Parks Canada
Symbol of the Government of Canada

Common menu bar links

Internal Audit and Evaluation Documents

Audit of Key Financial Processes at the Quebec City Field Unit

Final Report
February 2010

Prepared by
Office of Internal Audit and Evaluation

Table of Contents

Executive Summary

1. Background

2. Objectives and Scope

3. Methodology

4. Statement of Assurance

5. Conclusion

6. Observations and Recommendations

6.1 Management Control Framework
6.2 Hospitality and food expenses
6.3 Telecommunications
6.4 Inventories
6.5 Contracting
6.6 Payments to Suppliers
6.7 Financial coding

Printable Version


Note: To read the PDF version you need Adobe Acrobat Reader on your system.

If the Adobe download site is not accessible to you, you can download Acrobat Reader from an accessible page.

If you choose not to use Acrobat Reader you can have the PDF file converted to HTML or ASCII text by using one of the conversion services offered by Adobe.



Report was tabled at the Audit Committee March 18, 2010.

Executive Summary

Parks Canada Agency (PCA) conducts cyclical audits of key financial, administrative and management practices in field units, service centres and various branches at the national office and in the regions. The audits are based on compliance with the policies and practices of the Treasury Board Secretariat (TBS) and the Parks Canada Agency. The audit of the Quebec City Field Unit was conducted as part of this cyclical audit program.

The objectives of this audit were to determine whether due diligence is exercised in key management processes and to provide assurance to senior management that the processes and controls in place at the Quebec City Field Unit to limit risks of non-compliance with TBS and PCA policies were satisfactory.

The exercise included a review of the management control framework (MCF) as well as key processes in the following financial areas: hospitality and food expenses, telecommunications, inventory, contracting, payments to suppliers, and financial coding. The audit covered the period from April 1, 2009, to October 31, 2009.

The audit methodology included a review of relevant documentation, interviews with Quebec City Field Unit personnel, and sampling of transaction controls in the key financial process areas. The on-site work was carried out from January 11 to 15, 2010.

The audit engagement was planned and conducted to be in accordance with the Internal Audit Standards for the Government of Canada.

Overall, we determined that due diligence in applying key administrative processes and the systems and controls in place must be strengthened in order to increase the level of compliance with TBS and PCA policies. In addition, adequate controls need to be put in place to guide and oversee the application of policies on delegation of authority and on inventories.

Audit Reporting Rating Summary:

Ref. Management Process Rating
6.1 Management Control Framework ORANGE – Significant improvements needed
6.2 Hospitality and food expenses BLUE – Minor improvements needed
6.3 Telecommunications – Quebec City Field Unit YELLOW – Moderate improvements needed
Telecommunications – OCIO YELLOW – Moderate improvements needed
6.4 Inventory RED – Unsatisfactory
6.5 Contracting BLUE – Minor improvements needed
6.6 Payments to Suppliers BLUE – Minor improvements needed
6.7 Financial Coding GREEN – Controlled

The following is a list of recommendations make in the report to the Superintendent of the Quebec City Field Unit and the Chief Information Officer:

The Field Unit Superintendent must:

1.
Ensure that recurring duties of key positions in the organization are documented in a way that facilitates the intake of new employees and preserves the organization’s corporate memory.

2.
Ensure that meetings are held regularly and that minutes are available to employees.

3.
Ensure that signature specimen forms are up to date and reviewed at least once a year.

4.
Ensure that managers and employees in the Finance group understand and comply with financial authority under the FAA.

5.
Ensure that hospitality expense forms include the appropriate authorization levels.

6.
Consider the option of attaching a list of participants to the hospitality expense form in order to ensure tighter control.

7.
Put in place a process to ensure that users recognize their obligations regarding the policy on the use of cell phones and other wireless devices.

8.
Put in place a process to:
  • enable users to identify personal calls on their statement of account;
  • track personal calls so that the running total can be checked twice a year and ask users to pay any amount owing under the policy; and
  • ensure proper authorization of invoices under section 34 of the FAA.
9.
Must implement a random check process using the monthly statements in order to ensure appropriate use of wireless devices.

13.
Put in place a process for identifying items, making entries in the STAR financial system and tracking items in accordance with the Directive on the management of inventories of items worth between $1,000 and $10,000 and attractive items valued at less than $1,000.

14.
Take a physical inventory to confirm the existence of items covered by the directive and enter the items in the maintenance module of the STAR financial system.

15.
Ensure that:
  • sole-source contracts are justified and properly documented;
  • records of competitive contracts contain evidence of competition;
  • local purchase orders are not used to award service contracts.
16.
Ensure that the appropriate contract award forms are used and properly entered in the STAR financial system.

17.
Ensure that expenditures over $1,000 are committed in the STAR financial system in order to facilitate budget tracking.

The Chief Information Officer must:

10.
Ensure that acquisition requests for wireless devices (including cell phones) are standardized so that the required information is properly documented.

11.
Ensure that non-standard requests receive the necessary approval by the CIO before proceeding with PWGSC.

12.
Implement a system to monitor the acquisition and use of wireless devices in order to ensure policy compliance by the designated administrators.

1. Background

The Parks Canada Agency (PCA) conducts cyclical audits of key financial, administrative and management practices in the field units, service centers and various branches at the national office and in the regions. The audit of the Quebec City Field Unit was conducted as part of this cyclical audit program.

Field units are groupings of national parks, national historic sites and national marine conservation areas that are usually in proximity to each other. Their proximity allows them to share management and administrative resources. The service centres support the organization in a variety of professional and technical disciplines. Service Centre Directors and Field Unit superintendents are responsible for ensuring that the policies, directives and guidelines issued by the Treasury Board of Canada Secretariat (TBS) and PCA are followed.

2. Objectives and Scope

The objectives of this audit were to confirm whether due diligence is exercised in key management processes at the Quebec City Field Unit and to provide assurance to senior management that the processes and controls in place are adequate to ensure compliance with TBS and PCA policies and practices.

The audit included a review of the management control framework (MCF) as applied to financial management and the following key financial process areas:

  • hospitality and food expenses;
  • telecommunications;
  • inventories;
  • contracting;
  • payments to suppliers; and
  • financial coding.

The audit covered only transactions posted from April 1, 2009, to October 31, 2009.

3. Methodology

The audit methodology included the following activities:

  • a visit to the Quebec City Field Unit office;
  • interviews with managers and staff responsible for the key financial process areas at the Quebec City Field Unit;
  • review of relevant documents, in particular the 2001 audit report, the organization chart, the PCA delegated signing authorities chart, and policies governing the key financial process areas;
  • examination of a sample of transactions for each of the key financial process areas, as required.

The transactions were sampled using dated sorted by the STAR system and based on the value of transactions related to the areas covered in this audit.

The visit to the Quebec City Field Unit took place from January 11 to 15, 2010. Once the on-site work was complete, we presented a summary of our preliminary findings to the Superintendent of the Quebec City Field Unit and the Manager, Finance and Administration.

Our observations and recommendations have been made in accordance with the Audit Reporting Rating System described below:

Audit Reporting Rating System
RED Unsatisfactory Controls are not functioning and/or fraudulent activities have been detected which will or have a material impact on both the financial statements and operations of the Agency.
ORANGE Significant Improvements Needed Controls in place are weak. Several major issues were noted that could jeopardize the accomplishment of program/operational objectives. Immediate management actions need to be taken to address the control deficiencies noted.
YELLOW Moderate Improvements Needed Some controls are in place and functioning; however, several major issues were noted that could jeopardize the accomplishment of program/operational objectives.
BLUE Minor Improvements Needed Many of the controls are functioning as intended; however, some minor changes are necessary to make the control environment more effective and efficient.
GREEN Controlled Controls are functioning as intended and no additional actions are necessary at this time.

4. Statement of Assurance

The audit engagement was planned and conducted to be in accordance with the Internal Audit Standards for the Government of Canada.

5. Conclusion

Overall, we found that due diligence is being exercised in key administrative processes and that the systems and controls in place need to be strengthened in order to ensure greater compliance with TBS and PCA policies and practices. In addition, adequate controls need to be put in place to guide and oversee the application of policies on delegation of authority and on inventories.

6. Observations and Recommendations

6.1 Management Control Framework

ORANGE Significant Improvements Needed Controls in place are weak. Several major issues were noted that could jeopardize the accomplishment of program/operational objectives. Immediate management actions need to be taken to address the control deficiencies noted.

To determine whether the management control framework is sufficient to ensure compliance with financial policies, we used the following audit criteria:

C1-
The information necessary to achieve operational objectives is identified, collected, processed and sent quickly to the concerned individuals.

C2-
The roles and responsibility of staff members, particularly in terms of control, are clearly defined, documented and disseminated.

C3-
Business and operational plans are prepared in partnership with the stakeholders concerned and appropriately establish budgetary parameters, human and physical resource requirements, and security requirements.

C4-
The current control environment fosters sound, effective financial management.

C5-
The control activities conducted ensure rapid detection of any irregularities and allow for application of corrective actions with an acceptable timeframe.

C6-
The control activities conducted ensure appropriate management of financial staff.

C7-
The members of the finance team are suitable and have the qualifications necessary to achieve operational objectives.

C8-
Operational risks are formally assessed on a regular basis.

Observations

The organization implements the control framework in order to support its operations and ensure that employees are able to perform their tasks effectively and efficiently. The key components of an effective management control framework are specifically: clear governance, well-defined roles and responsibilities, effective communication, control of assets and regular control measures.

Governance

The Quebec City Field Unit (QFU) manages nine national historic sites and one discovery centre. The extended family of QFU designations comprises 54 sites, 48 figures and 16 events of national historical significance, for a total of 118 Historic Sites and Monuments Board of Canada (HSMBC) plaques. The total value of assets is just over $350 million.

The business plan is produced in collaboration with field unit managers. Priorities are set with a view to meeting the objectives of both the unit and the Agency. At the time of the audit, the business plan was being reviewed; the plan for the period from 2008-2009 to 2012-2013 was therefore still in effect.

The Quebec City Field Unit priority, since few years, has been the delivery of different infrastructure projects. Major projects, like ‘Espace 400e’ part of the 400th anniversary of Quebec City, repairing of Dufferin terrace and the rehabilitation of the Clairet River, were under the Field Unit responsibility. Important projects are under way this year and others, with the Economic Action Plan, like Forts-de Lévis and Grosse-île, will start soon.

The Quebec City Field Unit has not yet established a formal risk assessment process for all of its financial processes. However, risk management is taken into consideration in project studies and operational decision-making. As well, a number of guides and plans were developed in 2007, including the Plan de sécurité publique des lieux historiques nationaux de l’Unité de gestion de Québec, the Guide opérationnel pour l'organisation des secours et l’évacuation en cas d’urgence and the Programme de travail en espaces clos [public safety plan for visitors to Quebec City Field Unit National Historic Sites, the emergency response and evacuation manual and the work in confined spaces program], which identify and classify risks inherent in operations and propose mitigating measures.

PCA’s revised risk profile, which was approved by the Agency’s Chief Executive Officer in April 2009, calls for integrated risk management to be incorporated into the planning and reporting cycle. The 2010-2011 corporate plan and business plans will have to reflect the risk management approach.

Roles and responsibilities

An organization chart was presented during the audit. There were a number of staff changes last year. Some positions were staffed internally, others with outside candidates. The financial side of the field unit’s operations was not spared by all these changes. Several key positions in the field unit are held by employees with less than a year’s experience in the position or with Parks Canada, and some positions are still vacant.

Newly hired employees are given a generic work description. More specific descriptions are issued in some cases when the employee’s performance is evaluated. Performance reviews are done once a year and are accompanied by a development plan.

A new on-line training course (FIN 201) on key financial and administrative processes was recently presented to managers who have payment and spending authority. At the time of the audit, the managers at the Quebec City Field Unit had already completed the course.

Few documents describing operations are available in the field unit. To facilitate the transition when there is a change in staff, recurring duties must be documented. Without appropriate documentation, the coaching period may be longer and result in additional costs, thereby reducing transition effectiveness. Documenting the duties of key positions also helps preserve the organization’s corporate memory, which is very important in these times of frequent changes in human resources.

Recommendation

1.
The Superintendent of the Quebec City Field Unit must ensure that recurring duties of key positions in the organization are documented in a way that facilitates the intake of new employees and preserves the organization’s corporate memory.

Management Response

Agree. As of April 1, 2010, the Finance and Administration team will ensure that recurring duties performed by the team are documented. The process should be completed by late 2010-11.

Communication

Management decisions in the field unit are made by the management committee, which comprises six or seven members. The committee was supposed to meet monthly. The Superintendent acknowledges that meetings have not been frequent or regular over the past year. Information is distributed by the managers who attend the meetings, each choosing the method best suited to his or her group. There is no formal record of these meetings. To ensure transparency and as good practice, formal minutes must be available to employees so that the message is consistent.

There is also an expanded committee in the field unit that comprises the members of the management committee plus managers from visitor experience.

Meetings with staff are held two or three times a year to discuss the previous year’s results and the objectives for the year ahead. The Superintendent makes a point of regularly visiting all the sites under his authority. He takes an open-door approach to management and is always willing to consider suggestions made by employees either directly or, more usually, through a manager.

Recommendation

2.
The Superintendent of the Quebec City Field Unit must ensure that meetings are held regularly and that minutes are available to employees.

Management Response

Agree. Meetings have been held and will continue to be held in future, and the management team will ensure that the minutes from these meetings are provided to staff. As part of the Accelerated Infrastructure Program, the AP3/AP4 reorganization and staff changes due to retirements, it has been and is still very difficult to bring all management committee members together at the same time. However, small group meetings are held frequently, and we ensure that all files are carried through to completion.

Controls

Responsibility for compliance with financial policy lies with the person with spending authority under section 34 of the Financial Administration Act (FAA). The revised signature specimen forms confirm the employee’s level of delegated authority for a fund centre or specific cost centres. The new form makes it easy to audit and eliminate ambiguities. The delegation of financial and administrative signing authority instrument also states that signature specimen forms are to be reviewed and updated annually.

At the time of the audit, some old signature specimen forms had not been replaced and were still being used. Some documents do not reflect the new responsibilities assigned as a result of the appointments made in recent years. The form also has fields for “designated cost centres” but does not provide a list of centres. Some forms grant limited authority (“receive goods only”) under section 34. That authority is interpreted as spending authority. It is therefore essential that the signature specimen forms be reviewed to ensure that the delegation of authority is compliant and up do date.

Expenditures are initiated in the various sectors and approved by the competent authority. The manager signs the invoice to confirm receipt and authorizes payment of the amount due. Finance staffs in the field unit check the information and enter the payment in the STAR financial system. Finally, the person with payment authority under section 33 of the FAA must ensure that the information is complete and compliant before releasing the payment.

The Financial Administration Act and PCA and TBS financial policies are clear, but there are still some ambiguities at the Quebec City Field Unit between commitment authority under section 32 and spending authority under section 34. When we examined the transactions, we found that some invoices associated with an annual commitment (e.g., telephone invoices), an authorization form (e.g., hospitality expenses) or a purchase order did not always have a signature valid under section 34. Authority to commit funds and spending authority are authorities granted separately under the FAA in order to ensure adequate separation of tasks. Measures will have to be taken to ensure that paid invoices have been properly authorized.

Two finance officers share the financial duties, each in a different area of responsibility. It should be noted, however, that for most of the year, there was only one finance officer; the second officer was not hired until October. Managers responsible for their own budget determine the coding, but the finance officers monitor the codes to make certain the financial information is accurate.

Random checks are done by finance staff depending on the risk associated with the type of transaction according to the Statistical Sampling for Account Verification policy. In addition, statistical sampling is done nationally, and lists of selected transactions are sent to the finance group monthly for audit. The Manager, Finance and Administration, acknowledged a delay in the audit process attributable to staff absence. The Quebec City Field Unit is however in recovery mode, and there were audit signs, particularly in the area of hospitality expenses.

Financial reports issued by the finance group are being sent to managers on an increasingly regular basis. Managers are required to validate the information and make any necessary adjustments. There is constant communication between managers and the finance group in order to ensure adequate monitoring.

Conclusion

The controls in place need to be strengthened in order to ensure that the delegation of authority under sections 32 and 34 is understood and applied.

Recommendations

3.
The Superintendent of the Quebec City Field Unit must ensure that signature specimen forms are up to date and reviewed at least once a year.

Management Response

Agree. The Field Unit Superintendent undertakes to finalize the signature specimen forms review exercise with Finance by April 2010, before the operational teams begin their official business.

4.
The Superintendent of the Quebec City Field Unit must ensure that managers and employees in the Finance group understand and comply with financial authority under the FAA.

Management Response

Agree. The Superintendent of the Quebec City Field Unit fully agrees that all employees must understand their roles and responsibilities concerning FAA compliance. Following the signature specimen forms review, Finance will give refresher training to all staff with a financial delegation. This training will be given at the same time as the updated financial delegations, in May 2010.

In cases of non-compliance, action will be taken to help those experiencing difficulties. If an individual at fault does not make any appreciable effort to improve, other measures, which may ultimately include withdrawal of the person’s delegated authority, will be taken.

6.2 Hospitality and food expenses

BLUE Minor Improvements Needed Some controls are in place and functioning; however, several major issues were noted that could jeopardize the accomplishment of program/operational objectives.

To determine whether due diligence is being exercised in the financial process applicable to hospitality and food expenses and whether the controls in place are adequate to ensure compliance with policies, we used the following audit criteria:

C1-
Hospitality activities are carried out at the appropriate locations.

C2-
The financial limits allocated to hospitality activities are respected.

C3-
Hospitality activities are approved before the event with the appropriate level of approval.

C4-
Beneficiaries of the hospitality activities are consistent with the policy of Parks Canada Agency.

C5-
Payments for hospitality activities comply with the provisions of Parks Canada Agency.

C6-
Transactions recorded for the food account comply with the applicable policies and do not include any hospitality expenses.

Process

The government continues to focus on tight financial controls to demonstrate accountability and transparency in the management of public funds. Hospitality is one of the targeted expense categories. The Parks Canada Agency must comply with the Treasury Board’s Hospitality Policy.

Activities must be organized in an economical, uniform and appropriate manner in order to facilitate operations or where courtesy demands. Hospitality expenses must always be approved by the delegated officer before the activity takes place. The Hospitality Policy stipulates delegated authority based on the cost of the activity and the meal limits.

Where approval by the Minister (over $5,000) or the Chef Executive Officer (between $1,500 and $5,000) is required, hospitality expenses must be submitted far enough in advance to ensure that they are authorized before the activity takes place. Authorization from the CEO takes at least two weeks, while authorization from the Minister takes at least one month.

In 2007, Parks Canada issued a new policy on hospitality expenses. A memorandum was sent to senior managers at the time to reinforce the Agency’s position in this regard.

Observations

The Quebec City Field Unit is very involved in the community. A number of historic sites offer special activities or ceremonies for students and tourists.

Hospitality expense forms are completed and approved in advance. Activities generally take place in Parks Canada offices or at Parks Canada sites. However, no list of participants is attached to the form. As good practice, some field units attach a list of participants to the hospitality expense authorization form. Adding a list of participants to the payment documents would enable finance staff to corroborate the number of people attending activities and verify the cost per participant. A list would also confirm where the participants are from and ensure that the manager authorizing the hospitality expenses under section 34 did not benefit from the event.

As part of the examination, eight hospitality expense transactions were audited, representing 69% of the expenses incurred in the period covered by the audit.

Some irregularities were detected regarding mostly the absence of appropriate authority level:

  • one transaction did not have the appropriate level of delegation to authorize payment of the actual costs; those costs exceeded the estimated costs, which changed the level of authority required for the event;
  • one transaction did not have the appropriate level of delegation for pre-authorization;
  • one transaction had no signature on the form for payment of the actual costs;
  • one invoice did not have an appropriate signature for payment.

Food can be purchased in some circumstances for employees working in the backcountry for several days or for very specific activities. This account can be used in those circumstances only and must not include hospitality expenses.

As part of the examination, 10 transactions posted to the food account were audited, representing 55% of the expenses incurred in the period covered by the audit.

The audited expenses were related to specific events and were not associated with hospitality. Only one irregularity was detected in the food account: two transactions did not have the appropriate delegated authority. The issue was raised in section 6.1 Management control framework.

Conclusion

Overall, the controls in place to manage and process hospitality expenses are adequate. However, the importance of having a hospitality expense form that is properly completed and authorized at the right level must be emphasized.

Recommendations

5.
The Superintendent of the Quebec City Field Unit must ensure that hospitality expense forms include the appropriate authorization levels.

Management Response

Agree. The Superintendent of the Quebec City Field Unit, together with Finance, will ensure that this recommendation is applied at all times starting in early 2010-11.

6.
The Superintendent of the Quebec City Field Unit must consider the option of attaching a list of participants to the hospitality expense form in order to ensure tighter control.

Management Response

Agree. In order to tighten controls and improve transparency, the Superintendent of the Quebec City Field Unit will require those responsible for hospitality activities, as well as financial services, to attach a list of participants to their submitted hospitality costs authorization requests. This requirement will be announced in early 2010-11.

6.3 Telecommunications

QFU
YELLOW
Moderate Improvements Needed Some controls are in place and functioning; however, several major issues were noted that could jeopardize the accomplishment of program/operational objectives.
OCIO
YELLOW
Moderate Improvements Needed Some controls are in place and functioning; however, several major issues were noted that could jeopardize the accomplishment of program/operational objectives.

To ensure fair treatment of the entities audited during the audit cycle, we gave two ratings to the telecommunications section in order to reflect the current situation at the Quebec City Field Unit. The field unit has implemented procedures as directed by or in the absence of direction from the National Office. Certain points raised in the “Findings” section concern the Chief Information Officer. Specific recommendations are therefore addressed to the Superintendent of the Quebec City Field Unit and others, to the Chief Information Officer.

To determine whether due diligence is being exercised in the financial process applicable to telecommunications costs and whether the controls in place are adequate to ensure compliance with policies, we used the following audit criteria:

C1-
The manager or designated administrator must document user requirements in terms of wireless telecommunications devices and services.

C2-
All acquisition requests, cancellation or changes in service are coordinated by the designated administrative authority.

C3-
The procurement process for devices is consistent with guidelines.

C4-
Non-standard requests are submitted for approval to the Chief Information Officer (CIO), subject to the manager’s recommendation.

C5-
Attribution of the communication device is authorized by a Level A manager or higher and meets the current criteria.

C6-
Managers ensure that the users who report to them are familiar with the Policy on the Use of Cellular and Other Mobile Wireless Devices and agree to comply with the policy before being granted the device.

C7-
Use of the device complies with the terms of the policy and current guidelines.

C8-
Personal calls are identified, calculated and reimbursed by the user where applicable under the policy’s terms.

C9-
The administrative authorities responsible for managing wireless services at field units and service centres have developed internal processes for this policy.

C10-
Managers and designated administrators regularly examine the staff’s use records.

Process

Parks Canada’s new Policy on the Use of Cellular Phones and other Wireless Devices came into force on October 1, 2008. The goal is to foster more cost-effective and more appropriate use of wireless devices. With that in mind, Public Works and Government Services Canada (PWGSC) has put in place a new procurement process and a new acquisition agreement. In the past, cell phones and other devices were purchased from a large number of suppliers offering a wide range of functions and plan options. The new agreement will make it possible to reduce the Agency’s usage cost. The policy establishes guidelines and official procedures for purchasing, managing and safely and appropriately using cell phones and other wireless devices.

The policy concerns both acquisition and use of these devices. A person must be designated as the administrative authority for the field units and service centres. Any request for purchase, modification or cancellation must be sent to the designated administrative authority. The acquisition must be made from the suppliers listed in the new PWGSC agreement, unless an exception is made. User needs must be documented in order to allow the designated administrator to recommend an appropriate and adequate service. Further to the recommendations, the user’s manager must approve or cancel the request. The Office of the Chief Information Officer and the user’s manager or supervisor must conduct random checks of how wireless devices are used.

A non-standard request is possible if it is well documented and approved by the Chief Information Officer (CIO). Once the CIO’s approval has been obtained, the designated administrator informs PWGSC and obtains its consent to proceed with acquisition of the device. A non-standard request may occur when the suppliers under the agreement cannot meet the user’s needs (e.g., some regions of Canada are not serviced by the accredited suppliers) or if the requested device is not included in the agreement but is required for the job.

The use of cell phones and wireless devices is also regulated. Devices must be used for the Agency’s activities and services, emergency calls and limited personal use. Personal calls must be controlled and identified by users on their monthly statement. A threshold of $30 per year for personal use is considered reasonable. Data is compiled twice a year, in September and March. However, if the $30 threshold is reached in September, the employee must reimburse all personal use expenses for the first six months and in March must reimburse all personal use expenses for the last six months of the fiscal year. The roles and responsibilities of the employee and his or her manager are set out in the policy. The employee must take all necessary measures to ensure the integrity and security of the Agency’s information when using wireless mobile devices to send information. He or she must also comply with guidelines as well as local, provincial and federal laws on the use of wireless devices. The manager must ensure that the employee is familiar with the Policy on the Use of Cellular and Other Mobile Wireless Devices so that he or she may use the device appropriately. They are also required to do checks using indicators that could bring to light potential unauthorized or inappropriate use.

Quebec City Field Unit

YELLOW Moderate Improvements Needed Some controls are in place and functioning; however, several major issues were noted that could jeopardize the accomplishment of program/operational objectives.

Observations

An administrative authority has been designated for the Quebec City Field Unit, but the role has been delegated to the technical support officer, who reports to the Manager, Finance and Administration. Requests are communicated to the officer orally or by e-mail. The officer places orders based on the identified needs. The officer confirms the financial coding with the Manager, Finance and Administration, and ensures that the funds are available before proceeding. An annual commitment for telecommunications costs is entered in the STAR financial system at the beginning of the year. An inventory of devices is kept up to date using Excel spreadsheets.

When a request for a wireless device is made, a form containing information identified under “Administrative Process” in the policy is completed. The form is then sent to the Atlantic Service Centre, which is responsible for activating wireless devices. However, no form is filled out for cell phone requests only an e-mail or oral request for a device is forwarded to the designated manager. This practice is not in line with the administrative process set out in the policy. All requests should be documented in order to justify the need for a wireless device and make it easier to choose a product.

Once the device is received, it is given to the employee with no specific instructions. As good practice users should be required to sign a form acknowledging their obligations under the policy before they take possession of the device. This would encourage the user and the manager to meet their respective responsibilities and obligations. This procedure is used for acquisition cardholders.

To meet operational needs, the Quebec City Field Unit also uses the services of a supplier that is not included in the agreement. This supplier is used for non-standard requests processed through PWGSC. However, no information was available regarding the requirement to obtain authorization of non-standard requests from the Chief Information Officer as stipulated in Parks Canada’s Policy on the Use of Cellular Phones and other Wireless Devices.

When statements of account are received, the technical support officer checks the billing information (number of lines billed, changes, etc.). The officer does a quick check of transactions that might be non-standard (e.g., very large number of long-distance calls). No formal monitoring process is applied. Once he or she is satisfied, the officer signs the invoices under section 34, despite not having the proper-delegated authority. This situation is discussed in section 6.1 Management control framework.

In addition, users are not required to identify personal calls that appear on statements. No compilation is done in September and March of each year. We therefore cannot confirm whether charges for personal calls over the allotted $30 a year are recovered. Only a few employees apply the policy and pay for personal calls.

Recommendations

7.
The Superintendent of the Quebec City Field Unit must put in place a process to ensure that users recognize their obligations regarding the policy on the use of cell phones and other wireless devices.

Management Response

Agree. The Superintendent of the Quebec City Field Unit will ensure that at the beginning of the next fiscal year, all staff with a cell phone or other wireless device are aware of their obligations concerning the use of such devices. A sheet like the one used for acquisition cards will be prepared and signed by the holders of all wireless devices to confirm that they understand and acknowledge their obligations.

However, we will have to consider the particular situation of Grosse-île, which requires us to provide a telephone for emergency calls. In this case, the situation will need to be reviewed together with managers at the Quebec City Field Unit to ensure that everyone is treated fairly.

8.
The Superintendent of the Quebec City Field Unit must put in place a process to:
  • enable users to identify personal calls on their statement of account;
  • track personal calls so that the running total can be checked twice a year and ask users to pay any amount owing under the policy; and
  • ensure proper authorization of invoices under section 34 of the FAA.

Management Response

Agree. The Superintendent of the Quebec City Field Unit will inform the users of wireless devices of their obligations and will ask Finance to establish a process to allow monitoring by managers of the use of these devices. This process will also ensure that all amounts owing under the policy are recovered. The complete process will be in place by late September 2010.

As for the proper authorization of invoices under section 34 of the FAA, Finance has been informed and these invoices are now authorized by the Finance Manager or the Superintendent, who has authority over all funds centres, until the details of the future process are available.

9.
The Superintendant of the Quebec City Field Unit must implement a random check process using the monthly statements in order to ensure appropriate use of wireless devices.

Management Response

Agree. The Superintendent of the Quebec City Field Unit will ask Finance to strengthen the audit done currently by the technical support officer by late September 2010 with more complete audit sampling. These audits will determine whether wireless devices are being used appropriately.

Office of the Chief Information Officer

YELLOW Moderate Improvements Needed Some controls are in place and functioning; however, several major issues were noted that could jeopardize the accomplishment of program/operational objectives.

Observation

As stated, a non-standard request for a telecommunications device was made by the Quebec City Field Unit. The request was apparently processed directly through PWGSC. There is no documentation indicating that the Chief Information Officer approved the request. It should be noted that the practices in place at the Quebec City Field Unit comply with the directives issued by the Office of the Chief Information Officer, but not with the Agency’s Policy on the Use of Cellular Phones and other Wireless Devices. The Chief Information Officer needs to establish a clear interpretation and ensure that field units, service centres and national office directorates obtain the required authorization before proceeding.

Using a standard form would ensure that every request is documented as stipulated in the policy, whether the request is standard or non-standard. The form could be used to obtain approval from the CIO for non-standard requests and also make it easier for field units to control the inventory of cell phones and other wireless devices.

Random checks of the acquisition and use of wireless devices should also be done by the Office of the Chief Information Officer. No formal monitoring process is in place. A system will have to be developed to monitor and support the designated managers.

Interviews conducted in previous audits with the CIO and several staff members responsible for telecommunications confirmed the points rose in this section and led to three recommendations being made to the Chief Information Officer.

Recommendations

10.
The Chief Information Officer must ensure that acquisition requests for wireless devices (including cell phones) are standardized so that the required information is properly documented.

Management Response

Agree: The CIO undertakes to create a standard form that will standardize acquisition requests for wireless devices (including cell phones). The form will be implemented Agency-wide starting April 1, 2010.

11.
The Chief Information Officer must ensure that non-standard requests receive the necessary approval by the CIO before proceeding with PWGSC.

Management Response

Agree: The CIO will make changes to the Agency’s policy on the use of cell phones and other wireless devices in order to ensure that it clearly identifies the steps that must be completed to obtain approval of a non-standard request, including the requirement to obtain authorization from the CIO or a person delegated by the CIO before the request is sent to PWGSC. The changes to the policy will be made before April 1, 2010.

12.
The Chief Information Officer must implement a system to monitor the acquisition and use of wireless devices in order to ensure policy compliance by the designated administrators.

Management Response

Agree: The CIO undertakes to analyse a sample of requests twice a year in order to ensure that the designated managers are complying with the policy. Sampling of requests will begin on April 1, 2010.

Conclusion

Processes need to be put in place by the Quebec City Field Unit and the Office of the Chief Information Officer in order to reduce the risk of non-compliance with the Policy on the Use of Cellular Phones and other Wireless Devices. In addition, some clauses in the policy need to be clarified so that they are not misinterpreted.

6.4 Inventories

RED Unsatisfactory Controls are not functioning or are nonexistent. Immediate management actions need to be taken to correct the situation.

To determine whether due diligence is exercised in the financial process for inventory management of property worth from $1,000 to $10,000, attractive property worth less than $1,000 and property worth over $10,000 and whether controls are adequate to ensure compliance with policies, we applied the following audit criteria:

Items worth $10,000 or less

C1
Items covered by the directive and acquired after April 1, 2007, are entered in the financial system.

C2
The separation of tasks related to the inventory management process is adequate.

C3
A physical inventory was taken in the last 24 months.

C4
Measures are in place to ensure that purchased items are recorded in the inventory, regardless of the procurement method used.

Items worth less than $10,000

C5
Acquisitions are adequately identified and entered in the assets management system.

C6
Acquisitions are entered promptly in the STAR financial system.

C7
A physical inventory was taken in the last 24 months (equipment, vehicles, etc.).

A national inventory management system for property worth $1,000 to $10,000 and attractive property worth less than $1,000 was rolled out in April 2007. Under the Directive on the management of inventories of items worth between $1,000 and $10,000 and attractive items valued at less than $1,000, all items acquired after that date that fit the description must be entered in the maintenance module of the STAR financial system. A physical inventory must be taken every two years in order to validate and adjust the information in the STAR financial system.

Observations

The Quebec Field Unit does not have a process in place to comply with this directive. The last physical inventory was taken more than two years ago. No entries have been made in the maintenance module of the STAR financial system following that inventory. There are some entries in the system, but there is no formal entry process.

It should be noted that the computer support officer maintains an inventory of all computer equipment using a parallel system. All computer equipment has a Parks Canada identification number. Checks were done using that inventory list. Several items were selected and located in the building. Inversely, several items were selected and the inventory was checked to see if they were listed. The selected items were found. It bears mentioning, however, that the check was done in the building that houses the field unit’s administrative offices. No checks were done at other sites under the authority of the Quebec City Field Unit to validate the information on the inventory list.

Procedures need to be put in place to identify and enter all newly acquired items that fit the definition set out in Appendix A of the directive. A physical inventory will have to be taken so that missing information can be entered. Tracking methods will have to be developed to ensure the integrity of the data. Separation of tasks throughout the process has to be taken into account so that the same person does not have access to receipt, identification, entries and custody of the inventory of items covered by the directive.

Regarding items worth more than $10,000, managers with an approved budget for the acquisition of depreciable property must request that an internal order and an asset number be created. Once the asset file is complete, a transaction is made in the financial system to keep account of the appropriate depreciation. The Quebec City Service Centre does these transactions in the financial system for the Quebec City Field Unit. The operations manager for the field unit’s assets makes sure that the entries are made by comparing the data in the STAR financial system with the data in the assets management system.

Note that no physical audit was conducted for property worth $10,000 and over; only the process is described based on interviews.

Conclusion

A formal process needs to be put in place to track inventories of items worth less than $10,000 and ensure the integrity of the data in the financial system.

Recommendations

13.
The Superintendent of the Quebec City Field Unit must put in place a process for identifying items, making entries in the STAR financial system and tracking items in accordance with the Directive on the management of inventories of items worth between $1,000 and $10,000 and attractive items valued at less than $1,000.

Management Response

Agree. The Superintendent of the Quebec City Field Unit will ask Finance to strengthen the inventory tracking system by late December 2010. Managers will require that all newly acquired assets be entered in the inventory. Members of the Finance team, separate from the asset custodians, will be identified to track inventory inflows and outflows. Finance clerks will also perform a final check of newly acquired assets to be entered in the inventory. Their involvement will be important, especially to identify assets not purchased by procurement officers.

14.
The Superintendent of the Quebec City Field Unit must take a physical inventory to confirm the existence of items covered by the directive and enter the items in the maintenance module of the STAR financial system.

Management Response

Agree. Finance will take a physical inventory once the tracking process is fully implemented. This physical inventory will be finalized for March 2011. Afterward, Finance will conduct regular inventories.

6.5 Contracting

BLUE Minor Improvements Needed Some controls are in place and functioning; however, several major issues were noted that could jeopardize the accomplishment of program/operational objectives.

To determine whether due diligence is being exercised in the financial process applicable to contracting and whether the controls in place are adequate to ensure compliance with policies, we applied the following audit criteria:

C1-
Guidelines and procedures relating to contracting practices exist in the field unit/service centre and are in compliance with TBS and PCA policies and directives.

C2-
Adequate training/instruction is provided at all levels to ensure that staff are informed of and understand contracting policies and procedures.

C3-
Compliance with contracting policies and procedures is monitored.

C4-
Management reports relating to contracting activities are produced and used to monitor and supervise those activities.

C5-
A need to award a contract has been identified.

C6-
The appropriate contracting mechanism is used.

C7-
Contracts are awarded fairly, bearing in mind the economy principle.

C8-
The nature of the work to be performed or the good to be delivered is specified in the contracts.

C9-
The contracts include conditions to mitigate the risk of non-performance.

C10-
The contracts are approved by persons with the required authorization.

Process

The Quebec City Field Unit has used the following contracting methods: standing offers, purchase orders, local purchase orders, competitive sourcing and non-competitive sourcing. The directive in place encourages managers to use the contracting and procurement officer for all contracts and purchases over $5,000, which significantly reduces the risk of non-compliance with the contracting policy. It should be noted that courses FIN 101 and FIN 201, which are mandatory for obtaining delegated authority, also deal with the contracting policy. In addition to the training courses, a decision-making grid has been created by the Manager, Finance and Administration, which illustrate the chain of transactions based on needs and amounts. The grid also stipulates that transactions over $2,500 for goods or services must be accompanied by proof of competition.

A rationale must be on file for every sole-sourced contract over $2,500. In addition, the director of the field unit must approve all sole-sourced contracts over $5,000 before proceeding.

For purposes of the audit, we selected 24 files based on transactions entered in the STAR financial system, divided among the following categories:

  Competitive Sourcing Non-competitive Sourcing  
Category Number of Contracts $$ Number of Contracts $$ Total Number per Type Total $$ per Type
Over $10,000 7 $183,166 1 $7,500 8 $190,666
Under $10,000 2 $26,670 3 $12,613 5 $39,283
Local purchase order 2 $5,665 6 $17,754 8 $23,419
Purchase order 1 $22,680 1 $7,350 2 $30,030
Temporary help 1 $9,639 0   1 $9,639
Total 13 $247,820 11 $45,217 24 $293,037

Observations

Overall, the contracting process for transactions over $5,000 complied with Treasury Board’s Contracting Policy. The files contained the appropriate signatures and documentation: statement of work, call for tenders, bids, assessments, confirmation letters and all other correspondence with bidders.

The examination of documents revealed one irregularity related to transactions over $5,000: one purchase order did not have a rationale of sole sourcing.

The process for awarding contracts under $5,000 needs to be improved, however. The examination of files revealed the following instances of non-compliance:

  • three files were entered as competitive, yet there was no clear proof of competition;
  • three non-competitive files had no rationale of sole sourcing;
  • four local purchase orders were used to procure services.

Local purchase orders are used very frequently at the Quebec City Field Unit. Local purchase orders provide the lowest level of control and should be used as little as possible. They are used for contracts under $5,000 for both goods and services. Only the contract form (short-form contract under $5,000) is to be used for service requests. The contracting rules must be applied, such as proof of competition or rationale of sole sourcing.

In addition, three contracts were entered in the wrong category. Two files should have been entered as under $10,000 but were entered as over $10,000, and the opposite was done in another case. There was no financial impact, but the data for the different types of contract are incorrect.

Conclusion

Overall, the process for awarding contracts over $5,000 is adequate. However, contracting under $5,000 needs to be improved. Evidence of competition or rationale of sole sourcing must be on file.

Recommendations

15.
The Superintendent of the Quebec City Field Unit must ensure that:
  • sole-source contracts are justified and properly documented;
  • records of competitive contracts contain evidence of competition;
  • local purchase orders are not used to award service contracts.

Management Response

Agree. At present, contract awards are generally justified and properly documented, and we will ensure that this practice is improved.

For competitive contracts, officers take steps to ensure competition, but these are not always properly documented. Finance will strengthen this practice as of April 2010 by informing staff with a financial delegation that they must properly document contracts under $5K.

Concerning the use of local purchase orders (LPOs), although it is permitted in the instructions appended to the LPO book, Finance will ask users to stop using LPOs to award service contracts as of April 2010.

16.
The Superintendent of the Quebec City Field Unit must ensure that the appropriate contract award forms are used and properly entered in the STAR financial system.

Management Response

Agree. The Superintendent of the Quebec City Field Unit will ensure that a memo is issued by Finance to the relevant individuals in early 2010-11. Moreover, spot checks will be conducted by the contracting officer to determine whether all contracts are awarded correctly, and a report will be provided to the Finance Manager for control purposes.

6.6 Payments to Suppliers

BLUE Minor Improvements Needed Some controls are in place and functioning; however, several major issues were noted that could jeopardize the accomplishment of program/operational objectives.

To determine whether due diligence is being exercised in the financial process applicable to payments to suppliers and whether the controls in place are adequate to ensure compliance with policies, we used the following audit criteria:

C1-
Policies, guidelines and procedures regarding the purchase of/payment for goods and services from suppliers exist at the Field Unit/Service Centre and they adhere to TBS and PCA policies.

C2-
Adequate training/instruction is provided at all levels to ensure awareness and understanding of the policies and procedures.

C3-
Adherence to the policies and procedures is monitored.

C4-
Procurement of goods & services is appropriately initiated and authorized, and funds are properly committed in the financial system.

C5-
Goods and services on suppliers' invoices are matched to P.O /contract specifications.

C6-
Price and quantities on invoices are in accordance with POs/contracts.

C7-
A person with the appropriate delegated authority signs S.34 FAA.

C8-
Advances and progress payments are made only when in accordance with the terms of the contract.

Observations

The audit of payments to suppliers consisted in ensuring that payments are made on time and for the right amount for the goods or services and that people with the proper-delegated authority authorized the purchases. Some accounts are targeted for audit, namely training expenses and professional dues. We also examined an invoice received from PWGSC for engineering services. A selection of transactions was taken from various accounts, including travel expenses, to ensure equitable and representative coverage of expenditures. In addition, a number of acquisition card statements were examined in order to validate the process in place.

Table of main accounts audited for this section:

Name of Account Number of Transactions Audited $ Amount % of expenses audited / total expenses charged to account
Professional dues 6 3,265 58.81%
Training 2 1,910 81.80%
Travel 5 4,781 8.33%
Engineering services 1 610,819 69.29%
Other accounts 22 46,600 27.48%

Suppliers’ invoices are received and date-stamped in the file room. They are then forwarded to Finance, matched with the purchase orders and sent to the managers for authorization. The managers have to certify compliance under section 34 of the FAA, including the coding. Once all the vouchers are together, the documents go back to Finance for payment. The financial officers are responsible for ensuring that all the required information is on hand and that the appropriate signatures have been obtained before making the payment.

When a payment has to be made under a contract, the invoices are sent to the contracting and procurement officer, who checks for compliance with the contract terms. The invoice is then matched with the receipt and forwarded to a financial officer for payment.

Controls are applied in accordance with the policy on Statistical Sampling for Account verification. In addition, the person exercising payment authority under section 33 of the FAA does random checks of regular transactions; high-risk transactions are given special attention. The following transactions are considered by Finance staff to be high risk:

  • hospitality;
  • professional dues;
  • payments under contracts over $10,000; and
  • travel expenses over $1,000.

The financial group acknowledges that checks have not been done systematically in the past year. Staff absences and recent appointments in the finance sector have made it impossible to do as much monitoring as hoped. However, some of the selected documents had been reviewed before we visited.

As a rule, expenditures over $1,000 have to be committed in the financial system. Invoices over $1,000 are sometimes sent to Finance without a commitment in the STAR financial system. Transactions made by acquisition card are included in this group. No commitment is entered in STAR before the statements of account are received. Recurring expenditures like professional dues and communication costs are committed in the STAR financial system at the beginning of the year. For budget control purposes, a process should be put in place to enter all committed expenditures over $1,000, regardless of the form of payment.

Overall, payments to suppliers are controlled. However, some irregularities were observed:

  • one travel claim included reimbursement for three meals, yet there was no mention of any activity (training, meeting, etc.) outside the work area;
  • annual dues for an association were paid without the appropriate level of delegation to authorize the payment;
  • one transaction made by acquisition card was over the limit set by the field unit;
  • five transactions had no received date on the invoice;
  • three transactions were signed by people who did not have the proper authority (point raised in section 6.1 Management control framework).

The audit of acquisition card statements confirmed that a purchase log identifying completed transactions is used to make it easier to balance the account. The supplier’s name, the financial coding and the manager’s signature are clearly indicated. The control process in place for acquisition cards is acceptable.

Conclusion

Notwithstanding the point raised concerning the delegation of authority, the financial process for making payments to suppliers is adequate. Only commitment procedures will have to be developed to ensure appropriate budget tracking.

Recommendations

17.
The Superintendent of the Quebec City Field Unit must ensure that expenditures over $1,000 are committed in the STAR financial system in order to facilitate budget tracking.

Management Response

Partly agree. At present, all expenditures made other than by acquisition card or petty cash are committed in STAR as soon as possible. Given that petty cash expenditures are under $100, only acquisition card transactions require closer control. The managers agree that tracking these transactions is more difficult for them, and the team will come up with a way to make it easier. A few solutions have been put forward, and we will try to finalize this change in early 2010-11.

6.7 Financial Coding

GREEN Controlled Controls are functioning as intended and no additional actions are necessary at this time.

To determine whether due diligence is being exercised in the financial process applicable to financial coding and whether the controls in place are adequate to ensure compliance with policies, we used the following audit criteria:

C1-
Coding guidelines and procedures have been developed for the field unit or service centre.

C2-
Appropriate training/instruction is provided at all levels to ensure knowledge and understanding of coding policies and procedures.

C3-
Compliance with the chart of accounts is monitored.

C4-
Individuals with the appropriate knowledge handle coding.

C5-
Coding is validated when entered into the STAR system (financial system).

Observations

Managers with spending authority or their assistants are responsible for financial coding. When invoices are received, they are matched with appropriate documents and the financial code is recorded on the invoice by hand or identified on the purchase orders. The chart of accounts and any information necessary to select the appropriate financial codes are available on the Agency intranet under “Financial Policies”. Some managers have created lists of internal order numbers assigned to projects with the appropriate accounts in order to facilitate their teams’ work.

Finance staffs examine the financial codes only for payments subject to detailed checks, i.e., those selected by statistical sampling, high-risk transactions and payments chosen by random checks.

We audited the financial coding of transactions selected from a sample examined for the different financial processes. One document did not have a general ledger account number.

Overall, financial coding is adequate. The documents examined have appropriate coding.

No recommendation