergency travel situations are post approved and include an explanation on the expense claim	Did not occur in sample 3
2.7 Expense claim forms are completed within an acceptable timeframe and signed by an officer with delegated authority	Yes
2.8 Claims include required receipts and there is evidence that Finance as reviewed the claim (red tick marks)	Yes
2.9 It is the responsibility of supervisors to authorize taxi use for employees travelling on official government business. Vouchers cannot be used when travelling to or from an airport, bus terminal or train station for trip related purposes, or while at the duty travel location. The use is to be monitored.	Yes.
2.10 Consultants and other persons performing work on behalf of the government are not to be supplied with taxi vouchers	Yes
2.11 When taxi vouchers are made available instead of cash, departments and agencies are to use the standardized government-wide voucher (GC 89).	Yes
2.12 All air fare and rail bookings should be completed through AcXess Voyage.	Yes
2.13 Travellers’ cheques must be used for authorized travel on an exceptional basis only.	Yes
2.14 A travellers cheques custodian and a backup have been appointed	Yes
2.15 Travellers cheques are stored in a safe or locked cabinet with restricted access	Yes
2.16 The custodian is responsible for processing transactions and for procuring, protecting, controlling and handling the cheques.	Yes
2.17 The custodian signs off replenishments after verifying amounts received	Yes
2.18 A log is maintained and includes the name of the travellers and amounts provided in the denominations given	Yes
2.19 There is sign-off by the traveller confirming the amounts received with a copy on file and another for the traveller	Yes
2.20 The custodian has reconciled the inventory	Yes
2.21 The inventory matches the amounts on hand	Yes
2.22 American Express invoices are paid promptly	Yes
2.23 Amounts received by the travellers are supported by Travel Advance and Approval and Travel Expense Claim Forms duly signed by officer with delegated authority	Yes
2.24 Travellers cheques are not used for salary advances or loans	Yes

 

 

Sub-objective 3: To ensure the economical and efficient use of individual travel card (ITC)

Criteria	Summary result
3.1 The cards are assigned by an officer with delegated authority who is identified as the regional co-ordinator	Yes
3.2 The ITCs are used for government business only and for approved expenses i.e. accommodation, car rental	Yes
3.3 Travellers have prior approval using the Travel Advance and Approval form or have a blanket travel authority on file	Yes
3.4 Non standard type of expenses have been approved by an officer with delegated authority e.g. rental of meeting rooms, hospitality	Did not occur in sample.
3.5 Procedures are in place for authorising and issuing the card	Yes
3.6 Procedures are in place for retrieving and cancelling the cards when an employee leaves the department or assumes a new position	Yes but improvement possible (memo4)

 

 

Sub-objective 4: To ensure that procurements of goods or services are made in the most cost efficient manner while maintaining proper financial controls

Criteria	Summary result
4.1 There is a designated officer responsible for all acquisitions	Yes
4.2 Standing offers or contracts if amount exceeds $5K for goods and $25K for services have been negotiated with principal suppliers	Yes
4.3 When Local Purchase Orders (LPOs) are used, there is evidence that the best prices were obtained	Not met (see rec 3)
4.4 Internal request forms and LPOs are signed by officer with delegated authority	Not met. (see rec 1)
4.5 Procedures exist for the receipt and verification of goods or services received	Yes
4.6 Invoices or packing slips when separate are verified for accuracy of quantities and quoted prices	Yes
4.7 Managers sign off under sect. 34 confirming receipt of goods or services	Yes
4.8 Stamped invoices and packing slips are promptly forwarded to Finance for payment	Yes
4.9 Refer to payables criteria for Finance responsibilities prior to payment	Yes
4.10 There is designated co-ordinator for the use of acquisition cards (Master Card) who is not the purchasing officer. The cards are in the name of current employees within the administration unit and must be used by the cardholder only for official government purchases only and must be kept in a secure location with controlled access when being used.	Yes
4.11 The co-ordinator is fully responsible for all acquisitions using the card and there is a signed agreement to that effect. Each cardholder must sign a written acknowledgement.	Yes
4.12 A separate log or inventory exists for all acquisitions made by LPO, standing offer and acquisition card.	Yes but improvements possible (memo)
4.13 The card is not used for certain type of acquisitions specified by TB Policy e.g. travel related expenses, repairs, cash advances or interdepartmental transactions (this will be verified with SO 1 payables).	Yes
4.14 Payments to the credit card company are made promptly to avoid interest payments.	Yes

 

 

Sub-objective 5: To ensure that inventories are properly managed

Criteria	Summary of results
5.1 There is an officer identified as being responsible for the safe custody of the inventory of high value items and there is formal acceptance of that responsibility.	Yes
5.2 Accurate records are maintained of all items in the inventory	Not met. (see rec 4)
5.3 Periodic stocktaking is performed	Yes
5.4 There are procedures in place to account for and report losses or damages for write-off	Not met. (memo)
5.5 Inventories are properly safeguarded	Yes
5.6 There are documented departmental and regional instructions for the maintenance of inventory records and these are known.	Not met. No documented regional instructions. (see rec 4)

 

 

Sub-objective 6: To ensure that verification of interviewer pay is properly managed, a process exists to follow up on overpayments, and expense elements are accurately coded

Criteria	Summary result
6.1 There are up-to-date procedures outlining the responsibilities of managers and finance for the verification of interviewer pay claims	Partial, some procedures exist (see rec 5)
6.2 Managers conduct a verification of pay and expense claims (section 34 of FAA) before forwarding to finance	Yes
6.3 Financial officer is exercising its responsibility to ensure that a system of account verification exists	Yes
6.4 There is a process to follow up on overpayments (to do so requires an accurate records system and capacity to identify errors)	Yes
6.5 Expense elements of interviewer pay correspond to the appropriate line items in CDFS	Yes

 

 

Sub-objective 7: To ensure the security of regional employees, information and assets

Criteria	Summary result
7.1 A security officer is appointed and staff know who and where person is located	Not met (memo)
7.2 Procedures are in place for granting access to employees and visitors during and after regular hours	Met, with reservations. The issue was that the new magnetic doors were not functioning properly. This was addressed and resolved.
7.3 Emergency numbers are posted in central locations where staff can easily find them	Yes
7.4 Staff has been trained on security measures and know what procedures to follow under different circumstances e.g. gas smell, stranger in area	Not met (see rec 6)
7.5 Strangers are challenged	Yes
7.6 Staff members wear their ID according to security directives	Yes
7.7 Personnel screening procedures are in place to ensure that new hire employees are cleared in advance of beginning work (checked using tool for HR staffing)	Not met (see rec 7)
7.8 Procedures are in place to ensure that employees do not receive a user ID granting access to Network A or confidential information until personnel screening is completed.	Yes
7.9 Management controls are in place to ensure that A/B switches are not in use by those accessing information provided in confidence	Not met. (see rec 8)
7.10 A Committee on Occupational Safety and Health is established and is operational	Yes
7.11 Meetings are conducted on a regular basis	Yes
7.12 Minutes and decision records are posted in key areas and or E-Mailed to all staff	Not met. Not posted and not all staff has access to e-mail. (memo)
7.13 There are trained personnel on first aid and their names are posted	Yes
7.14 Fire extinguishers are in place and there are signs clearly indicating their locations	Yes
7.15 Employees have been trained on the procedures to follow when the alarms go off	Yes
7.16 Signs are posted indicating the location of emergency doors which are easily accessible	Yes

 

 

Sub-objective 8: Staffing under the Public Service Employment Act

Criteria	Summary result
8.1 Open and closed competition files contain all the key documents listed in the PSC Staffing Manual, Chapter 8. Key documents are duly completed and signed and show evidence that a process took place to apply relative merit, pursuant to the PSEA, section 10 (1). Gate-keeping and Senior Personnel Review Committee (SPRC) approvals have been obtained when necessary.	Yes but items coming from managers could be improved (see rec 9)
8.2 Staffing files for acting appointments and extensions of acting appointments (more than 4 months) contain key documents signed by delegated authorities, and show evidence that a process took place to apply relative merit, pursuant to the PSEA, section 10 (1) and PSER, section 7. Gate-keeping and SPRC approvals have been obtained when necessary.	Cannot conclude due to insufficient information. (see rec 10)
8.3 Term extensions files contain key documents signed by delegated authorities and show evidence that a right of appeal has been issued and that the 3-year cumulative period policy requirement has been applied, pursuant to section 10 (2) of the PSEA and section 7 of the 2003 Term Employment Policy. Gate-keeping and SPRC approvals have been obtained when necessary.	Cannot conclude due to insufficient information. (see rec 10)

 

 

Sub-obje ctive 9: Staffing for Statistical Survey Operations (SSO)

Criteria	Summary result
9.1 Staffing files show evidence that a competitive process to establish merit took place for all external appointments, internal promotions, and long-term acting assignments, pursuant to the Staffing Guidelines, sections 2 and 5.	For the records examined, there is evidence that key elements of a competitive process are used but cannot conclude due to insufficient information. (see rec 11)
9.2 The interviewer selection test has been administered during new hires staffing and all qualified candidates have obtained at least 65% on the test, pursuant to the Staffing Guidelines, section 5.2.4.	For the records examined, a selection test is administered but cannot conclude due to insufficient information. (see rec 11)

 

 

Sub-objective 10: To ensure that managers and HR personnel are being prepared for the introduction of HR Modernization

Criteria	Summary result
10.1 The HR manager is aware of the new accreditation requirements.	Yes
10.2 Training requirements are identified.	Yes
10.3 An HR learning plan is in place for HR personnel and managers.	Yes
10.4 HR personnel have received basic training. This could include Accountabilities & Responsibilities (P101), Enabling Skills for PSMA (P102), Preparation for PSMA Trainers (P103), PSEA – online (P106), Staffing for experienced staffing specialist ((P110) PSC ready in Sep) and Integrated HR & Business Planning (P100) (PSC ready in Oct).	Yes
10.5 Managers have or will receive basic training before the new policy.	Yes

 

Appendix B

Management Action Plan

Recommendations	Action Plan or Explanation of No action on the Recommendations	Responsible for Action	Estimated Completion Date	Status
The MSI manager should establish proper acqusition procedures to ensure that an officer with delegated authority signs before any acquisition is made:	MSI Manager has prepared proper procedures. The Finance Officer will perform periodic Audits to ensure compliance and will report these to the Director	Gary Dillon		Completed
The Director should take immediate steps to stop the early payment practice. He should ensure that clear procedures are in place that respect the 30 day release date for payments required under the Policy on Payment Requisitioning and Payment on Due Date and he should monitor the situation to ensure that this has been corrected:	The Director has taken action to ensure that existing PDD procedures are followed where possible. We maintain that there continues to be an issue with the larger companies (e.g. Bell Canada) that charge us interest when we apply PDD for their invoices. In light of our responsibility to manage Public Funds in the most cost efficient manner, we believe we should continue to pay some invoices as soon as they are received.	Doug Newson		Completed
The MSI manager should establish a set of procedures that would ensure that the best prices are obtained when using an LPO. The results of this process must be kept on file. Such procedures could include the pursuit of bids for each LPO. The MSI manager must also monitor the situation regularly to ensure that these new procedures are followed and that the problem has been corrected:	The MSI Manager has prepared a set of procedures outlining the process to be taken when acquisitioning goods through an LPO process and reflect the PWGSC guidelines that the “use of Standing Offers is Mandatory”. To ensure that these procedures are followed, all LPO must be signed under section 33 of the FAA by the Assistant Directors or the Regional Director. The Finance Officer will review files periodically to ensure compliance	Gary Dillon		Completed
We recommend that the MSI manager provide the individuals responsible for inventory items (both computer and non-computer) with written procedures and Read-only access to AMMIS should also be provided. In the case of non-computer inventory, the procedures should include a step that requires obtaining a C number before any equipment is deployed. The MSI manager should regularly monitor and provide feedback as required to the persons responsible for inventory items:	The responsibility of computer Inventories and A/B switches has been negotiated with ITSD. A signed SLA effective April 1st, 2006 establishes their responsibility. The MSI Manager has advised the ITSD representative of these findings and had them prepare procedures. As of April 24th, 2006, all persons responsible for Computer Inventories have access to AMMIS. As to non-computer equipment, the MSI Manager has prepared written procedures for purchasing and inventory control. The MSI Manager will monitor on a quarterly basis and access to AMMIS has been obtained for the Purchasing Clerk.	Gary Dillon		Completed
Regional Office Branch (ROB) should prepare guidelines for data collection managers (DCM) on their section 34 responsibilities and for the financial officer regarding section 33 and interviewer pay:	This has been referred to ROB for a national approach.	Manager, MS	Summer 2006
The Regional Director takes action to ensure that employees appropriately secure protected B data after hours, whether this is information provided in confidence, sensitive statistical information or other types of protected information such as personnel files. We also recommend that the RO either purchase a number of filing cabinets suitable for storing protected B information or consult with HO security to see how the present cabinets can be retro-fitted to meet security requirements:	All filing cabinets will be retro-fitted to meet security requirements May 5th, 2006. The Director has sent a note reminding all staff of their responsibility to ensure that protected B data is secured appropriately after hours. The Security Officer will carry out periodic inspections to ensure compliance.	Doug Newson		Completed
The director should introduce procedures to ensure that employees and interviewers be security cleared before they start working for the RO. This should be monitored on an ongoing basis to ensure full compliance:	Staffing Guidelines dated October 2005 had been distributed to all staff. Part of the Guidelines dealt with Security Clearances (in bold lettering) emphasizing that no one was to be hired without an Enhanced Reliability Check. These will be re-distributed under the Director’s Signature with an emphasis on Security Clearances. The HR Consultant will audit a sample of files to ensure compliance	Doug Newson		Completed
The IT manager should maintain a list of A/B switch users and declarations should be filled out in accordance with the EDP Security Policy, Appendix A section 11 ii. This practice should be monitored on an ongoing basis:	This responsibility for issuing and maintaining an inventory has been moved to ITSD through the SLA. The MSI Manager has ensured that all existing users of A/B switches sign the declaration.	Gary Dillon		Completed
The HR function should not issue competition results before all required documents are received from managers:	Discussion on this procedure has taken place with the employees who are responsible for staffing. Reminder has been sent to Managers, and will continue to communicate on an on-going basis as new competitions are undertaken	Heather Jefferys		Completed
The HR manager should ensure that the filing system is put into proper order and maintained:	System has been established. HR employees are in the process of implementation. Student is being hired to complete this project	Heather Jefferys	Fall 2006	Partially Completed
The Assistant Director, Operations should create and maintain a central filing system and associated procedures for SSO staffing actions. Doing this in conjunction with Regional Office Branch headquarters would foster consistent standards across regional offices:	Our position is that this responsibility belongs to the HR unit. The HR Consultant will create and maintain a central filling system, prepare a “check List” for staffing files in conjunction with HO and the other Regions to develop procedures and offer guidance to the Operations staff to ensure compliance	Heather Jefferys	Fall 2006	Partially Completed

Addendum – September 2007

HR staffing

Following the approval of the original report and subject to a paragraph ⁵ found on page 15 of the report, internal audit revisited the two HR staffing sub-objectives. These sub-objectives are: Staffing under the Public Service Employment Act, and Staffing for Statistical Survey Operations (SSO). These are listed as sub-objectives 8 and 9 respectively in the report.

The criteria have changed slightly to reflect the new Public Service Employment Act and accompanying Regulations.

Criteria

Staffing under the Public Service Employment Act

1. Key documents are duly completed and signed and show evidence that a process took place to apply merit, pursuant to the PSEA, section 30. Gate-keeping and Senior Personnel Review Committee (SPRC) approvals have been obtained when necessary.
2. Staffing files for acting appointments and extensions of acting appointments (more than 4 months) contain key documents signed by delegated authorities, and show evidence that a process took place to apply relative merit, pursuant to the PSEA, section 30 and PSER, section 12 to 16 inclusively. Gate-keeping and SPRC approvals have been obtained when necessary.
3. Term extensions files contain key documents signed by delegated authorities and show evidence that a right of appeal has been issued (the 3-year cumulative period policy requirement, pursuant to section 7 of the 2003 Term Employment Policy, does not apply here). Gate-keeping and SPRC approvals have been obtained when necessary.

Staffing for Statistical Survey Operations (SSO)

1. Staffing files show evidence that a competitive process to establish merit took place for all external appointments, internal promotions, and long-term acting assignments, pursuant to the Staffing Guidelines, sections 2 and 5. Key documents are duly completed and signed.
2. The interviewer selection test has been administered during new hires staffing and all qualified candidates have obtained at least 65% on the test, pursuant to the Staffing Guidelines, section 5.2.4.

Scope and approach

The scope and approach for the HR staffing portion were unchanged from the original report. Please see page 4 of the original report for a description.

Findings

In this section only findings that are accompanied by recommendations are presented. Findings and recommendations that are minor or technical have been dealt with in a management memorandum.

Staffing under the Public Service Employment Act

We found that the regional office was mainly compliant with this sub-objective. The few items that require attention have been dealt with in a management memorandum.

Staffing for Statistical Survey Operations (SSO)

The present filing system for the SSO staffing process has recently been put in place in the Toronto regional office. This is in response to recommendation 11 of the original report which read "The Assistant Director, Operations should create and maintain a central filing system and associated procedures for SSO staffing actions. Doing this in conjunction with Regional Office Branch headquarters would foster consistent standards across regional offices."

We found that the files had been centralized. There was evidence of competitive processes and that merit was applied. There was also evidence that qualified candidates had obtained 65% on the test. We also found that the staffing file for the latest senior interviewer process was complete.

We expected to find that key documents for each staffing process would be duly completed and signed. We found that many documents listed in the PSC Staffing Manual, Chapter 8 ⁶, were not in the staffing files that we looked at (except for the latest senior interviewer process as noted above). These include:

• There was no documented request to initiate a staffing action (initialization). The manager determines how many new interviewers are required when a new contract comes in and an analysis of interviewers on hand is done. The requirements are then forwarded to the project managers and senior interviewers informally. A record of how many can be hired is not kept on file.
• A copy of the letters of offer is not kept in the central staffing files key documents. The offers are kept in the personnel files (in the pay unit).
• Personnel screening and verification of security status are not well documented.
• The merit criteria are not in the staffing files.
• The personnel screening consent form is not in the staffing files (at the present time some (about 50%) can be found in the personnel files)
• The qualifying lists are not signed by the manager or board members depending on the process.

It is our understanding that a working committee has been tasked with developing and identifying the key staffing documents that will be required when conducting each SSO staffing process. We were also told that a focal point has been assigned to ensure that staffing is conducted consistently across the region and that SSO staffing files are in order.

We also found that the competitive processes were not advertised.

The causes are various but the main one is, as noted above, the central filing system which is fairly new. It has been introduced in the last few months in response to a recommendation found in the original report. It is still a work in progress and the HR personnel trying to maintain and improve the files are at the mercy of the operation supervisors running the SSO competitions.

The request to initiate a staffing action (initialization) is absent because this is how the operations people have been working for a long time. Very often the exact number of new interviewers required can only be determined late in the process.

The competitive processes are not advertised because the regional office receives unsolicited résumés all the time.

The impact of incomplete documents in the staffing files is fairly minor. In the case of SSOs there is very little chance that the department could lose its delegation authority since it is a separate employer. Incomplete files, however, tend to make the staffing process riskier. It could also be perceived that we are not as transparent as we should be.

The fact that the competitive processes to hire new interviewers are not advertised could be perceived as if the organisation is showing favoritism. However, a recently activated electronic application system that forms part of the public service recruitment site allows job seekers to apply on-line for SSO positions. We were also told that, when required, vacancies are advertised through local media as well as posted in public locations (e.g. post office, library). This new process resolves the potential perception of favoritism.

Recommendation

The focal point must pursue the file centralizing work started just a few months ago. The newly formed working committee must determine the key staffing documents required when conducting each SSO staffing process. Educating and persuading operations managers on the file requirements and the benefits that will result must be pursued. Monitoring the implementation of the improved SSO staffing process should be conducted regularly to provide managers with an assurance that it is proper.

Management Action Plan (addendum)

Recommendation	Action Plan or Explanation of No action on the Recommendations	Responsible for Action	Estimated Completion Date	Status
The focal point must pursue the file centralizing work started just a few months ago. The newly formed working committee must determine the key staffing documents required when conducting each SSO staffing process. Educating and persuading operations managers on the file requirements and the benefits that will result must be pursued. Monitoring the implementation of the improved SSO staffing process should be conducted regularly to provide managers with an assurance that it is properly implemented.	The Central Region assigned the responsibility of SSO staffing to a single focal point who works with both the Human Resources function and Operations. This individual is responsible to ensure that staffing is conducted consistently across the region. She ensures that all the staffing files and paperwork for hiring SSO staff (CATI & CAPI) are in order. A national working committee headed by Connie Graziadei has been tasked with developing and identifying the key staffing documents that will be required when conducting each SSO staffing process. This will represent a consistent national approach. It is anticipated that the committee will soon be able to finalize their recommendations and guidelines which will be implemented nationally. The next step in this process will be to educate operational managers and supervisors on the new requirements. Human Resources will be responsible for the provision of training, and coordination of these staffing actions.	Connie Graziadei Heather Jefferys	June 2008

 

Notes

 

1. Purolator, Canada Post and Bell Canada were left out of the analysis for this criterion because one would not expect to find a signed form at the regional level for these contracts.
2. Purolator, Canada Post and Bell Canada were left out of the analysis for this criterion because one would not expect to find a signed form at the regional level for these contracts.
3. Due to the wide usage of blanket travel authorities, emergency travel situations seldom occur.
4. A number of findings, due to their minor nature, were discussed in a management memo. These findings are associated to the following criteria: 3.6, 4.12, 5.4, 6.2, 7.1 and 7.12.
5. "There have been changes in the HR employee complement and responsibilities since many of these staffing actions were completed. This, coupled with file location problems and the desire of the director to ensure that staffing is carried out according to standards, as well as an invitation by the director to return, suggests that Internal Audit Division should consider more audit work in this area in its next multi-year audit plan."
6. There is no legal obligation to apply the PSC Staffing Manual here but it was used as a proxy since no document stating the required documents was available at the time of the audit.