Audit of Access to Information and Privacy (ATIP) Management

Background

An Audit of Access to Information and Privacy (ATIP) Management was included in Aboriginal Affairs and Northern Development Canada's ("AANDC's" or the "Department's") 2014-2015 to 2016-2017 Risk-Based Audit Plan, approved by the Deputy Minister on February 6, 2014. This audit was identified as a priority as there has not been a recent audit of this area and because of the inherent complexity of ATIP management due to a number of factors including:

• Legislative requirements;
• Number of stakeholders in the process;
• Unpredictability of requests in both complexity and volume; and
• Visibility and potential impact on the Department.

The legislative requirements applicable to ATIP are contained within the Access to Information (ATI) Act and thePrivacy Act. Both have been in place in Canada since 1983 and apply to all government institutions listed in Schedule I of the respective Acts. The purpose of the ATI Act is to provide a right of access to information under the control of the Government of Canada, based on the principles that government information should be available to the public and necessary exceptions to the right of access should be limited and specific. In addition, the Act establishes that decisions on the disclosure of information should be reviewed independently of government by the Office of the Information Commissioner of Canada (OIC).The Privacy Actwas enacted to extend the laws that protect the privacy of individuals with respect to the personal information held and controlled by the Government of Canada, and to provide a right of access to that information.

The management of AANDC's ATIP requests is carried out by the Department's ATIP Directorate, which falls under the mandate of the Corporate Secretariat. The ATIP Director reports to the Department's Corporate Secretary, who in turns reports to the Deputy Minister. The ATIP Directorate has corporate responsibility for providing a diverse range of support and services, including responses to access to information and privacy requests. The Directorate establishes policies, procedures and practices related to the departmental compliance with the Access to Information Act, and the Privacy Act. All requests pursuant to the Acts are processed through the Directorate, using input gathered from the various applicable departmental Sectors and Regions. Each Sector and Region has a designated an ATIP Liaison Officer (ALO) who works directly with the ATIP Directorate. That individual is responsible to coordinate the retrieval, review and submission of the required information back to the ATIP Directorate.

The Privacy Policy Unit within the ATIP Directorate provides advice and guidance to the Department on a number of privacy-related topics such as conducting Privacy Impact Assessments and educating and promoting awareness of privacy and privacy-related issues throughout the Department.

Audit Objective and Scope

The objective of the audit was to assess the adequacy of the governance, risk management, and control framework in place to support ATIP management in the Department and the extent to which they support compliance with legislative, Treasury Board and departmental requirements. In addition, the objective of the audit was to provide an assessment of the operating effectiveness of controls in place to manage the processing and continuous improvement of ATIP requests.

The scope of the audit included the activities under the Department's responsibility that are related to the management of ATIP. Specifically, the audit assessed the adequacy and operating effectiveness of the governance, risk management and control framework in place to support the management of ATIP requests.

Consistent with the audit objective, the scope of this audit considered the following four assertions:

1. The adequacy of governance, risk management and controls framework for the management of ATIP requests to support compliance with legislative, Treasury Board and departmental requirements and to mitigate the risk that excluded or exempted information is disclosed.
2. The operating effectiveness of governance, risk management and control framework for the management of ATIP requests in place to support compliance with legislative, Treasury Board and departmental requirements and to mitigate the risk of that excluded or exempted information is disclosed.
3. The adequacy of the governance, risk management and control framework for the protection of personal information to support compliance with Treasury Board and departmental requirements and to mitigate the risk of privacy breaches.
4. The adequacy of procedures in place with a view to supporting the efficient processing of ATIP requests.

The audit did not include an assessment of:

• the accuracy or completeness of completed ATIP requests; and
• the responsibilities for the protection of personal information that fall outside of the scope of the ATIP Directorate's responsibilities.

Statement of Conformance

The Audit of ATIP Management conforms with the Internal Auditing Standards for the Government of Canada, as supported by the results of the quality assurance and improvement program.

Observations

Prior to 2011-12, the Department had been cited by the Office of the Information Commissioner for having substantial deficiencies in its management of ATIP and had regularly failed to meet its statutory obligations. In 2011-12, AANDC focused efforts on improving the ATIP management process. As described in this report, these efforts have had a positive impact on the Department's ability to meet its statutory obligations in recent years and the deficiencies raised by the OIC have been largely addressed.

With the ATIP Directorate's recent focus on ensuring compliance with legislation and policy requirements, there has been limited work on identifying and addressing opportunities to drive efficiencies within management of ATIP requests across the entire Department. While the achievements of the Directorate should be commended, it is also important to recognize that the Directorate is now well positioned to move beyond the focus of compliance to one of maintaining compliance while driving efficiencies.

Conclusion

The audit found that, overall, the governance, risk management, and control framework in place to support the compliance of ATIP management with legislative, Treasury Board and departmental requirements are adequate and operating effectively. The audit did, however, identify opportunities for improvement in the following areas: Policies and Procedures; Training and Guidance; and, Efficiency and Continuous Improvement.

Recommendations

The audit team identified areas where management control practices and processes could be improved, resulting in the following three recommendations:

1. The Corporate Secretary should undertake a thorough review of ATIP policies and procedures with a view to identifying and addressing any gaps, inconsistencies or other improvement opportunities within the materials. In addition to the current practice of addressing issues on an as-needed basis, a schedule should also be developed which would require an appropriately periodic review of policies and procedures.
2. The Corporate Secretary should review, and update as applicable, the training programs offered by the ATIP Directorate. This would include:
   • Enhancing the Sectors' and Regions' access to hands-on training and guidance. In developing these enhancements, it is recommended that Regional/Sectoral representatives are solicited for their input.
   • Conducting an assessment regarding the sufficiency of the privacy training program relative to the Directorate's responsibility to educate and promoting awareness of privacy and privacy-related issues throughout the Department.
3. The Corporate Secretary should clarify expectations, roles and responsibilities for driving efficiencies within ATIP Management, and establish related objectives and practices designed to improve process efficiency. Practices could include facilitating the sharing of best practices between Regions and Sectors; reporting on the ATIP Directorate's performance against internal service standards; and, tracking the Department-wide level of effort required to process requests in order to monitor and identify improvements to efficiency.

Management Response

Management is in agreement with the findings, has accepted the recommendations included in the report, and has developed a management action plan to address them. The management action plan has been integrated in this report.

1.1 Summary of Legislation

1.2 Access to Information and Privacy Requests in the Federal Government

In 2012-13, there were 110,500^{Footnote 1} ATIP Requests across the Federal Government. Roughly half of these requests related to ATI and half to Access to Privacy (ATP).

During the same year, AANDC received 793 ATIP requests, 648 (81.7%) of which related to information requests. The table below, developed based on information provided in departmental Reports to Parliament, provides statistics for a selection of federal departments, including AANDC. The statistics demonstrate the variability in number of requests and number of pages reviewed per request across a sample of federal departments. It also demonstrates that, while AANDC's volume of ATIP requests for 2012-13 was very similar to Industry Canada and Human Resources and Skills Development Canada (HRSDC), the Department's deemed refusal rate stands out insofar as it was reported as 0%. It also demonstrates that the number of Full Time Equivalents (FTEs) within AANDC's ATIP Directorate is within the range of peer organizations based on the volume of requests. Finally, it shows that the Department experienced a relatively higher ratio of complaints to requests than the other organizations.

1.3 Overview of the ATIP Request Process

There are up to 11 steps associated with processing an ATIP request. The Department's ATIP Directorate, along with Sectors and Regions, has responsibility to complete these steps. In order to meet the 30 day response time required under the legislation, the ATIP Directorate has developed timelines and a critical path for the completion of these steps as depicted in the following graphic:

Text alternative for the ATIP Request Process

This graphic depicts the ATIP request process and timelines. Steps 1 to 3 of the ATIP Request Process are managed by the ATIP Directorate and begin on Day 1 of the ATIP request. The first step involves receipt of the ATIP request. During the second step, clarification is obtained (if necessary), sensitivity and possibility of media interest is identified, and the request appears on AANDC's Weekly ATIP Report.

Step 4 involves action on the part of both the Sector/Region and the ATIP Directorate. The Sector/Region completes three specific tasks during Step 4. First, the Sector/Region responds with an Impact Statement signed by the Associate Deputy Minister (ADM). The Sector/Region has up to 7 calendar days to send a copy of this statement to Communications. Second, the Sector/Region must identify the need for media lines and develop a draft with Communications. Third, any search/retrieval issues that are identified by Programs are discussed with the ATIP Directorate. The ATIP Directorate, on the other hand, sends a reminder to the ATIP Liaison Officer (ALO) on Day 5 of the ATIP request. On Day 7, the ATIP Directorate sends another reminder to the ATIP Liaison Officer ALO On Day 8, the ATIP Directorate follows-up with the ADM if necessary.

Steps 5 to 7 are managed by the ATIP Directorate and take place between Day 8 and Day 23 of the ATIP request. During Step 5, extensions are applied where necessary. During Step 6, consultations are undertaken (if necessary), and records are treated. During Step 7, the ATIP Directorate meets with the ADM if exemptions cannot be applied as proposed.

Steps 8 to 11 are considered "compliance critical" and take place between Day 23 and Day 30 (if an extension is justified, an alternative start-date for Step 8 is 7 days before the ATIP release date). During Step 8, the Deputy Minister's Office (DMO) conducts a review meeting on AANDC's Weekly ATIP Report. Sensitive impact statements are reviewed and final media lines are tabled at this meeting. Step 9 occurs on Day 26. During this step, the file is submitted to the ATIP Coordinator two days before the deadline, following an ATIP Manager review. Step 10 occurs on Day 28 and consists of two reviews: one by the DMO and one by the ATIP Coordinator. The ATIP Coordinator then signs-off on the completed file. The last step, Step 11, occurs on Day 30 and involves the response to the ATIP requester.

As depicted above, upon receipt of an ATIP request, the ATIP Directorate completes an assessment of the request and identifies which Regions or Sectors are responsible to provide the requested information. The ATIP Liaison Officer(s) ("ALO(s)") from the responsible Region and/or Sector reviews the request and forwards it to the appropriate individual(s) within the Region/Sector to compile the requested information.

Each responsible Region/Sector completes an Impact Statement, which is signed by the responsible senior manager (Senior Assistant Deputy Minister, Assistant Deputy Minister, Regional Director General, etc), and provides this to the ATIP Directorate. The Impact Statement identifies key information about the request including information considered sensitive as well as information that may be considered exempted or excluded. Exemptions are intended to protect information relating to a particular public or private interest such as confidential information provided by a third party or information that may be injurious to the defence of Canada. Certain information is specifically excluded from the scope of the Act and includes such information as Cabinet confidences and information available for purchase by the public.

While requests are generally required to be completed and released within 30 days of receipt by the Department, the legislation includes time extensions, which can be applied under various scenarios. For example, an extension of an additional 60 days can be applied if the Department needs to consult with other government departments or third parties, such as a First Nation, in order to complete the request.

1.4 Role of the ATIP Directorate

The management of AANDC's ATIP requests is carried out by the Department's ATIP Directorate, which falls under the mandate of the Corporate Secretariat. The ATIP Director reports to the Department's Corporate Secretary, who in turns reports to the Deputy Minister. The ATIP Directorate has corporate responsibility for providing a diverse range of support and services, including responses to access to information and privacy requests.

In addition to the Director, there are approximately 21 FTEs within the ATIP Directorate, including consultants and staffing agency personnel. Approximately 15 FTEs are responsible for the processing of ATIP requests, and approximately six FTEs are allocated to the Privacy Policy Unit. The ATIP Directorate establishes policies, procedures and practices related to the departmental compliance with the Access to Information Act and the Privacy Act. All requests pursuant to the Acts are processed through the ATIP Directorate, using input gathered from the various applicable departmental Sectors and Regions. As such, while the ATIP Directorate is responsible for coordinating responses to ATIP requests, all departmental senior management play a role in ensuring available requested documentation is provided to the ATIP Directorate in a timely manner.

The Privacy Policy Unit within the ATIP Directorate provides advice and guidance to the Department on a number of privacy-related topics such as conducting Privacy Impact Assessments and educating and promoting awareness of privacy and privacy-related issues throughout the Department.

1.5 Role of Regions and Sectors

Each Sector and Region within the Department has a role in processing ATIP requests that involve records within their respective organizations. As noted above, once they receive a call-out for records from the ATIP Directorate, it is the Region's/Sector's responsibility to identify and compile the appropriate records as well as obtain the ADM's sign-off on the implications of the request. They are also required to work with the Department's Communications Branch on any sensitive items where media lines may be required. Each Sector and Region has designated an ATIP Liaison Officer" CGE ALO who works directly with the ATIP Directorate. That individual is responsible to coordinate the retrieval, review and submission of the required information back to the ATIP Directorate.

1.6 Context

Prior to 2011-12, the Department had been cited by the Office of the Information Commissioner for having substantial deficiencies in its management of ATIP as it had failed to meet its statutory obligations. In 2011-12, AANDC focused efforts on improving the ATIP management process. Along with changes in staff and level of leadership within the ATIP Directorate, the Department updated and improved its ATIP policies and procedures, training and oversight practices. Table A below indicates the improvements realized from 2010-11 to 2013-14. This includes a significant rise in the number of requests being processed by roughly the same number of FTEs within the ATIP Directorate. Of note is the improvement in the proportion of requests that are completed within the initial 30 day time limit, and particularly the continual increase of requests completed within the first 15 days (well before the initial 30 day deadline). As described later in this report, the positive impact of these changes in the Department's ability to meet its statutory obligations is also supported by the results of this audit.

TABLE A:

2.1 Audit Objective

The objective of the audit was to assess the adequacy of the governance, risk management, and control framework in place to support ATIP management in the Department and the extent to which they support compliance with legislative, Treasury Board and departmental requirements. In addition, the objective of the audit was to provide an assessment of the operating effectiveness of controls in place to manage the processing and continuous improvement of ATIP requests.

2.2 Audit Scope

The scope of the audit included the activities under the Department’s responsibility that are related to the management of ATIP. Specifically, the audit assessed the adequacy and operating effectiveness of the governance, risk management and control framework in place to support the management of ATIP requests.

Consistent with the audit objective, the scope of this audit considered the following four assertions:

1. The adequacy of governance, risk management and controls framework for the management of ATIP requests to support compliance with legislative, Treasury Board and departmental requirements and to mitigate the risk that excluded or exempted information is disclosed.
2. The operating effectiveness of governance, risk management and control framework for the management of ATIP requests, in place to support compliance with legislative, Treasury Board and departmental requirements and to mitigate the risk of that excluded or exempted information is disclosed.
3. The adequacy of the governance, risk management and control framework for the protection of personal information to support compliance with Treasury Board and departmental requirements and to mitigate the risk of privacy breaches.
4. The adequacy of procedures in place with a view to supporting the efficient processing of ATIP requests.

The Audit Period of coverage was April 1, 2012 to March 31, 2014.

The audit did not include an assessment of:

• the accuracy or completeness of completed ATIP requests; and
• the responsibilities for the protection of personal information that fall outside of the scope of the ATIP Directorate’s responsibilities.

5.1 Governance and Oversight Practices

The audit team expected the Department to have established regular monitoring and oversight activities related to the management of ATIP requests. These activities should be supported by accurate and timely reporting, and serve to promote the identification, assessment and management of risks associated with ATIP requests.

The audit evidence indicated that weekly ATIP meetings are led by the Corporate Secretary and the ATIP Director with the Associate Deputy Minister. These meetings serve as the primary forum for senior level monitoring of the ATIP request management process. Additional attendees may include representatives from the Deputy Minister's Office, the Communications Branch, and the Litigation Management and Resolution Branch. During these meetings, ATIP activities and the status of requests are discussed with the ATIP Director. While every new request is discussed, particular attention is focused on requests involving potentially sensitive or otherwise significant information. The review of ATIP activities and requests that occurs at these meetings is an important practice in the management of ATIP-related risks and an effective mechanism to help ensure that appropriate internal stakeholders are notified and engaged in a timely fashion in cases where potentially sensitive information is involved.

In terms of reporting, the audit identified that summary reports are provided for purposes of discussion at the weekly meetings. These reports provide a synopsis of ATIP requests including changes since the previous weekly report (e.g.  summaries of all new requests, completed requests, and extensions, etc). In addition, the audit noted that the ATIP function feeds the Corporate Secretariat annual Business Plan, and reports on these elements in the Department's Quarterly Reports. Finally, the ATIP Directorate is required to produce detailed annual reports to Parliament outlining the performance of activities related to complying with the obligations set forth in the Access to Information Act and the Privacy Act.

Based on the observed evidence, the audit team found the governance and oversight mechanisms in place to be adequate and effective in the management of the ATIP function.

5.2 Departmental ATIP Policies and Procedures

5.3 Training and Support

The audit team expected to find that training programs were in place to ensure key stakeholders understand and acknowledge their roles and responsibilities related to ATIP and the protection of personal information; and that Sectors/Regions are provided with access to assistance in the interpretation or discharge of their responsibilities should the need arise.

The ATIP Directorate has developed an ATIP training session, ATIP 101, which outlines the legislative requirements and responsibilities for the management of ATIP requests. This training material is available on the departmental intranet and, recently, additional steps have been taken to further formalize this training. Specifically, ATIP 101 training is now managed by the Department's Learning and Development Directorate and is part of the Department's "Recommended Training". Having the training sessions managed through the Learning and Development Directorate has assisted with increasing the accessibility of training sessions and the accountability of participants for completing scheduled training. Further, classifying ATIP 101 training as "recommended" helps to raise the profile and demand for this training across AANDC. The table below provides a summary of ATIP training delivered in 2013-14:

Although Sectors and Regions provided the audit team with positive feedback on the current training, many interviewees also indicated that expanding the practical component of the training would be beneficial. This would involve more direction on how to effectively discharge ATIP responsibilities as they exist at the Sectoral/Regional level. Such responsibilities include how to: approach a search for records; manage/coordinate requests; and, manage ATIP timelines, etc. This was identified as an opportunity to better support the consistency of practices across the Department and to promote identification of process improvements. As such, to the extent that the current training program does not adequately support the practical responsibilities within Sectors/Regions, there is an increased risk that practices will not reflect an optimal level of consistency or that process improvement opportunities will not be highlighted.

In addition to the training developed for the management of ATIP requests, the Directorate has developed a training session to promote the awareness and responsibilities around the protection of personal information and the requirements if a breach of personal information should occur. While a training program has been established for this purpose, and is generally offered on a "by request" basis, this training has not been delivered in the recent past. Given the ATIP Directorate's responsibility to educate and promote awareness of privacy and privacy-related issues throughout the Department, there is possibility that an ad hoc approach to privacy-related training may not be sufficient to address this responsibility with the result of an increased risk that private information may not be protected.

In terms of support, audit interviews with Sectors and Regions indicated positive feedback regarding support provided by the ATIP Directorate. A majority stated they were comfortable to contact the ATIP Director for assistance when needed. In addition, interviewees also indicated that if a training need arose and there was not a scheduled ATIP training session, the ATIP Directorate would provide one-on-one training.

The audit found that training and support offered to departmental stakeholders generally met the requirements; however, there are opportunities to expand the practical component of ATIP 101 training and to confirm the sufficiency of privacy-related training in light of the ATIP Directorate's responsibility for privacy awareness.

5.4 Efficiency and Continuous Improvement

AANDC, in common with many federal government departments, must continually work to fulfill its mandate while supporting the government's commitment to cost-reduction, cost-containment and ensuring value for money. With the ATIP Directorate's recent focus on ensuring compliance with legislation and policy requirements, there has been limited focus identifying and addressing opportunities to drive efficiencies within management of ATIP requests across the entire Department. While the achievements of the Directorate should be commended, it is also important to recognize that the Directorate is now well positioned to move beyond the focus of compliance to one of maintaining compliance while driving efficiencie