The PIC strategy is periodically updated though an annual review process

During the previous audit of Key Financial Controls, there were a number of circumstances in which the testing schedule was not being followed. To ensure continued relevance of the strategy, the Internal Audit Division recommended that the PIC strategy be periodically updated and validated by the CFO and Chief Statistician.

The PIC team has implemented an annual review process. The testing strategy to assess compensatory controls is determined by reviewing business processes to ensure that planned system changes are identified. The annual review process is driven by the PIC team; Business Process Owners (BPOs) are consulted and are provided the opportunity to communicate any planned system changes. The impact of system changes on internal controls are then assessed by the PIC team through the annual review process. Once the annual review of business processes is completed, the PIC team will review and discuss the impact of system changes identified, and determine if the testing plan requires adjustment.

The 2015-2019 ICFR Risk Based Testing Plan replaces the PIC Strategy. It is updated annually, can be further adjusted as required, and is based on the assessment of results, changes and the impact of remediation actions.

The PIC Team's revised approach is effective in ensuring its PIC strategy is periodically updated.

Compensatory controls in place during process and system changes are considered for testing as part of providing ongoing assurance on ICFR

The previous audit of Key Financial Controls recommended that compensatory controls in place during process and system changes are considered for testing as part of providing ongoing assurance on ICFR.

In 2013-14, the PIC Team tested compensatory controls for all processes where testing had been postponed due to upcoming system changes. These processes were: Capital Assets, Salary Reconciliations for Payroll and Benefits, Operating Expenditures and Revenues.

The PIC Team's testing results showed that all compensatory controls were operating effectively with the exception of Payroll and Benefits. These results have been communicated to the appropriate business owners. As a result of the review and update of all ICFR business processes by the PIC team during 2013-14, no additional testing of controls were postponed due to system changes.

On the premise that process controls must continue to exist and be effective before and after changes are made and that in most cases, process controls and control objectives do not change even when accountability or tools are changing, the PIC team's approach going forward will be to follow the testing plan schedule, and not postpone testing. Should key controls become ineffective due to major systems changes, then the decision can be made to postpone regular testing and test compensatory controls. This will ensure that testing of compensatory controls is limited to instances where regular controls are no longer effective.

The PIC Team's revised approach ensures that compensatory controls in place during process and system changes will be considered for testing as part of providing ongoing assurance on ICFR.

The implementation of remediation actions are validated by the PIC team in a timely fashion

In the past, the PIC Team gathered information on the status of implementation of remediation actions through enquiry to the BPOs. The PIC team uses remediation follow-up templates to monitor the progress of the implementation of remediation plans. BPOs are asked to provide an update on the status of remediation plans to the PIC team on a quarterly basis in order to update the follow-up template.

The business process reviews conducted in 2013-14, and the annual review process described in the 2015-2019 ICFR Risk Based Testing Plan, combined with the assessment of PIC issues discussed during PIC team meetings is adequate to ensure that evidence of the implementation of remediation actions are gathered and documented, and that the adequacy of remediation actions are evaluated by the PIC team within a 12-month testing cycle.

The implementation of the PIC Steering Committee is an effective governance and oversight tool, and a leading practice

The new Guideline for PIC requires that internal controls be managed through formal oversight and effective governance, including regular reporting to senior management, the deputy head and the DAC.

During 2013-14, the Financial Reporting Division (FRD) created the PIC Steering Committee. Three meetings have been held as of January 2014. Roles and responsibilities of the PIC Steering Committee have been established and approved at the July 15th, 2013 meeting. Membership includes DGs that oversee areas where process controls are included and tested as part of the PIC framework. The purpose of the Committee is to inform members of proposed changes to the testing strategy and the progress made in various areas of PIC. The expected outcome of this new committee is to increase awareness and buy-in from BPOs' of the importance of PIC.

PIC Committee members receive information on the status of the PIC annual process, and propose changes to the testing plan. They are also reminded of the importance of the timely completion of remediation actions during meetings.

The implementation of a PIC Steering Committee is an effective means to ensure that issues are reported and dealt with at the appropriate level of management, and can be considered a leading practice.

Unresolved remediation actions from prior years' testing should be included in the current year's annex

In the past, information presented in the Annex to the Statement of Management Responsibility including Internal Control over Financial Reporting did not specifically outline the nature of the work that was required to achieve audit readiness, as it pertained to outstanding remediation items. The Internal Audit Division made a recommendation to ensure that the Annex clearly communicate the areas requiring corrective actions in order to achieve the state of audit readiness, and areas where assurance was not attained for any given period.

The information outlined in the 2012/13 Annex to the Statement of Management Responsibility including ICFR follows the template included in the new Guideline for the PIC. However, information pertaining to unresolved remediation actions from prior years' testing has not been disclosed in the current year's Annex.

The template provided in the new Guideline for PIC does not specifically address cases where control weaknesses remain unresolved for periods over 12 months. The core of the Guideline states that once the first full assessment has been completed, the department's Annex should reflect the ongoing monitoring stage; in the section pertaining to Status of Assessment, the Guideline requires information on plans to conduct the assessment work where remediation is to be completed in the years to follow.

Reporting annually on control weaknesses that remain unresolved for periods exceeding 12-months will encourage prompt corrective action and ensure they continue to be brought to senior management's attention.

Recommendation:

The Assistant Chief Statistician of Corporate Services (and CFO) should ensure that:

• The information regarding incomplete or pending remediation actions that had been disclosed in the Annex to the Statement of Management Responsibility including ICFR of previous years continue to be disclosed in the Annex in future years until remediation is completed.

Management Response:

Management agrees with the recommendations.

• The Director, Financial Reporting Division will ensure all pending items from prior years are resolved in a timely manner, using the PIC Steering Committee to ensure rigorous follow-ups, and will disclose remaining remediation actions from previous years in the Annex.
  
  Deliverables and Timeline: Incomplete or pending remediation actions from previous years will be disclosed in the 2013-14 Annex to the Statement of Management Responsibility including ICFR which will be presented to the Chief Financial Officer, the Chief Statistician and the Departmental Audit Committee. This Annex will then be published with the Departmental Performance Report and Financial Statements on Statistics Canada's website, by November 2014.

Objective 2: To assess the adequacy/effectiveness of examination and oversight activities undertaken within the Finance Branch in support of the CFO's attestation for Cabinet Submissions.

New Guideline for CFO Attestation

The Treasury Board Secretariat has issued a new Guideline on CFO Attestation for Cabinet Submissions (the Guideline), effective January 1, 2014. The purpose of this guideline is to provide a framework and practical guidance for the CFOs in the due diligence review and attestation they provide on the financial management aspects of Cabinet submissions.

As the accounting officer for the department, the Chief Statistician is ultimately responsible for the development and preparation of submissions, and for obtaining the sponsoring minister's sign-off. Both the CFO and senior departmental managers play important roles in developing the submission and in supporting due diligence and attestation. The CFO has a dual role of providing financial expertise to client-programs, and providing objective and independent advice to the Deputy Head.

The CFO's challenge and attestation role is based on corporate financial stewardship and as an objective strategic business adviser on matters such as risk management, the examination of financial options and cost containment.

Six fundamental assertions have been identified to characterize the elements of attestation and to convey the CFO's attestation conclusions in support of decision making. The CFO assertions¹ are as follows:

1. The nature and extent of the proposal is reasonably described and material assumptions having a bearing on the associated financial requirements have been disclosed and are supported.
2. Significant risks having a bearing on the financial requirements, the sensitivity of the financial requirements to changes in key assumptions, and the related risk-mitigation strategies have been disclosed.
3. Financial resource requirements have been disclosed and are consistent with the assumptions stated in the proposal, and options to contain costs have been considered.
4. Funding has been identified and is sufficient to address the financial requirements for the expected duration of the proposal.
5. The proposal is compliant with relevant financial management legislation and policies, and the proper financial management authorities are in place or are being sought through the proposal.
6. Key financial controls are in place to support the implementation and ongoing operation of the proposal.

Before providing attestation, CFOs are expected to conduct a robust due diligence review and challenge function in order to attest to the integrity of the financial information and assumptions presented in Cabinet/TB Submissions. The Guideline states that this review should be based at a minimum on the six assertions listed above, and covers a set of criteria and sub-criteria outlined in Annex B of the Guideline (see Appendix B). An objective and independent due diligence review process should be conducted by staff other than those who directly participate in preparing the submission, and reporting relationships should be structured in a way that reduces the potential for influence, subjectivity and partisanship.

It is expected that a management record will be maintained and be sufficiently detailed for a third party to understand the scope of the due diligence and testing of the assertions and assess how the CFO's conclusions and observations in the Attestation Letter are supported. The Office of the Comptroller General encourages the use of a checklist to document the analysis/testing work performed by the CFO Attestation team, for each assertion criteria.

The roles and responsibilities of the due diligence review process and its independence need to be clearly defined

Statistics Canada has two program initiatives which require a Memorandum to Cabinet at the beginning of each five-year cycle and TB Submissions in order to obtain funding. The audit team interviewed key staff within the Finance Branch and program management, and reviewed the Finance Branch's organisational charts and departmental procedures documents in order to identify key employees involved in the preparation of Cabinet/TB submissions and those involved in the conduct of the due diligence review and challenge function. The audit team also assessed whether the roles and responsibilities of the CFO Attestation team and the independent nature of this function have been clearly defined, documented and understood.

At Statistics Canada, financial officers/advisors are directly involved in the preparation of TB Submissions. They are generally FI-02 and FI-03 level staff who functionally report to Financial Planning Division (FPD). They provide strategic financial advice and support to their respective client-program areas and are involved early in the process by providing financial technical assistance, drawing historical information from the departmental financial systems and compiling financial data, and by providing costing services to program managers for the development of financial assumptions for Cabinet/TB submissions. Engaging the finance officers during the development of Cabinet/TB submissions improves the quality of the submission and is considered a good business practice.

Two teams within the Financial Reporting Division (FRD) are also involved in the CFO Attestation process. The Costing Team provides advice to financial advisors/officers on costing methodology and templates to be used for compliance to financial legislation and TB policies. The PIC Team assesses the state of audit readiness for internal controls within programs on an on-going basis. These two teams are not directly involved in the preparation of Cabinet/TB Submissions, and provide an independent and objective outlook on matters related to compliance of the submission and internal controls. The audit found that the support provided for the development of Cabinet/TB submissions is adequate.

The Director FPD attends program meetings throughout the development of the TB Submissions, and performs analysis procedures as required on an on-going basis. Through interviews, it was noted that comparative analysis of information such as the previous project cycle's financial information and the current TB submission had been conducted, and questions had been raised with the program where significant differences/ increases existed. FPD carries out these activities in order to provide advice to the program to ensure that it prepares information to support various costs, in anticipation of potential questioning from TB. While the analysis conducted by FPD is critical, the objectivity required to perform the due diligence review process should be strengthened.

The Finance Branch has developed a checklist which is divided into six sections based on the fundamental assertions. It is to be completed by the program management team and financial staff who are directly involved in the preparation and development of the submission. Once they have compiled and vetted the information, the checklist is signed by various levels of program management, up to the Assistant Chief Statistician (ACS). The results of this exercise yield substantiation binders that are to be used by the Chief, TB Submissions to carry out an independent due diligence review as per the Guideline.

Throughout the TB submission process, the Finance Branch organises debriefing sessions with the ACS and CFO to provide a walk-through of the binder information collected from the program. During this process, the program's management team and assigned financial officers/advisors present information related to key assumptions, costing, financing options, and other details to the CFO, who in turn challenges the information provided.

Currently, reliance is placed on the work performed by the financial officers who compile the financial information for the program in order to meet the requirements of an independent/objective due diligence review. Because they are directly involved in compiling the information for the Cabinet/TB submissions, this impairs their ability to objectively review the information as required by the Guideline. To fully meet the requirements of the new Guideline for CFO Attestation, roles and responsibilities of parties involved in the CFO Attestation need to be clearly defined, and objectivity and independence of the due diligence review process and challenge function should be strengthened.

The Due Diligence Review Process is not sufficiently documented to meet the requirements of the new Guideline

To assess whether a management record supports the due diligence review conducted, as described in section 4.3.4 of the Guideline, the audit team reviewed all available documentation compiled by FPD in support of the CFO Attestation for two recent program initiatives: A Memorandum to Cabinet and one TB Submission. The supporting evidence consisted of substantiation binders which included checklists completed by those involved in preparing the submission, financial and non-financial reports, and tables prepared by the programs.

The audit compared the design of the checklist template developed by the Finance Branch for alignment with the assertion criteria included in Annex B of the Guideline. The audit found that the current design of the checklist template is not totally aligned with the assertion sub-criteria included in Annex B of the Guideline. There are a number of questions where the link to the assertion criteria is not clear. For example, according to Annex B of the Guideline, criteria pertaining to risk management should include:

Key risks have been considered; Likelihood and impact of key risks has been considered; and Risk response and mitigation strategies are clear.

In section 2.1 of the Finance Branch's checklist template, which pertains to risk management, examples of questions that have been included are:

Have all the key stakeholders been consulted? If so, attach a written confirmation from each area; has HR capacity been confirmed? Have resource needs been analysed?

It was not apparent how these questions were linked to risk management in the context of the new Guideline, and how they would yield information that would be useful for the assessment of the assertion criteria on risk management.

During the file review, the audit found a number of gaps in the documentation collected for the due diligence review process and challenge function. There were instances where the program checked-off that the documentation for certain assertions was either not applicable, or that documentation would be available at a later time, or that the information was available but it was not included in the binder. The following are specific examples of criteria for which no documentation had been produced for review: financial sensitivity analysis for cost drivers having a material impact on resource requirements; compliance with relevant financial management legislation and policies; and spending or expenditure authorities. Consequently, a number of assertion criteria could not be assessed by the auditors or a potential third party review.

Through interviews, the audit team was able to corroborate that the Director FPD had raised questions with the program after comparative analysis of the previous project cycle's financial information and the current TB submission. When significant differences existed between the last project cycle and the current financials, the program was directed to prepare sufficient information to support these costs. Conclusions drawn from this analysis are not formally documented through meeting minutes or record of decisions and cannot be linked to results of the CFO Attestation.

Consequently, the audit team could not determine what analysis or testing had been conducted, what rational supporting various costs presented by the program was deemed to be satisfactory, and which conclusions were drawn to support the CFO Attestation.

A sufficient management record documenting the due diligence process and challenge function, from which a third party can understand the scope of the review and testing of the assertions and assess how the CFO reached his conclusions and observations in the Attestation Letter, is needed in order to meet the requirements of the Guideline.

Recommendations:

The Assistant Chief Statistician of Corporate Services (and CFO) should ensure that:

• The roles and responsibilities of staff involved in the CFO Attestation have been refined and documented in a manner that addresses requirements of independence as expressed in the Guideline.
• The maintenance of management records which supports the CFO's analysis, conclusions and Attestation Letter are established and documented, in accordance with section 4.3.4 of the Guideline.

Management Response:

Management agrees with the recommendations.

• The Director, Financial Reporting Division, the Director, Financial Planning Division, the Deputy Chief Financial officer (DCFO) and the CFO will establish, document and communicate clearly the roles and responsibilities of all parties involved in the CFO attestation process, in a manner that addresses requirements of independence as expressed in the Guideline.
  
  Deliverables and Timeline:
  • The roles and responsibilities of all parties involved in a cabinet document submission process will be developed and documented in a manner that will address the requirements of independence as expressed in the Guideline, by September 2014.
  • The roles and responsibilities will be validated with a working group made up of participants from a sample of recent cabinet document submission processes, by October 2014.
  • The final proposal will be reviewed and approved by the DCFO and CFO, by November 2014.
  • The roles and responsibilities will be published on the Corporate Services Hub, by December 2014.
• The Director, Financial Reporting Division, the Director, Financial Planning Division, the DCFO and the CFO will maintain management records which support CFO's analysis, conclusions and Attestation Letter.
  
  Deliverables and Timeline:
  • A protocol for recording the analysis and conclusions from the discussions with the DCFO and CFO will be developed, as part of the formalized review and attestation process. To be implemented by September 2014.
  • More explicit descriptions of supporting documents, included as evidence for each of the checklist sections, will also be included to improve the comprehension by a third party, of the depth of the analysis completed and analyzed by the CFO and his team. To be implemented by December 2014.

Authorities are defined

Statistics Canada exercises its mandate to enter into statistical data sharing agreements with other organizations under the authority of sections 11 and 12 of the Statistics Act. The statistical health survey information provided to the Saskatchewan Ministry of Health supports the Ministry in policy development, evaluating programs to improve health and the efficiency of health services, and sustaining demographic and epidemiological research.

The Directive on Data Sharing under Sections 11 and 12 sets out the roles and responsibilities for the development, implementation and monitoring requirements of DSAs. The Directive notes that Information Management Division (IMD), in consultation with Legal Services, is responsible for drafting data-sharing agreements when requested from directors of statistical programs. IMD is also required to support managers during the development of new or modified data-sharing agreements with receiving parties, pursuant to section 12 of the Statistics Act. Subject Matter Divisions are responsible for communication with recipient organizations during the negotiations and drafting of the agreements.

Responsibilities and accountabilities at Health Statistics Division need clarification

Statistics Canada replaced its existing DSAs with the Saskatchewan Ministry of Health (the Ministry) with Omnibus data sharing agreements signed on November 13, 2012 and April 12, 2013 for the collection and sharing of information from several selected health surveys.

The HSD is the liaison between Statistic Canada and the Ministry with responsibility for the implementation of the DSAs. The Data Access Services (DAS) section in HSD is the liaison between Statistics Canada and the Ministry for negotiating and drafting the agreements, and oversees the secure transmission of the prepared survey files to the Ministry.

At the time of drafting and signing the new Omnibus DSAs, HSD was not aware that the Ministry had transferred its Data Warehouse Administration group which supports its informatics services and combining records containing personal health information to eHealth. eHealth is a Treasury Board Crown corporation formed in 2010. The relationship between the Ministry and eHealth was formalized in an Information Management Service Provider (IMSP) Agreement in April 2011.

In November 2013, an amendment was made to both agreements with the Ministry to add an additional paragraph (6.2.5) allowing the Ministry to share data with eHealth under The Health Information Protection Act of the Statutes of Saskatchewan, 1999. From 2011 to November 2013, the Ministry provided Statistics Canada confidential information to eHealth even though they did not have a provision in the Omnibus DSAs that allowed them to do so. The Ministry did this as they had a legal requirement to use the services of eHealth for data management and record linkage. eHealth is dedicated to the management of all of the Ministry's health data and under the IMSP Agreement it does not use the health data for its own purposes.

Practices for the administration and management of the Data Sharing Agreements need to be strengthened at Statistics Canada

As per the Directive on Data Sharing Agreements under Section 11 and 12, the DAS section in HSD maintains a Contact Control register listing the province, official contact and electronic file transmission (e-FT) recipient, and date of confirmation of this information. A Transmission Control register is also maintained with a description of the survey name and file, reference period covered, password, location, recipient name, shipping date and confirmed receipt date.

Review of the Contact Control register revealed that the official contact and e-FT recipient was listed as a Data Warehouse Administrator at eHealth with a back-up who is also an employee of the Data Warehouse group at eHealth. There was no evidence of a date to confirm when the information had been updated.

Review of the Transmission Control register and interviews with the DAS section revealed, that even after the Data Warehouse Administration group was transferred from the Ministry to eHealth in 2010, the DAS section had not made a distinction between the two separate organizations and as a result continued to transmit Statistics Canada confidential information to the two official contacts listed in their Contact Control register, even though they were no longer employees of the Ministry, but employees of eHealth. Under the T&Cs of the Omnibus DSAs with the Ministry, Statistics Canada confidential information is to be transmitted directly to the Ministry's designated Data Custodian.

Responsibilities of the Data Custodian prescribed in the DSA for the management of Statistics Canada DSAs should be implemented

At the Ministry, functional responsibility for the administration and management of Statistics Canada confidential information – data receipt, handling, storage and transmission rests with the Director of Health Information Policy and Legislation Division, Risk and Relationship Management Branch, who is the designated Data Custodian and recipient for the Ministry.

Under the Omnibus agreement, the Data Custodian must implement the following three key requirements:

A Confidentiality Document

According to Appendix C in the Omnibus DSA, the Data Custodian will

"prepare a document for the use of the Receiving Party's employees and contractors, outlining the T&Cs governing the use of the Information, as well as the procedures to send, receive, handle and store the Information (hereinafter the "Confidential Document")."

Prior to granting access to Statistics Canada information, the Data Custodian must ensure that every employee and contractor who access the information has agreed in writing to comply with the terms of the DSA by signing and acknowledging that they have read, understood and agree to comply with the T&Cs of the DSA as highlighted in the Confidentiality Document.

The audit found that a Confidentiality Document has been drafted, but it has not been administered and signed by the Ministry employees and contractors with access to Statistics Canada confidential information.

A register of Data Files

The Data Custodian is required to maintain a register of all data files received from Statistics Canada which contains the following information: date received, file name and reference period, name of employee who received the file, name of employee at Statistics Canada who sent the file, employee responsible for safekeeping of the file, and the date the file was destroyed or returned to Statistics Canada.

The audit found that a template has been developed for this requirement, but it was blank and did not include a listing of all the data files received from Statistics Canada.

A register of Access to Data Files

The Data Custodian is required to maintain a register of all persons who have been granted access to the data files received from Statistics Canada by the Ministry which contains the following information: file name and reference year, name of employee or contractor to whom access has been given, justification for access, name of delegated manager who authorized access and date of authorization, and start and end dates of period for which access is authorized.

The audit found that a template has been developed for this requirement, but it was also blank and did not include a listing of all persons granted access to data files received from Statistics Canada.

As well, a User Guidelines for Selected Survey document has been developed which mirrors the T&Cs from Statistics Canada DSAs with the Ministry with respect to Data Sharing, Use of the Information, Access to the Information, Third Party Sharing and Monitoring and Compliance, but it too has not been implemented.

A third party contract entered into by the Ministry with a provincial research organization did not include an audit clause in compliance with the requirements of the DSAs

Clauses with respect to monitoring are prescribed by Statistics Canada in the Omnibus data sharing agreements. The Omnibus DSAs state that

"Statistics Canada shall have the right, when it determines necessary, to perform reviews of compliance with this Agreement"

The DSAs also prescribe that third party agreements entered into by the Ministry

"shall contain a clause stipulating the right of Statistics Canada or the Ministry (the Receiving Party) to review compliance with the terms of this Agreement".

The Ministry has Master Data Sharing Agreements with the thirteen HRs in Saskatchewan and the Data-Sharing-Schedules that accompany these include an audit clause. An audit clause is also included in the IMSP Agreement with eHealth and eHealth cooperated with the Ministry and Statistics Canada to review compliance with the T&Cs of the Omnibus DSAs. However, an audit clause was not included in a research contract that the Ministry has with a provincial research organization.

Recommendations:

The Assistant Chief Statistician Social, Health and Labour Statistics Field should ensure that:

• Statistics Canada data is transmitted directly to the Data Custodian at the Ministry in compliance with T&Cs of the DSAs.

Management Response:

Management agrees with the recommendation.

• The Director of HSD will confirm the identity and organization information of the designated Data Custodian at the Saskatchewan Ministry of Health and will update the two transmission forms (to be completed when confidential statistical files are transmitted to external receiving partners) with this information. These are Form 1 - Acknowledgement of Transfer for Director and Form 2 - Acknowledgement of Transfer by an External Receiving Party.
  
  Deliverables and Timeline: Form 1 and 2 to be updated by April 2014.

The Assistant Chief Statistician Social, Health and Labour Statistics Field should communicate with the Ministry and ensure that:

• The Data Custodian at the Ministry ensures compliance with all the requirements of the DSAs: that a Confidentiality Document is signed by employees and contractors prior to granting access to Statistics Canada data; a register of data files received from Statistics Canada is completed and maintained; and a register of all persons who have been granted access to those files is completed and maintained.
• An audit clause is included in all the Ministry's third party agreements and contracts in compliance with the DSAs.

Management Response:

Management agrees with the recommendations.

• The Assistant Chief Statistician will issue a letter to the Saskatchewan Ministry of Health, outlining the requirements of the data sharing agreement and reiterating the role and responsibilities of the Data Custodian. Additionally the letter will request a copy of the Ministry's Confidentiality Document; a copy of the completed register of data files received from Statistics Canada and a copy of the completed data-access register of all persons granted access to Statistics Canada data files.
  
  Deliverables and Timeline: Letter to be prepared and sent by May 2014. As part of HSD's process for ongoing monitoring of access, HSD will request from the Ministry, every six months, a copy of their current and completed data-access register.
• The Director of HSD will request copies of the Ministry's third party agreement templates and will review them for compliance to the terms and conditions of the data sharing agreement and will inform the Ministry of any gaps. Health survey information will only be provided after a thorough and satisfactory review of the third party templates. Senior management at Statistics Canada will be informed once the templates are compliant.
  
  Deliverables and Timeline: Request to be sent by May 2014 and review to be completed immediately upon receipt of third party templates.

Improvements are required for the management and handling of Statistics Canada confidential information at the Ministry and at eHealth

At the Ministry:

Operational administration and management of the DSAs remains with the Director, of Health Information Policy and Legislation Division, Risk and Relationship Management Branch at the Ministry - the designated Data Custodian for Statistics Canada confidential information. A Senior Policy analyst reporting to the Director is in charge of the day-to-day administration of the DSAs. Interviews revealed that there has been significant turnover in this group over the past couple of years, both at the Director level (three directors in two years) and at the analyst level. Also, the Senior Policy analyst was on extended leave during our audit. The Director was performing both duties and confirmed that the roles and responsibilities for the Analyst's position were not documented. The lack of clearly documented and communicated roles and responsibilities and employee turnover elevates the risk of ineffective and inefficient processes being applied for data management.

At eHealth Saskatchewan:

As part of the audit, a walkthrough of the processes and procedures for data receipt, storage and transmission of Statistics Canada data files was conducted. It was noted that detailed instructions exist for data receipt, storage and transmission, and are being followed by two employees of the Data Warehouse Administration group. The audit noted that they have an understanding of their roles and responsibilities but these have not been documented or communicated.

A review of the directory where Statistics Canada original encrypted data files received through e-FT are stored, revealed that they are downloaded in eHealth's statistical analysis system and database servers and require a separate password from the password that was used to log on to the network. The audit noted that logs of all the information received from Statistics Canada and transmitted to third party recipients are maintained electronically by the Data Warehouse group. The electronic logs maintain a register of the files sent, the recipient, contact name and information, and the date sent.

Interviews revealed that the Data Warehouse Administration group will only share Statistics Canada health information to either internal or external recipients after receiving approval from the Data Custodian. However, there was no evidence of these approvals because they are done informally.

Third party sharing by the Ministry is not always in compliance with the requirements of the DSAs

The Ministry can provide access to Statistics Canada confidential health survey information to third parties under the following five provisions:

1. Researchers working under contract directly for the Ministry to provide a survey-related product or service for the sole benefit of the Ministry.
2. Another organization that has entered into a DSA with Statistics Canada for the same survey and the same survey reference years.
3. eHealth under Health Information Protection Act of the Statutes of Saskatchewan, 1999 for the purposes of providing informatics services and combining records containing personal health information, provided that eHealth is working under contract directly for the Ministry to provide a survey-related product or service for their sole benefit and mandate.

The Ministry did not have any contracts with researchers, or with any organizations that have entered into a DSA with Statistics Canada. An IMSP Agreement was in place with eHealth.

4. Provincial/territorial or university research institutes working under contract directly for the Ministry to provide a survey-related product or service for the sole benefit of the Ministry.

The audit found that the Ministry had a contract with a provincial research corporation. The audit noted that one of the requirements stipulated in the DSA for setting up a contract with a provincial research institute is that:

"The Receiving party may provide access to the Information, to a recognized research institute or organization, provided that express written consent has been obtained from Statistics Canada prior to the contractual arrangement having been formalized between the Receiving Party and the research institute/organization".

Interviews revealed that the Ministry did not obtain an express written consent from Statistics Canada for this contract.

A copy of the contract has since been provided to HSD by IA for review. IA was informed by HSD that they would have provided their written consent to the Ministry for the existing contract, as it met the necessary confidentiality related concerns and all of the requirements of Statistics Canada. IA reviewed one of the files shared with the provincial research corporation and noted that no personal identifiers were shared with them as per the DSA.

5. To thirteen Saskatchewan HRs. However, Statistics Canada health survey information can only be provided to the HRs if the respondents were notified that their survey responses would be provided to HRs in their province of residence. Otherwise, the HR can only work under contract for the Ministry to provide a survey-related product or service for the sole benefit of the Ministry.

The audit found that the Saskatchewan Ministry of Health has entered into Master Data Sharing Agreements with the HRs in Saskatchewan, for a period of five years which can be continued on a month-to-month basis, unless otherwise terminated. Review of the Master Data Sharing Agreement revealed that it sets out the administrative conditions for sharing data with the HRs.

One of the administrative conditions in the Master Data Sharing Agreement stipulates that before data can be shared with a HR

"a separate request for data must be established in writing in a schedule called a 'Data-Sharing-Schedule' and must state that they were set-up pursuant to the Master Data Sharing Agreement and will become effective only upon execution by the authorized personnel of both parties".

When access to Statistics Canada confidential information is on the premises of the HR, HRs are required to sign Data-Sharing-Schedules that are reflective of the T&Cs from the Statistics Canada DSAs with respect to Access, Use and Security of shared information; Confidentiality; Sharing with a third party; and physical and IT security. This is in compliance with the requirement in the DSAs that

"HRs must undertake by a written agreement or contract to comply with the terms of the DSA with Statistics Canada, and to implement the required security measures set out in appendix 'A' of the DSA with Statistics Canada".

The audit found that in 2013, six Statistics Canada data files were shared by the Ministry with access on the premises of three HRs, but Data-Sharing-Schedules for each separate request had not been set-up and signed with the HRs by the Ministry. IA reviewed one of the files shared with one of the HRs and noted that no personal identifiers were shared with them as per the DSAs.

Recommendations:

The Assistant Chief Statistician Social, Health and Labour Statistics Field should communicate with the Ministry and ensure that:

• Roles and responsibilities for the management and handling of Statistics Canada health survey information should be documented and communicated to employees both at the Ministry and at eHealth.
• The Ministry should maintain formal approvals on file allowing eHealth to share data with third parties.
• Data-Sharing-Schedules should be established with the HRs in compliance with the Ministry's requirement under its Master Data Sharing Agreement and Statistics Canada DSAs.
• Express written consent should be received from Statistics Canada prior to arranging a contract with a recognized provincial institute or research organization.

Management Response:

Management agrees with the recommendations.

• The Assistant Chief Statistician will issue a letter to the Saskatchewan Ministry of Health, requesting a list of the Ministry and eHealth employees with access to Statistics Canada health survey information and their roles and responsibilities in terms of handling Statistics Canada information. The letter will also request the Ministry's plan for documenting and communicating the roles and responsibilities with respect to the management and handling of Statistics Canada health survey information.
• The Ministry will be requested to establish Data-Sharing Schedules with Health Regions for sharing Statistics Canada health survey information in compliance with the Ministry's requirements under its Master Data Sharing agreement and Statistics Canada DSAs and provide copies of the schedules to HSD.
• The Assistant Chief Statistician will reiterate the Ministry's responsibility to maintain formal approvals on file and to receive express written consent from HSD prior to arranging a contract with a recognized provincial institute or research organization.
  
  Deliverables and Timeline: Letter to be prepared and sent by May 2014. Copies of all Data-Sharing Schedules with Health Regions for sharing Statistics Canada health survey information will be requested.

Physical access is secure

The Data Warehouse Administration group at eHealth is housed in the same premises as the Ministry. A physical inspection of the Ministry's site revealed that physical access to the Ministry's premises is secured by locked doors with a card scanner outside each set of doors in the building where employees must swipe their key fobs to enter. Visitors must sign in at the front desk and be escorted at all times.

Physical storage of Statistics Canada information is secure

Statistics Canada data resides within eHealth's secured IT system (data warehouse servers). The eHealth servers are located in an 1,800 square foot facility in a separate building with 24/7 security. Passcard access into the secured server room is available only to authorized personnel of eHealth. No guest passcard access is allowed. Visitors must sign in at the front desk and be escorted at all times by authorized personnel. Walls, floor and ceiling of the server room are protected by wire mesh and cameras are also located in the server room to log entry and access to the servers. Security tapes are retained for ninety days and an access log is reviewed monthly by the Director.

Network access to Statistics Canada data files are not compliant with the policy framework of the Ministry and eHealth, and with the T&Cs of the DSAs

Network access privileges are requested through eHealth's Service Desk. eHealth employees must complete a Network Account Authorization form for access to the networks they require and obtain their manager's approval. A similar form must be completed by the manager when the removal of access privileges upon an employee's change of duties or termination of employment is required.

The T&Cs of the DSAs, stipulate that access to Statistics Canada confidential information at the Ministry is to be granted on a need-to-know basis, to employees whose work responsibilities require such access in order for the Ministry to meet its statistical and research needs. In addition, the IMSP Agreement between the Ministry and eHealth, states that

"eHealth may access and use information on a need-to-know basis as expressly authorized by the Ministry for the sole and express purpose of fulfilling its obligations under the Agreement".

The audit tested this requirement by reviewing who has access privileges to the directory where Statistics Canada data files are stored, the purpose, and frequency. Two employees in the Data Warehouse Administration group at eHealth have direct responsibility for Statistics Canada data files which involved data receipt, storage, and transmission to internal and external users. However, access to the database server on which Statistics Canada data files are stored was provided to all seven employees of the Data Warehouse group for cross-training and back-up purposes.

Section 8.1.1 of the Ministry's Security Policy Framework states that

"an employee of a Ministry of Health third party contractor is required to sign a Confidentiality Agreement prior to providing services to the Ministry of Health".

This requirement is separate from the Confidentiality Document prescribed in the Omnibus DSAs for administration by the Data Custodian prior to granting access to Statistics Canada data.

The audit found that all of the seven employees of the Data Warehouse Administration group that were former employees of the Ministry and are now employees of eHealth and providing services to the Ministry have not signed a Confidentiality Agreement with the Ministry.

Security measures exist for identification and authentication safeguards, IT storage and data transmission

Through testing, the audit revealed that data files are managed through server set-up and directory access rules at eHealth to ensure that access is only by those that have been authorized. Data files are received directly from Statistics Canada through e-FT and stored on a database server. Logical access controls exist at the device level for all workstations and at the system level for all database servers. Data is not stored on individual workstations. eHealth transmits data to external users through secure file transfer which is encrypted, and the data files are zipped and password protected.

Security measures exist for information copying, retention and records management

Information stored on the database servers is backed-up daily on encrypted tapes which are stored offsite in a secured building for thirty days and then rotated to an off-site private storage company. Review of both eHealth and the Ministry's Security Policy Frameworks revealed that their security policies prohibit the transmission of data through fax or emails and data cannot be stored on transportable media devices (i.e. CD-ROMs, USB sticks, hard drives, or laptops). Data is not to be removed from the premises with the exception of the transfer to third parties and to the offsite storage company and it is not to be reproduced. A private shredding company is used for the secure disposal of confidential information.

Recommendations:

The Assistant Chief Statistician Social, Health and Labour Statistics Field should communicate with the Ministry and ensure that:

• Access to Statistics Canada data at eHealth is restricted to employees on a "need-to-know" basis in compliance with the T&Cs of the DSAs, and the IMSP Agreement between the Ministry and eHealth.
• Employees of a Ministry of Health third party contractor providing services to the Ministry of Health should sign the Ministry's Confidentiality Agreement in compliance with its Security Policy Framework.

Management Response:

Management agrees with the recommendations.

• The Assistant Chief Statistician will issue a letter to the Saskatchewan Ministry of Health to remind the Ministry that access to Statistics Canada data at eHealth is restricted to employees on a "need-to-know" basis in compliance with the T&Cs of the DSAs, and the IMSP Agreement between the Ministry and eHealth.
• The Ministry will also be reminded of the requirement to have all third party contractors sign the Confidentiality Agreement and the Ministry will be asked to confirm that all third party contractors have signed the Confidentiality Agreement.
  
  Deliverables and Timeline: Letter to be prepared and sent by May 2014 and confirmation that all third party contractors have signed the Confidentiality Agreement be sent to HSD by June 2014.
  
  As part of HSD's process for ongoing monitoring of access, HSD will request every six months from the Ministry a list of the Ministry and eHealth employees with access to Statistics Canada health survey information, including their roles and responsibilities.