Archived - Risk-based Audit Plan 2008-2009 to 2010-2011

Date: June 27, 2008

PDF Version (311 Kb, 33 Pages)

This document represents the three-year Risk-based Audit Plan of Indian and Northern Affairs Canada for 2008-2011.

The plan was reviewed by the Audit and Evaluation Committee (AEC) at its April 25, 2008 meeting and, upon the recommendation of the Committee, subsequently approved by the Deputy Minister.

On June 1, 2008 the former Indian Residential Schools Resolution Canada (IRSRC) department became part of Indian and Northern Affairs Canada. As a consequence, the Audit and Evaluation Committee at its June 27, 2008 meeting approved the Chief Audit and Evaluation Executive's recommendations with respect to incorporating appropriate Resolution Sector (IRS) audit coverage into this Risk-based Audit Plan.

In preparing the 2009-2012 Audit Plan, a complete identification and risk assessment of Resolution Sector auditable units will be completed.

The plan focuses primarily on the provision of assurance services to Indian and Northern Affairs Canada's AEC and Deputy Minister while ensuring that appropriate audit attention is directed to addressing areas of government-wide interest, such as fundamental controls and financial reporting, as directed by the Office of the Comptroller General (OCG).

The plan is intended to support an annual opinion from the Chief Audit and Evaluation Executive (CAEE) on departmental governance, risk management and control processes.

Table of Contents

• Introduction
  • Background
  • Scope of the Internal Audit Function
• Risk-Based AuditT Planning
  • Consultations with INAC Management
• The Three-Year Audit Plan
  • Table 1 – Three-Year Audit Plan
  • Table 2 - Audit Projects for 2008-2009
  • Table 3 – Carry Forward from the 2007-2008 Plan
  • Performance of the Audit Engagements
  • Modification to the Plan
  • Level of Activity and Direct Resource Requirements
  • Infrastructure and Non-Core Resource Requirements
  • Challenges to Achievement of the Audit Plan
• Appendix A – Auditable Units
• Appendix B – Coverage of MAF Elements
• Appendix C – Contract Dollar Requirements for 2008-2009

Introduction

Background

The Audit and Assurance Services Branch within Indian and Northern Affairs Canada (INAC) is engaged in achieving full compliance by April 1, 2009 with Treasury Board's (TB) Internal Audit Policy.

The 2006 Internal Audit Policy places considerable emphasis on:

• increasing the independence of the internal audit function
• strengthening and further professionalizing the internal audit function
• providing a consistent, comprehensive government-wide approach to the way internal audit activities are planned and conducted and
• enhancing the oversight, monitoring and reporting role of the internal audit function.

This second three-year audit plan is a fundamental element of the new mandate, providing a strong and credible audit regime that contributes to effective risk management, sound resource stewardship and good governance in the delivery of Indian and Northern Affairs Canada's programs and activities.

Scope of the Internal Audit Function

The internal audit function plays an important role in supporting departmental operations. It provides assurance on all important aspects of risk management strategy and practices, management control frameworks and practices, and governance. Where control weaknesses exist and where the achievement of objectives is at risk, internal audit plays a role in providing constructive insight and recommendations for the strengthening of operations. In this way, internal audit contributes to enhanced accountability and performance.

The Government of Canada's standards for the professional practice of internal audit stipulate that the role of internal audit is to provide assurance that the system of internal control is adequate and effective to manage risk at a level that is acceptable to management. In this way, the internal audit function will provide the Deputy Minister and the Audit and Evaluation Committee with confidence that the risks to their objectives are being managed effectively. The internal audit function has a vital role to play in supporting the principles of modern comptrollership.

Internal control is defined broadly and encompasses those elements of an organization (including its resources, systems, processes, culture, structure and tasks) that, taken together, support the achievement of the organizational objectives.

The scope of the internal audit function is broad and includes those systems of internal control that are in place to achieve the following objectives:

• compliance with legislation, regulations, policies and procedures
• economy and efficiency of operations
• safeguarding of assets
• reliability and integrity of financial and operational information and
• achievement of operational objectives.

Risk-based Audit Planning

In preparing this second three year audit plan within the context of the 2006 Treasury Board Internal Audit Policy, the Audit and Assurance Services Branch employed the same risk-based planning methodology as developed for the 2007-2010 Plan. The methodology is described below and is consistent with professional standards for the development of risk-based audit plans.

The methodology consists of:

1. Identification of Auditable Units based upon an analysis and grouping of INAC's potential audit universe of programs, corporate functions, and authorities. A list of the auditable units is included as Appendix A.
2. Risk Assessment of each auditable unit in terms of its significance, complexity, and sensitivity, using a scale of 1 to 5 for each factor where 1 is low risk and 5 is high risk. Those auditable units marked with an asterisk in Appendix A are not currently ranked as having sufficient risk to be included in the Three Year Plan.
3. Recommendation of Audit Projects that would be most appropriate to address the highest risk areas on a priority basis.

While employing the same methodology to ensure consistency over time, care was taken to:

• update or refine the auditable units, e.g. to reflect new initiatives, transfer of responsibilities or areas of increased central agency interest
• revise the risk assessment to take into consideration the knowledge gained from implementation of the 2007-08 Annual Plan, including the results of Management Practices Reviews, audits and evaluations (both internal and external), and the review of Results-based Management Accountability Frameworks and Risk-based Audit Frameworks and
• refine or refocus recommended audit projects, e.g. carryover.

In the case of auditable units for which there has been little or no recent relevant audit or evaluation activity, the Branch will continue to undertake preliminary surveys as a first step in the audit process to identify the management control framework as well as potential risks that would be suitable for audit attention.

The Branch will also continue the practice of recommending a small number of audit projects that examine key issues or risks from a horizontal or cross boundary perspective.

Consultations with INAC Management

Consultations were held with the senior management of all sectors in INAC to explain and verify the identification of auditable units and to present the recommended audit projects that affect their sector or their interests as corporate managers.

The Three-Year Audit Plan

Based on the results of the risk-based prioritization of auditable units, a formal three-year audit plan has been developed, taking into consideration the known planned activities of external parties. The Three-Year Audit Plan (Table 1) sets out the recommended projects over the period from 2008-2009 to 2010-2011.

Prior to each subsequent fiscal year, the risk assessment of auditable units and the identification of projects will be updated to ensure that audit attention continues to be devoted to those areas of greatest risk that are suitable for examination.

The audit plan for 2008-2009 is presented in Table 2 with each project described in terms of its nature, its objective, its estimated timeframe, and its rationale. Regional coverage for each project will be determined as part of the planning phase.

The status of audit projects which began in 2007-2008 but have not been substantively completed is identified as carried forward in Table 3. Projects from the 2007-2008 Audit Plan which had not begun, e.g. due to unavailability of suitable contractors or contracting vehicles, and which are still considered as high priority have been included in the 2008-2009 Plan in Table 2.

Table 1 - Three-Year Audit Plan

Table 2 - Audit Projects for 2008-2009

Table 3 – Carry Forward from the 2007-2008 Plan¹

Performance of the Audit Engagements

The Audit and Assurance Services Branch will carry out the approved 2008-2009 audit engagements on a systematic basis. Having laid a solid foundation with the implementation of the 2007-2008 Plan and the establishment of a limited number of firms pre-qualified to provide audit services on a priority and timely basis, the Audit and Assurance Services Branch is well positioned to initiate and complete projects on a timely basis.

Audits will be carried out in accordance with the Professional Standards for Internal Audit as outlined in the TB Policy on Internal Audit.

Modification to the Plan

The risk-based audit plan will be updated, where justified on the basis of risk and urgency, as departmental and governmental risks evolve. Modifications to the plan will be presented at AEC meetings and submitted to the Deputy Minister for approval. As part of its ongoing monitoring of implementation of management action plans, the Audit and Assurance Services Branch may decide to conduct formal audit follow-up activity.

The Audit and Assurance Services Branch will also continue to monitor the scope and timing of external audits (e.g. OAG, OCG, Public Service Commission, Office of the Commissioner of Official Languages) in order to optimize coverage and minimize duplication of effort.

Level of Activity and Direct Resource Requirements

The Three-Year Plan identifies that approximately 20 audit projects will be carried out on an annual basis. While the level of audit effort will vary from project to project, it is the Audit and Assurance Services Branch's professional opinion that this level of activity is the minimum necessary to provide adequate and meaningful risk-based coverage of the programs and corporate functions of INAC and to meet the requirements of the Treasury Board Policy. Appendix B illustrates how the audit projects proposed for 2008-2009 will provide coverage of the Management Accountability Framework elements.

The Branch has been advised that this level of activity is commensurate with that required and undertaken in other government departments of similar size.

For purposes of identifying initial resource requirements, the Audit and Assurance Services Branch has assumed, based on experience, that its average portfolio of twenty audit projects will normally be comprised of 4-5 large projects at an expected cost of $250,000 each (in contract dollar terms), 6-8 medium size projects with an expected cost of $150,000 each, and 6-8 small projects with an expected cost of $75,000 each. These assumptions result in an annual requirement for a budget equivalent to approximately $3,000,000 in contract funds (exclusive of the costs of forensic and recipient audits). Due to delays in implementing the 2007-2008 Plan the Branch is carrying-forward a number of projects. To avoid a one-time shortfall, recommended audit average has been adjusted over the three years of the Plan. Appendix C details the anticipated costs of audit projects in 2008-2009.

Infrastructure and Non-Core Resource Requirements

In addition to the resource requirements for the carrying out of audit projects, the Audit and Assurance Services Branch also faces significant demands on its existing resource base to:

• serve as the Departmental liaison with the Office of the Auditor General and the Commissioner for the Environment and Sustainable Development, Public Service Commission, Office of the Comptroller General, and other Central Agencies (estimated annual cost of one senior level full time equivalent)
• represent INAC in the planning, conduct and reporting of special investigations and forensic audits (unfunded responsibility of increasing importance - estimated annual cost of one senior level full time equivalent)
• provide advice, guidance and challenge on the performance of risk assessments and related mitigation strategies and on the preparation of Risk-Based Audit Frameworks and related Treasury Board submissions (estimated annual cost of one senior level full time equivalent)
• support the establishment and operation of an independent Audit Committee as required by the Internal Audit Policy, e.g. an Audit and Evaluation Committee Terms of Reference and an Internal Audit Charter, estimated annual cost of one senior level full time equivalent
• formalize and inculcate a set of professional standards and practices (e.g. Audit Manual, Code of Ethics, Quality Assurance) that will enhance the capacity of the Branch to add value (estimated annual cost of one senior level full time equivalent).

Challenges to Achievement of the Audit Plan

The Audit and Assurance Services Branch recognizes that its recommended Plan continues to be very ambitious, but believes that it is essential to achieving full compliance with the Internal Audit Policy by April 1, 2009.

The extent to which the Branch is able to achieve full implementation of the Plan is dependent, however, on a number of factors:

• the Branch must be largely successful in having new audit managers assume a full range of responsibilities
• the Branch must be able to successfully manage its contractors
• the Branch must be able to limit the extent to which its resources are detracted into non-core, non-funded activities
• the Branch may have to respond in an incremental fashion to OCG requirements for government-wide audit activity and
• the Branch may have to respond to emerging INAC or government-wide priorities or issues.

The Audit and Assurance Services Branch will continue to provide an update to the Audit Committee at each of its meetings on the progress it is making in implementing the Plan and the challenges it is facing in so doing.

Appendix A – Auditable Units

Departmental Programs

1. Self Government/Claims
2. Band Support Funding
3. Capacity Development
4. Capital Facilities and Maintenance
5. Economic Development
6. Office of the Federal Interlocutor and Urban Aboriginal Strategy
7. Emergency
8. Natural Resources and Environmental Management
9. Child and Family Services
10. Income Assistance
11. Elementary and Secondary Schools and Other Education
12. Post Secondary Schools
13. Youth Employment Strategy*
14. Family Violence and Other Social Services
15. Registration and Membership
16. Northern Air Stage Funding Subsidy (Food Mail)*

Corporate Functions

Financial Management

1. Financial Planning and Budgeting
2. Forecasting (Management Variance Reporting)
3. External Reporting
   1. Public Accounts
   2. Audited Financial Statements
   3. DPR/RPP
   4. Proactive Disclosure
   5. Contingent Liabilities
4. Delegation of Financial Authority
5. Expenditure Management
   1. Procurement and Acquisition Cards
   2. Contracting
   3. Travel and Expenditure Claims
   4. Hospitality
   5. Memberships
   6. Compliance Monitoring
   7. Settled Claims
6. Fraud Risk and Control Strategies
7. Assets and Property Management
8. Revenues
9. Trust Accounts
10. Loans, Loan Guarantees, and Accounts Receivable

Human Resources Management and Services

1. Planning and Resourcing
   1. Human Resource Planning
   2. Corporate Resourcing and Aboriginal and other Resourcing
   3. Executive Resourcing
   4. Staffing
2. Organizational Design and Classification
3. Compensation and Benefits (Payroll)
4. Learning and Development
5. Labour Relations*
6. Occupational Health and Safety*
7. Accommodations*

Security

1. Physical
2. Personnel
3. IM/IT

Information Management and Technology

1. IM/IT Governance
2. IM/IT Applications
3. Information Management
4. Library and Information Centre*
5. Aboriginal Connectivity*

Corporate Governance

1. Strategic Policy and Planning
   1. Research
      1. Aboriginal Peoples Survey
      2. Legislation
2. ATIP*
3. Official Languages
4. Entity Level Controls
   1. Risk Management
      1. Follow-up of Audit and Evaluation Recommendations
      2. Policies and Practices
      3. Corporate Risk Profile
      4. Intervention Policy
      5. Business Planning (OAG in reserve for 08-09)
   2. Values and Ethics
      1. Staff Ombudsman
      2. Integrity
      3. Roles and Responsibilities
      4. Delegation of Authorities
      5. Governance Structure
5. Complaints and Allegations
6. Continuity of Operations
   1. Crises
   2. Emergencies
7. Communications
   1. Internal
   2. External
8. Legal Services and Litigation Management*
9. Corporate Secretary*
10. Departmental Audit and Evaluation
11. Sustainable Development

Management Practices

1. Regions
   1. British Columbia Region
   2. Alberta Region
   3. Saskatchewan Region
   4. Manitoba Region
   5. Ontario Region
   6. Quebec Region
   7. Atlantic Region
   8. Yukon Region
   9. NWT Region
   10. Nunavut Region
2. Sectors
   1. Treaties and Aboriginal Government (formerly Claims and Indian Government) Sector
   2. Socio-Economic Policy and Regional Operations Sector
   3. Aboriginal Economic Development Sector
   4. Lands and Trust Services Sector
   5. Northern Affairs Sector
   6. Resolution Sector (formerly Indian Residential Schools Resolution Canada)

Appendix B – Coverage of MAF Elements

Appendix C – Contract Dollar Requirements for 2008-2009