Public Services and Procurement Canada
Report on the key compliance attributes of Public Services and Procurement Canada’s Internal Audit Function, 2021 to 2022

April 1, 2021 to March 31, 2022
Office of the Chief Audit, Evaluation, and Risk Executive

Report on the key compliance attributes of Public Services and Procurement Canada’s
Internal Audit Function, 2021 to 2022 (PDF, 412KB)

On this page

Introduction

The Policy on Internal Audit (hereon referred to as the Policy) and its associated Directive on Internal Audit (directive) came into effect on April 1, 2017. The objective of the Policy is to ensure that the oversight of public resources throughout the federal public administration is informed by a professional and objective internal audit function that is independent of departmental management.

The Policy sets out the responsibilities for Deputy Heads of large and small departments related to internal audit, which contributes to sound risk management, control and governance processes, as well as the role and responsibilities of the Comptroller General of Canada as the head of the function government-wide.

Deputy Heads are responsible for ensuring that internal audit in the department is carried out in accordance with the Institute of Internal Auditors International Professional Practices Framework (Standards) unless the framework is in conflict with the Treasury Board Policy or its related directive; if there is a conflict, the Policy or directive will prevail.

The Directive on Internal Audit outlines specific requirements of the Chief Audit Executive (CAE) and the associated mandatory procedures for internal auditing in the Government of Canada in subsection A.2.2.3. These procedures include public reporting requirements as prescribed by the Comptroller General of Canada including performance results for the internal audit function and a list of planned audit engagements for the coming fiscal year. It is important that the public is aware that heads of government organizations are receiving assurance that activities are managed in a way that demonstrates responsible stewardship.

In order to comply with the requirement to publicly report on the performance of the internal audit function, the Comptroller General issued a technical bulletin that outlined, among other things, key compliance attributes. These attributes were selected in order to provide pertinent information regarding the professionalism, performance and impact of the internal audit function within the department. The key attributes of compliance with the Policy and Standards are:

It should be noted that these are not performance measures and no targets are attached. Under the Policy, the Comptroller General has the authority to amend these attributes, should there be changes in the internal audit environment and/or due to the evolving maturity of the internal audit function.

Key compliance attributes of Internal Audit

In accordance with the Policy and the technical bulletin issued by the Office of the Comptroller General (OCG), Public Services and Procurement Canada’s (PSPC) Office of the Chief Audit, Evaluation and Risk Executive (OCAERE) presents the following key compliance attributes for the internal audit function for the reporting period April 1, 2021 to March 31, 2022. The compliance attributes noted below pertain to staff professional certifications and designations, the quality assurance and improvement program, and execution of the audit plan.

1. Professional certifications and designations

Professionalism of the internal audit function is referenced several times in the applicable policy instruments. In accordance with the Policy, the OCG is responsible for determining the professional requirements for internal audit in the federal public administration. The OCG relies on the certification and training for the profession provided by the Institute of Internal Auditors. Within departments with internal audit functions, the CAE is responsible for ensuring that internal auditors have the appropriate qualifications, skills, and opportunities to maintain and develop their internal auditing competencies, and the Deputy Head is responsible for supporting this professional development and certification. The professional certifications and designations for staff employed in PSPC’s OCAERE are as follows:

Table 1: Compliance attributes in fiscal year 2021 to 2022
Key compliance attribute Fiscal year 2021 to 2022

1(a) Number of internal audit employees table 1 note 1:

  • assurance and consulting services: 16 employees
  • Quality Assessment and Process Improvement (QAPI): 4 employees
 20
1(b) Percent of staff with an internal audit or accounting designation: Certified Internal Auditor (CIA), Chartered Professional Accountant (CPA) 60%
1(c) Percent of staff with an internal audit or accounting designation (CIA, CPA) in progress 15%
1(d) Percent of staff holding other designations: Certified Government Auditing Profession (CGAP), Certified Information Systems Auditor (CISA), etc. 30%

2. Quality assurance and improvement program

In accordance with the International Standards for the Professional Practice of Internal Auditing, the Chief Audit Executive must develop and maintain a quality assurance and improvement program (QAIP) that covers all aspects of the internal audit activity (standard 1300) and must include both internal and external assessments (standard 1310). The status of the OCAERE’s QAIP is as follows:

Table 2: Responses to key compliance attributes
Key compliance attribute Response
2(a) Date of last comprehensive briefing to the Departmental Audit Committee on the internal processes, tools, and information considered necessary to evaluate conformance with the Institute of Internal Auditors (IIA) Code of Ethics and the Standards and the results of the QAPI.

In 2021 to 2022, the QAPI function of the OCAERE conducted an internal self-assessment of internal audit policies and procedures to ensure conformance with IIA standards. The assessment found the following areas of improvement:

  • enhancing the Risk-Based Audit Plan planning
  • development of a training plan for internal audit staff
  • strengthening internal audit procedures and tools
  • strengthening data analytics approach
  • strengthening relationships and communications with stakeholders
  • strengthening written audit reporting such as to comply with Treasury Board of Canada Secretariat accessibility guidelines

The results of the QAIP periodic self-assessment were presented to the Departmental Audit Committee on March 29 to 30, 2022.
2(b) Date of last external assessment. The OCAERE’s last external assessment was tabled at the January 28, 2020 Departmental Audit Committee meeting.

3. Internal Audit Plan and related information

In order to demonstrate that management is acting on recommendations made by internal audit to improve departmental practices, public reporting requirements, as prescribed by the Comptroller General of Canada, requires internal audit functions to publish a list of completed engagements including the date by which all management actions were to have been implemented and the status of that implementation. This information is to be updated regularly and remain on the list of engagements for 6 months after the management action plan has been fully implemented. Internal audit functions also list all engagements scheduled for the coming fiscal year and their status in the spirit of demonstrating open and transparent information on the government’s intentions to conduct engagements in areas of higher risk to departments and to demonstrate responsible stewardship to Canadians.

Table 3: Engagement titles and statuses
Engagement title Engagement status Report approved date Report published date Original planned Management Action Plan completion date Implementation status of the Management Action Plan table 3 note 1
Audit of RP-1 and RP-2 Contract Oversight Control Framework (Phase 1: Expenditures) Completed October 30, 2018 March 11, 2019 October 2019 89%
RP-2 Contract Oversight Control Framework (Phase 2: Revenues) Completed October 30, 2018 March 11, 2019 March 2019 100%
Office of the Comptroller General Horizontal Audit of Business Continuity Planning (BCP) Completed October 30, 2017 August 2018 March 2019 53%
*** table 3 note 2 Completed October 30, 2018 Not applicable (N/A) March 2019 60%
Review of Staffing Completed June 11, 2019 November 16, 2020 September 2020 50%
Audit of Information Technology (IT) Security Completed January 28, 2020 October 16, 2020 March 2021 23%
Audit of Staffing table 3 note 3 Completed February 4, 2020 October 16, 2020 September 2021 57%
Audit of the Management of Engineering Assets Completed June 1, 2020 October 16, 2020 September 2020 44%
Audit of Land, Aerospace, and Marine Procurement Completed October 13, 2020 March 21, 2021 February 26, 2021 100%
Preliminary Survey of Human Resources (HR) to Pay Risk Management Completed September 28, 2020 N/A September 2020 100%
Targeted Review of the Phased Bid Compliance Process Completed October 8, 2020 March 22, 2021 September 2020 80%
Health Check of Performance Measurement of Electronic Procurement Solution Project Completed November 10, 2020 N/A April 2021 To be assessed
BDO Independent Third Party Review of PSPC E-Procurement Solution (EPS) Project Review: Frozen Allotment Gate #1 Completed November 10, 2020 N/A July 2023 50%
Audit of Peoplesoft 9.2 Upgrade Stakeholder Engagement (Phase 1) Completed December 15, 2020 January 25, 2022 April 2021 100%
BDO Independent Third Party Review of PSPC EPS Project Review: Frozen Allotment Gate #2 Completed March 9, 2021 N/A September 2021 20%
Health Check of Energy Services Acquisition Program Completed February 2, 2021 N/A September 2021 54%
Health Check of the EPS: Project Management Framework Completed October 26, 2020 N/A November 2020 40%
Audit of Peoplesoft 9.2: Upgrade Stakeholder Engagement and Management Action Plan (MAP) Follow-up (Phase 2) Completed May 12, 2021 January 25, 2022 June 2021 100%
Audit of Peoplesoft 9.2: Upgrade Stakeholder Engagement and MAP Follow-up (Phase 3) Completed August 4, 2021 January 25, 2022 No MAP issued N/A
Review of the Payroll Validation Process in the PeopleSoft 9.2 Upgrade Project Completed May 12, 2021 N/A No MAP issued N/A
Industrial Security Systems Transformation (ISST) Completed December 16, 2020 N/A March 2022 25%
Follow-up to the Audit of IT Security Completed December 20, 2021 May 2022 March 2025 0%
Audit of the Charging model Completed December 20, 2021 May 2022 November 2022 0%
Lessons Learned from PSPC’s Response to COVID-19 Completed September 13, 2021 N/A No MAP issued N/A
Health Check of EPS Organizational Change Management and Readiness In progress To be determined (TBD) N/A TBD TBD
Laboratories Canada: Joint Advisory on Governance—Emerging Issues and Risks In progress TBD N/A N/A N/A
Accrual Budgeting In progress TBD TBD TBD TBD
Clinical Trial Material Facility (CTMF) In progress TBD TBD N/A N/A
Vaccine attestation In progress TBD TBD TBD TBD
Health check of Government of Canada Trusted Platform’s (GCTP) governance In progress TBD N/A TBD TBD
Health check on change management for the EPS: Phase II In progress TBD N/A TBD TBD
Health Check of ISST Organizational Change Management and Readiness Planned TBD N/A TBD TBD
Independent Third-party Review (ITPR) ISST Milestones 7 to 9 Planned TBD N/A TBD TBD
Health Check of the ISST’s Security Controls Planned TBD N/A TBD TBD
Health Check of GCTP’s Security Controls Phase I Planned TBD N/A TBD TBD
Health check of GCTP’s security controls phase II Planned TBD N/A TBD TBD
EPS ITPR Gate #3 frozen allotment (Milestone 6 to 8) Planned TBD N/A TBD TBD

4. Usefulness

In order to determine if the internal audit function is credible and adding value in support of the mandate and strategic objectives of the organization, internal audit functions are required to conduct post-audit surveys with senior management of the areas that have been audited.

Table 4: Key compliance attribute and response
Key compliance attribute Response
4. Average overall usefulness rating from respondents of areas audited. 100% of respondents rated the overall usefulness of audits as "Agree" to "Strongly Agree."
Date modified: