At a glance – Risk-based Audit Plan, 2021 to 2023, Environment and Climate Change Canada

About the Risk-based Audit Plan

The Audit and Evaluation Branch (AEB) prepared the ECCC Risk-based audit plan (RBAP) for the Deputy Ministers, in keeping with the Treasury Board Policy on Internal Audit. Prepared in the context of the ongoing COVID-19 pandemic, it presents audit engagements planned for fiscal year (FY) 2021 to 2022 to FY 2022 to 2023. The plan supports the allocation of internal audit resources to those areas that represent some of the most significant risks to the achievement of ECCC’s objectives. It also takes into consideration the departmental needs identified by branches.

ECCC’s Departmental Audit Committee reviewed the RBAP at its March 22-23, 2021 meeting and recommended the plan to the Deputy Ministers for approval. The Deputy Minister and the Associate Deputy Minister approved the RBAP on March 30, 2021.

The role of internal audit in the federal government is evolving. The Office of the Comptroller General (OCG) is leading the renewal of a vision for internal audit to support managing change in today’s government. External factors such as technology and the environment are driving the unprecedented complexity and pace of change.

The COVID-19 pandemic continues to affect the Department’s activities. As the Department adapts to the changes in the way it is delivering on its mandate, internal audit can play an important role by providing independent assurance or consultation services in keeping with OCG’s new vision of core services. As a strategic partner for senior management, internal audit can help to foster organizational learning and continuous improvement. It can also be a valuable catalyst for organizational change, leveraging audit findings, to help develop best practices and forward-looking solutions that benefit all of ECCC.

Developing the Risk-based Audit Plan

Identifying the audit universe

In developing this RBAP, a review was undertaken to ensure alignment of the audit universe with the Departmental Results Framework. The AEB also considered factors such as the materiality, the inherent risks associated with each entity, identified corporate risks and management challenges and the findings from past internal and external audits and evaluations.

Consulting with ECCC senior management

The CAE and AEB staff engaged with senior management through consultations with all branches. Joint audit and evaluation consultation sessions ensured that the planning process for both functions was effective, efficient and coordinated.

Identified internal audit engagements were presented at the ADM Corporate Operations Committee for discussion on February 26, 2021. The RPAP was revised in light of the comments received and presented to the Executive Management Committee on March 18, 2021. As a final step, the Departmental Audit Committee (DAC) reviewed the RBAP at its March 22-23, 2021 meeting.

External assurance providers

The AEB coordinates audits performed by external assurance providers such as the Office of the Comptroller General (OCG), the Office of the Auditor General (OAG), the Commissioner of the Environment and Sustainable Development (CESD), the Public Service Commission (PSC). The AEB provides advice, guidance and assistance to the Deputy Ministers and senior management throughout these engagements. In addition, the external audit liaison function helps to coordinate the Department’s response to environmental petitions received from the CESD. It should be noted that ECCC receives the majority of the environmental petitions that Canadians submit to the CESD.

The present RBAP takes into account the coverage and frequency of planned external audit engagements. Wherever possible, the AEB will leverage external audits to optimize the coverage and timing of its own planned audits and minimize duplication.

Selecting potential audit engagements

Internal audit takes risks into account, which including the likelihood of occurrence and the potential impact on the department, to determine the level of risk (high, moderate or low). This information is then used to identify or to help determine potential engagements. However, because of the current COVID-19 pandemic, it also considered branch needs and readiness for an engagement.

Each internal audit engagement included in the 2021 to 2023 RBAP was selected based on its potential to add value to ECCC’s strategic outcomes and operational objectives through the continuous improvement of governance, risk management and control processes. Professional judgment and the information obtained from discussions with ECCC senior management and their management teams were used to develop the final list of potential internal audit engagements.

Related activities

Follow-up process for past audit recommendations

The AEB is required by Treasury Board policies to regularly monitor and report on the implementation of management actions and commitments made in response to evaluations and  internal and external audit recommendations. The follow-up process allows management to provide, on an ongoing basis, evidence of actions taken and deliverables completed in response to the audit recommendations. The audit team is responsible for validating the implementation of actions and completion of audit deliverables. The Chief Audit Executive reports to the Deputy Ministers, DAC and the Performance Measurement, Evaluation and Results Committee (PMERC) on progress in implementing management actions to address recommendations. Any significant delays or changes to action plans and planned deliverables, as well as any associated risks, are flagged. The quarterly follow-up reports are approved by the Deputy Ministers.

Quality assurance and improvement program

The AEB Quality assurance and improvement program (QAIP) is in place and DAC is regularly briefed on its status.

The primary objective of a QAIP is to promote continuous improvement. It is an ongoing and periodic assessment of the entire spectrum of audit and consulting work performed by the internal audit function. It includes both internal and external assessments.

In compliance with the Treasury Board of Canada’s policies and the Institute of Internal Auditors’ International Professional Practices Framework, an external assessment of the audit function must be performed every five years. The last external assessment of the ECCC audit function was completed in March 2019, where the audit function received a global rating of “generally conforms”.

ECCC internal audit engagements for fiscal year 2021 to 2022 to fiscal year 2022 to 2023

Three audit engagements are planned for tabling in FY 2021 to 2022, four audit engagements are planned for tabling in FY 2022 to 2023 and one is planned for tabling in FY 2023 to 2024, as indicated in table 2. It should be noted that a planned audit engagement may start in a different fiscal year from its tabling date.

As well, two horizontal engagements requiring ECCC’s participation related to Laboratories Canada begun in FY 2020 to 2021 are carried forward and are expected to be tabled at DAC in FY 2021 to 2022:

• Risk Assessment of the Terra Canada Hub of Laboratories Canada
• Risk Assessment of the Atlantic Science Enterprise Centre (ASEC) of Laboratories Canada

No formal joint audit and evaluation engagements are planned for FY 2021 to 2022 or FY 2022 to 2023. In the list that follows, “tabling” indicates the date at which the report will be presented to the Departmental Audit Committee.

Tabling in December 2021

• Review of the progress in the implementation of the ECCC Data and Analytics Strategy
• Advisory engagement on the design and implementation of the Enforcement Branch’s risk-based approach

Tabling in March 2022

• Audit of the classification function at ECCC

Tabling in December 2022

• Review of ECCC’s Respect Bureau

Tabling in March 2023

• Audit of the governance of horizontal initiatives

Tabling in FY 2022 to 2023 (timing to be determined)

• Potential horizontal engagement related to Laboratories Canada

Tabling in December 2023

• Review of the use of scientific advice in support of policy development and decision making

Tabling in FY 2023 to 2024 (timing to be determined)

• Review of information management

It should also be noted that internal audit may be involved in the conduct of the OCG Horizontal audit on adoption of digital standards, should ECCC be scoped in. This engagement is planned to start in FY 2021 to 2022.

Internal audit resources and capacity

The implementation of the present RBAP is included in the AEB's FY 2021 to 2022 planned budget of $4.2 million and estimated 31.92 FTEs.