Audit of Expenditure Management (Including Salaries)

Background

The Audit of Expenditure Management (including salaries) was included in Indigenous and Northern Affairs Canada's (INAC) 2016-2017 to 2018-2019 Risk-Based Audit Plan. With the mandate of a renewed fiscal relationship with indigenous communities and the inclusion of an additional $8.4 billion over the next five years from Budget 2016 for INAC, expenditure management is an area of significant importance and will be subjected to increased public scrutiny to ensure due diligence and stewardship are exercised in the expenditure of such funds.

In August 2010, the Prime Minister announced that the Government of Canada would transform its pay administration. This initiative has two components:

• The pay modernization project (pay system), and
• The consolidation of pay services (compensation services).

The initiative, led by Public Services and Procurement Canada (PSPC) was implemented with the intent of ensuring the long-term sustainability of Government pay administration and services. Once fully implemented, PSPC would provide pay services to more than 300,000 employees of 101 federal departments and agencies.

The Government-wide initiative started by the consolidation of pay services, which will result in all departments and agencies being served centrally by the PSPC pay center, and that employees would become responsible for their own personal information and requests through self-serve applications. In 2012, INAC started the process of transferring all of its compensation advisors and services to the PSPC Pay Centre. This caused Work Force Adjustment issues for the compensation advisor team. The funding for these positions was transferred to PSPC and the Department implemented Liaison Officers to interact with the Pay Centre.

For the Pay modernization exercise, PSPC acquired a new system (Phoenix) to replace the existing Regional Pay System (RPS) that was in place for more than 40 years. Phoenix was deployed in two separate roll-outs, February and April 2016, and INAC was identified to be part of the first wave of implementation.

As planned, INAC's pay system was transferred to Phoenix in February 2016. The implementation of Phoenix, led by PSPC, resulted in a number of critical issues and challenges for departments and agencies for which they had no control. These implementation issues had an impact on INAC's salary expenditure processes, procedures and controls. Moreover, these challenges created unplanned additional work that had to be absorbed by INAC without necessarily having the resources in place. In many cases, INAC was dependent upon PSPC for information and updates regarding resolution of Phoenix issues.

In addition, in May 2016, INAC's existing departmental human resources application (PeopleSoft) was transferred to the My Government of Canada Human Resources (MyGCHR) system, which is a single, centralized instance of PeopleSoft for the GoC. MyGCHR is also supported by PSPC. The issues related to PSPC's implementation of Phoenix and MyGCHR were ongoing and not fully mitigated as of the end of the audit period. As a result, the expenditure management environment in which INAC was operating during the audit period was very challenging.

Audit Objective and Scope

The objective of the audit was to provide assurance on the adequacy, efficiency and effectiveness of the management control framework supporting the management of departmental expenditures and to ensure that the control framework is based on sound principles and in compliance with applicable Treasury Board and INAC policies and procedures and relevant regulations.
The audit scope focused on current expenditure management processes at INAC that have not been addressed in recent audits, specifically:

• Budgeting and forecasting processes, including salary forecasting;
• Controls over INAC's HR and Pay processes impacted by the implementation of Phoenix and MyGCHR; and,
• SAP access and configuration related to expenditure management processes that have not been previously reviewed, specifically budgeting and forecasting and Financial Administration Act (FAA) Section 33 approval supported by Electronic Authentication and Authorization (EAA).

The time period for the audit was April 1, 2015 to June 30, 2016 to ensure that the most relevant processes and controls were reviewed based on the implementation of SAP, service hub structure, and the recent Phoenix implementation. Given the implementation of the Phoenix pay system in February 2016 and the implementation of MyGCHR on May 31, 2016, HR and payroll processes were reviewed as they apply to the new systems.

Statement of Conformance

This audit conforms with the Internal Auditing Standards for the Government of Canada, as supported by the results of the quality assurance and improvement program.

Positive Observations

The audit found several areas where strong practices were in place. Throughout the Department, a positive culture of collaboration was observed between HR Systems, the HR Service Centres, the National Administrative Unit (NAU), the Chief Financial Officer Sector and individual regions and sectors to go over and above their normal duties for the benefit of INAC employees to address HR and pay issues related to the implementation of Phoenix and MyGCHR.

One region had an established process to monitor salary forecasts on a monthly basis to ensure the accuracy, completeness and validity of salary information. This approach has enabled the region to more closely monitor data integrity issues relating to the Phoenix system implementation.

INAC has a well-established budgeting and forecasting process that includes adequate guidance for regions and sectors. Continuous improvement activities to support the process were noted. For example, a new initial budget allocation process was introduced in 2016-17 to streamline existing processes.

Conclusion

The audit identified areas for improvement related to the adequacy, efficiency and effectiveness of the management control framework supporting the management of departmental expenditures (including salaries). A number of issues were introduced with the transition to the new centralized GoC Phoenix system for pay and MyGCHR system for HR that were out of the control of INAC. Although INAC staff has gone over and above their normal duties to assist in addressing these issues, at the time of the audit, it was noted that accountability and clearly defined processes had not been developed within INAC for ensuring that all HR and pay transition issues were being managed within the Department in a coordinated fashion.

In addition, it was expected that an HR and Pay control framework within INAC would have been established to support the MyGCHR and Phoenix enabled HR and pay processes to ensure that risk areas within the Department's control relating to the validity, accuracy and completeness of HR and Pay transactions were identified and appropriately controlled. However, it was noted that an HR and Pay control framework within INAC has not been formally developed to support the new processes.

Additional gaps were identified related to a lack of evidence of review and monitoring related to budget transfers between regions and sectors before they are entered in SAP, and excessive access to SAP functionality allowing for the entering of budget information.

Recommendations

The audit team identified areas where management control practices and processes could be improved, resulting in the following three recommendations.

1. The Director General, Human Resources and Workplace Services Branch, with support from the Chief Financial Officer should continue to implement:
   • The required processes, and accountability within INAC to support the ongoing transition to Phoenix and MYGCHR; and,
   • The communication plan that aligns with PSPC to enable INAC to continue to inform INAC staff of new or emerging HR and pay-related issues and INAC's response to address next steps. This becomes increasingly important on a go-forward basis as INAC will need to anticipate and respond to changes at the PSPC Pay Centre.
2. The Chief Financial Officer and the Director General, Human Resources and Workplace Services Branch should:
   • Implement a process to document INAC's internal control framework for HR and Pay processes, outlining the controls that are the responsibility of INAC and identifying gaps that require mitigation. The process should support communication of key issues/risks between the Department and PSPC and be iterative in nature given that HR and Pay processes remain in transition; and,
   • Develop a training plan and training materials to support INAC staff in relation to HR and Pay processes.
3. The Chief Financial Officer should ensure that:
   • Budget transfers are supported by the appropriate evidence of review and approval; and,
   • There is ongoing monitoring and reviewing of access to SAP functionality, and where excessive access is found, it is removed.

Management Response

Management is in agreement with the findings, has accepted the recommendations included in the report, and has developed a management action plan to address them. The management action plan has been integrated in this report.

2.1 Audit Objective

The objective of the audit was to provide assurance on the adequacy, efficiency and effectiveness of the management control framework supporting the management of departmental expenditures and to ensure that the control framework is based on sound principles and in compliance with applicable Treasury Board and INAC policies and procedures and relevant regulations.

2.2 Audit Scope

The audit scope focused on current expenditure management processes at INAC that have not been addressed in recent audits, specifically:

• Budgeting and forecasting processes, including salary forecasting;
• Controls over INAC's HR and Pay processes impacted by the implementation of Phoenix and MyGCHR; and,
• SAP access and configuration related to expenditure management processes that have not been previously reviewed, specifically budgeting and forecasting and Financial Administration Act (FAA) Section 33 approval supported by Electronic Authentication and Authorization (EAA).

The audit scope excluded the areas of expenditure management covered by recent audits, such as contracting, payables at year-end (PAYE) and acquisition cards, travel and hospitality. Transfer payments were also out-of-scope of the audit as they were being addressed through other ongoing and planned audit activities and in particular the annually recurring internal audit of the management control framework for grants and contributions.

The audit team conducted fieldwork primarily at INAC headquarters, although site visits were conducted at two regional offices, Alberta and Ontario. The scope period for the audit was April 1, 2015 to June 30, 2016 to ensure that the most relevant processes and controls were reviewed based on the implementation of SAP, service hub structure, and the recent Phoenix implementation. Given the implementation of the Phoenix pay system in February 2016 and the implementation of MyGCHR on May 31, 2016, HR and payroll processes were reviewed as they apply to these new systems.

5.1 Transitional HR and Pay Process

The audit expected that an integrated and coordinated response would be developed by INAC to respond to issues related to the implementation of Phoenix and MYGCHR.

The implementation of Phoenix by PSPC resulted in a number of critical issues and challenges for GoC departments. Although not the responsibility of INAC, these implementation issues had an impact on INAC's salary expenditure processes, procedures and controls. In many cases, INAC was dependent upon PSPC for information and updates regarding resolution of Phoenix issues.

Although a positive culture of collaboration was observed between various stakeholders groups involved with rectifying the issues (e.g., National Administrative Unit, HR systems, HR Service Centres, CFO Sector, and employees at large) the audit found that roles and responsibilities had not been clearly defined or understood between the stakeholders. As experienced by numerous GoC departments, INAC was faced with high volumes of unanticipated HR and Pay processing issues arising from PSPC's MyGCHR and Phoenix systems implementation. In response, INAC personnel across the Department sought ways to address these issues even though these activities may have been "over and above" their normal job duties.

During the audit period, we found evidence that the Department was communicating regularly with staff and employees, although it was restrained by the challenges of obtaining timely info from PSPC. However, the communication may not have been effective or well understood by those involved with HR and Pay processes who had questions or issues while performing their roles and responsibilities, understanding accountabilities, or resulting process changes. For example, accountability and clearly defined processes have not been developed within INAC for ensuring that all HR and Pay transition issues are identified, logged, and monitored by a defined group. These groups within INAC have responded by developing their own methods of tracking and following up on issues that arise from using the new systems. This includes:

• Identifying, monitoring and managing salary adjustments including the backlog of unprocessed HR staffing actions (e.g. hundreds of staffing actions relating to acting pay, stop payments that have not been made for terminated employees, etc.).
• Ensuring that all related salary recoveries are identified and monitored by Finance in the case where salary overpayments have been made by the PSPC Pay Centre.

The Financial Situational Report process is performed four times per year which includes the annual salary forecast compared to commitment budget as well as variance analysis between the commitment budget and actual amounts based on the departmental financial system (SAP). The variance analysis is used as a financial management monitoring tool by sectors and regions; however, despite the salary data integrity issues as a result of the Phoenix implementation, this frequency of performing this process has not been adjusted to address the increased risk of incorrect salary data.

5.2 HR and Pay Internal Control Framework

The audit expected that INAC had developed an internal control framework for its HR and pay processes consistent with Treasury Board's Policy on Internal Controls along with the Departmental Internal Control Framework. This would include controls related to the granting and reviewing of access to approval functions. Furthermore, it was expected that quality assurance activities would be established to monitor and look for enhancement opportunities to improve the framework.

INAC is responsible for salary management and commitment control, pay authorization and pay expenditure review. At the time of the audit, roles and responsibilities were not clearly defined between INAC and PSPC (as a service provider) given that they share joint accountability over the HR and Pay Control Framework. INAC did not have direct sight in regard to the effectiveness of controls performed by PSPC's Pay Centre and it was unclear as to how INAC would obtain comfort in this regard. It is also unclear as to how key issues or risks would be communicated and mitigated between INAC and PSPC.

Determining roles and responsibilities with PSPC is challenging given INAC has not designed or implemented all required key controls to identify the risks related to ensuring that HR and pay transactions are valid, accurate and complete. Areas in which key controls were expected but not observed included:

• Section 33 certification is based on authorization with either no or very limited access to appropriate supporting documentation from PSPC. The HQ Pay Accounting team only reviews high risk transactions prior to Section 33 approval. For the purpose of these reviews, INAC has defined high risk transactions as those related to severance pay. Other transactions are not subject to HQ Pay Accounting review.
• For emergency salary advances, audit testing identified instances where supporting documentation was not retained to evidence the Manager's Section 32 approval of the employee's initial request. In addition, there were instances where supporting documentation was not retained to provide evidence that verification activities were performed by the Accounting Hub as part of Section 33 certification.
• There are no post payment verification processes in place for pay transactions.

In addition, a common and documented approach has not been established to determine how data should be entered into MyGCHR and verified by INAC to ensure completeness, accuracy and validity of information. The controls for entering data in MyGCHR have become increasingly important as data entered into MyGCHR feeds the master data in the Phoenix system for pay purposes. Control gaps included: data fields considered mandatory for departmental purposes have not been identified; and, a common process has not been established to consistently address and resolve error messages across the Department.

The Security Control Access Officer (SACO) coordinates access for Section 33 approval between INAC and PSPC using standard forms; however, the SACO does not perform periodic reviews to ensure access remains appropriate.

There is no formal process to conduct meaningful monitoring and quality assurance activities relating to HR and Pay processes. System reports are not available, have not been provided by PSPC to INACor INAC has not requested them from PSPC.

Finally, training materials have not been developed to complement the job-aids, e-learnings, and other training guides developed by PSPC. The PSPC training materials are highly systems-focused, and do not provide guidance to the Department's day-to-day operations (overall process training).

Continuous improvement activities relating to communications and training have not been formally established to support the Department's HR and Pay processes (e.g. lessons learned).

5.3 Budgeting and Forecasting

The audit expected that roles and responsibilities and timelines for budgeting and forecasting processes are clearly established, communicated and understood. Furthermore, it was expected that budgeting and forecasting processes ensure that the initial budget and budget amendments are approved, data integrity is maintained, budget to actual variance analysis is effective and performed on a timely basis.

INAC has a well-established budgeting and forecasting process that includes adequate guidance for regions and sectors. Continuous improvement activities to support the process were noted, for example, a new initial budget allocation process was introduced in 2016-17 to streamline existing processes.

Through audit testing, there were a few instances noted where supporting documentation was not retained by the PRM Branch to evidence review and monitoring related to budget transfers between regions and sectors (intra budget transfers) before they are entered in SAP.

In addition, access to SAP functionality allowing for the entering of budget information was found to be excessive, both within the Corporate Services teams in the regions, as well as within the PRM Branch. Refer to Section 5.1 Transitional HR and Pay Process regarding an audit finding related to the Financial Situational Reporting (FSR) process.

Audit Criteria and Control Objectives