Audit of the Selection Processes for Recipient Audits

Context

The Government of Canada provides transfer payment funding to a variety of recipients to further its policy objectives and priorities. Crown–Indigenous Relations and Northern Affairs Canada (CIRNAC) and Indigenous Services Canada (ISC) administer funding to First Nations, Tribal Councils, Inuit, Métis, northern and other Indigenous and non-Indigenous organizations. This funding is distributed through grants and contributions. Contributions are transfer payments subject to performance conditions specified in the funding agreement and are subject to a recipient audit.

As defined by the Treasury Board, a recipient audit is an independent assessment to provide assurance on a recipient's compliance with a funding agreement. Departments are expected to implement a risk-based selection process for recipient audits to help ensure that transfer payments are managed in a way that reflects sound stewardship, integrity and transparency.

Recipient audits are one of several types of activities in place to support the ongoing departmental monitoring of recipients. Other departmental monitoring activities may include: program compliance reviews; financial statement reviews; the default prevention and management program; recipient reporting; site visits; and other ad hoc communications with recipients to review project progress.

Recipient audits are conducted by Chief Finances, Results and Delivery Officer (CFRDO) of ISC, CFRDO of CIRNAC, and First Nations and Inuit Health Branch (FNIHB) with the support of FNIHB Regional Operations and Regional Operations of ISC.

The Transfer Payment Advisory Services (TPAS) has been designated as the lead for the recipient auditing process for most of CIRNAC and most of ISC. It is a shared service within both CIRNAC and ISC CFRDOs that administers recipient audits for most CIRNAC contribution funding, ISC contribution funding (with the exception of FNIHB contribution funding) and any Indigenous and Northern Affairs Canada legacy funding. Within FNIHB, Capacity, Infrastructure and Accountability Division (CIAD) has been designated as the lead for the recipient auditing process and administers recipient audits for FNIHB contribution funding.

CFRDO and FNIHB each have their own recipient auditing processes. During the audit period, the sectors were collaborating on a new integrated CIRNAC and ISC recipient audit framework, which is expected to be shared with multiple governance committees starting in March 2021 to seek endorsement and then final approval. The date by which the framework will be implemented has not yet been determined. The conduct phase of this audit was substantially completed in November 2020 and the findings reflect observations made up to that time.

Why It Is Important

The audit was identified as a priority because a strong recipient auditing function contributes to independent and risk-based assurance on compliance with funding agreements and complements other recipient monitoring and oversight activities.

What We Examined

The objective of the audit was to provide assurance that CIRNAC and ISC were using risk-based recipient selection processes that supported providing sufficient recipient audit assurance for potentially high risk recipients.

What We Found

Overall Conclusion

The audit recognized that the current approaches to the risk-based recipient selection processes will be replaced by the CIRNAC and ISC Integrated Recipient Audit Framework that is being developed. The findings related to the current processes and the draft framework could be used to inform the final framework and its supporting guidance as it is completed, endorsed by governance committees and then ultimately approved.

The audit concluded that there was an opportunity to strengthen the consistency in how recipient selection criteria are assessed, including the requirement for stronger justification for decisions to not include proposed recipients in the recipient audit plan; elaborate on the assurance coverage required to meet the objectives of recipient audits; and to periodically validate that risk-based selection criteria remain aligned with the departmental risk landscape.

Management's Response

Management is in agreement with the findings, has accepted the recommendations included in the report, and has developed a management action plan to address the recommendations. The management action plan has been integrated into this report.

1.1 How Recipient Audits are Administered

1.2 Departmental Integration Efforts

As part of the departmental integration efforts, a Recipient Audit Framework Taskforce was created in 2020 to develop an integrated risk-based recipient audit framework and approach that is consistently applied across CIRNAC and ISC and supports departmental objectives related to recipient audits. The Recipient Audit Framework Taskforce is comprised of stakeholders from various CIRNAC and ISC regional offices and Headquarters. At the time of this audit, the Recipient Audit Framework Taskforce members were working collaboratively on the development of a new integrated recipient audit framework for CIRNAC and ISC. The new recipient audit framework is expected to be shared with multiple governance committees starting in March 2021 to seek endorsement and then final approval. The date by which the framework will be implemented has not yet been determined. The conduct phase of the audit was substantially completed in November 2020 and the findings reflect observations made up to that time.

2.1 Why It Is Important

The audit was identified as a priority because a strong recipient auditing function contributes to independent and risk-based assurance on compliance with funding agreements and complements other recipient monitoring and oversight activities.

2.2 Audit Objective

The objective of the audit was to provide assurance that CIRNAC and ISC were using risk‑based selection processes that supported providing sufficient recipient audit assurance for potentially high risk recipients.

2.3 Audit Scope

The scope of the audit included the examination of the process for recipient auditing within CIRNAC and ISC. The audit covered the activities related to the recipient auditing selection processes within CFRDO CIRNAC, CFRDO ISC, RO, FNIHB, and FNIHB-RO (National Capital Region and in the departments' regional offices).

The audit focused on recipient selection process activities between fiscal years 2017-18 and 2019-20. The development of the new recipient audit framework was considered up to November 2020.

This audit excluded the recipient selection process conducted within CIRNAC by Northern Affairs Organization through the NNC program. As grants are not normally subject to recipient audits, grants were also excluded from the scope of this audit.

2.4 Audit Approach and Methodology

The audit was conducted in accordance with the requirements of the Treasury Board Policy on Internal Audit and followed the Institute of Internal Auditors International Professional Practices Framework. The audit examined sufficient, relevant evidence and obtained sufficient information to provide a reasonable level of assurance in support of the audit conclusion.

Audit fieldwork was substantially performed from October 2020 to November 2020. The main audit techniques used included:

• Interviews with key stakeholders involved in the recipient selection processes;
• Process walkthroughs of recipient selection processes;
• Review of relevant documentation related to recipient selection, including policies, operational procedures and guidelines; and
• Data analysis of recipient selections, including coverage of highest assessed General Assessment (GA) risk ratings, other risk factors, overall funding and regions.

The approach used to address the audit objective included the development of audit criteria, against which observations and conclusions were drawn. The audit criteria can be found in Appendix A.

3.1 Recipient Selection Processes for Individual Funding Agreements and Coordination for Joint Recipient Audits

Treasury Board provided guidance on recipient auditing through the Guideline on Recipient Audits Under the Policy on Transfer Payments. The guideline outlined that a risk management model should be designed at a recipient and project level to inform a broader risk-based plan for assurance at a program and departmental level. Moreover, the process should be clearly documented, including when decisions should be made using sample selection or the manager's discretion.

Based on Treasury Board guidance, it was expected that both TPAS and CIAD would demonstrate consistent and transparent processes for their respective recipient selection. As explained earlier in the report, each group's individual process was not expected to continue once the integrated CIRNAC and ISC Recipient Audit Framework is implemented. The findings made in this section can be leveraged as the integrated framework and its supporting guidance are finalized.

3.2 Recipient Audit Coverage

CIRNAC and ISC had several types of activities in place to support the ongoing monitoring and oversight of funding agreements. These activities included program compliance reviews, financial statement reviews, the default prevention and management program, review of program or recipient reporting, site visits, and other ad hoc communications with recipients to review project progress.

Recipient auditing was one of several types of assurance activities in place to support ongoing departmental monitoring and oversight of recipients. As per the Treasury Board Guideline on Recipient Audits, recipient monitoring, reporting and auditing should reflect risks specific to the program(s), the value of funding in relation to administrative costs and the risk profile of the recipient. Accordingly, it was expected that there was alignment between the recipients selected for recipient audits and the three criteria identified by Treasury Board.

Findings

Within the TPAS and CIAD processes, the role of recipient auditing within departmental oversight had not been defined using any specific measurements or targets, which established the assurance that it was expected to contribute to departmental monitoring and oversight. Without a sense of what was expected to be achieved, the audit could not assess if the current assurance coverage met departmental needs. The following section simply describes the recipient audit coverage using the three criteria identified by Treasury Board.

3.2.1 Risks Specific to the Programs

The audit team did not observe any methods in the current recipient selection processes to link the recipient audits selected with risks, specific to the programs responsible for the funding.

3.2.2 The Value of Funding in Relation to Administrative Costs

While the recipient audit plans do not identify the total amount of funding for which recipient auditing provided assurance, a presentation to management noted that TPAS and CIAD's recipient audit coverage was six percent for the 2019-20 CIRNAC and ISC recipient plan.

3.2.3 The Risk Profile of the Recipient

As part of the contributions agreement process, CIRNAC and ISC undertook a risk assessment process each year to assess and score the risk of each recipient. This annual assessment was used to determine the risk profile of recipients based on the following risk factors: Governance, Planning, Financial Management and Program Management. The output of this risk assessment process was referred to as a GA score, which corresponded to a risk rating of low risk, medium risk and high risk.

While TPAS and FNIHB-RO have different approaches for selecting recipients, both processes considered the GA risk rating and other risk criteria of the recipients.

Recipients with high risk GA ratings were considered for recipient audit. As previously described in Section 3.1.1, there was no documented guidance to define an acceptable rationale for excluding recipients with high risk GA ratings from consideration for the recipient audit plan. The validity of the available rationales to support why high risk recipients were not included in the recipient audit plan could not be assessed.

For the purpose of this audit, the recipient audit plans were analyzed to determine what portion of the recipients that were audited had a high risk rating. Figures 1 and 2 provide a summary of risk ratings among selected recipients between 2017-18 and 2019-20. For further context, there were 57 recipients with a high risk rating during that time period.

Text alternative for Figure 1 TPAS: Distribution of risk ratings among selected recipients

Figure 1 Bar chart representing the Transfer Payments Advisory Services’ distribution of risk ratings among selected recipients for fiscal years 2017-2018, 2018-2019 and 2019-2020.

• 11 low risk, 10 medium risk and 2 high risk recipients were selected for audit in fiscal year 2017-2018.
• 15 low risk, 6 medium risk and 4 high risk recipients were selected for audit in fiscal year 2018-2019.
• 10 low risk, 2 medium risk and 1 high risk recipients were selected for audit in fiscal year 2019-2020.

 

Text alternative for Figure 2 CIAD: Distribution of risk ratings among selected recipients

Figure 2 Bar chart representing the Capacity, Infrastructure and Accountability Division’s distribution of risk ratings among selected recipients for fiscal years 2017-2018, 2018-2019 and 2019-2020.

• 15 low risk, 12 medium risk and 3 high risk recipients were selected for audit in fiscal year 2017-2018.
• 17 low risk, 5 medium risk and 2 high risk recipients were selected for audit in fiscal year 2018-2019.
• 20 low risk, 2 medium risk and 1 high risk recipients were selected for audit in fiscal year 2019-2020.

3.2.4 Recipient Auditing Framework

The draft integrated recipient audit framework included risk criteria and risk prioritization considerations to reflect risks specific to the program(s), the value of funding and the risk characteristics of the recipient. Recommendation #1 will ensure that the documented guidance will provide clarity on how these risk and prioritization criteria should be applied.

The draft integrated audit framework established that the objective of recipient auditing included meeting management's independent assurance needs while complementing, but not duplicating, management assurance obtained through other monitoring and oversight activities. At the time of the audit, there was no documentation to elaborate on how much assurance coverage was required from recipient auditing to meet the objective of recipient monitoring, reporting and auditing as a whole.

Recommendation

2. The Chief Finances, Results and Delivery Officer, CIRNAC, the Chief Finances, Results and Delivery Officer, ISC and the Senior Assistant Deputy Minister, First Nations and Inuit Health Branch should ensure that the CIRNAC and ISC Integrated Recipient Audit Framework's guidance elaborates on how much recipient audit coverage is required to support overall departmental monitoring and oversight.

3.3 Alignment of Selection Criteria with Risk Landscape

The risk landscapes of CIRNAC and ISC are continuously evolving. The risk in programs, the amount of funding being delivered by each department and the risk profiles of recipients change as a result of many factors, including lower risk recipients moving to 10-year grants rather than contribution agreement funding, new programs being delivered and more contribution agreement funding being delivered by CIRNAC and ISC.

It was expected that the selection criteria used for recipient audits would be updated periodically to remain aligned with the departmental risk landscape.

Statement of Conformance

This audit was conducted in conformance with the International Standards for the Professional Practice of Internal Auditing, as supported by the results of the quality assurance and improvement program.

Audit Criteria