Parks Canada
Symbol of the Government of Canada

Common menu bar links

Internal Audit and Evaluation Documents

Audit of Key Financial Processes - Jasper Field Unit

Final Report
April 2010

Prepared by:
Samson & Associates

Table of Contents

Summary

1. Background

2. Objectives and Scope

3. Methodology

4. Statement of Assurance

5. Conclusion

6. Observations and Recommendations

6.1 Management Control Framework (MCF)
6.2 Hospitality and Food Expenses
6.3 Telecommunication
6.4 Payments to Suppliers
6.5 Contracting
6.6 Inventory
6.7 Financial Coding

Printable Version


Note: To read the PDF version you need Adobe Acrobat Reader on your system.

If the Adobe download site is not accessible to you, you can download Acrobat Reader from an accessible page.

If you choose not to use Acrobat Reader you can have the PDF file converted to HTML or ASCII text by using one of the conversion services offered by Adobe.



Report presented to the Parks Canada Audit Committee meeting of June 30th, 2010

Summary

Parks Canada Agency (PCA) conducts cyclical audits of key financial, administrative and management practices in the national and regional offices, directorates and branches, Field Units, and Service Centers. The audits evaluate compliance with the policies and practices of the Treasury Board Secretariat (TBS) and the Parks Canada Agency. The audit of the Jasper Field Unit (JFU) was conducted as part of the PCA audit cycle.

The objectives of this audit were to determine whether due diligence is exercised in key management processes and to provide assurance to senior management that processes and controls in place at the Jasper Field Unit limit risks of non-compliance with TBS and PCA policies.

The exercise included a review of the Management Control Framework (MCF) for financial management as well as key processes in the following financial areas: hospitality and food charges, telecommunication, payments to suppliers, contracting, and non-capital assets inventory management. This audit covered the period from April 1, 2009 to January 15, 2010.

The audit methodology consisted of a review of relevant documents, interviews with staff of the JFU and sampling of transactions in order to test controls in the main financial areas. The on-site work was carried out between January 11th and 15th, 2010

The audit engagement was planned and conducted to be in accordance with the Internal Audit Standards for the Government of Canada.

In general, we determined that financial controls are in place and functioning. However, some changes and improvements are required regarding the telecommunication, payment to suppliers and contracting, to strengthen systems and controls in place and increase the level of compliance with TBS and PCA policies.

Audit Report Rating Summary

Ref. Management Process Rating
6.1 Management Control Framework BLUE – Minor Improvements Needed
6.2 Hospitality & Food BLUE – Minor Improvements Needed
6.3 Telecommunication - JFU YELLOW – Moderate Improvements Needed
Telecommunication - OCIO YELLOW – Moderate Improvements Needed
6.4 Payments to Suppliers YELLOW – Moderate Improvements Needed
6.5 Contracting YELLOW – Moderate Improvements Needed
6.6 Inventory Management BLUE – Minor Improvements Needed
6.7 Financial coding GREEN-Controlled

Below is our list of recommendations to the Jasper Field Unit Superintendent:

Hospitality and Food Expenses

1.
The Field Unit Superintendent needs to ensure that hospitality activities are pre-approved and are compliant with PCA and TBS Hospitality Policy.

Telecommunication

2.
The Field Unit Superintendent must put controls in place to ensure that personal calls are tracked on a cumulative basis and that cellular phone invoices are reviewed by managers in order to ensure compliance with the PCA policy on cell phones and wireless devices.

3.
The Field Unit Superintendent must put in place a process to ensure that users recognize their obligations regarding the policy on the use of cell phones and other wireless devices.

Payments to Suppliers

7.
The Field Unit Superintendent should reinforce controls to ensure that payment file documentation is strengthened in the following areas:

  1. Documentation supporting the commitment of funds should be included in the payment file and properly approved under S.32 of the FAA for all expenses over $1 000.
  2. Receiving date should be stamped on the invoice or envelopes to maintain a chronological trail of payment process.
  3. Section 34 approval documents must be clearly signed and dated by the authorized manager under FAA.
  4. Receiving slips or other proof of receipt of goods/services should be attached to the invoices.

Contracting

8.
The Field Unit Superintendent must ensure that local purchase order (LPOA) authorities are:

  1. used appropriately if other mechanism is not possible,
  2. not used to enter into a service agreement.

Inventory

9.
The Field Unit Superintendent must ensure that roles, responsibilities and controls in place, with regards to inventory management are documented and communicated to stakeholders to ensure that there is compliance with the Directive on Inventory Management for Items.

Below is our list of recommendations to the Chief Information Officer regarding telecommunication:

4.
The Chief Information Officer must ensure that acquisition requests for wireless devices (including cell phones) are standardized so that the required information is properly documented.

5.
The Chief Information Officer must ensure that non-standard requests receive the necessary approval by the CIO before proceeding with PWGSC.

6.
The Chief Information Officer must implement a system to monitor the acquisition and use of wireless devices in order to ensure policy compliance by the designated administrators.

1.0 Background

Parks Canada Agency (PCA) conducts cyclical audits of key financial, administrative and management practices in the National Office, directorates and branches, Field Units, and Service Centres. The audit of the Jasper Field Unit was conducted as part of the program of cyclical audits of key financial processes by Parks Canada’s Internal Audit and Evaluation Office.

The Jasper Field Unit is located in the town of Jasper Alberta. The majority of the management team is located in this office.

Under the direction of the Superintendent, the Jasper Field Unit is structured into 9 key organizational units:

  • Resource Conservation
  • Visitor Experience
  • External Relations
  • Townsite Manager Jasper National Park
  • Site Manager Fort St James
  • Integrated Land Use Planning
  • Asset Management
  • Finance and Administration
  • Human Resources

The 2009/2010 annual operating budget for the Jasper Field Unit is approximately $22.3 million. The JFU has a complement of approximately 195 FTEs.

2.0 Objectives and Scope

The objectives of this audit were to confirm whether due diligence is exercised in key management processes within the JFU and to provide assurance to senior management that processes and controls in place are adequate to ensure compliance with TBS and PCA policies and practices.

The audit comprised the review of the MCF as applied to financial management and the following key financial process areas:

  • Expenditures on hospitality and food;
  • Telecommunication;
  • Payments to suppliers;
  • Contracting; and
  • Inventory management.

The audit covered transactions entered into the financial system (STAR) between April 1st and December 31, 2009.

3.0 Methodology

The audit methodology included the following activities:

  • interviews with Jasper Field Unit management and staff responsible for key operational areas;
  • interviews with Jasper Field Unit finance and administration staff responsible for account verification and processing of accounts payable and providing most procurement and contracting services for the Unit;
  • examination of relevant documentation, including the organization chart, the PCA delegated signing authorities chart, policies governing key financial process areas, the business plan and a sampling of the budgets and financial reports; and
  • examination of a sample of transactions for each of the key financial process areas identified above, as required.

The transaction sample used sorted data from STAR and is based on a proportional and judgmental selection for transactions relating to the areas covered in the audit. The on-site work was carried out between January 11-15, 2010.

TRANSACTION TESTING TABLE
Control tested No. of transactions Transactions value
Hospitality & Food 18 $19,355
Telecommunication 15 N/A
Payments to Suppliers 44 $271,443
Contracting 26 $1,210,104
Inventory Management N/A N/A

After the fieldwork at the JFU was completed, the Field Unit Superintendent, Manager Finance and Administration and the Financial Officer, were debriefed on the preliminary observations.

Our observations and recommendations were made in accordance with the Audit Reporting Rating System described below:

Audit Reporting Rating System
RED Unsatisfactory Controls are not functioning or are nonexistent. Immediate management actions need to be taken to correct the situation.
ORANGE Significant improvements needed Controls in place are weak. Several major issues were noted that could jeopardize the accomplishment of program/operational objectives. Immediate management actions need to be taken to address the control deficiencies noted.
YELLOW Moderate improvements needed Some controls are in place and functioning. However, major issues were noted and need to be addressed. These issues could impact on the achievement of program/operational objectives.
BLUE Minor improvements needed Many of the controls are functioning as intended. However, some minor changes are necessary to make the control environment more effective and efficient.
GREEN Controlled Controls are functioning as intended and no additional actions are necessary at this time.

4.0 Statement of Assurance

The audit engagement was planned and conducted to be in accordance with the Internal Audit Standards for the Government of Canada.

5.0 Conclusion

In general, we determined that financial controls are in place and functioning. However, some changes and improvements are required regarding the telecommunication, payment to suppliers and contracting, to strengthen systems and controls in place and increase the level of compliance with TBS and PCA policies.

6.0 Observations and Recommendations

6.1 Management Control Framework (MCF)

BLUE Minor improvements needed Many of the controls are functioning as intended. However, some minor changes are necessary to make the control environment more effective and efficient.

To determine whether the management control framework is adequate to ensure compliance with financial policies, we used the following audit criteria:

C1-
Information essential for achieving operational objectives is identified, collected, processed and quickly transmitted to those concerned.
C2-
Staff members’ roles and responsibilities, specifically those relating to control, are clearly identified, documented and communicated.
C3-
Business and operational plans are prepared in cooperation with the stakeholders concerned and adequately establish the budget parameters, human and material resource needs, and security needs.
C4-
The control environment in place is conducive to sound and effective management.
C5-
The control activities conducted allow for shortcomings to be identified quickly and for corrective measures to be taken within a reasonable timeframe.
C6-
The control activities conducted ensure proper management of financial staff.
C7-
There are sufficient finance team members capable of achieving operational objectives.
C8-
Operational risks are assessed formally on a regular basis.

6.1.1 Organizational Structure

Management Information

The Jasper Field Unit has a management committee in place comprised of twelve managers. The committee discusses and establishes short and long-term policies for the Jasper Field Unit and updates the strategic business plan. Once adopted, information critical to the achievement of operational objectives is identified and communicated through the Jasper Field Unit business plan.

Policies, guidelines and work instructions are communicated to staff members through emails and are available on the Agency’s intranet site. Administrative staff ensures that changes in policy and guidelines are communicated to all managers. Staff in remote sites have periodic access to the Agency’s intranet and receive notices of changes through a variety of means such as written communiqués and by satellite and cellular phones.

The Agency and Directorates promulgate numerous policies, guidelines, work instructions and checklist documents to guide staff in their daily operational responsibilities. Because there are no Agency wide procedural manuals that document administrative procedures and requirements, the operational units in the Jasper Field Unit have developed their own administrative guidelines to foster consistency in services and facilitate the transition during employee changeovers. For day-to-day operations, managers and staff rely heavily on administrative staff, financial managers and procurement officers to obtain verbal information on procedural requirements. Managers expressed satisfaction with the timeliness of information provided to them from support staff.

Staff meetings in the Jasper Field Unit and meetings within each organization within the unit are held to inform staff of the status of projects, emerging priorities and realignment of resources, etc. Retreats can also be held to discuss strategy and alignment where it is deemed necessary. The Field Unit Superintendent holds bi-weekly management meetings where the Field Unit’s ongoing business is reviewed and discussed. Manager’s performance agreements include provisions on delivery of objectives.

The Jasper Field Unit’s organizational chart is updated on a regular basis. At the time of the audit, the current chart was up to date. It should be noted; however, that organizational changes are underway in the Jasper Field Unit and the organization chart will be modified to reflect these changes.

The Jasper Field Unit reacts to customer complaints through local staff. Complaints are elevated to senior management when required.

Roles and Responsibilities

The Jasper Field Unit operational groups are responsible for providing leadership and support to the achievement of the Agency’s mandate in such program activity areas as: ecological and cultural conservation; education; experience; and townsites-responsible growth management with due regard to heritage and environmental conservation.

The primary role of the Finance and Administration (F & A) group in the Jasper Field Unit is to act as a resource for managers, in connection with budgets and financial directives and policies. As the programs managed by the Jasper Field Unit are highly visible and impact the general public, applying financial directives and policies requires the support of persons with an in-depth knowledge of the rules. This ensures that all parties involved can exercise their area of expertise effectively and ultimately this will shorten the time required for decision-making. The Finance and Administration group provides a full range of financial and administrative services in support of the Jasper Field Unit.

With respect to the roles and responsibilities of staff members, official documents are available, such as the organization chart and the generic job descriptions. Generic job descriptions are used as a basis to develop “statements of qualifications” that describe job competency requirements and specific tasks to be performed on an everyday basis as part of the staffing process. When employees are initially hired, they receive a copy of their generic job description and the statement of qualifications that complements the generic job description. In addition, these documents may be consulted at all times on the Agency’s Intranet. The specific tasks that are to be performed are included in the employee’s performance and evaluation plan. Appraisals are conducted on an annual basis; personal development plans and objectives set for the next year are reviewed with the employee to ensure that their significance in terms of achieving the Agency’s overall objectives has been understood. Adjustments may be made verbally during the year.

Business Plans and Budgets

The Jasper Field Unit management committee prepares a five-year Sustainable Business Plan for Jasper National Park. The plan is reassessed and updated every year. The plan was updated in January 2010. The plan includes the Units’ overall objectives and specific program objectives by fiscal year. The Sustainable Business Plan is reviewed and approved at PCA Headquarters.

The Sustainable Business Plan includes the budget allocations for the year and the forecasts for the coming years. Managers monitor budgets, expenditures and forecasts. Financial reports, budget analysis and forecasting templates are sent to managers by the office of the CFO to enable them to account for their financial activities and to address potential budget variances. The Superintendent, Jasper Field Unit challenges and questions financial information and any discrepancies monthly.

The total operating budget of the Jasper Field Unit for 2009-2010 is approximately $22.3 million.

Segregation of Financial Duties and Team Capacity

The segregation of duties is clearly defined by the Jasper Field Unit organizational structure. Expenditures are initiated in various Field Unit groups and approved by the competent authority. All managers with Section 34 of the Financial Administration Act (FAA), spending authority have passed the F101 and F201 courses, a prerequisite for obtaining such authority.

The administrative staffs in individual Field Unit groups are responsible for entering commitments in the STAR financial system. These staff members are encouraged to follow the prerequisite Finance and Administration courses to improve their understanding of the requirements. Once the goods or services are received or rendered, the manager signs the invoice to confirm receipt and authorizes payment of the amount owing. Finance & Administration group finance personnel ensure that all supporting documents are appended to the invoices and enter the payment information into STAR. Finally, the financial officer with payment authority under Section 33 of the FAA ensures that the information is in compliance and complete before issuing payment.

6.1.2 Control and Monitoring Environment

In order for the Finance staff to assert effective control, Specimen Signature Cards must be complete, accurate, up to date and readily available. In addition, the Agency’s Delegation of Financial Signing Authority instruments must also be available and up to date. The audit confirmed that the Finance & Administration group had in place the most recent Agency Delegation of Financial Signing Authority instrument and the Specimen Signature Cards on hand were up to date.

To ensure that staff clearly understands acceptable financial practices, management is responsible for ensuring that personnel with financial delegation of financial signing authority have successfully completed the F101 and F201 courses that are prerequisites for obtaining spending authority.

Managers rely heavily on administrative staff to monitor the use of proper procedures and to provide support and advice to managers regarding financial policies. The Manager, Finance and Administration also provide direction on any questions regarding financial policy. When policy changes are made, emails are sent to all staff to keep them informed. Copies of policy, guidelines and other explanatory documents are available on the Agency's Intranet.

Managers who have been delegated spending authority under Section 34 of the FAA are responsible and accountable for compliance with financial policy. The accounts payable staff in the Finance & Administration group review payment files. In processing expenditures, instances of non-compliance are identified and managers are requested to provide the appropriate documentation before the payment is processed. Instances of non compliance are formally documented. The Finance & Administration group notifies managers regarding recurring errors and works with these managers to find the cause of these recurring errors and solutions to prevent their reoccurrence.

The Account Verification Policy updated in 2009 describes the statistical sampling process for low risk transactions and the extent of verification required for high risk transactions. Consideration should be given to reviewing the current Account Verification Policy to ensure it is based on the Agency’s current organizational structure and associated risks and is fully compliant with TBS policy requirements. This issue was raised in a recent audit report and management is committed to update the policy by April 1st 2010.

In order to comply with the current Account Verification Policy, the Office of the CFO statistically selects transactions to be verified a second time by finance personnel in PCA organizations exercising Section 33 FAA. In the case of the Jasper Field Unit this verification work is conducted by the Finance & Administration group. Statistical sampling is carried out nationally, and account verification results are compiled and sent to the office of the CFO. The Office of the CFO provides periodic feedback to the Jasper Field Unit Finance & Administration group, as needed, on issues identified during the account verification process.

Lessons learned from common errors or failures to comply with a financial policy are not formally communicated by the CFO, not permitting adequate review and follow-up action. The adoption of such a practice at the national level could reduce repetitive errors and confirm staff understanding of how to apply financial policies.

Expenditure reports are sent to the Jasper Field Unit by the office of the CFO. Managers must confirm the accuracy of the data and provide variance analysis and forecasts for the coming months. Forecasts are reviewed and challenged by the Superintendent. This exercise is carried out at the end of the first and second quarters of the fiscal year and every month during the last two quarters. Adjustments are made to the budget targets as required to ensure optimization of resources at the directorate level.

6.1.3 Risk Assessment

PCA Headquarters conducts a risk assessment for the overall Agency. The Jasper Field Unit manages risk based on the Agencies’ corporate risk assessment and the priorities identified. Managers are aware of the operational risks specific to their areas of responsibility. Risk management strategies are established and documented based on Agency directives. Some examples of risks include:

  • Communication with the media;
  • Public opinion;
  • Legislative compliance risk; and
  • Physical damage and loss (Forest fires, floods, etc).

While establishing the Sustainable Business Plan, some activities were identified as representing a higher risk than others. These risk factors are discussed and reviewed at management committee meetings. Mitigating measures are also studied and implemented to reduce the impact of the risks identified. This process ensures that business plans and financial forecasts take into account the risk management strategies identified at the Field Unit level.

In the Jasper Field Unit, a mature risk management process is in place. Major risks are identified and addressed in the Business Plan. Mitigation measures have been established to assist managers in the management of operational risks. It is often difficult to predict events that will generate risk for the Jasper Field Unit. Risks emerging from unforeseen situations are managed in an expedient, proactive and integrated manner by the Jasper Field Unit management team.

Overall Assessment of the Management Control Framework

The various components of the Management Control Framework are well documented. Managers and staff have a working knowledge of the Agencies policies and guidelines, their goals and objectives, as well as their roles and responsibilities. However, some opportunities for improvement were noted during the audit that requires management attention (see detail in section 6.2 to 6.7).

6.2 Hospitality and Food Expenses

BLUE Minor improvements needed Many of the controls are functioning as intended. However, some minor changes are necessary to make the control environment more effective and efficient.

To determine whether due diligence is being exercised in the financial process relating to hospitality expenses and whether controls in place are adequate to ensure compliance with policies, we have used the following audit criteria:

C1-
Hospitality functions take place in appropriate venues.
C2-
The financial limitations placed set out for hospitality functions are respected.
C3-
Hospitality functions are approved by the appropriate authority prior to the event.
C4-
The recipients of hospitality are consistent with Parks Canada Agency policy.
C5-
Payment for activities functions comply with Parks Canada Agency provisions.
C6-
Transactions entered in the food account are in compliance and do not include any hospitality fees.

Observations

Hospitality is used to provide non alcoholic beverages (i.e. coffee, juice) at official Agency functions and certain types of meetings. Hospitality expenditures do not include food, except for pre-approved strategic management meetings where it is demonstrated that it is more efficient to provide food instead of interrupting the meeting for lunch and breaks. Otherwise, government employees that are on travel status receive a daily meal allowance to cover food costs. No other costs are to be charged to hospitality.

Requests for hospitality functions must be approved at the appropriate level before the activity takes place using the appropriate form which explains the nature and scope of the planned activity. The completed document must be signed and submitted with the payment request.

Where approval by the Minister (>$5,000) or by the CEO (between $1,500 and $5,000) is required, requests for approval of hospitality must be submitted sufficiently in advance to ensure that authorization is received before the activity is held.

Findings

  • In 2 cases or 11% of files reviewed, meeting room rental costs were incorrectly charged as hospitality (see details at section 6.7).

  • In 1 case or 6% of files reviewed, the hospitality pre-authorization form was not found in the payment file.

  • In 1 case or 6% of the files reviewed, a participant list was not provided for a joint event with the Municipality of Jasper.

As a best practice, a list of participants can be attached to the form in order to confirm the origin and number of the participants in attendance. It also shows that the person who authorized the hospitality expenses did not personally benefit from the event.

Overall, the controls in place to manage and process hospitality expenses are satisfactory. However, management needs to clarify the interpretation of allowable hospitality activities and strengthen controls to ensure the validity of expenditures.

Recommendation

1.
The Field Unit Superintendent needs to ensure that hospitality activities are pre-approved and are compliant to PCA and TBS Hospitality Policy.

Management Response

Agree: The Field Unit Superintendent with the management team will ensure that this recommendation is followed. Hospitality activities that are not pre-approved may not be reimbursed.

6.3 Telecommunication

JFU
YELLOW
Moderate Improvements Needed Some controls are in place and functioning; however, several major issues were noted that could jeopardize the accomplishment of program/operational objectives.
OCIO YELLOW Moderate Improvements Needed Some controls are in place and functioning; however, several major issues were noted that could jeopardize the accomplishment of program/operational objectives.

To ensure fair treatment of the entities audited during the audit cycle, we gave two ratings to the telecommunications section in order to reflect the current situation at the Jasper Field Unit. The field unit has implemented procedures as directed by or in the absence of direction from the National Office. Certain points raised in the “Findings” section concern the Chief Information Officer. Specific recommendations are therefore addressed to the Superintendent of the Jasper Field Unit and others, to the Chief Information Officer.

To provide assurance to senior management that processes and controls are in place to reduce the risk of non-compliance with the Parks Canada Agency’s Policy on the Use of Cellular Phones and Other Wireless Devices and guarantee that the allocated wireless devices are used appropriately. We have used the following audit criteria:

C1-
The designated manager or authority is to document user needs for wireless telecommunications devices and services.
C2-
All requests for procurement, use and service charges are coordinated by the designated administrative authority.
C3-
The procurement process for the devices complies with guidelines.
C4-
Non-standard requests are submitted at the manager’s recommendation to the chief Information Officer (CIO) for approval.
C5-
The allocation of the communication devices was authorized by a manager at level A or higher and complies with effective standards.
C6-
Managers ensure that users under their responsibility are familiar with the Policy on the Use of Wireless Devices and that users agree to comply with the policy before devices are allocated.
C7-
Devices are used in compliance with current policy and guidelines.
C8-
Personal calls are identified and tallied and any resulting charges are reimbursed by the user in accordance with policy provisions.
C9-
Administrative authorities responsible for managing wireless services in the Directorate have developed internal procedures for this policy.
C10-
Designated managers and authorities regularly review employee usage.
C11-
The CIO performs random audits of the use of wireless devices and services to ensure compliance with effective policies.

Description of the Process

Parks Canada’s Policy on the Use of Cellular and Other Mobile Wireless Devices came into force on October 1, 2008. Its purpose is to ensure more cost-effective and appropriate use of wireless devices. To this effect, Public Works and Government Services Canada (PWGSC) has implemented a new procurement process and a new acquisition agreement. In the past, cell phones and other devices were purchased from a large number of suppliers offering a wide range of functions and plan options. Now, only two authorized service providers have been selected. No other service providers are allowed, unless there are zone coverage issues. The policy is available on the Agency’s intranet. The new agreement should enable the Agency to reduce the costs of using such devices. The policy provides guidelines and official procedures for safe and appropriate purchase, management and use of cell phones and other wireless devices.

The policy concerns both acquisition and use of these devices. A person must be designated as the administrative authority for the field units and service centres. Any request for purchase, modification or cancellation must be sent to the designated administrative authority. The acquisition must be made from the suppliers listed in the new PWGSC agreement, unless an exception is made. User needs must be documented in order to allow the designated administrator to recommend an appropriate and adequate service. Further to the recommendations, the user’s manager must approve or cancel the request. The Office of the Chief Information Officer and the user’s manager or supervisor must conduct random checks of how wireless devices are used.

A non-standard request is possible if it is well documented and approved by the Chief Information Officer (CIO). Once the CIO’s approval has been obtained, the designated administrator informs PWGSC and obtains its consent to proceed with acquisition of the device. A non-standard request may occur when the suppliers under the agreement cannot meet the user’s needs (e.g., some regions of Canada are not serviced by the accredited suppliers) or if the requested device is not included in the agreement but required for the job.

The use of cell phones and wireless devices is also regulated. Devices must be used for the Agency’s activities and services, emergency calls and limited personal use. Personal calls must be controlled and identified by users on their monthly statement. A threshold of $30 per year for personal use is considered reasonable. Data is compiled twice a year, in September and March. However, if the $30 threshold is reached in September, the employee must reimburse all personal use expenses for the first six months and in March must reimburse all personal use expenses for the last six months of the fiscal year. The roles and responsibilities of the employee and his or her manager are set out in the policy. The employee must take all necessary measures to ensure the integrity and security of the Agency’s information when using wireless mobile devices to send information. He or she must also comply with guidelines as well as local, provincial and federal laws on the use of wireless devices. The manager must ensure that the employee is familiar with the Policy on the Use of Cellular and Other Mobile Wireless Devices so that he or she may use the device appropriately. He or she must also use indicators to check for potentially unauthorized or inappropriate use.

6.3.1 Jasper Field Unit

YELLOW Moderate improvements needed Some controls are in place and functioning. However, major issues were noted and need to be addressed. These issues could impact on the achievement of program/operational objectives.
Observations

Managers determine the phone requirements for their area(s) of responsibility. Phones are issued to staff with travel requirements, or those that must be reached in case of emergencies or outside business hours. New phone requests must be properly justified. Requests for new units, approved by managers are forwarded to the Finance and Administration group who act as the Jasper Field Unit’s wireless device coordinator.

Phones are purchased by the Jasper Field Unit coordinator through PWGSC. PWGSC has a National Master Standing Offer in place and the supplier and plans are dictated in this document.

The coordinator advised the auditors that Accounts Payable monitors the usage of cell phones and blackberries on a monthly basis. They flag any apparent anomalies and notify the cell phone/blackberry holders. The managers are informed if corrective action is not taken. The co-ordinator advised the auditors that during the past fiscal year approximately ten employees reimbursed the Agency for personal usage.

When an employee receives a cell/phone or blackberry device, they are given a document that outlines the policy on cellular phones/blackberry devices and, in particular, the policy requirements regarding personal usage. Managers are also provided with cell phone/blackberry device policy information on a periodic basis. However, no formal acknowledgement is signed by phone users when phones are issued. As a best practice, users should be asked to sign a form acknowledging the policies in force with respect to the use of wireless devices before they are given the device. This formality will encourage the user and manager to meet their respective responsibilities and obligations. This practice is observed with acquisition cards.

Employees are required to identify and track personal phone use; however, there is no formal oversight process in place to monitor personal phone use at the Jasper Field Unit. Managers with the appropriate delegated authority review and approve phone invoices under Section 34 of the FAA.

Findings
  • In 80% of cases (12 of 15), there was no evidence of tracking of personal calls on file.

  • In 80% of cases, there was no evidence of manager review of personal phone calls, even where the phone user provided a list of personal phone calls.
Recommendations
2.
The Field Unit Superintendent must put controls in place to ensure that personal calls are tracked on a cumulative basis and that cellular phone invoices are reviewed by managers in order to ensure compliance to the PCA policy on cell phones and wireless devices.

Management Response

Agree: The Jasper Superintendent will enhance the process to allow monitoring by managers of the use of the wireless devices. The process will ensure that all amounts owing under the policy are recovered. The section manager of the users of these devices will be asked quarterly to review their usage and acknowledge that all personal usage has been identified and tracked.

3.
The Field Unit Superintendent must put in place a process to ensure that users recognize their obligations regarding the policy on the use of cell phones and other wireless devices.

Management Response

Agree: The Jasper Superintendent will ensure that all staff in receipt of wireless devices signs a form to acknowledge their obligations as identified in the policy.

6.3.2 Office of the Chief Information Officer

YELLOW Moderate Improvements Needed Some controls are in place and functioning; however, several major issues were noted that could jeopardize the accomplishment of program/operational objectives.
Observation
No non-standard device has been requested from the Jasper Field Unit for the audited period. However, previous audit works show that acquisition of non-standard devices is not always approved by the CIO and no formal form is in place to ensure consistency in the application of the policy. The office of the CIO should reinforce the message that the purchase of non-standard device required the CIO approval prior to order the item.

Using a standard form would ensure that every request is documented as stipulated in the policy, whether the request is standard or non-standard. The form could be used to obtain approval from the CIO for non-standard requests and also make it easier for field units to control the inventory of cell phones and other wireless devices.

Random checks of the acquisition and use of wireless devices should also be done by the Office of the Chief Information Officer. No formal monitoring process is in place. A system will have to be developed to monitor and support the designated managers.

Interviews conducted in previous audits with the CIO and several staff members responsible for telecommunications confirmed the points rose in this section and led to three recommendations being made to the Chief Information Officer.

Recommendations
4.
The Chief Information Officer must ensure that acquisition requests for wireless devices (including cell phones) are standardized so that the required information is properly documented.

Management Response

Agree: The CIO undertakes to create a standard form that will standardize acquisition requests for wireless devices (including cell phones). The form will be implemented Agency-wide starting April 1, 2010.

5.
The Chief Information Officer must ensure that non-standard requests receive the necessary approval by the CIO before proceeding with PWGSC.

Management Response

Agree: The CIO will make changes to the Agency’s policy on the use of cell phones and other wireless devices in order to ensure that it clearly identifies the steps that must be completed to obtain approval of a non-standard request, including the requirement to obtain authorization from the CIO or a person delegated by the CIO before the request is sent to PWGSC. The changes to the policy will be made before April 1, 2010.

6.
The Chief Information Officer must implement a system to monitor the acquisition and use of wireless devices in order to ensure policy compliance by the designated administrators.

Management Response

Agree: The CIO undertakes to analyse a sample of requests twice a year in order to ensure that the designated managers are complying with the policy. Sampling of requests will begin on April 1, 2010.

Conclusion

Processes need to be put in place by the Jasper Field Unit and the Office of the Chief Information Officer in order to reduce the risk of non-compliance with the Policy on the Use of Cellular Phones and other Wireless Devices. In addition, some clauses in the policy need to be clarified so that they are not misinterpreted.

6.4 Payments to Suppliers

YELLOW Moderate improvements needed Some controls are in place and functioning. However, major issues were noted and need to be addressed. These issues could impact on the achievement of program/operational objectives.

To confirm whether due diligence is being exercised in the management of payments to suppliers and to provide assurance to senior management that financial processes and controls were in place at the Jasper Field Unit for the period being audited to mitigate the risk of non-compliance to TBS and PCA policies and practices. We have used the following audit criteria:

C1-
Policies, guidelines and procedures regarding the purchase of/payment for goods and services from suppliers exist at the Field Unit/Service Centre and they adhere to TB and PCA policies.
C2-
Adequate training/instruction is provided at all levels to ensure awareness and understanding of the policies and procedures.
C3-
Adherence to the policies and procedures is monitored.
C4-
Procurement of goods and services is appropriately initiated and authorized, and funds are properly committed in the financial system.
C5-
Goods and services on suppliers’ invoices are matched to PO/contract specifications.
C6-
Price and quantities on invoices are agreed to POs/contracts
C7-
Section 34 FAA is signed by appropriate delegated authority.
C8-
Advances and progress payments are made only when in accordance with the terms of the contract.

Observations

Managers must have the appropriate delegation of authority to initiate expenditures, commit funds and approve payments to suppliers under Section 34 of the FAA.

Managers must follow training courses F101 and F201 that were developed for the Agency before they can receive the financial delegation authority. The delegations are described in the Agencies Delegation of Authority Document approved by the Minister.

Managers must sign off Section 34 FAA before an invoice can be paid to a supplier.

The Finance and Administration group maintains a record of the Specimen Signature Cards for all managers who have delegated authority. This includes authorities that are given on an “Acting” or temporary basis. They also have a copy of the current PCA Delegation of Financial Signing Authority on hand.

Supplier payments files are sent to the Finance and Administration group for account verification and final payment approval under Section 33 FAA. Section 33 FAA is approved electronically by batch; one financial officer has been provided an electronic key that allows her access to the Section 33 approval function in SAP. Once the Section 33 of the FAA approval is given, an electronic file is sent to Public Works and Government Services of Canada (PWGSC) to process the payment to the supplier.

Statistical sampling:

  1. The Jasper Field Unit Finance and Administration group receives a list of transactions pre-selected by the CFO office for further account verification.

  2. Files to be reviewed are assigned to accounting staff that did not perform the original review of the payment file.

  3. The Finance and Administration group performs a review of files selected based on a checklist provided by the CFO.

  4. Errors noted are sorted as critical VS non critical; review results are formally documented and sent to the CFO.

  5. Feed back is received periodically from the CFO office.

During the testing of files, we found that the “Date received” stamp information is missing on most invoices when sent to the Finance & Administration group. This is likely due to the fact that the “Date received” is stamped on the invoice envelope and not on the invoice copy itself.

We also found that the Section 34 FAA manager approval date was not indicated on many invoices. It is important that the invoices be dated or that the envelopes are attached to the invoices so that the chronological sequence of payments can be traced. The Finance staff are responsible for ensuring that all required information is present and that the signatures are authorized prior to making payment. If there are questions, or if there are instances of non-compliance with policies, the manager responsible for the expenditure is contacted and the justifications are appended to the payment records. This practice ensures the legitimacy of the expenditures.

Findings

  • In 8 cases or 22% of files reviewed, there was no documentation in the payment file, supporting the required approval under section 32 of the FAA.

    • 2 cases where the LPOA and/or contract/agreement was not attached to the invoice.

    • 6 cases where electronic PO/Requisition, travel authorisations and/or training applications were not found in payment file.

  • In 23 cases or 52% of files reviewed, funds were not committed in the financial system prior to the purchase of the good or service such as travel, training, and membership fees.

  • In 21 cases or 48% of files reviewed, the invoice was not date-stamped when received.

  • In 6 cases or 14% of files reviewed, there is no evidence of Section 34 FAA signature.

  • In 7 cases or 16% of the files reviewed, there is no receiving slip or other proof of receipt of goods/services.

Recommendations

7.
The Field Unit Superintendent should reinforce controls to ensure that payment file documentation is strengthened in the following areas:

  1. Documentation supporting the commitment of funds should be included in the payment file and properly approved under S.32 of the FAA for all expenses over $1 000.

  2. Receiving date should be stamped on the invoice or envelopes to maintain a chronological trail of payment process. The stamped document should then be kept on file.

  3. Section 34 approval documents must be clearly signed and dated by the authorized manager under FAA.

  4. Receiving slips or other proof of receipt of goods/services should be attached to the invoices.

Management Response

  1. Partially agree: When required, commitments are entered into the system and the documentation included in the payment file. The purchases of goods or services are made through a decentralized system by various budget holders that do not have access to the financial system. For the transactions that are low dollar value items or items purchased on a master card, the commitment (if > $1,000) and purchase are entered into the financial system at the time of payment. Commitments are entered into the financial system for all signed contracts and purchases made on a purchase order.

  2. Partially agree: Suppliers submit their invoices through a variety of methods such as the mail, at the time of delivery by internet or by fax. The invoices received in the mail are date stamped and for invoices received from other methods the authorized manager sends them directly to payables for processing. The accounts payable staff dates stamp all the invoices when received.

  3. Agree: All authorized managers have been advised of the requirement to sign all invoices and clearly indicating their section 34 authority.

  4. Agree: A memo will be sent to all staff reminding them to include the packing slip or to acknowledge the receipt of goods when submitting an invoice for payment. Invoices that do not have the required information will be returned to the authorized manager for completion before being processed for payment.

6.5 Contracting

YELLOW Moderate improvements needed Some controls are in place and functioning. However, major issues were noted and need to be addressed. These issues could impact on the achievement of program/operational objectives.

To confirm whether due diligence is being exercised in the contracting practices and to provide assurance to senior management that financial processes and controls were in place at the Field Unit for the period of audit to mitigate the risk of non-compliance to TBS and PCA policies and practices. We used the following audit criteria:

C1-
Guidelines and procedures related contracting practices at the Field Unit/Service Centre exist, and adhere to TB and PCA policies and directives.
C2-
Adequate training/instruction is provided at all level to ensure awareness and understanding of contracting policies and procedures.
C3-
Adherence to contracting policies and procedures is monitored.
C4-
Management reporting related to contracting activities is generated and used in monitoring/supervising contracting activities.
C5-
There is an identified need to enter into the contract
C6-
The appropriate method of contracting is used.
C7-
Contracting is conducted fairly with due regard for economy.
C8-
Nature of work to be performed or good to be delivered is defined in contracts.
C9-
There are terms and conditions in contracts to mitigate risk of non-performance.
C10-
Contracts are approved by individuals with delegated authority.

Practices and Observations

The Jasper Field Unit uses several methods for contracting including standing offers, hiring temporary resources, purchase orders, competitive sourcing and non-competitive sourcing.

In the Jasper Field Unit, all contracting transactions are processed through the Contracts Officer in the Finance & Administration group. She provides ongoing advice and direction to managers regarding PCA contracting requirements.

For example, she works with operational managers in the development of Statements of Work. She assists managers with developing evaluation criteria and terms of reference. This ensures that there is a consistent and fair contract award process for the goods or services required. Once a firm has been selected, contracts are signed by the contractor, then by the manager. Various reports on contracting are available on request from the Western & Northern Canada Service Centre (WSC). Our review of contract files revealed that copies of the signed contracts were on file.

The Contracts Officer receives ongoing advice and assistance regarding contracting matters from PCA contracting experts in the WSC and at headquarters as well as from PWGSC. She also has a strong working relationship with her counterpart in Banff National Park.

Training and contracting tools, such as Statement of Work, Request for Contract Action service templates, are available to managers to assist them with contracting activities. The F101 and F201 courses also cover the policy on contracting. For more specific questions, the Contracts Officer provides managers with the information they need verbally.

The centralization of the contracting function in the Jasper Field Unit not only creates a “one stop” centre of expertise but also minimizes the risk of non-compliance with government and PCA contracting requirements.

The Manager, Finance and Administration track the incidence of sole source contracting in the Jasper Field Unit. She advised the audit team that she had recently been informed by the CFO’s Office that the Jasper Field Unit had achieved a 92% rating relative to PCA’s standard that 80% of all contracts must be secured on a competitive basis.

Findings:

  • In the case of one (1) file or 4% of files reviewed, justification for a sole source contract was not found on file.
  • Although the contracting files reviewed contain all the required supporting documentation they are not organized in compliance with the PCA standard for file management.
  • In 25% of contract files reviewed, LPOA’s were used inappropriately as a method of purchasing services.

The audit established that local purchase orders were not used properly. Currently, procurement methods have improved with standing offers, purchase orders and acquisition cards. There is increasingly less need to use local purchase orders since there are other methods available that are less risky and easier to control by the Finance team, for example, acquisition cards. When analyzing transactions, we discovered that service agreements were entered into using LPOAs instead of a service contract in proper and due form (e.g. last bullet, 25% of the reviewed contracts). These situations are in direct contravention of the directive on the use of local purchase orders. In general, the number of transactions after the fact and without financial commitments is higher than with other purchase methods available. The use of this mechanism should be better controlled, and the need for using these orders should be re-evaluated.

Overall, with the exception of the use of LPOA, the contracting process is satisfactory.

Recommendation

8.
The Field Unit Superintendent must ensure that local purchase order (LPOA) authorities are:

  1. used appropriately if other mechanism is not possible,
  2. not used to enter into a service agreement.

Management Response

  1. Agree: The use of LPOAs will be reviewed to ensure they are used in accordance with financial directives.

  2. Agree: Even though the LPOA booklets indicate they can be used for the acquisition of services under $5,000 they will only be used for the purchase of goods as per the Parks Canada National Directive. Service agreements under $5,000 will be completed using the appropriate form.

6.6 Inventory

BLUE Minor improvements needed Many of the controls are functioning as intended. However, some minor changes are necessary to make the control environment more effective and efficient.

To provide senior management with assurance that there is compliance with the Directive on Inventory Management for Items Valued at between $1,000 and $10,000 and Attractive Items valued at less than $1,000, and that items of $10,000 or more are inventoried and recorded in the systems. We used the following audit criteria:

C1-
Items listed in the directive, acquired after April 1, 2007, are recorded in the financial system.
C2-
The separation of duties pertaining to the inventory management process is adequate.
C3-
The physical inventory was taken in the past 24 months.
C4-
Measures are in place to ensure that purchased items are entered in the inventory, regardless of the purchasing mechanism used.
C5-
Acquisitions information is recorded in the Asset Management System.
C6-
Acquisitions are entered in the STAR financial system in a timely manner.
C7-
The physical inventory is taken on a regular basis (vehicle equipment, etc.).
C8-
The separation of duties pertaining to the inventory management process (purchaser, book entries, inventory, disposal, etc.) is adequate.

Observations:

Items with Cost < $10,000

Since the Directive on Inventory Management for Items Valued at between $1,000 and $10,000 and Attractive Items was issued in 2007, the Jasper Field Unit has been recording non-capital inventory items into the STAR Plant maintenance module. Although there are procedures in place, they are not documented, making it difficult to ensure that all new inventory items received are recorded into the STAR system.

The cost centre initiates the purchase. The warehouse receives the item, affixes a bar code with a unique identifier and enters the item, tag number, dollar value, location, etc. into STAR. The payment process for items under $10,000 is separate from the recording of the asset into STAR.

Receipt of Goods:

When an item is ordered, the purchaser sends a copy of PO or requisition to the warehouse. The warehouse manager receives the items and packing slips and as described above, enters the item into STAR. The packing slip is compared to the original requisition and both are sent to finance.

Payment:

Once the invoice is sent to the purchaser and Section 34 is applied by Managers, it is then sent to finance. Finance matches the signed invoice to the PO or the requisition with the packing slip and authorizes payment under Section 33.

Capital Assets (cost > $10,000)

Assets over $10,000 are also entered into the STAR system and transferred electronically (swept) into the Asset Management System (AMS) nightly. Asset classes recorded in the AMS system include equipment, vehicles, buildings, real property, etc. Recording of these assets is handled slightly differently. 

Receipt and payment of assets:

The warehouse manager receives the asset and forwards the paperwork to Finance. The basic asset information is recorded in STAR by a Financial Analyst who also determines the Asset Class at the time of entry. The analyst will (“settle”) authorize payment under section 33 within SAP at this time as well. Each night, the asset information is transferred electronically (swept) from STAR into AMS.

Management of Capital Assets Using AMS:

AMS was originally populated using information from the financial system and therefore, it contains a complete record of assets over $10,000. Once the asset is visible in AMS, the asset information including maintenance schedules, etc. can then be updated by the Highway Service Centre or the Trades group. At the Jasper Field Unit, AMS is used to generate work orders that identify maintenance requirements to ensure assets are up to code or meet heritage regulations.

If a capital asset is no longer required, the asset custodian notifies the warehouse manager that an item is ready to be disposed of. Assets are disposed of through the Crown Asset disposal system; the warehouse manager contacts PWGSC to facilitate the sale. Once the item is disposed of, it is removed from STAR by the warehouse manager which causes it to be removed from AMS when the information is transferred each night.

Findings

The auditors tested a sample of supplies inventory items under $10,000 by tracing a sample of these items from the inventory lists to the floor. Two lists were provided, one identifying computers and related equipment, the other identifying all other items recorded in STAR. All of the items in the “list to floor” sample were found in the location indicated on the inventory list with the exception of two items that were in use off site. On the other hand, a “floor to list” sample test was not completed as the majority of items on the floor were acquired prior to 2007 and therefore were not included on the inventory lists.

Recommendation

9.
The Field Unit Superintendent must ensure that roles, responsibilities and controls in place, with regards to inventory management are documented and communicated to stakeholders to ensure that there is compliance with the Directive on Inventory Management for Items.

Management Response

Agree: The Filed Unit Superintendent will review the roles and responsibilities in regards to inventory management and ensure this is communicated to all stakeholders.

6.7 Financial Coding

GREEN Controlled Controls are functioning as intended and no additional actions are necessary at this time.

To determine if the financial coding process is exercised with due diligence and if controls in place are adequate to ensure compliance with TBS and PCA policies and practices, we used the following audit criteria:

C1-
Coding guidelines and procedures at the Field Unit/Service Center exist.
C2-
Adequate training/instruction is provided at all levels to ensure awareness and understanding of coding procedures.
C3-
Adherence to chart of account is monitored.
C4-
Coding is done by individual with proper knowledge.
C5-
Coding is validated when entered in SAP.

Observations

Managers with Section 34 FAA spending authority are responsible for financial coding. Financial coding is established at the time a commitment is created in the system. When invoices are received, the financial code is indicated by the cost centre manager and reviewed by the Branch Administrative Assistant prior to sending the invoice for payment at the Jasper field unit Finance group.

Finance officers at the Jasper field unit examine the financial codes for 100% of transactions received from responsibility centers manager.

In addition, the same review of coding is done when transactions are selected by statistical sample by the CFO for account verification purposes.

During the course of the audit, we verified if financial coding was accurate. Transactions from the audit sample were selected judgementally and reviewed for accuracy of coding. We found a very limited number of isolated coding errors. Overall, the use of financial coding is satisfactory.

No recommendation