Audit of Common Services Delivery Points

Final report

Global Affairs Canada
Office of the Chief Audit Executive

Tabling Date
June 2019

Acronyms and Symbols

AAO

Mission Procurement Operations

ACM

International Platform Branch

AFD

Client Relations and Missions Operations Bureau

AFS

Mission Operation, Policies and Innovation

CFO

Chief Financial Officer

CFSI

Canadian Foreign Service Institute

CO

Commitment Order

CSDF

Common Services Delivery Framework

CSDP

Common Services Delivery Point

FAA

Financial Administration Act

FAS

Financial and Administration System

FAS/MM

Financial and Administration System Material Management Module

FCO

Finance Control Officer

FINSTAT

Financial status

FSM

Finance Section Manager

FTE

Full-Time Equivalent

HLD

Locally Engaged Staff Bureau

HOM

Head of Mission

HQ

Headquarters

HR

Human Resources

ISP

Internet Service Provider

IT

Information Technology

KR

Standard invoice

LES

Locally Engaged Staff

MCO

Mission Consular Officer

MITNET

Multi-User Integrated Telecommunications Network

MRO

Mission Request Online

P2P

Procure to pay tool

RCRB

Regional Contract Review Board

RE

Purchase order based invoice

SCM

Corporate Planning, Finance and Information Technology (Chief Financial Officer)

SLA

Service Level Agreement

SMFF

Financial Operations, International

SPA

Specified Purpose Account

Executive Summary

In accordance with Global Affairs Canada’s approved 2018-19 Risk-based Audit Plan, the Office of the Chief Audit Executive conducted an audit of Common Services Delivery Points (CSDPs).

Why it is important

Global Affairs Canada uses CSDPs to provide standardized financial services; contracting and procurement; and Locally Engaged Staff human resources (HR) services to missions in countries across the world. In fiscal year 2017-18, all seven CSDPs were primarily responsible for processing 232,000 financial transactions for the 178 missions abroad, for a total value of approximately $916 million.

The services delivered by CSDPs have components that must comply with key legislation and specific regulatory and policy requirements. The effective provision of services by CSDPs is essential to missions who rely on these services to carry out their operations. The CSDP model, which has not yet been fully implemented, is designed to enhance economies of scale, increase internal controls, and improve risk mitigation. The Department is responsible for ensuring that CSDP activities are well managed and that suitable controls are in place and working as intended.

What was examined

The objective of the audit was to assess whether Global Affairs Canada’s Common Services Delivery Points provide services to Canada’s mission network effectively in support of the strategic business needs of the Department. The audit assessed roles and responsibilities with respect to CSDP implementation and operation; CSDPs service delivery progress with respect to the Financial Services, Contracting and Procurement, and Locally Engaged Staff Human Resources Services business lines; standardization of business processes and tools, including Information Technology solutions; and monitoring and reporting practices to measure overall performance. The audit focused on the Department’s CSDP operations for fiscal years 2017-18 and the first six months of fiscal year 2018-19. Interviews were conducted and documentation was reviewed up to and including December 2018. CSDP practices and controls at headquarters and missions were included in the scope of the audit. More details about the audit objective, scope and criteria are presented in Appendix A.

What was found

Global Affairs Canada cannot demonstrate that the CSDPs are providing services to Canada’s mission network effectively in support of the Department’s strategic business needs. Key objectives to measure the implementation of the CSDP model, based on the Common Services Delivery Framework, have also not yet been achieved:

• Standardization of business processes, including the implementation of information technology solutions, is still underway;
• Roles, responsibilities, and accountabilities of CSDPs still need to be clarified for some elements; and
• Cost efficiencies have not been identified since the Department did not yet develop a costing methodology in order to determine costs and savings to the Department as a whole for CSDP model implementation as well as the ongoing costs of CSDP operations over time.

For the governance of the CSDPs, the audit team found that high-level roles, responsibilities, and accountabilities were generally defined and communicated. However, specific roles and responsibilities between the CSDPs and their client missions are unclear at the operational level. The CSDPs have also not signed Service Level Agreements (SLAs) with all their client missions and did not complete the development of service standards for the three business lines, which prevents them from measuring their service delivery and making adjustments when required. In addition, the Department did not develop a methodology to measure the full cost of CSDP operations. Therefore, the Department cannot identify the financial impact of the rationalization of the CSDP and determine if it has the right number of CSDPs in the appropriate locations.

Regarding the implementation of the CSDP model and the standardization of business processes, the audit team found that the CSDPs have fully implemented the financial services business line by July 2018, as committed, but not the other two business lines. The audit team also found a significant number of errors across the CSDPs. Consequently, the Department may be issuing payments that are unauthorized, not compliant or unsupported. The nature and the number of errors shows that the Department did not yet achieve the level of standardization it had planned for the CSDPs, which creates operational efficiency issues.

At the strategic level, the Department is regularly monitoring the progress of CSDP implementation through senior management committees, but, at the operational level, functional authorities and CSDPs focus more on the timeliness of processing than on the quality of service provided by CSDPs to their client missions. Senior management was informed regularly on CSDP implementation progress, but the information provided lacks details on productivity and efficiency of service delivery and on whether the objectives are being achieved.

Recommendations

Recommendation #1

The Assistant Deputy Minister of International Platform (ACM), in collaboration with functional leads and other relevant stakeholders, should:

• Clarify and document specific roles and responsibilities at the operational level;
• Ensure that all Service Level Agreements have been completed and signed in a timely manner; and
• Revisit the CSDP staffing model to reflect the volume and complexity of transactions and services.

Recommendation #2

To ensure that all CSDPs are fully operational within a reasonable timeframe, the Assistant Deputy Minister of International Platform (ACM) should:

• Establish clear timelines and deliverables;
• Track progress against these measures; and
• Take corrective actions if the outcomes cannot be achieved as planned.

Recommendation #3

The Assistant Deputy Minister of International Platform (ACM), in collaboration with functional leads and other relevant stakeholders, should ensure that:

• CSDPs and their client missions strengthen their internal controls to reduce the number of errors and the risk of non-compliance with the Financial Administration Act and applicable contracting and procurement policies.
• Standardized tools are clear, complete, up-to-date, easily available, and not duplicated.

Recommendation #4

The Assistant Deputy Minister of International Platform (ACM), in collaboration with functional leads and other relevant stakeholders, should develop standards related to the quality of service provided by CSDPs and monitor them on a regular basis.

Recommendation #5

The Assistant Deputy Minister of International Platform (ACM), in collaboration with functional leads and other relevant stakeholders, should ensure that the Executive Committee and senior management receive complete information about the Common Services Regionalization Phase II to ensure it is meeting its objectives and to inform decision-making.

Statement of Conformance

In my professional judgment as the Chief Audit Executive, this audit was conducted in conformance with the Institute of Internal Auditors' International Standards for the Professional Practice of Internal Auditing and with the Treasury Board Policy and Directive on Internal Audit, as supported by the results of the quality assurance and improvement program. Sufficient and appropriate audit procedures were conducted, and evidence gathered, to support the accuracy of the findings and conclusion in this report, and to provide an audit level of assurance. The findings and conclusion are based on a comparison of the conditions, as they existed at the time, against pre-established audit criteria that were agreed upon with management and are only applicable to the entity examined and for the scope and time period covered by the audit.

1. Background

1.1 Introduction

In accordance with Global Affairs Canada’s approved 2018-19 Risk-based Audit Plan, the Office of the Chief Audit Executive conducted an audit of Common Services Delivery Points (CSDPs).

The CSDPs, initiated as a result of the Department’s strategic review in 2007, were created in 2011-2012 within a select group of missions to provide consolidated service delivery of transactional functions related to finance. This service delivery model was designed to enable the standardization of service delivery to client missions, increase internal controls, and risk mitigation. This approach leverages the concept of regionalization and seeks to align service delivery between headquarters (HQ), regional points of services, and missions.

1.2 Departmental Context

Previously, a traditional “boutique” service delivery format was scattered across 178 missions, where each mission had a finance section that provided financial services, accounting operations, budgeting support, and financial reporting, both to HQ and to mission management. Since then, the CSDPs have been developed and implemented in two phases.

CSDP Phase I

The implementation of CSDP Phase I consolidated the “boutique“ model of financial services delivery to 16 points of service. This first step started in 2010 and allowed the Department to leverage economies of scale and provided equal access to subject matter experts across the missions’ network.

CSDP Phase II

In October 2016, under the renamed Common Services Delivery Framework (CSDF), the CSDP Phase II was launched. It involved further consolidation from 16 points of service to seven. These CSDPs are hosted in existing Canadian missions in the following cities where they service the 178 missions: Berlin, Brussels, Delhi, London, Manila, Mexico, and Washington. Phase II also added two new business lines to the already existing financial services: contracting and procurement, and locally engaged staff (LES) human resources (HR) services.

When fully implemented, it is anticipated that each of the seven CSDPs will provide specific and standardized financial services, contracting and procurement, and LES HR services to approximately 25 missions each. Details on the specific missions allocated to each CSDP are presented in Appendix B.

The International Platform branch (ACM) is responsible for the implementation and acts as a functional lead for the Contracting and Procurement business line. Corporate Planning, Finance and Information Technology (SCM) and Human Resources (HCM) branches provide support to the International Platform branch through their role as functional leads for the Financial Services and the LES HR Services business lines respectively. More details on the roles and responsibilities of key stakeholders are presented in Appendix C.

As per the Common Services Delivery Framework, a single and consolidated model for service delivery will allow the International Platform branch (ACM) and the CSDPs to:

• Standardize business processes and procedures;
• Clarify roles, responsibilities and accountabilities;
• Leverage new electronic tools;
• Reinvest cost efficiencies in the International Platform branch (ACM); and
• Better share expertise across the network.

An overview of general and business line specific elements for each CSDP, with their associated relative rankings is presented in Appendix D.

Exhibit 1 below defines the common services delivery through the three business lines of the CSDP model.

Exhibit 1: CSDP Services by Business Line

Current Status of CSDPs

CSDP Phase II is still in the process of being implemented. As presented in Exhibit 2 below, the Financial Services business line has been fully implemented, the Contracting and Procurement business line has been partially implemented, and the LES HR Services business line has only been implemented in one location and is currently under review.

Exhibit 2: Status of implementation as at 31 December 2018

CSDP Staff and Transactional Service Output

Based on information available, the seven CSDPs consist of approximately 138 full-time equivalent (FTE) positions, which are divided amongst Canada-based staff (AS-07 supervisory roles, FI-03, and FI-02 supervising the Financial Services business line) and LES either leading or supporting the three CSDP business lines. Specifically, the CSDP manager receives functional direction from International Platform (ACM) and the Office of the Chief Financial Officer (CFO) at HQ, but reports within the mission framework. The functional managers of the three business lines of the CSDPs generally report to the CSDP manager, but receive functional direction from their functional leads at headquarters. The Head of Mission (HOM) of a CSDP host mission is accountable for the delivery of the CSDP Program, consistent with other programs at the mission. The HOMs of client missions remain accountable for decision-making and management authorities in their missions. CSDP HOMs are not accountable for client mission resources. More details on the CSDP resource structure are presented in Appendix E.

2. Observations and Recommendations

This section sets out key findings and observations, divided into three general themes addressing the CSDP governance, the implementation of the CSDP model and the standardization of business processes and tools, and monitoring activities and reporting on results.

2.1 CSDP Governance

According to Global Affairs Canada’s Common Services Regionalization Phase II Business Case, standardized Service Level Agreements (SLAs) are to be established between CSDPs and their client missions to ensure accountability in service delivery, determine service delivery standards as well as allow for transparency and consistency in CSDP governance. The SLAs includes a standard covering agreement and three annexes containing the mission-specific details on the three business lines: Annex A for Financial Services, Annex B for Contracting and Procurement, and Annex C for LES HR. The CSDPs had until May 2018 to implement all SLAs with their client missions, including the covering agreement and the three annexes.

2.1.1 Roles, responsibilities and accountabilities

The audit team expected that roles, responsibilities, and accountabilities related to CSDPs would be clearly defined and communicated, and that CSDP staff would have the competencies to discharge their responsibilities.

The audit team found that the high-level CSDPs’ roles, responsibilities, and accountabilities have generally been defined and communicated. The Department defined high-level roles and responsibilities for the different stakeholders, including the CSDPs and the different branches at missions and HQ, in the Program Support – Roles and Responsibilities Snapshot. This document has been communicated through the CSDP Client Portal.

However, specific roles and responsibilities between the CSDPs and with their client missions are unclear at the operational level. The SLAs provide an overview of the respective roles and responsibilities of the CSDPs and their client missions at the operational level, but they are not specific enough. The audit team found four areas where roles and responsibilities were unclear.

• Reporting relationships: The audit team found that reporting relationships for the Finance Section was not consistent between CSDPs.  Finance Section Managers in four out of seven CSDPs are CBS (FI-03) while the other three are LES (LE-09). The CBS (FI-03) report to the CSDP Executive Director (EX MCO) while the LES (LE-09) report to the CSDP Operations Managers (AS-07). As a result, the responsibility for the Financial Services business line is not consistently managed by the same position which may lead to confusion. At a meeting in Brussels in October 2018, CSDP Operations Managers determined that it was necessary to revisit the CSDP reporting and operational structure to clarify reporting relationships. It is scheduled to be done by March 31, 2019. 
• Financial coding: Section 34 of the FAA certification authority requires that the financial coding has been provided and is accurate and complete.  Section 33 of the FAA payment authority requires that the payment will not result in an unlawful charge against the appropriation. CSDPs stated that they are not responsible for reviewing the accuracy of financial coding entered by client missions. Therefore, they are not ensuring that the financial coding is accurate (See Exhibit 5, error #4).
• Compliance with departmental directive: The audit team found a number of instances where the transactions did not comply with the Directive on Recording of Contracts in the Financial and Administrative System Material Management Module (See Exhibit 6, error #6). SLAs are silent on whether the CSDP or the client mission is responsible for ensuring that transactions meet the Directive. Consequently, neither the CSDPs nor the client missions play an oversight role to ensure compliance.
• Prevention and detection of fraud: It was reported at the meeting of CSDP Operation Managers in Brussels in October 2018 that CSDPs’ role and responsibilities related to the prevention and detection of fraud needs to be more explicit. Mission Operation, Policies and Innovation (AFS) and Financial Operations (SMD) have been tasked to clarify the role of CSDPs regarding fraud prevention and detection and determine the appropriate level of resources needed to fully integrate this function going forward by September 30, 2019.

The audit team also found that CSDP staff have been adequately trained to discharge their responsibilities. For example, CSDP employees received financial training from the Canadian Foreign Service Institute (CFSI) and contracting and procurement training from Mission Procurement Operations (AAO). However, although mandatory for Sections 32 and 34 of the Financial Administration Act (FAA), the Department does not currently require its financial staff to get training for Section 33 payment authority of the FAA, which provides the authority to pay expenditures after ensuring that the payment is a lawful charge against an appropriation. Each of the CSDPs has a Finance Section Manager and a Financial Control Officer who approved approximately 232,000 transactions in 2017-18. These financial managers/officers have a specimen signature card giving them delegated authority for Section 33 Payment Authority. The audit team found that five out of these 14 employees had not completed the Authority Delegation Training Validation Certification for Managers. Considering the high volume of transactions approved and the high error rates, as discussed in detail later in the report, the Department should consider providing mandatory training to these CSDP financial personnel.

2.1.2 Service Level Agreements

The audit team expected that the CSDPs would be operating with current and signed SLAs with all client missions to ensure accountability for service delivery. The audit team also expected the CSDPs to have put in place clearly defined service standards that meet quality service delivery to client missions.

The audit team found that the signed SLAs were generally consistent with the current SLA template. However, the CSDPs did not yet have signed SLAs with all their client missions. Records from Client Relations and Mission Operations (AFD) show that there should be a total of 178 SLAs currently in place between the CSDPs and their client missions. As of November 2018, the CSDPs had signed 122 Annex A (Financial Services) SLAs, 37 Annex B (Contracting and Procurement Services) SLAs, and no Annex C (LES HR Services) SLAs. More details on the signed SLAs are presented in Exhibit 3. The CSDPs stated that some SLAs are still in the process of being signed by their client missions, but that they have all been distributed. The lack of signed SLAs in place may increase the risk that client missions may not receive the level of service they are supposed to receive and may have to do tasks that would normally be handled by the CSDP.

Exhibit 3: Number of SLAs signed between the CSDPs and their client missions as of November 16, 2018

The audit team also found that the Department developed service standards for two of the three CSDP business lines. Within the SLAs, the annexes for each of the three business lines outline the ‎specific services to be delivered by the CSDPs, their service standards, and their accountabilities. Annex A (Financial Services) includes 32 services while Annex B (Contracting and Procurement Services) includes 11 and Annex C (LES HR Services) 19 for a total of 62 services. However Annex C (LES HR Services) is still in draft form. The audit team found that 27 CSDP services have clearly defined standards (20 for Annex A and seven for Annex B). Service standards were not applicable for 19 CSDP services (12 for Annex A, four for Annex B, and three for Annex C). Service standards were not in place for the remaining 16 services in Annex C.  Without service standards in place for Annex C, the CSDPs cannot measure the quality of their LES HR service delivery and determine whether adjustments are required. See Exhibit 4 for details.

Exhibit 4: Number of Services with and without Service Standards by Business Line

2.1.3 CSDP Model and Assumptions

The Department attempted to be responsive to operational realities on the ground at missions by generally adapting the CSDP model accordingly. Costing was one of the key factors in determining where the CSDPs would be located. It represented 20% of the evaluation criteria. In addition, one of the objectives of the CSDPs was to reinvest cost efficiencies into the International Platform. Therefore, it was expected that the Department would measure and track the costs of CSDP operations in order to assess the financial impact of the CSDP model. Since the start of Common Services Delivery Phase II, the Department did not develop a methodology to measure the full cost, both direct and indirect, of CSDP operations. Until fiscal year 2017-18, the CSDPs did not have dedicated fund centres in place to track their direct costs. Instead, the CSDPs entered their direct costs under fund centres associated with their host mission. 

During fiscal year 2017-18, the CSDPs partially tracked their direct costs under dedicated fund centres. Some CSDPs, such as CSDP London and CSDP Berlin, tracked most of their direct costs under these fund centres while others, such as CSDP Washington and CSDP Manila, only tracked a small portion of their direct costs under these fund centres. Mission Operation, Policies and Innovation (AFS), the functional lead for CSDP, had not provided clear directions to CSDPs to track all direct costs under these fund centres. Consequently, the Department does not know what the full cost was to operate CSDPs for fiscal year 2017-18. For fiscal year 2018-19, the CSDPs have started to systematically enter their direct costs under the dedicated fund centres. However, these fund centres do not yet track the full costs of the CSDPs since they do not include indirect costs, such as rent. If the Department cannot determine the full cost of operation for CSDPs, it is not possible to identify the financial impact of the rationalization of the CSDP and determine if it has the right number of CSDPs in the appropriate locations. If there are any plans to modify or consolidate existing locations, the Department will need to have detailed costing information to make informed decisions moving forward. The Department is planning to establish a costing methodology for the CSDP model by end of March 2020.

The current CSDP model assumes that the level of staffing is irrespective of the volume and nature of services delivered. In 2016, the Department established a staffing model and set staffing levels that the CSDPs needed to implement and achieve. The audit team found that the current staffing levels in the CSDPs are consistent with the staffing model, with the recent addition of an Operations Assistant position for each CSDP. However, the staffing model does not take into consideration the differences in volume and complexity of processed transactions by CSDPs, as some CSDPs process significantly more transactions than others with similar staffing levels. For example, in 2017-18, CSDP Brussels processed 39,568 financial transactions while CSDP Delhi processed 25,908 financial transactions. This could impact the quality and timeliness of services delivered.

Recommendation #1

The Assistant Deputy Minister of International Platform (ACM), in collaboration with functional leads and other relevant stakeholders, should:

• Clarify and document specific roles and responsibilities at the operational level;
• Ensure that all Service Level Agreements have been completed and signed in a timely manner; and
• Revisit the CSDP staffing model to reflect the volume and complexity of transactions and services.

2.2 Implementation of the CSDP Model and standardization of business processes

2.2.1 Business Line #1: Financial Services

It was expected that the Financial Services business line would be functioning as designed and providing efficient services to the client missions. The Financial Services business line includes three services: banking and bank reconciliations, payments and revenues, and financial data entry into the Financial and Administration System (FAS). More details on the CSDP accounts payable process are presented in Appendix F. The audit team found that the CSDPs have fully implemented the Financial Services business line by July 2018, as committed in the Common Services Regionalization Phase II Business Case submitted to the Executive Committee in September 2016. However, the CSDPs are not achieving the quality of service necessary to ensure that financial transactions are properly processed.

To measure the quality of service provided by the CSDPs for the Financial Services business line, the audit team selected a judgmental sample of 20 transactions composed of 10 purchase order (PO) based invoices (RE) and 10 standard invoices (KR) for each of the seven CSDPs for a total of 140 transactions processed by the CSDPs between April 1, 2018, and September 30, 2018.

The audit team reviewed the documentation supporting the 140 transactions to assess the effectiveness of the controls that the CSDPs put in place before issuing payments. The audit team tested whether the transactions were:

• Properly authorized with respect to Sections 33 and 34 of the FAA;
• Paid in accordance with departmental policies and directives;
• Properly documented to support the payment; and
• Coded in FAS in accordance with departmental policies and procedures and consistent with the nature of the transactions.

According to Global Affairs Canada’s General Financial Operations guidelines, “the documents scanned and recorded in the P2P tool, in support of payment requests or other financial transactions, which may include an invoice, a contractual agreement or any other substantiating document approved under Section 34 of the FAA, will be used in the account verification process.” The audit team re-performed an account verification to ensure that the transactions sampled were valid and accurate under Sections 33 and 34 of the FAA. The audit team found 32 samples where it was not possible to complete the account verification with the information available within FAS. Of these 32 samples, 12 were processed by Global Affairs Canada on behalf of the Department of National Defence.  Corporate Planning, Finance and Information Technology (SCM) is working in collaboration with different stakeholders to provide guidance to CSDPs on how to process these transactions.

For the remaining samples, the audit team found a total of 39 errors. There were 36 samples with errors: 33 contained one error while three included more than one.  The CSDPs issued payments on these transactions despite the errors found. The audit team found four types of errors in reviewing its sample of payment transactions:

• Section 33 of the FAA;
• Section 34 of the FAA;
• Supporting documentation; and
• Financial coding.
• Complete descriptions of these errors are presented in Appendix G.

The results by type of errors by CSDP can be found in Exhibit 5 below:

Exhibit 5: Type of Errors by CSDP for Financial Transactions

To reduce the error rates, the Department could assess the possibility of integrating additional automatic controls within the financial system. For example, a financial officer who does not have authority to sign Section 34 of the FAA would be automatically blocked by the financial system and would not be able to proceed with the transaction.

It should be noted that the Department considers Section 34, policy compliance errors, and adequate supporting documentation to be critical errors. However, it classifies miscoding as non-critical, except when the transaction is not coded to the proper fiscal year. The audit team found two cases where transactions were not coded to the right Vote (e.g. coding an expense under a capital vote). These types of errors could have a significant impact on managing the Department’s appropriations. Therefore, the Department should reconsider how these types of errors are classified.

2.2.2 Business Line #2: Contracting and Procurement

It was expected that the Contracting and Procurement business line would be rolled out and functioning as planned. The Contracting and Procurement business line includes three common services to be delivered by CSDPs: Regional Contract Review Board (RCRB) for procurement oversight, procurement data entry into FAS, and procurement transactions and support under the lowest international Trade Agreement threshold signed by Canada with the other countries. 

The CSDPs have not fully implemented the Contracting and Procurement business line by July 2018, as committed in the Common Services Regionalization Phase II Business Case submitted to the Executive Committee in September 2016. At the time of the audit, the Contracting and Procurement business line has only been fully implemented in two CSDPs (CSDPs in London and Mexico) and partially implemented in the other five (CSDPs in Berlin, Brussels, Delhi, Manila, and Washington). The Department reviewed the business lines’ progress in May 2018 and no longer committed to a fixed date of implementation. Therefore, the Department does not know when the Contracting and Procurement business line will be fully implemented across the seven CSDPs.

The audit team found that the CSDPs are not achieving the quality of service necessary to ensure that procurement transactions are properly processed. Out of the 140 samples, 87 had a contracting component. As shown in Exhibit 6 below, the audit team found 30 errors. For 16 samples, the audit team could not complete the testing because documentation was incomplete or unclear. The most common error was whether or not a purchase order had been issued for purchases over $2,000 (Error #6). It is unclear whether the responsibility to make this determination resides with the client mission or the CSDP because the Procurement and Contracting Services business line was not implemented in all the CSDPs when these transactions were processed. Regardless of the lack of clarity in responsibilities, these transactions are still non-compliant with the Directive on Recording of Contracts in the Financial and Administrative System Material Management Module (FAS/MM). The audit team found two types of errors in reviewing its sample of contracting and procurement transactions:

• Section 41 of the FAA; and
• Purchasing instrument.

More details on the descriptions of these errors are presented in Appendix H.

Exhibit 6: Type of Errors by CSDP for Transactions with a Contracting Component

The Department could assess the possibility of integrating additional automatic controls within the financial system to reduce the error rates. For example, the financial system could automatically prevent the same individual from signing Section 34 and 41 of the FAA.

2.2.3  Business Line #3: Locally Engaged Staff (LES) Human Resources (HR) Services 

The audit team expected that the LES HR Services business line would be rolled out and functioning as planned. The LES HR Services business line was scheduled to be fully implemented across all CSDPs by July 2018, but, at the time of the audit, it had not been implemented.

The audit team found that the Department has defined the LES HR services that the CSDPs will be offering to their client missions. The plan for the LES HR Services business line is to include two services: staffing transactions and support, classification and organizational design transactions and support. However, the LES HR services are scheduled to be clarified and re-assessed by December 2019. Nevertheless, CSDP London is currently offering the services that were originally planned by the Department. 

Since 2010, the Department has been unable to implement the CSDP model it envisioned. Given the expected deadline for completion has not yet been determined, it has now been nine years since the beginning of Phase I. Other countries have managed to implement similar models between two and five years. 

2.2.4 Standardization of Business Processes and Tools 

It was expected that the standardization of business processes and tools would be achieved as planned to support the realization of efficiencies and economies of scale. It was also expected that technology would be available for CSDPs in all geographic areas in support of the CSDP Framework. 

The audit team found that the Department does not have a centralized repository to provide consistent, accurate, and easy to find tools on CSDP business lines delivery. Tools are scattered across multiple locations (e.g. intranet; wiki pages; and the Department’s repository for tools and guidance needed for employees to do their work, commonly referred to as Modus) and are not necessarily up-to-date. This can result in missing, inaccurate or inconsistent information about policies and procedures needed by both operational and mission staff in order to carry out their responsibilities consistently. Until fiscal year 2018-19, some CSDPs had their own wiki pages that included tools for their client missions, but many of them were missing, outdated or non-functional. Mission Operation, Policies and Innovation (AFS) is currently leading a working group to complete the implementation of a CSDP Client Portal to consolidate the individual CSDP wiki pages in order to standardize the tools. At the time of the audit, the individual CSDP wiki pages were still online and included duplicate information with the currently running CSDP Client Portal, which is slowing down standardization.

There are a number of key Information Technology (IT) solutions required to enable standardization and delivery of the three business lines. These solutions and the implementation status of four of them are presented in Appendix I. The Department has developed IT solutions for the three business lines, but some of them are still in development and not ready for roll-out. The IT solutions related to the Financial Services business line have achieved a higher level of standardization since it is the only business line that has been fully implemented. The standardized approach is for the CSDPs to use the Financial Administration System (FAS) to keep record of the financial information and for the client missions to use the Procure to Pay tool (P2P) to send payment invoices to be processed by the CSDPs. For the other two business lines, the Department did not standardize the IT solutions across the CSDPs. For the Contracting and Procurement business line, the Department is currently developing Phase II of Mission Request Online (MRO) to track contracting transactions. The second phase of the MRO’s implementation is currently not done. Once in place for procurement, MRO will allow for data about contracting transactions to be pulled from the system. For the LES HR Services business line, CSDP London is currently using an applicant tracking system and recruiting software (AMRIS) to manage the staffing process, but this IT solution has not been implemented to the other CSDPs yet. Until all of these IT solutions reach their final state, manual practices are used, which impacts operational efficiency and effectiveness and increases the risk of error. The Department could also assess the possibility of further enhancements to the functionality of key IT solutions in order to leverage opportunities to improve efficiency.  For example, the P2P tool could be used beyond its current main purpose as a means to scan documents electronically. 

The audit team also found that the CSDPs and their client missions do not have consistent bandwidth access to operate effectively, either via terrestrial link, virtual satellite, and/or Internet Service Provider (ISP). CSDPs and their client missions have different levels of connectivity because they have different needs. For example, smaller missions with fewer positions may not require a Multi-User Integrated Telecommunications Network (MITNET) as an ISP link is sufficient to meet their needs. Network latency can delay the connection speed for users around the world and slow down processing, which would affect the effectiveness of operations. For those missions that use MITNET, the Department is scheduled to upgrade their connection speed before the end of 2019.

Recommendation #2 

To ensure that all CSDPs are fully operational within a reasonable timeframe, the ADM of International Platform (ACM) should:

• Establish clear timelines and deliverables;
• Track progress against these measures; and
• Take corrective actions if the outcomes cannot be achieved as planned.

Recommendation #3

The Assistant Deputy Minister of International Platform (ACM), in collaboration with functional leads and other relevant stakeholders, should ensure that:

• CSDPs and their client missions strengthen their internal controls to reduce the number of errors and the risk of non-compliance with the Financial Administration Act and applicable contracting and procurement policies.
• Standardized tools are clear, complete, up-to-date, easily available, and not duplicated.

2.3 CSDP Monitoring and Measurement of Performance

2.3.1 Monitoring

The audit team expected that monitoring mechanisms would be in place to track CSDP performance. At the strategic level, Mission Operation, Policies and Innovation (AFS), as the primary coordinator of the CSDP initiative is responsible for monitoring the progress of the implementation of the Common Services Delivery Phase II model as it is rolling out. At the operational level, the functional authorities at HQ are responsible for monitoring the CSDPs’ performance to ensure that the CSDP model is achieving its goals and serving its intended purposes. The seven CSDPs are also responsible for monitoring their own operations to ensure that the requests they are processing are legitimate while complying with departmental policies. Overall, the Department has implemented mechanisms to track CSDP performance, but improvements are needed.

At the strategic level, the audit team found that Mission Operation, Policies and Innovation (AFS) is regularly monitoring the progress of Common Services Delivery Phase II through its involvement in the CSDP Steering Committee and the CSDP Management Board. As the chair of both entities, Mission Operation, Policies and Innovation (AFS) oversees and guides common services delivery abroad while working with the functional authorities at HQ.

For the Financial Services business line, Financial Operations – International (SMFF) is the functional authority responsible for tracking the volume of payments via Business Warehouse (BW) that each CSDP processes for their client missions. The audit team found that Financial Operations – International (SMFF) created a comprehensive and detailed monitoring framework designed to assess whether CSDPs and client missions are following policies regarding financial transactions. However, this framework was used only once since its inception. The resulting report indicated that there was an overall error rate of 25% in transactions reviewed while the maximum tolerable error rate set by Financial Operations – International (SMFF) is 5%.

Financial Operations – International (SMFF) has also created Management Dashboards providing a monthly summary of key performance metrics for all seven CSDPs, such as volume of transactions, type, and average processing time. These dashboards are available on the CSDP Client Portal. While the CSDP Management Dashboards measure key indicators against service standards found in the SLAs, they focus more on the timeliness of processing with limited information on the quality of service, such as the reliability of advice and compliance with policies. If the Department does not measure the quality of service, it cannot determine if and where improvements are required.

For the contracting and procurement and the LES HR services, Mission Procurement Operations (AAO) and the Locally Engaged Staff Bureau (HLD) are the respective functional authorities to monitor these two business lines. Given the extent of these two business lines implementation, only some CSDPs have formalized monitoring activities. There are currently very few SLAs in place for these two business lines to allow for service standards to be monitored. For example, CSDP London is producing quarterly reports that compile data on transaction processed, missions served, Regional Contract Review Boards (RCRB) approvals, sole source contracts, competitive contracts, and contracts referred to them. CSDP London is also the only CSDP delivering the LES HR services business line. They have an IT solution called AMRIS that provides them with reports on the number of resumes screened and the number of competitions by region, by missions, and by HR staff. Without effective monitoring across all CSDPs where implementation has occurred, the CSDPs cannot measure their service delivery and determine whether adjustments are required.

The CSDPs, as the payment authority for Section 33 of the FAA, have to review payment requests received from their client missions to ensure that there are no errors. More detail on the results of the initial review by CSDPs of payment transactions by accounts payable assistants is presented in Appendix J. When a request does not meet submission requirements, the CSDPs do not process the payment and note the error type using P2P before returning the request to the client mission for further clarification. The Record of Errors is important because it can be used to identify the most frequent errors, the client missions who submitted the documentation, the identification of training opportunities, and to establish risk profiles for client missions for use by both CSDP and Financial Operations – International (SMFF). However, the CSDPs are not using the Record of Errors to aggregate the data and produce trend analyses that could allow them to take corrective action to lower the occurrences of the common errors. The audit team analyzed the nature and extent of errors across the CSDPs and found that the error rates and the relative nature of errors were inconsistent between the CSDPs. The Department will need to understand these variations in order to better manage critical errors such as unauthorized, non-compliant or unsupported payments and to ensure a more standardized delivery of services.

The audit team expected that high risk transactions would all be reviewed before being processed by the CSDP. More detail on the results of high risk transactions reviewed by CSDP finance staff is presented in Appendix K. From all high risk transactions reviewed by the Department, 108 of these high risk transactions were also part of the audit team’s sample. The audit team consistently found a higher or the same number of errors than the CSDPs for these 108 high risk transactions. In total, the CSDPs identified five errors while the audit team identified 31 errors. Exhibit 7 presents a comparison of errors found by the CSDPs and the audit team for the 108 high risk transactions.

Exhibit 7: Errors identified by the CSDPs vs. Errors identified by the Audit team

A lack of due diligence in the CSDP review of high risk transactions may result in undetected critical errors where payments are either not authorized, non-compliant with policies or not properly supported.

2.3.2 Reporting

It was expected that periodic reporting on CSDP achievements would be provided to senior management to assess the effectiveness of the CSDP model.

Beginning in 2016, International Platform (ACM) and Corporate Planning, Finance and Information Technology (SCM) have been reporting regularly to the Executive Committee and senior management through reports and presentations on the Common Services Regionalization Phase II, including CSDPs’ status, challenges, and implementation progress. The Executive Committee used the information received for decision-making. However, the audit team found that the information reported, while accurate, lacks some details. The Common Services Regionalization Phase II Business Case includes objectives and a list of success indicators. Financial Operations – International (SMFF) provides the number of transactions and the time it takes to process them, but Mission Operation, Policies and Innovation (AFS) does not provide aggregated results against these objectives and indicators, such as productivity and efficiency of service delivery, which would inform senior management that the Common Services Regionalization Phase II is achieving its intended purpose. If the Executive Committee and senior management do not get complete information, they may not be sufficiently informed to oversee progress and take the most effective corrective actions to ensure that the Common Services Regionalization Phase II is achieving its objectives.

Recommendation #4

The Assistant Deputy Minister of International Platform (ACM), in collaboration with functional leads and other relevant stakeholders, should develop standards related to the quality of service provided by CSDPs and monitor them on a regular basis.

Recommendation #5

The Assistant Deputy Minister of International Platform (ACM), in collaboration with functional leads and other relevant stakeholders, should ensure that the Executive Committee and senior management receive complete information about the Common Services Regionalization Phase II to ensure it is meeting its objectives and to inform decision-making.

3. Conclusion

Global Affairs Canada cannot demonstrate that the CSDPs are providing services to Canada’s mission network effectively in support of the Department’s strategic business needs. Key objectives to measure the implementation of the CSDP model, based on the Common Services Delivery Framework, have also not yet been achieved:

• Standardization of business processes, including the implementation of Information Technology solutions, is still underway;
• Roles, responsibilities, and accountabilities of CSDPs still need to be clarified for some elements; and
• Cost efficiencies have not been identified since the Department did not yet develop a costing methodology in order to determine costs and savings to the department as a whole for the CSDP model implementation as well as the ongoing costs of CSDP operations over time.

The audit identified opportunities for improvement with respect to CSDP roles and responsibilities, the establishment of clear timelines and deliverables for the implementation of the CSDP model, and the monitoring and reporting of CSDP performance.

Appendix A: About the Audit

Objective 

The objective of the audit was to assess whether Global Affairs Canada’s Common Services Delivery Points (CSDPs) provide services to Canada’s mission network effectively in support of the strategic business needs of the Department. The audit included an assessment of the following areas:

• Roles and responsibilities with respect to CSDP implementation and operation;
• CSDPs service delivery progress with respect to the Financial Services, Contracting and Procurement, and LES HR Services business lines;
• Standardization of business processes and tools, including Information Technology solutions; and,
• Monitoring and reporting practices to track performance

Scope 

The audit generally focused on the Department’s CSDP operation for fiscal year 2017-2018 and the first six months of fiscal year 2018-19. Interviews were conducted and documentation was reviewed up to and including December 2018. CSDP practices and controls at headquarters and at missions were included in scope of the audit.  

Based on the planning interviews and analysis conducted by the audit team, services that required global consistency and/or unique expertise are either maintained at mission level or repatriated back to headquarters. Therefore, these aspects are considered out of scope. Specifically, this audit excluded the following aspects: LES labour relations, mission procurement over RCRB thresholds, Foreign Service Directive (FSD) administration, and inventory management. 

With respect to the Financial Services business line, the audit focused primarily on payment transactions and did not examine bank reconciliations, journal vouchers, and accounts receivable. For the Contracting and Procurement and the LES HR business lines, the audit team was limited to the level of implementation at the time of the audit. 

For the transaction review, the audit team selected a judgmental sample of 20 transactions composed of 10 purchase order (PO) based invoices (RE) and 10 standard invoices (KR) for each of the seven CSDPs for a total of 140 transactions processed by the CSDPs between 1 April and 30 September 2018. Standard invoice (KR) transactions focused on those not subject to exemption under the Directive on Recording of Contracts in the Financial and Administrative System Material Management Module (FAS/MM).

Criteria

The criteria were developed following the completion of the detailed risk assessment and considered the audit criteria related to the Management Accountability Framework developed by the Office of Comptroller General of the Treasury Board Secretariat. The audit criteria were discussed and agreed upon with the auditees. The detailed criteria are presented as follows.

Approach and Methodology

In order to conclude on the above criteria, and based on identified and assessed key risks and internal controls associated with the related business processes, the audit methodology included, but was not limited to the following:

• Identify and review relevant regulations, policies, and directives, and guidelines and operational standards on CSDP;
• Gain an understanding of relevant processes and systems, as well as identify key risks and controls
• Conduct walkthroughs of sampled CSDP processes and systems of implemented business lines in order to identify and assess the effectiveness of key controls;
• Interview key departmental stakeholders and CSDP staff;
• Perform data analysis and tested through file review, a judgemental sample of 140 transactions consisting of  20 transactions from each of the seven CSDPs, using the following selection criteria:
  • Ten KR transactions with the highest value from different General Ledger (GL) accounts;
  • Five RE transactions with the highest value from different GL accounts;
  • The three highest value transactions related to hospitality; and
  • The two highest value transactions related to travel.
• Perform analysis of related financial and non-financial information related to CSDP operations; and
• Apply other relevant methods as deemed necessary by the audit team.

Appendix B: Mission Listing by CSDP

Appendix C: Roles and Responsibilities of Key Stakeholders

International Platform Branch (ACM)

The ACM branch is responsible for coordinating the implementation of the CSDP model and acts as a functional lead for Procurement and Contracting. The Client Relations and Missions Operations Bureau (AFD) has a leadership role for the CSDPs, ensuring consistency and coherence of their implementation, reporting on progress, ensuring alignment of CBS and LES resources and leading overall communications. AFD also is responsible for allocating the CSDP budgets and is accountable for the use of these resources. The Platform Corporate Services (AAD) is the functional lead for the Contracting and Procurement business line.

Corporate Planning, Finance and Information Technology Branch (SCM)

The SCM branch acts as finance functional lead and is also responsible for implementing and maintaining the IT tools used by the CSDPs. The Financial Operations Bureau (SMD) is functional lead for the Financial Services business line. This includes all required tools, templates, business processes, training content, monitoring and performance measures specific to their function. Information Management and Technology (SID) supports the development and implementation of tools used by the CSDP such as Finance Administration System (FAS), Mission Request Online (MRO) and Financial Reporting initiatives, and provides advice and guidance on technological solutions.

Human Resources Branch (HCM)

The Locally Engaged Staff Bureau (HLD) of the HCM branch is the LES Human Resources functional lead, playing a role in providing advice and training to CSDP personnel.

CSDP Host Missions

The CSDP host missions are accountable for ensuring that the CSDP Program is fulfilling its mandate to provide services to the client missions under their responsibility, including the host mission themselves as a client. HOMs of the CSDP host missions play a leadership role in the implementation of the Common Services Delivery Framework.

Other Stakeholders

• CSDP Client Missions: CSDP client missions receive services from the CSDPs. HOMs of client missions are responsible for implementing the Common Services Delivery Framework for their own mission as a CSDP client. They play the lead role in communicating the impacts of CSDP consolidation to CBS and LES staff at mission.
• Canadian Foreign Service Institute (CFSI): in conjunction with the functional leads at HQ, CFSI develops ongoing training packages and programs, for all staff at CSDPs and at client missions.

Appendix D: General and Business Line Specific Elements for each CSDP

Appendix E: CSDP Resource Structure

Appendix F: Accounts Payable Process Flowchart

Appendix G: Key Error Descriptions, Findings, and Impacts for all Sample Payment Transactions

The audit team defined five key potential error types that could have been identified in the review of all types of sample transactions:

• Error #1 - Section 33 of the FAA: The CSDPs are responsible to exercise Section 33 of the FAA, which provides the authority to pay expenditures after ensuring that the payment is a lawful charge against an appropriation. They have to ensure Section 33 is signed by officials with the proper authority. The audit team found instances where Section 33 was performed by an individual before the effective date of his/her signature card and/or the signature card was not in FAS. If Section 33 is not performed by an authorized official, the CSDPs may be issuing unlawful and fraudulent payments.
• Error #2 - Section 34 of the FAA: Client missions are responsible to exercise Section 34 of the FAA, which certifies that goods or services have been received as contracted. The CSDPs have to ensure that client missions have properly exercised Section 34 before issuing payment, including signature by officials with the proper authority. The audit team found instances where officials signed for a fund centre over which they do not have the authority. If the CSDPs are issuing payments without Section 34 being properly performed by client missions, the Department may be paying for goods and services it did not fully receive and/or that do not match what was contracted.
• Error #3 - Supporting documentation: The CSDPs have to ensure that each transaction includes all the relevant supporting documentation and that the information is accurate before issuing payments. The audit team found the following instances: illegible invoices, the amount of the invoice did not match the amount paid, and the vendor name did not match the information on the invoice. If the CSDPs do not ensure the accuracy and completeness of the supporting documentation, it may be issuing payments for items or services that have not been obtained or provided.
• Error #4 - Financial coding: The CSDPs have to ensure that client missions are coding transactions under the proper fiscal year and General Ledger (GL) account before issuing payments. The audit team found numerous transactions that were not coded properly. If the CSDPs do not ensure that transactions are coded properly, it may lead to improper charges to incorrect accounts and inaccurate FINSTAT (Financial Status) reports, which could result in errors in the Department’s financial planning and monitoring.

Appendix H: Key Error Descriptions, Findings and Impacts for Procurement and Contracting Type Payment Transactions

The audit team defined two key potential errors that could have been identified in the review of procurement and contracting type transactions:

• Error #5 - Section 41 of the FAA: Before issuing contract payments, the CSDPs need to ensure that there is segregation of duties between the official who has the delegated authority to perform Section 41 of the FAA to enter into a contract between the Crown and another entity, and the official who has delegated authority to perform Section 34 in order to provide certification of the performance of work. The audit team found the following instances: the same official at the client mission signed Section 41 and Section 34, officials exceeding their signing authority limit, and signature cards not in FAS. If the CSDPs do not ensure segregation of duties for these two sections or these individuals are not authorized, they may be issuing payments for unauthorized and/or fraudulent procurement of goods and services.
• Error #6 - Purchasing instrument: The Directive on Recording of Contracts in the Financial and Administrative System Material Management Module (FAS/MM) requires the creation of a purchase order for every acquisition over $2,000 CAD, unless subject to an exemption, to allow the mission to commit funds for the acquisition and ensure that funds are available. The audit team found instances where a PO should have been issued but was not. Purchases that are not treated as contracts when they should be treated as such may result in these expenditures not being subject to requirements that would normally be the case such as public proactive disclosure of contracts and Regional Contract Review Board oversight.

Appendix I: Key IT Solutions by Business Line