Internal Audit Report - Audit of Financial Management Control Framework

June 2013

Table of Contents

• Executive Summary
• 1. Introduction
  • 1.1 Background
  • 1.2 Audit Objectives and Scope
  • 1.3 Audit Approach
• 2. Audit Findings
  • 2.1 Future Funding
  • 2.2 Information Technology General Controls over Financial Reporting
  • 2.3 Knowledge of Financial Management Processes
  • 2.4 Optimizing Work Already Performed
  • 2.5 Budget Deficit Reduction
• 3. Audit Conclusion
• 4. Statement of Conformance
• Appendix A: Audit Criteria

Executive Summary

Introduction

Infrastructure Canada (INFC) leads federal efforts to ensure that Canadians benefit from world-class, modern public infrastructure. INFC flows billions of dollars in transfer payments each year to its infrastructure partners such as provincial, territorial, and municipal governments. To successfully fulfill its mandate and contractual obligations, INFC's financial management framework must effectively support relevant and timely financial planning, budgeting, monitoring and reporting activities.

Audit Objectives & Scope

The objectives of the Financial Management Control Framework audit were to provide assurance that:

Objective 1: INFC's financial management control framework is aligned to and compliant with federal policy and legislative requirements.

Objective 2: INFC maintains an adequate system of internal controls and practices to ensure effective and efficient departmental financial management.

Objective 3: INFC's financial management control framework produces accurate and timely information that supports departmental decision-making.

The scope of the audit involved an examination of all systems, practices, policies, procedures, and tools related to INFC's financial management control framework, such as the planning, budgeting (including identifying resource requirements, budget preparation and resource allocation), monitoring, and reporting processes within INFC.

Conclusion

Based on audit evidence, it was found that INFC's financial management control framework was aligned to and compliant with federal policy and legislative requirements. INFC maintains an adequate system of internal controls and practices to ensure effective and efficient departmental financial management. INFC's financial management control framework produces accurate and timely information that supports departmental decision-making.

Opportunities for improvement to the financial management control framework were identified and help to:

• Reduce financial risks to INFC by following up with Transport Canada to help ensure that a consistent approach to the establishment of payables at year end is established.
• Strengthen internal controls related to the financial management system and financial processes within INFC by addressing the remaining known control weaknesses within Integrated Financial Management System and by providing mandatory training sessions for fund centre managers who do not adhere to the existing Financial Status Report preparation process.
• Support the department's preparation for compliance with Treasury Board's Policy on Internal Control by formalizing the performance of the key controls within INFC's budgeting processes and documenting the existing processes that impact the quality of financial results and financial statement reporting.
• Improve capacity within the Finance & Contracting Division.

Management is in agreement with the audit findings and recommendations. Management has developed action plans to address the recommendations and these action plans have been included in the report.

Statement of Conformance

The audit conforms to the International Standards for the Professional Practice of Internal Auditing and the Internal Auditing Standards for the Government of Canada, as supported by the results of INFC's Internal Audit quality assurance and improvement program.

Signature

1. Introduction

1.1 Background

Infrastructure Canada (INFC) leads federal efforts to ensure that Canadians benefit from world-class, modern public infrastructure. INFC flows billions of dollars in transfer payments each year to its infrastructure partners such as provincial, territorial, and municipal governments. To successfully fulfill its mandate and contractual obligations, INFC's financial management framework must effectively support relevant and timely financial planning, budgeting, monitoring and reporting activities.

INFC is subject to the Treasury Board Policy Framework for Financial Management. In conjunction with the Financial Administration Act (FAA), the framework guides the work of public service employees and provides the cornerstone for effective financial management within the federal government. The policy framework encompasses the Policy on Financial Management Governance, the Policy on Internal Control, the Policy on Financial Resource Management, Information and Reporting, and the Policy on the Stewardship of Financial Management Systems.

Each policy considers a different aspect of financial management principles. The Policy on Financial Management Governance considers the human resources element in the roles and responsibilities for financial management governance. The Policy on Internal Control focusses on prudent stewardship of public funds, the safeguarding of public assets, and the effective, efficient and economical use of public resources. The Policy on Financial Resource Management, Information and Reporting considers the management of public funds from the perspective of the deputy heads, Chief Financial Officers, senior departmental managers, and the Comptroller General of Canada. The Policy on the Stewardship of Financial Management Systems considers the role of financial management systems in delivering accurate, reliable, accessible, and timely financial information and the relevant responsibilities of the deputy head.

The Corporate Services Branch has undertaken a key role in fulfilling INFC's responsibilities with respect to the Treasury Board Policy Framework for Financial Management. The Branch is headed by the Chief Financial Officer (CFO) who reports directly to the Deputy Minister. Within the branch, Finance and Contracting Division is responsible for ensuring the provision of financial services and for developing financial policies, procedures and tools to help managers and employees fulfill their financial management responsibilities.

1.2 Audit Objectives and Scope

The objectives of the Financial Management Control Framework audit were to provide assurance that:

Objective 1: INFC's financial management control framework is aligned to and compliant with federal policy and legislative requirements.

Objective 2: INFC maintains an adequate system of internal controls and practices to ensure effective and efficient departmental financial management.

Objective 3: INFC's financial management control framework produces accurate and timely information that supports departmental decision-making.

The scope of the audit involved an examination of all systems, practices, policies, procedures, and tools related to INFC's financial management control framework, such as the planning, budgeting (including identifying resource requirements, budget preparation and resource allocation), monitoring, and reporting processes within INFC.

1.3 Audit Approach

The examination phase of this audit began in January 2013 and was substantially completed in April 2013. The audit employed various techniques including interviews, walkthroughs of financial processes, and examinations of financial and non-financial documentation such as Financial Status Reports, key budgeting process documents, Departmental Management Committee meeting minutes, Treasury Board Secretariat (TBS) guidance documentation, and INFC's submissions to the Office of the Comptroller General (OCG) and TBS.

2. Audit Findings

2.1 Future Funding

Operational funding

Unlike other federal departments, INFC does not have ongoing operating funding to run the Department. Historically, Treasury Board (TB) approved a small program delivery component within each new transfer payment program that INFC delivered. While the program delivery funds were originally intended to cover the incremental costs associated with each new program, they were eventually used to fund the Department's entire operating budget. However, in 2013-2014, for the first time, the Department received funds from TBS specifically for the operating budget. These funds were only for the 2013-2014 year and did not provide for future years.

The Department is currently administering eight infrastructure programs. In addition, INFC is currently developing the new suite of programs within the New Building Canada Plan as per Budget 2013. While these programs are scheduled to start in 2014-2015, there are still administrative costs associated with planning, consultation, and program development. As a result, operating funds will be required to run the department for several more years.

It was expected that INFC would implement measures to address the risk of not having sufficient operating funds to fulfill its mandate.

A process is in place to help secure multi-year operating funds.

As a first step in securing operating funds for the Department, INFC fulfilled the condition imposed by Budget 2012 to draw down the provision to provide funds for the purpose of an Operating Vote in the 2013-2014 Main Estimates. The condition was that INFC would build a Corporate Costing Model, have it vetted by the OCG and then have it approved by TBS.

INFC's Corporate Costing Model determines the cost to establish and deliver new programs. It can consider the resources required at different stages of a program's lifecycle including program design, implementation and close. The model focuses on resource utilization and more specifically on the Full-Time Equivalent (FTE) units which represent the workload of one person for a day. FTEs from each Branch and Division are modeled to support an estimate of operating cost for future years.

It was observed that INFC is committed to working with TBS and the Department of Finance to use the costing model in order to help establish planning numbers beyond the upcoming year.

Transfer payments

Infrastructure projects often span several years and eligible expenses can be incurred at different times during the project's lifecycle. If eligible expenses are incurred, paid, and submitted by the recipient to INFC for payment before the end of a fiscal year, then INFC has an obligation to pay these amounts from the same year's funds. If eligible expenses are incurred, paid, submitted but not processed prior to fiscal year end, a Payable At Year End (PAYE) must be established.

In previous years, INFC set up a PAYE based on a recipient's estimate of eligible expenses that had not yet been claimed. With time, INFC began to identify projects that had significantly overestimated the PAYE amount. The financial impact of the overestimated PAYE amounts was that the unused PAYE funds lapsed. To restore the committed funds, INFC submitted requests to Central Agencies, specifically TBS and Department of Finance, to re-profile the funds to the fiscal year in which the funds were actually used. Recently, Central Agencies have denied requests to re-profile PAYE funds.

Due to the multi-year nature of the infrastructure projects, forecasts are used to describe the timing and amount of funds that will be spent. INFC uses the forecasts to profile the appropriate amount of funds to the appropriate years.

A process similar to the PAYE process is used by INFC to request financial forecasts from project recipients. INFC's experience with financial forecasts has shown that some forecasts turn out to be inaccurate for various reasons such as overly optimistic estimates or delays related to contracting, weather, or supply of materials. As a result, unused planned spending lapses at the end of a fiscal year. While TBS and the Department of Finance have not yet denied INFC's requests to re-profile lapsed funds related to financial forecasts, there is a concern that they may change their position based on the precedent established for overestimated PAYE funds.

It was expected that INFC would implement new measures to improve the accuracy of PAYE and financial forecasts.

INFC has addressed most of its financial risk related to PAYE funds.

INFC has implemented a new process that requires PAYEs for recipients be based on a claim submitted to INFC that had not been processed prior to year end. For Federal Delivery Partners (FDPs), INFC sends out call letters to initiate the PAYE process. It was observed that the call letter guidance has been modified to redefine how PAYEs are to be calculated. The new process requires that PAYEs be based on a submitted claim that had not been processed prior to year end. For projects administered by FDPs on behalf of INFC, acceptable proof would be FAA Section 34 approval and confirmation that the expense has already been paid by the recipient. The Section 34 approval signifies that the work has been performed, the goods supplied or the services rendered.

Transport Canada (TC) is one of INFC's FDPs. TC delivers projects under three INFC programs and as such, TC submits PAYE information to INFC on behalf of those projects. TC continues to rely on an attestation by the recipient as to the reasonableness of estimated PAYE amounts. It was observed that TC's PAYE estimates have proven to exceed the expenses that are eventually claimed against the PAYE amount. It is INFC's understanding that TC is in the process of changing their approach to establishing PAYEs. An attestation will soon be required to confirm that eligible expenses were incurred and paid by the recipients. This new development will help to ensure that the eligible expenses that TC reimburses will equal the PAYE that TC established.

TC is the only FDP that currently does not require proof from recipients that their eligible expenses were incurred and then paid. INFC will be at risk of having insufficient funds if the program spends more than the remaining amount of funds which is possible as per the commitments established in the contribution agreements.

INFC has partially reduced the potential risk of lapsed funds due to inaccurate financial forecasts.

It was observed that INFC has not changed its process on how project forecasts are developed. INFC's rationale to maintain its existing practice of relying on each analyst's judgment to assess only the overall reasonableness of a financial forecast is that it is not involved in the logistical details of project management. While the department monitors project progress, budgetary implications, and project scope, INFC is not a decision-maker or advisor to the projects.

There have been efforts made to provide analysts with guidance on how to challenge the reasonableness of forecasts. Sample questions for discussion between the INFC analyst and the project recipient were suggested. Practical tips such as using past experience to identify projects with a history of inaccurate forecasts were provided in an effort to focus resources where they are most needed.

Inaccurate financial project forecasts risk lapsing funds that will not be available to meet INFC's financial commitments under its contribution agreements. The main difference between PAYE and forecasted amounts is that the financial forecasts are significantly larger than PAYE amounts and as such, the financial risk to INFC is proportionally greater.

Management has subsequently begun to address these financial risks. INFC has initiated discussions with TBS to address the implications of the funds already lapsed. In addition, new language regarding appropriations has been included in templates for future contribution agreements. Canada establishes that it may reduce or terminate any payment under the agreement in response to the reduction of appropriations.

Recommendation 1:

It is recommended that the Assistant Deputy Minister (ADM) of Corporate Services continues to work towards a consistent approach to the establishment of PAYE by all Federal Delivery Partners.

Management Response for Recommendation 1:

The ADM of Corporate Services accepts this recommendation. INFC negotiated a consistent approach with all Federal Delivery Partners. Since the end of 2011-12, the Regional Development Agencies have been following the exact same approach as INFC in the establishment of PAYEs. Negotiations with Transport Canada (TC) took a little longer, and it is INFC's understanding that TC adopted a new approach in 2012-13. INFC will follow up and ask TC to provide evidence of the new methodology they have adopted.

Due Date: August 31, 2013

2.2 Information Technology General Controls over Financial Reporting

Integrated Financial Management System (IFMS) is INFC's departmental financial management system. It is used to record departmental financial transactions and to prepare the departmental financial statements.

IFMS is hosted by Industry Canada and therefore, INFC is not the owner of the system. A Memorandum of Understanding (MoU) between Industry Canada and INFC spells out the roles and responsibilities of each department.

The 2012-2013 MoU states that while Industry Canada will share the results of evaluations relating to the application controls of IFMS, the information is expected to be used by INFC to aid in INFC's evaluation of their General Computer Controls (GCCs) as they relate to Internal Controls over Financial Reporting. The MoU language clearly establishes that INFC remains responsible for the GCCs that affect its financial reporting despite not being the system's host. This requirement is in alignment with INFC's existing responsibilities to evaluate its GCCs related to Internal Controls over Financial Reporting under TB's Policy on Internal Control.

In compliance with the requirements of the MoU, Industry Canada's assessment of the design and operational effectiveness of the Information Technology General Controls (ITGCs) within IFMS was performed during the 2011-2012 fiscal year in the report titled "IT General Controls Design & Operational Assessment – Details of controls found to be ineffective". The assessment used walkthroughs to identify whether ITGCs were effectively designed and placed into operation, and whether the ITGCs were operating effectively. The report identified several key processes where ITGC's were effectively designed and operating effectively. However, periodic user validation, change management, and password configuration were identified as key processes where ITGCs were not effectively designed and placed into operation and were not operating effectively. Terminated user access controls were identified as effectively designed and placed into operation but were not operating effectively.

As part of INFC's efforts to meet the requirements of TB's Policy on Internal Control, INFC's Finance and Contracting Division has developed an ITGC Action Plan. The ITGC Action Plan considers all of the information systems that are critical to INFC's operations and financial reporting including the IFMS. To date, the planning and scoping stage as well as the documentation stage have been completed for IFMS. The next phases will include a test of design effectiveness as well as a subsequent test of operating effectiveness. These phases will also include the identification and implementation of appropriate remediation measures.

Management indicated that since INFC is not the system owner, it is unable to resolve the known control deficiencies within IFMS and has minimal influence over the technical design or maintenance of the financial system.

It was expected that INFC would mitigate the known ITGC deficiencies identified within the departmental financial management system which is used for departmental financial records and financial reporting.

Known control deficiencies within IFMS have only been partly mitigated.

INFC acknowledged its responsibility to evaluate IFMS' GCCs as they relate to internal controls over financial reporting as per the requirements of TB's Policy on Internal Control. It was observed that INFC identified remedial measures to help mitigate the risk created by the control design deficiencies identified in the Industry Canada report. The compensating controls include quarterly user access validations for all INFC IFMS users and weekly reviews of INFC Employee Departure forms to ensure IFMS access is terminated upon employee departure.

While these compensating controls will offset the risk associated with the known Periodic User Validation and Terminated User Access control deficiencies, the remedial measures do not address the ITGC design and operational effectiveness deficiencies in the change management and password configuration processes.

ITGCs within the IFMS that are not effectively designed or are not operating effectively may impact the reliability of INFC's financial records. Existing change management processes may not prevent an unintended programming change with financial implications. In addition, the security and integrity of the financial information may be compromised if a password breach was to occur.

Delays in the implementation of INFC's ITGC Action Plan have been caused by insufficient capacity in Finance and Contracting Division.

As part of the ITGC Action Plan, the testing of design effectiveness over IFMS' controls was to be completed by the fourth quarter of 2012-2013. This testing would have included the identification of remedial measures to address control deficiencies. It was observed that completion was delayed due to a lack of available staff to complete the exercise. Consequently, remediation measures have not been identified to date.

Recommendation 2:

It is recommended that the ADM of Corporate Services address the remaining known control weaknesses within the department's financial management system. This can be done by identifying mitigating measures within INFC to compensate for the known IFMS control deficiencies or by working with Industry Canada to address the control weaknesses in IFMS. For the 2014-2015 MoU with Industry Canada, the language should limit INFC's responsibilities to the areas over which INFC has control.

Management Response for Recommendation 2:

The ADM of Corporate Services accepts this recommendation. The department will identify mitigating measures within INFC to compensate for the known IFMS control deficiencies. As well, the 2014-2015 MoU with Industry Canada will include language that limits INFC's responsibilities to the areas over which INFC has control.

Due Date: March 31, 2014

A recommendation to address the impact of capacity issues on the completion of the ITGC Action Plan will be made in Section 2.3.

2.3 Knowledge of Financial Management Processes

As part of INFC's efforts to support the Government's commitment to reduce planned expenditures, INFC implemented its own budget deficit reduction initiative. INFC underwent planned staffing reductions and also experienced other employee departures during the same period. In this context, it is important to ensure that knowledge of the department's financial management processes is formalized and retained.

Key financial management roles and responsibilities need to be performed to effectively meet the financial commitments of the Department. Some key financial processes include financial statement preparation and the monthly Financial Status Report (FSR) process. While the financial statement preparation process occurs mostly within Finance and Contracting Division, the FSR process includes participation from Fund Centre Managers across the entire Department. Consideration must be given to ensure that these key processes are fulfilled and that the appropriate level of performance is maintained even as staff changes occur.

It was expected that INFC would demonstrate that knowledge of its key financial management processes is formalized and retained.

Specific elements of departmental financial statement preparation have been documented.

It was observed that INFC has developed narratives and flowcharts to record how key elements of the departmental financial statements are prepared. The PAYE, Receivable at Year End, Year End Close, and Special Accruals/Entries processes are described in detail. While the flowchart provides the overall procedures for each process, the narrative provides additional context such as participants in the process, internal and external preparation guidance, and detailed descriptions of the control activities.

Monthly reconciliation between financial systems is not formally documented or approved.

The financial transactions that are reported in the departmental financial statements are recorded in IFMS. Financial Planning & Analysis Application (FPAA) is used to manage transfer payment programs. A monthly reconciliation is performed between the systems to ensure that FPAA has complete and accurate financial transfer payment information. It was observed that the monthly reconciliation between FPAA and IFMS was not formally documented nor was it approved at a more senior level to ensure the appropriateness of the reconciling items.

The FSR process does not always follow the approved process.

The monthly FSR data is used by the Department to provide a snapshot of actual financial results compared to the budget. The FSR data is a compilation of the fund centre financial information that is approved by each individual Fund Centre Managers. The monthly fund centre results are compiled into a Departmental FSR that is used to support executive decision-making at the Departmental Management Committee. Finance and Contracting Division has implemented several measures to increase departmental knowledge of how each participant should fulfill their FSR responsibilities. Monthly call letters include guidance and optional meetings are established each month to provide the Fund Centre Managers with an opportunity to address questions or concerns.

It was observed that some Fund Centre Managers did not follow the established approval process for changes to their fund centre's planned expenditures. The standard form to submit changes was not used and the non-standard submission did not establish the Fund Centre Manager's accountability for the rationale behind the change. Furthermore, it was observed that the non-standard submissions consisted of mid-month information rather than the end of month information that the FSR process requires. Finally, it was also observed that the procedures used by Finance and Contracting Division to modify the non-standard mid-month data into month end planned expenditures were not documented and not communicated to a backup employee.

Management explained that the FSR process does not always occur as described in its guidelines because some Fund Centre Managers choose to submit the information in the format that they use to track the data. Within Finance and Contracting Division, the information is modified by one person to accommodate the non-standard submissions. This modified process has not been documented because the informal task is performed by a single person.

Progress has been made documenting key financial processes

INFC has made progress on documenting key financial processes relating to financial reporting. This is due to INFC's efforts to become compliant with TB Policy on Internal Control. Given the focus on financial reporting in the policy, INFC has prioritized those processes. At this time, the internal control work is ongoing and other financial processes will be addressed in the future. The pace at which the work is completed is dependent on capacity issues within the Division. There is a risk that capacity issues may impact the completion of INFC's documentation of processes.

Weaknesses in the retention of financial management process knowledge may impact future performance in Finance and Contracting Division. There is a risk that the monthly reconciliations between FPAA and IFMS which is currently being performed informally by a single person may be overlooked or performed incorrectly as roles change within Finance and Contracting Division. The knowledge required to modify non-standard submissions of mid-month data into month-end changes to planned resources may be lost with employee turnover.

Recommendation 3:

It is recommended that the ADM of Corporate Services implement measures to identify Fund Centre Managers who do not use the standard FSR forms and to provide mandatory one-on-one training sessions to ensure that a consistent approach is applied across the Department in order to establish accountability for the explanation of how each Fund Centre's Planned Expenditures changed.

Management Response for Recommendation 3:

The ADM of Corporate Services accepts this recommendation. One-on-one training sessions are provided to all new fund centre managers (FCMs). This includes training on the use of the standard forms. However, there are existing FCMs that currently use their own forms. F&C will provide targeted training to FCMs who currently do not use the standard form. In addition, F&C will advise these FCMs to adopt the standard forms as non-standard forms will no longer be accepted after December 31, 2013.

Due Date: March 31, 2014

Recommendation 4:

It is recommended that the ADM of Corporate Services complete the documentation of the existing processes as these processes impact the quality of financial results and financial statement reporting including the reconciliation procedures between FPAA and IFMS and the calculation required to modify the non-standard mid-month data for FSR purposes.

Management Response for Recommendation 4:

The ADM of Corporate Services accepts this recommendation. The documentation is not complete for all existing processes. Given the capacity issues facing F&C and the priority to resolve the operating budget situation for the department, this work will be targeted for March 31, 2014.

Due Date: March 31, 2014

Recommendation 5:

It is recommended that the ADM of Corporate Services address capacity issues within Finance and Contracting Division by training backup people to perform key financial management processes such as completion of control testing within the ITGC Action Plan, documentation of key financial processes, and monthly preparation of financial status reports.

Management Response for Recommendation 5:

The ADM of Corporate Services accepts this recommendation. Capacity issues will be addressed within the Finance and Contracting Division by training people as back-ups to perform key financial management processes such as completion of control testing within the ITGC Action Plan, documentation of key financial processes, and monthly preparation of financial status reports.

Since 2011-2012, each group within the Finance and Contracting Division has begun to train people as backups to perform key financial management processes, such as documentation of key financial processes, monthly preparation of financial status report, FSR preparation, salary reports and more. The division will continue its continuous effort in training resources to ensure that every position has a back-up person for the main duties it performs.

With respect to control testing within the ITGC action plan, a professional services contract will be used to perform the control testing. A Financial Analyst from the Internal Control group will be working with the consultant to receive on the job training to develop the skills required to perform control testing as the backup.

Due Date: March 31, 2014

2.4 Optimizing work already performed

The objective of the TB Policy on Internal Control is that risks relating to the stewardship of public resources are adequately managed through effective internal controls, including internal controls over financial reporting. The Deputy Minister is responsible to ensure the establishment, maintenance, monitoring and review of the departmental system of internal control to mitigate risks. The policy identified the effectiveness and efficiency of programs, operations and resource management, including safeguarding of assets as one of the broad categories of the Deputy Minister's responsibility. Financial management internal controls are included as a sub-set of that category. Financial management activities include those of planning, budgeting, accounting, reporting, control, oversight, analysis, decision support/advice, and financial systems.

At INFC, the budgeting and planning processes include the FSR process and the Annual Reference Level Update (ARLU) process. The FSR process requires that monthly financial data for each fund centre is forwarded to the Fund Centre Manager. Each Fund Centre Manager approves the monthly expenses and planned spending information for their fund centre. The Finance and Contracting Division compiles the approved fund centre financial data into a departmental financial snapshot for the month. The departmental level FSR is presented at the Departmental Management Committee for discussion at the Deputy Minister and senior management levels.

INFC's ARLU and Main Estimates processes involve key approvals prior to financial information being submitted to TBS. While the CFO performs most of these key approvals, the Deputy Minister also approves the page proofs that TBS uses to publish INFC's Main Estimates.

INFC uses the Budget Development and Resource Allocation process to divide the confirmed Main Estimates between salary and non-salary expenses and then between the branches. Input into the salary process includes confirmation by each Fund Centre Manager of their planned salary expenses for the medium term. Input into the non-salary expenses includes the approved FSR data and consultations with relevant INFC staff. Draft budget allocations to each fund centre are reviewed at the branch and departmental levels. Final allocations are then approved at the Senior Management level.

It was expected that the financial management internal controls specific to the FSR, ARLU, Main Estimate, and Budget Development and Resource Allocation processes would operate effectively in order to fulfill the Deputy Minister's responsibilities under the TB Policy on Internal Control.

Performance of controls is not always documented

It was observed from walkthroughs of the financial management processes that several key controls in the budgeting and planning processes operated effectively; however, there was no direct evidence available to support the operating effectiveness of some of the key controls.

Within the FSR process, there were isolated incidences where Fund Centre Manager approval of the fund centre level FSR data was not received. While all the other fund centre information was approved and then submitted to Finance and Contracting Division, the missing approvals affected the accountability of the information that was rolled up to a departmental FSR. It was observed that these incidences only affected two monthly Departmental FSR reports. There was no formal documentation to demonstrate that the monthly departmental level FSR was reviewed by the senior levels of the Finance and Contracting Division immediately prior to the CFO's approval. There was no explicit evidence that the CFO approved the monthly departmental FSRs. Indirect evidence was provided for one monthly departmental FSR that was approved at the Departmental Management Committee of which the CFO is a member. The other monthly departmental level FSRs were only presented for discussion at the Departmental Management Committee and did not receive formal approval as recorded in the minutes.

During the ARLU and Main Estimates process, it was observed that there was no formal evidence of the CFO's approval of the Main Estimates submission; however, there was indirect evidence of the CFO's approval in the e-mail that the CFO used to send the Main Estimate submission to TBS.

For the Budget Development and Allocation process, there was no evidence to demonstrate that the draft budget allocation was reviewed by the senior levels of the Finance and Contracting Division prior to the CFO's approval. There was no explicit evidence of the CFO's approval of the draft budget allocations. However, the CFO's approval of the allocation was implied when the CFO presented it for discussion at the Departmental Management Committee. Also, there was no documented approval of the budget allocations by the Deputy Minister.

According to Finance and Contracting Division officials, formal approval is not documented because it is simply an oversight in a Division where the work is already being performed. There is indirect and implied evidence that some of the controls are already operating; however, the formalization of the controls has never occurred because the informal process has worked satisfactorily for Finance and Contracting Division's purposes.

Key financial controls that are being performed informally do not provide adequate evidence to support the operating effectiveness of financial management internal controls or to demonstrate the fulfillment of the Deputy Minister's responsibilities under the TB Policy on Internal Control.

Recommendation 6:

It is recommended that the ADM of Corporate Services formalize the performance of the key controls within INFC's budgeting processes to provide sufficient evidence to demonstrate operating effectiveness of financial management internal controls. The key budgeting processes include the Financial Status Report, Annual Reference Level Update, Main Estimate, and Budget Development and Resource Allocation processes.

Management Response for Recommendation 6:

The ADM of Corporate Services accepts this recommendation. A new process will be implemented that officially documents the review work and approvals at each stage of the key budgeting processes listed above.

Due Date: August 31, 2013

2.5 Budget Deficit Reduction

Budget 2012 highlighted the government's commitment to Responsible Expenditure Management through the Deficit Reduction Action Plan (DRAP) initiative. The goal was a return to balanced budgets over the medium term by enhancing the efficiency and effectiveness of government operations, programs and services which would result in cost savings for the Canadian taxpayer.

While INFC was not subject to the formal DRAP initiative used to identify cost-cutting opportunities, INFC contributed to this initiative through a reduction in annual operating funds.

Budget 2012 required a decrease in INFC's annual budget of $2 million from the 2011-2012 levels of $57 million. The annual budget was set at $55 million for 2012-2013 and will be decreased by an additional $5 million for the 2013-2014 budget of $50 million. In order to respect the new annual budgets, expenditure reductions of salary and non-salary expenses were required.

It was expected that INFC would develop and implement a strategy to respect the reduced budget level.

INFC's budget deficit reduction plan was successfully implemented.

It was observed that INFC met its self-imposed Budget Deficit Reduction goals. The cost-saving strategy was developed and implemented at all levels of the organization.

At the Branch level, opportunities were identified to reduce non-salary expenses by reducing the use of temporary help and professional services contracts. Hospitality, travel, and conference expenses were capped. The budgeted allocation for each employee's training expense was decreased. Plans for branch specific contracts were cancelled. Usage fees were decreased under existing Memorandums of Understanding.

At the Departmental level, non-salary expenses were decreased by re-evaluating the timing and scope of large investment projects. Information Management / Information Technology cancelled a project to develop a departmental information management system given the opportunity to implement GCDocs, the new government-wide document management solutions. Some enhancements to the Department's Shared Information Management System for Infrastructure were deferred while others were frozen for a one year period. The timetable for updating desktop computers was elongated to delay investments in new assets.

Senior Management identified opportunities to reduce staffing costs to respect the decreased future budget levels. Nineteen positions were identified for elimination. While some of the positions were declared surplus immediately, others were identified as being affected under the Selection of Employees for Retention or Lay-Off process. It was observed that at the completion of the budget deficit reduction process, all nineteen positions were declared surplus and the positions were either eliminated or scheduled to be eliminated.

The effect of the budget deficit reduction initiative at INFC is that the Department has positioned itself to support the government's commitment to reduce expenditures while still delivering its infrastructure programs.

3. Audit Conclusion

Based on audit evidence, it was found that INFC's financial management control framework was aligned to and compliant with federal policy and legislative requirements. INFC maintains an adequate system of internal controls and practices to ensure effective and efficient departmental financial management. INFC's financial management control framework produces accurate and timely information that supports departmental decision-making.

Opportunities for improvement to the financial management control framework were identified and help to:

1. Reduce financial risks to INFC by following up with Transport Canada to help ensure that a consistent approach to the establishment of payables at year end is established.
2. Strengthen internal controls related to the financial management system and financial processes within INFC by addressing the remaining known control weaknesses within IFMS and by providing mandatory training sessions for fund centre managers who do not adhere to the existing FSR preparation process.
3. Support the department's preparation for compliance with Treasury Board's Policy on Internal Control by formalizing the performance of the key controls within INFC's budgeting processes and documenting the existing processes that impact the quality of financial results and financial statement reporting.
4. Improve capacity within the Finance & Contracting Division.

4. Statement of Conformance

The audit conforms to the International Standards for the Professional Practice of Internal Auditing and the Internal Auditing Standards for the Government of Canada as supported by the results of INFC's Internal Audit quality assurance and improvement program.

Appendix A: Audit Criteria

Objective 1: INFC's financial management control framework is aligned to and compliant with federal policy and legislative requirements.

• 1.1 INFC's procedures are aligned to and compliant with the expectations and requirements of the Treasury Board Policy on Financial Management Governance.
• 1.2 INFC's procedures are aligned to and compliant with the expectations and requirements of the Treasury Board Policy on Internal Control.
• 1.3 INFC's procedures are aligned to and compliant with the expectations and requirements of the Treasury Board Policy on Financial Resource Management, Information and Reporting.
• 1.4 INFC's procedures are aligned to and compliant with the expectations and requirements of the Treasury Board Policy on the Stewardship of Financial Management Systems.
• 1.5 INFC's procedures are aligned to and compliant with the expectations and requirements of the Treasury Board Policy on Payables At Year End.

Objective 2: INFC maintains an adequate system of internal controls and practices to ensure effective and efficient departmental financial management.

• 2.1 INFC's planning and resource management processes function as intended.
• 2.2 INFC's planning and resource management processes function with due consideration for the current environment of fiscal restraint.
• 2.3 INFC has mitigating controls and practices in place to address the absence of an approved multi-year departmental operating budget.

Objective 3: INFC's financial management control framework produces accurate and timely information that supports departmental decision-making.

• 3.1 INFC's financial management processes support the department's ability to produce timely, accurate and complete financial information in a way that fosters corporate decision-making.