Targeted Annual Core Control Self-Assessment Audit in Small Departments (Fiscal Year 2022–2023)

Background

In the fall of 2022, 42 small departments (SD) were required to provide the Office of the Comptroller General (OCG) the results of their core control self-assessments, approved by their chief financial officer, in the policy areas of delegation of spending and financial authorities and transfer payments.

After receiving these self-assessments, the OCG provided SDs with the consolidated results of these self-assessments and information on horizontal findings. The OCG then launched an audit to independently verify the accuracy of the self-assessments results in a targeted sample of 3 SDs and provide insights to help address common challenges and risks related to these policy sectors.^{Footnote 1} The SDs scoped into this audit were:

• Polar Knowledge Canada (POLAR)
• Women and Gender Equality (WAGE)
• Royal Canadian Mounted Police External Review Committee (RCMP-ERC)

SDs that were not included in this audit are encouraged to assess whether the recommendations and general advice in this report apply in their own contexts, and develop their own management action plans and follow up on them internally, where appropriate.

Why this is important

Canadians expect the Government of Canada’s financial resources to be well managed in the delivery of programs and safeguarded through balanced controls that enable flexibility and manage risk. As accounting officers under the Financial Administration Act, deputy heads are accountable for ensuring that delegation of authorities and transfer payments are organized to deliver departmental objectives in compliance with government policies and procedures, which set the requirements for sound stewardship of public funds.

Key findings

• Regarding accuracy, the audit found that overall self-assessment compliance ratings reported by the 3 SDs for both areas examined were not significantly overstated.
• In the area of transfer payments, high compliance ratings were generally observed for the SDs audited. Exceptions mainly related to the alignment of funding agreements with program terms and conditions.
• Compliance in the area of delegation of spending and financial authorities varied more widely from high to low across the SDs audited. Opportunities for improvements identified mainly revolved around the annual monitoring of delegation instruments and related training.
• The rigour of sampling approaches adopted by the 3 SDs to complete their self-assessments also varied widely. One SD self-assessed all their transactions while the other two SDs were unable to fully demonstrate what sampling methodology they had adopted for their self-assessments, given the lack of supporting documentation.

Conclusion

Overall, the audit found that the SD self-assessments results examined had a high level of accuracy in the area of transfer payments and that opportunities for improvements regarding compliance with government policies were more prevalent in the area of delegation of spending and financial authorities.

Based on the key findings in this report, recommendations were issued in the following areas (see Appendix E for the list of recommendations):

• Annual monitoring of delegation instruments
• Mandatory training for the delegation of spending and financial authorities
• Alignment of the funding agreements with the terms and conditions of their respective programs

Additionally, general guidance was issued for all SDs participating in the self-assessment in the following areas (see Appendix F for the list of general guidance):

• Segregation of duties when completing the self-assessment tools
• Considering the risk of overestimation in self-assessing compliance levels
• Leveraging existing best practices from other SDs
• Following self-assessment sampling guidelines issued by the OCG, and retaining supporting documentation

Objectives

The objectives of this audit were to:

• verify the accuracy of a sample of SD self-assessments results in the areas of delegation of authorities and transfer payments^{Footnote 3}
• provide related insight to help address common challenges and risks

Scope

In the fall of 2022, 42 SDs were required to provide OCG the results of their self-assessments (covering fiscal year 2021–22) in the areas of delegation of authorities and transfer payments using the prescribed OCG tool. Micro-organizations were required to provide their self-assessment only in the area of delegation of authorities.

Three SDs were selected for this audit based on a risk assessment completed by the OCG team. To ensure a certain level of diversity and representativeness of the audit sample, the following criteria were considered:

• recency of past OCG audit coverage
• size of department
• sector of activity
• self-assessment results

The three SDs selected for the targeted audit were the following:

• Polar Knowledge Canada (POLAR), a regulatory agency and, in terms of size, a small SD
• Women and Gender Equality (WAGE), a medium-sized policy advisory organization
• Royal Canadian Mounted Police External Review Committee (RCMP-ERC), an investigative body categorized as a micro-organization^{Footnote 4}

The audit scope excluded the self-assessments provided to OCG by the other SDs and SDs that have their own internal audit function (including a departmental audit committee).

Compliance rating scale

• Low: Less than 80% compliance
• Medium: Less than 90% compliance and greater than or equal to 80% compliance
• High: Greater than or equal to 90% compliance

Detailed findings

Transfer payments

Transfer payments are one of the government’s key instruments to further its broad policy objectives and priorities that include monetary payments or transfers of goods, services, or assets to third parties, including Crown corporations, made by the Government of Canada on the basis of appropriations.

The Treasury Board policy framework provides direction on transfer payments within government and aims to ensure that transfer payment programs are:

• designed and delivered to address government priorities in achieving results for Canadians
• managed with integrity, transparency and accountability in a manner that is sensitive to risks
• focused on citizens and recipients

The 2 SDs that were audited for this area were WAGE and POLAR^{Footnote 5}

Figure 1 depicts the average compliance results by sub-criteria in the areas of:

• funding
• segregation of duties
• expenditure initiation/commitment authority
• transfer payment management
• certification authority

More specifically, figure 1 shows the comparison between the average results of the targeted departments’ self-assessment ratings, their actual audit ratings, and how they compare to the average ratings amongst all 42 departments’ self-assessment ratings.

Figure 1 - Text version

Sub-criteria	42 SDs average self-assessment ratings	Average of targeted departments’ self-assessment ratings	Average of targeted departments audit ratings
Sub-criteria 1.2	100%	100%	85%
Sub-criteria 1.3	100%	100%	100%
Sub-criteria 2.1	92%	100%	100%
Sub-criteria 3.2	98%	100%	100%
Sub-criteria 5.5	96%	100%	100%
Sub-criteria 5.7	82%	100%	100%
Sub-criteria 6.3	98%	95%	95%

Sub-criteria description
Legend
	1.2 The types of transfer payments selected for the recipient is appropriate under the program terms and conditions.
	1.3 The funding amounts are consistent with federal stacking limits established in program terms and conditions.
	2.1 Segregation of duties exist between individuals responsible for managing transfer payments.
	3.2 Expense (total project funding amount) is approved prior to the approval of funding agreement.
	5.5 Supporting documents for all transfer payments made are properly completed and documented, in accordance with payment and reporting requirements stated in the signed funding agreement.
	5.7 Amendments are signed by the appropriate authority and are performed prior to the end date of the agreement.
	6.3 Certification authority is conducted in a timely manner.

In terms of compliance ratings, OCG audit and SD self-assessments results aligned in almost all key areas examined under transfer payments. Alignment was found in:

• stacking limits being consistent with the funding amounts
• segregation of duties existing between individuals
• expenses being approved prior to the approval of the funding agreement
• availability of documentation to support that activities were carried out
• funding agreement amendments being signed by the appropriate authority
• certification authority being conducted in a timely manner

The audit noted that there was only a 7% variance between the SDs’ self-assessed compliance results and the audit results. Variances between audit and self-assessment results mainly revolved around the compliance of funding agreements and programs with their terms and conditions (for example, maximum duration, funding amount and eligible expenditures of the agreements).

Delegation of spending and financial authorities

According to the Directive on Delegation of Spending and Financial Authorities, chief financial officers are responsible for the delegation of spending and financial authorities and its maintenance, and of their management and oversight. This ensures that the Government of Canada’s financial resources are well managed in the delivery of programs to Canadians and safeguarded through balanced controls that enable flexibility and manage risk.

The Guide to Delegating and Applying Spending and Financial Authorities provides departments with information on how, when, what and to whom to delegate spending and financial authorities, in addition to the tools to do so. The Policy on People Management combined with the Policy on Learning, Training, and Development (now archived) provide the guidance for the required delegation training.

The three SDs—RCMP ERC, POLAR and WAGE—were audited for this area.

Figure 2 depicts the average compliance results by sub-criteria in the areas of delegation of spending and financial authorities, and for the area of learning, training, and development. It shows the comparison between the average results of the targeted departments’ self-assessment ratings, their actual audit ratings, and how they compare to the average ratings amongst all 42 departments’ self-assessment ratings.

Figure 2 - Text version

Sub-criteria	42 SDs average self-assessment ratings	Average of targeted departments’ self-assessment ratings	Average of targeted departments’ audit ratings
Sub-criteria 1.1	98%	100%	100%
Sub-criteria 1.2	86%	100%	33%
Sub-criteria 1.3	88%	100%	100%
Sub-criteria 1.4	96%	50%	100%
Sub-criteria 2.1	93%	97%	68%
Sub-criteria 2.2	92%	78%	58%

Sub-criteria description
Legend
	1.1 Spending and financial authorities are delegated in writing in accordance with the Directive on Delegation of Spending and Financial Authorities.
	1.2 At a minimum, the delegation of spending and financial authorities are reviewed annually.
	1.3 The delegation chart is updated and submitted for the minister’s signature when there are significant changes or within 90 calendar days of the appointment of a new minister.
	1.4 Financial authorities delegated to other departments are signed by either the minister or the deputy of the minister.
	2.1 Individuals who are granted delegated spending and financial authorities completed the required training prior to exercising their authorities.
	2.2 Individuals who are granted delegated spending and financial authorities revalidated their knowledge at least every five years in order to maintain their delegated authorities.

The audit noted that, on average, about half of the SD self-assessed compliance results aligned with the audit results. Areas of alignment between the audit and SD self-assessments results pertain to spending and financial authorities being delegated in writing in accordance with the directive and being submitted for the minister’s signature when there are significant changes or within 90 days of the appointment of a new minister.

The audit concluded that 22% of variances identified between the audit and self-assessment results were significant (that is, high self-assessed compliance rating versus corresponding low audit compliance rating). These variances were observed with respect to learning, training and development where SDs provided delegated financial authorities to individuals before they completed the required training.

Furthermore, another area where there was a significant variance was for annual reviews on financial authorities where 2 SDs had limited documentation to support the completion of the process.

Potential reasons for variances observed between the audit and self-assessment results

Inconsistencies identified between the audit and the self-assessment results may be due to several factors. As is often the case with self-assessments, there may have been a natural inherent tendency to overestimate results. In addition, although the self-assessment tools contain detailed guidelines, they cannot cover all the specific cases that could exist for the 42 SDs, which may lead to discrepancies in the interpretations of policies and directives. Finally, some findings could be explained by SDs not necessarily having timely access to the technical expertise required to conduct a thorough evaluation.

Why this is important

Accurate self-assessments of compliance with government policies not only help support deputy heads in their roles as accounting officers, but also show departments where improvements are most needed to prioritize corrective actions.

Notwithstanding the small sample size for this audit, variances observed between self-assessment results and audit results are an important consideration for all participating SDs (or any other departments using the OCG self-assessment tool) when interpreting their own self-assessment results. For instance, the variances observed as part of this audit may provide an indication of areas where a risk of significant overestimation of compliance assessment by management is more likely.

Conclusion

Overall, the audit found that the self-assessments results provided by SDs were generally accurate in the area of transfer payments. However, the accuracy of self-assessments results in the area of delegation of spending and financial authorities varied more widely.

General guidance for all SDs

1. Where possible, departments should consider having self-assessments of compliance completed by a different set of individuals (perhaps from a different section) than those responsible for transaction processing. This could help mitigate the inherent risk of overstatement often associated with self-assessment exercises.
2. When relying on self-assessments, consider the risk of overestimation in compliance levels:
   • Consider that based on the results of this audit:
     1. the self-assessed compliance ratings in the area of transfer payments were highly accurate
     2. the majority of the departments audited tended to self-assess by at least one level of compliance higher than the audit results in the area of delegation of spending and financial authorities
     3. all available mandatory training from the Canada School of Public Service should be leveraged to help mitigate the risk of overestimation
     4. referring to the Guide to Delegating and Applying Spending and Financial Authorities might also help address technical questions in the area of delegation and, when in doubt, departments are encouraged to reach out to the Treasury Board of Canada Secretariat with their enquiries (see section 8 of the Directive on Delegation of Spending and Financial Authorities)

Compliance rating scale

• Low: Less than 80% compliance
• Medium: Less than 90% compliance and greater than or equal to 80% compliance
• High: Greater than or equal to 90% compliance

Detailed findings

Potential reasons for variations in policy compliance

Inconsistency of audit results between SDs and between the 2 areas may be due to several factors. Transfer payment is a core activity in a department and as such may get more attention, in terms of more resources and a higher level of scrutiny in terms of oversight and public interest. This may inherently lead to a higher-level policy compliance than in back-office areas such as delegation of spending and financial authorities.

The larger SDs in the audit also tended to have higher compliance ratings, which, based on interviews, would be in part because they have more specialized and sometimes dedicated resources to ensure compliance. This would also explain the high compliance level of the transfer payment self-assessments, as they were completed by the largest SDs of the sample. Moreover, the variability in compliance results was also likely partly due to a variability in the degree of formalization of business processes in SDs.

Why this is important

The criteria of the self-assessments stemming from policy instruments and legislation are mandatory requirements that all SDs should comply with. Compliance directly supports deputy heads in their role as accounting officers under the Financial Administration Act. Compliance in both areas also enables departments to address government priorities by demonstrating sound stewardship of public funds through integrity, transparency and accountability.

Conclusion

Overall, the audit found that the level of compliance observed in the area of transfer payments was generally high, while in the case of delegation of spending and financial authorities the level of compliance varied more widely from high to low.

Recommendations

1. Small departments should implement a documented annual monitoring process to ensure that delegation instruments, including specimen signature cards, are current and approved in accordance with the Directive on Delegation of Spending and Financial Authorities.
2. Small departments should implement a documented process to verify that individuals who are granted delegated spending and financial authorities have:
   1. completed the required training prior to being granted and exercising their authorities
   2. revalidated their knowledge at least every 5 years in order to maintain their delegated authorities
3. Small departments should establish a formal process to document their verification of funding agreements to ensure their alignment with the terms and conditions of respective programs. These verifications should cover all the following key elements:
   1. eligible recipients and activities
   2. maximum duration and funding
   3. reporting requirements
   4. any other specific program criteria (that is, eligible expenditures)

General guidance for all SDs

When developing, improving and/or documenting business processes to help further enable and demonstrate compliance in both areas examined, departments could consider reaching out to other SDs of comparable size (or within the same sector of activity) with higher self-assessed compliance ratings to leverage existing practices where appropriate. This could help minimize the level of effort needed. 

Detailed findings

One department was able to examine all of their transactions for their delegation of spending and financial authorities’ self-assessment due to their small population size.

Another department used an external firm for sample selection and was only able to fully demonstrate how their transactions were selected for examination for their self-assessment relating to transfer payments, but were unable to do so for their self-assessment in the area of delegation of spending and financial authorities.

Finally, one department was unable to fully explain or demonstrate how their transactions were selected for examination in either of the self-assessments they completed.

Potential reasons for documentation inconsistencies

In SDs, the workload and impetus to deliver on results for Canadians can be just as significant as in larger organizations, but resources are more limited. Therefore, the importance of ensuring that sampling methodologies for oversight activities are fully documented might not be deemed a priority. Recognizing this context, the self-assessment sampling guidance issued to SDs by OCG could have been more detailed and clearer. OCG will therefore strengthen its guidance in this area before the next round of SD self-assessments.  

Why this is important

When departments are unable to fully explain or demonstrate how transactions were selected for examination in their self-assessments, it calls into question the reliability of results given the inherent risks of human bias and inability to prove the extent of the sample’s representativeness.

Furthermore, without a formal sampling approach to help ensure consistency between self-assessment exercises, it will be difficult for departments to gauge their progress over time and assess the effectiveness of corrective actions taken.

In SDs, investing time in formalizing strong sampling approaches would not only help them better support their deputy heads in their role as accounting officer, but could also help optimize the use of limited resources by focusing oversight efforts in key areas of risks.   

Conclusion

Overall, the audit found that documentation to verify the sampling approaches adopted by the 3 SDs to complete their self-assessments was limited. The rigour of these sampling approaches varied widely. The SDs should ensure in the future that they can demonstrate that they follow OCG sampling guidance.

General guidance for all SDs

All SDs should ensure that they can demonstrate (with supporting documentation) that the sampling guidelines for self-assessment issued by the OCG have been followed. A detailed procedure on how to perform sampling is provided on the guidance tab of the self-assessment tools. Additional guidance on sampling can also be found in the Guide to Delegating and Applying Spending and Financial Authorities and on the Statistics Canada website (specifically, section 3.2 “Sampling” in the document entitled Statistics: Power from Data!).

Guidance

1. Where possible, departments should consider having self-assessments of compliance completed by a different set of individuals (perhaps from a different section) than those responsible for transaction processing. This could help mitigate the inherent risk of overstatement often associated with self-assessment exercises.

2. When relying on self-assessments, consider the risk of overestimation in compliance levels:

   Consider that based on the results of this audit:

   • The self-assessed compliance ratings in the area of transfer payments were highly accurate.
   • The majority of the departments audited tended to self-assess by at least one level of compliance higher than the audit results in the area of delegation of spending and financial authorities.
   • All available mandatory training from the Canada School of Public Service should be leveraged to help mitigate the risk of self-assessing at a higher level.
   • Referring to the Guide to Delegating and Applying Spending and Financial Authorities might also help address technical questions in the area of delegation and, when in doubt, departments are encouraged to reach out to the Treasury Board of Canada Secretariat with their enquiries (see section 8 of the Directive on Delegation of Spending and Financial Authorities)
3. When developing, improving and/or documenting business processes to help further enable and demonstrate compliance in both areas examined, departments could consider reaching out to other SDs of comparable size (or within the same sector of activity) with higher self-assessed compliance ratings to leverage existing practices where appropriate. This could help minimize the level of effort needed.
4. All SDs should ensure that they can demonstrate (with supporting documentation) that the sampling guidelines for self-assessment issued by the OCG have been followed. A detailed procedure on how to perform sampling is provided on the guidance tab of the self-assessment tools. Additional guidance on sampling can also be found in the Guide to Delegating and Applying Spending and Financial Authorities and on the Statistics Canada website (specifically, section 3.2 “Sampling” in the document entitled Statistics: Power from Data!).