Audit of the Monitoring and Oversight of the Contribution Agreements Process

Documentation and communication of roles and responsibilities

The audit team reviewed monitoring process documentation and conducted process walkthroughs with regional representatives from the 4 sampled regions (Manitoba, Saskatchewan, Quebec, British Columbia). It was found that the documented roles and responsibilities for monitoring were aligned to the expected steps and actions for reviewing recipient reports and recommending corrective actions as per ISC Directives 121 and 123. Specifically, regional monitoring plans and processes (e.g., procedure manuals and process flows) were found to include assigned roles and responsibilities for completing key actions such as:

• Receiving and reviewing recipient reports within target timeframes;
• Following up on overdue reports, including early warning of potential funding sanctions if reports cannot be provided by a certain date;
• Performing initial and detailed reviews of recipient reports;
• Concluding on recipient compliance after detailed review of reports;
• Taking corrective actions where recipients are non-compliant;
• Following up on corrective actions through communicating concerns to recipient, establishing follow up plan and considering funding intervention if concerns cannot be addressed;
• Considering halting funds under certain authorized conditions (e.g., insufficient management control framework, reporting unobtainable);
• Engaging default prevention and management process where applicable, including default risk assessment, remediation strategies and follow up on remediation progress; and
• Escalation of any management override for recommended corrective actions.

As a result, ISC regional employees were provided with adequate guidance to fulfill their monitoring roles and responsibilities.

Systems and tools to support employees in carrying out responsibilities

The key system in place to support monitoring and oversight of contribution agreements is GCIMS. As part of file testing, the audit team requested and reviewed documentation related to a sample of contribution agreements across the 4 regions. File testing showed that financial and non-financial reporting requirements were accurately entered into GCIMS for each contribution agreement.

Furthermore, to track the status of recipient reporting against these requirements, regional offices updated GCIMS on an ongoing basis to identify when reports are due and/or how many days they are overdue, the status of the review and the review’s conclusion on recipient compliance to reporting requirements. It was found that financial reports were being reviewed by regional office employees in a timely manner consistent with the target timeframes outlined in Directive 121.

The Department has implemented a General Assessment (GA) tool which supports the management of funding agreements. The GA tool is completed by departmental staff and then shared and discussed with recipients. The General Assessment provides an annual snapshot of the funding recipient's past performance. It also identifies strengths and emerging risks that may have an impact on how the Department manages its transfer payments to recipients. The GA tool informs monitoring efforts and the transfer payment approach based on risk.

The Department also has a Default Assessment tool that is used by the Funding Service Officer to complete a default assessment when requirements are not met by a recipient. The completion of the Default Assessment Tool helps assess if an actual default has occurred or not. If a default does exist, the Default Assessment tool helps identify the level of risk of the default and aids the Department in deciding the appropriate Default Management action.

The audit found that the system and tools were being used.

Separation of duties

Separation of duties is a basic building block of risk management and internal controls. One of the primary reasons an organization or department implements separation of duties is to prevent a conflict of interest.

Financial and non-financial reports provide evidence that funds being used as agreed and that finances are being soundly managed so appropriate review is a key element of oversight and monitoring. It was found during walkthroughs and file testing that regional offices have separated duties for the review and the approval of the review for the reports received from the recipients. Specifically, the following separation of duties was observed:

• Program Officers perform initial reviews of recipient reports and maintain working relationship with recipients through check-ins and follow ups on progress;
• Managers perform a challenge function on Program Officer’s monitoring results; and
• Directors sign off on the recipient compliance conclusion.

Upon completion of sampled file testing, the audit team noted that the Program Officer assigned to the file performed reviews of provided reports with a secondary review of results being conducted by the Manager and sign-off at the Director level. These workflows and supporting audit trails were clearly documented in GCIMS.

Separation of duties helps ensure that reviewers reached fair and reasonable decisions on recipient compliance, partially reducing the risk of a lack of diligence due to conflict of interest.

Conflict of interest (COI) procedures and guidance

In addition to the implementation of separation of duties, well understood supporting procedures and guidelines are needed to enhance risk mitigation. Regional offices were not able to provide specific procedures and guidelines used to manage conflict of interest (COI). Employees are required to report COIs, and this is especially important since the team noted that limited controls exist to reinforce conflict of interest reporting. For example, the audit team did not observe controls in place to ensure periodic conflict of interest checks and/or training and awareness on how to manage conflict of interest when monitoring recipients.

In addition to not observing specific COI guidance, the audit team also was not able to observe evidence of any instances where a COI was reported in the 66 files that were tested. There is a risk that COI may not be actively considered and mitigated when regional employees monitor recipients. This may be due to the weakness in formal procedures and the limited controls in place to ensure that potential conflicts of interest are identified and mitigated.

Departmental initiatives to address COI

A Fraud Risk Assessment was conducted for ISC in May 2021 which presented an analysis of the Department’s vulnerability to specific types of fraud scenarios. One of the fraud scenarios identified was:

An employee involved in the funding process, fails to disclose an actual, potential, or perceived conflict of interest with a funding recipient, resulting in an intentional increased benefit to be provided. Additional funding benefits relatives.

With regard to this fraud scenario, the following recommendations were made in the Fraud Risk Assessment to address the identified control gaps:

1. Requiring all employees working in high-risk sectors to sign an annual compliance declaration affirming they are aware of the COI Policy, their obligations and expected behaviors and to attest that they did not have any conflict of interest (real, perceived, potential) since their last annual declaration;
2. Providing fraud awareness training with coverage of COI to employees upon hire and periodically (e.g., annually);
3. Assessing and reporting any suspected employee risks related to the fraud triangle model (i.e., perceived financial need, perceived opportunity, rationalization);
4. Increasing the accessibility of the Department’s Policies and Procedures by making them available in one central location on the intranet;
5. Requiring employees to acknowledge, on an annual basis, their understanding of their requirements under the Code of Conduct and the Values and Ethics;
6. Providing periodic communications to employees of both their obligation to report suspicions of fraud and wrongdoing and the respective reporting process; and
7. Issuing periodic reminders to Delegated Authorities of their responsibilities when signing off on S.34 of the Financial Administration Act and the consequences if they do not perform the required review procedures prior to approving payment.

A response to these recommendations in the Fraud Risk Assessment was developed by CFRDO and other sectors responsible for the recommendations. At the time of the audit, the actions identified in that response had been partially implemented.

The lack of an annual COI compliance declaration and awareness training led to the Department not having ongoing assurance that COI was being considered and mitigated within the recipient monitoring processes.

Recommendation

1. The Chief Finances, Results and Delivery Officer should complete the implementation of the actions to address the Fraud Risk Assessment recommendations for which they are responsible as the implementation of these actions will also address the weaknesses noted in this audit.

Finding

The audit found that delays in receiving reports is an issue for both financial and non-financial reports.

Prior to examining the data, the assumption was that there would be a large decline in reports received during the pandemic due to the operational challenges associated with the public health guidance as well as ISC’s policy exemptions that provided flexibility for First Nations reporting in order to prevent the potential hardship of halting funds when reports were not received. The data shows that the number of reports received on time declined during the pandemic period by approximately 10% for financial reports and 5% for non-financial reports from 2018-19 to 2020-21. Table 1 and 2 provide the data on reports received on time for the period under review.

As illustrated in table 1 and 2, there are significantly fewer non-financial reports coming in on-time compared to financial reports. This may be partly due to the volume of non-financial reports that are expected by the different programs providing contribution funding to recipients. For example, in 2018-19 there were approximately 29,000 non-financial reports expected in the GCIMS system, compared to approximately 1,500 financial reports expected from recipients. The volume of reports being requested from recipients, coupled with the capacity challenges facing First Nations which the audit team was informed of by regional personnel, resulted in delays in reporting.

The audit team further examined the GCIMS data for the period under review and found that approximately 71% of delayed financial and non-financial reports are received within 180 days of the date due. Approximately 90% of reports are received within a year. Figure 3 below provides a breakdown of the average wait time for delayed reports based on the GCIMS data received.

Text alternative for Figure 3 – Average Wait Times for Delayed Reports

Figure 3 provides the average waiting time for delayed financial and non-financial reports for the period from 2018-19 to 2020-21, divided by day intervals on the x-axis and percentages on the y-axis.

• 0 to 59 days in delay: 39% for financial report and 38% for non-financial report
• 60 to 119 days in delay: 20% for financial report and 20% for non-financial report
• 120 to 179 days in delay: 12% for financial report and 12% for non-financial report
• 180 to 239 days in delay: 9% for financial report and 9% for non-financial report
• 240 to 299 days in delay: 6% for financial report and 6% for non-financial report
• 300 to 359 days in delay: 4% for financial report and 4% for non-financial report
• 360 to 419 days in delay: 3% for financial report and 3% for non-financial report
• 420 to 479 days in delay: 2% for financial report and 2% for non-financial report
• 420 to 479 days in delay: 2% for financial report and 2% for non-financial report
• 540 to 599 days in delay: 1% for financial report and 1% for non-financial report
• 600 to 659 days in delay: 1% for financial report and 1% for non-financial report
• 660 to 719 days in delay: 1% for financial report and 1% for non-financial report
• 700+ days in delay: 2% for financial report and 1% for non-financial report

Recipient reporting is a key tool in the oversight and monitoring of contribution agreements and these reports provide evidence of effective financial management and information to programs for decision making. As illustrated by the data, the significant majority of reports are eventually received; however, the delays in reporting means that the Department must make decisions with less relevant data. It is unclear what level of risk the Department is taking by waiting for these reports.

Finding

As noted in the previous section, there was an opportunity to better document and follow up on corrective actions. This creates a challenge in determining at a departmental level that monitoring activities are effective and leading to positive recipient outcomes.

While recipient report status was tracked in GCIMS, there was no further observed reporting on recipient monitoring activities to support departmental analysis. For example, there was not a process at the national level to review recipient monitoring data to assess common and emerging risks and trends, number of non-compliances and extent of corrective actions carried out.

As per departmental directives, TPAS was expected to have a Compliance Unit that monitors regional adherence to directives on recipient monitoring. This Compliance Unit was not active for the period of the audit; however, TPAS was able to share plans that show it is being considered for re-implementation. These plans were at the visioning stage (no approval, costs and resourcing estimates, etc.) and planned to achieve the following objectives:

• Provide data analysis services on financial/non-financial reports and General Assessments;
• Ensure compliance of financial and non-financial reporting and provide management quarterly reports;
• Provide advice, guidance and interpretations of the departmental directives and guides on financial reporting and reporting management; and
• Development, execution and reporting of results of monitoring plan for Grants and Contribution policy compliance based on risk.

Due to the lack of a national governance structure in place during the audit, there was limited oversight and analysis to demonstrate that the Department was being diligent in its recipient monitoring activities.

In the absence of oversight and analysis of recipient monitoring results, the Department is not able to effectively demonstrate compliance with policies and directives and that objectives for recipient monitoring are being achieved.