Follow-up on Internal Audit Recommendations

Follow-up on Internal Audit Recommendations

Executive Summary

Background

1. The Practice Review and Internal Audit—Multi-year Plan for Fiscal Years 2012–13 to 2014–15 recommended one internal audit activity for the 2012–13 fiscal year: a follow-up of past internal audit recommendations.

Objective, scope, and approach

2. The objective of the follow-up audit was to assess how well responsible managers had implemented the recommendations made in the 11 internal audits that were conducted over the past 10 years.

3. We sought input from management and reviewed the supporting documentation provided. We also reviewed the Office of the Auditor General of Canada’s (OAG’s) INTRAnet site for pertinent documents.

Findings

4. We found that management has fully implemented all of the recommendations in 8 of the 11 internal audits that we examined. We also found that management had partially implemented the recommendations in the following three internal audits.

Internal Audit of Classification and Compensation—December 2004

5. One of the four recommendations has not been fully implemented.

6. There has been some progress in acquiring an up-to-date Human Resource (HR) management information system. We found that the OAG asked to join the Government of Canada Human Resources Management System (GCHRMS), which is the human resource information and management system that is endorsed by Treasury Board of Canada Secretariat, under its Shared Systems Initiative. However, the government’s delay in implementing the new HR system has prevented the Office from fully implementing this recommendation.

Internal Audit of the Management of Human Resources and Professional Development Function—April 2006

7. Two of the nine recommendations have not been fully implemented.

8. Management agreed to compare its capacities to other organizations’ good practices and to identify and address any variances. We found that the Office participated in a government-wide HR management benchmarking exercise, which was lead by Deloitte. We also found that HR staff was in the process of conducting its own exercise, by comparing the HR and professional development management practices at the US Government Accountability Office (GAO) to those at the OAG. However, HR has not analyzed the results of the benchmarking exercises to identify any variances and take any necessary corrective action.

9. Management agreed with the recommendation that staffing officers should take the central agency training available to them. We reviewed staffing officers training records and found that two of the three staffing officers have completed the available training. Management indicated that the remaining staffing officer is scheduled to take the training in 2013.

Internal Audit—Assessment of the Design of the Office’s Quality Management System—October 2008

10. Two of the nineteen recommendations have not been fully implemented:

• Management indicated that the roles and responsibilities for joint and collaborative audits were appropriately understood and that formal guidance would be developed by June 2010. We found that guidance was not developed in 2010 and was not included in the Renewal of Audit Methodology (RAM) project—which was launched in two phases, in November 2011 and October 2012. The Annual Audit Practice Team (AAPT) indicated that additional guidance on joint audits would be included in the methodology update to the Annual Audit Manual in summer 2013.
• In 2008, the Professional Practices Group (PPG) agreed that a grid—which cross-referenced each standard in the Quality Management System to each relevant audit document, and which provided evidence that each element of the quality control system was operating correctly—would be prepared by June 2010 and would be maintained. This work was included in the overall deliverables for the OAG’s System of Quality Control within the RAM project that was launched November 2011. We found that PPG had established a TeamMate file, which had been populated with planning and execution information, to document the 2012 monitoring process. We also found that PPG was completing its first annual monitoring report for the 2012–13 fiscal year, which it indicated would be finalized in June 2013. The TeamMate file would then be carried forward to begin the 2013 monitoring process and to document the process and results.

11. Appendix A includes our assessment of progress made against each recommendation in the 11 internal audits.

Introduction

Background

12. Internal audits focus on management processes and administrative services within the Office of the Auditor General (OAG). The Practice Review and Internal Audit group (PRIA) provides independent assessments to the Auditor General, on whether the processes and services are appropriately designed and operating effectively; the PRIA group also makes recommendations for improvements. The internal audit reports also provide the Auditor General with assurance that key areas within the OAG are being adequately managed.

13. Over the past 10 years, the PRIA group has conducted 11 internal audits. These have confirmed the effective functioning of selected processes and services, and have included a number of recommendations for improvements.

Mandate

14. The Practice Review and Internal Audit—Multi-year Plan for Fiscal Years 2012–13 to 2014–15, which was recommended by the OAG Audit Committee and approved by the Auditor General, contained one internal audit activity for the 2012–13 fiscal year: a follow-up of past internal audit recommendations.

About the follow-up audit

Objective

15. The objective of the follow-up audit on the past internal audit recommendations was to assess the progress that responsible managers made in implementing these recommendations. The PRIA group follows up on each recommendation until it has been fully implemented.

Scope and approach of the follow-up audit

16. The scope of the follow-up audit focused on all outstanding recommendations in the 11 internal audits that were conducted between 2000 and 2012. These included recommendations from the following internal audits:

• Internal Audit of Travel—January 2004
• Internal Audit of Classification and Compensation—December 2004
• Internal Audit of Hospitality Expenses—December 2005
• Internal Audit of the Management of Human Resources and Professional Development Function—April 2006
• Internal Audit of the Staffing Function—May 2008
• Assessment of the Design of the Office of the Auditor General’s Quality Management System—October 2008
• Internal Audit of Controls over Financial Transactions and GX Financial Reporting System—November 2009
• Internal Audit of Hospitality Spending—December 2010.

17. In 2008, the PRIA group reported the results of a follow-up of five internal audits to the Audit Committee. The assessment indicated that the recommendations from two of the internal audits had been partially implemented; they are included in the current follow-up. All of the recommendations made in the following three internal audits had been fully implemented:

• Internal Audit of Professional Services Contracts—December 2001
• Internal Audit of Security at Headquarters—August 2003
• Internal Audit of Security in Regional Offices—January 2004

18. We requested and received management reports on progress made against the outstanding recommendations as well as key documents that supported the reports. We also reviewed the OAG INTRAnet for pertinent documents.

Assessment of Audit Recommendation Implementation

Internal Audit of Travel—January 2004

19. The PRIA group’s 2008 assessment of management’s progress in implementing recommendations found that one recommendation—that the Office should monitor the use of discount airfares—had not been implemented. At the time of the assessment, the PRIA group made four new recommendations related to improving the use and monitoring of discounted airfares. The new recommendations were based on the findings from a review of a sample of 35 out of 227 travel activities, which were identified in a Public Works and Government Services (PWGSC) report and for which OAG staff had not accepted discounted fares.

20. We found that the Comptroller’s Branch had fully implemented the following four new recommendations:

• Management formalized and communicated guidelines for the use of discounted airfares, including circumstances where exceptions could be made. The Comptroller’s Branch had posted the formal travel guidelines on the OAG INTRAnet site. In addition, Comptroller staff and the OAG travel agent made presentations on the use of discounted airfares to OAG employees who usually made travel arrangements. The OAG travel agent requested Assistant Auditor General (AAG) approval when employees did not use discount airfare, if required.
• Management monitored and recorded when the lowest airfare was used, in accordance with guidelines. They also documented instances of the lowest fare not being accepted and the reasons why it was not accepted. The OAG travel agent monitored and recorded instances where lowest airfare was not used and produced a quarterly report for the Comptroller’s Branch.
• Management emphasized the importance of cost effectiveness and encouraged the employees to consider other modes of transportation when they travelled reasonable short distances, and acknowledged exceptions that were formally approved. Management recognized that work-life balance is very important to OAG employees and considered the impact on work-life balance when giving advice to employees on cost-effective travel options.
• Management developed and posted, on the OAG INTRAnet site, the Transportation—Lowest Available Airfare Guideline, which includes a list of preferred carriers for international travel. The Office is a member of the National Joint Council and follows the Council’s travel directives on international travel. The travel directives include travelling in economy class and finding the lowest available airfares, when appropriate; booking as far in advance as possible; and, where available and when authorized, flying business/executive class if continuous air travel exceeds nine hours.

Internal Audit of Classification and Compensation—December 2004

21. Three of the four recommendations that were assessed as outstanding in the PRIA group’s 2008 follow-up have now been fully implemented.

• We found that in 2008 the Auditor General issued a formal instrument of delegation of Human Resource (HR) authorities. This instrument covered classification, compensation, benefits, and other areas that clarify the authorities delegated to each level and the associated responsibilities. The Director of HR then provided training to all AAGs and Principals (PXs) on the roles and responsibilities of the delegated HR authorities, according to group. This training is also part of the Director (DX) and PX transition training, which is offered following the promotion process.
• In October 2011, HR staffing officers began using Guidance for Determining Salary and the associated forms to document the rationale for salaries negotiated with employees at the time of appointment.
• The observations in the Internal Audit of Classification and Compensation found that the Audit Services Group (ASG) classification policies were not up to date. We found that an ASG Classification Policy was put in place in 2005, and an ASG Classification Standard was implemented in 2009.

22. There has been some progress made on the recommendation to acquire an up-to-date HR management information system. We found that the OAG asked to join the Government of Canada Human Resources Management System (GCHRMS), which is the human resource information and management system that is endorsed by Treasury Board of Canada Secretariat, under its Shared Systems Initiative. In 2009, the administrator of GC HRMS informed the Office that it could use the system. At that time, the GC HRMS was in the process of converting existing members from the old information system platform to PeopleSoft, so the Office decided to delay joining the shared service to avoid a double conversion from the OAG system to the old information system platform and then to PeopleSoft. In 2012, the Office again asked to join GC HRMS but was informed that no new departments or agencies would be given access to the system until the conversion of existing users to PeopleSoft had been completed. The delay in the GC HRMS data conversion has prevented the Office from implementing the recommendation to acquire an up-to-date HR information system.

Internal Audit of Hospitality Expenses—December 2005

23. There were two outstanding recommendations from this report:

• The Office should reconsider the “formal work related event” category.
• The Office should monitor progress of the draft Treasury Board Policy and comply fully with it once it has been approved by Treasury Board.
• They were included as the recommendations in the Internal Audit of Hospitality Spending—December 2010, our assessment of which is later in this report.

Internal Audit of the Management of Human Resources and Professional Development Function—April 2006

24. Seven of the nine recommendations have been fully implemented. The following two were only partially implemented:

• We found that that Human Resources/Professional Development group (HR/PD) had partially implemented a recommendation to compare its capacities to good practices in other organizations and to identify and address any variances. In 2010, the Office participated in a government-wide benchmarking exercise lead by Deloitte. The study found that the OAG appeared to be performing significantly above the average in its stewardship role, and above average in its strategist’s role. HR management indicated that it was going to conduct its own benchmarking exercise in March 2013, by comparing HR/PD management practices at the US Government Accountability Office (GAO) with those at the OAG. When we completed our audit work, HR Management had not analyzed the results of the benchmarking to identify any variances and take any necessary corrective action.
• We also found that HR/PD had partially implemented a recommendation to establish a requirement for HR staff to take and successfully complete central agency training in staffing. In 2006, management agreed with the recommendation and indicated that staffing officers were taking the training available to them. We reviewed staffing officers’ training records as at 28 February 2013 and found that two of the three staffing officers had completed the available central agency training (Canada School of Public Service Courses: Staffing for Staffing Specialist—Part I and II). Management indicated that the remaining staffing officer was scheduled to take the courses in 2013.

Internal Audit of the Staffing Function—May 2008

25. All five recommendations have been fully implemented.

26. We noted that one of the recommendations, that the Office reconsider requiring written support by superiors during the promotion process, was discussed by the Executive Committee. The response from the Committee was that it was satisfied there were a sufficient number of controls and reviews in the process to ensure that there was no possible abuse of power. Since the Executive Committee has considered the recommendation and has decided to maintain the status quo, we consider the recommendation fully implemented.

Internal Audit—Assessment of the Design of the Office’s Quality Management System—October 2008

27. Management has fully implemented 17 of the 19 recommendations and has partially implemented the following 2:

• The first recommendation relates to the development and approval of guidance for audit teams involved in joint and collaborative audits. The guidance should include the division of work, required communication between the auditors, and access to working papers. The recommendation says there should be written guidance requiring confirmation by the engagement leader of an understanding of how the work is to be divided. In the 2008 response to the recommendation, management indicated they were confident that the roles and responsibilities for joint and collaborative audits were appropriately understood. They went on to say that formal guidance would be developed in this area by June 2010. We found that guidance was not developed in 2010, nor was it included in the Renewal of Audit Methodology (RAM) project in either of its two phases (November 2011 and October 2012). The Annual Audit Practice Team (AAPT) indicated that additional guidance on joint audits would be included in the methodology update to the Annual Audit Manual during summer 2013.
• The second recommendation relates to preparing and maintaining a grid that cross-references each standard in the Quality Management System with the relevant documentation in an audit file to provide evidence that each element of the system was operating correctly. In 2008, the Professional Practices Group (PPG) indicated that the grid would be prepared by June 2010 and would be maintained. This work was subsequently included as part of the overall deliverables of the OAG’s System of Quality Control within the RAM project that was launched in November 2011. In June 2012, PPG indicated that a TeamMate file would be established to document the 2012 annual monitoring process. We found that PPG had established a TeamMate file, which had been populated with planning and execution information, to document the 2012 monitoring process. We also found the PPG was completing its first annual monitoring report, which included draft recommendations. PPG indicated that the monitoring report would be finalized in June 2013. The TeamMate file would then be carried forward to begin the 2013 monitoring process and would be used to document the process and results.

Internal Audit of Controls over Financial Transactions and GX Financial Reporting System—November 2009

28. We found that the recommendation from this Internal Audit was fully implemented.

Internal Audit of Hospitality—December 2010

29. We found that the recommendation from this Internal Audit was fully implemented. We noted that the Comptroller’s Group had updated the OAG Hospitality Policy to reflect the Directive on the Management of Expenditures on Travel, Hospitality and Conferences, from the Treasury Board of Canada Secretariat. The OAG policy clarified the various types of events, with the terms “work-related” or “formal work-related” no longer used, to be consistent with the Directive.

Conclusion

30. We found, in the 8 internal audits that we examined, that 41 of the 46 recommendations made to management were fully implemented and 5 remain outstanding.

Management Response

31. Management has reviewed this report and accepts its conclusions.