Audit of Internal Controls over Financial Reporting

Context

Canadians expect that the financial resources of the Government of Canada are well-managed and safeguarded through balanced internal controls that enable flexibility and manage risk. Additionally, reliable financial reporting is expected to demonstrate transparency and accountability to Canadians on how public funds were spent to achieve results. An organization's system of internal controls over financial reporting (ICFR) is intended to meet these expectations. The system of ICFR is designed to mitigate risks based on a process to identify and prioritize key risks, assess effectiveness of associated key controls and implement any corrective action.

In the Government of Canada's Financial Administration Act, the deputy head is designated as the accounting officer with the accountability to maintain an effective system of internal control. The Treasury Board (TB) Policy on Financial Management also states that the Chief Financial Officer supports the deputy head in fulfilling their financial management responsibilities and accountabilities by leading and managing the departmental financial management function and has the responsibility for establishing, monitoring, and maintaining a risk-based system of ICFR.

The effectiveness of the year-round internal control processes that make up the system of ICFR is established in the Statement of Management Responsibility Including ICFR. Appended to the financial statements, the Annex to the Statement of Management Responsibility Including ICFR provides assurance that internal control activities undertaken by the department maintained an effective ICFR system through internal control monitoring activities and action plans.

Crown-Indigenous Relations and Northern Affairs Canada (CIRNAC) and Indigenous Services Canada (ISC) have separate Statements of Management Responsibility Including ICFR. The work to support the Statement of Management Responsibility and its Annex is performed by ISC's Chief Finances, Results and Delivery Officer (CFRDO) Internal Control Team. Services are provided to CIRNAC's CFRDO via a service level agreement between the two departments which identifies the responsibilities for internal control activities within both departments, including: the planning, execution and monitoring of the internal control plan reported upon in the Statement of Management Responsibility Including ICFR and the preparation of the Statement of Management Responsibility Including ICFR. CIRNAC's Financial Operation team provides a liaison and challenge function for CIRNAC on the services provided by ISC.

Why it is important

This audit was identified as a priority because the ICFR process had not been audited since 2015 and the operating environment had changed with the creation of ISC and CIRNAC. In addition, the policy requirements changed with the implementation of the 2017 TB Policy on Financial Management that replaced the TB Policy on Internal Control.

What we examined

The audit objective was to provide assurance that the processes supporting the Internal Control Plan in ISC and CIRNAC are aligned with the ICFR requirements of the TB Policy on Financial Management and meet the coverage and oversight needs of each department.

What we found

Overall conclusion

The Internal Controls Team within ISC CFRDO provides ICFR services to ISC as well as to CIRNAC. The scope of the audit examined the key activities performed for both Departments from 2018-2019 to 2021-2022 which included the work performed under the operational challenges of the COVID-19 pandemic.

The key departmental guidance for the ICFR activities is the Internal Control Management Framework that was developed in 2015. While it does still include guidance on key ICFR activities, it does not reflect the operational changes from the creation of the 2 new Departments. It only partially complies with the requirements of the TB Policy on Financial Management.

Two key elements of the ICFR process are the ICFR Monitoring Plans and the risk assessments or environmental scan that inform them. There were gaps in the performance of the risk assessments or environmental scans. A decision had been made to shift from individual departmental monitoring plans to a common monitoring plan. Key business processes related to each Department's financial reporting were incorporated into the common business processes in the common monitoring plan. It was not clear if the planned testing for the common business processes would be detailed enough to reflect the testing needs of the original business processes or if the testing frequency efficiently reflected the risk of the individual business processes within the common groupings.

The results of the ICFR activities was shared with the Departments. It included the results of the business process testing, identified deficiencies and the corrective actions required to address them. What was not present in the reporting was a conclusion on the overall strength of the system of internal controls over financial reporting, the impact of planned testing not being performed, and an update of the implementation of corrective actions for previously identified deficiencies.

Statement of conformance

The audit conforms with the Institute of Internal Auditors' International Standards for the Professional Practice of Internal Auditing and the Government of Canada's Policy on Internal Audit, as supported by the results of the Quality Assurance and Improvement Program.

Management's response

Management is in agreement with the findings, has accepted the recommendations included in the report and has developed a management action plan to address them. The management action plan has been integrated into this report.

Departmental Perspective

Crown-Indigenous Relations and Northern Affairs Canada (CIRNAC) and Indigenous Services Canada (ISC) have separate Statements of Management Responsibility Including ICFR. The work to support the Statement of Management Responsibility and its Annex is performed by the Internal Control Team of ISC's Chief Finances, Results and Delivery Officer (CFRDO) through the internal control plan and testing activities. Services are provided to CIRNAC's CFRDO via a service level agreement between the two departments. The agreement identifies the responsibilities for internal control activities within both departments which includes the planning, execution and monitoring of the internal control plan reported upon in the Statement of Management Responsibility Including ICFR. CIRNAC's Financial Operation team provides a liaison and challenge function on the services provided by ISC.

ICFR Process

Business owners are responsible for the design and implementation of controls to ensure that the TB Policy on Financial Management requirements are being meet. The CFRDO is responsible for establishing, monitoring and maintaining a risk-based system of internal controls over financial reporting and to provide reasonable assurance that the TB Policy on Financial Management requirements are being met.

Figure 1 illustrates the ICFR process as described by the TB Policy on Financial Management. A risk assessment or environmental scan should be conducted to identify and assess the risk level of the financial controls within business processes. Based on the identified risk level, a multi-year ICFR ongoing monitoring plan should be developed. It should outline the planned schedule to conduct assessments to ensure that key controls are functioning as intended and that control risks are mitigated. Based on the results of these assessments, management action plans should be created and business process owners should be held accountable to remediate the identified deficiencies. The assessment results, corrective actions and potential gaps should be collectively reported in the annual financial statements for both ISC and CIRNAC.

Text alternative for Figure 1 Description of the ICFR process

The figure 1 describe the ICFR Ongoing Monitoring Plan. In the first place, a risk assessment or an environmental scan should be conducted to identify and assess the risk level of the financial controls within business processes. The plan follow four steps:

1. Monitor corrective action implementation;
2. Identify internal control assessments based on risk priority level;
3. Conduct assessments and identify areas for improvement;
4. Provide recommendations and obtain corrective actions from business owners.

Finally, there is a conclusion based on results of the initial assessment or scan.

2.1 Why it is important

This audit was identified as a priority because the ICFR process had not been audited since 2015 and the operating environment had changed with the creation of ISC and CIRNAC. In addition, the policy requirements changed with the implementation of the 2017 TB Policy on Financial Management that replaced the TB Policy on Internal Control.

2.2 Audit objective

The audit objective was to provide assurance that processes supporting the Internal Control Plan in ISC and CIRNAC are aligned with the ICFR requirements of the 2017 TB Policy on Financial Management and meet the coverage and oversight needs of each department.

2.3 Audit scope

The scope of the audit included ICFR activities for both ISC and CIRNAC including risk assessments, the ICFR plan, execution of the plan, reports on results and follow-ups on corrective actions. The audit included ICFR activities for the period from April 2018 to November 2021.

The audit focused on the process in place to perform ICFR work such as the completion of risk assessments to support the development of ICFR Ongoing Monitoring Plans and reporting on the result. The audit did not re-perform the design and operating effectiveness testing of key business processes that was done by CFRDO ISC's Internal Controls team. The audit also excluded the Internal Controls Over Financial Management activities because the work to establish, monitor, and maintain a risk-based system of Internal Controls Over Financial Management was still being implemented by the Departments.

2.4 Audit approach and methodology

The audit was conducted in accordance with the requirements of the TB Policy on Internal Audit and followed the Institute of Internal Auditors International Professional Practices Framework. The audit examined sufficient, relevant evidence and obtained sufficient information to provide a reasonable level of assurance in support of the audit conclusion.

The audit fieldwork was performed from October 2021 to February 2022 and consisted of three phases: planning, conduct and reporting. The main audit techniques used included:

• Interviews with key stakeholders;
• Process walkthroughs;
• Review of relevant documentation, including policies, operational procedures and guidelines; and,
• File testing to evaluate how the assessment process was implemented.

The approach used to address the audit objective included the development of audit criteria, against which observations and conclusions were drawn. The audit criteria can be found in Annex A.

3.1 Established System of Internal Controls Over Financial Reporting

3.2 Design of the ICFR Ongoing Monitoring Plan

3.3 Reporting on Results

Management's Detailed Response and Action Plan

The internal control team within the Corporate Accounting, Policy and Internal Control directorate of ISC provides internal control services to both ISC and CIRNAC. In recent years, there has been a significant amount of staff turnover in the unit that has resulted in a loss of both corporate knowledge and documentation of processes. The impacts of COVID-19 have also resulted in a shift of focus to assess the impacts of the pandemic on the control environment.

Though it has not been possible to perform some assessments of high risk processes within the time frame set out (two years) in recent years, there are many compensating controls that have been relied upon to provide assurance that the internal controls are effective and the risk of material misstatement is low. For example, for contingent liabilities, the methodologies used to assess the liability have remained stable in recent years with the exception of the methodology for specific claims which was modified in 2017-18. The updated specific claim methodology was reviewed by Ernst & Young in 2017-18, which concluded that the methodology was appropriate, and the management action plan for recommended improvements to the process was implemented in 2018-19. The contingent liability process has been further strengthened by the implementation of a Director General level committee with membership from CFRDO sector, program sectors as well as central agencies including the Office of the Comptroller General and Department of Finance, who review the quarterly contingent liability submission as well as any significant claims to support the accounting treatment. The liability for contingent liabilities for both ISC and CIRNAC and environmental liabilities for CIRNAC are audited by the Office of the Auditor General every year as a part of their audit of the Public Accounts of Canada due to materiality. The 2020-21 OAG audit did not note any issues with regards to contingent or environmental liabilities for ISC and CIRNAC.

Management is in agreement with the recommendations made by Internal Audit and will prioritize the implementation of recommendations with additional efforts to document processes, findings and briefings to senior management.

To date, the actions to address the recommendations have been fully implemented by the CFRDO sector with the exception of the Internal Control Framework which is currently underway and expected to be completed by December 31, 2022.

Although Management agrees with the recommendations resulting from Internal Audit's review and has diligently worked to implemented them in advance of the signing of the 2021-22 Departmental Financial Statements, Management would like to clarify that the audit did not examine the effectiveness of the internal controls themselves nor have there been any concerns by the Office of the Auditor General with the quality of ISC's or CIRNAC's financial information in recent years audits of the public accounts plates and forms.

Additional context is also needed in regards to the meaning of a risk based system of internal control. A risk based systems implies that internal control assessments will be planned based on assessed level of risk and resource availability. The planned assessments may be modified in order to respond to emerging risks, such as the impact of COVID on the system of internal controls. This may result in delayed testing for other business processes which is acceptable from a policy perspective. Management does recognize that any changes to the ongoing monitoring plan and delays in testing should be properly documented and approved.

Audit Criteria