Archived - Audit of SCIS Expenditure Management

Background

In 2006, Treasury Board approved the Secure Certificate of Indian Status (SCIS) project. The approved funding covered one-time implementation costs of $9.34M and recurring operational costs (Vote 1, Vote 5 and Vote 10) of $5.73M annually. The SCIS initiative was introduced by Aboriginal Affairs and Northern Development Canada (hereon referred to as "AANDC" or "the Department") to replace the original Certificate of Indian Status, which was a laminated paper card that could be easily altered for fraudulent purposes.

The Resolution and Individual Affairs (RIA) Sector is the sponsor organization for the SCIS project, and has overall accountability for SCIS service delivery. RIA is also responsible for project and financial management, including progress reporting.

This audit of SCIS expenditure management was initiated in April 2011 to examine potential risks associated with SCIS project expenditure management.

Objective and scope

The objective of this audit was to provide assurance that:

• A sound control framework is in place to manage expenditures;
  
  
• The SCIS budget is managed with appropriate oversight; and,
  
  
• SCIS project is on track for an effective and efficient implementation.

The scope of the audit covered expenditures made in fiscal year 2010-11 between November 1, 2010 and March 31, 2011, as well as management controls in place at the time of the audit. The audit covered risks in the broad areas of expenditure, procurement and record management.

Methodology

The audit was planned and conducted to be in accordance with the Internal Auditing Standards for the Government of Canada as set out in the Treasury Board Policy on Internal Audit. It does not constitute an audit in accordance with any Generally Accepted Auditing Standards (GAAS), typically used as part of audited financial statements.

Audit work was conducted from June 2011 to September 2011 at headquarters using a risk-based audit program that was developed based on the Financial Administration Act (FAA) and relevant Treasury Board policies. Principle audit techniques used include documentation reviews, interviews, walk-throughs and testing, including data analytics.

Findings and Conclusion

The audit found that the reported current budget of $6.1M for fiscal year 2010-11, was spent appropriately. While supplementary funding was spent in addition to this total, the Treasury Board funding granted through the 2006 submission was effectively allocated to the SCIS project by the Department for the period under audit.

While the audit found effective expenditure management in many areas, the following exceptions were noted for the period under audit:

• Financial coding not effectively leveraged to enable an understanding of total project cost;
  
  
• Software expenditures not capitalized in accordance with Treasury Board and public accounting guidelines while nearly $5M in Vote 5 funding lapsed;
  
  
• Electronic and paper-based records not well integrated, leading to inefficiencies and increased non-compliance risk regarding records management;
  
  
• Procurement planning not well coordinated between the SCIS and procurement teams; and,
  
  
• Key decisions not consistently recorded and limited operational reporting.

Recommendations

The Audit and Evaluation Sector recommends that the Assistant Deputy Minister, Resolution and Individual Affairs Sector and the Chief Financial Officer address the findings identified to further improve budget and expenditure management for the SCIS project. The recommendations should be considered as planning continues toward achieving a national, sustainable model for SCIS. Specifically, we recommend:

The Assistant Deputy Minister, Resolution and Individual Affairs Sector should:

• (Recommendation #1) – Ensure that the SCIS project team, in consultation with the Resource Planning and Administration unit of RIA and with the CFO sector, utilizes a more comprehensive project coding structure to track and report on all expenditures associated with the development and implementation of SCIS.  We recommend a project coding structure be designed to enable:
  
  
  • Effective and efficient tracking of all expenditures related to SCIS across the Department;
    
    
  • Reconciliation of budget transfers to other RCM's and associated expenditures to enable appropriate and efficient use of funds; and,
    
    
  • Reporting of total project costs.
    
    
• (Recommendation #4) – Ensure that the SCIS team continues to proactively review, prepare and revise procurement strategies for the project.
  
  
• (Recommendation #5) – Ensure that the SCIS project maintains detailed operational reporting that includes:
  
  
  • A detailed risk register to track risk mitigating activities at the operational level; and,
    
    
  • Performance metrics and KPIs, including financial and resource metrics, service delivery, and project status by stream.
    
    

Dashboards for senior management should contain an aggregate of the detailed operational reporting, and have the ability to raise major issues or risks that require attention. In addition, key management briefings and evidence of decisions should be documented and retained.

The Chief Financial Officer should:

• (Recommendation #2):
  
  
  • Determine whether SCIS software development costs incurred to date should be reclassified in accordance with TBAS 3.1 and PSAB 3150;
    
    
  • Review other projects with potential capital investment to determine whether appropriate accounting treatment has been applied; and,
    
    
  • Ensure when changes to project scope impact Vote authority that the funding profile be adjusted through Treasury Board to match projected spending.
    
    
• (Recommendation #3) – Review internal policies to ensure alignment of electronic records (eRecord) management with related paper-based records management. To more efficiently and securely store and access records of value to the Department, we recommend:
  
  
  • Establishing common nomenclature and promote use of metadata to improve linkage of paper-based records to electronic transactions (i.e. linking transactions in OASIS with documents in the document management solution);
    
    
  • Increasing employee awareness and training on internal recording keeping policies;
    
    
  • Increasing monitoring and compliance of record keeping practices; and,
    
    
  • Ensuring business processes are revised to reflect continual evolution of eRecord management.
    
    
• (Recommendation #4) – Ensure procurement officers use and refer to developed procurement plans. To improve communication and alignment, we recommend that a procurement officer be designated as a liaison for the SCIS project. The procurement liaison should be tasked to provide regular guidance and feedback to the project team in the following areas:
  
  
  • Selection of appropriate procurement vehicles to meet the short-, medium- and long-term needs of SCIS project;
    
    
  • Tendering notices and requests for proposal; and,
    
    
  • Establishing timelines for procurement to ensure the right resources are provided at the right time.

In 2006, Treasury Board approved the SCIS project for $9.34M of funding for one-time implementation costs and $5.73M annually to introduce a secure identity document to confirm official Indian Status in Canada. The SCIS initiative was introduced by AANDC to replace the original Certificate of Indian Status, which was a laminated paper card that could be easily altered for fraudulent purposes.

SCIS application intake began at the start of 2009. As a result of feedback provided by AES, a new project management team, process, and roll-out strategy was introduced in December 2009.

The Resolution and Individual Affairs (RIA) sector is the sponsor organization for the SCIS project, and has overall accountability for SCIS service delivery. RIA is also responsible for project and financial management, including progress reporting.

This audit of SCIS expenditure management was initiated in April 2011 to examine potential risks associated with SCIS project expenditure management.

2.1 Objective

The objective of this audit was to provide assurance that:

• A sound control framework is in place to manage expenditures;
  
  
• The SCIS budget is managed with appropriate oversight; and,
  
  
• SCIS project is on track for an effective and efficient implementation.

2.2 Scope

The scope of the audit covered expenditures made in fiscal year 2010-11 between November 1, 2010 and March 31, 2011, as well as management controls in place at the time of the audit. The scope included the following:

• Measures implemented in fiscal year 2010-11 to address procurement and records management control deficiencies;
  
  
• Expenditures made between November 1, 2010 to 31 March 2011, including:
  
  
  • Financial coding and expenditure tracking;
    
    
  • Identification and classification of expenditures;
    
    
  • Review of budget transfers;
    
    
• Current budgeting and expenditure management practices and controls (i.e. practices in place during the execution of the audit); and,
  
  
• Project budgeting, variance analysis and reporting for fiscal year 2010-11.

2.3 Areas not in scope

The following areas were not within the audit scope:

• IT controls to limit access to the financial system: Oracle Financials application controls and IT general controls were not audited.
  
  
• Costing model: The costing model for a sustainable, national SCIS program continued to evolve and was not assessed as part of the audit.

The audit of SCIS expenditure management was planned and conducted to be in accordance with the Internal Auditing Standards for the Government of Canada as set out in the Treasury Board Policy on Internal Audit. It does not constitute an audit in accordance with any Generally Accepted Auditing Standards (GAAS), typically used as part of audited financial statements.

Audit work was conducted from June 2011 to September 2011 at AANDC headquarters. A risk-based audit program was developed based on the Financial Administration Act (FAA), the Policy on Internal Control (PIC) and other relevant policies, standards and directives specified by the Treasury Board of Canada Secretariat (see Appendix A). Principle audit techniques used include documentation reviews, interviews, walk-throughs and testing, including data analytics.

To inform management of audit status, and enable the Department to understand and effectively mitigate risks throughout the audit, periodic status meetings were held with the Assistant Deputy Minister (ADM) of RIA. Status updates were also provided to the Departmental Audit Committee. Key dates and audit timelines are depicted in the figure below.

The picture depicts the timeline for the audit of SCIS expenditure management. Above the timeline, arrows are used to show the length of each phase of the audit, beginning with initial meetings to refine the audit scope. This segment of the audit lasted from April 2011 to June 2011. The next phase of the audit, the planning phase, began in late May 2011 and was finished at the end of June 2011. The execution phase began in mid-June 2011 and ended at the end of August 2011. The reporting phase of the audit began at the end of August 2011 and was completed in September 2011 with the presentation of the audit report to the Departmental Audit Committee.

The picture also depicts the approximate dates of key audit briefs with the Departmental Audit Committee (represented by a diamond shape) and SCIS project leadership (represented by a heptagon shape). The first briefing occurred in late April 2011 where the Departmental Audit Committee requested an audit of SCIS expenditure management. Following this meeting, the audit team met with SCIS project leadership in May 2011 to hold an initial discussion on the scope of the audit. In June 2011, the audit team held a formal kick-off meeting with SCIS project leadership to initiate the audit. Following the kick-off meeting, the audit team provided a briefing to the Departmental Audit Committee in late June 2011. This was followed by an audit status meeting with SCIS project leadership in mid July 2011 to discuss the status of the audit. A final briefing was held with SCIS project leadership at the beginning of September 2011 to present the results of the audit. The results along with the final audit report and management action plan were presented to the Departmental Audit Committee at the end of September 2011.

Overall, the project expenditures in fiscal year 2010-11 were managed appropriately. The reported current budget of $6.1M for fiscal year 2010-11 was spent on the SCIS project. While supplementary funding was spent in addition to this total, as discussed in Section 4.1, the Treasury Board funding granted through the 2006 submission was effectively allocated to the SCIS project by the Department for the period under audit.

The findings and recommendations are organized according to the following five areas:

1. Expenditure tracking;
   
   
2. Capital expenditure classification;
   
   
3. Records management;
   
   
4. Procurement; and,
   
   
5. Reporting and records of decision.

4.1 Expenditure tracking

We observed improvements made to SCIS expenditure management, coinciding with a change in project leadership that occurred in 2010. Specifically, we observed a greater degree of rigour and discipline in tracking SCIS expenditures and the use of a project code to track expenditures allocated through the Financial Management Committee (FMC).

While progress has been noted, the following areas were identified for improvement to promote more effective management of SCIS expenditures as the project evolves to a steady-state program:

• Financial codes are not configured to track expenditures in a comprehensive manner: The project code used by SCIS does not cover expenditures made by other Responsibility Centre Managers (RCM) in the Department. We noted one such example, where Information Management Branch (IMB) established a separate coding mechanism to track project expenditures. As a result, budget transfers of $1.5M for fiscal year 2010-11 are not tracked as SCIS project expenditures. This situation impairs the Department's ability to view the total SCIS expenditures in the financial system.
  
  
• There is no detailed reconciliation of SCIS expenditures As a result of the limitation in project coding described above, the reconciliation of project expenditures (budget versus actual) performed by the RIA Sector excluded spending made by another RCM in the Department. Specifically, no detailed reconciliation was performed for spending by IMB for application development, which represented 17% (approximately $1M) of total SCIS expenditures in fiscal year 2010-11.
  
  
• Total cost of ownership is not well understood: Because another RCM supplemented funds transferred to them by SCIS with their own internal budget funds, the total funds originating from the SCIS RCM do not represent the total cost of the project. Specifically, approximately 9% ($95K) of the total IMB spending on SCIS application development for fiscal year 2010-11 was from IMB's internal budget funds. The use of IMB's internal budget allocation to supplement SCIS application development has resulted in:
  
  
  • Inaccurate management reporting of total costs for the development and implementation of SCIS; and,
    
    
  • Increased risk of funding pressure for other IT projects.

4.2 Capital expenditure classification

We observed that all project expenditures for the SCIS project are expensed when incurred, including software development expenditures incurred within IMB. However, SCIS software developed in-house subject to the requirements of Treasury Board Accounting Standards (TBAS) 3.1 and 3.1.1 for Capital Assets and Software Guidance indicates these types of expenditures should be capitalized. Public Sector Accounting Board (PSAB) section 3150 also provides guidance on the capitalization of tangible capital assets, suggesting that expenditures related to software development should be capitalized. No evidence was available for review to confirm the process specified for capital assets in AANDC's Financial Management Manual (Chapter 7.11) was adhered to.

We noted in fiscal year 2010-11 that reported current budget of SCIS Vote 1 funds was $6.1M while the Treasury Board submission allotment for Vote 1 remained at $2.95M. Since 2006, the SCIS delivery method has evolved significantly requiring amendments to the Treasury Board Vote authority profile. These amendments were not made, which resulted in the Department having to approve FMC pressure funds for the project. Additionally, accumulated Vote 5 and remaining Vote 10 funding for the project lapsed at year-end.

4.3 Records management

We observed improvements to records management practices. Invoices, contracts and supporting financial paper-work were readily available for review, in a consistent filing format managed by the RIA Sector. While improvement has been made, the following exceptions were noted:

• Policy non-compliance for paper-based records: We observed instances of non-compliance with records management policies during testing within the Headquarters Financial Services office of the CFO Sector. Specifically, we observed important financial control documents not filed in accordance with the Treasury Board Directive on Recording Keeping that requires documents to be properly classified and stored. While all supporting documents were located, the files were stored in boxes, unclassified and unsecured.
  
  
• Inconsistent procurement filing for paper-based records: In the sample of procurement file reviewed, we found no evidence of a defined, structured framework for managing associated documents. The importance of a number of documents contained in the files or the associated business value for their retention was not clear. In some instances, repetitive information was retained, which resulted in difficulty ascertaining the final outcomes of key decisions made on contracts and associated amendments.
  
  
• Gaps in policy awareness: The results of our testing indicate that retention policies for financial records are not well understood by personnel managing financial records within the RIA Sector. This suggests that communication between IMB and the RIA Sector may require strengthening with regards to the application of internal records management policies.

In addition to the exceptions above, the audit observed inefficiencies associated with linking paper-based records to their associated electronic files in the financial system. Specific inefficiencies noted include:

• Inconsistent budget transfer batch nomenclature, resulting in difficulty identifying transfers; and,
  
  
• Inability to identify supply arrangements used by a particular RCM, resulting in time-consuming key word searches on a case-by-case basis.

To further refine the records management process for greater efficiency and risk mitigation, the processes in place to manage files with electronic and paper-based components should be revised to improve integration.

The exceptions noted and the inefficiencies observed suggest that the framework for managing paper-based records may require attention. As part of efficiency-focused transformations taking place, the Department should consider efficiencies to be gained by integrating the processes to manage paper-based records in greater alignment with electronic file-keeping.

4.4 Procurement

Procurement is another area in which improvements were noted. We observed a greater degree of planning and oversight for SCIS-related contracts within the RIA Sector. Despite these improvements, there was a lack of evidence to demonstrate a coordinated planning process between the SCIS project team and the CFO procurement team.

Our testing of procurement files and assessment of contracting strategies for SCIS suggested poor communication between the teams. Specifically, we noted the following:

• Inefficiencies in contract management: The nature and frequency of communications between procurement and RIA personnel demonstrate challenges in implementing a coordinated approach to procurement for the SCIS project.
  
  
• Lack of a formalized procurement plan for 2010-11: Procurement management indicated that there has never been a formal procurement plan presented by the SCIS team to enable effective planning. However, while outside the period of audit, we noted that the SCIS project has established procurement plans for fiscal years 2011-12 and 2012-13. It is unclear why procurement management interviewed was not aware with these plans, suggesting a lack of coordination between the two units, particularly at the operational level.
• Potential for conflict of interest in current processes: Due to increased reliance on contracted personnel, it appears that there may be challenges in segregating some of the SCIS contract management functions from consultants. On two occasions, we observed consultants engaged in the bid review process. This practice introduces the potential for conflict of interest. To mitigate this risk, controls should be in place to assess the potential for conflict of interest in advance of bid reviews.

4.5 Reporting and records of decision

As part of our assessment of budgeting and oversight, we noted a lack of evidence to demonstrate how and when key decisions were made in fiscal year 2010-11 outside of briefing documents to the Deputy Minister. While we were informed of frequent meetings to discuss and resolve issues as part of the project's organizational reporting framework, records of decision from key management and oversight meetings were not available for review. The practice of retaining these records of decision is important for the following purposes:

• Demonstrating due diligence and rationale for budgetary changes or costing revisions; and,
  
  
• Managing SCIS knowledge, which is particularly important when key resources are no longer available to work on the project.

At a high level, it appears that the reporting and oversight processes have matured and that improved record keeping practices for key decisions is now in place for fiscal year 2011-12. As the project evolves, the following documentation should be retained as evidence of appropriate oversight and reporting:

• Risk registers to track and manage risks associated with the project;
  
  
• Records of decision from key meetings;
  
  
• Ongoing budget-to-actual analysis; and,
  
  
• Detailed cost forecasting.

---

5. Conclusion

---

6. Management Action Plan

---

Appendix A: Audit Criteria

The audit objective is linked to audit criteria developed in alignment with relevant Treasury Board policies (see Appendix B). Additional audit criteria were developed to address specific risks identified in during the planning phase of the audit.

---

Appendix B - List of Treasury Board policies reviewed

---