Audit of Delegated Financial Authorities

January 2016

Table of Contents

• Executive Summary
• Background
• Audit Objective and Scope
• Audit Approach
• Sampling Methodology
• Audit Findings
  • Existence of authorities, responsibilities and accountabilities
  • Adequacy of instruments, policies and procedures
  • Compliance with financial authorities
• Conclusion
• Statement of Conformance
• Management Response and Action Plan

1. Executive Summary

The delegation of authority establishes one of the fundamental internal controls in the management of government. The following quote from the Privy Council Office comes from a guide prepared for ministers and ministers of state that outlines their role in their respective departments:

Given the scope and complexity of the powers, duties and functions vested in Ministers, by practical necessity the majority are exercised on the Minister's behalf by departmental officials pursuant to common law principles that have been codified in legislation or pursuant to express delegations of authority from the Minister ^{Footnote 1}.

Delegated authorities empower managers to achieve departmental and government objectives, while maintaining accountability for decisions. Two key types of authorities related to the day-to-day management of government are delegated: financial authorities and human resource authorities.

At Infrastructure Canada (INFC), financial signing authorities are delegated through the departmental Delegation of Financial Signing Authorities. This document is actually comprised of two linked documents, the delegation matrix, approved by the Minister and Deputy Head, as well as an accompanying guide that provides greater context and examples of the various transaction types, as well as details on any applicable restrictions.

Audit Objective and Scope

The audit objective was to provide assurance that INFC was administering its delegated financial signing authorities in accordance with legislative and policy requirements. Specifically, the audit sought to determine whether:

• Authority, responsibility and accountability instruments and policies were established, and documented;
• Internal financial management policies and procedures were adequate, up to date and communicated; and
• Compliance with authorities was monitored.

The scope of this audit covered the period of April 2013 to June 2015, and examined a sample of transactions, as well as departmental policies and procedures, and relevant legislation and policies established by central agencies. Information obtained through December 2015 was also considered as part of the analysis.

Conclusion

The audit found instances where INFC's administration of its delegated financial authorities was not in accordance with legislative and policy requirements.  Specifically, restrictive language in the delegation instrument and the inadequate maintenance of specimen signature cards resulted in the department making payments that were not in accordance with the Financial Administration Act.

Three issues were identified for immediate attention to address non-compliance of legislative or policy requirements. Five additional areas for improvement were also identified.

To address the immediate concerns, it is recommended that the Assistant Deputy Minister (ADM), Corporate Services Branch:

• Revise the delegation instrument to allow payments on transactions that departmental officials are required to make but that the current delegation instrument does not allow.
• Ensure that all specimen signature cards reflect the positions listed in the delegation instrument, and explicitly outline all the authorities being delegated to the individual.
• Review all employees with delegated authority to ensure that required training has been taken and knowledge (re-)validation is complete, where necessary.

The four areas for improvement focus on enhancing the clarity of the delegation instrument and internal processes, and developing department specific training or guidance for delegated managers.

The audit also recommends that the ADM, Corporate Services Branch:

• Consider revising the wording of sections within the delegation instrument that are inconsistent with other departmental or government policy.
• Update the procedures related to the administration of financial signing authority delegation, journal vouchers, and awards.
• Develop a training/guidance/awareness package for officials with delegated financial signing authority.
• Establish a monitoring or quality assurance process related to invoice verification and payment.

The audit further recommends that the ADM, Corporate Services Branch, ADM, Policy and Communications Branch, ADM, Program Operations Branch, ADM, Federal Montreal Bridges, and DG, Audit and Evaluation reinforce with their employees the responsibilities and accountabilities expected in the exercising of delegated financial signing authorities.

2. Background

Introduction

The delegation of authority establishes one of the fundamental internal controls in the management of government. The following quote from the Privy Council Office comes from a guide prepared for ministers and ministers of state that outlines their role in in their respective departments:

Given the scope and complexity of the powers, duties and functions vested in Ministers, by practical necessity the majority are exercised on the Minister's behalf by departmental officials pursuant to common law principles that have been codified in legislation or pursuant to express delegations of authority from the Minister.^Footnote2

Delegated authorities empower managers to achieve departmental and government objectives, while maintaining accountability for decisions.

Two key authorities related to the day-to-day management of government are delegated: financial authorities and human resource authorities.

Financial Delegated Authorities

The Treasury Board Directive on Delegation of Financial Authorities for Disbursements, along with other supporting policy instruments, outlines the general principles and elements of financial signing authority in the federal government. There are three main aspects to financial authorities:

Spending authority which encompasses three elements:

• expenditure initiation: the authority to incur an expenditure or to make an obligation to obtain goods or services that will result in the eventual expenditure of funds;
• commitment authority: the authority to carry out one or more specific functions related to the control of financial commitments (namely section 32 of the Financial Administration Act); and
• transaction authority: the authority to enter into contracts, including acquisition card purchases, or sign-off on legal entitlements.

Certification authority: the authority, according to section 34 of the Financial Administration Act to certify, before payment, contract performance and price, entitlement or eligibility for the payment. The ability to exercise section 34 authority is generally limited to specific fund centres.

Payment Authority: the authority to requisition payments according to section 33 of the Financial Administration Act. Generally, higher value transactions require approval at a higher level.

Departmental Context

INFC's 2015-2016 Report on Plans and Priorities reported 370 employees and planned spending in excess of $3.6 billion. The department has six Senior Executives at the Deputy Minister, Associate Deputy Minister and Assistant Deputy Minister levels and 27 executives at the Director and Director General levels. Supporting the executive level are managers at various groups and levels throughout the department.

Financial signing authorities were delegated to positions at INFC through the Delegation of Financial Signing Authorities, which is actually comprised of two linked documents:

• The delegation matrix, approved by the Minister and Deputy Head (DH), which provides an overview of transactions types, and specifies which positions have full, restricted (limited), or no authority.
• An accompanying guide that provides greater context and examples of the various transaction types, as well as details on any applicable restrictions.

Both documents explicitly stipulate that they are to be read in conjunction with each other.

The current delegation instrument provisions 32 specific authorities (generally transaction types) across six generic management authorities (which follows the departmental management hierarchy), and seven functional authorities (such as specific authorities for the chief financial officer, manager of contracting, the director general of human resources, and designated financial officers).

For example:

• Administrative assistants often have commitment authority (section 32 of the Financial Administration Act),
• Executives and most managers have certification authority (section 34 of the Financial Administration Act),
• Only Designated Financial Officers, Deputy Chief Financial Officer (DCFO), and Chief Financial Officer (CFO) have payment authority (section 33 of the Financial Administration Act).

Individuals are granted delegated financial signing authority once a signature specimen card, which links an individual to a position named in the Delegation of Financial Signing Authorities, is authorized. The specimen signature card outlines the individuals name, effective date of authority, the fund centre(s) where authority is applicable, and any additional restrictions above and beyond those included in the delegation instrument.

Delegated authority follows the hierarchical nature of fund centres; that is, positions delegated authority also have authority on all fund centres that are downstream in their respective hierarchy.

Table 1: Example of Fund Centre Hierarchy

Fund Centre Name	Fund Centre Number	Delegated individual has authority for
Branch X	1000	1000, 1100, and 1110
Directorate Y	1100	1100 and 1110
Section Z	1110	1110

Key Roles and Responsibilities

DHs are responsible for establishing the management framework within their respective departments, and Treasury Board mandates that CFOs support their DH in the management of delegated authorities.

3. Audit Objective and Scope

The overall audit objective was to provide assurance that INFC was administering its delegated financial signing authorities in accordance with legislative and policy requirements. Specifically, the audit sought to determine whether:

• Authority, responsibility and accountability instruments and policies were established, and documented;
• Internal financial management policies and procedures were adequate, up to date and communicated; and
• Compliance with authorities was monitored.

The scope of this audit covered the period of April 2013 to June 2015, and examined a sample of transactions, as well as departmental policies and procedures, and relevant legislation and policies established by central agencies. Information obtained through December 2015 was also considered as part of the analysis.

Transactions related to payroll and personnel (including, but not limited to, regular pay, overtime, employee benefits and deductions, and leave related transactions) were not included as INFC is scheduled to convert to the new Government of Canada pay system in April 2016.

This audit was conducted in accordance with INFC's Risk-Based Audit Plan 2015–2018.

4. Audit Approach

The approach and methodology used conforms to generally accepted practices, processes, procedures and standards of internal audit in the Government of Canada, and conforms to the Treasury Board Policy on Internal Audit and the Institute of Internal Auditors International Standards for the Professional Practice of Internal Auditing.

The Treasury Board Directive on Delegation of Financial Authorities for Disbursements, Treasury Board Directive on Expenditure Initiation and Commitment Control, Treasury Board Directive on the Administration of Required Training and INFC's Delegation of Financial Signing Authorities were the main sources of audit criteria used in this audit. In addition, the Office of the Comptroller General's most recent version of the Core Management Controls and relevant practices and reports from other Government of Canada Departments and Agencies were also consulted.

The audit work was conducted in three phases – planning, examination, and reporting - with deliverables prepared at key points. The planning phase included interviews with INFC officials, document review and an audit risk assessment. The audit plan was presented to the client to validate facts and to confirm the accuracy and completeness of the information prepared.

The examination phase included various tests as necessary to provide reasonable assurance on the administration of delegated financial signing authorities. Auditors interviewed departmental officials, reviewed documentation and conducted process walk-throughs.

5. Sampling Methodology

A sample of financial transactions was selected from all transactions input into the departmental financial system.

All transactions include object coding, which is a government-wide coding block that identifies the type of goods or services acquired, the transfer payments made, the source of revenue, or the cause of increases or decreases in assets and liabilities. Four levels of object coding classification are used, in descending order of aggregation: categories, sub-categories, reporting objects, and economic objects.

The primary selection criterion was the economic object coding of the transaction. This consideration permitted for the segmentation of the population and allowed internal audit to focus on areas of higher risk. The areas selected were judgmental, based on internal audit's assessment of the relative risk of the transaction(s).

The secondary consideration was any authority limitations, specifically amount, and items with specific expenditure initiation requirements. This consideration helped focus on transactions that are subject to more stringent rules.

Where appropriate and possible, transactions from a variety of fund centres were selected. Consideration was also given to how fund centres rolled up to help determine if issues are isolated to specific branches or directorates, or are more systemic in nature.

To ensure that a broad range of branches and fund centres were captured in the sample, the random sample generated was larger than needed. If a branch or fund centre was not over represented (using auditor judgement), the additional transactions in the sample were discarded. However, if a branch or fund centre was over represented, a transaction involving that branch or fund centre was removed (judgmentally) and replaced with one of the additional randomly selected transactions.

For each category of transaction, a number of transactions were selected, with a total sample of 123. The number of transactions per year was roughly apportioned to the relative number of transactions per fiscal year in scope.

The delegated financial authority sample is summarized in table 2.

Table 2: Sample vs. Population

	Sample			Sample as a percentage of the population
Object Sub Category	#	Value		#	Value
Acquisition of Land, Buildings and Works	5	$1,362,840		25.00%	10.29%
Acquisition of Machinery & Equipment	5	208,796		0.51%	9.80%
Information	5	9,702		0.58%	1.79%
Materials and Supplies	10	2,100		0.54%	1.06%
Other Expenditures From Internal Sources or for Accounting Purposes	1	12,582		0.27%	-1.01%
Other Subsidies and Payments	10	1,620		0.29%	1.78%
Professional and Special Services	17	3,470,395		0.38%	6.57%
Purchased Repair and Maintenance	5	6,285		6.41%	8.97%
Rentals	10	246,429		0.76%	6.90%
Transportation and Telecommunications	18	66,135		0.21%	7.79%
Total	86	$ 5,386,884		0.39%	7.46%

Transfer Payments…
…to Industry	5	$5,174,048		25.00%	44.80%
…to Municipalities and Local Organizations	10	311,087,421		3.18%	11.96%
…to Organizations, Including Crown Corporations and Non-Profit Organizations	5	4,373,292		3.05%	3.07%
…to Provinces and Territories	12	185,232,022		1.64%	4.92%
Total Transfer Payments	32	$505,866,783		2.60%	7.76%

Transfers to JCCBI
Transfers to Crown Corporations and Other Entities	5	$206,390,518		5.81%	63.98%
Grand Total	123	$ 717,644,185

6. Audit Findings

Existence of authorities, responsibilities and accountabilities

Audit criterion

It was expected that authority, responsibility and accountability instruments were established, and documented. Specifically:

• Delegated authorities were written, and approved by the appropriate authority;
• The delegation instrument was clear in the communication of the delegated authorities;
• Delegated authorities were aligned with roles and responsibilities; and
• There was appropriate segregation of duties related to the exercise of delegated authorities.

Delegated authority approval

The Delegation of Financial Signing Authorities is the written delegation of financial signing authority at INFC. The most recent version was approved by the Minister on February 25, 2015.

Clarity of the delegation instrument

Generally the delegation instrument was found to be clear. However, there are two exceptions:

Payments to Crown Corporations

In February 2014, responsibility for the New Bridge for the St. Lawrence Corridor project transferred from Transport Canada to INFC. As part of that change, INFC became responsible for the oversight of JCCBI, a federal crown corporation.

Prior to February 2014, INFC did not have any crown corporations that reported through its Minister, and as such, the delegation instrument at that time did not make provisions for payments to crown corporations. INFC released payments to JCCBI without the express delegated authority from the Minister to do so, which is not in compliance with the Financial Administration Act (FAA). It should be noted that the individuals that signed off on those payments held the positions that would have had authority to sign off on those types of payments, had the delegation instrument allowed payments to crown corporations.

This situation was caused by restrictive wording of certain provisions in INFC's Delegation of Financial Signing Authorities; in particular the wording around the authority to sign-off on sections 34 and 33 of the FAA. Prior to the transfer of JCCBI, the restrictive wording had not been a problem, as the department had not encountered transactions that differed from those expected and provisioned for in the delegation instrument.

Risk and Impact:

Unless the delegation instrument is updated, INFC officials are unable to legally make payments that they are required to make.

Events

The approval thresholds indicated in the delegation instrument do not align with approval thresholds outlined in INFC's Events Directive. The delegation instrument does indicate that the delegation instrument only outlines the maximum authority granted to a position, and that additional restrictions may also be in effect. In addition, the delegation instrument as well as the specimen signature cards, indicate that it is up to the incumbent exercising the authority to ensure all restrictions (whether from the delegation matrix, or from some other source) are complied with.

As there have been recent changes in the process for recommending and approving events and training expenditures, there is an opportunity to align both documents.

Alignment of delegated authorities

The positions indicated in the Delegation of Financial Signing Authorities generally align with the management hierarchy in the department, where each level of responsibility reasonably coincided with the respective level of management.

Treasury Board Policy requires that delegation of financial signing authorities be risk based. The current process to update the delegation instrument involves consultation within the department as well as a comparison of what INFC's portfolio partner, Transport Canada, has done.

The level of responsibilities and accountabilities coincided to what was expected and there was documented evidence that a risk assessment took place.

Segregation of duties

Segregation of duties is a core control concept which states that certain activities should be separated and performed by different individuals (or groups) to minimize the risk of fraud or error.

The delegation instrument generally segregates incompatible functions. For example, where it does not (such as authorities granted to the DH), there is an explicit clause that states incompatible functions cannot be exercised together, even if the person has been otherwise granted all the authorities.

The current segregation of duties meets all mandatory legislative and policy requirements; however, the recommended segregation of duties, as outlined in the Treasury Board Directive on Delegation of Financial Authorities for Disbursements is not met in one instance. Transaction (contracting) authority and certification (FAA section 34) authority are able to be shared by an individual. While INFC has created a compensating control, where the departmental contracting group inspects all contract related invoices against the corresponding contract prior to recommending payment, the Treasury Board directive recommends formalized segregation of those authorities for an organization the size of the department.

Risk and Impact:

Internal audit is planning on conducting an audit of procurement in the next fiscal year, and will examine what, if any, risks relate to this finding. It will also examine whether the existing compensating control is sufficient.

Recommendation 1. It is recommended that the ADM, Corporate Services Branch revise the delegation instrument to allow payments on transactions the current delegation instrument does not permit. This will ensure that INFC is able to legally make payments that it is required to make.

Recommendation 2. It is recommended that the ADM, Corporate Services Branch consider revising the delegation instrument to modify inconsistent wording between other departmental or government policy. This will reduce the likelihood of error and ensure clarity on any restrictions.

Adequacy of instruments, policies and procedures

Audit criterion

It was expected that authority instruments and related policies and procedures were adequate, up to date, and communicated. Specifically:

• Delegation instruments were compatible with the organizational structure;
• Applicable policies or procedures were maintained, kept current and made available to persons with delegated authority;
• There was an effective process for the management of specimen signature cards;
• Delegated authorities were communicated to officials in a timely manner and made available to them;
• Individuals were designated to exercise authority only after they have acquired the requisite training; and
• There was a process in place to regularly review and consult on delegation authority instruments.

Alignment of delegated authorities

The 2015 Delegation of Financial Signing Authorities merged the Delegation of Financial Signing Authorities and Delegation of Contracting and Material Authorities into a single instrument. It also renamed a number of official position titles, and created a few new positions. While these changes modified the matrix, they did not fundamentally change how the instrument was read or applied.

The change in position titles created a situation where many individual signature cards no longer align to the matrix. While in most cases it is easy to infer what the new position would be, that is not always the case. Transactions involving individuals exercising authority that is not clearly and explicitly delegated to them are not in accordance with the FAA. If signature cards are updated to align with the position titles indicated in the Delegation of Financial Signing Authorities, there would be a close alignment between positions listed in the matrix, and the organization structure of the Department.

In addition, in February 2015, when the Minister approved an update to the Delegation of Financial Signing Authorities, there was a change which lowered the authority to certify payment (section 34 of the FAA) on certain transfer payments from the Assistant Deputy Minister-level to some Director and Director General-level positions. The individual specimen signature cards were not updated at the same time. As the authority of an individual to exercise delegated authority is limited to what authorities are explicitly granted on the relevant specimen signature card, we found seven instances where employees exercised delegated financial signing authority they did not have. In these instances, the payments were technically not in compliance with the FAA. However, the individuals that certified payments would have been able to, had the administrative actions been taken to update their specimen signature cards.

Risk and Impact:

Individuals are only able to exercise authority explicitly granted through the relevant specimen signature card. Any transaction authorized by an individual without the explicit authority to do so would not be in compliance with the FAA.

Procedures are maintained, kept current and made available

We found a lack of clarity around procedure documents. Specifically, the procedures related to the management of specimen signature cards, journal vouchers and awards.

Management of specimen signature cards

There is a procedures document that governs the creation, maintenance, or implementation of the delegated financial signing authorities, however, it has not been updated since 2007, and the procedures outlined therein are not being followed. The lack of an up-to-date procedures document was identified as an issue during the 2013-14 internal control assessment, and an action plan was developed to update the procedures document. The due date for the update was initially December 2014, but was subsequently extended to March 2016.

Journal Vouchers

A journal voucher is not a charge against the department, but rather is used to adjust existing entries for incorrect coding (for instance, wrong fund centre), and/or changes in financial coding (such as work-in-progress transfers from assets under construction to capital assets).

With journal vouchers, payment has generally already been made. However, journal vouchers can potentially change the appropriation and/or expenditure category against which the transaction has been charged, and is therefore subject to limitations outlined in the Delegation of Financial Signing Authorities. Internal audit noted five instances in our sample where journal voucher transactions had FAA section 33 sign-off by individuals not authorized to do so. There is a procedure document for the creation and processing of journal vouchers, but it does not adequately address the issue of transaction authorization.

Instant and Informal Awards

Instant and informal award purchasing is centralized within the Human Resources and Administration Directorate, however, the costs incurred are charged directly to the fund centre where the employee works. Four of the 10 transactions in our sample found instances where an individual in the Human Resource and Administration directorate authorized transactions against fund centres where they had no authority.

Risk and Impact:

Up-to-date, well maintained, and easily accessible policy and procedure documents are a key element of an efficient and effective business process. These documents clearly articulate the expectations of management. Failure to follow established procedures increases the likelihood that legislative or policy requirements are not met.

Management of specimen signature cards

We found specimen signature cards were not well maintained. The signature cards are organized by name of the delegated individual and not by fund centre, which makes it difficult to determine who had delegated authority over a particular fund centre at any given time. We also noted during our testing that four signature cards related to transactions in our sample were missing.

We also noted situations where delegated authorities were not removed in a timely manner. For instance, we found multiple instances of signature cards that had not been de-activated after the individuals had changed positions, or left the department.

Risk and Impact:

Failure to remove authority in a timely manner places the department at risk of an employee authorizing transactions that they should otherwise not be exercising. It also leaves INFC in non-compliance with Treasury Board Policy.

Communication of delegated authorities

Once approved by the Minister, the Delegation of Financial Signing Authorities is posted on INFC's intranet, and accessible to all employees.

The signature specimen card that gives individuals delegated financial signing authority also includes a statement with the signature that individuals exercising delegated authorities must comply with INFC's Delegation of Financial Signing Authorities, as well as relevant federal statutes, Treasury Board or other Central Agencies and departmental policies, directives, regulations and bulletins.

Training and guidance on delegated authorities

The Treasury Board Directive on Delegation of Financial Authorities for Disbursements requires that no person exercise delegated authorities unless he or she has successfully completed the required training or has validated knowledge associated with his or her professional or legal responsibilities.

The Treasury Board Directive on the Administration of Required Training states that an employee who exercises delegated signing authority in finances is responsible for fulfilling the duties of their position with the exception of delegated signing authorities until successful completion of required training. The Canada School of Public Service (CSPS) is identified as the body to provide the required training, and the directive stipulates that the assessment and validation of the knowledge as related to delegated signing authorities occurs at least once every five years.

The requirement to ensure that employees completed all mandatory training prior to being granted delegated authority has not been consistently followed. We found multiple instances where employees had been granted and exercised delegated authority without having completed the necessary training, particularly amongst employees that exercise commitment authority (section 32 of the FAA), and payment authority (section 33 of the FAA). These are generally exercised by positions in administrative support, and accounting operations, respectively.

While the CSPS training provides a good overview of delegation, it is not necessarily reflective of the day-to-day operating environment of INFC. During interviews it was noted that some employees may not clearly understand the delegated authorities they are expected to exercise and the related responsibilities and accountabilities that flow for exercising delegated authorities. This comment is also supported by some of the isolated errors we found in our sample. Given these findings, departmental specific training/guidance/awareness would be helpful for those with delegated authorities.

Risk and Impact:

Treasury Board policy states that employees are not able to exercise delegated financial signing authorities unless the employee has successfully completed the assessment and validation of the knowledge related to delegated signing authorities at least once every five years. Any transactions authorized by individuals without the necessary training would not be in compliance with both Treasury Board Policy and the FAA and increases the risk of errors and fraud, potentially having an impact on INFC's financial statements.

Process in place to review the delegation instrument

The Treasury Board Directive on Delegation of Financial Authorities for Disbursements requires that the delegation instrument, and related matrices, signature cards, and associated processes be reviewed at least annually. Currently, there is no formal process to review the finance delegation instrument. A review is conducted at least annually, or when warranted, however, unless that review results in changes there is likely no evidence to support the review took place.

Between updates to the delegation instrument, the Policy and Internal Control team keeps note of non-urgent changes that are to be considered when the instrument is next updated.

Risk and Impact:

Failure to document the review puts INFC at risk of not being able to demonstrate that the review took place, which is a requirement of Treasury Board Policy.

Recommendation 3. It is recommended that the ADM, Corporate Services Branch ensure that all specimen signature cards reflect the positions listed in the delegation instrument, as well as explicitly outlining all the authorities being delegated to the individual. Without accurate and up-to-date signature specimen cards, transactions may not be in compliance with the Financial Administration Act.

Recommendation 4. It is recommended that the ADM Corporate Services Branch create or update the procedures related to the administration of delegated financial signing authority, journal vouchers, and awards. Clear procedures are needed to ensure that legislative, as well as departmental and Treasury Board policy requirements are being adhered to.

Recommendation 5. It is recommended that the ADM, Corporate Services Branch review all employees with delegated authority to ensure that all required training has been taken and knowledge (re-)validation is complete, where necessary.

We further recommend that employees without the necessary training not exercise delegated authorities until the required training is successfully completed.

Recommendation 6. It is recommended that the ADM, Corporate Services Branch develop a training/guidance/awareness package for officials with delegated financial signing authority.

Compliance with financial authorities

Audit criterion

It was expected that compliance with financial management legislation, policies and authorities was monitored. Specifically:

• There was a formal process for monitoring compliance of the delegation of authorities and related legislation, policies and authorities; and
• Results of quality assurance and monitoring were reported in a timely manner to finance officials, as well as senior management.

Formal process for monitoring

The current process has the Accounting Operations area performing 100% invoice verification before processing payments. As such, no additional quality assurance or monitoring process exists.

There is a quasi-independent group within the Accounting Operations and Systems group, the Policy and Internal Control team, that performs testing in support of the Treasury Board Policy on Internal Control. This group tests the design and operation of various controls, including the sampling of individual transactions to test compliance with legislation, as well as departmental and central agency policy. There is evidence that the Policy and Internal Control team does find and follow up on control failures; however, that is not an appropriate substitution for a formal quality assurance or monitoring process. That being said, there is evidence from this and previous internal audits, where accounting operations staff have flagged and sought correction of various issues.

Risk and Impact:

Failure to periodically monitor compliance of the invoice verification and payment process could result in INFC making payments that are not in compliance with legislation, departmental or central agency policy.

During the review of transactions, internal audit noted several isolated deficiencies, such as individuals exercising acting authority without there being records that the acting had been invoked following the departmental process, and an individual certifying payment where the individual received personal benefit from the transaction (a training course, where pre-registration approval was received at the appropriate level, but the actual payment was certified by the person that received the training).

These isolated incidences were generally related to how delegated authorities were applied under specific circumstances, in particular issues related to spending and certification authority (notably sections 32 and 34 of the FAA).

Risk and Impact:

While the Accounting Operations group does have a monitoring and control role, responsibility and accountability ultimately falls on the individual that exercised the delegated financial signing authority. As each step in the payment process builds on the last, it is essential that the proper level of care and due diligence be performed by all individuals with delegated financial signing authorities, to minimize errors and comply with the FAA and other policies and directives.

Recommendation 7a. It is recommended that the ADM, Corporate Services Branch establish a monitoring or quality assurance process related to invoice verification and payment.

Recommendation 7b. It is recommended that the ADM, Corporate Services Branch, ADM, Policy and Communications Branch, ADM, Programs Operation Branch, ADM Federal Montreal Bridges, and DG, Audit and Evaluation reinforce with their employees the responsibilities and accountabilities expected in the exercising of delegated financial signing authorities.

7. Conclusion

The audit found instances where INFC's administration of its delegated financial authorities was not in accordance with legislative and policy requirements. Specifically, restrictive language in the delegation instrument and the inadequate maintenance of specimen signature cards resulted in the department making payments that were not in accordance with the FAA.

Three issues were identified for immediate attention to address non-compliance of legislative or policy requirements. Four additional areas for improvement were also identified.

To address the immediate concerns, it is recommended that the ADM, Corporate Services Branch:

• Revise the delegation instrument to allow payment on transactions that departmental officials are required to make but that the current delegation instrument does not allow.
• Ensure that all specimen signature cards reflect the positions listed in the delegation instrument, and explicitly outline all the authorities being delegated to the individual.
• Review all employees with delegated authority to ensure that required training has been taken and knowledge (re-)validation is complete, where necessary.

The four areas for improvement focus on enhancing the clarity of the delegation instrument and internal processes, and developing department specific training or guidance for delegated managers.

The audit also recommends that the ADM, Corporate Services Branch:

• Consider revising the wording of sections within the delegation instrument that are inconsistent with other departmental or government policy.
• Update the procedures related to the administration of financial signing authority delegation, journal vouchers, and awards.
• Develop a training/guidance/awareness package for officials with delegated financial signing authority.
• Establish a monitoring or quality assurance process related to invoice verification and payment.

The audit further recommends that the ADM, Corporate Services Branch, ADM, Policy and Communications Branch, ADM, Programs Operation Branch, ADM, Federal Montreal Bridges, and DG, Audit and Evaluation reinforce with their employees the responsibilities and accountabilities expected in the exercising of delegated financial signing authorities.

8. Statement of Conformance

This audit conforms to the International Standards for the Professional Practice of Internal Auditing and the Internal Auditing Standards for the Government of Canada as supported by the results of the quality assurance and improvement program.

9. Management Response and Action Plan

#	Recommendation	Management Response and Action Plan	OPI and Due Date
1	It is recommended that the ADM, Corporate Services Branch revise the delegation instrument to allow payments on transactions the current delegation instrument does not permit. This will ensure that INFC is able to legally make payments that it is required to make.	ADM Corporate Services agrees and accepts this recommendation. The revised delegation instrument to be approved in February 2016 by the Minister of Infrastructure and Communities includes modifications (specifically to section 34) to allow INFC to legally make payments.	ADM, Corporate Services Branch Targeted completion date: February 29, 2016
2	It is recommended that the ADM, Corporate Services Branch consider revising the delegation instrument to modify inconsistent wording between other departmental or government policy. This will reduce the likelihood of error and ensure clarity on any restrictions.	ADM Corporate Services agrees and accepts this recommendation. No changes are required to the delegation instrument. The out-of-date Events Directive was removed from the INFRAnet in December 2015. New Events procedures will be provided to HMC for approval and published on the INFRAnet.	ADM, Corporate Services Branch Targeted completion date: March 31, 2016
3	It is recommended that the ADM, Corporate Services Branch ensures that all specimen signature cards reflect the positions listed in the delegation instrument, as well as explicitly outlining all the authorities being delegated to the individual. Without accurate and up-to-date signature specimen cards, transactions may not be in compliance with the Financial Administration Act.	ADM Corporate Services agrees and accepts this recommendation. A new signature card template was finalized in Fall 2015 (which is currently being used for new employee signature cards) which reflects the positions listed in the instrument, and explicitly outlines all authorities delegated to the individual. Once the updated delegation instrument is signed by the Minister of Infrastructure and Communities in February 2016, all signature cards will be revised using the new template.	ADM, Corporate Services Branch Targeted completion date: March 31, 2016
4	It is recommended that the ADM Corporate Services Branch create or update the procedures related to the administration of delegated financial signing authority, journal vouchers, and awards. Clear procedures are needed to ensure that legislative, as well as departmental and Treasury Board policy requirements are being adhered to.	ADM Corporate Services agrees and accepts this recommendation. A procedure for the administration of financial signing authority delegation was drafted in December 2015 and will be shared with HR in January 2016 to ensure accountabilities and responsibilities are clearly identified. In addition, the account verification procedures will be updated to include sections on journal vouchers and awards.	ADM, Corporate Services Branch Targeted completion date: March 31, 2016
5	It is recommended that the ADM, Corporate Services Branch review all employees with delegated authority to ensure that all required training has been taken and knowledge (re-)validation is complete, where necessary. We further recommend that employees without the necessary training not exercise delegated authorities until the required training is successfully completed.	ADM Corporate Services agrees and accepts this recommendation. The new signature card template includes the expiry date of the required training for each employee with delegated authority. Finance will work with HR to ensure information related to the required training is communicated to Finance in a timely manner. A procedure for the administration of financial signing authority delegation will be drafted which will include information about the consequences of not having the required training.	ADM, Corporate Services Branch Targeted completion date: March 31, 2016
6	It is recommended that the ADM, Corporate Services Branch develop a training/guidance/awareness package for officials with delegated financial signing authority.	ADM Corporate Services agrees and accepts this recommendation. A package for officials with delegated financial signing authority will be developed and shared with employees.	ADM, Corporate Services Branch Targeted completion date: July 31, 2016
7a	It is recommended that the ADM, Corporate Services Branch establish a monitoring or quality assurance process related to invoice verification and payment.	ADM Corporate Services agrees and accepts this recommendation. A monitoring or quality assurance process will be implemented within Finance. Remediation will be defined for employees who do not exercise their delegated authority in accordance with the delegation instrument.	ADM, Corporate Services Branch Targeted completion date: June 30, 2016
7b	It is recommended that the ADM, Corporate Services Branch, ADM, Policy and Communications Branch, ADM, Programs Operation Branch, ADM Federal Montreal Bridges, and DG, Audit and Evaluation reinforce with their employees the responsibilities and accountabilities expected in the exercising of delegated financial signing authorities.	The OPIs will reinforce with their employees their responsibilities and accountabilities associated with delegated authorities. The audit reports will also be presented to the Horizontal Implementation Committee and the Horizontal Management Committee to increase awareness.	ADM, Corporate Services Branch, ADM, Policy and Communications Branch, ADM, Programs Operation Branch, ADM, Federal Montreal Bridges, and DG, Audit and Evaluation Targeted completion date: March 31, 2016

Terms used in management action plans:
INFRAnet: Infrastructure Canada’s intranet
HMC Horizontal Management Committee: A committee of director and director general-level employees from across the department.