Management Practices Audit of the Chief Financial Officer (CFO) Sector

5.1.1 Management and Oversight Bodies

Effective governance includes the decision-making process and the process by which decisions are implemented (or not implemented). To support good governance, it is important that management oversight structures and mechanisms are established and functioning, with clearly communicated mandates, and that these governance structures have a clear role and purpose.

To determine if effective management and oversight bodies for CFO Sector operations were established and functioning, the audit team assessed whether:

• Governance committees were in place
• Governance committees had terms of reference defined
• Records of decision / meeting minutes were retained for committees in place
• Recommendations from management action plans were tracked and addressed

We found several formal oversight bodies in place within the Sector to govern large initiatives, ongoing operations and strategic planning for the Sector. As examples, oversight bodies and committees were found to be in place for the following:

• Departmental financial management;
• Sector management;
• Regional operations;
• CFO Sector Human Resources (HR);
• Debt write-off;
• Business management knowledge sharing;
• Projects and strategic initiatives;
• IT architecture;
• Grants and contributions;
• Information governance; and,
• Information technology stewardship.

Not all governance structures described by interviewees to be in place had terms of reference available for review. While we did not obtain a complete view of all the management meetings and oversight committees in the Sector, we were provided with terms of reference for 15 different governance structures. Similarly, we requested meeting minutes / records of decision for a sample of two governance structures. However, we were informed that one of the governance structures did not prepare such records. Records for the other structure were provided subsequent to the completion of the conduct phase of the audit.

While we found several management and oversight bodies exist, both horizontally and vertically within the Sector, we did not find evidence of a tool providing a consolidated, integrated view of how the governance structures integrate and support one another, with the exception of IMB governance bodies. The IMB has a documented view of how the various IMB oversight bodies relate to one another, the purpose of the bodies, and the calendar of meetings. This view allows for greater clarity, communication and rationalization of the meetings and committees, consistent with leading practices. Such a view was not found to be in place for the overall Sector.

A tool providing a complete view of the various committees and regular meetings in place would enable the Sector to identify areas of overlap (i.e. opportunities for greater efficiency), as well as to confirm appropriate risk coverage and alignment between governance bodies. For example, the information supporting one meeting may rely on the output from another meeting. Seeing the information flows between governance bodies and a calendar of all meetings could strengthen the framework and create new efficiencies by allowing management to identify gaps and / or areas of overlap across current governance structures.

We also found that a formalized risk assessment process had been undertaken by the Sector in 2012. This risk management exercise (termed "Integrated Performance and Risk Management Framework") aimed to "provide practical measures to support performance reporting and decision-making and also provide indicators for tracking the achievement of outcomes and managing risks". The exercise included a detailed logic model and aimed to support the Sector in addressing the significant transformations underway. The consideration for formal risk analyses during a time of significant change, as well as integrating these risk analyses within the objective reporting framework, is consistent with leading practices.

We confirmed that recommendations from management action plans prepared in response to previous AANDC internal audits were tracked by the Sector and reported on through CFO Sector quarterly reports.

For oversight bodies to be effective and enforce accountability for items discussed, records of decision can be an important control. In establishing a consolidated, integrated view of the oversight bodies, the documentation to support these structures should be defined and applied consistently.

Recommendation

1. The Chief Financial Officer should ensure that a consolidated, integrated view of the governance structures in place within the Sector, including the information flows between these structures, is established. As part of this exercise, the Chief Financial Officer should ensure that: an approach to including the newly created hubs is considered in the Sector's governance structure; terms of reference are defined and available for oversight bodies and assess whether there is any redundancy between committees and meetings; and, key decisions / meeting minutes are consistently recorded to enforce accountability and enable knowledge sharing.

5.1.2 Operational Objective-Setting and Planning

In support of an effective governance regime, an organization should have in place operational plans and objectives aimed at achieving its strategic objectives. In this regard, an organization first needs to clearly define and communicate its strategic direction and objectives, ensuring that they are aligned with its mandate. It should then establish operational plans and objectives aimed at achieving these strategic objectives.

To determine if the Sector had operational plans and objectives aimed at achieving its strategic objectives, the audit team assessed whether a clear process was in place to establish strategic priorities as well as operational objectives and plans. The audit team also assessed the alignment between operational objectives and plans and the strategic priorities.

Interviewees suggested that the CFO Sector is effective and focused in establishing operational objectives for the delivery of core business. For instance, interviews and other enquiries suggested that for the Sector's core business functions, such as IT and financial services, the operational objectives were clear, transparent and well understood.

We also found a process in place to report quarterly on progress against objectives articulated in the CFO business plan. Interviewees described a top-down process in place to establish the business plan, with feedback loops for bottom-up refinements. At the time of the audit, the business planning process in place for fiscal year 2012-13 was only in the process of being formally documented; nonetheless, it was relatively well understood by representatives interviewed.

Strategic priorities and how these priorities link to and inform operational objectives were less clearly understood. Without an in-depth understanding of priorities, management may not be sufficiently well-equipped to make resource allocation decisions; such decisions are even more critical in a time of fiscal constraint in which there are several demands on the Sector. While the Report on Plans and Priorities outlines the departmental priorities, we found limited understanding of the Sector's strategic priorities from interviewees, how these priorities should resolve competing pressures, and how the priorities set tactical, operational objectives.

During the course of the audit, the audit team was provided with two separate CFO business plans. In reviewing the first CFO business plan received, we found inconsistent methods of outlining priorities, and unclear links between the operational objectives detailed and the priorities defined up front. The link between strategic and operational objectives was difficult to understand from the document. Our observations were consistent with the challenge articulated in the control self assessment (CSA) and confirmed in interviews. A second, higher level business plan was provided by management in response to our questions and observations related to the lack of clarity in the first. We found this second plan to be much clearer. We also found that the Sector used the second business plan in communication of objectives to employees via an email. However, the less clear version of the plan was still in use, creating potential confusion. We were also informed that the Sector intended to post its 2012-13 business plan on its intranet site to be widely accessible to employees; however, the plan had not been posted as of March 2013.

We were informed that the business planning process has been evolving and that 2012-13 was especially challenging due to DRAP. We understand from interviewees that they expect the Sector to have greater clarity and alignment in future years between various planning tools and documents.

We also found opportunities to strengthen the IM objectives for the Department. During the time of the audit, an enterprise IM operational plan (or IM tactical plan) had not been developed by the IMB. AANDC's IM/IT strategy identified gaps in enterprise IM to be a top issue and we understand efforts have been initiated to address the gaps. We were also informed that MOUs for IM services between IMB and AANDC sectors do not exist.

As information is a critical asset for the Department and plays a central role in enabling the achievement of departmental objectives, we would have expected greater clarity on the desired future state for IM and the roadmap to get there. As described further in Sections 5.3 and 5.5, there are inefficiencies in how information is managed within the Sector and across the Department. Additionally, we noted significant opportunities to improve the Sector's intranet site, which can act as a centralized communication vehicle for events, Sector objectives and plan, organizational structures and other key information.

Recommendation

2. The Chief Financial Officer should ensure that business planning processes continue to be documented and that greater alignment of the business planning documentation produced by the Sector is maintained. To enforce consistency, the Chief Financial Officer should ensure that the number of tools and documents produced is rationalized and that outdated documents are decommissioned to avoid creating confusion. In addition, the Chief Financial Officer should ensure that information management (IM) strategic and operational plans are strengthened, finalized and implemented.

5.2.1 Internal Client Service Standards

Effective client service is enabled by implementing, monitoring and managing client service standards. Service standards should accurately reflect service that clients are receiving, and client feedback should be solicited to accurately reflect value in services provided. The CFO Sector plays an important role in providing internal services to other AANDC sectors and business units within the Sector, including IM and IT , procurement and transaction processing.

While we found some service standards in place within the Sector, client-centered service was found to be the control area with the greatest opportunity for improvement. In particular, we found limited client-centered performance measurement across IM and IT , accounting, procurement and other Sector processes that serve clients. Specifically, we found few service standards and service level agreements across business units within the Sector. We also found limited evidence that feedback was solicited from clients to inform process design decisions.

Recommendation

3. The Chief Financial Officer should ensure that a client-centered view of defining, measuring and reporting on performance across procurement, accounting and IT services, is established and sufficient tracking tools exist to support effective reporting. The Chief Financial Officer should also ensure that IM process solutions are strengthened to better support and enable workflows, including transaction processing in the hubs.

5.3.1 Budgeting and Forecasting

To assess the effectiveness of the departmental budgeting and forecasting process, we examined the process, roles and responsibilities for establishing the budgets and forecasts. We also examined the control framework to manage budget re-allocations and report against initial budget estimates.

We found the Sector has a defined budgeting and forecasting process, including documented timelines, milestones and procedures for:

• Allocating funds;
• Establishing budgets;
• Forecasting and tracking actuals;
• Reallocating funds as required;
• Measuring performance; and,
• Reporting on results.

Financial Management Advisors (FMA) work with internal clients to support the budgeting and forecasting process throughout the year. The FMAs take a risk-based approach in allocating time to their respective clients. This risk-based approach considers the complexity of budget expenditures and the budgeting experience of senior managers in the respective sectors and regions. In addition, we understand that the FMA / client assignment process was recently improved to consider file complexity, versus solely budget size. Interviewees also described how FMA morale has improved recently, increasing retention rates and knowledge of clients. These observations are consistent with leading practices for a sound budgeting and forecasting framework.

We also found specific opportunities for improvement in the allocations process. Currently, the funding allocation process relies on an Excel spreadsheet, internally referred to as the "Resource Allocation Management Database". We were informed that the spreadsheet was designed because of an Oracle OASIS system limitation that prevents sufficient agility to capture budget detail. The information stored in this Excel spreadsheet is critical to the Department; however, it is not maintained with the same controls as enterprise systems and databases. While the CIDM system is used to maintain a backup of the Excel tool, CIDM was not designed or intended to house financial systems or databases.

With the volume of manipulations applied to this spreadsheet on an ongoing basis, data integrity is at risk. Specifically, financial systems are normally designed with "key application controls" to enforce data integrity at the point of entry; however, we found a lack of evidence to demonstrate this Excel spreadsheet was designed in such a manner. To mitigate the risk associated with budget data errors, significant manual effort is devoted to maintaining the Excel tool and reconciling outputs. This manual work compensates for data integrity risks, including formula errors (the existence of which was identified during audit fieldwork). The Excel tool is over 60 megabytes in size with several pivot tables, which limits performance and increases the manual effort required for ongoing maintenance.

While we understand the existing need for a more agile funding allocation tool due to the Oracle OASIS system limitations, the current Excel spreadsheet solution represents a potential single point of failure that the Department should address in the transition to SAP with appropriate risk management measures in the interim. Establishing a better tool can also promote process efficiencies and reduce manual effort.

Recommendation

4. The Chief Financial Officer should ensure that a defined solution for the SAP implementation that enables a more secure and efficient budget allocation process than the existing Excel solution is established. In the interim, the Chief Financial Officer should ensure that mitigating measures to protect the integrity of initial budget allocations performed in Excel are established.

5.3.2 Transaction Processing, Monitoring and Reporting

Strong financial management and internal controls reinforce good stewardship of public funds and contribute to better decision making. It is important that transactions are recorded accurately, on a timely basis and in accordance with policy.

The audit team assessed whether appropriate financial coding, recording and monitoring of financial transactions was supporting complete, accurate, relevant and timely reporting that aligns with requirements. In particular, we assessed the monitoring and oversight of transaction processing in the accounting and procurement hubs for stabilized processes (e.g. those medium and low risk transactions that were transferred first to the accounting and procurement hubs). We also performed data analytics to assess duplicate payment risks and examined the existence of key controls under the Financial Administration Act (FAA).

The Sector has a defined account verification framework (AVF), including pre-verification and post-verification processes performed according to transaction risk level. We also observed a monitoring framework in place that examines the execution of key controls under the FAA, financial coding and completeness of supporting documentation. The implementation of hubs is establishing a consistent approach to processing, monitoring and reporting transactions Department-wide.

In addition to the strengths noted above, the audit noted the following control gaps that should be addressed:

• Ineffective control to confirm cash level before payment in accordance with Section 33 (s.33) of the FAA: Accounting Operations relies on the financial system to prevent s.33 execution if cash levels are insufficient; however, as articulated in the Department's 2012-13 Corporate Management Regime document, this control is not automatically performed by the OASIS financial system. Interviewees from Resource Management noted that they are reliant on manual monitoring performed by Accounting Operations; however, we found no evidence that manual monitoring is being performed with the exception of monthly reconciliations to validate that grant authorities have not been exceeded.
  
  We were informed that the cash monitoring control problem is specific to OASIS and will be resolved when the Department moves to SAP. However, this control gap is significant and could result in a payment that exceeds the cash levels in the Department. Moreover, business units were reliant on others to mitigate the risk, yet we found that these views did not reconcile; this observation suggests that communication across business units should be strengthened.
  
  During the reporting phase of the audit, we were informed that management had established a plan to mitigate this risk. Specifically, the Sector implemented regular monitoring as of March 19, 2013 and that the Sector will be revising the Corporate Management Regime to reflect the monitoring changes and to establish the roles and responsibilities surrounding cash monitoring activities. We did not validate the mitigating measures implemented, nor did we examine potential risks associated with cash management in the Department.
• Quality control not being performed on the post-verification process: Medium and low-risk transactions are post-verified on a sample basis in accordance with the AVF. While a checklist exists to enforce consistency in the post-verification process, a quality control over the process and completion of this checklist was not evidenced in all of the samples reviewed. In one of three checklist samples examined, an entire section had not been completed during the post-verification verification. As volumes increase, time pressures increase the risk of incomplete checklists and other errors being made in the post-verification process. While a review of each checklist may not be practical or warranted, a periodic quality control check should be conducted to confirm the integrity of the post-verification process, identify recurring issues and strengthen the control framework.
• Error rates found through post-verification process exceed Departmental tolerance: The post-verification results are reported at Financial Management Committee (FMC) meetings and inform decisions made with respect to delegated authorities. The post-verification process validates the execution of key controls and the existence of supporting documentation for the transaction, in addition to payment and financial coding accuracy.
  
  The most recent post-payment error summary report (second quarter of 2012-13) found a year-to-date exception rate of 45% for salary payments and an exception rate of 11% for non-salary payments, both exceeding the Department's tolerable error rate of 5%. The Headquarters Region had the highest error rate at 85% for salary and 17% for non-salary payments. The stated error rates include those errors considered to be "critical" as well as those considered to be "classification" and "less critical" errors.
  
  The exception rates are significant and are likely a consequence of the transition to hubs and of increased volumes at National Headquarters. At the time of this audit, the post-verification process was months back-logged and results relevant to the hubs (i.e. after October 2012) were not available for review. While interviewees described an expectation that the hubs would reduce the error rate, evidence of a decrease in these significant error rates was not available at the time of the audit due to the monitoring back-log. During a time of significant change, and heightened inherent risk, more timely quality monitoring may be warranted. Given the significance of the error rates prior to hub implementation, a review of the post-verification process may be warranted in the interim to detect any significant issues during a time of transition and to avoid costly mitigating action downstream.
• Bypassing of FNITP system to clear a suspense account: In performing data analytics, we noted one instance in which two transactions associated with the same invoice were entered into the OASIS financial system under two different "Invoice ID" numbers. Upon further analysis, we were informed that this anomaly was due to a payment reversal in the suspense account for a grant or contribution transaction being cleared manually through the OASIS financial system instead of FNITP. We do not consider this anomaly significant, and the payment was not material. Nonetheless, management should validate that the ability to bypass the grants and contribution system (previously FNITP, now GCIMS) has not led to other problems.
• Challenges adapting to clients with more complex procurement portfolios: The hubs have adapted and responded to an accelerated timeline and are working to process significant volumes of procurement and accounting requests. We found that for some procurement portfolios, the payment processes require further refinement. For instance, we understand that the workflow design did not account for SECRET classified procurement documentation, which is applicable for some departmental business units. We also noted financial coding errors in OASIS during a walk-through. We were informed that financial coding errors have been occurring for some of the more complex portfolios, particularly when multiple financial codes are required for a single invoice. We understand that the financial coding risk is heightened by OASIS functionality that allows the user to roll prior financial coding information forward for efficiency in processing the payment. The financial coding errors for the majority of transactions can only be detected during the manual post-verification process.
  
  It will be important for the CFO Sector to work with its clients as the hub transition continues to understand the nature of their procurement portfolios and the associated financial coding structures for accounting transactions. These relationships will both strengthen the Sector's control framework and improve client relationships.

We also found significant IM deficiencies impairing the efficiency of transaction processing. In walking through the end-to-end transaction processing workflow, we found that the same documents are saved multiple times in CIDM through a time-consuming process. In some cases, these same documents are also saved in the financial system.

In addition to multiple copies saved in corporate systems, to save these documents in the financial system, users have designed work-arounds that create additional local copies on hard drives. The IM challenges lead to security gaps with local copies of Protected A and B information stored as well as emails that may contain Protected B information.

Due to the existence of many copies of the same procurement documents, we were unable to establish a well-defined system of record. Multiple hard copies and soft copies can exist. While we understood from interviewees that the imaged copies are considered to be the official records, we were informed that hard copies are maintained and sometimes needed for re-scanning when the images lack sufficient clarity for the post-verifiers to read. This lack of information governance creates both inefficiencies and a control weakness for the Sector.

Recommendation

5. The Chief Financial Officer should ensure that the following issues related to transaction processing, monitoring and reporting are addressed:

• Section 33 cash validation: Ensure the plans for SAP address the existing s.33 cash validation control gap and implement manual monitoring to mitigate interim risk in advance of the SAP implementation.
• Post-verification: Closely monitor transactions with significant error rates, particularly salary transactions, and ensure that a decrease in the post-verification error rates is observed to within the Department's tolerable error rate. In addition, implement a quality control to periodically validate the integrity of the post-verification process.
• Information management solutions: Establish a system of record for procurement documents that can be accessed by all parties that require access (including procurement hubs, accounting hubs and internal clients initiating the transaction).

5.4.1 Accountability

An organization should ensure that timely budgets and forecasts are developed at an appropriate level of detail through a rigorous process, with budgets allocated to responsibility centres in a timely manner. During the planning phase of the audit, the aspect of budget and forecasting identified as being the high risk was the timely distribution of grant and contribution program budgets to regional offices. As a result, the scope of the audit was designed to focus on the Sector's practices as they relate to the timely allocation of the targeted program funds to regional offices.

To assess the Sector's accountability structures and management spans of control, we examined whether organizational structures were documented, widely accessible to employees and up-to-date. We also examined and compared the management spans of control across organizational units within the Sector.

We found that the Sector has a well-defined organizational structure. While accountabilities for strategic initiatives and major projects were not within the scope of this audit, we found that quarterly reports define accountabilities for major objectives and priorities. We also found that the reporting relationships for individuals are housed in a central Human Resources Management System (HRMS), and linked to HR and staffing processes.

The CFO Sector intranet site includes a high-level organizational illustration of the Sector's main business units; however, the high-level organizational structure communicated on the site had not been updated to reflect organizational changes within the Sector. Specifically, the Sector intranet site available to employees was out of date following a significant reorganization in 2012. We found the Government Electronic Directory Services provided a more up-to-date view of the organizational structure within the CFO Sector, yet it is not intended to be used to communicate the Sector's organizational structure.

The audit team had difficulty obtaining detailed organizational charts for the Sector and its branches that demonstrated reporting relationships. Interviewees indicated that the AANDC Electronic Telephone Directory (ETD) is used to understand reporting relationships; however, we found the ETD to be out of date. We understand that an up-to-date organizational chart is difficult to obtain because the charts in HRMS contain sensitive personal information and are not intended to be widely accessed. We were informed that it takes a significant amount of time to print / view an up-to-date organizational chart for the Sector due to limitations in AANDC's HRMS functionality. An updated organization chart was provided to the audit team following the completion of the conduct phase.

The reporting relationships were found to be understood through meetings and less formal methods of communication. While interviews indicated that people believed they understood their own operational accountabilities, a view of the Sector's organizational structure was not easily obtained. Because the official organizational chart in HRMS is not widely accessible, and the intranet site is out of date, employees' understanding of reporting relationships are dependent on people's concerted efforts to articulate the organizational structure through meetings and other communication mechanisms.

The audit observations suggest that the communication needs of the Sector are not supported with effective tools, creating challenges for employees and leading to inefficiencies. An improved intranet site and user-friendly organizational chart would enable greater efficiencies and reduce inconsistent information, supporting management's efforts to communicate change through meetings, emails and documentation.

IMB has a significantly greater number of employees to manage than the Sector's other organizational units, even after infrastructural resources were moved to Shared Services Canada (SSC). Specifically, IMB has 50% more positions than Corporate Accounting and Material Management (CAMM), the next largest organizational unit reporting to the CFO. There are six directors in IMB, which is double the amount in any other organizational unit, with a broad mandate. See Figure 1 in Section 1.3 for a diagram of the Sector's organizational structure.

While the spans of control may be expected to be wider in IMB due to the different operating model for IT service delivery, we could not confirm whether the spans of control within IMB are appropriate, especially with the number of strategic initiatives and priorities demanding IMB resources. Given upcoming transformation initiatives and increasing complexity of IM as data volumes increase, IMB's role has become more strategic for the Department and is critical to enabling success in the ongoing consolidations and conversions.

Recommendation

6. The Chief Financial Officer should ensure that the CFO intranet site is strengthened and maintained or that outdated, inconsistent information is removed to avoid confusion. The Chief Financial Officer should also ensure that a documented and widely accessible organizational structure is established to ensure accountability structures are communicated, accessible and understood. Finally, the Chief Financial Officer should ensure that the management spans of control within IMB are reviewed and should confirm that they are sufficient to allow the Branch to meet AANDC's strategic needs and demands. Any decisions should take into consideration the evolving role of Shared Services Canada.