Follow-up Audit of the Diplomatic Mail Service

Final Report

Global Affairs Canada
Office of the Chief Audit Executive

February 8, 2016

Executive Summary

Diplomatic mail services were identified as a key area of risk in the Department of Foreign Affairs, Trade and Development’s (now known as Global Affairs Canada, the Department) 2015-2018 Risk-based Audit Plan. The purpose of this audit is to provide assurance on the adequacy and effectiveness of controls for the diplomatic mail services, including improvements made in response to the recommendations of the 2013 Audit of Diplomatic Mail Services.

Diplomatic mail is an important internal service for carrying out the Government of Canada mandate abroad. As defined in the Vienna Convention on Diplomatic Relations, it is a means to exchange official correspondence between a government and its representative missions abroad. The responsibility for diplomatic mail services is delegated to the Department in the Policy on Government Security.

The administration of mail and distribution services between Headquarters and missions is the responsibility of the Distribution and Diplomatic Mail Services (AAG) of the International Platform Branch.  The mail and distribution service, in conjunction with international security, developed a diplomatic mail policy to ensure the safety and security of information and assets for missions abroad. It is the responsibility of each mission to ensure the policy is adhered to and respected.  The Diplomatic Distribution Services unit (AAGD) within AAG is the main carrier of diplomatic mail for all federal government departments, ensuring the secure transportation of information and material between Headquarters and missions abroad, and between missions. Goods and equipment that support mission operations are also shipped abroad through this service.

There are two types of diplomatic mail services: Unclassified and Classified. The Unclassified Diplomatic Mail Service is used for the transmission of information and assets identified as UNCLASSIFIED or PROTECTED A. Integrity bags are tamper-proof bags that are used to ship IT equipment from HQ to missions. These tamper-proof bags are shipped within *** bags. These are unaccompanied, labeled airfreight bags, sent via private sector carriers with service on regular commercial aircraft. The Classified Diplomatic Mail Service is exclusive to *** bags. This service is used for the transmission of information and assets identified as PROTECTED B, PROTECTED C, CONFIDENTIAL, SECRET or TOP SECRET. These are accompanied, labeled bags travelling by hand with a designated departmental courier who holds a TOP SECRET security clearance, and who maintains effective control of the bags at all times in order to maintain the security chain and ensure the integrity of the diplomatic bags.

The original objective of this audit set out in the Risk-based Audit Plan was to follow-up on the recommendations of the 2013 Audit of Diplomatic Mail Services.  The audit scope was modified to assess the diplomatic mail services at missions abroad because diplomatic mail is an international service whereby missions are one of the primary clients and also have a direct responsibility regarding the secure movement and safeguarding of information and assets. The audit focused on processes and operating procedures with regard to diplomatic mail services, including:

• Roles and responsibilities to ensure compliance and security of individuals and safeguarding of diplomatic mail and GAC assets during their transport through the diplomatic mail service;
• Adequacy of training for those individuals with responsibilities for diplomatic mail;
• Effectiveness and efficiency of the controls of the diplomatic mail service; and
• Monitoring and oversight.

The Unclassified Diplomatic Mail Service (*** bags) and the Memorandum of Understanding between the Department and the Foreign and Commonwealth Office of the United Kingdom for diplomatic mail services were excluded from the scope, as they do not represent the same level of risk to the Department.

The Treasury Board Policy on Internal Audit and international audit standards require auditors to assess the risk of fraud throughout the planning and the examination phases of an audit. This audit meets this requirement however the audit procedures were not designed to uncover instances of fraud, including those specifically resulting from collusion.

Results of the Audit:

The audit team found that satisfactory improvements were made in response to the 2013 Audit of Diplomatic Mail Services. Recommendations were met and controls were implemented to properly secure information and assets. To ensure the continued adequacy and effectiveness of the controls safeguarding diplomatic mail, the Department should consider: making diplomatic mail training mandatory for mission staff responsible for diplomatic mail; developing, implementing and updating mission-specific procedures for classified diplomatic mail, in accordance with the Department’s policies; and finalising the AAG organisational chart structure, including job descriptions, which will help with their support to departmental employees.

Statement Of Conformance

In my professional judgment as Chief Audit Executive, the audit was conducted in conformity to the Institute of Internal Auditors’ International Standards for the Professional Practice of Internal Auditing and the Internal Auditing Standards for the Government of Canada, as supported by the results of the quality assurance and improvement program.  Sufficient and appropriate audit procedures were conducted and evidence gathered to support the accuracy of the findings and conclusion contained in this report, and to provide an audit level of assurance.   The findings and conclusion are based on a comparison of the conditions, as they existed at the time of the audit, against pre-established audit criteria that were agreed upon with management.  The findings and conclusion are applicable only to the entity examined, for the scope and period covered by the audit.

Chief Audit Executive

1. Background

Diplomatic mail services were identified as a key area of risk in the Department of Foreign Affairs, Trade and Development’s (now known as Global Affairs Canada, the Department) 2015-2018 Risk-based Audit Plan. The effective delivery of diplomatic mail services supports the secure management of information and assets, and helps mitigate security and reputational risks for the department.  This audit engagement is intended to provide assurance on the adequacy and effectiveness of controls of the diplomatic mail service, including improvements made in response to the recommendations of the 2013 Audit of Diplomatic Mail Service.

As defined in the Vienna Convention on Diplomatic Relations, diplomatic mail is a means to exchange official correspondence between a government and its representative missions abroad. It is a key administrative service for carrying out the Government of Canada’s mandate abroad. The responsibility for diplomatic mail services is delegated to the Department through the Policy on Government Security.

The administration of mail and distribution services, both at Headquarters and at missions around the world, is the responsibility of the Distribution and Diplomatic Mail Services (AAG) of the International Platform Branch. As prescribed by the Policy on Government Security, AAG is the main carrier of diplomatic mail for all federal government departments, ensuring the secure transportation of information and material between Canada and missions abroad, and also between missions. The unit within AAG responsible for classified diplomatic mail is the Diplomatic Distribution Services unit (AAGD).

There are two types of diplomatic mail services: Unclassified and Classified. The Unclassified Diplomatic Mail Service is used for the transmission of information and assets identified as UNCLASSIFIED or PROTECTED A. These are unaccompanied, labeled airfreight bags, sent via private sector carriers with service on regular commercial aircraft. Integrity bags are tamper-proof bags that are used to ship IT equipment from HQ to missions. These tamper-proof bags are shipped within *** bags.

The Classified Diplomatic Mail Service is exclusive to *** bags. This service is used for the transmission of information and assets identified as PROTECTED B, PROTECTED C, CONFIDENTIAL, SECRET or TOP SECRET. These are accompanied, labeled bags travelling by hand with a designated departmental courier who holds a TOP SECRET security clearance, and who maintains effective control of the bags at all times in order to maintain the security chain and ensure the integrity of the diplomatic bags.

The AAG provides Classified Diplomatic Mail Service to 134 missions abroad and has distributed more than 34,000 units over the past two years. There are three types of delivery models for the transmission of classified diplomatic mail: AAG diplomatic couriers; Ad Hoc couriers; and agreements with Commonwealth countries, such as the United Kingdom. The AAG couriers are the Department employees cleared to TOP SECRET who are responsible for escorting classified (***) diplomatic bags. Occasionally, diplomatic material may be transported by Ad Hoc couriers (other Canada-based Staff with Top Secret clearance) to complement the diplomatic courier service. Ad Hoc couriers are used in cases of emergency, in cases where special credentials are required and difficult to obtain, and/or for service to smaller missions with limited Canada-based staff. Similarly, the Government of Canada has formal and informal agreements with the United Kingdom, Australia and New Zealand whereby the governments agree to share diplomatic mail services for cost-saving purposes or for delivery to countries where access is difficult to obtain.

All recommendations from the 2013 Audit of Diplomatic Mail Services were included in the scope of this audit. In addition, the audit scope was expanded to include roles and responsibilities, reporting relationships and escalation procedures, and physical safeguards at missions. Diplomatic mail is an international service beyond Headquarters, which was the focus of the 2013 audit. Missions are one of the primary clients and participants. A significant portion of the diplomatic mail delivery process occurs at missions and, as a result, it is important that controls are in place to ensure the continued integrity of the bags.

The Unclassified Diplomatic Mail Service (*** bags) and the Memorandum of Understanding between the Department and the Foreign and Commonwealth Office of the United Kingdom for diplomatic mail services were excluded from the scope as they do not represent the same level of risk to the Department.

2. Observations and Recommendations

The audit team examined the diplomatic mail services offered by AAGD, the unit responsible for this service, based on the criteria described in Appendix A. To do so, the auditors interviewed AAG management and staff, as well as Domestic Security, IT Security, and Financial Operations management. The audit team also conducted mission visits to seven countries to examine the physical safeguards in place to protect diplomatic mail and interview mission staff. Videoconference calls were conducted with an additional seven missions (see Appendix C). Finally, documentation relevant to the diplomatic mail delivery system was examined. Based on this work, observations and recommendations were made and developed; they are detailed below.

2.1 Follow-up of the 2013 Audit of Diplomatic Mail

The objective of the previous Audit of Diplomatic Mail Services (the 2013 audit) was to provide reasonable assurance on the adequacy and effectiveness of controls in place at Headquarters to protect the integrity of the diplomatic mail service. To determine whether the mail distribution centre was secure and not vulnerable to loss of assets, information and records, the audit examined preventative and detective controls related to physical layout, access controls, and personnel security. The audit resulted in the following recommendations: 

1. Information and assets should be processed and stored in an area with the appropriate level of security;
2. Surveillance cameras should be installed inside both the security and high security zones for continuous monitoring;
3. Access should be recorded and videotape records are retained for approximately 3 to 6 months;
4. The list of individuals authorized to access the mail facilities should be regularly monitored and updated;
5. Remedy should be implemented to provide an audit trail and formal procedures to monitor, review and detect access to the IT system should be put in place;
6. Financial Operations, Domestic and International Division (SMFF) should develop, implement, and communicate procedures and guidelines for transferring funds via diplomatic bags; and
7. Mission staff responsible for diplomatic mail should have access to similar training, tools and resources available at Headquarters.

At the conclusion of the 2013 audit, management agreed to all recommendations and prepared a Management Action Plan in response. Measures were taken to implement these changes. The audit team’s work confirms that all measures listed in the Management Action Plan were put in place. The information below describes how the audit team reached its conclusion.

In order to determine whether the above physical controls were implemented, the auditors conducted a walk-through of the AAG Mail Distribution Centre. Following the 2013 audit, AAG constructed a high secure zone (vault) for storing classified mail and an adjacent secure zone (annex) for receiving and processing mail. The audit team found that for both the vault and the annex, access is limited to essential employees and restricted and monitored by an authentication system, alarms, and surveillance cameras (Closed-circuit television – CCTV). A review of the most recent videotape records confirmed that the CCTV cameras’ records in the vault and annex were retained for over 100 days.

To ensure that access to the classified mail facilities is restricted, AAG management maintains a list of authorized personnel which is reviewed and updated on a monthly basis. A weekly access log is provided by Domestic Security (JSCD) and cross-referenced by AAG with the list of authorized personnel. In addition, non-authorized personnel entering the restricted area must be escorted and must fill out a sign-in sheet, which is also regularly monitored by AAG.

The process for restricting and monitoring access to the vault and staging area is documented in one of the three Standard Operating Procedures (SOPs) developed by AAG. The two other SOPs cover the processes for receiving and shipping diplomatic mail. These documented procedures are concise and updated regularly to reflect procedural changes. Furthermore, whenever changes are made, AAG management requires that employees read and sign the updated documents to ensure that new procedures are agreed to and understood.

The audit team also examined the physical safeguards in place at missions to protect classified diplomatic mail. For the seven missions visited, the audit team found that access to mail facilities, classified information and sensitive access was physically restricted and limited to authorized individuals. In an effort to expand the number of missions included in the audit, a checklist inquiring as to the physical safeguards to protect diplomatic mail at missions was sent to seven additional missions. The self-reported information corroborated audit team’s observations at the missions visited.

Remedy Software is an application used by AAG internal staff and clients to process and track diplomatic mail shipments. The system provides an audit trail that can be queried to report on selected information. Its implementation was one of the recommendations of the 2013 audit. Remedy has since been implemented at Headquarters, as well as Washington, Bogota, and Mexico.

Another one of the recommendations from the 2013 audit was that the Financial Operations (SMFF) develop written procedures for transferring funds. The purpose of these procedures is to provide guidance on determining whether funds should be shipped via diplomatic mail or transferred electronically, and on preparing and safeguarding funds and material sent to the Cashier’s Office. Guidelines were developed by SMFF in accordance with this recommendation, and were communicated to missions in September 2014. SMFF is currently updating these procedures, which will be published on the Intranet, once approved.

The final recommendation of the 2013 audit was that the Department provide mission staff with access to similar training, tools and resources as those available at Headquarters. Within GAC, guidance on the diplomatic mail service is primarily provided through the AAG Intranet web page, which includes relevant policies, guidelines, and useful links. It also includes contact information for the AAG Distribution Center, should employees have any enquiries. In addition, AAG offered webinar training to missions in March and June 2013 (23 sessions in total) and reported that the overall participation rate was 85% (131 missions were invited, and 111 attended). The audit team reviewed the PowerPoint presentation that was used for this webinar and concluded that it was clear and comprehensive. As well, diplomatic mail training was also offered in May 2014 to Foreign Service Administrative Assistants. Evaluations from this training indicated that participants found it to be useful and understandable.

However, interviews with mission staff indicated a disparity in levels of training. Nine out of fourteen mission employees interviewed indicated that they had not received any formal training on diplomatic mail. It should be noted though that seven out of those nine employees indicated that they had either received on-the-job training or a copy of the PowerPoint presentation used in the AAG webinar.

In the absence of formal training on diplomatic mail for mission staff involved in or responsible for handling *** bags, there is a risk that the practices and procedures outlined in the GAC Policy on Diplomatic Mail (the policy) may not be adhered to or consistently applied by staff. An example of this need for formal training relates to forms that ensure good control over the bags. As prescribed by the policy, there are two key forms that must be completed and must accompany *** bags during their transportation. The first is a Diplomatic Mail Schedule (DMS), which consists of a list of all materials (and corresponding barcodes) contained inside the diplomatic bag. The DMS allows AAG and clients to track the items included in the diplomatic bags. The second form is the Diplomatic Courier Service Waybill, which lists the serial numbers and weight of each bag included in a shipment. The Waybill is necessary to facilitate border security and customs procedures for the courier while in transit. For the sample missions, the audit team reviewed the most recent DMS and Waybill produced by the missions. This examination revealed that the majority of documentation was not in compliance with the policy. One out of fourteen missions was not aware that the Waybill was required, and the remaining missions did not fill it out correctly (ex. not properly signed and/or dated). In addition, one CBS responsible for handling diplomatic mail was not aware that the DMS form was required and six missions did not correctly complete the form (ex. incomplete sender information and/or missing lever lock number). AAG is aware of these issues and maintains a non-conformance log with a list of errors made on DMS forms received from missions. In addition to the issues identified by the audit team, AAG has also noted incidents such as missing clerk names, wrong label classification, and missing tracking numbers. There is a risk that a lack of proper documentation will make it difficult for AAG to trace *** bags in the event of loss or theft, and demonstrates the need for diplomatic mail training for mission staff. To mitigate this risk, audit team noted that AAG mail clerks review the DMS and Waybill forms and provide feedback to missions in effort to improve the quality of the documentation.

Recommendation #1:

The Assistant Deputy Minister, International Platform Branch, should ensure that diplomatic mail training is made mandatory for Management and Consular Officers and any other mission staff responsible for diplomatic mail. In addition, training packages should be provided to missions to allow them to train new staff after rotations, and to be used as refreshers for current staff.

2.2 Roles and responsibilities

2.2.1 Roles and responsibilities at missions

Missions are responsible for their own incoming and outgoing diplomatic mail and must ensure that all classified (***) bags are opened and closed by Canada-based staff (CBS). Depending on the size and structure of the mission, the diplomatic mail duties are performed by various employees including the Management Consular Officer (MCO), the Deputy MCO, the Mission Security Officer (MSO), the Military Police Security Specialist (MPSS) or the Head of Mission’s Administrative Assistant.

For the sample of missions selected, the audit team conducted interviews with staff responsible for diplomatic mail and found that roles and responsibilities were clearly understood, mostly based on the individual’s experience in previous postings. Only six out of fourteen employees responsible for diplomatic mail reported receiving handover notes on diplomatic mail procedures and/or overlapping with their predecessor, while others did not receive any formal communication of their diplomatic mail duties.

Although the majority of employees interviewed reported having previous experience handling diplomatic mail, certain duties and processes vary from mission to mission, based on the size of the mission and local airport regulations. As per the policy, missions must ensure that proper procedures are in place to dispatch and receive diplomatic mail shipments. However, the audit found that only six out of the fourteen missions included in the audit sample had mission-specific procedures related to classified mail. Furthermore, an examination of these mission-specific procedures revealed varying levels of length, detail, and comprehensiveness. For example, some procedures included the notification sent by AAG, the list of prohibited items, and how to number and label *** bags, while others only covered procedures related to the airport.

Each mission has unique circumstances due to location, size, and security that can impact the diplomatic mail process. Given these differences and the rotational nature of mission staff, it is important that mission-specific procedures are in place to clearly assign and define roles and responsibilities for all mission staff involved. In the absence of mission-specific procedures, there is a risk that the controls outlined in departmental policies are not applied, increasing the risk of loss or theft of classified information and assets.

Recommendation #2:

The Assistant Deputy Minister, International Platform Branch, in consultation with Geographic ADMs, should ensure that mission-specific procedures for classified diplomatic mail are developed, implemented and kept up-to-date to reflect missions’ structures and GAC policy.

2.2.2 Roles and responsibilities at Headquarters

The Diplomatic Distribution Services (AAGD) is the unit within AAG that is responsible for the provision of Diplomatic Mail Services for GAC and other partners at Headquarters and missions abroad. AAGD has the ultimate authority for determining which items may be included in the diplomatic bag and ensuring compliance with international laws, the Vienna Convention, and GAC policies.

In order to support the effective delivery of diplomatic mail services, AAGD should have a clearly defined delineation of responsibilities and lines of communication. Interviews with AAGD staff and management and review of documentation indicated delays in decision-making processes within AAGD. These were reported to have an impact on the quality of service provided to some missions, who also reported experiencing slow responses from AAGD.

In addition, interviews indicated that AAGD management and staff understand their roles and responsibilities, even though not all job descriptions were current. While job descriptions for the diplomatic couriers were up-to-date, job descriptions for supporting staff did not reflect the work being done. Clearly defined roles and responsibilities within AAGD will allow it to better coordinate activities with clients and respond to their requests in a timely manner. At the time of the audit, Distribution and Diplomatic Mail Services was being restructured and, as such, the organizational structure and job descriptions were being reviewed.

Recommendation #3:

The Assistant Deputy Minister, International Platform Branch, should ensure that the AAG organisational chart is finalised and approved and that it clearly communicates roles and responsibilities, in order to support effective and timely decision-making and improve services to clients.

3. Conclusion

The audit team found that satisfactory improvements were made in response to the 2013 Audit of Diplomatic Mail Services. Recommendations were met and controls were implemented to properly secure information and assets. To ensure the continued adequacy and effectiveness of the controls safeguarding diplomatic mail, the department should consider: making diplomatic mail training mandatory for mission staff responsible for diplomatic mail; developing, implementing and updating mission-specific procedures for classified diplomatic mail, in accordance with GAC policies; and finalising the AAG organisational chart, including job descriptions, which will help with their support to departmental employees.

Appendix A: About the Audit

Audit Objective

The objective of this audit was to provide assurance on the adequacy and effectiveness of controls of the Diplomatic Mail Services, including improvements made in response to the recommendations of the 2013 Audit of Diplomatic Mail Service.

Audit Scope

This audit examined processes and operating procedures with regards to diplomatic mail services from June 2013 to October 2015. The scope of the audit covered the following areas:

• Design of processes, roles and responsibilities to ensure compliance and security of individuals and safeguarding of diplomatic mail and GAC assets during their transport through the diplomatic mail service;
• Adequacy of training for those individuals with responsibilities for diplomatic mail;
• Effectiveness and efficiency of the controls of the diplomatic mail service; and
• Monitoring and oversight.

All recommendations from the 2013 Audit of Diplomatic Mail Service were included in the scope of this audit. Unclassified Diplomatic Mail Services (*** bags), the Memorandum of Understanding between the Department and the Commonwealth Office of the United Kingdom of Great Britain and services to other departments were excluded from the scope of this audit as they did not represent a high risk to the department.

The Treasury Board Policy on Internal Audit and international audit standards require auditors to assess the risk of fraud throughout the planning and the examination phases of an audit. This audit meets this requirement however the audit procedures were not designed to uncover instances of fraud including those specifically resulting from collusion.

Audit Criteria

The criteria were developed following the completion of a detailed risk assessment and considered the core management controls from the Audit Criteria related to the Management Accountability Framework, developed by the Office of the Comptroller General, Treasury Board Secretariat. The audit criteria were discussed and agreed upon with the auditees. The detailed criteria are presented as follows:

1.0 Recommendations from the 2013 Audit of Diplomatic Mail Service have been addressed.

2.0 Governance, authorities, roles and responsibilities for diplomatic mail activities are well defined and communicated at headquarters and in missions.

3.0 All mission staff involved in the diplomatic mail process is provided with the training, tools, resources and information to support the discharge of their responsibilities.

4.0 Controls, including a tracking system, are in place to ensure anomalies are identified, reported and escalated to the appropriate authority in a timely and compliant manner.

5.0 Controls are in place to ensure that classified information is protected (from loss and inappropriate access) and is in compliance with policies and directives.

Audit Approach and Methodology

The Follow-up Audit of Diplomatic Mail was conducted in accordance with Treasury Board Policy on Internal Audit, Directives, and the Internal Audit Standards for the Government of Canada and conforms to the International Standards for the Professional Practice of Internal Auditing of the Institute of Internal Auditors.

In order to conclude on the above criteria and report against the audit objective, the audit methodology included, but was not limited to, the following work:

• Identifying key internal controls and assessing their effectiveness;
• Performing walk-through;
• Reviewing documentation;
• Conducting interviews with management and operations staff; and,
• Conducting field visits to interview mission staff and identify key controls at missions.

Appendix B: Sampling Methodology

In order to determine which missions to be included in the field visits, the audit team developed four selection criteria. The following criteria were established based on areas of risk identified through consultation with the audit entity, as well as documentation review.

Criteria for Mission Selection

Sampling Criteria

1. The volume of Classified Mail sent to and from missions, between April 2013 and March 2015:

1. Number of *** Bags received by each mission;
2. Number of *** Bags sent by each mission;
3. Number of Integrity Bags received by each mission; and

2. The number of Funds in Transit transactions between April 2013 and March 2015

1. The number of transactions, by mission.
2. The total value of these transactions, by mission.

3. The number of errors made by missions when shipping diplomatic mail, based on AAG’s Non-Conformance Log for the period April 2013 and March 2015.

1. Number of incidents; and
2. The number of runs with incidents

4. The number of CBS and LES employees at the mission.

The audit team began the mission identification exercise by narrowing the scope of missions to those that have been identified as receiving and sending classified diplomatic mail. Classified diplomatic mail includes both *** bags and integrity bags.

The criteria for selection further continued based on the number of Funds in Transit transactions conducted by each mission. Funds in Transit is the process through which missions send and receive cash and other financial instruments. The transmittal of cash through diplomatic *** bags is an important consideration due its high risk and materiality. Certain missions, especially those located in cash-based societies, transmit significant amounts of cash through diplomatic mail. The audit team acquired a list of all missions that used the Funds in Transit process in the past two fiscal years, as well as the value of these transactions in Canadian dollars.

A third criteria used for mission selection was the number of known errors that missions had made when preparing and sending diplomatic mail over the past two fiscal years. Distribution and Mail Services (AAG) has kept a “Non-Conformance Log” where they recorded each incident whereby a diplomatic bag was improperly prepared by a mission. Examples of non-conformance include: placing an incorrect label, not including a Diplomatic Mail Schedule (DMS) in a *** Bag, or failing to barcode the items in the bag.

Finally, the audit team also took into consideration the number of CBS staff at each mission. The Policy on Diplomatic Mail requires that only CBS handle and open *** diplomatic bags and Integrity bags. Missions that have a limited number of CBS staff may be at higher risk of not complying with these policy requirements.

Selected Missions

Based on the above criteria, the following 14 missions were judgmentally selected:

Mission visits:

• Abu Dhabi
• Bogota
• Nairobi
• Quito
• Warsaw
• London
• Hong Kong

Video-conferences:

• Port-au-Prince
• Beijing
• Abidjan
• Accra
• Singapore
• Havana
• Tokyo

Representativeness

• The missions selected are in North America, Caribbean, South America, Europe, Africa and Asia.
• These 14 missions are of varying size, as indicated by the number of CBS posted at each mission. The number of CBS staff varies from 4 to 67 employees.
• The missions selected are also representative of the two types of diplomatic mail delivery models. In addition, Hong Kong is one of the two designated “hub” missions for diplomatic mail delivery.
• Approximately 24% of all classified diplomatic mail sent by missions in 2013-2015 was sent from these 14 missions.
• Approximately 22% of all classified diplomatic mail received by missions in the same period was sent from these 14 missions.
• The missions selected also conducted approximately 27% of Funds in Transit transactions between 2013 and 2015. The value of these transactions was more than $15.9 million, which represents approximately 34% of the total value of Funds in Transit transactions for that period.
• Lastly, approximately 29% of the non-conformance incidents in 2013-2015 occurred in these 14 missions.

Appendix C: Management Action Plan