Audit of Internal Controls Over Financial Reporting

CFO Attestation for Cabinet Submissions

In January 2014, TB introduced a Guideline on Chief Financial Officer (CFO) Attestation for Cabinet Submissions. This guideline identifies the six assertions of a CFO and provides guidance on CFO attestation conclusions and their communication. Under this new guidance and based on the criteria developed to support each assertion, the CFO is required to conduct a robust due diligence review prior to issuing a final assertion through a formal Attestation Letter that is to accompany all Cabinet and TB submissions. While the CFO attestation requirements are forward looking, some of the financial analyses contained in future cabinet submissions will likely use historical data from financial statements, the accuracy of which are supported by existing financial controls.

5.1.1 Roles and responsibilities

There are formally established roles and responsibilities outlined in AANDC's Internal Control Management Framework and the Operational Effectiveness Testing Approach and Methodology. These are the key framework documents that form the basis not only for the implementation of ICFR at AANDC but also for its overall governance and oversight. Roles and responsibilities, as they related to ICFR, are defined for the Deputy Minister, CFO, Director General (DG) of Corporate Accounting and Materiel Management (CAMM), Director of Corporate Accounting and Reporting Directorate (CARD), senior management of programs and the Internal Controls Unit.

• Deputy Minister - Assumes overall responsibility and leadership for the measures taken to maintain an effective system of internal controls. This role is primarily performed through participation on the Department's Audit Committee and Financial Management Committee.
• CFO - Reports directly to the Deputy Minister and provides oversight for the coordination, coherence and focus on the design and maintenance of an effective and integrated system of internal controls, including its annual assessment. Additionally, the CFO provides the approval of action plans to remediate weaknesses in the system of internal controls.
• DG CAMM - Reports directly to the CFO on status, reliability and weaknesses in the system of internal controls and reviews progress and provides instruction to the Director, Corporate Accounting and Reporting, and the Internal Controls Unit on addressing weaknesses to the system of ICFR.
• Director, CARD - Reports directly to the CFO and DG CAMM on the status, reliability and weaknesses in the system of internal controls; provides instruction to the Internal Controls Unit on developing and implementing the approach, methodology and ongoing monitoring for ICFR; and, oversees the development of the draft annex to the Statement of Management Responsibility including Internal Controls over Financial Reporting for the DG CAMM and the CFO.
• Senior management of programs - Provides documentation and support as needed to complete operational effectiveness testing and implement recommendations and action plans approved by the CFO in their areas of responsibility.
• Internal Controls Unit - Reports directly to the CFO, DG CAMM and Director, Corporate Accounting and Reporting Directorate on the status, reliability and weaknesses in the system of internal controls; develops and implements the approach, methodology and ongoing monitoring for ICFR; develops and maintains all documentation related to the design and operational effectiveness for ICFR and develops the draft annex to the Statement of Management responsibility including Internal Controls over Financial Reporting for the DG CAMM and the CFO.

While the framework clearly outlines roles and responsibilities and these roles and responsibilities are well understood, responsibilities regarding the identification of changes to processes and controls could be better defined in the framework to enable more timely updating of processes and controls. Refer to Section 5.4.1 for more information on identifying changes to processes and controls and updating documentation.

5.1.2 Reporting progress

Reporting of progress occurs formally and informally between key individuals with responsibilities for the implementation and oversight of ICFR as well as the two main oversight bodies, the Department's Audit Committee and Financial Management Committee (FMC).

Formally, ICFR progress is reported to the Audit Committee and the FMC, and, as a member of both committees, to the Deputy Minister. As per our review, ICFR progress has been reported in all Audit Committee meetings and select FMC meetings over the past year due to the concerns identified by the OAG in its Fall 2013 Follow-up Audit on ICFR. Progress is reported using the Internal Control Action Plan, which outlines the status of the action plan, what has been achieved, and the next steps. Table 1 below demonstrates the Internal Control Action Plan work plan, which was presented to the Audit Committee and the FMC in April 2014, and outlines the ICFR controls/processes, their current status and for those controls/processes not yet completed, the expected period of completion. Prior to Audit Committee and the FMC, the DG CAMM and CFO are updated on the progress of ICFR work by the Internal Controls Unit using the Internal Control Action Plan. The DG CAMM and CFO are able to provide insight, recommendation and advice based on that plan.

Table 1 - Example Internal Control Action Plan for April 2014

Updates are produced upon completion of a process assessment, an ad-hoc status update request, or a regular bi-lateral meeting.

Informally, additional progress reporting and oversight at the DG and Director levels occurs informally through regular bi-lateral discussions between the Director and DG CAMM. These bi-lateral discussions occur on a monthly basis, with more frequent discussions occurring around key project milestones.

While progress against ICFR objectives is being reported formally and informally to Audit Committee, FMC and senior management, the frequency at which progress is reported is not formally documented within the framework.

Finding

While a governance framework is in place and progress against the Internal Control Action Plan is effectively communicated, no formal documentation exists to outline the frequency at which progress is to be reported to the Audit Committee, the FMC, and the CFO. Additionally no formal process is in place to support the timely identification of changes and updates to processes and controls. For example, there has been no identification and assessment of how the transition to SAP or the new CFO Attestation for Cabinet Submissions will impact processes and controls.

Recommendation:

1. The Chief Financial Officer should formalize and communicate protocols for both reporting progress to stakeholders and the reporting of process and control changes to the Internal Controls Unit.

5.2.1 Completeness and accuracy of documentation

Completed design assessments are comprised of three documents: (i) a control matrix; (ii) a process flowchart; and, (iii) a process narrative. The control matrix identifies the risks, controls, frequency of control operation, relevant assertion and other control details (detect/prevent, automated/manual, control owner, etc.). The process flowchart is a visual depiction of the process broken down by step, location of control and control owner. The flowchart is accompanied by a process narrative which is a written description to provide added detail and context to the process / controls.

Once the process is documented walkthroughs are performed. Walkthroughs consist of following a process from start to finish using a transaction. Walkthroughs are an important component of the design assessment as it provides the Internal Controls Unit the ability to validate the accuracy of the process documentation as well as assess the design of the control, and evidence to support its operation.

The purpose of the design assessment is to determine if the control is designed effectively (appropriate information, individual performing the control, frequency of control, nature of control) to mitigate the risk (identified in the control matrix).

Once the design assessment is completed and any identified design weaknesses are remediated and in operation for an appropriate period of time (depending on the frequency of control), operational effectiveness testing can be performed. Typically, prior to performing operational effectiveness testing another walkthrough would be performed to ensure the remediation has taken place and to validate the accuracy of the process against existing process documentation and where required, update the process documentation.

During the audit, we reviewed the design and operating effectiveness assessment and related documentation completed by Internal Controls Unit, and we performed walkthroughs to validate the accuracy and completeness of process documentation, including the identification of Headquarters/Regions, Business Management Units, and hubs. With the exception of recent organizational and system changes, the assessment and documentation of processes that were completed by the Internal Controls Unit in the 2013-14 fiscal year appears reasonable. Current process documentation indicates OASIS as the financial system; however, as of April 1, 2014, this was no longer accurate as SAP was implemented. This inconsistency was the result of a financial system change that has not yet been assessed for its impacts on processes/controls. This inconsistency and the timely identification and assessment of changes to processes/control would be addressed through implementation of recommendation 1 described above.

5.2.2 Validation of operating effectiveness approach and findings

Through the re-performance of operating effectiveness testing for those process assessments completed by the Internal Controls Unit in the 2013-14 fiscal year, it was observed that testing was performed in accordance with AANDC's documented methodology. Opportunity exists to further strengthen the methodology/approach to better align with leading practice around ICFR, as follows:

Entity level controls - The Internal Controls Unit's entity level control approach and methodology is based on the framework developed by COSO in developing their entity level approach. The COSO Framework is structured around five components of internal control: Control Environment; Risk Assessment; Control Activities; Information and Communication; and, Monitoring Activities. Within each component, there are between two and seven sub-components. It was observed that the Internal Controls Unit assessed the sub-components based on their relevance to ICFR-related risks. This resulted in 10 of the 21 sub-components (and 20 of 36 key controls) being identified as high risk and subsequently assessed for design and operating effectiveness. While risk assessments can be an important component of identifying key controls at the entity level, the Internal Controls Unit did not use a risk assessment to rank control, but instead to rank sub-components. The result is that 11 sub-components and 16 key controls have not yet been tested for design and operating effectiveness.

While the PIC does not specifically outline how entity level controls are to be identified and assessed, in the first year of assessment, all key controls and ultimately, all sub-components, should be assessed for design and operating effectiveness. This would also enable the Internal Controls Unit to more accurately perform a risk assessment in the following years to determine the frequency at which key controls are to be tested and represents leading practice of others implementing the Policy on Internal Controls.

Guaranteed Loan / Revenue Management - The Internal Controls Unit developed an Operational Effectiveness Testing Approach and Methodology with the help of an independent contractor. This Approach and Methodology was consistently applied but, in doing so, two types of variances were identified that resulted in inconsistencies in findings.

1. Internal Controls Unit - If a control is rated as having a medium or low risk level and there are 0 < 5% exceptions, no further testing is required.
   
   Leading Practice - For a control to be operating effectively, it should operate without exception. If there is one exception and there is a reasonable explanation, testing should be expanded. If no further exceptions are identified, the control can pass; however, if another exception is identified, the control fails and it is concluded not to be operating effectively. The design of the control itself should dictate whether or not it is considered to be key (i.e. expected to work consistently without exception).
2. Internal Controls Unit - If a control exception is identified but there is a compensating control in place, and if the compensating control is operating effectively, both controls can be concluded to be operating effectively.
   
   Leading Practice - If a control exception is identified and a compensating control is identified and assessed separately, only the compensating control can be concluded to be operating effectively. Consideration must then be given to the impact of the ineffective control and whether its failure, despite the presence of a compensating control, increases the overall risk to the process.

Environmental Liabilities - This process was assessed by an external contractor and, at the time of the conduct phase, the Internal Controls Unit was not in possession of the supporting documentation to substantiate the findings of the external contractor. The supporting documentation was provided to the audit team following the completion of audit fieldwork. As part of the audit, we reviewed the process documentation, testing documentation, and reporting and it was observed that, while the independent contractor followed most of AANDC's methodology, unlike the processes assessed by the Internal Controls Unit, there were no conclusions on the operating effectiveness of the individual controls tested. This could be the result of either:

1. The Internal Controls Unit not appropriately ensuring that the external contractor followed AANDC's methodology, including providing a conclusion on the operating effectiveness of the controls; or,
2. The external contractor did not provide conclusions over the effectiveness of each identified key control. Equally, the Internal Control Unit itself had not concluded over the effectiveness of the individual controls and therefore the assessment remains incomplete.

Finding:

While the entity level controls have been identified as "completed as planned" by the Internal Controls Unit, the plan consisted of performing operating effectiveness testing on high risk controls, leaving medium and low risk controls un-tested. The result is that not all entity level controls have been tested as would be expected for the first assessment. Additionally, as no conclusions over the effectiveness of each identified key controls have been provided the assessment remains incomplete.

Recommendation:

2. The Chief Financial Officer should ensure that a complete assessment, including conclusions over the effectiveness of all identified key controls, is performed by March 31, 2015, in order to meet AANDC's commitments and to better inform a risk-based approach for the on-going monitoring phase. Specifically, individual control effectiveness conclusions on key controls identified in the environmental liabilities process should be clearly documented and reviewed for completeness by the Internal Controls Unit. Additionally, leading practice for entity level control assessments would include the testing of all identified key controls at least once before taking a risk-based approach to testing in future years.

Finding:

When leveraging the work of external consultants for areas such as environmental liabilities, the Internal Controls Unit has not mandated the same approach to testing and documentation as they employ internally. This includes retention and ownership of working papers and the provision of testing conclusions.

Recommendation:

3. The Chief Financial Officer should provide guidance on the management of performance and reporting by external consultants retained to support AANDC's Internal Controls over Financial Reporting framework, to ensure alignment with the Internals Control Unit's Operating Effectiveness Approach and Methodology.

5.2.3 Methodology and application

The PIC outlines the responsibilities of Deputy Heads for monitoring and reporting on their department's/agency's system of internal controls. In reviewing AANDC's methodology documents, the Whitepaper on the Status of INAC AFS Projects (Design Assessment), the Operational Effectiveness Testing Approach and Methodology (Operational Effectiveness), and the Internal Controls Management Framework, it was observed that these documents address the broad requirements outlined in the PIC and therefore, AANDC's methodology for ICFR aligns with the PIC.

Furthermore, the methodology has been consistently applied by the Internal Controls Unit throughout the design and operating effectiveness testing, with the exception of missing control conclusions for Environmental Liabilities.

5.2.4 Third party service providers

Service providers external to AANDC have the potential to impact/inform AANDC's financial statements as a result of reliance on information provided by those parties. These service providers include other government departments (OGDs) and external (to government) third party service providers that provide advice, valuations and opinions.

AANDC relies on OGD and external third party service providers to provide operational services (i.e. payroll), advice, valuations and other sources of information. As a result of this reliance, there is an expectation that AANDC has a robust process in place to identify and assess the impact(s) of third party service providers on the financial statements.

While an informal process currently exists to identify OGDs that are providing services to AANDC, there is no process in place to assess the related risk and impacts of all third parties (including those external to government) as well as the service providers' own internal assessments of internal control operation.

Finding:

There is no formal process in place to identify and assess how third party service providers (including those external to the government) impact departmental reporting requirements. This may result in inappropriate reliance on third party information and/or lack of understanding around the controls governing the generation and use of that information.

Recommendation:

4. The Chief Financial Officer should ensure that a process is developed and implemented to allow the Internal Controls Unit to identify and assess third party service providers' impact on departmental financial reporting (i.e. valuations performed by external third parties experts used to inform accounting judgements such as contaminated site liabilities). Additionally, while an informal process is in place to identify other government departments (OGDs) providing third party services, assurance on the effectiveness of internal controls being performed by OGDs should be obtained by AANDC through review of publically available statements of management responsibility and/or third party service auditor reports for private organizations.

5.3.1 System Changes

AANDC implemented SAP as the new financial system of record, effective April 1, 2014. This audit examined Internal Controls Unit's process to assess how the implementation of SAP was anticipated to impact existing processes and controls. The Internal Controls Unit noted that no process is currently in place to identify the changes, to assess the impacts on processes/controls and to perform any follow-up testing as required/needed to reflect the change in the core financial system.

The Tangible Capital Asset process that is undergoing operational effectiveness testing in the 2014-15 fiscal year has not being updated to reflect the impact of SAP controls. The Internal Controls Unit has elected to test the operational effectiveness of Tangible Capital Assets based on controls within the previous financial system, OASIS, due to the timing of SAP implementation. This results in both design and operational effectiveness testing which is not relevant to the current process (i.e. using SAP).

The need to create a course of action for updating of significant processes for the impact of SAP is included in Recommendation #1 in section 5.1.2 above. The process by which significant changes in the control environment, such as SAP, are identified and updated in a timely manner should be revisited by the CFO and the Internal Controls Unit.

5.3.2 Progress to actuals to completion deadline

In reviewing processes completed by the Internal Controls Unit in the 2013-14 fiscal year, progress reported to the Audit Committee and the FMC in April 2014 through the formal Internal Control Action Plan, and to senior management through informal and formal updates, was observed to be accurate. The audit observed, however, that entity level controls, which have been reported as "Completed" or Completed as Planned", have been tested at a level inconsistent with leading practice for ICFR evaluations (see Section 5.2.2 - Entity level controls).

There are two processes that are identified to be completed in the 2014-15 fiscal year, Tangible Capital Assets and the On-going Monitoring Plan.

Tangible Capital Assets - Based on a review of the documentation completed to date, the work remaining to be completed, the project schedule, and the resources allocated to the process, it appears reasonable that the operating effectiveness testing and remediation plan can be completed by March 31, 2015. However, while the plan to complete appears reasonable, it should be noted that if challenges arise during the testing phase, if process/control owners challenge the findings and recommendations, or if the Internal Controls Unit temporarily or permanently loses resources, the Internal Controls Unit may have difficulties completing the Tangible Capital Asset process, as planned.

On-going monitoring - After reviewing the approved On-going Monitoring Framework, the project schedule, and resources allocated to the application of the Framework, the On-going Monitoring Plan may not be completed for the end of the 2014-15 fiscal year, as planned. Completion of the On-going Monitoring Plan may be challenging due to the limited capacity, complexity of applying the On-going Monitoring Framework, and the amount of consultation that may be required. As noted for Tangible Capital Assets, other variables could negatively impact the completion of the On-going Monitoring Plan, in addition to the aforementioned challenges.

Finding:

Recommendation:

5. The Chief Financial Officer should prioritize its five-year on-going monitoring and oversight plan based on the approved framework to ensure its completion. This will allow the Department to meet its requirements under the Policy on Internal Controls and address concerns raised by the OAG in its Fall 2013 Follow-up Audit on Internal Controls over Financial Reporting.

5.3.3 Remediation

During the audit, it was noted that remediation plans have been prepared for the processes that were completed during the 2013-14 fiscal year. These plans include dates to complete remediation actions and assigned responsibilities for completion. The monitoring approach for remediation actions includes follow-up emails, face-to-face meetings, and a review of the remediation actions to determine satisfaction with results. The Internal Controls Unit has updated the remediation plan to reflect when the remediation was completed and the evidence of completion. Process/control owners are also encouraged to proactively inform the Internal Controls Unit when remediation actions have been completed. While the remediation monitoring is in place, follow-up assessment/testing may not occur until the process is re-examined under the On-going Monitoring Plan.

5.3.4 Liabilities

Environmental Liabilities and Guaranteed Loans have structured accounting approaches; however, both processes are experiencing challenges with consistency of operation as follows:

Environmental Liabilities - Documentation and testing performed by the external consultant does not contain conclusions on the operating effectiveness of the controls. Additionally, the accounting approach to determine liabilities was not fully implemented and therefore, was not being consistently applied by the programs and regions.

Guaranteed Loans - While a process is in place, there have been challenges in applying it consistently due to discrepancies and completeness of financial information used to develop the liabilities. Discrepancies are the result of reports such as the Lender Confirmation of Actuals Reports, which are incomplete, not current, or inaccurate. This impacts the overall accuracy of the National Housing Authority Report which informs the contingent liability for the Guaranteed Loans Program.

The challenges surrounding the implementation of the accounting processes have been identified in the Operational Effectiveness testing and remediation plans.

5.4.1 Ongoing sustainability

Roles and responsibilities are clearly communicated and understood by the key stakeholders responsible for the ongoing sustainability of the PIC. However, with respect to identification of changes in the internal control environment (i.e. processes/controls), further work should be done to strengthen the process for ensuring timely communication of those changes to the Internal Controls Unit and modification to existing process/control documentation.

Currently, changes are only identified and documentation updated when the Internal Controls Unit validates the process/controls through walkthroughs prior to Operating Effectiveness testing as part of planned assessments, and not immediately after a change has occurred. This delays the operational effectiveness testing as unplanned time is required to validate and update process documentation before testing can commence. Additionally, this impacts the Internal Controls Unit' ability to accurately prioritize the processes and controls to be assessed in the current and future periods

5.4.2 On-going Monitoring Framework

The On-going Monitoring Framework outlines the annual re-assessment process, including the risk factors that are considered for each existing and new process.

The eight risk factors are:

• AANDC Corporate Risk Profile (and stakeholder concerns);
• New Program or Legislation;
• Organizational Change;
• Data Analysis for Trends;
• Size of Program;
• Adequacy and Effectiveness of Internal Controls;
• Prior Findings; and,
• Last Coverage.

These risk factors should allow for the organization to appropriately re-assess processes on an annual basis and ensure that the plan is monitoring the highest risk processes.

Finding:

No additional findings identified. Refer to finding and Recommendation #1 in section 5.1.2 above for on-going sustainability.

5.5.1 Development and Implementation

Based on our interview and walkthrough with stakeholders in the Financial Planning, Analysis and Estimates Directorate of the CFO Sector, it was noted that a checklist was developed based on Appendix B of the TB Guideline on CFO Attestation for Cabinet Submissions. The checklist aligns with the six assertions outlined in the TB Guideline and provides a basis for the due diligence to be completed and documented by the CFO Sector. The checklist was reviewed and supported internally by the Director of Financial Planning, Analysis and Estimates, the DG Planning and Resource Management, and the CFO.

The TB Guideline went into effect on January 1, 2014. AANDC since has developed 13 TB Submissions. Of these 13 TB Submissions, two were reviewed in detail as part of this audit, to determine if the checklist was completed and supporting documentation was present to support the six assertions. In both cases the checklists were complete, supporting documentation was on file to support the six assertions, and the Attestation was signed by the CFO.

Roles and responsibilities, while not formally documented in AANDC's internal process, are outlined in the TB Guideline on CFO Attestation for Cabinet Submissions.

5.5.2 Assessment for design and operating effectiveness

Based on interviews during the audit, it was noted that the Internal Controls Unit was not involved in the development of the checklist or in the implementation of the process. Furthermore, this process has not been documented, assessed for design and operating effectiveness.

Finding:

No design or operational assessments have been performed on the AANDC CFO Attestation process for TB Submissions, which was implemented on January 1, 2014, as required by the TB Guideline on CFO Attestation for Cabinet Submissions

Recommendation:

6. The Chief Financial Officer should ensure that the new process/controls for the Chief Financial Officer Attestation for Cabinet and Treasury Board submissions are assessed for design and operational effectiveness.