Archived - Audit of Payroll

Date: September 2010
Project #09-071

PDF Version (186 Kb, 40 Pages)

Table of Contents

• List of Acronyms
• Executive Summary
• Summary of Findings and Recommendations
• 1. Background
• 2. Objectives and Scope
• 3. Statement of Assurance
• 4. Methodology
• 5. Findings
• 6. Conclusion
• 7. Management Action Plan
• Appendix A - Financial Context for INAC Payroll
• Appendix B - Audit Criteria

List of Acronyms

Executive Summary

Background

The Audit and Evaluation Sector (AES) of Indian and Northern Affairs Canada (INAC), also referred to as "the Department", identified payroll as a high-risk area in their 2009-10 Risk-Based Audit Plan. AES engaged Ernst & Young to conduct an audit of payroll from November 2009 – July 2010.

According to INAC's Departmental Performance Report for the fiscal year ended 31 March 2009, the Department had approximately 4,400 employees, whose salaries and benefits represented approximately $489M, or 48% of regular operating expenses.

Pay administration is a complex process governed by various acts, policies, directives and guidelines. INAC's payroll process is decentralized across the Department's 11 regions, including headquarters. At the time of the audit, pay transactions were generated using the On-Line Pay System, a web application used to connect with Public Works and Government Services Canada's (PWGSC) legacy Regional Pay System (RPS).

As part of the Government of Canada's Pay Modernization Project, which seeks to streamline and centralize public service payroll processes using a common, shared HR management system ("PeopleSoft"), departments and agencies have begun to interface their payroll systems with PeopleSoft (an intitiative referred to as the Government of Canada Pay Interface or GCPI). INAC plans to go live with the new interface between June and December 2010, adding an additional element of risk to payroll and the associated processes. As a result, the GCPI project planning phases were included in the audit scope.

Objectives and scope

The primary audit objective was to provide assurance over the accuracy of regular and supplementary payments. In light of INAC's plans to implement GCPI, a secondary audit objective was included to evaluate the payroll administration controls in place prior to the implementation of GCPI.

The audit scope included regular and supplementary payments for fiscal years 2008-09 and 2009-10 (April 1 - December 31 2009), as well as the management control framework in place to support the accuracy of payments, salary management and reporting. The audit also entailed an analysis of systems involved in the payroll administration process, including the integration between INAC's payroll processes and systems.

The first five of eight GCPI project phases (planning through testing) were reviewed for the period of January-March 2010. In addition to reviewing the sufficiency of GCPI project and process controls, we assessed the extent to which the first five GCPI project phases helped to identify and correct data errors, omissions, unauthorized changes and timeliness issues.

Methodology

The audit was conducted in three distinct phases: planning, executing and reporting. A risk-based audit program was developed during the planning phase. Audit fieldwork was conducted during the executing phase at headquarters in Gatineau and regional offices located in Ontario, Saskatchewan, Alberta, British Columbia and the Yukon Territory.

The audit program was structured to include a review of previous audits, documentation reviews, interviews, and testing. Data analytics were used as part of testing to examine a large volume of pay transactions to identify patterns and anomalies.

Findings and conclusions

Given the significance of the audit findings, we cannot provide assurance over the accuracy of regular and supplementary salary payments for the period under audit. In particular, we noted the following:

• Lack of a consistent pay administration process across the Department
• Employees from a separate organization created mid-fiscal-year erroneously included in INAC's Yukon region salary roll-up and financial reporting for 2009-10, causing an approximate $700K overstatement in Yukon region's financial reports [Note 1]
• Significant payroll control variances and gaps in all regions visited
• High exception rates for regular and supplementary payments tested
• Significant deviations from policy with respect to extra duty (overtime) pay transactions

Furthermore, we cannot conclude that INAC is prepared for Department-wide GCPI implementation at this time due to the following:

• Data discrepancies and errors in PeopleSoft and the Regional Pay System (RPS)
• A lack of PeopleSoft system and process readiness, including a lack of documented workflows, training, data governance, access restrictions and preventive system controls
• Gaps in the planned post-GCPI payroll process and RPS system access controls
• No evidence to demonstrate how risks will be effectively managed under current project timeline
• Insufficient project communication and collaboration across business units

While we find the GCPI business case, project objectives, and gradual roll-out approach to be sound, evidence could not be provided to demonstrate how risks will be adequately managed under the current implementation schedule.

Recommendations

We recommend that INAC document and enforce consistent payroll processes and controls across the Department. The findings and exceptions identified in the audit should be remediated and root causes addressed. INAC should implement preventive and detective controls, particularly for extra duty pay, where significant policy compliance issues were noted for a sample of employees.

While the automation of manual processes under the GCPI project may address current inefficiencies and improve the overall payroll process, we recommend that INAC adjust the project timelines to allow for sufficient risk analysis and management of implementation and pay process risks. In particular, root causes of data errors should be addressed and the post-GCPI pay process and associated controls should be documented and assessed prior to GCPI implementation across the Department.

Summary of Findings and Recommendations

The table below summarizes the findings and recommendations contained in the report, in the order in which they appear.

1. Background

The Audit and Evaluation Sector (AES) of Indian and Northern Affairs Canada (INAC), also referred to as "the Department", identified the Department's payroll function as a high-risk area in the Sector's 2009-10 Risk-Based Audit Plan. The plan, which ranked payroll in the top two audit priorities, cited the potential for operational, financial and reputational risks for the Department arising from inaccurate pay transactions, inaccurate salaries and benefits reporting, and non-compliance with policies and legislation. AES engaged Ernst & Young to conduct an audit of payroll from November 2009 – July 2010.

Pay can be defined as monies received by an employee for services rendered during a specified period, in accordance with the employee's Certificate of Employment (also known as Letter of Offer) and applicable Terms and Conditions of Employment. For the purposes of this audit, payments made to employees were distinguished between regular payments and supplementary payments.

According to INAC's Departmental Performance Report (DPR) for the fiscal year ended 31 March 2009, the Department had approximately 4,400 employees, whose salaries and benefits represented approximately $489M or 48% of regular operating expenses. Departmental compensation costs per Full Time Equivalent (FTE) increased by 12.3% from 2007-08 to 2008-09 [Note 2], which INAC explained as the machinery of government change to amalgamate Residential Schools with INAC and binding salary commitments arising from renewed collective agreements. Further compensation cost analysis is provided in Appendix A.

Pay administration is a complex process governed by various acts, policies, directives and guidelines established by parliament, the Treasury Board of Canada Secretariat (TBS), the Department of Justice (DoJ) and federal government departments and agencies. INAC is responsible for ensuring the completeness, accuracy and authority of its payroll-related transactions. [Note 3] Per TBS, payroll accounting and financial control over the administration process are part of financial management, whereas employee compensation policiesand procedures are part of HR management.

INAC's payroll administration process is further complicated by a decentralized pay model, where the Department's 11 regions, including headquarters, are each responsible for processing and monitoring their pay transactions. At the time of the audit, pay transactions were generated using the On-Line Pay System, a web application used by a number of departments and agencies to connect with Public Works and Government Services Canada's (PWGSC) legacy Regional Pay System (RPS).

As part of the Government of Canada's Pay Modernization Project, which seeks to streamline and centralize public service payroll processes using a common, shared HR management system ("PeopleSoft"), departments and agencies have begun to interface their payroll systems with PeopleSoft (hereon referred to as the Government of Canada Pay Interface or GCPI). INAC plans to go live with the new interface between June and December 2010, adding an additional element of risk to payroll and the associated processes. As a result, the GCPI project planning phases were included in the audit scope.

2. Objectives and Scope

2.1 Objectives

The primary audit objective was to provide assurance over the accuracy of regular and supplementary payments. In light of INAC's plans to implement GCPI, a secondary audit objective was included to evaluate the payroll administration controls in place prior to the implementation of GCPI.

2.2 Scope

The scope of the audit included regular and supplementary payments [Note 4] for fiscal years 2008-09 and 2009-10 [Note 5], as well as the management control framework in place to support the accuracy of payments.

The audit also entailed an analysis of systems involved in the payroll administration process. In particular, we analyzed the integration between INAC's payroll processes and manual pay card system in each region visited. We also reviewed interfaces [Note 6] to other relevant systems, including RPS, PeopleSoft, Oasis Salary Management System (OSMS) and Oasis Financials System.

The scope of the GCPI component of the audit included a review of the following:

• Project and process controls in place to safeguard the integrity of the information within the payroll system prior to the interface implementation
• The extent to which the project helps to identify and correct errors, omissions, unauthorized changes and timeliness issues in the overall integrated system

2.3. Scope constraints

The scope of the audit included regular and supplementary payments for INAC employees on Public Works and Government Services Canada (PWGSC) INAC pay code, "IAN". Pay transactions for separate organizations (identified by pay lists and / or PWGSC pay codes) were not in scope, including (but not limited to) the following:

• Indian Oil and Gas Canada (IOGC)
• Canadian Northern Economic Development Agency (CanNor)
• Canadian Polar Commission
• Indian Residential Schools Adjudication Secretariat [Note 7]

While individual pay transactions were not in scope for separate organizations, payroll process risks associated with other organizations were noted in applicable regions, as further discussed in Sections 5.1.1 and 5.1.2. In particular, we noted areas where payroll interdependencies between INAC and other organizations were observed to be inappropriately controlled.

We received extensive cooperation from employees at headquarters and in the regions. However, key reports and information requested were not available for review, causing the following test limitations:

• Testing transactions against a Departmental payroll administration control framework - There was no evidence of a single, consistent, and documented end-to-end payroll process and control framework for the Department. Because payroll controls varied across regions visited, we tested pay transactions against the controls applicable to the respective region of pay.
• Testing from a complete list of employees paid by INAC – We could not establish completeness of the employee lists provided from OSMS and found that the OSMS reports provided did not include all pay transactions. To establish a complete list of INAC pay transactions, reports generated from RPS at PWGSC were required. However, these reports were not readily available, as further discussed in Section 5.1.3.
• No mechanism to track adjustment transactions – Employee payrates, classifications, places of employment and collective agreements change regularly and may require retro-active compensation changes. Because there was no mechanism in place to readily identify whether subsequent adjustment transactions had been made, we cannot conclude whether the exceptions noted in pay transaction accuracy would have been caught at a later date.

The audit was based on interviews and discussions with INAC management, documentation reviews, and functional demonstrations provided in the selected regions. Where possible, testing was conducted to validate information provided through management interviews; however, we did not seek to confirm the accuracy of information provided in all cases.

3. Statement of Assurance

We cannot conclude that INAC's pay administration control framework successfully supports payment accuracy for regular and supplementary payroll transactions. We found a high exception rate in pay transactions tested (32 exceptions out of 50 samples). We also cannot conclude that the Department is ready for the Government of Canada Pay Interface (GCPI) at this time.

Our work was conducted according to a risk-based audit program, developed collaboratively with INAC management. Sufficient work was performed and the necessary evidence gathered to support the findings and conclusions in this report. The conclusions were based on a comparison of the situations as they existed at the time of the audit and against the audit criteria. The conclusions are applicable only for the areas examined and the regions visited.

The risk-based audit program was based on Control Objectives for Information and related Technology, version 4.1 (COBIT 4.1) and the Project Management Institute's Project Management Body of Knowledge, version 4 (PMI PMBOK 4). Government of Canada compensation standards, as specified by TBS and the Officer of the Comptroller General (OCG), were also used to develop the audit program. The audit was executed in conformity with the Internal Auditing Standards of the Government of Canada. It does not constitute an audit or review in accordance with Generally Accepted Auditing Standards (GAAS).

4. Methodology

4.1 Timeline

The assessment was conducted in three distinct phases as follows:

• Planning Phase (November-December 2009)
• Executing Phase (January-May 2010)
• Reporting Phase (May-July 2010)

4.2 Audit approach

The audit criteria are listed in Appendix B. Fieldwork was conducted at headquarters and in a sample of five regions as follows:

• Ontario (Toronto office)
• Alberta (Edmonton and IOGC offices)
• Saskatchewan (Regina office)
• British Columbia (Vancouver office)
• Yukon (Whitehorse office)

Salary expenditures for these five regions represented approximately 28% of all Departmental salary expenditures for 2008-09 (see Appendix A for further details).

One of the selected regions was used as a pilot to identify risks and further develop the risk-based audit program. The audit program was structured to include a review of previous audits, documentation reviews, interviews, and testing. Data analytics were used to examine a large volume of pay transactions identifying patterns and anomalies. A sample of 50 pay transactions was tested for accuracy and compliance.

4.3 Previous audits and reviews

The following audits and reviews included findings relevant to the audit of payroll:

• Office of the Auditor General (OAG) audit (2006-07 and 2007-08)
• Internal review of PeopleSoft upgrade from v.8.0 to v.8.9 (2008-09)
• INAC Audited Financial Statements Readiness (FSR) project (2008-09)
• Internal audit of PeopleSoft (2009-10)

During the planning phase of the audit, INAC management raised concerns regarding a duplication of effort, based on the above audits and reviews previously conducted. To avoid duplication of effort, we reviewed the previous audits and reviews prior to building the risk-based audit program. Previous audit findings relevant to payroll at INAC are discussed where relevant in the findings below.

5. Findings

The findings are outlined according to the two main audit objectives as follows:

• Accuracy of regular and supplementary payments
• First five phases of the GCPI project

These areas are described in the following sections.

5.1 Accuracy of payments

In addition to testing pay transactions, we reviewed the payroll process to identify control gaps that create inherent risks to the accuracy of regular and special payments.

The findings and recommendations are organized according to the following five areas of risk:

• 5.1.1. Payroll process
• 5.1.2. CanNor salary roll-up and reporting in the Yukon
• 5.1.3. Controls to enforce pay accuracy
• 5.1.4. Regular pay transactions
• 5.1.5. Supplementary pay transactions

These areas and the associated findings are further detailed in the sections below.

5.1.1 Payroll process

Payroll is administered by compensation personnel in INAC's regions and headquarters. Prior to testing in each of the five sample regions, we gained an understanding of the respective regional payroll administration process and the associated control framework, through interviews and process descriptions provided by regional compensation personnel. Specifically, we reviewed the following:

• INAC pay administration process
• Pay process interdependencies with separate organizations and agencies

These areas and our associated observations are detailed below.

INAC pay administration process

Systems involved in INAC's pay administration and overall salary management and reporting include:

• RPS – pay system housed by PWGSC, used to process salary payments and issue pay cheques.
• On-Line Pay System – web application used by INAC Compensation Advisors to access RPS and enter pay transactions based on employee hard copy files.
• OSMS – INAC's salary forecasting and reporting tool.
• Oasis Oracle Financials – INAC's financial system – receives salary information by OSMS.
• PeopleSoft – at the time of the audit, a stand-alone system used to manage leave and HR data.
• Employee hard copy file – includes employee manual pay card, Letter of Offer (LOO), and other hard copy files supporting employee's compensation and benefits.

Pay administration is a manual process that currently requires experienced and knowledgeable INAC Compensation Advisors to mitigate the risks in the absence of an end-to-end documented workflow. To make manual pay calculations, particularly for supplementary payments, Compensation Advisors must find and reference several unconsolidated documents, including collective agreements and policies, in conjunction with the respective employee hard copy pay history.

Interviews suggested that there is a lack of sufficient training for Compensation Advisors. Processing pay in the On-Line Pay System, while accurately interpreting and understanding all of the applicable policies, directives and employee contracts, requires considerable knowledge. The volume of different collective agreements and policies to absorb is challenging, especially for new employees, highlighting the importance of regular and comprehensive training as well as appropriate documentation to maintain an effective payroll function.

We found that INAC Compensation Advisors currently act as a system of record for employee pay histories and that their knowledge is required to verify pay transaction accuracy. This reliance on experienced employees and the lack of a documented end-to-end process create risks for INAC. In addition to risks associated with Compensation Advisors leaving INAC, [Note 8] there is a risk that compensation personnel across the Department may interpret the pay rules and regulations differently, causing INAC employees in different areas to be paid according to different standards.

To identify key controls in the absence of a documented end-to-end payroll process, we reviewed four flow diagrams that describe the pay process at headquarters, as well as a draft Account Verification Framework document. During the audit, the "Account Verification Framework" was under development by Finance to establish direction and guidelines for Section 34 and 33 (s.34 and s.33 respectively) of the Financial Administration Act (FAA).

While these headquarters documents were not used and applied in regions examined, we used them as a baseline to capture regional differences. Based on inquiry, we documented procedural and control differences in each region visited. Table 1 highlights a sample of control differences across the regions examined.

Table 1 - Regional variances in payroll process controls

In addition to the control differences above, regional process variances were noted. Monitoring and review practices were seen to differ in each region. In one region visited, OSMS was not used due to system difficulties; instead, a regional tracking sheet had been developed to manage salary forecasts. Similarly, different forms were observed in regions, including a regional overtime pre-authorization form and a regional "Fast-Track Staffing" form.

In summary, pay administration is inconsistent across INAC regions. Based on the lack of a documented process, and the control variances noted, we cannot provide reasonable assurance that financial (business process, computer and reporting) controls have been designed and implemented effectively.

Pay process interdependencies with separate organizations and agencies

While pay transactions for separate operating agencies were not directly within the scope of the audit, payroll process interdependencies between INAC and other organizations were reviewed in regions visited. In particular, IOGC, the Department of Justice (DoJ), and CanNor were identified as stakeholders in INAC's payroll administration process. At the time of the audit, in all three cases, no documented agreements were in place outlining services involved, as further detailed below.

IOGC

• INAC Alberta office processes IOGC pay transactions (via the On-Line Pay System) and executes s.34 and s.33 for IOGC.
• We were informed by regional and IOGC management that IOGC is a separate employer whose employees are paid according to different compensation standards and collective agreements. Management interviewes suggested that a Memorandum of Understanding (MOU) should be in place between INAC and IOGC, but that no such agreement exists.
• While a 1992 MOU was made available on 20 August 2010, following completion of the audit work, IOGC and INAC persons interviewed during the audit were not aware of its existence.
• Conflicting information was provided throughout the audit regarding whether IOGC is a separate employer requiring an MOU. INAC should determine whether a documented agreement is required between INAC and IOGC for pay services. If no agreement is required, the Department should enforce procedural consistency between INAC and IOGC payroll.

DoJ

• We were informed that, in order to address Yukon resource constraints for DoJ and INAC, a DoJ employee in the Yukon region executes s.34 for INAC pay transactions; similarly, INAC's Yukon region executes s.34 for DoJ payroll.
• No evidence of an MOU was in place between the two departments, outlining roles, responsibilities, and system access privileges.

CanNor

• INAC Yukon office processes pay transactions (via the On-Line Pay System) and executes s.33 for CanNor payroll. (Discussed further in Section 5.1.2.)
• No evidence of a valid MOU between INAC and CanNor for 2010-11 was made available during the audit in the Yukon region. While INAC communicated internally that services specified in the expired 2009-10 MOU would continue to be provided in 2010-11, documented evidence to demonstrate whether CanNor authorized or approved this service extension under a payment schedule was not made available for review.

The lack of formal agreements presents a risk that INAC may not be able to demonstrate accountability over payments. It is important that INAC establish such agreements, particularly since external organizations may have access to process and verify pay transactions in INAC's On-Line Pay System. The lack of agreements also creates a risk to the GCPI implementation strategy and the post-GCPI payroll process, further discussed in Section 5.2.3. Without formal agreements, INAC's Accounting Officer might be inadvertently assuming accountability on behalf of another organization's Accounting Officer. In addition, there are practical financial implications, whereby INAC may not be recovering sufficient funds from separate organizations for services rendered.

5.1.2 CanNor salary roll-up and reporting in the Yukon

CanNor was created in August 2009 using INAC employees, including approximately 15 employees from the Yukon region. While these CanNor employees transferred from INAC mid-fiscal-year 2009-10, their salaries continued to be included under INAC's Yukon regional salary figures. This reporting error led to an approximate $700K regional overstatement for 2009-10.

We found that CanNor employees were being paid under the INAC code in RPS, "IAN", in the Yukon region. Moreover, CanNor employees could not be distinguished in RPS or PeopleSoft. To remove CanNor employees from the test sample, we requested a list of all CanNor employees from regional management. Three different, inconsistent lists were provided; therefore, we could not establish the completeness and accuracy of any of the lists. The only available method of confirming CanNor employees and their respective transfer dates from INAC to CanNor was to locate a hard-copy employment agreement for each CanNor employee. As a result, the 2009-10 salary expenditures for CanNor employees could not be confirmed. Based on the $1.5M projection for 2010-11, it was estimated that the 2009-10 costs were roughly $700K.

We understand that the creation of CanNor mid-fiscal-year initiated several challenges and that it was difficult for INAC to segregate CanNor employees in the applicable systems because INAC employees transferred to CanNor at different times, with several employees working partially for both organizations. However, no evidence was available to demonstrate that controls were in place to detect a regional misallocation in the salary reports. Furthermore, at the start of 2010-11, there was no evidence available to demonstrate that the Yukon region had corrected this reporting error for the new fiscal year.

Although salary figures for the Yukon CanNor employees did not represent a material amount for the Department, the reporting inaccuracy suggests a gap in INAC's regional salary reporting controls. Payroll accuracy for separate organizations and financial reporting for INAC were not within the scope of the audit; however, based on the observations in the Yukon region, there is a risk that Yukon CanNor salary figures continue to be included in the Department's salary reporting figures. This issue may exist in other regions affected by the creation of CanNor.

5.1.3 Controls to enforce pay accuracy

We reviewed the computer systems involved in the current payroll process, focusing on the controls in place to protect payroll data and to maintain alignment between actual expenditures and financial reporting. The following two areas were reviewed as part of the risk-based audit program:

• Interface between RPS and OSMS
• RPS pay transaction processing

These areas of review are further described below.

Interface between RPS and OSMS

As described in Section 5.1.1, OSMS is the Department's salary forecasting tool. There is no automated, real-time interface between RPS and OSMS. OSMS feeds the Oasis Oracle Financials system and, therefore, determines what salary expenditures are reported.

Data is loaded from RPS to OSMS every two business days at INAC. However, because OSMS includes a suspense account for transactions failing to load from RPS, a complete list of actual transactions could not be obtained from OSMS. [Note 9]

A complete report of actual payroll transactions (i.e. cheques cut) can only be obtained out of the RPS system. However, INAC cannot generate reports directly from RPS; instead, they must be provided by PWGSC. Such reports were found to be very difficult to obtain for the audit. We were informed by INAC management that PWGSC does not provide INAC with RPS reports on a regular basis and that a complete list of payroll transactions had not been obtained from PWGSC for the last three years.

Without reports on actual transactions from RPS, a complete reconciliation of all cheques issued cannot be performed. Based on interviews, regional salaries reported, which include manual journal vouchers (MJVs), are not validated against actual pay transactions.

As identified in the 2007-08 OAG audit, there are no controls in place to validate that the gross dollar batch of payroll transactions sent to PWGSC for processing is the same as the batch that is received back by the Department. The OAG noted that this situation is not unique to INAC, but that other departments have controls in place to ensure completeness of the payroll process. INAC's OAG management action plan acknowledged the gap, and highlighted that this had been identified as part of the internal FSR project, which recommended that discussions should be held with other departments to determine if, and how, they are performing this reconciliation. At the time of the audit, no evidence was available to demonstrate that such interdepartmental discussions had taken place.

On-Line Pay System and RPS

Employee data and pay transactions are entered by INAC Compensation Advisors through the On-Line Pay System, which connects to RPS at PWGSC. Pay verification and authorization, s.34 and s.33 respectively, are also executed electronically through the On-Line Pay System. We understand from INAC management that, because RPS does not electronically record users responsible for pay transactions, a screen shot should be printed in hard copy, date-stamped and signed by the authorities responsible for s.34 and s.33. This is performed to comply with the TBS Policy on Electronic Authorization and Authentication, which states that a complete audit trail of the electronic transactions must be maintained such that the authorizer is effectively and positively identified. [Note 10]

We reviewed IT controls to validate that the On-Line Pay System supports the accuracy of pay data and enforces proper authorization and adherence to policy. Our observations include:

• Completeness of the list of users with On-Line Pay System access privileges could not be confirmed. Descriptions of user access privileges were not available for review.
• Evidence was not available to demonstrate appropriate RPS access granting and monitoring. No evidence of a process to authorize and monitor current users or of RPS access request forms.
• One region examined was unable to provide audit evidence for s.33 of s.34 for any pay transaction in the last two years. Regional INAC management elected not to implement hard copy signatures and date stamps. Another region was unable to provide audit evidence demonstrating s.33 execution for the sample pay transactions tested.
• HR continues to execute s.33 in some regions instead of Finance, creating a segregation of duties risk. In particular, HR continues to execute s.33 in regions where s.33 evidence is not retained, contrary to INAC policy.
• Pay authorization roles and responsibilities between HR and Finance are not clearly defined. In regions where Finance does execute s.33, the authorization is dependent on HR review. There is a lack of training and transaction code knowledge in Finance to properly validate pay figures for s.33 sign-off. As a result, regional Finance personnel rely on HR to execute the FAA control.

5.1.4 Regular pay transactions

We examined regular pay transactions, including basic and acting pay, for INAC employees (RPS code "IAN"). Basic and acting pay encompass the largest salary commitments for INAC, ranging from 80-90% of total pay expenditures in the regions visited for 2008-09. [Note 11]

We tested pay transactions for calculation accuracy as well as for compliance with relevant collective agreements and policies. In the absence of documented, consistent controls for the payroll process, we established the test criteria based on headquarters documentation and interviews. The types of exceptions and exception rates varied across regions. In some instances, transactions included multiple exceptions across the test criteria.

Twenty-two> (22) regular pay transactions were tested, ranging from $135 to $5.3K [Note 12]. In total, we found that 10 out of 22 transactions included one or more exceptions. Regional Compensation Advisors helped to verify the accuracy of pay transactions and validate the exceptions noted. The exceptions observed in the transactions are summarized as follows:

• 4 of 22 (18%) exceptions regarding gross pay accuracy
• 5 of 22 (23%) exceptions regarding compliance to TBS policies, directives and collective agreements
• 4 of 22 (18%) exceptions regarding compliance to INAC policies

A higher exception rate was observed in pay transactions for students and Casual employees. Regular payments were not verified for FAA signing authorities unless applicable (e.g. the payment was combined with a supplementary payment requiring FAA sign-offs). Pre-approval and/or FAA s.32 were applicable to 6 of the 22 transactions, for which 1 exception was identified. Similarly, FAA s.34 and s.33 were applicable to 4 of the 22 transactions, for which 1 s.33 exception was noted.

Employee pay rates, classifications, places of employment and collective agreements change regularly and may trigger retro-active changes. These events require compensation rate changes. Because there was no mechanism in place to readily identify whether subsequent adjustment transactions had been made, we cannot conclude whether the errors noted in calculation accuracy would have been caught at a later date.

While the monetary impact of the pay inaccuracies observed during the audit was negligible, pay errors may have other implications and risks to the Department as follows:

• High frequency of exceptions may be indicative of a systematic problem of financial significance.
• High frequency of pay errors requires costly rework. While these costs are difficult to measure, regional discussions suggested that the amount of rework may hinder operations.

Recommendation 3 below pertains to Findings 3 and 4.

5.1.5 Supplementary pay transactions

Supplementary payments ranged from 10-20% of total regional salary expenditures in the regions visited (see Appendix A for further details). Unlike regular pay cheques, which are automated to run bi-weekly, supplementary pay is manually calculated. As a result, these payments were identified to be high-risk.

Thirteen (13) types of payments were tested in a sample of 28 supplementary pay transactions, ranging from $351 to $45K [Note 13]. In total, we found that 22 out of 28 transactions included one or more exceptions. The exceptions observed are summarized as follows:

• 9 of 28 (32%) exceptions regarding gross pay accuracy
• 10 of 28 (36%) exceptions regarding compliance to TBS policies, directives and collective agreements
• 11 of 28 (39%) exceptions regarding compliance to INAC policies

In addition, the following exceptions were observed with respect to the FAA:

• Pre-approval and/or s.32 was applicable to 24 of the 28 transactions, for which 14 exceptions were observed (58%)
• s.34 was applicable to 27 of the 28 transactions, for which 12 exceptions were observed (44%)
• s.33 was applicable to 27 of the 28 transactions, for which 17 exceptions were observed (63%)

The most notable exceptions observed relate to extra duty (i.e. overtime, stand-by and travel), particularly for extra duty paid to employees on compressed work week (CWW) [Note 14] schedules. High exception rates were observed in extra duty pay transactions (10 of 14)and significant deviations from policies and collective agreements were noted. For example, the following practices and exceptions were observed:

• Several months of extra duty submitted for pay by employees at year-end, leading to pay errors and a lack of proper management review prior to s.34 verification. For example, overtime for a non-existent calendar date, 29 February 2010, was authorized and processed for pay.
• Lack of pre-approval evidence for majority of transactions tested as well as retro-active pre-approvals (e.g. pre-approval signed after the extra duty was worked), including pre-approval signed six months after the extra duty was worked.
• Excessive amounts of extra duty paid to select individuals (e.g. average of over 63.5 hours worked/week – equalling 26 overtime hours/week - for 8.5 consecutive weeks), with no evidence of review and distribution across resources. TBS Maximum Hours of Work policy states that Public Service employees should not work more than 48 hours/week unless exceptional conditions prevail. In these instances, departments must maintain records on all exceptions authorized, including specific reason(s) for hours in excess of 48 hours per week.
• Non-compliance issues noted for employees working on CWW schedules, including no evidence of CWW employee agreements, no evidence of review or schedule adjustment for employees consistently paid overtime on "earned days off", and no evidence that employees were working a CWW schedule.
• Regional management lacks a complete view of employee CWW schedules to support decision-making.

INAC does not track employee extra duty hours in any of its systems. Because extra duty can be paid in cash or compensatory leave, monitoring only expenditures causes costs to be overlooked, namely the costs associated with compensatory leave. As demonstrated in Appendix A, some regions have higher costs associated with extra duty paid as compensatory leave than with that paid as cash. For example, compensatory leave was estimated to entail twice as much as overtime paid in cash in the Yukon (see Appendix A). Furthermore, if extra duty is continually taken as compensatory leave, it could exacerbate resource allocation/work load issues that are driving the original requirement for extra duty to be performed.

In addition to issues regarding individual extra duty pay transactions, the lack of extra duty tracking suggests that sufficient review and monitoring cannot currently be performed, at an individual, regional and Departmental level. We had expected to find control where INAC management monitors overtime, with a complete view of hours taken. This monitoring would typically determine whether resources are deployed effectively and the degree to which overtime aligns with peak work periods; for instance, a lack of overtime may indicate over-staffing. We were not able to identify these controls as part of INAC's management control framework.

Based on PWGSC transaction reports, extra duty pay represents 1.4% ($4.8M) of the Department's pay expenditures for 2008-09, varying from 0.7% to 2.6% in regions visited.[Note 15] Given the control gaps and the nature of exceptions identified, there is a risk of fraud.

5.2 Government of Canada Pay Interface project

PWGSC recently developed the Transformation of Pay Administration Initiative (TPAI). The goal of the TPAI is to ensure the long term sustainability of the GoC pay administration system that contributes to a more efficient and effective public service, offering better value to Canadians. There are two main components to the initiative: the Pay Modernization Project and the Pay Consolidation Project.

As part of the Pay Modernization Project, which seeks to streamline and centralize public service payroll processes using a common, shared HR management system ("PeopleSoft"), departments and agencies have begun to interface their payroll systems with PeopleSoft using the Government of Canada Pay Interface (GCPI). INAC plans to go live with the new interface between June and December 2010, adding an additional element of risk to payroll and the associated processes. INAC is the fourth government department to undertake the GCPI project.

The INAC implementation strategy is an eight-phase process that uses a gradual approach to roll out the implementation across the Department. The Alberta region is being used as a pilot implementation beginning June 2010, followed by seven go-live dates to implement the interface in other regions from June–November 2010.

GCPI project plans from January–March 2010 were reviewed as part of the audit. These plans included the first five phases (planning through to testing). Audit work included interviews, document reviews, and cross-verification testing. A risk-based audit program was developed that focused on the following areas:

• 5.2.1. Consistency of payroll data across systems
• 5.2.2. PeopleSoft readiness
• 5.2.3. Post-GCPI payroll process
• 5.2.4. Implementation strategy
• 5.2.5. Internal project communication

These areas are further described in the sections below, followed by:

• 5.2.6. Business impact and risk analysis.

5.2.1 Consistency of payroll data across systems

One of the GCPI risk factors identified was data discrepancies in employee data across systems at INAC. Leading practices suggest that, prior to interfacing two databases, the databases should have the same level of data integrity and data fields should reconcile between both databases to prevent errors. [Note 16] In the context of INAC's payroll processes and systems, this practice is important for PeopleSoft and RPS.

To assess the quality of data for key payroll data fields, we performed a data cross-verification across the following relevant systems, using the employee hard copy file for comparison:

• PeopleSoft
• RPS
• OSMS [Note 17]

OSMS and PeopleSoft were observed to have high exception rates in the cross-verification testing. For instance, 31% and 47% exception rates for the salary field were observed in OSMS and PeopleSoft respectively, in 85 samples across four regions. We also observed significant variation across regions. For example, the PeopleSoft salary exception rates varied from 17%-75% across four regions. A high rate of data discrepancies between PeopleSoft and RPS was also observed (for example, a 47% salary field discrepancy was noted between the two systems).

INAC is aiming to clean PeopleSoft data in preparation for GCPI through mass data corrections, termed "waves" of data clean-up (these data corrections were not part of the audit). The following observations were made with respect to the waves:

• Exception rate not observed to decrease as the waves progressed throughout the audit.
• Clean-up waves did not consider all relevant systems in the pay process. Specifically, regions confirmed that OSMS had the correct data in some cases – not the pay card or RPS; however, OSMS was not referenced when data corrections were being made. [Note 18]
• Corrections were observed to be highly complex and no additional training or resources were provided to assist with data clean-up. Compensation Advisors often had to examine data across several systems and trace through employee's employment history to verify data accuracy.
• Not all fields examined were included in the waves of clean-up, including "next increment date", which was observed to have a very high exception rate in PeopleSoft.
• Data discrepancies were re-introduced by separate, simultaneous PeopleSoft data correction initiatives, with no communication of the data modifications made to regions.

Based on the exception rates and observations above, we cannot conclude that the data in PeopleSoft is ready to be interfaced with RPS under the GCPI project. Without preventive controls in place to protect PeopleSoft from the generation of new errors, corrective initiatives will become more resource-intensive and may not achieve the project's objectives. As a result, there is a high likelihood that data will disagree between RPS and PeopleSoft if GCPI is implemented as planned. Furthermore, the gains made by waves of clean-up will be difficult to maintain.

5.2.2 PeopleSoft readiness

PeopleSoft will play a fundamental role in the payroll process post-GCPI, as pay transactions will be initiated in the PeopleSoft system.

Based on an upgrade review and a recent audit of the PeopleSoft [Note 19] system, conducted concurrently with this audit of payroll, the PeopleSoft system and associated processes are not sufficiently prepared for this interface. Specifically, there is no evidence to demonstrate that the audit findings from the PeopleSoft upgrade review and the recent audit have been addressed by management.

Therefore, the following issues remain pertinent, creating a risk to the GCPI project:

• Inadequate HR workflow documentation and trained PeopleSoft resources
• Insufficient communication and collaboration between regions, headquarters, and business units
• Lack of PeopleSoft reports, leading to "black books", under-utilization of INAC's HR system and a reduction in both the quality and timeliness of information
• Lack of data integrity and data governance

5.2.3 Post-GCPI payroll process

The payroll process will change once GCPI is implemented. Limited documentation regarding the project plans and the changes to payroll process was available for review. Therefore, we established our understanding of the implementation strategy and the changes planned for INAC's payroll process primarily through inquiry and interviews.

Following GCPI implementation, INAC plans to implement a "batch" s.33, where all transactions for the Department are signed off as a batch at headquarters instead of individually in the regions. While a regional authorization will continue, a single delegated authority at headquarters will become accountable for s.33. No evidence was available to demonstrate how regional accountability for pay transactions will be enforced under this new model, particularly since Finance representatives in regions visited were not aware of this change.

The Account Verification Framework, under development during the audit, focuses on s.33 as a key control while detailing pay process steps. However, the Framework does not make reference to process changes post-GCPI. There was no evidence to demonstrate that post-GCPI process changes were taken into account in the Framework, or that the GCPI project considered s.33 procedures detailed in the Framework.

We also were unable to establish how the pay process will change for separate operating agencies. In particular, IOGC does not currently use PeopleSoft and is not participating in the GCPI initiative. Since the Alberta region executes the payroll process on behalf of IOGC, as previously discussed in Section 5.1.1, Compensation Advisors in the region will continue to require access to RPS in order to generate IOGC pay transactions, resulting in two pay processes in place in the Alberta region. IOGC personnel interviewed were not aware of these changes and potential implications for their agency. Similar questions regarding other separate operating agencies and departments involved in the INAC payroll administration process, including CanNor and DoJ. Evidence of consideration for these unique circumstances in GCPI project plans was not available for review.

The post-GCPI RPS access restrictions are a further area of concern. Access to RPS via the On-Line Pay System will not change post-GCPI, which will allow compensation personnel to continue processing pay transactions directly through RPS instead of PeopleSoft. No evidence was available to demonstrate how using the On-Line Pay System instead of PeopleSoft would be prevented. This represents a control gap with several associate risks, further discussed in Section 5.2.6.

5.2.4 Implementation strategy

Using a pilot site allows INAC to resolve unexpected problems on a smaller scale than if the entire Department went live at once. However, this approach lends itself to a higher degree of complexity due to the inconsistency and application of pay policies, processes and systems that the implementation team will encounter across the Department during the roll-out.

Based on testing across a sample of regions, we found that Alberta has experienced knowledgeable staff who diligently monitor and control the payroll process. The Alberta region was not found to be representative of other regions; significant variances between regions were noted, as previously discussed in Section 5.1.1 and 5.1.3. Specifically, experience and knowledge in the Alberta region was observed to compensate for control gaps and the lack of payroll documentation. Not all regions were found to have this level of experience; for instance, a significant portion of the HR team was new to INAC in at least one region. As a result of these discrepancies, issues may present themselves during the phased roll-out that were not observed during the pilot.

While the gradual, pilot method appears to be a judicious approach, the timelines are aggressive given the current state of PeopleSoft and the changes to the payroll process involved. Moreover, key milestones, "project gates", and deliverables were undefined ("to be determined") in the project charter (signed after the audit work was complete, on 5 July 2010), making it difficult to assess project health.

Evidence to support the determination of project timelines and implementation sequence across regions was not available for review. While a checklist indicating pilot region preparedness for go-live was developed, no evidence of the criteria used to evaluate and assess the readiness of other regions and headquarters was available. Therefore, we could not determine the basis for the project plan and corresponding schedule. Based on evidence available, it is not clear how the GCPI risks will be sufficiently mitigated under the current project timeline.

5.2.5 Internal project communication

While a tight project schedule may be managed with strong alignment and coordination, we observed a lack of communication between business units and between headquarters and regions. We noted multiple data and process discrepancies as a result of these communication gaps. We also observed a lack of Finance involvement. As discussed in Section 5.2.3, regional Finance interviews indicated a lack of awareness regarding changes to the payroll process post-GCPI, including the batch s.33. Finance in some regions was preparing to adjust their payroll process and execution of s.33 in a way that would not be possible under the post-GCPI payroll process.

We found a lack of evidence to demonstrate that stakeholders from HR, IT and Finance had agreed on project objectives and timelines. The project charter was only signed on 5 July 2010 (after the audit work had been completed) and did not include Finance representation. Furthermore, dates for project milestones and deliverables remained as "to be determined" when the charter was signed. While outside the scope and timeline of the audit, we understand from management that GCPI had already gone into production in the pilot region when the charter was signed.

5.2.6 Business impact and risk analysis

The findings in Sections 5.2.1-5.2.5 aggregate to form Finding 6 below.

Risks associated with the GCPI project include the following (in order of significance, where significance is a measure of both likelihood and impact):

1. Continued RPS access could lead to:
   • Transactions executed using the On-Line Pay System instead of PeopleSoft
   • Employee transaction histories differing between RPS and PeopleSoft
   • Unauthorized modifications to RPS data via the On-Line Pay System
   • Irreconcilable payroll data between systems
   • Duplicate payroll transactions entered using two different systems
2. Lack of PeopleSoft data integrity may lead to perpetual manual-intensive, costly waves of clean-up
3. Batch s.33 sign-offs could result in lack of regional accountability for individual transactions
4. Lack of PeopleSoft access controls may lead to unauthorized data modifications, causing pay transactions to be rejected by RPS
5. Lack of communication and training could introduce new inconsistencies and control gaps in the Department's pay process
6. Service expectations of separate operating agencies may not align with the new payroll process

Rather than overwriting RPS legacy data with PeopleSoft data, only individual pay transactions will be transmitted from PeopleSoft to RPS via the GCPI interface. We were informed that if there are any discrepancies between the employee data in the transaction from PeopleSoft and the legacy employee data in RPS, RPS will reject the transaction. [Note 20]

Access to RPS will not change post-GCPI; therefore, pay transactions can continue to be submitted to PWGSC through the On-Line Pay System, circumventing PeopleSoft. Risks associated with access rights to RPS post-GCPI are significant because RPS will provide an alternate method to initiate transactions. In terms of security, pay transactions initiated through RPS will directly bypass audit trails, monitoring and detective controls designed as part of PeopleSoft and the pay interface. This risk event is operationally significant because PeopleSoft transaction histories would become inaccurate and transaction tracking between both systems would not reconcile, leading to increased manual rework.

The current lack of PeopleSoft data integrity and preventive controls (including training) increases the probability of pay transactions being rejected by RPS due to data discrepancies. If sufficient end-user support is not in place to manage the volume of problems that arise, the rejections may not be resolved in time to meet payroll deadlines, potentially increasing the likelihood that the On-Line Pay System will be used instead of PeopleSoft. If this were to repeat, the problem would perpetuate, further diminishing the maintenance of PeopleSoft data and reliance on the system.

The impact of this risk scenario may not be immediate, but is significant. The consequences include having inconsistent data and transaction histories between two systems in a single payroll process. Once PeopleSoft manages pay transactions, with pay and benefits totalling $489M, [Note 21] the impact of unreliable data will be significant and more difficult to correct. Moreover, the effects may only become evident many months after the implementation.

Based on data quality issues, lack of PeopleSoft readiness, findings regarding the post-GCPI payroll process, and gaps in communication and coordination, we cannot conclude that INAC is ready to implement GCPI at this time. While the objectives of the project are reasonable and GCPI has the potential to reduce manual workload and streamline the payroll process, the implementation could lead to additional workload and create new problems if a sound control framework is not in place.

6. Conclusion

We found a high exception rate in pay transactions tested, particularly in extra duty pay transactions. Given the observed lack of a consistent Departmental pay process and regional control variances, we cannot conclude that the payroll administration control framework successfully supports payment accuracy.

While pay errors of financial significance were not identified for the Department, the high frequency of these errors may entail costly rework and may be indicative of a systematic problem of financial significance. We recommend that INAC address the findings according to the recommendations in Section 5.

We cannot conclude that INAC is well prepared for GCPI implementation at this time. We found data errors, a lack of PeopleSoft readiness, gaps in the planned post-GCPI payroll process and system access controls, and insufficient internal project communication. While we find the GCPI business case, project objectives, and gradual roll-out approach to be sound, evidence was not available to demonstrate how the risks will be adequately managed under the current implementation schedule.

While the automation of manual processes under the GCPI project may address current inefficiencies and improve the overall payroll process, we recommend that INAC adjust the project timelines to allow for sufficient risk analysis and risk management. In particular, root causes of data errors should be addressed and the post-GCPI pay process should be assessed and documented prior to implementation.

7. Management Action Plan

Appendix A - Financial Context for INAC Payroll

A.1 Summary of financial reporting

Table 2 provides a summary of INAC's salaries and benefits expenses as reported in the unaudited Departmental financial statements for the past six years. The FTEs listed below are as stated in INAC's Departmental Performance Report for the respective years. The dollar values, as per the financial statements, are stated in millions (CDN $). As previously noted in Section 1, there was an 12.3% increase in compensation per FTE from 2007-08 to 2008-09, which INAC explained as the machinery of government change to amalgamate Residential Schools with INAC and binding salary commitments arising from renewed collective agreements.

It was not within the scope of this audit of payroll to review or audit the salary figures or FTEs reported. Figures are highlighted to provide context for the audit report only.

Table 2 - Expenses versus number of FTEs

* Total operations expenses exclude court awards and other settlements, environmental liabilities, and claims and litigation.

A.2 Regional analysis

Based on the RPS reports from PWGSC, we calculated expenditures for the regions visited. As discussed in Section 5.1.3, the RPS reports are not made readily available to INAC. Therefore, our financial summaries in this report, based on actual expenditures, may differ from INAC salary forecast reports. The dollar values for regional expenditures are stated in thousands (CDN $) in Table 3 below.

Table 3 - Payroll expenditures (excluding benefits) 2008-09 break-down by region for regions visited

Regions visited encompassed 28% of Departmental salary expenditures for 2008-09.

When examining extra duty expenditures, costs may be overlooked if compensatory leave is not considered. Per collective agreements, employees can choose to take compensatory leave instead of cash for overtime hours worked. We understand that, because INAC does not track overtime hours, a complete view of overtime costs is not available to management. Compensatory leave costs include hours used as well as unused leave hours cashed out at year-end.

Based on our analysis of PeopleSoft compensatory leave data, outlined in Table 4 below, the regions visited with lower overtime expenditures had higher compensatory leave costs per FTE . For instance, compensatory leave makes up approximately 68% of extra duty costs per FTE in the Yukon region, which is not evident by examining expenditures only.

Table 4 - Extra duty expenditures and compensatory (comp.) leave - estimated costs for 2008-09

Appendix B - Audit Criteria

The following audit criteria were developed to provide assurance in line with the audit objectives outlined in Section 2.1.

Gain reasonable assurance that:

• Financial (business process, computer and reporting) controls have been designed and implemented as part of a departmental pay administration model to support the accuracy of regular and supplementary pay transactions.
• INAC's pay administration activities are in compliance with policies, procedures and collective agreements.
• Oversight for payroll exists; management at respective levels have the necessary reports to conduct payroll monitoring and reconciliations; and processes are in place to support accurate reporting of payroll expenditures to be represented on the financial statements.
• System interfaces and application controls for payroll administration systems are effectively supporting the accuracy of pay transactions, which includes any proposed changes to pay administration as a result of GCPI.
• Payroll services with external agencies have controls in place to appropriately identify roles, responsibilities and accountabilities for the administration of payroll prior to GCPI.

Footnotes:

1. No evidence available at the time of the audit to demonstrate that this error has been corrected for 2010-11. Section 5.1.5 describes this issue further. (return to source paragraph)
2. INAC Departmental Performance Report, INAC Financial Statements for the Year Ended March 31, 2009 (return to source paragraph)
3. TBS Policy on Terms and Conditions of Employment (2009), section 8
   TBS Policy on Electronic Authorization and Authentication (1996) (return to source paragraph)
4. The scope of the audit included regular and supplementary payments through PWGSC on INAC Department Pay Code "IAN" (return to source paragraph)
5. For fiscal year 2009-10, testing included pay transactions from April 1 - December 2009 only (return to source paragraph)
6. For the purposes of the audit, interfaces between systems may be automated and/or manual (return to source paragraph)
7. Teachers and principals for federal schools in Ontario and Alberta, paid under the "IAN" code in RPS, were within scope (return to source paragraph)
8. Jennex, M. E. (2008). Current Issues in Knowledge Management. Hershey, PA: Information Science Reference (Page 1). (return to source paragraph)
9. While a PWGSC pay file, loaded from RPS to OSMS, contains the actual expenditures, it is not in readable format. (return to source paragraph)
10. TBS Policy on Electronic Authorization and Authentication, Sections 8.g, 8.f (return to source paragraph)
11. Calculated based on PWGSC transaction reports. (return to source paragraph)
12. This $5.3K transaction represented monthly regular pay for a federal school teacher. (return to source paragraph)
13. This $45K transaction pertains to a severance payment. (return to source paragraph)
14. CWW schedules refer to alternative work arrangements where a standard work week is reduced to fewer than 5 full days. Employees with CWW entitlement work an equivalent number of hours/week by working longer hours/day. (return to source paragraph)
15. These amounts exclude the costs associated with compensatory leave. (return to source paragraph)
16. R.L. Krutz, R.D, Vines, The CISSP Prep Guide, Wiley Publishing Inc 2003, Pages 277-278, "Biba Integrity Model" (return to source paragraph)
17. OSMS is a budget tool for salary forecasting. Therefore, it is understood that salaries in OSMS may differ from actual salaries on the manual pay card, based on projections. However, in general, HR data between systems should reconcile. (return to source paragraph)
18. We understand that as a salary forecasting system, data in OSMS will not reconcile with RPS in real-time; however, tombstone employee data should be consistent across systems. (return to source paragraph)
19. PeopleSoft in this report refers to INAC's implementation of the PeopleSoft application, not the tool itself. (return to source paragraph)
20. We were not provided evidence to demonstrate how the project objective of eliminating data entry into two systems will be achieved for new employees. Specifically, if PeopleSoft cannot write to RPS without an edit check for consistency, it was not made clear how data for new employees will be entered into RPS. INAC Departmental Performance Report, Section I - Page 15 and Section III - Page 52, INAC Unaudited Financial Statements for the year ended March 31 2009. (return to source paragraph)
21. INAC Departmental Performance Report, Section I - Page 15 and Section III - Page 52, INAC Unaudited Financial Statements for the year ended March 31 2009 (return to source paragraph)
22. 2009-10 figures are based on the draft Financial Statements, which were not published at the time of the audit. (return to source paragraph)
23. Extra duty calculation includes overtime retro (return to source paragraph)
24. Expenditures in Table 3 include salary payments from RPS for INAC ("IAN" code) employees only (return to source paragraph)
25. Based on inconsistencies noted in OSMS and PeopleSoft, we cannot confirm the accuracy of the reports obtained for analysis. The figures in the section aim simply to provide further context to overtime spending - not to state actual costs. (return to source paragraph)
26. Assuming an average annual salary rate of $70K and extra duty paid at time and a half. (return to source paragraph)