Key financial controls: Process Overview

The chart is a flow chart description of the process of Assessment of Internal Controls over Financial Reporting (ICFR) presenting the 4 core activities involved and their outputs described just below each activity. Activities and results/outputs are differentiated by colors and forms. The flow chart is set up in 5 key steps aligned with arrows from left to right. A box groups the 4 core activities for the assessment of ICFR. The flow chart begins with the first step on the left, which is Planning & scoping. Outputs from this activity are Strategic Plans for ICFR & ITGC and work plans. From this point, the process moves at right to Documentation of in-scope business processes. Outputs from this activity are Process Narratives or Flow Charts. Going right onto the third step, the process progresses to the activity of Tests of Design of Key Controls and involves, when required, Letters of Recommendations (LoR) regarding Design. Finally, Tests of Effectiveness of Key Controls is the last activity performed within the process of Assessment of ICFR. LoRs are also an output shown for this step. With arrows from top to bottom, the chart demonstrates that ongoing monitoring and risk management are performed at each step throughout the assessment process. Once the process of the Assessment of ICFR is fully completed, there is a resulting step described outside the box, at right. Reporting to the CS, CFO and Field Senior Management includes progress towards implementing PIC, results of the assessment of ICFR, and the state of audit readiness. Finally, an arrow showing an output from reporting, which is the Statement of Management Responsibility including ICFR labelling the signatures of the CS and CFO.

Audit Report

April 22, 2013
Project Number: 80590-74

• Executive summary
• Introduction
  • Background
  • Audit objective
  • Scope
  • Approach and methodology
  • Authority
• Findings, recommendations and management responses
  • Framework supporting the assessment of the effectiveness of ICFR
  • Ongoing monitoring and reporting on the state of ICFR
• Appendices
  • Appendix A: Audit criteria
  • Appendix B: Acronyms
• List of figures
  • Figure 1: Assessment of ICFR

Executive summary

The Treasury Board of Canada (TB) Policy on Internal Control took effect on April 1, 2009 and is issued pursuant to Section 7 of the Financial Administration Act (FAA). The objective of the Policy is to ensure that risks relating to the stewardship of public resources are adequately managed through effective internal controls, including internal controls over financial reporting. The Policy requires the Chief Statistician (CS) and the Chief Financial Officer (CFO) of Statistics Canada to sign an annual Statement of Management Responsibility Including Internal Control over Financial Reporting attesting that an effective risk-based system of internal control is in place and operating within the Agency.

The objective of this audit was to provide assurance to the CS and Statistics Canada's Departmental Audit Committee (DAC) on the adequacy of the activities supporting the framework in place for the Finance Branch's annual risk-based assessment of the effectiveness of the system of internal control over financial reporting in support of the Statement of Management Responsibility Including Internal Control over Financial Reporting (the Statement).

This audit was conducted following the Standards for the Professional Practice of Internal Auditing as per the Institute of Internal Auditors (IIA) and in accordance with the TB Policy on Internal Audit.

Key findings

Statistics Canada has met the requirements for the implementation of a framework supporting the Policy on Internal Control. The Agency's project charter and overall process for assessing the effectiveness of ICFR integrates all major components of the Diagnostic Toolkit developed by the Office of the Comptroller General.

Statistics Canada has developed a key strategy document titled: "Proposed Strategy to Address Requirements of Policy on Internal Controls (March 2010)", which forms the basis of the Agency's approach to implementing the PIC. It includes all of the main components recommended in the Diagnostic Toolkit. Over the past two years, Finance has adjusted certain governance components of its framework for assessing ICFR; however Statistics Canada's strategic plan for PIC compliance has not been revised or updated for continued operational relevance since it was first developed.

The provision of ongoing assurance regarding the full system of ICFR is required to meet policy requirements. Finance has completed all activities related to Tests of Operating Effectiveness (TOE) according to testing schedule established in its PIC strategy, with the exception of processes and systems that are planned to be changed or in the process of being changed. Compensatory controls have not been tested by Finance during transition periods.

Statistics Canada has established processes for monitoring and reporting PIC compliance. The PIC team monitors the level of completion of remediation action plans resulting from each cycle of Tests of Design (TOD) and TOE; however in some cases, to the timing of validation activities does not permit the PIC team to provide ongoing assurance regarding ICFR. Audit testing of completed remediation actions for two business processes' action plans confirmed that recommendations had been implemented.

In accordance with the Policy, the Agency has completed its first Annex to the Statement of Management Responsibility including Internal Control over Financial Reporting for fiscal year 2011-2012, and is currently working towards the preparation of its second statement for fiscal year 2012-2013. The Statement follows the structure per the OCG's Diagnostic Toolkit, however areas requiring corrective actions in order to achieve the state of audit readiness, and areas where assurance was not attained for a given period are not explicitly reported.

Overall conclusion

Statistics Canada has implemented a comprehensive framework in support of its annual risk-based assessment of the effectiveness of the system of internal control over financial reporting.

While the activities supporting the framework in place are adequate, opportunities exist to ensure the Agency can sustain its ICFR assessment process cycle and remain current as continuous progress towards audit readiness evolves. Particular attention should be devoted to updating the Agency's strategy, and clearly communicating areas requiring corrective actions and areas where assurance was not attained.

Conformance with professional standards

The audit was conducted in accordance with the Internal Auditing Standards for the Government of Canada, which includes the Institute of Internal Auditors (IIA) Internal Standards for the Professional Practice of Internal Auditing.

Patrice Prud'homme
Chief Audit Executive

Introduction

Background

The Treasury Board of Canada (TB) Policy on Internal Control (PIC) took effect on April 1, 2009 and is issued pursuant to Section 7 of the Financial Administration Act (FAA). The objective of the Policy is to ensure that risks relating to the stewardship of public resources are adequately managed through effective internal controls, including internal controls over financial reporting (ICFR).

The Policy requires the deputy head (Chief Statistician) and the Chief Financial Officer (CFO) of Statistics Canada to sign an annual Statement of Management Responsibility Including Internal Control over Financial Reporting (the Statement). The Statement prefaces the Agency's financial statements, and includes the following:

• Acknowledgement of management's responsibility to ensure that an effective system of internal control over financial reporting is maintained;
• Acknowledgement of the conduct of an annual risk-based assessment of the effectiveness of the system of internal control;
• Acknowledgement of the establishment of an action plan; and
• A summary of the results of the assessment and the actions taken in response to issues.

The expected results of the Policy are the following:

• An effective risk-based system of internal control is in place in departments and is properly maintained, monitored and reviewed, with timely corrective measures taken when issues are identified; and
• An effective system of internal control over financial reporting is operating in departments as demonstrated by the Departmental Statement of Management Responsibility Including Internal Control over Financial Reporting.

The Office of the Comptroller General (OCG) has developed the 2010 Policy on Internal Control – Preliminary Draft Diagnostic Tool for Departments and Agencies (Diagnostic Toolkit), which provides departments with a practical step-by-step approach for planning and conducting a risk-based assessment of the effectiveness of the systems of ICFR as required under the PIC. It states that implementation of the PIC does not require an assessment of all controls, but rather an assessment of key controls based on risks. The proposed approach involves multi-year assessment planning, taking into account departmental capacities.

The Financial and Administrative Services Division (FASD) (formally Financial Management Operations and Systems Division) is responsible for developing a framework for the assessment of operating effectiveness of ICFR and Information Technology General Controls^{Footnote 1} (ITGC). Staff assigned to these responsibilities (the PIC team) include: one full-time FTE responsible for the coordination of testing activities carried out by external contractors and tracking follow-up activities. Two levels of supervision oversee activities supporting PIC compliance on a part-time basis, including a Chief and Assistant-Director. The PIC team reports to the Acting Director (A/Director), FASD, and to the Director General of Finance (the Deputy CFO). The Finance team started the initial stages of the planning and scoping process in 2009. Since then, the first full cycle of assessment of ICFR has been completed. The Agency issued its first Statement of Management Responsibility for the fiscal year ending March 31, 2012. From that point on, the project of implementing the PIC has evolved to a sustained process which requires monitoring and maintenance of documentation in collaboration with process owners, testing ICFR and reporting on the state of audit readiness.

At Statistics Canada, Assistant Chief Statisticians (ACSs) are required to sign a Statement of Management Responsibility for their respective fields. This initiative was implemented by the Finance team as a best practice. By signing this statement, ACSs agree to provide full cooperation and support through the annual assessment of ICFR within their area.

The assessment of ICFR involves four (4) core activities, which are undertaken according to an established schedule, as per a strategy defined by the Agency. A brief description of each activity is outlined below. Processes within each activity are further detailed throughout the findings section of this report.

Figure 1: Assessment of ICFR

Planning and Scoping is the first step in conducting an assessment of an Agency's ICFR. Strategic Plans for ICFR and ITGC and related work plans outline the scope of the ICFR that will be covered and the frequency of testing. It presents the results of a risk assessment exercise from which decisions on the selection of in-scope business processes are made.

Documenting processes and controls within each in-scope business process is the approach used to identify key controls in place to mitigate risks to an acceptable level. Ultimately this will help to ensure that control testing efforts are appropriately focused on areas of greatest risk.

The assessment of control design involves identifying the key controls in place to prevent or detect a material misstatement in the financial statements and mitigate key risks. Testing of Design is intended to confirm alignment of these key controls related to the key risks to the financial statements they aim to mitigate.

The assessment of control operating effectiveness involves assessing the extent to which a key control has been operating as intended over a specified period of time. Tests of operating effectiveness are intended to demonstrate the reliability of the controls over a period of time in reducing financial reporting risks.

Key controls requiring improvements are communicated to each business process owner through Letters of Recommendation (LOR). Finance's ongoing monitoring and reporting activities, as well as sound risk management practices ensure continued progress towards audit readiness.

Audit objective

The objective of this audit was to provide assurance to the Chief Statistician (CS) and Statistics Canada's Departmental Audit Committee (DAC) on the adequacy of:

• The activities supporting the framework in place for the Finance Branch's annual risk-based assessment of the effectiveness of the system of internal control over financial reporting in support of the Statement of Management Responsibility Including Internal Control over Financial Reporting.

Scope

The scope of this audit included an examination of processes and mechanisms in place for selected key steps within the PIC implementation process, as described in the Office of the Comptroller General's Diagnostic Toolkit. The audit included interviews with management and staff within the Finance Branch and other divisions having an impact on PIC compliance. The scope of the audit included an examination of processes and mechanisms in place during fiscal years 2011-2012 and 2012-2013 up to December 2012.

Approach and methodology

The audit was conducted following the Standards for the Professional Practice of Internal Auditing as per the Institute of Internal Auditors (IIA) and in accordance with the TB Policy on Internal Audit. The audit work consisted of examination of documents, interviews with key Senior Management and personnel of Statistics Canada, review of processes and procedures with respect to internal controls and testing of the completion of a sample of remediation actions. The audit approach was inspired by the TB Policy on Internal Control and the 2010 Policy on Internal Control – Preliminary Draft Diagnostic Tool for Departments and Agencies issued by the Office of the Comptroller General in July 2010.

Authority

The audit was conducted under the authority of Statistics Canada Multi-Year Risk-Based Audit Plan 2012/13-2016/17, approved April, 2012 by the Departmental Audit Committee.

Findings, recommendations and management responses

Objective: Adequacy of the activities supporting the framework in place for the Finance Branch's annual risk-based assessment of the effectiveness of the system of internal control over financial reporting in support of the Statement of Management Responsibility Including Internal Control over Financial Reporting.

Framework supporting the assessment of the effectiveness of ICFR

The process of assessing the effectiveness of ICFS starts from early planning, including financial statement decomposition, through the identification of key risks and key controls, the documentation requirements to support adequate assessments and the design and operating effectiveness testing up to the completion of remediation and on-going monitoring activities with periodic risk-based testing over time. This process is intended to enable departments to better understand their state of audit readiness and level of compliance with the PIC.

Project charter

Based on the approach described in the OCG's Diagnostic Toolkit; activities, schedules, and resources needed to achieve PIC compliance objectives should be documented and sufficient resources should be secured to support compliance to the PIC. Responsibilities for the implementation of ICFR should be clearly identified and assigned. As part of this process, the Agency should have a documented plan in place for the assessment of ICFR effectiveness required by the PIC. The documented plan should include scope, timing, milestones, costs/capacity, and cover the steps required to assess the effectiveness of ICFR. An independent oversight mechanism should be in place to deal with cases concerning values and ethics that allows for anonymous reporting of suspected improprieties.

Statistics Canada has developed two key guiding PIC strategy documents: The first is titled the "Proposed Strategy to Address Requirements of Policy on Internal Controls (March 2010)" and the second is the "Proposed Strategy to Address Requirements of Policy on Internal Controls - ITGCs (January 2012)", which is specific to Information Technology General Controls. These two strategy documents form the basis of the Agency's approach to implementing the PIC, and include all the main components recommended in the Diagnostic Toolkit, with the exception of costs and capacity, which are covered in the work plan developed annually to execute on the ICFR and ITGC strategy documents.

Responsibilities for PIC compliance are clearly identified and assigned within the "Proposed Strategy to Address Requirements of Policy on Internal Controls document (March 2010)". The strategy document identifies four stakeholders within the Agency having significant roles and responsibilities: the CS, the CFO, the DAC and Financial Management Operations Systems Division (now the FASD). Described roles and responsibilities are in-line with the Policy. In addition, the Annex to the Statement of Management Responsibility Including ICFR describes the roles of three committees involved in monitoring the PIC compliance program:

• DAC is an advisory committee that provides objective views on the Agency's risk management, control and governance frameworks;
• The Corporate Policy Committee (CPC) is chaired by the CS and is the most senior executive committee in the Agency, providing broad strategic direction. It acts as the body for all decision-making related to corporate-level management of the Agency including strategic corporate planning, resource allocation, financial management, human resources management, communications and dissemination, program evaluation and information management/information technology; and
• Administrative Practices Committee (APC) oversees the development, implementation and application of administrative, financial management, risk management and evaluation practices.

Statistics Canada also has an independent oversight mechanism in place that allows for anonymous reporting of suspected improprieties. Should employees come across information or evidence that could potentially involve suspected improprieties, they can report any such concerns through the values and ethics framework established within Statistics Canada.

The Agency's project charter is in line with the PIC and follows the approach described in the OCG's Diagnostic Toolkit.

Risk management

Management should have adequate risk management practices in place, to consider and mitigate risks associated with the implementation of ICFR, and achieving PIC compliance. Implementing and maintaining a framework for PIC has inherent risks that may preclude the achievement of compliance with the Policy.

Interviews revealed PIC compliance is subject to four main dependencies: 1) Services provided by an external consultant; 2) Finance staff assigned to activities related to PIC; 3) The collaboration of business process owners for the documentation of processes, the identification of key controls and implementation of remediation actions where control weaknesses are identified; and 4) The support of senior management across the Agency.

Risks to the implementation of ICFR have been considered and mitigated within Finance. FASD has identified a number of short and long-term mitigation strategies to manage risks associated to these dependencies, including, but not limited to:

• Securing a professional services contract for resources to carry out the PIC work plan;
• Oversight activities to ensure quality over the consultants work;
• Access to a pool of rotational staff within Finance to address current and future knowledge resource needs for activities related to the PIC;
• Formal letters of acknowledgement of responsibility towards the implementation of PIC signed by the ASCs in each field; and
• Presentations to senior management across the Agency explaining the requirements of the policy as well as their respective roles and responsibilities.

From its first year of operation, Finance has monitored the effectiveness of mitigation strategies in place, and is in the process of developing additional strategies to increase the level of collaboration of business process owners. As a result, FASD has identified certain challenges with respect to follow-up activities and is considering implementing a steering committee involving key stakeholders at the Director and Director General (DG) levels to increase the support and engagement of management with respect to PIC compliance across the Agency. This new initiative is expected to be implemented in 2013.

Finance has an adequate approach to managing the inherent risks associated with implementing a framework for the annual risk-based assessment of the effectiveness of the system of ICFR.

Planning and scoping

As Statistics Canada's process to assess ICFR has evolved from an initial implementation project to a sustained process, the strategic plan for PIC compliance and work plan should be reviewed periodically and validated by the CFO and CS to ensure continued relevance. As required by the PIC, DAC should be consulted on the risk-based assessment plans for the annual assessment of the effectiveness of the departmental system of internal control.

Statistics Canada has mechanisms in place to plan and scope its strategy for PIC compliance, to address significant issues, and ensure continuous improvement. The two PIC strategy documents describe the approach to be used for the testing of ICFR, roles and responsibilities, reporting requirements, next steps, a work plan with defined timelines, and detailed risk assessments for each in-scope business process.

To develop the strategy documents and associated work plan, the Agency has identified the key risks facing the integrity of the financial statements (F/S), the significant accounts within the F/S, and has determined which business processes are considered in-scope.

The business processes considered in-scope are the following:

• Financial Close and Reporting;
• Payroll and Benefits;
• Census Pay;
• Interviewer's Pay;
• Revenues;
• Operating Expenditures;
• Capital Assets;
• Entity Level Controls, including Budgeting and Forecasting; and
• General Computer Controls (GCCs).

For each in-scope business process, the Agency has identified the significant business units, systems, and entity level controls that are reported in the F/S. The planning documents specify the area to be tested, the inherent risks, the rationale for the inherent risk areas to be tested, the control objectives, the extent of testing, and the frequency of testing.

In March 2013, Statistics Canada will have completed its second year of assessment of ICFR following the original PIC compliance strategy. The strategy guides decision-making regarding which processes, financial statement accounts, and risks are most relevant for consideration in the testing strategy, and the allocation of resources. Over the past two years, Finance has adjusted certain governance components of its framework for assessing ICFR; however Statistics Canada's strategic plan for PIC compliance has not been revised or updated for continued operational relevance since it was first developed. Revisiting and updating the strategy and risk environment on a periodic basis will ensure that the strategy remains relevant, by being reflective of the Agency's operating environment.

At the end of each fiscal year, the CS and CFO are responsible for signing the Statement of Management Responsibility. Therefore, once the testing strategy has been updated, formally validating it with the CS and the CFO would ensure they have an opportunity to review and provide input into the proposed plans. The outlines of the strategy and the Statement were presented to the CFO, senior management and DAC in March 2012, but the testing strategy document was not presented in its entirety. As a result, actual completed testing cannot be compared to planned testing activities. Signing the annual Statement requires an acknowledgement of the conduct of annual risk-based assessment of ICFR, including any deviations from the PIC strategy.

Documentation of in-scope business processes

An adequate process should be in place to document in-scope business processes and identify process-level controls that mitigate risks to the integrity of the financial statements. Business process narratives and flowcharts are used to identify key controls, and map these controls to F/S risks. Documentation maintained for in-scope business processes should be evergreen, reflecting significant changes in processes and/or systems that have an impact on ICFR.

Statistics Canada has completed its initial round of documentation for each in-scope business process. A review of the business process documentation for four in-scope business processes (Pay, Financial Close Reporting, Revenues and GCC-Change Management) found that the Agency follows a standardized approach to documentation (process narratives), which include a description of the process and sub-processes, related systems, key controls and identification of the process owners accountable for each in-scope business process. Key control points and accountabilities were identified in the narratives, or directly within the testing matrices, and linked with key risks. For three out of the four in-scope business processes reviewed, process narratives were prepared using a standard format. The GCC-Change Management process was documented using a process flowchart, with specific sub-processes documented in the testing matrices. This is an acceptable alternative to process narratives.

Process owners develop their own process narrative documentation, which is then validated by the PIC team. Process documentation should be evergreen and as such, should be periodically validated with process owners to ensure documentation remains up-to-date. This practice helps ensure that Statistics Canada is working with an accurate and up-to-date understanding of business processes when identifying and monitoring key controls, risk factors, and determining areas of ICFR testing. Currently, reliance is placed upon process owners to communicate changes in processes to the PIC team, and significant follow-up is required as business process owners do not systematically communicate changes to the PIC team. Accurate and up-to-date information is essential for decisions regarding approach and methodology for testing.

Tests of design (TOD) of key controls

Assessing the design of key controls involves identifying key controls, aligned with the key risks, and completing tests of design. Tests of design are conducted to verify that key controls in place are implemented as described in process narratives.

Statistics Canada has identified key controls that exist within in-scope business processes, has mapped these controls to the risks they mitigate, and has completed tests of design. The audit selected three sub-processes for each of the four selected in-scope business processes for review. The audit confirmed that each sub-process had a key control identified and was aligned to each key control. For those controls that were found to be ineffective through TOD, the finding/weakness was included in a Letter of Recommendation (LOR), and a management response was developed to address the specific finding/weakness.

Tests of operating effectiveness (TOE) of key controls

A process should be in place to assess the extent to which key controls, including ITGC and entity level controls, have been operating as intended over a specified period of time. This process is referred to as a Test of Operating Effectiveness (TOE). The testing strategy should be documented, and include sampling techniques, locations, timing, and the IT application controls to be tested.

Statistics Canada has developed and documented its strategy for completing tests of effectiveness of key controls. The testing strategy describes the scope, approach, methodology, basis for sampling, frequency and lists the application controls to be assessed. Statistics Canada's two PIC strategy documents include sections on the Agency's approach for TOE. The approach to testing contained in each PIC strategy document adequately details key information, including risk information, the degree of reliance on controls, a testing strategy for each in-scope business process, a testing plan with timelines, and sample sizes. The testing matrices further document the testing and sampling strategies for each key control to be tested, and where applicable, identifies the various locations where testing is to take place.

In this regard, the Agency has met the PIC requirements. Processes that are in place are in line with the approach recommended in the Diagnostic Toolkit.

Change management

The Policy on Internal Control requires ongoing assurance on the system of ICFR. In order to meet this requirement, the Agency must follow its strategy for the assessment key controls for in-scope business processes, according to the established timelines. The strategy should include coverage and testing in situations when processes and systems are scheduled to be changed or are in the process of change. Testing activities should be adapted in such cases to ensure compensatory controls are monitored for effectiveness during this time. In the event that testing for an in-scope business process is suspended or cancelled, such decisions should be communicated to the CS and CFO, as it impacts the Agency's ability to monitor the effectiveness of the full system of ICFR on an ongoing basis, as is required by the PIC.

Interviews with management and the review of documentation revealed that there are a number of projects underway that involve significant changes in processes and systems affecting ICFR. Some initiatives originate from within the Agency, while others are initiated by third parties who provide services to the Agency. Examples of significant changes are:

• Business processes affected by Administrative Processes Review and Automation (APRA);
• Transfer of technology to Shared Services Canada (SSC);
• Public Works & Government Services Canada's changes to the Common Departmental Financial System (CDFS), with the implementation of a Capital Assets module;
• Business process changes resulting from letters of recommendations to address weaknesses in key financial controls (e.g. IT Change Management process, HR's system change from GLOBAL to GALAXY).

Where process or system changes are initiated within the Agency, the PIC team proactively reviews the design of processes under development to ensure key controls are imbedded. Interviews revealed that some testing activities had been cancelled for 2012-2013, as they relate to business processes impacted by APRA.

When process or system changes are initiated by third-party service providers, the PIC team monitors the evolution of these initiatives by attending meetings, or through on-going communication with designated Statistics Canada representatives who are part of steering committees.

In the event that significant process or system changes are planned or are being changed by third-party service providers, the ability to provide ongoing assurance regarding the full system of ICFR should be maintained in order to meet the requirements of the policy. In these situations, the current practice has been to suspend, defer or cancel testing. For example, the Capital Assets business process was last tested in 2009, and was scheduled for the next round of testing in the 2011-2012 fiscal year. Due to planned changes to CDFS, testing of Capital Assets has been deferred to the 2014-2015 fiscal year. When testing is cancelled in an area, the PIC team has not been confirming whether the system of internal control has remained the same or if it continues to be effective. If ongoing assurance cannot be provided for a period of time, this situation should be clearly stated in the Statement.

For the transition of technology to SSC, Finance and SSC are engaged in discussions to determine how Statistics Canada will obtain assurance on ICFR from SSC. Departments across the Federal Government are affected by this transition of services to SSC, and it is expected that each department will engage in negotiations with SSC to attain the level of assurance deemed necessary by each department. As expected, timelines for including assurance over ICFR on business processes managed by SSC have not yet been set.

A review of the PIC Follow-up Action Plan revealed that certain key controls scheduled to be tested during the last round of testing had not been tested. Interviews with Finance staff confirmed that testing of certain key controls had been delayed in instances where processes or systems were planned to be changed. Compensatory controls in place during transition periods were not tested. Postponing or cancelling testing of key controls may impact the Agency's ability to monitor the effectiveness of the full system of ICFR on an ongoing basis, as is required by the PIC.

Recommendations:

It is recommended that the Assistant Chief Statistician Corporate Services and CFO ensure that:

• The PIC strategy is periodically updated and validated by the CFO and CS.
• Compensatory controls in place during process and system changes are considered for testing as part of providing ongoing assurance on ICFR.

Management response:

Management agrees with the recommendations.

• The Director, Financial Reporting Division will ensure that the PIC strategy is updated and validated by the CFO, CS and DAC annually.
  
  Deliverables and Timeline: Annual presentation of the PIC strategy to Policy Committee and DAC, in March/April of each year.
• The Director, Financial Reporting Division will ensure that compensatory controls are considered and included in the testing strategy as required, on a risk basis.
  
  Deliverables and Timeline: Completed testing of compensatory controls as planned in the testing strategy, as required.

Ongoing monitoring and reporting on the state of ICFR

Based on the approach suggested in the OCG's Diagnostic Toolkit regarding ongoing monitoring and reporting on the state of ICFR and progress towards audit readiness, management needs to consider the potential impact that control weaknesses may have on the integrity of the financial statements and monitor the implementation of remedial actions required to address specific control deficiencies. As part of the process, there should be timely reports to the CFO and senior management on the nature of the results of the assessments and with attention on the associated action plans. At appropriate times, the DACs should be engaged for advice on the findings and responses.

The following sections provide an assessment of monitoring and reporting activities in place within Finance, and are from the first full cycle of assessing control effectiveness through testing, implementation of remediation actions and reporting results within the Agency.

Monitoring progress towards audit readiness

Following the completion of TOE, Finance obtains proposed remediation actions from respective business process owners and outstanding actions are flagged for follow-up. The PIC team monitors the level of completion of remediation action plans resulting from each cycle of TOD and TOE. To do so, the state of completion of remediation actions is assessed by the business process owner, and communicated to the PIC team, where it is tracked in the PIC Follow-up Action Plan spreadsheet.

Remediation plans were reviewed by the audit team and interviews were conducted with business process owners to verify that remediation actions had been completed, and updates to the plan had been communicated to the PIC Finance team. The audit found that in some cases, the timelines for implementing remediation actions extended past the next scheduled testing. As a result, TOE for those processes had been delayed.

The audit team also selected two completed remediation actions from the Revenues and the GCC-Change Management business processes action plans to verify that changes to the process had been implemented. A sample of 11 control transactions was selected for each of these two business processes:

• The first control tested was the approval process for monthly reconciliations between the cash receipts recorded in the Common Departmental Financial System (CDFS) and the Corporate Sales Support System (CSSS) using the Non Salary Information Management System (NSIMS). The result of our test confirmed that the recommended control was implemented within the process. The completion of this remediation action had also been validated by the PIC team in the last round of testing.
• The second control tested was the approval process for system changes identified in the Team Foundation Server (TFS). Results confirmed that the recommended control over change requests was implemented within the process.

Timely completion of remediation actions is essential to ensuring an effective system of ICFR is operating in the Agency. In both cases, the recommended controls had been implemented and the remediation actions had been completed.

The PIC team's current approach for validating the state of completion of remediation actions is to carry out testing during the next scheduled round of testing established in the Strategy's testing schedule; which could represent a three year time lapse between tests. As a result, it may not be possible for the PIC team to provide assurance on the effectiveness of the changes implemented by the business process owner, as required for annual reporting purposes.

Timely validation of completed remediation actions will enable the PIC team to provide ongoing assurance regarding ICFR.

Reporting on the state of ICFR and progress towards audit readiness

To fulfill their responsibilities as stated in the Policy, it is essential that the CS and the CFO have a clear picture of the overall state of internal control at Statistics Canada, and that their attention is drawn to areas requiring corrective actions. According to the Diagnostic Toolkit,

"there should be timely reports to the CFO and senior management on the nature of the results of the assessments, with attention on the associated action plans. At appropriate times, the DACs should be engaged for advice on the findings and responses".

The PIC team is responsible for reporting to senior management and the DAC on the results of ICFR testing and progress towards the completion of testing plans and remediation actions. The PIC team has made a number of presentations to DAC, CPC and APC for its first PIC reporting exercise. Information presented focussed on the requirements of the Policy and contained high-level information on results of testing.

In accordance with the Policy, the Agency has completed its first Annex to the Statement of Management Responsibility including Internal Control over Financial Reporting (the Statement) for fiscal year 2011-2012, and is currently working towards the preparation of its second statement for fiscal year 2012-2013. The Annex, which was attached to the Departmental Financial Statements for the fiscal year ending March 31, 2012, follows the same structure that is suggested in the OCG's Diagnostic Toolkit. The section pertaining to the Agency's progress provides information on which elements of the testing schedule have been completed.

The intent of the Statement, as stated in the Diagnostic Toolkit, is

"to report to the Departmental Audit Committee, senior management and central agencies on the status of ICFR management; communicate the importance of continuous improvement in internal controls within the organization; and serve as input into the ICFR assessment plans for future years".

In order to achieve this objective, information presented in the Annex should speak to the nature of the work that is required to achieve audit readiness, as it pertains to outstanding remediation items. This process enables decision-makers to have sufficient information to ensure corrective measures are implemented in a timely fashion.

Conversely, when testing of ICFR is not possible during transition periods, the Annex should clearly communicate what in-scope business processes or periods were not assessed. The audit team analysed the information communicated in the Agency's first Statement, issued for the fiscal year 2011-2012. The Statement includes a section pertaining to next steps, in which general information on processes and systems in transition is provided. Decisions to postpone or cancel ICFR testing were not clearly communicated in the Statement. The CFO, CS, and the DAC rely on information from the Statement as it may influence decisions pertaining to areas where assurance was not attained for any given period.

The Statement follows the structure per the OCG's Diagnostic Toolkit, however areas requiring corrective actions in order to achieve the state of audit readiness, and areas where assurance was not attained for a given period are not explicitly reported.

Recommendations:

It is recommended that the Assistant Chief Statistician Corporate Services and CFO ensure that:

• The monitoring process include timely validation on the state of completeness of remediation actions reported by business process owners, and formal guidelines and protocols for communicating issues of significance such as a deviation from legislation or TB policy related to ICFR
• The Annex to the Statement of Management Responsibility including Internal Control over Financial Reporting clearly communicates the areas requiring corrective actions in order to achieve the state of audit readiness, and areas where assurance was not attained for any given period.

Management response:

Management agrees with the recommendations.

• A PIC Steering Committee was created with as membership the DGs of Finance, IT, HR, Procurement and Assets Management and Census. The Director, Financial Reporting Division will ensure that this core management group provides leadership and oversight on the state of completeness of all reported remediation actions and for communicating issues of significance.
  
  Deliverables and Timeline: Regular meetings of PIC Steering Committee and timely validation on the state of completeness of remediation actions through review of evidence of actions taken by business process owners and/or testing to ensure controls have been implemented. Meetings and validation activities will be held quarterly or as required depending on status of remediation actions, in accordance with PIC reportring timelines. First PIC Steering Committee meeting is planned for May 2013.
• The Director, Financial Reporting Division will ensure that the status of the ICFR strategy and all relevant information in describing the organization's state of audit readiness are clearly communicated.
  
  Deliverables and Timeline: As part of the Annex to the Statement of Management Responsibility including Internal Control over Financial Reporting, which is issued annually, in accordance with PIC reporting timelines.

Appendices

Appendix A: Audit criteria

Appendix B: Acronyms

Note

Audit Report

December 17, 2012
Project Number: 80590-73

• Executive Summary
• Introduction
  • Background
  • Audit Objectives
  • Scope
  • Approach
  • Authority
• Findings, Recommendations and Management Responses
  • Control environment for the management of the DSA
  • Data Stewardship
  • Physical and Informatics Technology (IT) security
• Appendices
  • Appendix A: Audit Criteria
  • Appendix B: Acronyms

Executive summary

To achieve its mandate, Manufacturing and Energy Division (MED) enters into statistical data-sharing agreements with organizations under the authority of section 12 of the Statistics Act. In general, data-sharing for statistical purposes occurs when statistical and information inquiry is initiated by joint survey partners, or where a common data resource is equally and jointly owned by two or more partners. Data Sharing Agreements (DSAs) are a key business process. In recent years, data-sharing has become a growing and increasingly complex area to manage. Ensuring confidentiality of data is a challenge.

To protect the confidentiality and sensitive nature of the information collected, the DSA's contain terms and conditions to ensure that confidentiality of information is not compromised.

The objective of this audit is to provide assurance to the Chief Statistician (CS) and Statistics Canada's Departmental Audit Committee (DAC) that:

• The Terms and Conditions of the Data Sharing Agreement (DSA) between Statistics Canada and the Alberta Minister of Energy are met.

The audit was conducted by Internal Audit Division in accordance with the Government of Canada's Policy on Internal Audit.

Although the scope of this audit was limited to one specific DSA, it was determined that the nature of the findings impacted the broader process of managing data sharing agreements in the agency. Consequently, Statistics Canada's Policy Committee provided input to the management response and action plan to address the findings and recommendations at the corporate level.

Key findings

At Statistics Canada, roles, responsibilities and practices for the implementation and management of the DSA with Alberta Energy are in place, but the audit noted that they were not always followed due to lack of clarityin internal procedural guidelines at the program level.

Practices for the management of the DSA should be strengthened within MED to ensure that confidential information shared with Alberta Energy are only for the years which are referenced in the DSA.

The audit revealed that practices and procedures for sharing Statistics Canada confidential information exist but should be strengthened. The policy framework for the management of DSAs and advance release of confidential microdata would benefit from better clarity and integration to ensure consistent and appropriate application.

At Alberta Energy, internal protocols for the management and handling of Statistics Canada confidential information were not always followed as employees did not have a clear understanding of their roles and responsibilities.

Effective controls for physical access to Alberta Energy's premise are in place. Logical access controls and identification and authentication safeguards are in place and monitored by the Information Technology (IT) group. However, opportunities exist to strengthen data access controls by ensuring that Statistics Canada microdata are securely stored and only accessible to authorized individuals at Alberta Energy as per the Terms and Conditions of the DSA.

Overall conclusion

Alberta Energy entered into a statistical data-sharing agreement with Statistics Canada for statistical and research purposes and to help decision making related to the energy sector in the Province.

While Statistics Canada has outlined roles and responsibilities related to the management of DSAs, greater clarity of the roles and responsibilities is necessary to ensure sound management of confidential microdata. Improving the policy framework for the management of DSAs and advance release of confidential microdata would ensure consistent and appropriate application of polices and directives.

Data stewardship at Alberta Energy is in place but should be enforced to ensure that Statistics Canada confidential microdata are accessed by only authorized individuals and that the storage of Statistics Canada confidential microdata adheres to the terms and conditions set out in the DSA.

Conformance with professional standards

The audit conforms with the Internal Auditing Standards for the Government of Canada, as supported by the results of the Quality Assurance and Improvement Program.

Patrice Prud'homme
Chief Audit Executive

Introduction

Background

The Energy Statistics sector is one of the two subject matter programs of the Manufacturing and Energy Division (MED) at Statistics Canada with the mandate to collect, compile, analyze, abstract and publish statistical information on Canadian business activity in the energy sector. Statistics on the financial, industrial, operational and location characteristics of the energy sector are obtained through twenty-three surveys on energy supply and demand – eight monthly, two quarterly and thirteen annual. The major forms of energy covered are crude oil, natural gas, coal, electricity, and refined petroleum products. The Energy Statistics section provides information on energy producing and distributing industries, the consumption of specific forms of energy, and operating and technical information.

The energy sector has been high profile given emerging issues such as rising energy prices, the deregulation of electricity and natural gas markets, energy security and dependencies, and greenhouse gas emissions from the production and consumption of fossil fuels.

To achieve its mandate, MED enters into statistical data-sharing agreements (DSAs) with organizations under the authority of section 12 of the Statistics Act. In general, data-sharing for statistical purposes occurs when statistical and information inquiry is initiated by joint survey partners, or where a common data resource is equally and jointly owned by two or more partners. Data-sharing is exercised when there are significant reductions in response burden and compliance costs for data-sharing partners, as well as improvements in statistical data accuracy, coverage, relevance and timeliness. The DSA with Alberta Energy was signed in 2010 and twenty-one energy monthly and annual surveys are included in the agreement.

The monthly surveys cover detailed volumetric data on production, imports, exports, pipeline movements and domestic sales of various energy commodities. Quarterly and annual disposition surveys provide data on the consumption of energy commodities by key sectors including mining and oil and gas extraction, manufacturing, forestry, construction, transportation, agriculture, residential, commercial and other institutional. Other annual surveys provide operating and technical information such as generating capacities of electric power stations, greenhouse gas emissions by large industrial facilities or financial statements of the energy industries.

Data are collected directly from respondents for most surveys. The exceptions are for monthly electricity, crude oil and natural gas production data and for energy import and export data where federal and provincial administrative sources are used.

Alberta Energy may use the information shared pursuant to the DSA, relating to an identifiable respondent, for statistical and research purposes only. The audit will ensure that the confidentiality of information is not compromised and data is protected.

Audit objectives

The objective of the audit is to provide assurance to the Chief Statistician (CS) and Statistics Canada's Departmental Audit Committee (DAC) that:

• The Terms and Conditions of the Data Sharing Agreement (DSA) between Statistics Canada and Alberta Energy are met.

Scope

The scope of this audit included an examination of the terms and conditions prescribed in the DSA to ensure that confidentiality of information is protected. The audit focused on the confidentiality and security (physical access, IT storage and transmission, physical storage and information copying and retention and record management) safeguards at Alberta Energy to ensure that data is protected and confidentiality is maintained.

Approach

The audit approach consisted of a review of applicable policies, procedures, and information for the administration and management of the agreement with Alberta Energy. Interviews with MED staff and management and an examination, review and testing of the processes and procedures in place within MED took place. The approach at Alberta Energy consisted of interviews with key Senior Management and an examination and review of the processes and procedures to ensure the terms and conditions of the DSA between Statistics Canada and Alberta Energy are met with emphasis on whether the security requirements are in place and complied to and confidentiality of data is maintained.

This audit was conducted following the Standards for the Professional Practice of Internal Auditing as per the Institute of Internal Auditors (IIA) and in accordance with the TBS Policy on Internal Audit.

Authority

The audit was conducted under the authority of Statistics Canada Integrated Risk-Based Audit and Evaluation Plan 2012/13-2014/15 recommended by the Departmental Audit Committee, April 2012 and subsequently approved by the Chief Statistician.

Findings, recommendations and management responses

LOE #1: The Terms and Conditions of the Data Sharing Agreement (DSA) between Statistics Canada and Alberta Energy are met.

Control environment for the management of the DSA

Clear delineation of roles, responsibilities and accountabilities to support effective management of the Terms and Conditions (T&Cs) of the DSAs should exist to ensure efficient and effective operations. Monitoring of operational performance should take place to detect errors or potential errors which would otherwise increase operational risk.

Authority

Statistics Canada exercises its mandate to enter into statistical data-sharing agreements (DSAs) with other organizations under the authority of sections 11 and 12 of the Statistics Act.

To support policy development and data initiatives, Alberta Energy requires accurate information on various energy production, consumption and distribution within the province. As a result, pursuant to section 12 of the Statistics Act, Statistics Canada has entered into a DSA with Alberta Energy to share information from 21 energy surveys listed in the agreement.

Policy framework for Data Sharing Agreements

Roles and responsibilities related to the development, implementation and monitoring requirements of DSAs are set out in the Directive on Data Sharing under Sections 11 and 12.  The Directive notes that Information Management Division (IMD), in consultation with Legal Services, is responsible for drafting data-sharing agreements when requested from directors of statistical programs. IMD is also required to support managers during the development of new or modified data-sharing agreements with receiving parties, pursuant to section 12 of the Statistics Act.  Subject Matter Divisions are responsible for communication with recipient organizations during the negotiations and drafting of the agreements.

Practices for management of the Data Sharing Agreement

The DSA with Alberta Energy was drafted by IMD and signed in January 2010. The Energy Statistics (ES) section in Manufacturing and Energy Division (MED), is the liaison between Alberta Energy and Statistics Canada with responsibility for the implementation of the DSA. The Dissemination and Frame Services (DFS) section in MED is the liaison between Alberta Energy and IMD for negotiating and drafting the agreement, and oversees the secure transmission of the prepared survey files to Alberta Energy.

When a request for data under the DSA is received from Alberta Energy, the ES section prepares the microdata files requested to ensure only data for the province is included and tax information has been stripped and stores it in a folder on the shared drive.  They advise the staff in the DFS section that the files are ready for transfer. The microdata files are then prepared for secure transmission either by computer disks (CDs) or by electronic file-transfer (e-FT) by the DFS section.

As per the Directive on Data Sharing Agreements under Section 11 and 12, a control log is maintained within the subject matter division, which lists the organization, section of the Statistics Act under which the DSA falls, name of the official recipient, name of end-user, date sent to recipient, date received by recipient and transmission method. A description of contents – file name, reference period covered, survey number, date request received, subject-matter expert (SME) who prepared the file, name of person who prepared the microdata for transmission and time it took to process the request are also recorded.

Since implementation of the DSA, Alberta Energy has requested two data sets on CDs. The first was for the Coal Monthly Survey which was requested and sent in January 2011. Review of the transmission control log revealed that this request for the microdata was made by and transmitted to the authorized contact at Alberta Energy in the Economics and Markets (EM) branch. This request was handled and processed at Statistics Canada by the SME for the survey in the ES section.

The second request was for the Annual Coal Mines Survey, which was sent in October 2011. Staff in the DFS section is required to match the contact information provided by the SME with the one identified in the agreement to ensure that the CDs are transmitted only to the authorized contact. The transmission control log showed that this request was made directly by the end-user and not the authorized contact and data custodian. The request was processed by the ES section and sent directly to the end-user and not the authorized contact as required in the Terms and Conditions of the DSA. The audit noted that the internal guidelines document "Procedures-File transmission" did not provide clear directives related to who is an authorized data recipient.

The audit concluded that at Statistics Canada, roles, responsibilities and practices for the implementation and management of the DSA are in place but they were not always practiced due to lack of clarity in internal procedural guidelines.

The sharing of Statistics Canada microdata under section 12 of the Statistics Act requires giving respondents prior notification of the proposed sharing, and giving them the right to refuse to allow their information to be shared. This requirement is reflected in the DSA with Alberta Energy which states

"Each survey questionnaire used by Statistics Canada will contain a statement that the information provided may be shared by Statistics Canada with Alberta Energy, unless the respondent objects to such sharing, as required by the federal Statistics Act".

Review of the second data file (the Annual Coal Mines Survey) prepared and sent to Alberta Energy revealed that Statistics Canada transmitted data to Alberta Energy for calendar years that were not covered in the DSA. The DSA covered data for the Coal Survey beginning in 2010, however confidential microdata for years 2006, 2007 and 2008 were sent to the recipient party.

Survey respondents were not given the opportunity to object to the sharing of information with Alberta Energy for these years which is in conflict with both the federal Statistics Act and the data-sharing agreement with Alberta Energy.

Sharing of Statistics Canada confidential information

Confidential information sent to DSA recipient parties prior to official release in The Daily are subject to the Policy on Official Release in The Daily. The Policy sets out four conditions that must be met by organizations in order to have access to new data sets or information products prior to official release in The Daily, and notes the types of arrangements and submission forms which must be in place to allow for the advance release of sensitive statistical information. These conditions include:

• Authorization by the Clerk of the Privy Council on the advice of the Chief Statistician;
• Work-in-progress agreements or peer reviews;
• External partnerships in collaborative programs (cost-recovery, common governance and administrative programs);
• The Chief Statistician may authorize dissemination of information in advance of release in special circumstances in which the benefits justify the exception.

The audit determined that preliminary data for the Annual Coal Survey for 2010 which had not been fully processed was shared with Alberta Energy in October 2011, prior to official release which took place in The Daily in May 2012. In this instance, for the pre-release of the data, an Advance Release Submission form should have been prepared and submitted to the Communications Division for approval as per the Policy. This was not completed.

The audit found that the program area within MED felt that pre-release of microdata was acceptable when there is a section 11 or section 12 DSA in place. Within the Dissemination unit, there was an understanding that the scope of the Policy exempts DSAs from the pre-release conditions. This understanding is a result of the scope clause within the Policy which states,

"The sharing of survey microdata under sections 11 and 12 of the Statistics Act is governed by the provisions of the Statistics Act and the terms and conditions of the data sharing agreements."

The program stated that their interpretation is that this is an exclusion clause. The audit confirmed with Communications Division and Information Management Division that DSAs fall within the scope of the Policy and as such pre-release of microdata falls under the Policy. The audit also revealed that the Directive on Data Sharing under Sections 11 and 12 does not provide guidance on the different requirements that programs should be aware of when releasing protected information involving microdata or statistical aggregates at a confidential level.

A second source of confusion within the DSA with Alberta Energy was brought to the attention of the audit team. MED staff felt that the DSA had a clause within it that implied that the sharing of microdata was permitted. Clauses 4 and 5(1) in the DSA with Alberta Energy state:

4. The Department (Alberta Energy) may release or publish only statistical aggregates derived from the information provided to it pursuant to this Agreement. However:

5. (1) The Department (Alberta Energy) shall not do so prior to the official release by Statistics Canada.

The program felt that because the agreement specifies that the department (Alberta Energy) agrees only to release or publish after official release by Statistics Canada; it is permissible to provide confidential microdata in advance of the official release by Statistics Canada.

Review of the new approved DSA templates for Provincial, Provincial omnibus, Federal and Crown corporations revealed that all templates include similar clauses and therefore inadvertently imply the sharing of microdata with external partners prior to the official release by Statistics Canada in The Daily. This is in conflict with Statistics Canada's Policy on Official Release in The Daily.

The audit concluded that the practices and procedures for the sharing of Statistics Canada confidential information exist but should be strengthened. The policy framework for the management of DSAs and advance release of confidential microdata would benefit from better clarity and integration to ensure consistent and appropriate application.

Risk management and monitoring

MED conducts a formal risk exercise on an annual basis, to assess and monitor the internal environment (survey process) and external environment for risks and to provide input into the corporate planning exercise. The 2010 Program Performance Review identified that management of all the DSAs in MED should be centralized. Subsequent to this review, the management function of all DSAs within MED has been centralized under the Dissemination and Frame Services (DFS) section within the division.

Monitoring is prescribed by Statistics Canada in an audit clause included in the DSA. Monitoring of the DSA at Alberta Energy is the responsibility of the EM branch. Since only two data sets have been requested by Alberta Energy, and no researchers have been contracted to provide survey-related product or service at the premises of Alberta Energy, EM branch has not performed any monitoring.

Statistics Canada's DSA with Alberta Energy has a provision outlining the requirements should unauthorized access occur. No incidences of unauthorized access have been reported to Statistics Canada by Alberta Energy.

Recommendations:

The Assistant Chief Statistician (ACS) Business and Trade Statistics should ensure that:

• Employees understand their roles and responsibilities with respect to the handling and management of Statistics Canada confidential information.
• Confidential information for only those surveys that are referenced in a valid data-sharing agreement and for cycles, for which respondents were informed of sharing, is shared with external partners pursuant to section 12 of the Statistics Act.
• The conditions set out in the Policy on Official Release in The Daily to provide access to pre-release data sets and information products to external partners are followed.

Management response:

Management agrees with the recommendations. Since the nature of the findings impacted the broader process of managing data sharing agreements in the agency, Statistics Canada's Policy Committee provided input to the management response and action plan to address the findings and recommendations at the corporate level.

MED has DSAs with a large (30 and growing) number of partner and user organizations across the country. In 2012, the division identified as a risk and strategic priority in its PPR the need to improve the management of these DSAs due to: the growing number, the complexity of this work, the high rate of staff turnover, and the potentially high impact if problems emerge. MED received long term planning funding last fiscal year to take steps to address this challenge. Several of the related strategies will help to ensure that the types of problems experienced with Alberta Energy do not re-occur.

• The Director MED, will direct Alberta Energy to destroy the data they received for years 2006 to 2008 (annual coal survey) and years 2006 to 2009 (monthly coal survey), and ask for written confirmation of date the data were destroyed.
  
  Deliverables and Timeline: Letter from Director, MED, to Alberta Energy in November 2012.
• The centralization of the management of DSAs within the Dissemination and Frame (D&F) Section in MED. This will allow for the development of expertise, experience and back-up capacity; improved monitoring and follow-up procedures; and greater accountability.
  
  Deliverables and Timeline:  The Director MED established the new centralized unit with the responsibility to manage DSAs for MED, in March 2012.
• Staff in the new centralized unit receives periodic training on rules and procedures for managing DSAs.
  
  Deliverables and Timeline: The Chief D&F Services Section is responsible for ensuring periodic training is provided to staff. Training so far has occurred in May and October 2012.
• Information on confidentiality & security will be presented by IMD to MED employees annually.
  
  Deliverables and Timeline: The Chief D&F Services Section is responsible for ensuring that information session are provided by IMD to MED at all staff meetings, on an annual basis. The first session was held in June 2012.
• Information on the new processes and organization is communicated to MED management.
  
  Deliverables and Timeline: The Chief D&F Services Section sent instructions to all MED managers in July 2012.
• Detailed procedures and a checklist for staff working on DSAs will be developed.
  
  Deliverables and Timeline: The Chief D&F Services Section prepared and ensured the implementation of the checklist in May 2012. The checklist was updated in October 2012.
• A new mandatory certificate to record the conformity of the information being shared will be signed by directors every time a share file is provided to an external partner.
  
  Deliverables and Timeline: New procedure, records and documentation to be developed by IMD and followed by Program directors by June 2013.
• A new mandatory requirement for the external partner to acknowledge receiving the information and being aware of the conditions set in the data-sharing agreement every time a share file is provided to them.
  
  Deliverables and Timeline: New procedure, records and documentation to be developed by IMD and followed by Program directors by June 2013.
• A new mandatory training session for directors about data-sharing agreements.
  
  Deliverables and Timeline: Training by IMD and Human Resources Development Division (HRDD) by June 2013.
• Reminders to program managers to follow communication protocol and quickly report incidents through the proper management channels.
  
  Deliverables and Timeline: Reminders to programs by ACS and senior management teams by December 2012.

Recommendations:

The Assistant Chief Statistician (ACS) Business and Trade Statistics in collaboration with the ACS of Informatics and Methodology and the ACS of Census, Operations and Communications should ensure that:

• In consultation with IMD, the DSA with Alberta Energy is amended to clarify that microdata cannot be shared with Alberta Energy prior to the official release by Statistics Canada.
• The clause in the new DSA templates for Provincial, Provincial omnibus, Federal and Crown corporations is amended to clarify that microdata cannot be shared with external partners prior to the official release by Statistics Canada unless the conditions for pre-release in the Policy on Official Release in The Daily are met
• The conditions in the Directive on Data Sharing under Sections 11 and 12 of the Statistics Act are consistent with those set in the Policy on Official Release in The Daily that Subject Matter Divisions have to meet for advance release of sensitive statistical information.

Management response:

Management agrees with the recommendations.

• The Director, IMD and the Director MED, will prepare an updated DSA template, to replace current DSA with Alberta Energy.
  
  Deliverables and Timeline: An updated DSA template signed by Statistics Canada and Alberta Energy by June 2013.
• The Director, IMD will prepare an updated DSA template.
  
  Deliverables and Timeline: An updated DSA template by June 2013.
• The Director IMD and the Director General, Communications Division, will ensure the recommended consistency.
  
  Deliverables and Timeline: Required updates to the Directive on Data Sharing under Sections 11 and 12 and the Policy on Official Release in The Daily by March 2013.

Data stewardship

Internal protocols that outline roles, responsibilities and practices and procedures for the sound management of data should be in place to ensure the protection and safeguarding of Statistics Canada confidential information.

Roles and responsibilities of the data recipient

At Alberta Energy, functional responsibility for the administration and management of the Statistics Canada energy survey data rests with the Economics and Markets (EM) branch who is the designated data-custodian and recipient. The EM branch acts as the liaison between Statistics Canada and all the individuals at Alberta Energy requesting information from Statistics Canada.

As part of the Terms and Conditions of the DSA, access to Statistics Canada confidential information at Alberta Energy is to be granted on a need-to-know basis, to employees whose work responsibilities require such access in order for Alberta Energy to meet its' statistical and research needs. The audit noted that Alberta Energy has set out internal protocols specifying the procedures for sending, receiving, handling and storing Statistics Canada confidential microdata within Alberta Energy. Provisions provided in the DSA are included in an internal Memorandum of Understanding (MOU) prepared by the EM branch. Individuals requesting access are required to provide their adherence to the provisions by signing the MOU.

Review of the MOU template at Alberta Energy revealed that in addition to the above, it also contained the provisions that the EM branch will receive all the confidential microdata from Statistics Canada and will then transmit it to authorized individuals within Alberta Energy; and confidential microdata will be stored in a secured location while in the possession of the EM branch and any individual at Alberta Energy.

As part of the audit, all signed MOUs were to be reviewed to match and confirm the signatures of the end-users to the names on the MOUs. End-user names on the forms were to be traced to the names listed on the transmittal control log maintained by the DFS section. As a result, only one signed MOU was found to be in place at Alberta Energy.  Enquiry at Alberta Energy revealed that the first end-user did not understand his roles and responsibilities and as a result provided access to confidential microdata to an employee in his branch for whom formal approval was not requested. This is in conflict with the requirement in the agreement with Alberta Energy which requires all users of Statistics Canada confidential microdata to receive formal approval from the EM branch and acknowledge their adherence by signing the MOU.

At Alberta Energy, internal protocols for the management and handling of Statistics Canada confidential information have been documented, however they were not always followed as employees did not have a clear understanding of their roles and responsibilities.

Third party recipients

Under the current agreement, Alberta Energy is not allowed to share or disclose Statistics Canada confidential information to external third party recipients. Only researchers directly under contract with Alberta Energy, who provide survey-related product or services on the premises of Alberta Energy, are allowed access to Statistics Canada confidential microdata.

The audit revealed that in keeping with the provisions of the agreement, Statistics Canada confidential information has not been shared with external third party recipients, and Alberta Energy has not entered into any contracts with researchers to provide survey-related product or service on the premises of Alberta Energy as allowed by the agreement.

Microdata received from Statistics Canada is for statistical and research purposes, and for internal use only. The audit confirmed that statistical aggregates that directly or indirectly identify a person, business organization or an identifiable product are never released or published.

Recommendations:

The Assistant Chief Statistician (ACS) Business and Trade Statistics should communicate with Alberta Energy to ensure that:

• Employees understand their roles and responsibilities with respect to the handling and management of Statistics Canada confidential information and have signed the internal MOU outlining these responsibilities.

Management response:

Management agrees with the recommendation.

• The Director, MED will ensure the updated DSA template includes all of the necessary information, already covered in the current DSA template.
  
  Deliverables and Timeline: An updated DSA template signed by Statistics Canada and Alberta Energy and in person meeting at Alberta Energy to provide additional information and guidance by June 2013.

Physical and Informatics Technology (IT) security

Information provided to Alberta Energy is designated as 'Protected B' information as defined in the federal Policy on Government Security. Alberta Energy is required to ensure that the control and protection of information, either physically or electronically, is carried out in a manner that protects against loss, theft, compromise or improper disclosure. Access should only be given to employees on a "need-to-know" basis as part of their duties.

Physical access to Alberta Energy's premises

A physical inspection was conducted of Alberta Energy's site during the examination phase of the audit. The audit noted that each floor of Alberta Energy is secured and can only be accessed by authorized staff. There is a card reader outside each set of doors and staff must swipe their ID card to enter. Visitors have to sign-in at the reception desk; they receive a visitor pass that has to be visible at all times but does not authorize access to secure areas; and they are to be escorted by an authorized person at all times.

Physical access to the data files

Access to Statistics Canada survey files is on a need-to-know basis only. At the time of the audit, only 2 employees had access to the CDs.

The audit noted that the CDs for the two data sets that had been sent to Alberta Energy (Annual Coal and Monthly Coal Survey) under the section 12 DSA are kept in a key locked safe in the secured area of the end-user as required by the terms and conditions of the DSA. In order to make the key to the safe accessible to staff, it is kept in an unlocked desk drawer of a staff member which is in an open office environment. This elevates the risk that the data may be accessed by unauthorized individuals within Alberta Energy.

Statistics Canada confidential data is held on the original CDs and is not transferred to a server or a computer or any other electronic media.

Identification and authentication safeguards, IT storage and transmission

Devices and networks are protected by logical access controls at Alberta Energy and are administered by the IT group. Passwords are required to access the Alberta Energy computer networks and must be updated every 6 weeks.

The Government of Alberta's "Policy for Maintaining Security of Government Data Stored on Electronic Data Storage Devices" does not recommend the storage or transmission of high-sensitivity data on a laptop or memory key. Memory sticks are only used for storing presentations to stakeholders at conferences, and when used they are password protected. Remote access for departmental information is allowed using Citrix system.

Effective controls for physical and electronic access to Alberta Energy's premises are in place. However, opportunities exist to strengthen physical storage access controls by ensuring that Statistics Canada original CDs are in the custody of the designated data-custodian only and by ensuring that the key to the safe which holds the CDs is properly secured as per the terms and conditions set out in the DSA.

Recommendation:

The Assistant Chief Statistician (ACS) Business and Trade Statistics should communicate with Alberta Energy to ensure that:

• Microdata files transmitted from Statistics Canada are securely stored and only accessible to authorized individuals as per the Terms and Conditions of the DSA.

Management response:

Management agrees with the recommendation.

• The Director, MED will ensure the updated DSA template includes all of the necessary information, already covered in the current DSA template.
  
  Deliverables and Timeline: An updated DSA template signed by Statistics Canada and Alberta Energy and in person meeting at Alberta Energy to provide additional information and guidance by June 2013.

Appendices

Appendix A: Audit criteria

Appendix B: Acronyms