Audit of Internal Control over Financial Reporting

Office of the Chief Audit Executive

Table of Contents

• 1.0  Assurance Statement
• 2.0  Executive Summary
  • 2.1  Background and Audit Objective
  • 2.2  Overall Conclusion and Findings
• 3.0  Introduction
  • 3.1  Background
  • 3.2  Audit Objective and Scope
  • 3.3  Audit Criteria
  • 3.4  Approach and Methodology
• 4.0  Findings and Recommendations
  • 4.1  Follow-up on the Action Plan of the Audit Readiness Assessment
  • 4.2  Management Variance Reporting Process
  • 4.3  Lack of Documentation
  • 4.4  Lack of Review and Approval and Inadequate Segregation of Duties
  • 4.5  Course Fees
• 5.0  Other Related Observations and Recommendations
  • 5.1  Overall Effectiveness of Internal Control over Financial Reporting
  • 5.2  Learner Registration Management System
• 6.0  Overall Conclusion
• Appendix A  Recommendations, Management Response and Action Plan
• Appendix B  Acronyms

1.0 Assurance Statement

The Office of the Chief Audit Executive (OCAE) of the Canada School of Public Service (the Canada School) has completed the Audit of Internal Control over Financial Reporting. The objective of the audit was to provide assurance of the existence and effectiveness of the internal control activities over financial reporting. The audit approach and methodology followed the International Standards for the Professional Practice of Internal Auditing as defined by the Institute of Internal Auditors and the Internal Auditing Standards for the Government of Canada as required under the Treasury Board's Policy on Internal Audit.

For the fiscal year ending March 31, 2009 (the period under audit), the OCAE concludes with a high level of assurance that, with a few exceptions, internal control activities over financial reporting at the entity level and for the five business processes (revenues, payroll expenditures, other operating expenditures, capital assets, and financial closing and reporting) existed and were generally operating effectively. Where they were not, deficiencies were related primarily to a lack of documentation, a lack of review and approval, and inadequate segregation of duties.

The Canada School should be ready to sustain an efficient controls-reliant audit of its financial statements by an external auditor if the organization:

• implements an action plan to remedy the exceptions noted above;
• audits the design and effectiveness of the internal control activities surrounding the transfer to the financial accounting system's new SAP platform (in operation since April 1, 2009); and
• audits the internal control activities over the compensation and benefits services operations (transferred to the Canada School in June 2009).

In the professional judgment of the Chief Audit Executive, sufficient and appropriate audit procedures have been conducted and evidence has been gathered to support the accuracy of the opinion provided in this report. This opinion is based on a comparison of the conditions at the time of the audit against pre-established audit criteria. The opinion is only applicable to the entity examined and for the scope and time period covered by the audit.

2.0 Executive Summary

2.1 Background and Audit Objective

The Audit of Internal Control over Financial Reporting is an assurance engagement that was part of the approved Canada School of Public Service Multi-year Risk-Based Audit Plan 2008-2009 to 2010-2011. The OCAE of the Canada School conducted the audit engagement.

The objective of the audit was to provide assurance that internal control activities over financial reporting existed, and that they were operating effectively as intended.

In 2007, the Canada School's management elected to undergo a Financial Statements Audit Readiness Assessment. This decision went beyond the government's expectations of an organization the size of the Canada School. The two main goals of this assessment were to strengthen the Canada School's internal control over financial reporting and position the organization to undergo a controls-reliant audit of its financial statements by an external auditor. An external consulting firm carried out the initial phases of the Audit Readiness Assessment, which included the following activities:

• review of the Canada School's financial statements and elements supporting the financial statements to ensure compliance with accounting policies and standards (Phase 1);
• documentation and assessment of the design effectiveness of the internal controls over financial closing and reporting, the business processes' controls over the revenues, payroll expenditures and other operating expenditures, capital assets, General Computer Controls (GCC) and entity-level controls (Phase 2); and
• audit of the Canada School's Statement of Financial Position as of March 31, 2008 (Phase 3).

After each phase, the consulting firm issued management reports, discussion papers and letters of recommendations. The letters of recommendations to the Canada School specifically addressed the control gaps. More specifically, after the documentation and assessment of the design effectiveness of the internal controls phase the consulting firm reported that once the Canada School implements a remediation/action plan and ensures the operating effectiveness of all key control activities, the organization would be ready to sustain an efficient external audit of its financial statements. Also, an unqualified audit opinion on the Canada School's Statement of financial position as at March 31, 2008 has been rendered by the audit firm in charge of the audit. In response, the Canada School's management prepared remediation/action plans indicating how and when the recommendations would be addressed. The Audit of Internal Control over Financial Reporting is, in fact, another phase and a continuation of the Audit Readiness Assessment the Canada School management decided to embark on in 2007.

2.2 Overall Conclusion and Findings

Phase 2 of the Audit Readiness Assessment found some weaknesses in the design of the internal control activities examined. The audit found that, during the fiscal year ending March 31, 2009, the Canada School made good progress in implementing the action plan that was developed to address the internal control gaps identified by the Audit Readiness Assessment.

For the fiscal year ending March 31, 2009 (the period under audit), the OCAE concludes with a high level of assurance that with a few exceptions, internal control activities over financial reporting at the entity level and for the five business processes (revenues, payroll expenditures, other operating expenditures, capital assets, and financial closing and reporting) existed and were generally operating effectively. Where they were not, deficiencies were related primarily to a lack of documentation, a lack of review and approval, and inadequate segregation of duties.

The Canada School should be ready to sustain an efficient controls-reliant audit of its financial statements by an external auditor if the organization:

• implements an action plan to remedy the exceptions noted above;
• audits the design and effectiveness of the internal control activities surrounding the transfer to the financial accounting system's new SAP platform (in operation since April 1, 2009); and
• audits the internal control activities over the compensation and benefits services operations (transferred to the Canada School in June 2009).

The organization should also be in a position to comply with the Treasury Board's new Policy on Internal Control (effective April 1, 2009), which will require, for the fiscal year ending March 31, 2012, the President and the Chief Financial Officer (CFO) of the Canada School to sign the modified and revised annual Statement of Management Responsibility Including Internal Control Over Financial Reporting.

3.0 Introduction

The Audit of Internal Control over Financial Reporting is an assurance engagement that was part of the approved Canada School of Public Service Multi-year Risk Based Audit Plan 2008–2009 to 2010–2011. The OCAE of the Canada School conducted the audit engagement.

3.1 Background

In 2007, the Canada School's management elected to undergo a Financial Statements Audit Readiness Assessment. This decision went beyond the government's expectations of an organization of the size of the Canada School. The two main goals of this assessment were to strengthen the Canada School's internal control over financial reporting and to position the organization to undergo a controls-reliant audit of its financial statements by an external auditor. An external consulting firm carried out the initial three phases of the Audit Readiness Assessment, which included the following activities:

• review of the Canada School's financial statements and elements supporting them to ensure compliance with accounting policies and standards (Phase 1);
• documentation and assessment of the design of the internal control activities over financial reporting, at the entity level, and for the five business processes (revenues, payroll expenditures, other operating expenditures, capital assets; and financial closing and reporting) and General Computer Controls (GCC) (Phase 2); and
• audit of the Canada School's Statement of Financial Position as of March 31, 2008 (Phase 3) and issuance of an unqualified opinion.

This Audit of Internal Control over Financial Reporting is, in fact, a continuation of the Audit Readiness Assessment.

Finally, a recent event relating to the internal control over financial reporting is the new Treasury Board's Policy on Internal Control (effective April 1, 2009). This policy will require, for the fiscal year ending March 31, 2012, the President and the CFO of the Canada School to sign a modified annual Statement of Management Responsibility, re-titled Statement of Management Responsibility Including Internal Control Over Financial Reporting. The new Statement will continue to preface the Canada School's financial statements, and will include the following:

• acknowledgement of management's responsibility for ensuring that an effective system of internal controls is maintained over financial reporting;
• acknowledgement of the conduct of an annual assessment of the effectiveness of the system of internal controls;
• acknowledgement of the establishment of an action plan; and
• a summary of the results of the assessment and the actions taken in response to issues.

3.2 Audit Objective and Scope

The objective of the audit was to provide assurance that internal control activities over financial reporting existed and that they were operating effectively as intended.

The scope of the audit consisted of testing the existence and the operational effectiveness of the internal control activities over financial reporting identified and documented in Phase 2 of the Audit Readiness Assessment. These activities consisted of entity level controls and controls over the following five business processes:

• revenues
• payroll expenditures
• other operating expenditures
• capital assets
• financial closing and reporting

The audit covered the internal control activities whose design had been judged effective through the walkthroughs conducted during Phase 2 of the Audit Readiness Assessment. It also covered those internal control activities with deficiencies that management had since addressed. The testing period covered the fiscal year ending March 31, 2009. As well, where management had dealt with control deficiencies, audit coverage started at the point where corrective actions began. The examination phase of the audit was conducted between February and August 2009.

The audit did not examine or test the GCC and the internal controls relating to the financial accounting system's SAP platform, since the Canada School had planned to transfer its SAP software platform and service provider from the Treasury Board of Canada Secretariat to the Department of Health Canada as of April 1, 2009. It was therefore decided that the GCC and the internal controls relating to the new SAP platform would not be included in the scope of this audit. The audit of GCC is planned for 2010-2011. Finally, the audit did not examine or test controls relating to compensation and benefits services, which were transferred from Public Works and Government Canada (PWGSC) to the Canada School in June 2009.

3.3 Audit Criteria

The audit sought to verify that internal control activities over financial reporting (as documented and assessed in Phase 2 of the Audit Readiness Assessment) exist and are operating as intended.

3.4 Approach and Methodology

The audit approach and methodology followed the International Standards for the Professional Practice of Internal Auditing as defined by the Institute of Internal Auditors and the Internal Auditing Standards for the Government of Canada as required under the Treasury Board's Policy on Internal Audit. These standards require that the audit be planned and performed in such a way as to obtain reasonable assurance that the audit objective is achieved. The audit was conducted in accordance with detailed audit programs that tested each of the internal control activities for each of the five business processes and at the entity level in operation during the fiscal year ending March 31, 2009.

The audit approach included, but was not limited to, the following steps:

• reviewing the documentation prepared by the external consulting firm that worked on the initial three phases of the Audit Readiness Assessment and the action plan developed by Canada School management in response to the internal control gaps identified;
• performing detailed audit tests on the internal control activities to assess their operational effectiveness at the entity level and for each of the five business processes:
  • revenues
  • payroll expenditures
  • other operating expenditures
  • capital assets
  • financial closing and reporting
• examining the following documents:
  • 40 Memoranda of Understanding for courses and their related 121 invoices (revenues business process);
  • 25 individual course invoices generated and managed by the Learner Registration Management (LRM) system (revenues business process);
  • 67 individual pay action forms (payroll expenditures business process);
  • 25 individual invoices (other operating expenditures business process); and
  • individual invoices or journal vouchers (capital assets business process);
• performing detailed audit tests on three monthly internal control activities, such as reconciliations, and on all of the annual internal control activities applicable to each of the business processes.

4.0 Findings and Recommendations

4.1 Follow-up on the Action Plan of the Audit Readiness Assessment

OCAE found that the Canada School had developed an action plan to address the weaknesses identified in phase 2 of the Audit Readiness Assessment, and that the organization had generally made good progress in dealing with the gaps in internal control. However, OCAE found that the documentation describing new procedures - i.e. corrective action to address the internal control weaknesses - had not been updated. Unless any new procedures are clearly documented, there will be a risk that staff will carry out incorrect and out-of-date processes.

Recommendation #1:

OCAE recommends that the CFO develop an action plan to update the documentation of business processes to reflect the changes to the internal control activities resulting from the action plan following the Audit Readiness Assessment. (High Priority)

4.2 Management Variance Reporting Process

The Management Variance Reporting (MVR) process is a critical, overarching internal control activity. It plays a key oversight role and affects the business processes for the Canada School's revenues, payroll, and other operating expenditures. This audit raised a number of issues with respect to the MVR process. Collectively, these issues affect, among other things, the accuracy and timeliness of variance reporting.

At the time of the audit, OCAE noted that the Corporate Services branch was developing a new tool which will automate the reporting of the MVR process. This new tool is planned to be implemented in the next round of reporting (Fall 2009). If the Canada School builds rigor into the improved MVR process, this will be an important step towards both strengthening the organization's internal control and complying with the Treasury Board's Policy on Internal Control.

Recommendation #2:

OCAE recommends that the CFO continue to develop and implem

4.3 Lack of Documentation

For some of the internal control activities tested, supporting documentation was not available. For example, documentation was lacking for the reconciliation of financial data of two key systems - the LRM system and the Salary Management System (SMS) - to the financial accounting system SAP.

For example, the LRM system is a registry of students enrolled in various courses. It generates data on courses attended by students, which is necessary to prepare the invoices to bill departments for training. These invoices represent the Canada School's revenues. SAP, the organization's financial accounting system, is used to prepare annual financial statements. Accordingly, the financial data in the two systems must be reconciled in order to confirm that all the courses attended have been invoiced and related revenues accounted for.

OCAE found that the process for reconciling the data of the LRM system and the SAP system had not been documented, even though it is a common internal control activity. If documentation is missing there can be no reasonable assurance that staff have reconciled the data between the two systems, that all departments have been billed for all of the courses attended by their employees, and consequently that all the Canada School's revenues are accounted for in its financial statements.

Recommendation #3:

OCAE recommends that the CFO, in collaboration with the Registrar, take the following corrective actions:

1. document detailed working procedures on key internal control activities easily accessible to all staff in an organized and complete document or manual type;
2. develop standardized tools/aids to be used by staff and management in order for them to produce appropriate evidence of the internal control activity performed; and
3. provide training to all implicated staff (High Priority)

4.4 Lack of Review and Approval and Inadequate Segregation of Duties

Review and approval processes and segregation of duties are, in effect, internal control activities and are part of the larger internal control framework.

Review and approval. For internal control to work effectively, organizations must have a process for certain staff to review and approve the work of others. The purpose of this process is to prevent and detect errors and inconsistencies and to reduce the risk of fraud. If review and approval processes are deficient, the effectiveness of other internal control activities is compromised, and risk increases.

In examining the internal control activities across the five business processes, OCAE found instances of inadequate review and approval procedures. Some were more critical for internal control purposes than others; the lack of review and approval over changes to the master files of vendors and customers in SAP is an example of a more critical inadequacy.

Segregation of duties. This internal control is designed to reduce the risks that may arise if employees perform incompatible tasks. An example of incompatible tasks is an employee both entering journal entries into a financial system and approving the transaction. OCAE found several instances of employees performing incompatible tasks, which creates the risk that a wide range of errors - such as incomplete or improperly recorded or presented transactions - could occur. All of these errors could ultimately affect the financial statements.

Recommendation #4:

OCAE recommends that the CFO establish procedures, including appropriate monitoring, to ensure that master files are subject to periodic review and approval and that accounting staff do not perform incompatible tasks. (High Priority)

4.5 Course Fees

An approved framework for setting fees is an accepted, common business practice for organizations that charge fees for providing a service. At the time of the audit, no official fee schedule or framework approved by senior management existed at the Canada School. As a result, there was an increased risk that the Canada School had charged some clients more than others for the same or equivalent courses. OCAE also noted in some instances that documentation to support any differences in fees charged (e.g., a discount for a large number of students) or to support a decision to cancel a course was not available.

OCAE noted, however, that the Canada School has since addressed this issue in the fiscal year ending March 31, 2010. In fact, the Board of Governors endorsed a Pricing Framework and a discounting approach. As well, the Management Committee and the Sub-Committee to Management Committee sanctioned a Policy on Memorandum of Understanding and related documents.

5.0 Other Related Observations and Recommendations

5.1 Overall Effectiveness of Internal Control over Financial Reporting

Several automated internal control activities in the financial accounting system SAP relate to the Canada School's five business processes. These have not yet been documented to reflect the change to the financial accounting system's new SAP platform service provider as of April 1, 2009.

Similarly, OCAE also noted that the internal control activities for the payroll expenditures business process have not been updated to reflect the June 2009 transfer of the compensation and benefits services from PWGSC to the Canada School.

Without complete documentation of both the key automated and manual internal control activities and the steps taken to deal with existing internal control gaps, it is not possible to fully assess the effectiveness of internal controls. Moreover, without complete documentation on these new systems and processes, there might be new weaknesses in the design and the effectiveness of internal control activities. There is therefore an increased risk that Canada School management may make inappropriate decisions based on an inaccurate picture of the effectiveness of the internal control framework.

As noted earlier, GCC were not part of the scope of this audit. GCC have an encompassing and overall effect on any organization's internal control related to its computerized systems. In the case of the Canada School, the financial accounting system SAP, the LRM system [which will be replaced by the new Integrated Learning Management System (I-LMS)] and the SMS are all computerized systems that are directly linked to the overall internal control over financial reporting. Canada School management should be aware that until the operational effectiveness of the organization's GCC has been tested, there is a risk that the Canada School will not be ready for a controls-reliant audit of its financial statements.

Recommendation #5:

OCAE recommends that the CFO develop an action plan to:

1. update the documentation of business processes to reflect the change to the new SAP platform service provider, as well as any other new or revised internal control activities implemented after April 1, 2009; and
2. test the operating effectiveness of any new or updated internal control activities once they have been documented and implemented. (High Priority)

Recommendation #6:

OCAE recommends that the CFO, in collaboration with the Director General of Human Resources, develop an action plan to:

1. update the documentation of business processes to reflect the transfer of compensation and benefits services from PWGSC to the Canada School; and
2. test the operating effectiveness of the related internal control activities once they have been documented and implemented. (High Priority)

5.2 Learner Registration Management System

OCAE noted that the Canada School is currently developing the new I-LMS to replace the current LRM system, which has been in use for some time. This audit and phase 2 of the Audit Readiness Assessment, however, identified internal control weaknesses in the operations surrounding the LRM system, such as inadequate segregation of duties and lack of review of the individuals having access to it.

Call centre agents are responsible for inputting information on course participants into the LRM system. They can also change course pricing and update the participant's attendance status. They are also capable, however, of updating the LRM system "status" used for approving cancellations and adjustments. These are incompatible tasks.

OCAE noted that there is no process to periodically review the list of individuals with active user access to the LRM system. The list of individuals with access to the LRM system obtained by OCAE contained over 700 names. OCAE judges this number of individuals having access to the LRM system as being excessive, considering that the Canada School's 2008-2009 Report on Plans and Priorities reported a planned total of 940 Full-time Equivalent employees for the entire organization.

Recommendation #7:

OCAE recommends that the Registrar ensure that:

1. internal control functionalities are incorporated in the new I-LMS in order that an appropriate segregation of duties for individuals having access to the system be respected; and
2. procedures be developed and implemented in order to review, on a periodic basis, the users' access rights to the I-LMS in the production environment. (High Priority)

6.0 Overall Conclusion

Phase 2 of the Audit Readiness Assessment found some weaknesses in the design of the internal control activities that were examined. This audit found that, during the fiscal year ending March 31, 2009, the Canada School made good progress in implementing the action plan that was developed to address the internal control gaps identified by the Audit Readiness Assessment.

For the fiscal year ending March 31, 2009 (the period under audit), the OCAE concludes with a high level of assurance that, with a few exceptions, internal control activities over financial reporting at the entity level and for the five business processes (revenues, payroll expenditures, other operating expenditures, capital assets, and financial closing and reporting) existed and were generally operating effectively. Where they were not, deficiencies were related primarily to a lack of documentation, a lack of review and approval and inadequate segregation of duties.

The Canada School should be ready to sustain an efficient controls-reliant audit of its financial statements by an external auditor if the organization:

• implements an action plan to remedy the exceptions noted above;
• audits the operational effectiveness of the design and effectiveness of the internal control activities surrounding the transfer to the financial accounting system's new SAP platform (in operation since April 1, 2009); and
• audits the internal control activities over the compensation and benefits services operations (transferred to the Canada School in June 2009).

The organization should also be in a position to comply with the Treasury Board's new Policy on Internal Control (effective April 1, 2009), which will require, for the fiscal year ending March 31, 2012, the President and the CFO of the Canada School to sign the modified and revised annual Statement of Management Responsibility Including Internal Control Over Financial Reporting.

Appendix A - Recommendations, Management Response and Action Plan

Audit of Internal Control over Financial Reporting (as of 4 December 2009)

Appendix B - Acronyms

Contact us Subscribe to the GCLearning newsletter

---

Features

Embedding Risk Management into Decision-Making (TRN5-E44)

(November 18, 2024)

2024 Government of Canada Workplace Charitable Campaign: Quiz for a Cause – DM Trivia (WMT2-E16)

(November 28, 2024)

Practical Artificial Intelligence Series: Reimagining Government Communications and Access to Services (DDN1-E11)

(December 5, 2024)

Follow:

• Twitter
• YouTube
• LinkedIn
• GCLearning newsletter
• RSS