Archived - Risk-Based Audit Plan 2007-2008 to 2009-2010

Background

The Audit and Assurance Services Branch within Indian and Northern Affairs Canada (INAC) is engaged in implementing a new mandate for internal audit as defined in the Treasury Board's (TB) Internal Audit Policy that came into force April 1, 2006, with full implementation to be completed by April 1, 2009.

The 2006 Internal Audit Policy places considerable emphasis on:

• increasing the independence of the internal audit function
  
  
• strengthening and further professionalizing the internal audit function
  
  
• providing a consistent, comprehensive government-wide approach to the way internal audit activities are planned and conducted and
  
  
• enhancing the oversight, monitoring and reporting role of the internal audit function.

The Government of Canada's Federal Accountability Act (Bill C-2) reinforces this new mandate by enacting measures that are meant to strengthen accountability and increase transparency and oversight in government operations. The Act includes specific measures to strengthen auditing and accountability within departments by clarifying the managerial responsibilities of deputy heads within the framework of ministerial responsibility, and by bolstering the internal audit function within departments. This three-year audit plan is a fundamental element of the new mandate, providing a strong and credible audit regime that contributes to effective risk management, sound resource stewardship and good governance in the delivery of Indian and Northern Affairs Canada's programs and activities.

Scope of the Internal Audit Function

The internal audit function plays an important role in supporting departmental operations. It provides assurance on all important aspects of risk management strategy and practices, management control frameworks and practices, and governance. Where control weaknesses exist and where the achievement of objectives is at risk, internal audit plays a role in providing constructive insight and recommendations for the strengthening of operations. In this way, internal audit contributes to enhanced accountability and performance.

The Government of Canada's standards for the professional practice of internal audit stipulate that the role of internal audit is to provide assurance that the system of internal control is adequate and effective to manage risk at a level that is acceptable to management. In this way, the internal audit function will provide the Deputy Minister and the Audit and Evaluation Committee with confidence that the risks to their objectives are being managed effectively. The internal audit function has a vital role to play in supporting the principles of modern comptrollership.

Internal control is defined broadly and encompasses those elements of an organization (including its resources, systems, processes, culture, structure and tasks) that, taken together, support the achievement of the organizational objectives.

The scope of the internal audit function is broad and includes those systems of internal control that are in place to achieve the following objectives:

• compliance with legislation, regulations, policies and procedures
• economy and efficiency of operations
• safeguarding of assets
• reliability and integrity of financial and operational information
• achievement of operational objectives.

The methodology employed in the development of the three-year internal audit plan is described below and is consistent with professional standards for the development of risk-based audit plans.

Identification of Auditable Units

The Audit and Assurance Services Branch identified a number of auditable units based upon an analysis and grouping of INAC's potential audit universe of programs, corporate functions, and authorities. A list of the auditable units is included as Appendix A.

Risk Assessment

Recognizing that the most effective processes for risk assessment for internal audit purposes are ultimately based on sound professional judgment, the Audit and Assurance Services Branch adopted a framework that assesses the risks associated with each auditable unit in terms of its significance, complexity, and sensitivity, using a scale of 1 to 5 for each factor where 1 is low risk and 5 is high risk. A total score of 12 – 15 would indicate a high risk auditable unit, 8 – 11 a moderate risk auditable unit, and 3 – 7 a low risk auditable unit. This approach to risk assessment is highly consistent with approaches proposed by the Office of the Comptroller General to identify its possible cross-government audit priorities and by the Blue Ribbon Panel on Grants and Contributions to identify which recipients should be subject to audit.

In completing its initial identification of the risks associated with the auditable units, the Audit and Assurance Services Branch relied on information contained in:

• previous audit or evaluation reports (including those of the Auditor General of Canada)
  
  
• reports or summaries of previous corporate level risk assessments
  
  
• records of early 2007 meetings between senior INAC and Office of the Auditor General officials in the context of their One Pass Plan exercise
  
  
• Treasury Board Submissions, including Results based Management and Accountability Frameworks (RMAFs) and Risk-Based Audit Frameworks (RBAFs)
  
  
• statistical results and narrative reports from the conduct of Grant and Contribution Control Self Assessment Sessions at headquarters and in two regions between April and May, 2007
  
  
• assessments provided by the Office of the Comptroller General as to common government objectives and risks
  
  
• audit plans prepared by other government departments (particularly as they related to corporate functions or to contribution programs
  
  
• other related reports or documents.

As one component in validating the Audit and Assurance Services Branch's assessment of risks, the Audit and Evaluation Sector convened a small working group of senior executives with no direct responsibility for program delivery. The members of the group were asked to individually identify the highest risk areas they perceived for INAC in terms of three categories – fundamental controls (based on the Management Accountability Framework elements), funding authorities, and elements of INAC's Program Activity Architecture. The compiled results confirmed that the Audit and Assurance Services Branch's assessment of risks was well founded and that its resulting proposed projects were well aligned. Appendices B1, C1 and D1 display the results of the assessments, while appendices B2, C2 and D2 identify the high and medium risks in each category in terms of how they are addressed in the first year of the Three-Year Audit Plan.

Recommended Audit Projects

Following the assessment of auditable units, the Audit and Assurance Services Branch considered the nature and type of audit project that would be most appropriate to address the highest risk areas on a priority basis.

In some cases, related audit work had recently been completed or initiated. In these instances, the branch considered whether coverage was likely to be sufficient or whether additional work would be required over the term of the Three-Year Audit Plan. As a result, audit work in some priority areas may be deferred, while in others it may be seemingly repeated or expanded, e.g. in the case where the scope of a recent audit may have been too limited to provide assurance over the entire auditable unit.

In the case of auditable units for which there has been little or no recent relevant audit or evaluation activity, the branch has identified a preliminary survey as a first step in the audit process to identify the management control framework as well as potential risks that would be suitable for audit attention.

As a result of a synthesis of risks previously identified through a variety of sources, it was recognized that there was an opportunity to introduce a small number of audit projects that would examine key issues or risks from a horizontal or cross boundary perspective.

Finally, through its review of Treasury Board Submissions and related RMAFs and RBAFs, the Audit and Assurance Services Branch identified two instances where INAC had committed to Treasury Board to do an audit. Although these projects have been identified in the Plan, it is the Branch's intention to initiate discussions with Treasury Board Secretariat (TBS) to determine whether it is necessary to complete these audits within the time frame indicated, since they did not arise as high risks in the Branch's risk assessment.

Since the Audit and Evaluation Sector formally assumed a responsibility to review INAC's RMAFs and RBAFs, it has paid particular attention to ensuring that audit commitments are not made which undermine the Treasury Board's own policy that internal audit activity be based on risk assessments which are conducted at least annually.

Consultations with INAC Management

Consultations were held with the senior management of all sectors in INAC to explain and verify the identification of auditable units and to present the recommended audit projects that affect their sector or their interests as corporate managers.

Based on the results of the risk-based prioritization of auditable units, a formal three-year audit plan has been developed, taking into consideration the known planned activities of external parties. The Three-Year Audit Plan (Table 1) sets out the recommended projects over the period from 2007-2008 to 2009-2010.

Prior to each subsequent fiscal year, the risk assessment of auditable units and the identification of projects will be updated to ensure that audit attention is devoted to those areas of greatest risk that are suitable for examination.

The audit plan for 2007-2008 is presented in Table 2 with each project described in terms of its nature, its objective, its estimated timeframe, and its rationale.

Table 1

Table 2 – Audit Projects for 2007-08

Performance of the Audit Engagements

The Audit and Assurance Services Branch will carry out the approved 2007-2008 audit engagements on a systematic basis. A small number of audit projects has already been initiated, with the concurrence of, or at the request of, the Deputy Minister.

Audits will be carried out in accordance with the Professional Standards for Internal Audit as outlined in the TB Policy on Internal Audit.

Ever-greening of the Plan

The risk-based audit plan will be updated, where justified on the basis of risk and urgency, as departmental and related environmental risks change. This "ever-green" approach will enable the Audit and Assurance Services Branch to ensure that internal audit activity remains relevant and effective. Modifications to the plan will be presented at AEC meetings and submitted to the Deputy Minister for approval.

The Audit and Assurance Services Branch will also continue to monitor the scope and timing of external audits (e.g. OAG, OCG, Public Service Commission, Office of the Commissioner of Official Languages) in order to optimize coverage and minimize duplication of effort.

Level of Activity and Direct Resource Requirements

The Three-Year Plan identifies that some seventeen audit projects will be carried out on an annual basis. While the level of audit effort will vary from project to project, it is the Audit and Assurance Services Branch's professional opinion that this level of activity is the minimum necessary to provide adequate and meaningful risk-based coverage of the programs and corporate functions of INAC and to meet the requirements of the Treasury Board Policy.

The Branch has been advised that this level of activity is commensurate with that required and undertaken in other government departments of similar size.

Apart from variations in the objectives and scope of audit projects, the cost of carrying out individual audit projects will also vary considerably depending on:

• whether internal or external contract resources are employed
• whether contract work is done through large nationally recognized professional organizations or through mid-size locally based firms
• whether the engagement requires general audit skills or a high degree of expertise and
• whether or not travel is required.

For purposes of identifying initial resource requirements, the Audit and Assurance Services Branch has assumed, based on experience, that its average portfolio of seventeen audit projects will normally be comprised of 3-5 large projects at an expected cost of $250,000 each (in contract dollar terms), 5-7 medium size projects with an expected cost of $150,000 each, and 6-8 small projects with an expected cost of $75,000 each. These assumptions result in an annual requirement for a budget equivalent to $2,500,000 in contract funds. Appendix E details the anticipated costs of audit projects in the Three-Year Plan.

Based on these assumptions, the Audit and Assurance Services Branch foresees a potential shortfall of $900,000 in 2007-2008.

Infrastructure and Non-Core Resource Requirements

In addition to the resource requirements for the carrying out of audit projects, the Audit and Assurance Services Branch also faces significant demands on its existing resource base to:

• serve as the Departmental liaison with the Office of the Auditor General and the Commissioner for the Environment and Sustainable Development
• represent INAC in the planning, conduct and reporting of forensic audits (unfunded responsibility of increasing importance)
• provide advice, guidance and challenge on the performance of risk assessments and related mitigation strategies and on the preparation of Risk-Based Audit Frameworks and related Treasury Board submissions (unfunded responsibility recently assumed)
• support the establishment and operation of an independent Audit Committee as required by the Internal Audit Policy, e.g. an Audit Committee Charter and an Internal Audit Mandate
• formalize and inculcate a set of professional standards and practices (e.g. Audit Manual, Code of Ethics, Quality Assurance) that will enhance the capacity of the Branch to add value.

Challenges to Achievement of the Audit Plan

The Audit and Assurance Services Branch recognizes that its recommended Plan is very ambitious, especially in terms of its approval late in the first quarter of the fiscal year, but believes that it is an essential first step in achieving full compliance with the Internal Audit Policy by April 1, 2009.

The extent to which the Branch is able to achieve full implementation of the Plan is dependent, however, on a number of factors:

• the Branch must be largely successful by the end of the second quarter in its current efforts to staff five approved audit manager positions
  
  
• the Branch must be able to engage competent audit managers on a temporary help contractual basis pending staffing of permanent positions
  
  
• the Branch must be able to limit the extent to which its resources are detracted into non-core, non-funded activities
  
  
• the Branch may have to respond to OCG (yet to be determined) requirements for government-wide audit activity or for providing holistic opinions
  
  
• the Branch may have to respond to emerging INAC or government-wide priorities or issues and
• the Branch may need additional contract dollars (as noted above).

The Audit and Assurance Services Branch will provide an update to the Audit Committee at each of its meetings on the progress it is making in implementing the Plan and the challenges it is facing in so doing.

Appendix A – Auditable Units