Public Services and Procurement Canada
Annex A: Assessment of internal controls over financial management for year ended March 31, 2022

1. Introduction

This annex provides a summary of measures taken by Public Services and Procurement Canada (PSPC) to maintain an effective system of internal control over financial management (ICFM), assessment results and related action plans.

Detailed information on the department’s authority, mandate and program activities can be found in its most recent Departmental plan and Departmental results report.

2. Departmental system of internal control over financial management

2.1 Internal control management

PSPC has a well–established governance and accountability structure to support departmental assessment efforts and oversight of its system of internal control. This structure is formalized in the Departmental Internal Control Framework, which includes:

• organizational accountability and oversight structures to support sound financial management, including roles and responsibilities of departmental senior managers in their areas of responsibility for internal control management
• semi–annual monitoring of, and regular updates on, internal control management, as well as provision by the Internal Control Directorate of related internal control assessment results and action plans to the Departmental Audit Committee (DAC)
• values and ethics, which provide educational and awareness programs and have developed a departmental code of conduct
• leveraging the work of audit and advisory services for internal audits on the effectiveness of risk management, control and governance processes, where appropriate
• risk–based management practices

The DAC provides advice to the deputy head on the adequacy and functioning of the department’s risk management, control and governance frameworks and processes. It meets at least 4 times a year, and is comprised of the deputy minister, the associate deputy minister and 4 members external to the federal public administration, 1 of whom is the chair. Its meetings are also attended by the chief financial officer and the chief audit executive.

To provide reasonable assurance that financial controls are in place and operating as intended and adequately, PSPC conducts risk–based assessments, leverages ongoing monitoring programs and conducts specific year-end reviews, including:

• information technology general controls (ITGCs) monitoring, for the financial management system, including feeder systems
• financial advisors reviews of program management budgets and forecasts
• performance management assessments based on the Financial Management Framework
• awareness and monitoring of internal financial control audits and assessments performed by program management
• results of control audits and management accountability framework assessments by the Office of the Comptroller General
• documentation and assessment of internal controls by common service provider entities

These activities help ensure that:

• financial arrangements or contracts are entered into only when sufficient funding is available
• payments for goods and services are made only when the goods and services are received or the conditions of contracts or other arrangements have been satisfied
• payments have been properly authorized

In addition, PSPC leverages results and findings from audits performed by external auditors, including annual financial statement audits of the revolving funds, audits performed by the Office of the Auditor General, and the Office of the Chief Audit, Evaluation and Risk Executive, as input in its assessments of the control environment.

2.2 Service arrangements relevant to financial statements

PSPC relies on other organizations for processing certain transactions that are recorded in its financial statements as follows:

Common service arrangements

PSPC provides common services to other organizations for processing certain transactions that are recorded in their financial statements. In addition, PSPC relies on services provided by other organizations:

• the Treasury Board of Canada Secretariat (TBS) provides services related to public sector insurance for employees of PSPC, and centrally administers payment of the employer’s share of contributions toward statutory employee benefit plans (in other words, the Public Service Pension Plan, Employment Insurance Plan, Canada Pension Plan, Québec Pension Plan and Public Service Supplementary Death Benefit Plan) on behalf of PSPC
• the Department of Justice Canada provides legal services to PSPC
• Shared Services Canada provides information technology infrastructure services to PSPC in the areas of data centre and network services (the scope and responsibilities are addressed in the interdepartmental arrangement between Shared Services Canada and PSPC)
• Employment and Social Development Canada provides services of Worker’s Compensation Coverage for employees of PSPC

Readers of this annex may refer to the annexes of the annual consolidated statements of the above–noted organizations for a greater understanding of the systems of internal controls over financial management related to these specific services.

PSPC provides common services in the areas of procurement, federal real property and infrastructure, contract security, translation and interpretation, as well as pay and pension administration to other federal government departments, agencies and public service pensioners. In addition, the Receiver General of Canada provides treasury and banking services and administers several systems on behalf of the Government of Canada, including the Standard Payment System, Payroll System-General Ledger, and Receiver General-General Ledger.

Specific arrangements

PSPC relies on other external service providers for the processing of certain transactions or information that are recorded in its financial statements, as follows:

• PSPC provides facilities management and services through a contract with an external service provider responsible for property and facility management government-wide:
  • it also establishes third-party leases and agreements
  • it provides lease administration and project delivery for all PSPC Crown-owned and leased sites across Canada
  • the external service provider is responsible for their own internal controls to help ensure compliance
• PSPC provides Shared Services Canada with an external service provider that is the SAP based financial management system platform to capture and report all financial transactions
• external service providers, pursuant to contracts with the Government of Canada, support the administration of various information technology systems
  • such as for travel services, pay services and the relocation program for federal public service employees

3. Departmental assessment results for the fiscal year ending March 31, 2022

PSPC’s ongoing financial control monitoring program assesses, on a multi-year rotational basis, the state of key financial control processes performed by PSPC’s Finance Branch, and the financial control activities conducted directly by branches delivering services and programs. This combined approach leads to a more robust and holistic view of the department’s overall financial control environment, and further supports assertions made in the Statement of Management Responsibility.

As in previous years, for this fiscal year ending March 31, 2022, we have assessed the impact of the COVID-19 pandemic on the department’s internal control over financial management, and amounts recognized and/or disclosed in its consolidated financial statements. We have not identified significant deficiencies in the operation of the internal controls which could have a material impact on PSPC’s consolidated departmental financial statements.

For the mature processes and sub–processes, testing is conducted on a multi-year rotational cycle. Annually, a risk assessment of the business processes for key financial reporting controls is performed, which indicates if there is a residual risk of material misstatement. This risk–based approach supports PSPC’s decisions as to the scope and extent of operational effectiveness testing required.

In the current fiscal year, efforts were concentrated on sub-processes which were assessed as medium or high risk for material misstatements, prior to controls or mitigation strategies.

As part of ongoing monitoring, sub–processes documentation is reviewed, and design effectiveness and operations effectiveness testing is conducted on selected key controls. In addition to the ongoing monitoring of the financial controls processes, and operating effectiveness testing, corroborative procedures are performed in all of the control environments to obtain sufficient reliable evidence to support PSPC’s assertion that the financial control environment in place is sound.

3.1 Mature business processes

The following table summarizes the progress of the ongoing monitoring activities performed as part of the internal control review of mature business processes, for the fiscal year ending March 31, 2022. This review is consistent with the previous year’s rotational plan.

Summary of recommended improvements 1

As a result of design and operating effectiveness testing of key controls for mature business processes reviewed, no significant control deficiency, which would expose the department to an elevated risk of material misstatement of its financial statements, has been identified. There are, however, areas that could be strengthened, for which additional actions will be taken and monitored over the next fiscal year for improvement:

• roles and responsibilities need to be clearly defined, documented, communicated and implemented to ensure accountability, and adherence to the established processes and procedures
• training and communication of standardized procedures are needed to support responsibility center managers, and staff, in performing their work more effectively and efficiently
• communications with stakeholders should be improved and emphasized
• documentation and evidence of the performance of certain key controls need to be improved to strengthen the audit trail
• access, security and change management information technology general controls need to be strengthened to ensure safeguarding of government information
• controls related to large or complex data sets need to be enhanced to ensure accuracy, completeness and integrity of data
• monitoring controls could be improved to better support management

3.2 New business processes

As required by the requirements of the April 1, 2017 Treasury Board Policy on Financial Management, PSPC has several business processes which are significant to its financial management or that of other departments for which PSPC provides common services, as follows.

Summary of recommended improvements 2

As a result of the assessment of the new business processes, controls and documentation relating to financial data will be strengthened to ensure accuracy, completeness and integrity of financial information. Additional actions will be taken and monitored over the next fiscal year for improvement.

4. Departmental action plan for next fiscal year and subsequent years

4.1 Ongoing internal control monitoring for mature business processes

For the fiscal year ending March 31, 2023, multi-year rotational reviews of mature internal control processes will continue, along with ongoing improvement of internal controls assessment methodology for enhanced effectiveness. The approach leverages risk–based assessments to identify best mitigation strategies, and internal control testing techniques for greater cost efficiency and assurance.

Furthermore, remediation strategies identified in management action plans for the fiscal years ending March 31 2020 and March 31, 2021 have been largely addressed, but will continue to be monitored with March 31, 2022 recommendations.

4.2 Other significant financial management processes

The plan for the assessment of the other significant financial management processes will be determined after a risk–based assessment is completed and is as follows:

4.3 Common service processes

As a common service provider of pay, pension, treasury, banking, procurement, translation and interpretation, federal real property and infrastructure and security in contracting, PSPC completes annually a risk–based assessment of the internal controls related to some of these services. The results of the assessment of certain sub–processes within the Pay Administration Services are provided in sections 3.1 and 3.2.

The planned annual assessment of internal controls over common services for the next and subsequent years is detailed below.