Parks Canada
Symbol of the Government of Canada

Common menu bar links

Internal Audit and Evaluation Documents

Audit of Key Financial Processes at the Quebec Service Centre

Final Report
November 2009

By:
Office of Internal Audit and Evaluation

Table of Contents

Executive Summary

1. Background

2. Objectives and Scope

3. Methodology

4. Assurance Statement

5. Conclusion

6. Findings and Recommendations

6.1 Management Control Framework
6.2 Hospitality and food
6.3 Telecommunications
6.4 Inventory
6.5 Contracting
6.6 Payments to Suppliers
6.7 Financial Coding

Printable Version


Note: To read the PDF version you need Adobe Acrobat Reader on your system.

If the Adobe download site is not accessible to you, you can download Acrobat Reader from an accessible page.

If you choose not to use Acrobat Reader you can have the PDF file converted to HTML or ASCII text by using one of the conversion services offered by Adobe.



Report approved by the Chief Executive Officer of Parks Canada, 2009

Executive Summary

Parks Canada Agency (PCA) is conducting a series of cyclical audits of field units, service centres and the various branches of national and regional offices to review key financial, administrative and management practices. The audits focus on compliance with Treasury Board of Canada Secretariat (TBS) and PCA policies and practices. The audit of the Quebec Service Centre was conducted as part of this cyclical audit program.

The objective of this audit was to determine whether due diligence is being exercised in key management processes at the Quebec Service Centre (QSC) and whether the processes and controls in place are adequate to ensure compliance with TBS and PCA policies.

To achieve this, the audit reviewed the management control framework in place and covered the following key financial process areas: hospitality and food, telecommunications, inventory management, contracting, payments to suppliers, and financial coding. This audit covered primarily the period extending from April 1, 2008, to March 31, 2009.

The audit methodology included a review of relevant background documentation, interviews with Quebec Service Centre staff and the Office of the Chief Information Officer (OCIO) as well as a sampling of transactions in the key financial process areas. The visit to the Quebec Service Centre took place from June 15 to 19, 2009.

In our opinion, sufficient audit work has been performed and the necessary evidence has been gathered to support the conclusions contained in this audit report.

Overall, we found that the financial and administrative functions are effective enough to ensure due diligence with respect to the application of most of the management processes examined as well as to guarantee to executive management that the controls in place at the Quebec Service Centre are adequate to ensure compliance with TBS and PCA policies and practices.

However, we identified one financial process (telecommunications) requiring improvements to current processes in order to strengthen controls and improve compliance with existing policies. Specific recommendations have been made to the Director of the Quebec Service Centre as well as to the Chief Information Officer. A separate rating was given to the service centre and the Office of the Chief Information Officer in order to reflect the current situation.

Audit Reporting Rating Summary for the Quebec Service Centre:

Ref Management Process Rating
6.1 Management control framework BLUE – Minor Improvements Needed
6.2 Hospitality and food GREEN – Controlled
6.3 Telecommunications – QSC BLUE – Minor Improvements Needed
Telecommunications – OCIO YELLOW – Moderate Improvements Needed
6.4 Inventory BLUE – Minor Improvements Needed
6.5 Contracting GREEN – Controlled
6.6 Payments to suppliers BLUE – Minor Improvements Needed
6.7 Financial coding GREEN - Controlled

Below is the list of recommendations made in the report to the Director of the Quebec Service Centre and the Chief Information Officer:

The Director of the Quebec Service Centre must:

1)
Ensure that a current organizational chart is maintained in order to clearly identify the roles and responsibilities of team members.

2)
Ensure that the appropriate delegations of authority are in place in order to ensure compliant practices.

3)
Implement a process to ensure that users acknowledge their obligation with respect to the Policy on the Use of Cellular and Other Mobile Wireless Devices.

4)
Implement a random check process for monthly statements in order to ensure appropriate use of wireless devices.

8)
Ensure that equipment transfers are recorded in the maintenance module of the STAR financial system within a reasonable timeframe.

9)
Ensure that a physical inventory is conducted every two years in order to confirm the existence of the property recorded in the ledgers.

10)
Ensure that the date of receipt appears on invoices in order to be able to follow the chronology of transactions.

11)
Ensure that supporting documents are detailed enough to confirm the type of expense.

12)
Assess the option of introducing a register for acquisition cards (STAR or in-house forms) in order to facilitate reconciliation with the statement of account as well as input into the financial system.

13)
Ensure that the signature of the person with spending authority is clearly indicated for an acquisition card payment involving purchases for more than one cost centre.

The Chief Information Officer must:

5)
Ensure the standardization of all acquisition requests for wireless devices (including cell phones) in order to properly document the required information.


6)
Ensure that non-standard requests receive the necessary approval by the CIO before proceeding with PWGSC.

7)
Implement a system to monitor the acquisition and use of wireless devices in order to ensure policy compliance by the designated administrators.

1. Background

Parks Canada Agency (PCA) is conducting a series of cyclical audits of field units, service centres and the various branches of national and regional offices to review key financial, administrative and management practices. The audit of the Quebec Service Centre was conducted as part of this cyclical audit program.

Field units are groupings of national parks, national historic sites and national marine conservation areas that are usually near one another. Their proximity allows them to share management and administrative resources. The service centres support the organization in a variety of professional and technical disciplines. It is the responsibility of the Service Centre Directors and the Field Unit Superintendents to ensure that the policies, directives and guidelines issued by the Treasury Board of Canada Secretariat (TBS) and PCA are followed.

2. Objectives and Scope

The objectives of this audit were to determine whether due diligence is being exercised in key management processes at the Quebec Service Centre and whether the processes and controls in place are adequate to ensure compliance with TBS and PCA policies and practices.

To achieve this objective, the audit reviewed the management control framework applied to financial management and covered the following key financial process areas:

  • hospitality and food;
  • telecommunications;
  • inventory;
  • contracting;
  • payments to suppliers;
  • financial coding.

Only transactions that occurred during the period extending from April 1, 2008, to March 31, 2009, were examined.

3. Methodology

The audit methodology involved the following activities:

  • A visit to the Quebec Service Centre office.
  • Interviews with the managers and personnel responsible for the key financial sectors at the Quebec Service Centre.
  • Interviews with the personnel responsible for telecommunications at the Office of the Chief Information Officer.
  • Examination of the relevant supporting documentation, in particular the 2001 audit report, the organizational chart, the PCA signing authority delegation chart, policies governing the key financial sectors, and records of management meetings;
  • Examination of a sample of transactions for each key financial sector, where applicable.

The sample of transactions was determined based on data sorted using the STAR financial system according to the value of the transactions in areas targeted by this audit.

The visit to the Quebec Service Centre took place from June 15 to 19, 2009. Once the on–site work was finished, we submitted a summary of our preliminary findings to the Director of the Quebec Service Centre and to the Director’s representatives.

Our findings and recommendations have been made in accordance with the Audit Reporting Rating System described below:

Audit Reporting Rating System
RED Unsatisfactory Controls are not functioning or are nonexistent. Immediate management actions need to be taken to correct the situation.
ORANGE Significant Improvements Needed Controls in place are weak. Several major issues were noted that could jeopardize the accomplishment of program/operational objectives. Immediate management actions need to be taken to address the control deficiencies noted.
YELLOW Moderate Improvements Needed Some controls are in place and functioning. However, major issues were noted and need to be addressed. These issues could impact on the achievement or not of program/operational objectives.
BLUE Minor Improvements Needed Many of the controls are functioning as intended. However, some minor changes are necessary to make the control environment more effective and efficient.
GREEN Controlled Controls are functioning as intended and no additional actions are necessary at this time.

4. Assurance Statement

In our opinion, sufficient audit work has been performed and the necessary evidence has been gathered to support the conclusions contained in this report.

5. Conclusion

Overall, we found that the financial and administrative functions are effective enough to ensure due diligence with respect to the application of most of the management processes examined as well as to guarantee to executive management that the controls in place at the Quebec Service Centre are adequate to ensure compliance with TBS and PCA policies and practices.

However, we identified one financial process (telecommunications) requiring improvements to current processes in order to strengthen controls and improve compliance with existing policies. Specific recommendations have been made to the Director of the Quebec Service Centre as well as to the Chief Information Officer. The recommendations to the Chief Information Officer will ensure compliance and uniformity with the telecommunications policy for the entire Agency, not just for the Quebec Service Centre. A separate rating was therefore given to the Quebec Service Centre and the Office of the Chief Information Officer in order to reflect the current situation.

6. Findings and Recommendations

6.1 Management Control Framework

BLUE Minor Improvements Needed Many of the controls are functioning as intended. However, some minor changes are necessary to make the control environment more effective and efficient.

To determine whether the management control framework is adequate to ensure compliance with financial policies, we applied the following audit criteria:

C1
The information necessary to achieve operational objectives is identified, collected, processed and sent quickly to the concerned individuals.

C2
The roles and responsibility of staff members, particularly in terms of control, are clearly defined, documented and disseminated.

C3
Business and operational plans are prepared in partnership with the stakeholders concerned and appropriately establish budgetary parameters, human and physical resource requirements, and security requirements.

C4
The current control environment fosters sound, effective financial management.

C5
The control activities conducted ensure rapid detection of any irregularities and allow for application of corrective actions with an acceptable timeframe.

C6
The control activities conducted ensure appropriate management of financial staff.

C7
The members of the finance team are suitable and have the qualifications necessary to achieve operational objectives.

C8
Operational risks are formally assessed on a regular basis.

Findings

The organization implements the control framework in order to support its operations and ensure that employees carry out their duties efficiently and effectively. The key elements of an effective management control framework are, in particular clear governance, properly defined roles and responsibilities, effective communication and regular control measures.

Governance

The Quebec Service Centre is under the responsibility of the Agency’s Executive Director, Service Centres. The business plan is drawn up in conjunction with the Agency’s three other service centres. It shows the commitment to respect the mandate of Parks Canada and reflects the priorities and activity programs set out in the Agency’s corporate plan.

Each year, the field units submit projects requiring the expertise of one or several departments. Requests are assessed based on the Agency’s priorities and the available human and financial resources. After this process, a work plan for the service centre is approved and presented to the various field units involved.

The Quebec Service Centre has not yet established a formal process or documented a risk assessment for all these financial processes. However, risk management is taken into account during project review and decision making. The Agency reviewed its risk profile, which was approved by the Agency’s CEO in April 2009 and provides for harmonizing integrated risk management with the planning cycle and report creation. The corporate plan and the 2010−2011 business plans must reflect the risk management approach.

A guide to security and emergency procedures was developed in June 2007. It includes the roles and responsibilities of stakeholders as well as procedures for various emergencies requiring short-term action. The guide prioritizes employee and client safety. However, no business continuity plan was implemented. It is essential that every organization assess the risks and impacts associated with events beyond our control that may prejudice the Agency’s services or even damage its reputation. Services deemed essential to our clients, partners and employees must be identified and acceptable alternatives at a reasonable cost must be considered. The National Office is currently developing the business continuity plan. Directives to this effect should follow in spring 2010.

Roles and responsibilities

The Quebec Service Centre’s administrative structure brings together seven departments with about 125 employees, including experts in such fields as biology, archaeology, real estate, history, finance, administration and marketing. The service centre must provide services and advice to field units in Quebec and even outside the province in certain areas of expertise.

An organizational chart amended in April 2008 was available. There have been several appointments to key positions since then. At the time of the audit, these changes to the organizational chart had not yet been approved. A current organizational chart facilitates communication and enhances the understanding of roles and responsibilities throughout the organizational structure.

Employees were given a generic job description. Specific objectives are identified at the time of work plans or performance appraisals, which are conducted yearly and are accompanied by a training plan. The human resources manager uses these to plan appropriate training and reduce training costs for the service centre.

A new online training on key financial and administrative practices was recently given to managers with signing and spending authority. Each manager was required to pass this course no later than June 1, 2009, in order to maintain his or her authority. At the time of the audit, most service centre managers had completed the training. Managers who did not take the course or did not complete it saw their signing authority suspended until they took and completed the course.

Recommendation

1)
The Director of the Quebec Service Centre must ensure that a current organizational chart is maintained in order to clearly identify the roles and responsibilities of team members.

Management response

Agree: The QSC Director agrees to update the QSC’s organizational chart and will assign this task to the Human Resources Manager so that the chart can be approved by April 1, 2010.

Communication

The preferred means of communication at the service centre is e-mail and intranet. The departments use files with group-restricted access to facilitate the sharing of information.

The management committee meets every two weeks. During peak times, the frequency is reduced to once a month. A financial topic is generally included on the agenda. Records for these meetings are available and accessible to all employees through a shared file. General staff meetings are also planned twice a year. An organizing committee consisting of two managers and one employee was created for that purpose.

An orientation guide for new employees was developed to help them integrate and is available on the Quebec Service Centre’s intranet site. It contains a range of general information about the Parks Canada Agency as well as other information more specific to the Quebec Service Centre.

Control measures

Responsibility for compliance with financial policies lies with the person who holds spending authority under section 34 of the Financial Administration Act (FAA). The revised signature specimen forms allow for confirmation of the level of delegation of authority granted to an employee for a specific financial centre or cost centre. This form facilitates verifications and eliminates ambiguities. As stipulated in the Instrument of Delegation: Administrative and Financial Signing Authorities, signature specimen forms must be examined and updated yearly.

At the time of the audit, old signature specimen forms had not been replaced and were still in use. Some documents were as old as 2006. It is therefore crucial to review the signature specimen forms in order to ensure that the delegations of authority match and are up to date.

Moreover, some of the functions carried out at the service centre do not fall directly under the Service Centre Director. In particular, human resources and the communications group report to the Director General for Eastern Canada (DGEC), and the Manager, Information Technology, reports to the Office of the Chief Information Officer. However, financial transactions for these groups are performed by the Quebec Service Centre. Delegations of authority must thus be granted to certain individuals.

To this effect, we observed that certain signature specimen forms for special authorities granted full authority under sections 32, 34 and 33 of the FAA to a single person for a given financial centre under the responsibility of the office of the DGEC. The separation of duties reduces the risk of fraud and embezzlement. It is thus important that the person with spending authority be someone other than the person with spending authority for a same group. Although an examination of the documents did not show any irregularity in this regard, since only spending authority would be exercised, authority can nonetheless be exercised under sections 33 and 34.

However, an examination of the documents showed an irregularity in spending authority under section 33 of the FAA. In the absence of the person with spending authority at the Quebec Service Centre, the person with authority at the Quebec Field Unit authorizes payments without proper delegation of authority. This practice is apparently reciprocal between the two units. The same situation is repeated with the Information Technology Department, although no delegation of spending authority was in place. As such, it must be determined whether the appropriate delegations of authority are in place in order to ensure the separation of duties and comply with the FAA.

Finance staff conduct random checks based on the risk associated with the type of transaction under the Account Verification and Sampling Policy. Also, a statistical sampling is selected at the national level and the selected transaction lists are sent every month to the finance group for auditing purposes.

Spending is initiated in the various sectors and is approved by the competent authority. Procurement Officers oversee the purchase of goods or services, Once the goods or services are received, the manager signs the invoice to confirm receipt and authorize payment of the sum owing. The service centre’s finance staff checks the information and records the payment in STAR. Finally, the person with spending authority under section 33 of the FAA must ensure compliance and that all the necessary information has been provided before authorizing payment.

Three Finance Officers share the financial duties and each has a different area of responsibility. The managers responsible for their budget determine the coding; however, the Finance Officers play a monitoring role to ensure financial data is accurate.

Quebec Service Centre employees have access to a computer and may consult the Parks Canada intranet site to obtain information on policies and/or directives. Explanatory documents, referred to as tool tips, are also available on the service centre’s site. These records are issued for various reasons:

  • For new directives, policies or procedures
  • Interpretation of more complex directives or policies
  • Frequently asked questions
  • Reminders further to controls

The Finance Department has also introduced a binder containing the most common procedures as well as the forms that must be filled out to comply with policies. It is used for training and reference purposes, as necessary, and is also available for consultation by Finance Department employees.

The Finance Department sends regular financial reports to managers, who must validate the information and make any necessary corrections. There is constant communication between managers and the department to ensure appropriate follow-up. A Finance Officer occasionally attends management committee meetings to facilitate the process and ensure that a consistent message is being conveyed.

Recommendation

2)
The Director of the Quebec Service Centre must ensure that the appropriate delegations of authority are in place in order to ensure compliant practices.

Management response

Agree: The head of accounting operations will update the signing authorities within six months.

Conclusion

The analysis of the management control framework shows that in general, the Quebec Service Centre has practices in place to ensure appropriate control. Minor improvements must be made in terms of communicating roles and responsibilities and updating delegated authorities so as to strengthen policy compliance.

6.2 Hospitality and Food

GREEN Controlled Controls are functioning as intended and no additional actions are necessary at this time.

To determine whether due diligence is being exercised in the financial process for hospitality and food expenses and whether controls are adequate to ensure compliance with policies, we applied the following audit criteria:

C1
Hospitality activities are carried out at the appropriate locations.

C2
The financial limits allocated to hospitality activities are respected.

C3
Hospitality activities are approved before the event with the appropriate level of approval.

C4
Beneficiaries of the hospitality activities are consistent with the policy of Parks Canada Agency.

C5
Payments for hospitality activities comply with the provisions of Parks Canada Agency.

C6
Transactions recorded for the food account comply with the applicable policies and do not include any hospitality expenses.

Findings

The government continues to focus on strict financial controls in order to guarantee accountability and transparency in the management of public funds. Hospitality expenses are one of the targeted expense categories. Parks Canada Agency must comply with the Treasury Board’s Hospitality Policy.

Activities must be organized in an economical, consistent and appropriate way when it will facilitate government business or is considered desirable as a matter of courtesy. Requests for hospitality expenses must always be approved by the delegated officer in charge before the activity is held. The Hospitality Policy stipulates the delegated authorities based on the cost of the activity as well as the ceilings for meals.

When approval by the Minister (> $5,000) or the CEO (from $1,500 to $5,000) is required, hospitality requests must be sent early enough to ensure pre-authorization before the activity is held. Authorization by the CEO requires at least two weeks and approval by the Minister, at least one month.

In 2007 Parks Canada issued a new policy on hospitality expenses. A memorandum to senior managers was also sent to support the Agency’s position in this regard.

Ten transactions were selected, representing 82% of the Quebec Service Centre’s hospitality expenses. All activities were under $1,000. A hospitality expense form accompanied each activity. The form has three sections: the first is the purpose of the hospitality, the location, the number of participants and a cost estimate, the second section is for pre-approval, and the last to indicate the actual cost and final approval under section 34 of the Financial Administration Act.

The selected transactions had been pre-approved and respected the current limits. However, one form indicated that a dinner was included in the hospitality expenses, whereas the costs estimated on the form and the related invoice showed only beverages.

As a best practice, a list of participants can be attached to the form in order to confirm the origin and number of the participants in attendance. It also shows that the person who authorized the hospitality expenses did not personally benefit from the event.

Food may be purchased under certain circumstances for employees working in remote areas for several days. This account may be used only under these circumstances and must not include any hospitality expenses. Note that no transaction was recorded for the Quebec Service Centre under the food account.

Conclusion

The process in place for hospitality and food expenses complies with the PCA and TBS policy.

No recommendation.

6.3 Telecommunications

QSC
BLUE
Minor Improvements Needed Many of the controls are functioning as intended. However, some minor changes are necessary to make the control environment more effective and efficient.
CIO
YELLOW
Moderate Improvements Needed Some controls are in place and functioning. However, major issues were noted and need to be addressed. These issues could impact on the achievement or not of program/operational objectives.

In order to give fair treatment to the entities audited in the course of the audit cycle, we have given two audit ratings in the telecommunications section in order to reflect the current situation at the Quebec Service Centre. The service centre has implemented processes based on the instructions received, if any, from the National Office. Certain points raised in the “Findings” section concern the Chief Information Officer. Specific recommendations are therefore addressed to the Director of the Quebec Service Centre and others, to the Chief Information Officer.

To determine whether due diligence is being exercised in the financial process for telecommunications expenses and whether controls are adequate to ensure compliance with policies, we applied the following audit criteria:

C1
The manager or designated administrator must document user requirements in terms of wireless telecommunications devices and services.

C2
All acquisition requests and requests for devices or changes in service are coordinated by the designated administrative authority.

C3
The procurement process for devices is consistent with guidelines.

C4
Non-standard requests are submitted for approval by the Chief Information Officer (CIO), subject to the manager’s recommendation.

C5
Attribution of the communication device is authorized by a Level A manager or higher and meets the current criteria.

C6
Managers ensure that the users who report to them are familiar with the Policy on the Use of Cellular and Other Mobile Wireless Devices and agree to comply with the policy before being granted the device.

C7
Use of the device complies with the terms of the policy and current guidelines.

C8
Personal calls are identified, calculated and reimbursed by the user where applicable under the policy’s terms.

C9
The administrative authorities responsible for managing wireless services at field units and service centres have developed internal processes for this policy.

C10
Managers and designated administrators regularly examine the staff’s use records.

Description of the process

Parks Canada’s new Policy on the Use of Cellular and Other Mobile Wireless Devices came into force on October 1, 2008. Its purpose is to ensure more profitable and appropriate use of wireless devices. To this effect, Public Works and Government Services Canada (PWGSC) has implemented a new procurement process and a new acquisition agreement. In the past, cell phones and other devices were purchased from a large number of suppliers offering a wide range of functions and plan options. The new agreement will enable the Agency to reduce the costs of using such devices. The policy provides guidelines and official procedures for safe and appropriate purchase, management and use of cell phones and other wireless devices.

The policy concerns both acquisition and use of these devices. A person must be designated as the administrative authority for the field units and service centres. Any request for purchase, modification or cancellation must be sent to the designated administrative authority. The acquisition must be made from the suppliers listed in the new PWGSC agreement, unless an exception is made. User needs must be documented in order to allow the designated administrator to recommend an appropriate and adequate service. Further to the recommendations, the user’s manager must approve or cancel the request. The Office of the Chief Information Officer and the user’s manager or supervisor must conduct random checks of how wireless devices are used.

A non-standard request is possible if it is well documented and approved by the Chief Information Officer (CIO). Once the CIO’s approval has been obtained, the designated administrator informs PWGSC and obtains its consent to proceed with acquisition of the device. A non-standard request may occur when the suppliers under the agreement cannot meet the user’s needs (e.g., some regions of Canada are not serviced by the accredited suppliers) or if the requested device is not included in the agreement.

The use of cell phones and wireless devices is also regulated. Devices must be used for the Agency’s activities and services, emergency calls and limited personal use. Personal calls must be controlled and identified by users on their monthly statement. A threshold of $30 per year for personal use is considered reasonable. Data is compiled twice a year, in September and March. However, if the $30 threshold is reached in September, the employee must reimburse all personal use expenses for the first six months and in March must reimburse all personal use expenses for the last six months of the fiscal year. The roles and responsibilities of the employee and his or her manager are set out in the policy. The employee must take all necessary measures to ensure the integrity and security of the Agency’s information when using wireless mobile devices to send information. He or she must also comply with guidelines as well as local, provincial and federal laws on the use of wireless devices. The manager must ensure that the employee is familiar with the Policy on the Use of Cellular and Other Mobile Wireless Devices so that he or she may use the device appropriately. He or she must also use indicators to check for potentially unauthorized or inappropriate use.

Quebec Service Centre

BLUE Minor Improvements Needed Many of the controls are functioning as intended. However, some minor changes are necessary to make the control environment more effective and efficient.

Findings

In November 2007 a presentation on the new PWGSC acquisition agreement was made to the management committee of the Quebec Service Centre. Managers were asked to review their need for cell phones and wireless devices before the change in supplier came into force. The managers interviewed indicated that they reduced the number of devices subsequent to that evaluation. Some devices were pooled for a given group rather than assigned to a single employee.

An administrative authority was designated for the Quebec Service Centre. However, the role was assigned to the Manager, Information Technology, who is also a designated administrator for the Quebec region. The Manager, Information Technology, reports to the Chief Information Officer rather than to the Director of the Quebec Service Centre.

When a wireless device is requested, a form is filled out with the various information elements identified in the policy, under administrative process. The form is then sent to the Atlantic Service Centre, which is responsible for activating wireless devices. However, no form is filled out for cell phone requests. The request is made by e-mail to the designated administrator. This practice does not comply with the administrative process set out in the policy. All requests must be documented in order to facilitate the choice and justify the need for a wireless device.

As a best practice, users should be asked to sign a form acknowledging the policies in force with respect to the use of wireless devices before they are given the device. This formality will encourage the user and manager to meet their respective responsibilities and obligations. This practice is observed with acquisition cards.

In terms of use, users identify personal call using the monthly statements. The total amount is identified and calculated. The user creates a control sheet to indicate the amount of personal calls identified on each statement, the running total and any reimbursements made. Some employees who use wireless devices more frequently have opted to reimburse their personal calls on a monthly basis instead of twice a year.

When the monthly statements were audited, personal calls were identified and the running total was compiled per employee. However, there appears to be no monitoring. Only the manager’s signature, authorizing payment, appears. The policy gives examples of indicators (Policy on the Use of Cellular and Other Mobile Wireless Devices – Schedule A; Roles and Responsibilities) for improved control and fostering appropriate use of the devices. The user’s manager should conduct random checks to ensure compliance with the Policy on the Use of Cellular and Other Mobile Wireless Devices.

Recommendations

3)
The Director of the Quebec Service Centre must implement a process to ensure that users acknowledge their obligation with respect to the Policy on the Use of Cellular and Other Mobile Wireless Devices.

Management response

Agree: The QSC Director agrees to implement an acknowledgement of responsibilities form for cell phones and BlackBerry handsets and will assign this task to the telephony responsible in the procurement and contracts section, to be completed within three months. This form will be similar to the one used for MasterCard and Amex cards and will be kept in a binder once signed by employees.

4)
The Director of the Quebec Service Centre must implement a random check process using the monthly statements in order to ensure appropriate use of wireless devices.

Management response

With reservations: We understand the risk our current situation poses. However, unless cases are brought to our attention, applying this type of measure goes against our value of trust in our employees. The awareness of managers will be done through management committee and written reminders to management concerning the monitoring role that they have to assume. Also, the financial team will be lying in wait for any case of inappropriate use and bring them to the attention of managers.

Office of the Chief Information Officer

YELLOW Moderate Improvements Needed Some controls are in place and functioning. However, major issues were noted and need to be addressed. These issues could impact on the achievement or not of program/operational objectives.

Findings

Use of a standardized form would ensure that every request is documented as described in the policy, whether the request is standard or non-standard. This form can be used to obtain the approval of the CIO in the case of non-standard requests as well as facilitate inventory control for cell phones and other wireless devices for field units.

The Quebec Service Centre’s designated administrator obtained a cellular device through a non-standard request. The request was justified in an e-mail exchange between the requesting party, the designated administrator and PWGSC. Official authorization was not obtained from the Chief Information Officer, who was never involved in the exchanges. It should be noted that although the practices implemented at the Quebec Service Centre respect the instructions received from the Office of the Chief Information Officer, they do not comply with the Agency’s Policy on the Use of Cellular and Other Mobile Wireless Devices. The Chief Information Officer must clarify the interpretation and ensure that field units, service centres and various branches at the National Office obtain the necessary authorization before proceeding.

The Office of the Chief Information Officer must also conduct random checks for the acquisition and use of wireless devices. No formal monitoring process is in place. A system will have to be developed in order to monitor and support the designated administrators.

Recommendations

5)
The Chief Information Officer must ensure the standardization of all acquisition requests for wireless devices (including cell phones) in order to properly document the required information.

Management response

Agree: The CIO will create an official form to standardize requests for wireless devices (including cell phones). This form will be implemented across the Agency beginning April 1, 2010.

6)
The Chief Information Officer must ensure that non-standard requests receive the necessary approval by the CIO before proceeding with PWGSC.

Management response

Agree: The CIO will amend the Agency’s Policy on the Use of Cellular and Other Mobile Wireless Devices to ensure that it clearly sets out the steps needed for approval of a non-standard request, including the need to obtain authorization from the CIO or his/her delegate before contacting PWGSC. Policy amendments will be made before April 1, 2010.

7)
The Chief Information Officer must implement a system to monitor the acquisition and use of wireless devices in order to ensure policy compliance by the designated administrators.

Management response

Agree: The CIO will analyze a sample of requests twice a year to ensure that designated administrators comply with the policy. Sampling will begin on April 1, 2010.

Conclusion

Certain elements of the Policy on the Use of Cellular and Other Mobile Wireless Devices require clarifications in terms of their interpretation. The Quebec Service Centre and the Office of the Chief Information Officer must implement processes in order to ensure compliance with the policy.

6.4 Inventory

BLUE Minor Improvements Needed Many of the controls are functioning as intended. However, some minor changes are necessary to make the control environment more effective and efficient.

To determine whether due diligence is exercised in the financial process for inventory management of property worth from $1,000 to $10,000, attractive property worth less than $1,000 and property worth over $10,000 and whether controls are adequate to ensure compliance with policies, we applied the following audit criteria:

Property worth $10,000 or less

C1
The property concerned by the directive, acquired after April 1, 2007, is recorded in the financial system.

C2
The separation of duties for the inventory management process is adequate.

C3
Physical inventory was taken in the last 24 months.

C4
Measures are in place to ensure that purchased property is recorded in the inventory, whatever the purchase mechanism used.

Property worth over $10,000

C5
Acquisitions are identified appropriately at the time of purchase and recorded in the property management system.

C6
Acquisitions are recorded in the STAR financial system and in a timely manner.

C7
Physical inventory was taken in the last 24 months (equipment, vehicle, etc.).

Findings:

A national inventory management system for property worth $1,000 to $10,000 and attractive property worth less than $1,000 was rolled out in April 2007. From that date on, all acquired property that meets the description must be recorded in the maintenance module of the STAR financial management system. Physical inventory must be taken every two years in order to validate and correct the information in the STAR system.

A Procurement Officer and an Administrative Officer oversee the maintenance of the inventory system. The Procurement Officer is responsible for assigning an inventory number to the property received. Four-digit bar code labels are used for all property except computer equipment already bearing the manufacturer’s serial number. The Finance Department must identify purchases of property that were not initiated by the Procurement Officer so that the property can be assigned an inventory number. Once the information is gathered and the numbers assigned, the documentation is given to the Administrative Officer who enters it into the STAR system’s maintenance module. Three in-house forms were created to standardize practices: one form to add equipment, one for excess equipment, and one for transfers between inventory caretakers.

The last physical inventory at the Quebec Service Centre was conducted in 2005. All the items were entered into the STAR maintenance module. Once a year, managers receive a copy of their inventory list and must confirm the accuracy of data. The list includes the item’s identification number, description and location. Any change must be justified on the appropriate form, approved by the manager responsible for the inventory and entered into the STAR system in order to reflect the physical inventory. The separation of duties for inventory follow-up is therefore appropriate, since the inventory caretakers do not have access to data entry into the STAR financial system.

For the purposes of the audit, we selected items for two groups at the Quebec Service Centre based on inventory lists generated by the STAR financial system. We attempted to visually locate the items. We then identified specific items at workstations and checked their registration in STAR. Only one selected item could not be physically located: a piece of computer equipment that had been replaced. The transfer had still not been recorded eight weeks after the initial audit because no document had been submitted by the inventory caretakers.

The finance group at the Quebec Service Centre is responsible for creating internal orders for property worth $10,000 and over for all field units in Quebec. The goal is to standardize property registration in the financial system. Managers with an approved budget for acquisition of depreciable property must request that an internal order and an asset number be created. If the request is made during the year, the manager must submit a resource request duly approved by the Service Centre Director before an internal order can be created. Employees assigned to payment of supplier accounts must identify any property purchase and inform the person in charge of inventories of that purchase to ensure its registration in the financial system. Once the asset file is complete, a transaction is performed in the financial system in order to account for the appropriate depreciation. For transactions at the Quebec Service Centre, the transfers are planned in the month following file closure. Additional timeframes are noted for the transactions of Quebec field units due in part to a lack of communication when the asset file is closed.

Note that no physical audit was conducted for property worth $10,000 and over, only the process is described based on interviews.

Conclusion

Overall, the inventory management process is properly controlled. A few minor changes would increase the level of assurance by confirming the accuracy of financial data for physical inventory of the property.

Recommendations

8)
The Director of the Quebec Service Centre must ensure that equipment transfers are recorded in the maintenance module of the STAR financial system within a reasonable timeframe.

Management response

Agree: The administrative officer will enter the transfers into the STAR system as quickly as possible and the head of accounting operations will send a reminder to inventory staff.

9)
The Director of the Quebec Service Centre must ensure that a physical inventory is conducted every two years in order to confirm the existence of the property recorded in the ledgers.

Management response

Agree: We will conduct a physical inventory count every two years, from September to November, beginning in fiscal year 2010–11. The head of accounting operations will provide follow-up.

6.5 Contracting

GREEN Controlled Controls are functioning as intended and no additional actions are necessary at this time.

To determine whether due diligence is exercised in the financial process for contracting and whether controls are adequate to ensure compliance with policies, we applied the following audit criteria:

C1
Guidelines and procedures for contracting practices exist in the field unit/service centre and are consistent with the TBS and PCA policies and directives.

C2
Appropriate training/instruction is provided at all levels to ensure knowledge and understanding of contracting policies and procedures.

C3
Compliance with contracting policies and procedures is controlled.

C4
Management reports for contracting activities are produced and used for control and supervision of these activities.

C5
There is an identified need to make the contract.

C6
The appropriate contracting method is used.

C7
Contracts are made fairly, taking into account the principle of economy.

C8
The nature of the service to be performed or the goods to be delivered is specified in the contracts.

C9
The contracts include conditions intended to mitigate the risk of non‑execution.

C10
The contracts are approved by persons with the required authorizations.

Findings

The Quebec Service Centre used the following contracting methods: standing offers, purchase orders, competitive sources and sole-source supplier. The current directive encourages managers to work with the Contracting and Procurement Officer for all contracts, purchases of over $5,000 and standing offers. This considerably reduces the risk of departing from the contract award policy. Note that the FIN 101 and FIN 201 courses, pre-requisites for obtaining delegation of authority, also deal with the policy. The focus is on awarding 80% of contracts competitively. No official report is issued, but checks are conducted regularly in order to meet that goal. Also, the Service Centre Director must approve all sole-source supplier contracts in excess of $5,000 beforehand.

Various forms are used to facilitate the monitoring of the process as well as payments under the contract, such as “demande pour appel d’offres et octroi de contrat”, “liste des soumissions reçues par le comité d’ouverture des soumissions” and “demande pour l’émission d’un rectificatif.”

Our sample is based on the level of risk that may result from the contract award process. Most contracts are awarded through a standing offer or a purchase order, methods that involve little risk.

As part of the audit, we selected transactions (roughly $5,000) for a specific account of the general ledger, that is, “Other Professional Services.” The 14 transactions chosen represent 9 contracts representing over 38% of the expenses recorded in the account for the period in question. We selected four other contracts in different accounts in order to obtain a better representation of the contracting process. The value of the contracts ranged from $19,000 to $89,900 each. The various contracts examined, both those worth over $5,000 and those worth less than $5,000, were complete and respected the policy in force.

The files consulted contained the appropriate signatures and documents, i.e., a purchase order, a statement of work and a justification of the sole-source supplier, where applicable. The criteria for assessing bids and results were on file, as was the correspondence with bidders. Only one of the selected contracts in excess of $5,000 was awarded to a sole-source supplier. One contract involved additional expenses for which an amendment was completed in accordance with regulations.

Conclusion

The process in place respects the Treasury Board’s Contracting Policy. The files examined complied with requirements.

No recommendation.

6.6 Payments to Suppliers

BLUE Minor Improvements Needed Many of the controls are functioning as intended. However, some minor changes are necessary to make the control environment more effective and efficient.

To determine whether due diligence is exercised in the financial process for payments to suppliers and whether controls are adequate to ensure compliance with policies, we applied the following audit criteria:

C1
The field unit/service centre has policies, guidelines and procedures governing the purchase and payment of goods and services from suppliers and these are consistent with TBS and PCA policies.

C2
Appropriate training/instruction is provided to employees at all levels to ensure knowledge and understanding of the policies and procedures.

C3
Compliance with policies and procedures is controlled.

C4
The purchase of goods and services is carried out and authorized appropriately, and the funds are entered correctly in the financial system.

C5
The goods and services on supplier invoices correspond to the purchase orders/ contract terms.

C6
The price and quantities indicated on the invoices correspond to the purchase orders/contract terms.

C7
The certification under section 34 of the FAA is signed by the appropriate officer.

C8
Advances and progress payments are made in accordance with contract terms.

Findings:

The supplier account audit consists of ensuring that payment is made within the stipulated timeframes and corresponds to the amount of the goods or services received and the persons with the necessary delegation authorized that purchases. Certain accounts were targeted for the audit: conference expenses, training expenses and professional dues. Travel expense claims were also included in the selection representing over 5% of the service centre’s expenses. Also, some statements of account for acquisition cards were examined. A selection was also made among less significant expenses to ensure fair and representative coverage of expenses.

Table of key accounts audited for this section:

Account name Number of audited transactions Amount
$
% of audited expenses / total expenses under the account
Conference expenses 9 6,605 45%
Professional dues 5 5,913 74%
Training expenses 7 7,824 34%
Travel expenses 31 57,588 10%
Various accounts 17 120,045 47%

Supplier invoices are received in the archives room and are dated using a stamp. Most are then sent to the Material Management Department. Invoices are attached to the purchase order and the acknowledgement of receipt, then sent to the respective managers. The managers must certify invoice compliance under section 34 of the FAA (including the financial coding). Authorized invoices are then returned to the Material Management Department. Once all the supporting documents are gathered, the documents are sent to the finance group for processing. Finance Officers are responsible for ensuring that all the required information is on hand and that the appropriate signatures have been obtained before making the payment. If questions or departures from the policies are identified, the manager responsible for the expense is contacted and the justifications are attached to the payment documents. This practice ensures the legitimacy of the expenses.

Overall, payments to suppliers are properly controlled. An examination of the selected documents showed that conference and training expenses complied with existing policies. Professional dues were attached to a level of authorization form based on the established thresholds. An error in addition was found to have resulted in an underpayment of $100. A correction was made in the months that followed. However, one point observed would be the absence of a stamp to confirm the date the invoices are received. Four selected transactions did not have the date of receipt stamped on the invoice. The same situation was observed with invoices for hospitality expenses. Invoices must be dated in order to be able to follow the chronology of payments. Note, however, that all the examined accounts were paid without interest.

A few irregularities were also found for travel expense claims:

  • The supporting documents for three claims were not detailed enough. Two were for gas and one for accommodation. The supporting documents indicated only the total amount charged to the credit card, without details.
  • Two claims involved accommodation expenses at locations not on the list of accommodations approved by the Treasury Board. No justification was found in the payment file.

Supporting documents must include enough details to ensure validation of the claimed expenses. A total transaction amount cannot be accepted because it does not confirm the type of expense. Travel expense claims with exceptions should include an explanatory note or be identified as such on the travel authorization form if the situation is known before the traveller’s departure.

Some statements of account for acquisition cards were audited based on the transactions selected in the sampling. The Material Management Department handles most goods and services purchases for the entire service centre. Several transactions are done using the acquisition card. Thus, the holder of an acquisition card for the Material Management Department may make purchases that must be charged to various cost centres that are not under the responsibility of his or her immediate superior or even his or her department. This approach means that each transaction must be approved by someone with spending authority for the cost centre that will be charged for the expense. An examination revealed that some statements of account for acquisition cards indicated authorization (S‑34) by the cardholder. This practice is contrary to the policy, since the account holder cannot authorize payment of his or her purchases. However, a more detailed examination showed a separate authorization for each invoice. It is therefore recommended that the signature of the person with spending authority be clearly identified in order to avoid any ambiguity.

Centralizing purchases increases the monthly volume of transactions associated with a statement of account. Accounts must be reconciled in order to facilitate financial data input and validate payment. Use of a register that allows for reconciliation of invoices for purchases made with the statement of account facilitates this process. This register may be kept by hand or computerized. The SAP financial system provides for this function. The computerized register is generally used by employees of the Material Management Department who hold an acquisition card. An audit of a limited number of statements of account showed this practice; however, the interviews confirmed that it was not in use throughout the Quebec Service Centre.

Conclusion

The controls in place for payments to suppliers are acceptable. Minor changes must be made in order to facilitate reconciliation and monitoring.

Recommendations

10)
The Director of the Quebec Service Centre must ensure that the date of receipt appears on invoices in order to be able to follow the chronology of transactions.

Management response

With reservations: Archiving ensures that all invoices we receive are date-stamped; this practice is already in place. However, some invoices are received by other units and may sometimes not be date-stamped. We understand the risk our current situation poses. Accounting operations will strive to minimize this occasional occurrence as much as possible.

11)
The Director of the Quebec Service Centre must ensure that supporting documents are detailed enough to confirm the type of expense.

Management response

Agree: The head of accounting operations will send a memo to all employees explaining that they must provide detailed invoices with their expense claims rather than debit/credit card slips, because we cannot verify the nature of expenses using slips.

12)
The Director of the Quebec Service Centre must assess the option of introducing a register for acquisition cards (STAR or in-house forms) in order to facilitate reconciliation with the statement of account as well as input into the financial system.

Management response

Disagree: Only purchasing officers use a log for purchases made with acquisition cards; other cardholders do not use it. We do not believe it is necessary to enforce its use, because we have few monthly transactions and they are easily reconciled.

13)
The Director of the Quebec Service Centre must ensure that the signature of the person with spending authority is clearly indicated for an acquisition card payment involving purchases for more than one cost centre.

Management response

Agree: Cardholders cannot sign their own monthly statements under section 34. This deficiency among some cardholders has been corrected.

6.7 Financial Coding

GREEN Controlled Controls are functioning as intended and no additional actions are necessary at this time.

To determine whether due diligence is exercised in the financial process for coding and whether controls are adequate to ensure compliance with policies, we applied the following audit criteria:

C1
Coding guidelines and procedures have been developed for the field unit or service centre.

C2
Appropriate training/instruction is provided at all levels to ensure knowledge and understanding of coding policies and procedures.

C3
Compliance with the chart of accounts is monitored.

C4
Coding is handled by individuals with the appropriate knowledge.

C5
Coding is validated when entered into the SAP system (financial system).

Findings:

Managers with spending authority are responsible for financial coding. When invoices are received, they are stamped and the financial code is recorded by hand or identified on the purchase orders. The chart of accounts and all the information needed to select the right financial coding are available on the Agency’s intranet site under Financial Policies.

Finance Officers at the Quebec Service Centre are responsible for examining transactions before making payment. Financial coding is an integral part of this examination. Finance staff may occasionally find and correct coding errors. In this case, the manager is informed by e-mail and a copy is kept with the transaction for follow-up.

The coding audit was performed based on the sampling selected for the various financial processes.

Conclusion

Overall, the use of financial coding is adequate. All the documents examined were properly coded.

No recommendation.