This Web page has been archived on the Web.

2002 September Status Report of the Auditor General of Canada

Assistant Auditor General: Maria Barrados
Principal: Peter Simeoni

Key Message

1.1 Human Resources Development Canada (HRDC) has been slow to address many of the observations and recommendations arising from our 1998 audit of the management of the Social Insurance Number (SIN). In 2000 we reported that some improvements had been made in SIN records and the number of SIN-related fraud investigations had increased. In 2002 we returned, expecting to find that the problems reported in 1998 would have been largely resolved. Instead, we found that progress on some key issues has been limited. The continuing weakness in the issuing of SINs leads us to conclude that HRDC has not done enough to safeguard and strengthen the integrity of the SIN.

Human Resources Development Canada has responded. HRDC agrees with our recommendations and has committed itself to specific actions. HRDC will seek authority to cancel any SINs that have not been used in five years. It will also seek authority to place expiry dates on the SIN cards of people who are neither Canadian citizens nor permanent residents and will no longer accept photocopies of identity documents as proof of identity.

The Treasury Board Secretariat has responded. The Secretariat agrees with the recommendation we addressed to it.

Introduction

1.6 In 1998 we audited the management of the Social Insurance Number (SIN). We reported several problems in the way it was managed. We conducted a follow-up in 2000. Based on more recent audit work, this chapter provides a status report on the government's efforts to improve the integrity of the SIN.

What is the Social Insurance Number?

1.7 The Social Insurance Number was created in 1964 as a file identifier for the Canada Pension Plan, Quebec Pension Plan, and employment insurance (then unemployment insurance) programs. Under the current Employment Insurance Act , the Canada Employment Insurance Commission assigns "a number that is suitable for use as a file number or account number or for data processing purposes and the number so assigned...is the person's Social Insurance Number...." The SIN is a unique, nine-digit number assigned to each individual, and a person legitimately has only one number at a time.

1.8 The government's current policy views the SIN as a file identifier or account number for specifically authorized activities (Exhibit 1.1). The Employment Insurance Act and Regulations require that a SIN be issued only after an applicant's identity and citizenship status have been determined.

Who is involved in administering the SIN?

1.9 The Canada Employment Insurance Commission is named in the Act and Regulations as the body responsible for SIN administration. On behalf of the Commission, Human Resources Development Canada (HRDC) issues SINs and maintains the Social Insurance Register, which holds all relevant information on SIN applicants. The Treasury Board is responsible for the SIN policy, and the Treasury Board Secretariat is responsible for developing guidelines that govern how federal departments collect and use the SIN. The Canada Customs and Revenue Agency uses the SIN in administering the Income Tax Act . The Office of the Privacy Commissioner of Canada monitors federal organizations for their compliance with the Privacy Act, which governs the protection of personal information, including the SIN. For example, departments are required to inform the Privacy Commissioner of any significant changes to existing uses of personal information, specifically any new uses or disclosures.

1.10 In 2001-02, HRDC spent about $16.7 million on SIN administration and collected close to $2 million from people applying for replacement SIN cards. It issued a total of 1.2 million new cards and replacements.

Why is the integrity of the SIN important?

1.11 The SIN is needed to access federal programs. Several of the federal government's largest programs use the Social Insurance Number. In 2000-01 the SIN was the key account number on about three million applications for Employment Insurance benefits that totalled $9.5 billion and Canada Pension Plan and Old Age Security benefits that totalled $43.7 billion. Applicants for benefits under these programs need a SIN. In 1998 we reported that by using the SIN, various programs had been able to avoid or recover overpayments and improve administrative efficiency, thereby achieving significant savings.

1.12 Widespread use of the SIN outside the federal government. Use of the SIN in the private sector began when the government made it a personal identifier for income tax, in 1967. Since then, the Income Tax Act has been amended several times to require that various public agencies collect a person's SIN in their transactions and to ask the same of private sector organizations, such as insurance companies and financial institutions. Various documents we examined also indicated that provinces and municipalities use the SIN in administering social assistance and other programs. In short, many organizations collect SINs from Canadians and then retain that information.

1.13 The widespread use of the SIN for many different purposes gives it a value that means it must be linked with only its rightful owner. When it is not, government benefits, tax refunds, or bank credit may go to the wrong person.

1.14 Opportunities for SIN fraud. According to HRDC, between 1964 and 1976 almost 19 million SINs were issued without requiring the applicants to provide proof of their identity. In 1976, the government began requiring that new applicants and card holders seeking replacement cards furnish documents such as birth certificates to prove their identity. Due to cost considerations, the government decided not to require the 19 million people who already had a SIN to register again with proof of their identity.

1.15 According to HRDC, the proof-of-identity requirements established in 1976 are no longer sufficient. New technologies have made it relatively easy to forge identity documents such as birth certificates. HRDC has anecdotal reports from the Royal Canadian Mounted Police, other police agencies, and its own employment insurance investigators that illustrate how easily fraud can be perpetrated and SINs issued that should not be issued. In addition, the plastic SIN card can be used as an identity document, although it has no modern security features and is easily forged. There is a wide range of fake documents available on the Internet, including birth certificates. The formula for generating a false SIN that will look like a valid one can also be accessed on the Internet.

1.16 Impact of SIN fraud. In 1998 we noted that obtaining a SIN fraudulently can be part of developing a false identity and an initial step in schemes to obtain government services or credit fraudulently or evade taxes.

1.17 In both Canada and the United States, identity fraud is a growing concern. The SIN and its U.S. counterpart, the social security number, can play an important role in this kind of crime. American authorities report that social security numbers, along with dates of birth and mothers' maiden names, are among personal identifiers often used in a wide range of identity-related frauds. These frauds can be steps toward far more serious crimes.

1.18 The Canadian Council of Better Business Bureaus reports that stolen identity is one of its top three concerns. Equifax Canada Inc., a consumer and commercial credit reporting company, states that the incidents of identity theft it handles increased from 4,000 cases in 1998 to over 12,000 cases in 2001. The U.S. Federal Trade Commission reported that in 2001 it processed more than 86,000 reports from victims of identity theft. In a recent report to Congress, the General Accounting Office concluded that the prevalence and cost of identity theft in the United States appear to be growing.

1.19 According to HRDC, the expanded use of the SIN by other levels of government and institutions has both increased the potential for SIN fraud and extended its impact. For example, once someone has established a false identity that includes a SIN obtained fraudulently from HRDC, that identity can be used to access federal and provincial social programs, to defraud banks, and to misrepresent income to the Canada Customs and Revenue Agency. As the Web site of the Office of the Privacy Commissioner of Canada notes, a valid SIN can also be used to steal a real identity. It is possible to use someone else's SIN along with other personal information to apply for a credit card, open a bank account, and rent vehicles, equipment, or accommodation in that person's name, leaving the victim responsible for the bills, charges, bad cheques, and taxes. Exhibit 1.2 provides recent examples of the kinds of crimes in which the SIN has played a part.

What we found in 1998

1.20 Our 1998 audit found that the SIN had become a common numerical identifier both inside and outside the federal government in a wide range of income-related transactions and benefits. We reported several weaknesses in the administration of the SIN, including the following:

• Information held by HRDC on SIN holders, particularly on births and deaths, was not always complete and accurate.
• Procedures to apply for a SIN were not sufficient to guard against fraud and abuse. Millions of SIN holders who had registered before the proof-of-identity program was introduced in 1976 had not been asked to furnish documents that proved their identity. This exacerbated the risk of misrepresentation.
• The provinces and financial institutions were required by the Income Tax Act and Regulations to collect SINs for tax purposes, but could not validate the SIN numbers provided by their clients.
• SIN errors, abuse, and misuse affected many federal and provincial programs and the private sector. Collectively, the impact may have been sizable.
• HRDC was dedicating minimal effort to investigating SIN fraud and abuse, and penalties were minimal, with no real impact on deterrence.
• Unregulated use in the private sector (except in Quebec) made the SIN vulnerable to abuse—both fraud and invasion of privacy.

1.21 Our report contended that it was time to review the current role, objectives, and uses of the SIN in light of the important function it serves in government and society. The government needed to state clearly the level of integrity and protection of privacy expected in the system.

What has happened since 1998?

1.22 HRDC, the Canada Customs and Revenue Agency (CCRA), Citizenship and Immigration Canada, Industry Canada, and the Department of Justice Canada accepted our 1998 recommendations and observations. The Standing Committee on Public Accounts and the Standing Committee on Human Resources Development subsequently held hearings and issued reports to the House of Commons on the SIN. Both committees substantially agreed with our recommendations.

1.23 HRDC created five working groups to address our recommendations for better management of the SIN. These groups were made up of representatives of the departments involved in the SIN program: HRDC, the CCRA, and Citizenship and Immigration Canada. The working groups reported to HRDC in February 2000.

1.24 Our December 2000 follow-up reported that HRDC had taken several measures to improve the integrity of data in the Social Insurance Register; it had increased the number of SIN investigations and had other initiatives under way to address some of our 1998 recommendations. We indicated that a government-planned study on the impact and use of the SIN would provide essential information to help the government and parliamentarians make sound decisions about the future of the SIN, the advisability of restricting its use, matching of the data, and protection of privacy.

1.25 Early in fall 2001, HRDC submitted a plan to the Treasury Board for improving the management of the SIN. The Department advised the Treasury Board that without significant new funding it would be unable to improve the integrity of data in the Social Insurance Register to an acceptable level, assess the effectiveness of current SIN policies, make its proof-of-identity requirements more rigorous, increase the number of SIN investigations, or undertake a national public awareness campaign. According to HRDC, the new funds it later received were not enough to carry out these activities. It did not reallocate its resources to fund them.

Focus of the audit

1.26 The objective of our audit was to determine whether the government has safeguarded and strengthened the integrity of the Social Insurance Number. We examined its actions on the key concerns we raised in 1998 and the concerns of the Standing Committee on Public Accounts and the Standing Committee on Human Resources Development. More details appear in About the Audit at the end of the chapter.

Observations and Recommendations

Role and importance of the SIN

Use of the SIN outside the federal government

1.27 Responding in December 1999 to a recommendation by the Standing Committee on Human Resources Development, HRDC submitted a report confirming that the SIN's primary role was as a file number in the administration of authorized federal programs. The government rejected the idea of legislation to restrict the use of the SIN outside the federal government. Recognizing concerns about privacy of personal information, including the SIN, in the private sector, it introduced the Personal Information Protection and Electronic Documents Act .

1.28 That legislation provides Canadians with, among other things, the right to the protection of their personal information in the private sector. It defines the principles that govern the collection, use, and disclosure of personal information and provides a framework to address complaints of alleged breach of these principles. The Act (which will not be fully implemented until 2004) does not deal specifically with the SIN but captures it in the definition of personal information. It requires that an organization explain why it needs personal information and obtain the person's consent to use it. This could serve to limit the use of the SIN. Prohibiting its use outside of the federal government, however, was not included in legislation.

1.29 HRDC asked Statistics Canada to study the extent to which the SIN is used in the private sector but did not study its use in the voluntary sector or the public sector of the provinces and territories. The study by Statistics Canada concluded in February 2001 that SINs were being collected from employees and clients for a wide range of purposes. The study revealed the following:

• 94 percent of employers ask for a SIN when hiring an employee;
• 86 percent of employers do not know their obligations related to the SIN's 900 series (issued to applicants who are not Canadians or permanent residents and who cannot work in Canada without an employment authorization from Citizenship and Immigration Canada);
• 6 percent of all businesses surveyed and 27 percent of businesses with more than 250 employees have been given a false SIN by employees, although few reported any losses as a result;
• 10 percent of businesses surveyed have used SINs as employee file numbers;
• 14 percent of all businesses surveyed and 57 percent of businesses with more than 250 employees have used SINs to identify their employees' insurance and pension files;
• 19 percent of businesses surveyed have shared SINs with insurance companies that provide coverage to employees (only 5 percent did so at the request of the employee); and
• 9 percent of businesses surveyed have asked their clients for SINs and used them for a variety of purposes such as credit checks, proof of identity, and file numbers.

1.30 Partly as a response to these survey results, HRDC undertook a number of public awareness activities on the SIN. However, their scope was limited by their primary focus on certain clients of the Department, particularly Canada Pension Plan beneficiaries and visitors to local HRDC offices. The Department also placed information on its Web site. It did not take other measures that would have reached a larger public, such as using the national media. HRDC has not measured the public awareness campaign's effectiveness in informing individuals, employers, and other stakeholders about how and when to use the SIN.

1.31 Recommendation. Human Resources Development Canada should assess the public awareness of how and when to use the Social Insurance Number appropriately and should carry out public education efforts as needed.

HRDC's response. As the Auditor General notes, HRDC did undertake a range of public awareness activities during 2001 and 2002. These included brochures, information to clients, and changes to the message on the SIN card itself. HRDC will assess the effectiveness of its Social Insurance Number public awareness activities during 2002-03. The Department will use the results of that assessment to guide the next phase of its public education efforts that will begin in 2003-04.

Problems with the use of the SIN

1.32 The Treasury Board policy implemented in 1989 reflects the government's intention to restrict the use of the SIN by federal institutions to specified tax, pension, social, and benefits programs. The policy on the use of the SIN lists acts and regulations requiring its use and programs authorized to use the SIN. The Treasury Board Secretariat has not updated the policy governing the SIN since 1989.

1.33 Although the SIN has been studied from many aspects since 1998, what has not been assessed is how federal programs use it and to what extent they rely on it. HRDC, for example, requires the SIN of applicants for benefits in its large programs. However, it is unclear whether HRDC uses the SIN as simply a number to manage a recipient's file or also as a means to help establish recipient's identity.

1.34 Although the government has reaffirmed its policy that the SIN is simply a file number and therefore not a form of identification, it has not given departments direction on acceptable ways to identify program beneficiaries, except for on-line services. Properly identifying clients is a fundamental control in any government program.

1.35 The Treasury Board Secretariat became aware in 2000 that HRDC's Opportunities Fund for Persons with Disabilities program was using the SIN without Treasury Board authorization. Follow-up work by the Department and the Secretariat found two other HRDC employment assistance programs (Youth Initiatives and Aboriginal programs) using the SIN without authorization. During our audit, the Department was attempting to remedy the situation by working closely with the Treasury Board Secretariat. It received the support of the Privacy Commissioner for using SINs in these programs.

1.36 Further to its work in HRDC, the Secretariat decided to review whether federal institutions are respecting the policy that governs the use of the SIN. It will also consider revising the policy and developing guidelines for all federal institutions. The Secretariat expects to report the results of its review to the Treasury Board by June 2003.

1.37 Recommendation. Human Resources Development Canada should use the SIN only where authorized by the Treasury Board.

HRDC's response. HRDC is working with the Treasury Board Secretariat and the Privacy Commissioner of Canada to include the three programs to which the Auditor General refers on the list of authorized uses. This will enable HRDC to fulfil its commitment to full compliance and underline the fact that the SIN is intended to serve solely as a file identifier for Government of Canada-related purposes.

1.38 Recommendation. In its review, the Treasury Board Secretariat should look at why and how departments are using the SIN.

Treasury Board Secretariat's response. During its review, the Treasury Board Secretariat will closely examine the uses of the SIN by federal institutions and will make every effort to resolve any issues related to the Treasury Board policy concerning the SIN.

Integrity of the issuing process

Applying for a SIN

1.39 An application for a SIN is generally presented in person at one of the 320 Human Resources Centres across Canada. An HRDC representative reviews the application for completeness and examines the document offered as proof of identity and status in Canada. The representative records relevant information from the document submitted and then stamps and initials the application. The stamp indicates to the Department's National Services in Bathurst, New Brunswick (which issues all SIN cards) that 1 of the 38 acceptable documents has been seen and the application is complete, accurate, legible, and valid. The application is then sent to National Services for review and for input in the Social Insurance Register, and the card is issued. Applications can also be mailed directly to National Services with an original document or a certified photocopy. The process is illustrated in Exhibit 1.3.

1.40 Over 1.2 million applications are processed each year; about 1 million new SINs are assigned and about 200,000 replacement cards issued. Since 1998 the Department has issued over 3.7 million new and replacement SIN cards.

SINs are issued without proper control

1.41 We expected to find that HRDC was meeting the requirements of the Employment Insurance Act and Regulations in issuing SINs and that it had strengthened its controls over SINs. Instead, we found serious weaknesses in the issuing of SINs, and in our view HRDC is not doing enough to safeguard the SIN's integrity.

1.42 In our view, HRDC's policies and practices do not meet, in important respects, the intent of the Employment Insurance Act and Regulations. Under the Act, the Canada Employment Insurance Commission is required to identify accurately all persons to whom it assigns a SIN. The Regulations to the Act specifically require HRDC to determine both the identity and the citizenship status of SIN applicants. However, HRDC currently requires that a SIN applicant be asked for only one document as proof of both identity and citizenship. Many of the 38 different documents that HRDC accepts, such as birth certificates, cannot be linked to the person applying for a SIN. A document may show citizenship status, for example, but has no photograph or description of the owner to help identify the bearer of the document as its owner. In our opinion, determining identity properly would mean requiring additional identification. Consequently, our view is that HRDC's policies and practices do not respect the intent of the Employment Insurance Act or Regulations. We are concerned that for the majority of the SINs issued since 1998, the applicant's identity and citizenship status were not checked properly because a single piece of identification is usually insufficient to check both.

1.43 In 1998 we observed that many of the documents HRDC was accepting had significant drawbacks. We recommended that the Department assess the reliability of identity documents used to support applications for a SIN and that it take corrective action where needed. In our audit this year, we found that the Department had done little to strengthen its process of issuing SINs and was still reconsidering its approach to proof of identity and citizenship. It was accepting Quebec baptismal certificates or birth certificates issued before 1994, although the Government of Quebec had asked it to stop accepting these certificates because they are difficult to authenticate and could have been falsified. HRDC was also accepting as proof of identity and citizenship other documents with higher risk of falsification, such as expired Canadian passports no matter how old. However, at the end of our audit HRDC announced that it would stop accepting these documents as of August 2002, in order to strengthen the SIN proof-of-identity requirements.

1.44 As already noted, HRDC does not require applicants to submit documents in the original; it accepts photocopies that have been certified as true copies by people in a wide range of occupations. The Department does not check the information, even on a sample basis, with the people who have certified the photocopies it accepts. In our view, photocopies represent a greater risk of falsification. Moreover, accepting photocopies circumvents one of the key controls in the processing of applications—the comparison by HRDC staff of documents presented by applicants with pictures of authentic documents and descriptions of their security features.

1.45 For the most part, the Department does not have the means to contact the authority that issued the documents to check their validity. Exceptions are the checking of immigration documents with Citizenship and Immigration Canada and of birth certificates with the Vital Statistics Branch of New Brunswick's Department of Health and Wellness—which together account for about 30 percent of applications that HRDC processes. These checks verify that the document is valid but do not confirm that the bearer of the document is its rightful owner.

1.46 We also found that the Department's policies on issuing SINs focus less on safeguarding the integrity of the application process and more on satisfying the applicant. For example, HRDC staff are advised to use discretion when they attempt to confirm an applicant's identity if presented with documents of questionable validity, in case the applicant views their attempts as harassment. Moreover, HRDC's rules are unclear in many respects and are therefore subject to misinterpretation. We found examples of contradictory statements and ambiguous instructions.

1.47 During our audit, HRDC completed a study to identify ways to improve how it issues SINs while reducing the processing time. The Department informed us that it intends to use the results of this study in its planned changes to its process.

Staff lack adequate training, tools, and information

1.48 All HRDC staff should be processing SIN applications in a consistent way. However, we found that job responsibilities, training, tools, and information for issuing SINs vary greatly among local HRDC offices. There is a risk that how much attention a SIN application receives depends on where it is submitted and who processes it.

1.49 Responsibilities may not be understood clearly. For example, while all staff are responsible for fraud detection, most front-line staff we interviewed said they tend to rely on National Services in Bathurst to detect fraud. For applications handled initially by HRDC's local offices, however, National Services relies on the local staff to detect fraud. And despite high rate of turnover in some offices, no formal training is given to staff before they start handling applications. Computer-based training is available on the Department's internal network. However, we observed in the offices we visited that new employees were often left to learn on the job.

1.50 HRDC has made some progress in providing staff with tools for fraud detection. For example, it introduced risk indicators for staff of local offices to use on incoming applications. It also issued a guide containing pictures and descriptions of security features of authentic documents for comparison with documents presented by applicants. In early 2002, it supplied regional offices with ultraviolet lamps (to help detect fraudulent documents) for distribution to all local offices. When we visited local offices, however, we noted that some had not obtained the lamps and that generally staff had received no training in their use.

Inadequate control over SINs issued to applicants who are not Canadians or permanent residents

1.51 HRDC also issues SINs to short-term visitors, refugee claimants, seasonal workers, and foreign students. A SIN can also be issued to citizens of other countries, even if they are not visiting or residing in Canada. These numbers begin with a 9 to distinguish them from regular SINs and to indicate that the bearer requires separate authorization to work in Canada. When a person who has been issued a 900-series SIN is granted Canadian citizenship or becomes a permanent resident and applies for a regular SIN, HRDC cancels the 900-series SIN and assigns a regular number in its place. Over time, HRDC has issued close to 1.6 million 900-series SINs. At the end of 2001, the Social Insurance Register showed more than 900,000 of these SINs that had not yet been cancelled.

1.52 Since our 1998 audit, the Department has made no changes in the way it controls the 900-series SINs. We found that, as in the case of regular SINs, HRDC does not take adequate steps to establish the identity of people who apply for 900-series SINs. It requires only one document to prove both identity and citizenship. It will accept any one of a range of documents produced by the Government of Canada (such as immigration forms) and by foreign governments (such as passports). While passports demonstrate both identity and citizenship, many other documents do not. And staff have no training or tools to verify the validity of documents issued by foreign governments. Moreover, HRDC will accept photocopies of these documents (including foreign passports). Detecting fraud is more difficult when working with photocopies.

1.53 Furthermore, under the Regulations to the Employment Insurance Act , HRDC is supposed to require applicants for 900-series SINs to show why they need one. Some of the identity and citizenship documents HRDC accepts (for example, an authorization to work in Canada) might suggest why the person would need a SIN, but most indicate only that the person is allowed to be in Canada. We found that the Department does not require staff to get an explanation from all 900-series applicants as to why they need a SIN (see the case study). Since 1998 the number of 900-series SINs assigned each year has been increasing. According to HRDC, this trend is consistent with the changes that Citizenship and Immigration Canada has reported in the temporary resident and refugee claimant population. In 2001, over 110,000 of the 900-series SINs were issued; this was 41 percent more than in 1998.

1.54 As in 1998, the 900-series numbers and the cards do not expire. Most people holding them are expected either to be in the country only temporarily or to gain permanent status in Canada and be granted a regular number. We noted during our audit, however, that more than 60 percent of 900-series SINs that have not been cancelled were issued more than five years ago. It is likely that the original holders have left the country, but there is no way of knowing what happened to their cards.

1.55 Recommendation. Human Resources Development Canada should ensure that its policies and practices respect the intent of the Employment Insurance Act and Regulations, which require it to

• determine the identity and citizenship status of applicants for a Social Insurance Number; and
• obtain proof of the need for a Social Insurance Number from applicants who are not Canadian citizens or permanent residents.

1.56 Recommendation. Human Resources Development Canada should reconsider its goals for the 900-series SIN and the associated risks. It should revise its policy and practices accordingly.

1.57 Recommendation. Human Resources Development Canada should improve the integrity of its SIN application process. In particular, it should

• assess the reliability of the identity and citizenship documents it accepts as support for applications and implement corrective action where necessary;
• make reasonable efforts to develop a means of checking the validity of identity and citizenship documents with the authorities that issued them; and
• ensure that staff have the training and tools to comply with the Employment Insurance Act and Regulations when they process applications for a Social Insurance Number.

HRDC's response. HRDC is building on previous initiatives to improve the integrity of the issuing process to ensure that it is meeting the Social Insurance Number goals of the Employment Insurance Act .

As of August 1, 2002, the Department implemented a uniform standard for Canadian-born applicants when it stopped accepting baptismal certificates from applicants born in Quebec and Newfoundland and Labrador. HRDC will build on this step by implementing its decision to render certified photocopies ineligible as proof of identity by November 1, 2002. This means that HRDC will accept only original documents to prove identity for applications made in-person or through the mail. The Department will accelerate the necessary training of staff on policies and procedures, including the new proof-of-identity requirements. Initiatives such as the use of ultraviolet lights to examine original documents, and improved staff training, enhance HRDC's security measures.

In February 2002, the Department reviewed how SIN applications are processed and is considering ways to further strengthen proof of identity, such as implementing a guarantor system similar to the one used for the Canadian passport; or including photo identification as part of the application process.

HRDC will continue with efforts that it has been making since 1998 to access vital statistics databases of the provinces and territories. It should be recognized that, with privacy and security concerns, these partnerships take time. Eventually, as is the case right now in New Brunswick, this will allow the Department to directly, accurately, and consistently verify birth information provided by Canadian-born SIN applicants with the province or territory of birth. HRDC is currently working toward a pilot project with British Columbia to verify the information provided on a SIN application with the provincial vital statistics agency.

HRDC is taking steps to amend the Employment Insurance Regulations to improve the management of SINs needed by people who are neither Canadian citizens nor permanent residents (900-series). Under this change, these 900-series SINs will be limited to an amount of time that is linked to the individual's authorized stay in Canada, rather than indefinitely . These SIN cards will display the expiry date of that Social Insurance Number.

HRDC also recognizes the need to address the issue of existing 900-series SINs. In order to bring about consistency, and after regulatory approval is obtained, existing 900-series SIN cardholders will have a reasonable period of time to provide acceptable proof of identification and proof of need to obtain a new card.

The Department anticipates that these measures represent additional significant improvements in the overall security and accuracy of the Social Insurance Number database.

Integrity of the Social Insurance Register

1.58 The Social Insurance Register is the database that records the personal information provided by individuals who apply for a SIN. It contains all the SINs issued so far and basic personal information such as name, date of birth, father's name, and mother's maiden name. In 1998 we reported that the integrity of the Register was a major concern. We expected to find in this audit that HRDC had largely resolved this concern and ensured that the information in the Register was reasonably accurate and complete.

Action taken to date

1.59 In 1998 we recommended that HRDC set out a plan for bringing the reliability and completeness of the Register up to an appropriate level. In 2002 we found that the Department has not carried out a comprehensive approach for improving the integrity of the information. According to HRDC, a lack of funding prevented it from implementing the improvement plan it had originally developed in response to our 1998 concerns. At the end of our audit, there was still no standard for the quality of information in the Register.

1.60 Nevertheless, HRDC has attempted to improve the Register through various initiatives. The Department has compared data in the Register with the Old Age Security and Canada Pension Plan (CPP) records of almost 10 million people, and personal information has been updated accordingly. This included

• cross-checking CPP and Old Age Security files against at least 3 million SIN records for which HRDC had never obtained proof of identity;
• noting on 101,000 SIN records that the individual had died; and
• changing about 276,000 incorrect dates of birth.

1.61 The Department undertook various initiatives to obtain more accurate information on deaths. Since 1998, it has received over 4.8 million death notices from different sources, such as the Canada Customs and Revenue Agency and the Old Age Security and Canada Pension Plan programs.

1.62 The Department also implemented SIN Tele-App which allows clients in New Brunswick to apply for a SIN by telephone. Their information is validated against the database at the Vital Statistics Branch of New Brunswick's Department of Health and Wellness or against Citizenship and Immigration Canada's immigration database.

1.63 HRDC has built into its system some indicators to detect potentially fraudulent applications. However, it could add other indicators of unusual activity, such as SIN cards mailed to a post office box, cards returned to National Services and never claimed, or multiple cards sent to the same address. A special study by the Department in 2001 found that in many cases HRDC had mailed more than 100 SIN cards (with different numbers) to a single address over a period of a year (including 225 cards to one address). Because the Department does not track such activities, it did not detect these events as it processed the applications; nor did it investigate them afterward.

Information in the Register can be improved further

1.64 One of the main difficulties in maintaining the Register is that HRDC is not advised routinely of births or changes of name. Although HRDC receives death notices from many sources, it indicates that this information is not comprehensive. The integrity of the Register would be improved if the Department had access to provincial and territorial vital statistics. During our audit, HRDC initiated discussions on this subject with the Vital Statistics Council, an interjurisdictional advisory group comprising the heads of the vital statistics divisions/agencies from all the provincial and territorial governments and the Health Statistics Division of Statistics Canada. The Council provides a forum for developing common approaches to collecting vital statistics, sharing information with outside parties, and facilitating problem solving for issues related to vital statistics.

1.65 However, HRDC has not pursued other sources of information that could improve the Register. For example, it lacks formal agreements with federal departments that issue identity and citizenship documents, such as citizenship cards and passports. While HRDC compares monthly Register data with Old Age Security data, it has not yet done so with the Canada Pension Plan or the Quebec pension plan (Régime de rentes du Québec). At the end of our audit, HRDC was involved in discussions with the CPP and the Quebec pension plan. As already noted, HRDC has made efforts to improve the Register's information on deceased people. However, many of the death notifications it receives are not checked with provincial or territorial vital statistics.

Dormant file review

1.66 HRDC classified over 3.2 million SINs as dormant after obtaining evidence from the Canada Customs and Revenue Agency that the SINs belonged to people over the age of 23 who had not filed a tax return, or for whom no income had been reported from 1993 to 1997.

1.67 The intent of this exercise was to help explain the gap between the number of SINs and the population and to flag SINs for greater scrutiny if the Department were to receive an application for a replacement card or any other changes. Until May 2002, however, National Services was processing transactions involving dormant SINs without investigating them. It simply removed the dormant marker from the file and took no special action to ensure that the transaction was legitimate.

1.68 In May 2002, HRDC began routinely investigating SIN-related transactions in dormant files. These dormant SINs can still be used as a first step to access benefits such as Employment Insurance, Canada Pension Plan, and Old Age Security—because federal programs that use SINs are not informed of those that are dormant. HRDC advised us that other information in addition to the SIN is required to establish eligibility for its benefits or entitlement to them.

1.69 The Department has found problems in the way the dormant file exercise was carried out. For example, the results excluded SINs that should have been identified as dormant: they did meet the screening criteria. In our view, the identification of dormant SINs has done little so far to reduce the gap between the number of usable SINs and the size of the population. By a usable SIN, we mean one that can be used as an account number in transactions with the federal government and not raise any concern or suspicion in itself.

Problems with information integrity persist

1.70 There are still significant discrepancies between the number of usable SINs and Statistics Canada's estimates of the Canadian population over 20 years old. While the Social Insurance Register is not a census of the Canadian population and comparing it with Statistics Canada's census presents some problems, the question remains: Why would there be millions more usable SINs than Canadians who could use them?

1.71 These discrepancies concern us, as they did in 1998. Despite HRDC's efforts to improve its information on SIN holders, the Register still contains significant variances from population estimates—variances that have increased over the past four years (Exhibit 1.4). While excluding the dormant SINs would reduce these discrepancies from 5 million to 2.4 million, we included them in the exhibit because they are still usable as a first step to access federal benefits. In HRDC's view, dormant SINs are unlikely to be used in the future.

1.72 However, even with the dormant SINs removed, 2.4 million is a significant gap. The Department suggests that these excess SINs probably represent people who have left the country (most often, holders of 900-series SINs), deaths of which HRDC has not been notified, people with multiple SINs, and frauds; or they could reflect the timing of the census. In our view, HRDC needs to explain the variances fully.

1.73 Another issue identified in this audit is the number of SINs that have never been cross-checked with other departments or supported by any proof-of-identity documents. These SINs were issued before the introduction in 1976 of the proof-of-identity program. The SIR shows over 8.3 million of these usable SINs. This represents a significant decrease from 1998. HRDC has accomplished this mainly by obtaining information from the CPP and Old Age Security programs. Due to the cost and inconvenience to SIN holders, HRDC does not plan to certify the remaining SINs systematically but only when there is a new transaction. However, it hopes it will be able to certify many more of these SINs if and when it is given access to provincial and territorial vital statistics or other official sources of information.

HRDC needs to better report on its improvements to the Register

1.74 We are concerned that HRDC reported the improvements it has made to the Social Insurance Register in a way that could be misinterpreted.

1.75 In its March 2000 Performance Report , HRDC said it had closed the gap between the number of SINs and the population to 800,000. It arrived at that figure by assuming that all holders of dormant SINs had died or left the country, although it had no proof that either was the case. Moreover, the identification of dormant SINs simply provided a possible explanation for a large portion of the gap between data in the Register and population estimates at that time. HRDC had taken no steps to actually reduce or close the gap. The dormant SINs could still be used as a first step to access benefits.

1.76 In its December 1999 response to the Standing Committee on Human Resources Development, HRDC implied that by identifying dormant SINs it had reduced the number of uncertified SIN records by 2.6 million. In our view, there is no relationship between dormant SINs and uncertified SINs. Dormant SINs are those that have not been used for some time, whereas uncertified SINs are those for which the personal information has not been verified. Declaring a SIN to be dormant does not somehow validate the personal information that HRDC has on record.

1.77 Recommendation. Human Resources Development Canada should set goals for the completeness and reliability of the Social Insurance Register and take the steps necessary to meet them.

HRDC's response. HRDC has made numerous improvements to its Social Insurance Number database, the Social Insurance Register (SIR), to make it more complete and reliable. Since 1998, HRDC has certified the accuracy of millions of SIN records. The Department has also identified 3.2 million other SINs that have not been used in at least five years, which includes 600,000 SINs of deceased individuals. HRDC conducts investigations as appropriate if someone then uses those Social Insurance Numbers to apply for Employment Insurance or is seeking a replacement SIN card.

To provide greater security, HRDC is taking steps to amend the Employment Insurance Regulations to cancel SINs that have not been used in five years. Once a SIN is cancelled, a person will be required to provide acceptable proof of identity to reactivate that SIN.

The Department has initiated a comprehensive review of the Social Insurance Register. That review will assist HRDC to set goals for SIR integrity, define the actions and timeframes needed to meet those goals, and implement the additional required changes. This process will be completed by April 2003.

1.78 Recommendation. Human Resources Development Canada should ensure that its reporting of improvements to the quality of the information in the Social Insurance Register is clear and unambiguous.

HRDC's response. HRDC agrees that reporting should be clear and accurate. It has already started to review this reporting to ensure that it provides information as clearly as possible.

Investigating fraud

A risk-based approach to investigation and control is needed

1.79 We expected that HRDC would link its fraud investigations to the risks associated with the issuing of the SIN and with its use by the federal government.

1.80 Instead, we found that HRDC has completed no risk-based analysis of the SIN program. Nor has it attempted to determine the extent and nature of SIN-related fraud. Its level of effort is based mainly on the number of SINs issued, the resources it has available, and a number of specific risk indicators. Although the number of SIN investigations has increased since 1998 (Exhibit 1.5), it is not clear that this effort was focussed on high-risk areas. Furthermore, since current levels of effort reflect the supplementary funding the Department received, SIN investigations may not remain at this level after this funding ends in 2002-03.

1.81 In 1998, we recommended that HRDC redesign its performance indicators for SIN investigations to recognize their importance not only to the Employment Insurance program but also to other federal programs and provincial, territorial, and municipal programs. In 2001-02, HRDC began the setting of goals and the routine tracking of the number of SIN investigations carried out by its local offices. This performance indicator does not capture information on the quality and results of those investigations. However, since 1998 the SIN Investigation Service has reviewed most SIN investigations for completeness.

1.82 Recommendation. Human Resources Development Canada should adopt a more comprehensive risk-based approach to investigating SIN-related fraud.

HRDC's response. The Department has implemented the SIN Application Review Program (SARP), a risk-based program that guides investigation priorities related to SIN applications, which forms part of HRDC's approach to risk management. The Department will determine if SARP can be expanded to guide priority-setting for other SIN investigations. Any risk-based approach will recognize that the Department needs to work closely with federal and provincial government officials, police services, employers, and other partners in combating SIN-related fraud and abuse.

Investigators lack structured training and adequate tools

1.83 In this audit, we expected to find that SIN investigators were receiving more training and support than in 1998. However, we found that there is still no formal training program. While they now have access to some computer-based training, investigators informed us that they would benefit from classroom instruction.

1.84 We also expected that SIN investigators would have access to adequate tools. We found that various tools are being made available: on-line access to certain databases, a guide containing pictures and descriptions of security features of authentic documents, and ultraviolet lamps to help identify fraudulent documents. However, as we found with front-line staff, investigators in many of the local offices we visited had not yet received the lamps and some had not received training in the use of the tools.

1.85 Recommendation. Human Resources Development Canada should ensure that investigators have the proper training and tools.

HRDC's response. HRDC agrees with the recommendation. The Department has developed an integrated course on Social Insurance Number investigation and identity fraud. The first session of the course will take place in the fall of 2002. All HRDC offices have now received ultraviolet lamps and the necessary instructions and training to help identify fraudulent documents through their use. This is matched by a regularly-updated guide to identity documents. The decision that HRDC will no longer accept certified photocopies to prove identity from people applying for SINs in-person or through the mail will increase the effectiveness of these tools.

Conclusion

1.86 The SIN is used widely outside the federal government as well as inside. It is one of a handful of personal identifiers that a person needs to function in Canadian society. It is used in several major federal benefits programs and in transactions with the Canada Customs and Revenue Agency. It is used often, but not always, by provinces, cities, and the financial services industry. It also appears that many businesses use it when offering credit to their clients. All of these uses give the SIN its value.

1.87 We began our audit expecting to find that the issues we raised in 1998 had been substantially addressed. Instead, we have concluded that HRDC has not done enough to safeguard and strengthen the integrity of the SIN.

1.88 Ensuring that SINs are issued to only those eligible is still problematic. Most of the application-processing weaknesses we found in 1998 have not been addressed. In our view, HRDC's policies and practices do not meet, in important respects, the intent of the Employment Insurance Act and Regulations. We are concerned that for the majority of the SINs issued since 1998, the applicant's identity and citizenship status were not checked properly because a single piece of identification is usually insufficient to check both.

1.89 The integrity of the Social Insurance Register also remains a persistent problem. While HRDC made a number of improvements after 1998, there are still several weaknesses that it has not dealt with adequately. The number of usable SINs for people over 20 years old exceeds the census figure by 5 million. Although HRDC has designated millions of SINs as dormant, they could still be used to access federal benefits programs without triggering an investigation. Finally, there are still 8.3 million records in the Social Insurance Register that have never been cross-checked with other departments or supported by any proof-of-identity program. These uncertified SINs are also usable.

1.90 Since 1998 the Department has stepped up the number of SIN-related fraud investigations. However, there is little basis for judging whether the new level of effort is adequate—because there is little information on the extent of SIN-related fraud. The Department has not done a comprehensive risk analysis as a basis for its investigation efforts.

HRDC's comments. HRDC is committed to fulfilling its role as part of the overall Government of Canada response to Canadians' heightened awareness of security issues. The Department recognizes the priority of addressing the security issues related to personal identification documents and has responded with actions that will strengthen its ongoing efforts to

• ensure appropriate issuance of SINs;
• improve the integrity of the key SIN database, the Social Insurance Register;
• vigorously pursue SIN fraud and abuse; and
• raise awareness that the Social Insurance Number (SIN) is authorized only as a file identifier for specific Government of Canada-related purposes and how to protect against SIN misuse.

HRDC is dedicated to diligent stewardship of the Social Insurance Number. Since 1998 the Department has taken steps to improve the management of the SIN and the integrity of the Social Insurance Register (SIR). The Department agrees with the recommendations in this chapter, and as indicated in its responses, is taking immediate action to implement a number of key initiatives. These actions will improve the policies, processes, and practices of its management and administration of the Social Insurance Number. We will continue to work with the Office of the Auditor General and other partners on further initiatives that fully meet the recommendations of the report and the expectations of Canadians.

About the Audit

Objective

The objective of our audit was to determine whether the federal government was safeguarding and strengthening the integrity of the Social Insurance Number (SIN). We assessed the extent of the government's action to address the key concerns we raised in our 1998 audit and those raised by the Standing Committee on Public Accounts and the Standing Committee on Human Resources Development.

Scope

Using the problems we identified in 1998 as a baseline, we tested whether they still existed and were still significant in 2002. We looked at four issues:

• the role and importance of the SIN;
• the integrity of the information in the Social Insurance Register (SIR);
• control over the issuing of SINs and the SIN cards; and
• efforts to combat fraud.

We carried out our audit mainly at HRDC headquarters in the National Capital Region; at Bathurst and Moncton, New Brunswick; in regional and local HRDC offices; and at the Treasury Board Secretariat. We gathered additional information from the Canada Customs and Revenue Agency, Citizenship and Immigration Canada, the Office of the Privacy Commissioner, Statistics Canada and the Royal Canadian Mounted Police.

Criteria

Legislative and other authorities should provide a sound framework for safeguarding and strengthening the integrity of the SIN.

Human Resources Development Canada should be aware of how the SIN is used in the private sector and the public sector in provinces and should lead action to encourage its proper use.

The Treasury Board Secretariat should monitor departmental compliance with its policies on the use of SIN and data matching.

HRDC should make reasonable efforts to ensure that it provides new SINs and replacement cards only to eligible individuals.

HRDC should make reasonable efforts to ensure that the Social Insurance Register is accurate, complete, and secure.

Fraud detection and investigation efforts should be based on risk.

Ratings

We assessed the action of departments/agencies against our original audit recommendations (see Key Message at the beginning of the Chapter). We used the following ratings:

• Completed. Corrective action has been fully implemented
• Satisfactory progress. Progress is being made at a satisfactory pace
• Limited progress. Some progress is being made, but the pace or scope is not satisfactory
• No progress. No evidence of progress although the department or agency accepted the recommendation from the original audit
• Rejected. The department or agency did not accept the recommendation from the original audit
• Unknown. Status of progress is unknown or information is not available

Audit team

Assistant Auditor General: Maria Barrados
Principal: Peter Simeoni
Director: Suzanne Therrien

Christian Couture
Guy Dumas
Susan Gomez
Lise Tremblay

For information, please contact Communications at (613) 995-3708 or
1-888-761-5953 (toll-free).