Internal Audit Report - Follow-Up Audit of Travel, Hospitality and Acquisition Cards

Final Report January 2010

Table of Contents

1. Executive Summary

Policies and controls on financial management and governance must constantly be revised and updated to manage risks as they emerge. Such is the case in the management of travel, hospitality and acquisition cards where new policies, controls, and initiatives are implemented to take advantage of efficiencies, manage existing and emerging risks, and achieve effectiveness and economy.

As a follow up to the 2005 Compliance Audit of Travel, Hospitality and Acquisition Cards, this audit undertook to provide management with an update on the implementation of the 24 recommendations made in the 2005 audit and to provide an assessment on whether the control deficiencies identified in the 2005 audit had been addressed.

The audit scope included the review of travel and hospitality expenses, and acquisition card transactions processed between February 1st, 2008 and January 31st, 2009, and the actions taken by Management up to October 2009 to address the 2005 recommendations. The five recommendations that related to the role Industry Canada used to play with respect to Section 33 authority were not examined as this role has since changed.

Overall, the audit found evidence of good financial controls and financial stewardship. Infrastructure Canada's policies and procedures were generally in compliance with Treasury Board standards with regard to travel, hospitality and acquisition cards; financial coding was accurate and the reporting of proactive disclosure was generally properly done. Controls could be strengthened in the following areas: the application of financial authority, the documentation of exceptional travel, the use of blanket travel authorities, and the documentation and management of acquisition cardholder files.

Of the 19 recommendations in the 2005 audit that we followed up on, twelve were deemed completed, and seven were at various stages of completion. Overall, our opinion is that satisfactory progress has been made, however further improvements are needed to address some of the previously identified control deficiencies.

On October 1st, 2009 Treasury Board released new directives on account verification, travel cards and acquisition cards. Although these new directives were not used in determining the assessment criteria for this audit, they have been considered in the new recommendations which have been proposed.

Original signed by

Linda Saunders
Chief Audit Executive
Office of Infrastructure Canada

Date

Yaprak Baltacıoğlu
Deputy Minister of Transport, Infrastructure and Communities

Date

2. Background

A Compliance Audit of Travel, Hospitality and Acquisition Cards covering the 19-month period from April 1st, 2003 to October 31st, 2004 was conducted in 2004-2005. The purpose of the audit was to provide INFC's senior management with reasonable assurance concerning the following objectives:

  • Internal control mechanisms
    • There are appropriate internal controls in place as concerns authority (Section 32 – Financial Administration Act [FAA]), approval (Section 34 – FAA) and payment (Section 33 – FAA). These controls are effective and were applied throughout the audit period in order to manage risks relating to the administration of departmental funds for travel, hospitality and the use of acquisition cards.
  • Compliance
    • INFC complied with Treasury Board standards relating to the eligibility of travel and hospitality expenses and acquisition card transactions.
  • Matching of financial data
    • Travel, hospitality and acquisition card expense data entered in the INFC financial system are generally accurate and correspond to Industry Canada's records. 1
  • Proactive disclosure
    • Travel and hospitality expenses are properly disclosed on the INFC website.

The 2005 audit identified some areas of improvement, notably with respect to the application of Section 32 and 34 of the FAA, and the eligibility of acquisition card purchases. The audit also identified a risk area related to the use of a third-party delivery partner (i.e. , Industry Canada) for data entry and Section 33.

In 2008-2009, the Departmental Audit Committee2 approved a Follow-up Assurance Audit of Travel, Hospitality and Acquisition Cards to determine the extent to which previous audit recommendations have been implemented and have addressed control deficiencies identified in the management of these activities.

The follow-up audit started in March 2009 with an examination of the environment with respect to travel and hospitality expenses, and acquisition card transactions, and determined that it had remained substantially the same, with exception to the following changes:

  • As mentioned in footnote #1, in 2005, INFC was outsourcing its accounting operations to Industry Canada by means of service agreement. Accounting operations are now done in house and Section 33 payment authority is exercised by INFC employees since July 2008. As a result, the risk of relying on a third-party delivery partner for data entry and Section 33 authority no longer exists.
  • With respect to travel claims, INFC implemented the government Expense Management Tools (EMT) in December 2008. Expense claims are now computerized with pre-populated data such as the meal entitlements and rates, reducing the risk of manual errors. A manual Section 34 signature is still required.

Additional risks related to travel and hospitality expenses and acquisition card transactions have not been identified. The two environmental changes mentioned above have been taken into consideration in developing the scope of this audit.

3. Audit Objectives

The objectives of the audit were to provide assurance that the previous audit recommendations:

  • have been implemented; and
  • have addressed the control deficiencies identified in the management of travel and hospitality expenses, and acquisition card transactions.

4. Audit Scope

The audit examined the management action plans that have been implemented since the approval of the first audit report in June 2005, with the exception of the ones that are no longer relevant. More specifically, the management action plans that related to the role Industry Canada used to play with respect to Section 33 authority were not examined (i.e. , recommendations #2, 3, 4, 5 and 11).

In reviewing the management action plans that relate to travel, the audit took into consideration the impact of the recent implementation of the EMT.

The audit also reviewed travel and hospitality expenses, and acquisition card transactions processed between February 1st, 2008 and January 31st, 2009 to determine if the management action plans had addressed the identified control deficiencies.

Linkage to the Treasury Board (TB) Management Accountability Framework (MAF)
With the focus of the audit being on financial controls and compliance, it addressed the Stewardship area of the MAF.

5. Audit Approach

The examination phase of this audit employed various techniques including interviews, review of financial and non-financial documentation, random and directed sampling of transactions, and analytical reviews. The audit criteria used were similar to those employed during the initial audit, and were based upon applicable policies, procedures, and legislation.

The examination phase of this audit was completed in August 2009.

For purposes of this report, the residual risk rankings associated with the findings use low, moderate, and high three-point scales and are subjectively based on our knowledge gained from this audit. The subjective criteria are:

High – Threats/Opportunities have very significant impact on INFC's objectives, are imminently likely and no or uncertain mitigation measures are in place.

Moderate – Threats/Opportunities have significant impact on INFC's objectives, have a longer-term likelihood and reliable mitigation measures are planned or are being established.

Low – Threats/Opportunities do not have a significant residual risk to INFC's objectives.

6. Audit Findings

6.1 Section 32, 34 and 33 of the Financial Administration Act

Observation
Moderate Risk

The audit found that the effectiveness of the financial authority controls (Section 32) could be improved and that Section 32 was not consistently applied, especially with regard to acquisition card purchases. The audit found that Section 34 and Section 33 were generally effective and consistently applied. That being said, the audit also identified some weaknesses that warrant attention.

Section 32 - Acquisition Card:

The audit reviewed 48 randomly selected acquisition card transactions and found 12 instances where Section 32 authority was not adequately supported. For six of these instances we were unable to find a signature card for the acquisition card holder making the purchase. In the six other cases, the acquisition card holder was delegated Section 32 but not for the fund centre in which the transaction took place. While acquisition card holders do not have to be delegated Section 32 authority to make purchases with their cards, these purchases have to be pre-authorized under Section 32 by the relevant delegated fund centre manager. The audit did not find any evidence of preauthorization for any of these 12 transactions; for nine of them, Section 32 authority was signed after the purchase was made.

Section 32 - Travel:

The audit reviewed 30 randomly selected travel claims as well as the claims of the five employees who travelled the most during the review period. For the most part, Section 32 was adequately performed. That being said, the audit identified two areas for improvement.

The first area is associated with the approval and the exercise of Section 32 for the travel of the members of the executive committee, which is not documented for each individual trip, but done using a blanket travel authority (BTA). While the use of BTAs is acceptable under Treasury Board (TB) Travel Directive, the audit determined this specific BTA to be inadequate because: it was issued to a group of employees as opposed to a specific one; it has no end-date and has not been reviewed since its issuance in 2006; it does not include the names of the employees, nor it is signed by them; and it does not list any conditions or limitations, except for the fact the travel expenses have to be within the limit of the relevant budget and in accordance with the TB Travel Directive.

The second area of improvement relates to the estimation of travel costs. Section 32 requires that there is a sufficient unencumbered balance in the appropriation to discharge the debt. For travel expenses, Section 32 authorization is based on estimated costs. While differences between estimated costs and actual expenses are expected, the two amounts should be somewhat similar. The audit found that for six of the 30 randomly selected claims, the actual travel expenses were 25% higher than estimated authorized costs.

These weaknesses, whether related to travel or acquisition card purchases, could have various negative impacts including: challenges in managing budgets, exceeding delegated authority, exceeding appropriation, and inadequate or unauthorized purchases or expenses.

Section 34:

With respect to Section 34, the audit found instances where there was insufficient documentation or a lack of supporting evidence to verify that the goods were supplied or the services were rendered. More specifically, of the 48 acquisition cards reviewed, the audit found six instances where an original invoice was not used to issue the payment, instead, Section 34 was signed on an email, packing slip or receipt. The audit also found seven instances where supporting evidence (such as a training course certificate or a packing slip) was insufficient to verify that the goods were supplied or the services were rendered. The audit was also unable to locate any supporting documentation for two acquisition card transactions and one hospitality expense. These issues could result in unauthorized or inadequate purchases, paying for goods or services not received/rendered, and duplicate payments.

Section 33:

The audit found that Section 33 was performed on all of the transactions reviewed and that the segregation of duties with Section 34 was adequate. That being said, the audit noted that in most cases, persons signing Section 33 did not put their full signature but instead put their initials, making authentication more difficult. In addition, the audit found six instances where one person, who was signing Section 33, was not delegated that authority at the time of the transactions, but was subsequently delegated such authority.

Overall, the audit has attributed the identified weaknesses to a combination of factors, including:

  • The lack of awareness by acquisition cardholders, fund centre administrators delegated Section 32 authority, and fund centre managers, of their roles and responsibilities with respect to the authorization of acquisition card purchases and Section 34 requirements;
  • An account verification process that could be improved;
  • The lack of acquisition card monitoring, as requested by the TB Directive;
  • A blanket travel authority that needs to be reviewed and improved; and
  • A process to review and update financial signature cards that is not effective because:
    • The process is not clearly defined;
    • Evidence of validation of the successful completion of the Canada School of Public Services (CSPS) "Essentials of Managing in the Public Service" course and related exams is not documented; and
    • Up-to-date organizational charts in support of the process are not available on a regular basis.
Recommendations Management Action Plan

1.1 The Finance and Administration Division should develop and deliver an orientation/training session for acquisition cardholders and fund centre administrators who are delegated Section 32 to inform them of their roles and responsibilities (including financial coding).

1.1 INFC-Finance is consulting with other departments to identify best practices in the management and administration of acquisition cards. INFC-Finance will review training and orientation practices used in other departments including Transport Canada, and either adapt best practices materials or enter into a shared services arrangement for delivery of orientation/ training as required.

Assistant Deputy Minister Responsible:

Director, Finance & Administration

Due Date:

September 30, 2010

Recommendations Management Action Plan

1.2 The Finance and Administration Division should formalize its process for reviewing financial signature cards, ensure such a process takes place annually, and ensure the validation of successful completion of the CSPS relevant training is documented.

1.2 INFC-Finance is currently reviewing the department's financial signature cards. The review of the validation of relevant CSPS training is expected to be completed by January 30, 2010, and a formal report of findings and recommendations is expected to be submitted to the CFO by March 31, 2010.

The Manager, Accounting Operations and Systems is participating in informal discussions and information sharing among a number of departments regarding policies and procedures on the management of Financial Signing Authorities. Best practices policy and procedures will inform the review and strengthening of INFC's Departmental Financial Signing Authorities Procedures which will be performed as part of the work plan to ensure compliance with the TB Policy on Internal Control for the 2011/2012 fiscal year.

Assistant Deputy Minister Responsible:

Director, Finance & Administration

Due Date:

Documentation of current review findings and actions taken – March 31, 2010, Strengthening of policies/procedures to ensure compliance with internal control – March 31, 2011

Recommendations Management Action Plan

1.3 The ADM Corporate Services should ensure that a process is in place to facilitate the regular updating of human resources information (organizational charts).

1.3 Human Resources Directorate is taking the following measures to ensure that up-to-date organization charts are available:

  1. Adopting a new tool that produces organizational charts electronically based on reports from the HR Information System (in progress);
  2. Adding resources to the classification unit (in progress);
  3. Reviewing the HR Delegation Instrument to ensure that org chart approvals are at the right level to allow for timely response to changes in personnel (by September 2010).
Assistant Deputy Minister Responsible:

Director General, Human Resources

Due Date:

September 30, 2010

Recommendations Management Action Plan

1.4 The Finance and Administration Division should strengthen their account verification process, especially with respect to the adequacy of the documentation supporting Section 34 authorization, and compliance with the Travel Directive and Special Authorities.

(Note: This recommendation also addresses Finding 6.2)

1.4 A new INFC Policy on Account Verification has recently been approved. Related account verification procedures are being developed and will include Section 34 documentation requirements for travel related expenditures. INFC is reviewing the practices employed by other departments for account verification related to travel to ensure consistency and reasonableness of INFC practices.

Assistant Deputy Minister Responsible:

Director, Finance & Administration

Due Date:

March 31, 2010

Recommendations Management Action Plan

1.5 The Finance and Administration Division should ensure that blanket travel authorities are used only when they meet the requirements of TB travel directive.

(Note: This recommendation also addresses Finding 6.2)

1.5 INFC-Finance has reviewed sample blanket travel authorities used by other departments, including Transport Canada. A revised proposed annual blanket travel authority for Management Committee members will be completed by the end of February 2010. The revised authority will be based on best practices, and be submitted for Deputy Head approval on an annual basis.

Assistant Deputy Minister Responsible:

Director, Finance & Administration

Due Date:

February 26, 2010

6.2 Compliance with Treasury Board Standards for Travel

Observation
Moderate Risk

The audit found that INFC generally complied with TB standards related to travel, with the exception of the justification and approval of exceptional cases.

Indeed, the audit found that the issue related to the justification and approval of exceptional travel cases identified in the previous audit has not been resolved. Of the 30 randomly selected claims, 12 included accommodation charges at a hotel rate above the approved rate for the city and time period, without documented justification and specific approval. This was also the case for 23 of the 52 claims reviewed as part of our directed sample. While staying at a hotel with a rate above the standard one could be justified under certain circumstances, according to the TB Travel Directive, such circumstances need to be documented in the travel authority form, and approved. In the case of senior executives, the TB Special Travel Authorities applies, and such justification need only be documented on the travel claim.

In addition, the audit found 12 instances, for a senior executive, where the flight classes were upgraded above the standard class (economy). These include 11 upgrades to business class, and one upgrade to first class. Given the level of the employee, the TB Special Travel Authorities apply and upgrades to business class for nine of the flights could have been approved because these flights were more than 850 km in length, but such approval was not obtained. It should also be noted that the Special Travel Authorities specify that the Deputy Head should manage a reduction in the use of business class travel. The TB Travel Directive and the Special Travel Authorities does not have any provision regarding upgrades for flights of less than 850 km, and the Special Travel Authorities is specific about the fact that first class air travel is never to be used, even if business class is not available.

The audit has attributed these instances of non-compliance to:

  • A lack of awareness by the travelers of certain elements of the Travel Directive and Special Travel Authorities;
  • A lack of understanding by the fund centre administrators and fund centre managers of their roles and responsibilities;
  • An account verification process that could be improved; and
  • The use of a blanket travel authority that requires compliance with the Travel Directive and does not allow for flight upgrades which could be acceptable under the Special Travel Authorities.

The instances of non-compliance with the Travel Directive and the Special Travel Authorities identified above resulted in extra expenses and could negatively impact INFC's reputation.

Recommendations Management Action Plan

2.1 The Finance and Administration Division should ensure that the restrictions of the Travel Directive and Special Travel Authorities are clearly communicated to employees and managers.

2.1 INFC-Finance will brief the Management Committee members and their assistants on the proposed revised annual blanket travel authority upon approval by the Deputy Head. Briefings will include explanation of the restrictions of the Travel Directive and Special Travel Authorities as it applies to Senior Executives.

New INFC account verification procedures and approval requirements for travel are contained in the Administrative Procedures for Travel which came into effect April 1, 2009. These procedures have been communicated directly to employees and posted on INFC's infranet. A new internal control function is also being created to ensure ongoing compliance with travel administration and other related processes.

Assistant Deputy Minister Responsible:

Director, Finance & Administration

Due Date:

Briefings on the revised annual blanket travel authority and the restrictions of the Travel Directive and Special Travel Authorities – March 31, 2010 Creation of the new internal control function – September 30, 2010

See also recommendations 1.4 and 1.5 under finding 6.1

See also management action plans 1.4 and 1.5 under finding 6.1

6.3 Compliance with Treasury Board Standards for Acquisition Cards

Observation
Moderate Risk

The audit found that INFC generally complied with Treasury Board standards related to acquisition card purchases. That being said, the audit also found two areas for improvement, one related to the maintenance of acquisition cardholders' files (which contain information related to the card and the cardholder, not the expenses), and one related to the monitoring of acquisition card expenses.

Acquisition Cardholders' Files:
The audit found that the controls surrounding the acquisition cardholders' files could be strengthened. Indeed, the audit was unable to locate the files of four acquisition cardholders, and therefore was unable to confirm the cardholders' authorizations, limits and restrictions or to validate if the cardholder had signed the required acknowledgment letter. The audit also found two instances of credit limit increases without documented authorization supporting the increase. In addition, we noted that, in general, acknowledgment letters were not updated when a credit limit increase was granted, making the information on them inaccurate. The acquisition cardholder acknowledgment letter includes credit limit and restrictions, as well as signatures of the acquisition card holder and his/her manager. When no documentation is kept on file to authorize an increase of the acquisition card limit and the acknowledgment letter is not updated either, it is impossible to know if such an increase was indeed authorized.

Furthermore, the audit found two instances where acquisition card cancellation was not properly documented. In one case, the date of the cancellation and who requested it was not documented. In the other case, a pre-authorized monthly transaction was processed after the documented cancellation date. This lack of documentation makes it difficult to determine accountability if/when charges occurred after the acquisition cards should have been canceled.

Monitoring of Acquisition Card Transactions:
The TB Acquisition Card Directive states that the acquisition card coordinator has the responsibility of ensuring that the use of acquisition cards is monitored, and the INFC Acquisition Card Policy states that such monitoring should be performed by the acquisition card coordinator. The acquisition card coordinator has not undertaken a regular monitoring process, but rather relied on the regular review process performed by the financial assistant. This review process consists of ensuring that each transaction has proper coding and supporting documentation. It does not include ensuring proper pre-authorization of purchases and compliance with the TB Acquisition Card Directive. The audit found instances where proper pre-authorization was not done adequately.

Recommendations Management Action Plan

3.1 The Finance and Administration Division should put mechanisms in place to ensure that:

  • acquisition cardholder files are kept up to date; and
  • credit limit increase authorizations and card cancelations are well documented.

3.1 INFC-Finance will review and confirm acquisition card authorizations, limits and restrictions. Processes and procedures will be reviewed and documented to ensure proper maintenance and monitoring of acquisition cards, based on best practices identified in other departments.

Assistant Deputy Minister Responsible:

Director, Finance & Administration

Due Date:

Review and confirmation of Acquisition Card authorizations, limits and restrictions – March 31, 2010

Documentation and monitoring of processes – September 30, 2010

Recommendations Management Action Plan

3.2 The Finance and Administration Division should strengthen its acquisition card monitoring/review process. Such process should not duplicate the account verification process, but rather, complement it.

3.2 A new internal control function is being created to ensure independent review and monitoring of acquisition card files.

Assistant Deputy Minister Responsible:

Director, Finance & Administration

Due Date:

September 30, 2010

6.4 Financial Coding

Observation
Low Risk

For the most part, the audit found that the information entered in the financial system was generally accurate and corresponded to the supporting documentation. The audit did identify a few instances of coding errors (GL account, FY) but none of major significance. The only issue worth mentioning relates to the accounting of GST for acquisition card purchases. The audit found 19 instances where the GST was not properly accounted for in the financial system. There were instances where the equivalent of 5% GST was recorded in the financial system even though GST was not applicable to the purchase and not included in the invoice. This causes expenses where GST is not applicable, to be understated by 4.8% (i.e., 5% of 105%), and GST to be overstated by the same amount. In addition, for certain invoices issued by the suppliers before January 1st, 2008, the GST on the invoice represented 6% of the costs, as this was the GST rate at the time, but when these were paid in 2008, only 5% was coded to GST. This issue could be due to a system problem where GST is automatically calculated.

Recommendations Management Action Plan

4.1 The Finance and Administration Division should update its process to ensure that expenses where GST is not applicable are properly accounted for.

4.1 Accounting staff have been informed of the correct expense payment process where GST is not applicable.

A new internal control function is being created to ensure ongoing compliance with payment processing requirements.

Assistant Deputy Minister Responsible:

Director, Finance & Administration

Due Date:

Updated process – completed
Independent monitoring for compliance – March 31, 2010

6.5 Proactive Disclosure

Observation
Low Risk

Overall, the audit found that travel and hospitality expenses incurred within Infrastructure Canada by senior level employees at the Deputy Minister, Assistant Deputy Minister, and equivalent levels were generally properly disclosed on the INFC website. That being said, the audit also found certain discrepancies, as follows:

Of the 77 travel claims reviewed, 32 claims needed to be disclosed and this requirement was met. However, for nine of these claims, we were not able to reconcile the amount disclosed with the amount claimed. In all nine cases the amount disclosed was higher than the amount claimed. It should be noted that in most cases the differences were not significant (less than 10% of actual costs) and in 3 cases, the difference was $25 or less. These discrepancies were attributed to: data entry error (typo); AMEX fees not accounted for in the claim as is usually the norm, but included in the total amount disclosed; and amounts disclosed that were based on estimated costs as opposed to actual ones. While the discrepancies are considered minimal, they do represent inaccuracies in the information presented on the INFC website.

The audit also noted that expenses for incidentals were usually presented in the "other" category on the INFC website as opposed to under the "meals and incidentals" category. This is likely due to the design of the form used to enter the information on the INFC website. The form labeled the category as "meals" and this leads to entering incidental expenses under "other," however when the "meals" amount is posted, it shows as "meals and incidentals." As a result, for most travel expense reports disclosed on the INFC website, the meals and incidentals expenses are understated while the other expenses are over stated, by the incidental amount.

With respect to hospitality, only two of the ten transactions reviewed needed to be disclosed, of which only one was disclosed on the INFC website. The audit was not able to determine why the transaction was not disclosed, however, this is not considered a systemic issue.

Recommendations Management Action Plan

5.1 The Finance and Administration division should review its proactive disclosure process to:

  • increase the accuracy of the amounts disclosed on the INFC website;
  • document reasons for discrepancies between amounts claimed and amounts disclosed, if applicable; and
  • ensure that incidentals are reported under the appropriate expense category.

5.1 INFC- Finance will consult with other departments, including Transport Canada, to ensure implementation of best practice processes relating to proactive disclosure of travel and hospitality expenses. Employees will be informed of changes made to their claims and that the amounts are properly reflected in the publication.

Assistant Deputy Minister Responsible:

Director, Finance & Administration

Due Date:

March 31, 2010

7 Audit Opinion

The 2005 audit report included 24 recommendations, of which five were scoped-out of the audit as they were no longer applicable. Based on our assessment of the implementation of the remaining 19 recommendations presented in Appendix A, it is our opinion that 12 recommendations have been successfully implemented, while further progress is required for the other seven recommendations. The recommendations made in this audit effectively replace the 2005 recommendations that were not fully implemented. The implementation gaps related to these seven recommendations are summarized in the table below. The table also includes a link to the relevant 2009 recommendations.3

In terms of providing assurance that the previous audit recommendations have addressed the control deficiencies identified in the management of travel and hospitality expenses, and acquisition card transactions, our opinion is the following:

  • Most of the recommendations that have been implemented have addressed the related deficiencies. The only exception is the proactive disclosure of travel expenses for senior level employees. While the Finance and Administration Division have improved the proactive disclosure process, the audit noted certain discrepancies in the amount disclosed.
  • Some control deficiencies still remained in the following areas:
    • The application of Section 32, 34, and 33 of the FAA;
    • The approval and justification of exceptional travel expenses;
    • The maintenance of acquisition cardholder files; and
    • The accounting of GST for acquisition card purchases.
  • Additional areas for improvement are as follows:
    • The process for reviewing financial delegation signature cards should be formalized;
    • The account verification process could be strengthened; and
    • The use of blanket travel authorities should only be used when meeting the requirements of the TB Travel Directive

Audit Recommendations

2005 Audit Recommendation Implementation Gap 2009 Audit Rec.
1. INFC financial management to: Ensure appropriate training with respect to financial responsibilities and the application of policies and legislation for employees and managers who have signing authority to commit funds under section 32 of the FAA and approve travel, hospitality and acquisition card expenditures under section 34, and for employees in the INFC financial group who are ultimately responsible for ensuring compliance of transactions before payment, according to section 33 of the FAA.

The administrative assistants' monthly meetings are used to educate and inform them about Sections 32 and 34, however, the audit found that either these meetings are not held on a monthly basis, or that minutes are not filed for all meetings. The audit found minutes for only five meetings in 2008-2009 and four meetings in 2009-2010. The audit also found that, while these meetings could be an adequate mechanism to communicate updates and ad hoc issues, it is not an appropriate means to train administrative assistants on their financial responsibilities.

Under a new government-wide policy, all managers with financial delegated authority must be certified by the Canada School of Public Services (CSPS). The audit selected a sample of fund centre managers and was able to confirm through the Human Resources Department, that they did successfully complete the CSPS requirements. However, for approximately half of the managers in our sample, there was no evidence in the Finance files showing that such validation had been performed. It is possible that employees are exercising signing authority without having successfully completed the online test.

1.1

1.2

10. INFC financial management to: Ensure that all business travel expense claims are documented and, especially in exceptional cases, that an explanation is provided; if not, they should not be approved.

The audit found instances where exceptional cases were not properly documented and authorized. Please refer to finding 6.2 for more details.

1.4
1.5
2.1

12. INFC financial management to: Ensure that employees and managers in a position of authority make sure the claims are properly and fully completed. As mentioned under recommendation 10 above, the audit found instances where exceptional cases were not properly documented. Please refer to finding 6.2 for more details.

1.4
1.5
2.1

15. INFC financial management to: Ensure that acquisition cardholders and their managers receive training to inform them of the acquisition card's restrictions.

The audit found that there was no formal training in place or formal instruction provided to new acquisition cardholders prior to them receiving their acquisition card. There is also no training given to Fund Centre Managers to inform them of their responsibilities with regard to the management of the acquisition card.

While the audit found that employees generally sign the acknowledgement form mentioned above, there is still a risk that employees sign it without reading the policy.

1.1
21. INFC financial management to: Refuse payment of expenses when they have been made by someone other than the person whose name appears on the card, unless appropriate authorization has been given.

Management had disagreed with this recommendation but had committed to implement a process to ensure that errors or wrongdoing in regard to the use of acquisition cards are detected.

The INFC Acquisition Card Policy states that the acquisition card coordinator has the responsibility to monitor the use of acquisition cards on a regular basis. The acquisition card coordinator has not undertaken a regular monitoring process as outlined in the Policy, but rather relied on the regular review process performed by the financial assistant. This review process consists of ensuring that each transaction has proper coding and supporting documentation. It does not include ensuring proper pre-authorization of purchases and compliance with the TB Acquisition Card Directive. The audit found instances where proper pre-authorization was not done adequately.

3.2
22. INFC financial management to: Ensure that those responsible for coding acquisition cards receive training in accounting coding.

The audit found that there was no formal training in place or information instruction provided to new acquisition cardholders and fund centre managers with respect to financial coding, more specifically GL accounts. Finance has instead published a list of the GL account with their description on the Infranet.

Even though coding errors identified as part of this audit were minimal, financial coding training could be included as part of a training/orientation session for acquisition cardholders.

1.1
24. INFC financial management to: Follow up on the Acquisition Card Acknowledgement and Receipt form and on credit limit increases to ensure that all documentation is complete and has been filled out properly.

While initial acknowledgement letters are generally completed and signed by the acquisition cardholder and his/her manager prior to receiving the card, the audit found instances of credit limit increases without documented authorization supporting the increase. In addition, the audit noted that, in general, acknowledgment letters were not updated when a credit limit was granted. This makes the information on them inaccurate. When no documentation is kept on file to authorize an increase in the acquisition card limit and the acknowledgment letter is not updated either, it is impossible to know if such an increase was indeed authorized.

3.1

8 Statement of Assurance

In our professional judgment, sufficient and appropriate audit procedures have been conducted and evidence gathered to support the accuracy of findings reached and contained in this report. The findings were based on a comparison of the situations as they existed at the time against the audit criteria.

The findings are only applicable for the entity examined. The extent of the examination was planned to provide a reasonable level of assurance with respect to the audit criteria. The evidence gathered meets professional audit standards and is sufficient to provide senior management with proof of the findings derived from the internal audit.

APPENDIX A: FOLLOW-UP ON 2005 AUDIT REPORT RECOMMENDATIONS

2005 Audit Recommendation Assessment Level of Risk

1. INFC financial management to: Ensure appropriate training with respect to financial responsibilities and the application of policies and legislation for employees and managers who have signing authority to commit funds under section 32 of the FAA and approve travel, hospitality and acquisition card expenditures under section 34, and for employees in the INFC financial group who are ultimately responsible for ensuring compliance of transactions before payment, according to section 33 of the FAA.

Partially completed
To implement this recommendation management had committed to:

  • develop detailed procedures on travel, hospitality and acquisition cards;
  • use administrative assistants' monthly meetings as a forum to educate and inform them about Sections 32 and 34, and discuss common problems and errors; and
  • ensure that those with delegated financial authority are certified by the Canada School of Public Services (CSPS).

Two sets of procedures were developed and published on the Infranet. The first set of procedures outlined high-level processes for employees to follow when traveling, acquiring hospitality services, requesting an acquisition card or processing acquisition card monthly statements. The second set of procedures are called administrative procedures; there is one for travel and one for hospitality and they were recently published on the Infranet. They are more complete and detailed than the first ones; they specify procedural requirements, as well as the responsibilities of employees, fund centre managers, fund centre administrators, the accounting operation unit, and the financial assistant. Administrative procedures have not yet been developed for acquisition cards. It should also be noted that having two procedures on the INFC Infranet on the same topic (Travel and Hospitality) both posted under the "procedure" heading may cause confusion for employees. A better distinction could be made by clearly identifying the purpose of each procedure.

The administrative assistants' monthly meetings are used to communicate financial information, however, the audit found that either these meetings are not held on a monthly basis, or that minutes are not filed for all meetings. The audit found minutes for only five meetings in 2008-2009 and four meetings in 2009-2010. The audit also found that, while these meetings could be an adequate mechanism to communicate updates and ad hoc issues, it is not an appropriate means to train administrative assistants on their financial responsibilities.

With respect to the CSPS course and certification for fund centre managers, the audit selected a sample of fund centre managers and was able to confirm, through the Human Resources Department, that they did successfully complete the CSPS requirements. However, for approximately half of the managers in our sample, there was no evidence in the Finance files showing that such validation had been performed. It is possible that employees are exercising signing authority without having successfully completed the online test.

Moderate

6. INFC financial management to: Ensure that invoices are reconciled with AMEX statements periodically, at the very least, before Industry Canada initiates payment of AMEX accounts.

Note: Payment initiation is now done by INFC Finance.

Completed
AMEX statements are generally reconciled monthly within each of the relevant fund centres and approved under Section 34 of the FAA before payment is initiated. That being said, the reconciliation process sometimes takes longer than 30 days, which results in a late payment of the corresponding AMEX statement.
Low
7. INFC financial management to: Document applicable control mechanisms, and roles and responsibilities regarding travel expenditures in a specific internal procedure. Completed

INFC has posted the following policies and procedures on the Infranet:

  • The Departmental Government Travel Cards Policy (March 2007);
  • The Procedures for Travel (Sept. 2008); and
  • The Administrative Procedures for Travel (April 2009).

The Administrative Procedures for Travel specifically address the requirements of the recommendation by defining the responsibilities of each individual involved in the process.

Low

8. INFC financial management to: Discuss with Industry Canada representatives the nature and cause of problems related to late payment on acquisition cards in order to remedy these problems as quickly as possible.

Note: Acquisition card payment is now initiated by INFC Finance.

Completed

INFC has put in place a process to clear and pay acquisition card invoices in a timely mater. The MasterCard billing to INFC is sent electronically to INFC around the 3rd of each month and comprises one invoice for a total of all cardholder purchases for the previous month, along with a detailed sheet for each individual cardholder's charges to support the total billing.

Section 33 is exercised after receiving the signature of Section 34 from the Director, Finance and Administration on the overall invoice. Payment is automatically done on the 10th of each month.

At the same time, details of transactions for each cardholder are sent to them. They reconcile every transaction, provide financial coding and obtain Section 34 authorization from the fund centre managers. They forward the information to Finance with the receipts. Finance then clears the transactions, card by card, in the financial system from the credit card suspense account to each fund centre.

Thus, the current process in place does ensure that acquisition card statements are paid on time as required by the TB policy on Acquisition Cards.

Low
9. INFC financial management to: Ensure that the GST is properly accounted for in the AMEX statements.

Completed

The audit reviewed a sample of AMEX statements and determined that the GST was properly accounted for. The audit also noted that this was a challenging process given how GST information is presented on the AMEX statement.

Low
10. INFC financial management to: Ensure that all business travel expense claims are documented and, especially in exceptional cases, that an explanation is provided; if not, they should not be approved.

Not completed
The audit found instances where exceptional cases were not properly documented and authorized. Please refer to finding 6.2 for more details.

Moderate
12. INFC financial management to: Ensure that employees and managers in a position of authority make sure the claims are properly and fully completed.

Not Completed
The audit found instances where exceptional cases were not properly documented. Please refer to finding 6.2 for more details.

Moderate
13. INFC financial management to: Remind INFC managers to refrain from approving advances because employees can now pay for their travel expenses with assigned government travel credit cards.

Completed
Travel advances are now issued only under exceptional circumstances as employees use government issued travel cards. For the period under review no travel advances were issued.

Low
14. INFC financial management to: Follow-up on advances on a monthly basis.

Completed
There were no travel advances granted during the period in review so no follow-up was necessary.

Low
15. INFC financial management to: Ensure that acquisition cardholders and their managers receive training to inform them of the acquisition card's restrictions.

Partially completed
The TB Acquisition Card Directive requires that the Chief Financial Officer provide training to acquisition cardholders and the INFC Acquisition Card Policy states that the acquisition card coordinator should provide such training. Consistent with the TB directive, the INFC Acquisition Card Directive also requires that employees sign an acknowledgment letter which states that they have read and understood the restrictions and obligations contained in the TB Acquisition Card Directive.

The audit found that there was no formal training in place or formal instruction provided to new acquisition cardholders prior to them receiving their acquisition card. There is also no training given to fund centre managers to inform them of their responsibilities with regard to the management of the acquisition card.

While the audit found that employees generally sign the acknowledgement form mentioned above, there is still a risk that employees sign it without reading the Directive.

Moderate
16. INFC financial management to: Ensure that the INFC financial group and those responsible for acquisitions receive training on the determination and recording of Payables at Year-End (PAYE) to make sure that INFC and TB policies on PAYE are fully applied, particularly the prompt adjustment of accounts at the beginning of the new fiscal year.

Completed
Towards the end of each fiscal year, Finance gives a presentation to the administrative assistants to inform them about the process for the creation of PAYEs and of their responsibilities in that regard. The session is not mandatory but highly recommended, and widely attended. The only minor item missing in the presentation is a point specifying that the GST shall not be included in the PAYE amount, as it does not affect the appropriation. This point may not be fully understood by administrative assistants and could result in PAYEs being overstated. The Accounting Operation and the Financial and Analysis groups are responsible to manage and clear the PAYE at the beginning of the fiscal year. Monthly follow-up on outstanding PAYE is done with fund centre managers through the financial status report (FSR) process.

Low
17. INFC financial management to: Confirm travel expenses before posting them on the INFC website by reconciling them with those recorded in the INFC financial system.

Completed
Finance has defined procedures for the proactive disclosure of travel expenses. The information from the original travel claims are compared to the information in the INFC financial system. A validation and approval by the appropriate ADM or Associate ADM is sought prior to posting information on the INFC website.

Low
18. INFC financial management to: Indicate the GST separately for transactions posted on the INFC website so as to reconcile them with those in the INFC financial system, where the GST is entered separately.

Completed
The TB Guidance Document on Proactive Disclosure for Travel and Hospitality Expenses does not exclude GST from the total cost to be disclosed for travel and hospitality. The INFC website for proactive disclosure of travel and hospitality clearly indicates all amounts disclosed include GST. The audit reviewed a sample of transactions and confirmed that GST was indeed included in the amount posted.

Low

19. INFC financial management to: Provide more details in the INFC financial system so that the transactions can be linked to the employees concerned.

Note: This refers to travel expenses for proactive disclosure purposes.

Completed
The audit was not able to determine if more details were indeed provided in the INFC financial system. However, as mentioned under recommendation #17, Finance has defined procedures for the proactive disclosure of travel expenses, which includes comparing the information from the original travel claims to the information in the INFC financial system. As such, this recommendation is considered completed.

Low

20. INFC financial management to: Confirm hospitality expenses before posting them on the INFC website by reconciling them with those recorded in the INFC financial system.

Completed
Finance has defined procedures for the proactive disclosure of hospitality expenses. The information from the original hospitality claims are compared to the information in the INFC financial system. Then, a validation and approval by the appropriate ADM or Associate ADM is sought prior to posting information on the INFC website.

Low

21. INFC financial management to: Refuse payment of expenses when they have been made by someone other than the person whose name appears on the card, unless appropriate authorization has been given.

Note: There were issues in the process at the time of the audit that resulted in late payments and blocked cards, leading to cardholders of a blocked card to use somebody else's card to pay for purchases, and authorization was not always properly documented. A new process for the payment of acquisition cards was implemented in October 2005 to eliminate late payments and blocked cards. As a result, nobody should have to use anyone else's card except their own.

Partially Completed
Management had disagreed with this recommendation but had committed to implement a process to ensure that errors or wrongdoing in regard to the use of acquisition cards are detected.

The INFC Acquisition Card Policy states that the acquisition card coordinator has the responsibility to monitor the use of acquisition cards on a regular basis. The acquisition card coordinator has not undertaken a regular monitoring process as outlined in the Policy, but rather relied on the regular review process performed by the financial assistant. This review process consists of ensuring that each transaction has proper coding and supporting documentation. It does not include ensuring proper pre-authorization of purchases. The audit found instances where proper pre-authorization was not done adequately.

Moderate

22. INFC financial management to: Ensure that those responsible for coding acquisition cards receive training in accounting coding.

Partially Completed
The audit found that there was no formal training in place or information instruction provided to new acquisition cardholders and fund centre managers with respect to financial coding, more specifically GL accounts. Finance has instead published a list of the GL accounts with their description on the Infranet.

Even though coding errors identified as part of this audit were minimal, financial coding training could be included as part of a training/orientation session for acquisition cardholders.

Low

23. INFC financial management to: Ensure follow-up on the coding of purchases made with acquisition cards when pre-auditing purchases made with acquisition cards.

Completed
After reviewing a sample of acquisition card reports, the audit found that financial coding checks were done on a regular basis by the financial assistant. When errors are found, they are either corrected directly or sent to the appropriate fund centre for correction. Coding errors have occurred occasionally, sometimes due to entry errors (typos) or to the cardholder's misinterpretation of how a specific expense should be coded.

Low

24. INFC financial management to: Follow up on the Acquisition Card Acknowledgement and Receipt form and on credit limit increases to ensure that all documentation is complete and has been filled out properly.

Not completed
The audit found that initial acknowledgement letters are generally completed and signed by the acquisition cardholder and his/her manager prior to receiving the card. However, the audit found instances of credit limit increases without documented authorization supporting the increase, and noted that, in general, acknowledgment letters were not updated when a credit limit was granted. This makes the information on them inaccurate. When no documentation is kept on file to authorize an increase in the acquisition card limit and the acknowledgment letter is not updated either, it is impossible to know if such an increase was indeed authorized.

Moderate
  • [1] At the time of the audit, INFC was outsourcing its accounting and contractual operations to Industry Canada by means of a service agreement.
  • [2] The Departmental Audit Committee at that time was comprised of INFC senior management; it is now comprised of four external members (including the Chair).
  • [3] Numbers reflect only the seven recommendations from the 2005 audit that have not been fully implemented.
Date modified: