Risk-Based Audit Plan 2021-2023

Office of the Chief Audit Executive

October 2021

FINAL

1.0 Introduction

This updated two-year risk-based audit plan (2021 to 2023) provides a forward plan of third-line assurance activity for Global Affairs Canada.

Operating Context

The proposed audit coverage is framed by the external and internal context within which the department has and will continue to operate. The level and concurrence of different crises over the last few years has created significant uncertainty, a shift of global priorities, and, in some cases, driven change. This “new normal” is expected to continue for some time, and may result in further uncertainty and challenges. In addition to the impact of these external drivers on the policy priorities and operating context of the department, possible fiscal constraints and the need to maintain a state of perpetual agility will add further stresses to the department’s business model.

Despite these external pressures, and in direct response to them, the department continues to pursue a number of internal reforms that aim to improve the effectiveness and efficiency of the business model and supporting processes through the delivery of key transformations (such as climate finance, data, digital, and trade). When coupled with the external threat environment, this could result in exposure and/or unintended consequences. While governance committees, senior management, and project teams are working to manage these matters, second and third-line functions should continue to provide oversight, monitor, and assess these matters to provide early warning and/or independent insight into drivers or gaps that could lead to potentially undesirable scenarios or exposure.

Departmental Oversight

Internal Audit, together with the Evaluation, Inspection, Enterprise Risk and the other second-line areas such as Internal Controls, have an important role to play in ensuring that the department maintains strong systems of governance, risk management and internal controls. With the finite resources available, Internal Audit will work with other oversight providers to target its engagements and coordinate with existing efforts. Internal audit will also shift some services into the preventative space, through the provision of advisory services and in-flight health checks to assist department in its effort to design fit for purpose, integrated systems and controls through informed risk assessments.

Internal Audit Function

Internal Audit’s strategy is to create value for Global Affairs Canada by leveraging our expertise to drive improvements that support the department in achieving its mandate and contribute to management excellence. To better plan and organize the internal audit function, and in light of the pandemic impacts on departmental operations, the function has developed a Risk-Based Audit Plan (RBAP) for two years to allow for more flexibility to adjust the plan on a year-to-year basis.  

2.0 Purpose

The practice of internal audit, including the development of the audit plan, conforms to the Treasury Board Policy on Internal Audit and its Directive. This policy and directive are derived from the International Professional Practices Framework of the Institute of Internal Auditors. Internal Audit is primarily responsible for advising and providing assurance on governance, risk management and internal control issues, consistent with its Internal Audit Charter.

The audit plan identifies the engagements to be undertaken in 2021-2022 and 2022-2023. It establishes the foundation on which the Internal Audit function will add value to the department. The plan was designed to align engagements to reflect the department’s core responsibilities (see 3.2) while addressing areas of high risk and significance.  

3.0 Risk-Based Audit Planning

3.1 Methodology

The first step undertaken in the planning process was a review and update of the audit universe using the Departmental Results Framework, which is comprised of 53 programs under six core responsibilities (see Appendix A).

Senior management consultations and material from senior management committees were collected and analayzed. The results from the consultations, documentation review, facilitated risk discussions and a review of outstanding audit recommendations identified areas of significance and risk. This ongoing work allows Internal Audit to monitor new and emerging risks proactively.  For the purposes of this plan, the following areas of risk were identified:

1. Ongoing COVID-19 Activities – as the pandemic moves into its second year, the department is maintaining critical functions, and resuming regular operations while moving towards new post-pandemic practices and hybrid working options.
2. Program Design and Delivery – effective management and controls, and coherence in programming are essential to support the achievement of business objectives and maintain program integrity. 
3. Transfer Payments – the control framework over transfer payments needs continued focus to support efficient and effective delivery especially given the new Climate Finance Delivery Plan.
4. Internal Service Delivery – data and digital solutions must be prioritized to secure information, support program and service delivery. Internal services need to be aligned with policy development and operations. The reliance on internal partners and external partners should be managed to support the achievement of business objectives.
5. Transformation – several large transformation initiatives are underway. Risks associated with these initiatives that may warrant oversight include business readiness, financial controls, business process controls, technical solutions, governance, and regulatory aspects. 

3.2 Risk Approach

The risk areas were analyzed in relation to departmental priorities, core responsibilities, enterprise risks, and government-wide risk areas. As well, three detailed risk assessements were completed to address mission network risks, Information Technology risks and remote work risks.

In particular, for the mission risk assessement thirteen risk indicators were applied to 178 missions such as hardship, volume of temporary duty assignments, corruption index, financial risk, cash account, spending trends and contracting including method of vendor payment.  Following this step, other filters were applied such as number of staff, operating budgets greater than $1.5M, whether previously audited or inspected. This analysis identified ten missions that could be audited over the next two years.  Conducting mission audits in the field will depend on ability to travel from a health perspective and country stability from a safety perspective. Currently, the audit plan has a placeholder for four mission audits which provides flexibility for internal audit to decide on the exact locations closer to the start date.

3.3 Other Assurance Providers

Internal Audit coordinates risk-based audit planning activities in consideration of other internal oversight functions (e.g. Evaluation and Inspector General) and external assurance providers (i.e. Office of the Auditor General, Office of the Comptroller General and the Public Service Commission) to align audit coverage of high-risk areas, and to minimize overlap and duplication, thus reducing the engagement burden on the department. 

At Parliament’s request, the Office of the Auditor General (OAG) is continuing to focus on selected COVID-19 emergency responses as well as more traditional performance audits. In that regard, the department is currently engaged with the OAG on a performance audit on COVID-19 Vaccine Expenditures. The OAG has not yet determined if the department will be officially scoped into this audit. The department has received official notification for a second OAG performance audit related to Protecting the North. This audit is focused on the implementation of the Arctic and Northern Policy Framework. The department is also involved in the Audit of Public Accounts 2020-2021 that is recurrent every year and continues to focus on pay stabilization as the Government of Canada manages the associated risks with the Phoenix pay system.

The Office of the Comptroller General has issued its two-year audit plan (2021-22 to 2022-23). The Chief Audit Executive, in consultation with senior management, will consider participating in the Horizontal Audit of Departmental Adoption of Digital Standards or will conduct a similar audit on its own to address risks associated with the digital adoption strategy. 

The National Security and Intelligence Committee of Parliamentarians (NSICOP) and the National Security and Intelligence Review Committee Agency (NSIRA) are reviewing matters of national security and intelligence activities in the department. More specifically, the department is engaged in two reviews that are expected to be completed by Fall 2021. Internal Audit has provided support to this unit as the work is being conducted and will rely on the results of the review to inform any future audit work in this area.

The methodological approach used to prepare the audit plan is illustrated in the process map below:

Alternative text

1. Document Review
• Corporate plans (departmental, investment, security, human resources), Enterprise Risk Profile, Human Resources information, Ministers' Mandate Letters, departmental priorities, Departmental Results Framework
• Departmental Results Reports, Management Accountability Framework Assessment results
• Reports prepared by other internal and external assurance providers
2. Consultations
• Ongoing senior management consultations
• Mission operations and functional management
• Internal audit staff and other government departments
• Coordinate with internal oversight providers (Inspection, Evaluation, Internal Controls)
• Coordinate with external assurance providers (OAG, PSC and OCG)
3. Risk Identification/ Prioritization
• Synthesize document review and update branch profiles. 
• Review outstanding audit recommendations to identify potential risk areas
• Extract relevant data related to missions, country programs and conduct analysis
• Identify and assess risks based on results of analysis
• Prioritize auditable entities based on risk
4. Mapping Auditable Entities
• Map auditable entities to OCG government-wide risks, core responsibilities, Enterprise Risk Profile, Ministers' Mandate Letters, and departmental priorities to ensure adequate coverage
• Consider work conducted by other assurance providers
5. Developing the RBAP
• Prioritize auditable entities for each fiscal year
• Ensure engagements are focused on areas of highest risk
• Assess whether audit/advisory is the right tool
• Document the plan and submit for approval

3.4 Prioritization and Finalization

Following this work, the list of potential topics was prioritized for each fiscal year and engagements were selected based on areas of highest risk. The Internal Audit team also assessed which tool, audit or advisory, would be best to support the program area and/or function.  The remaining document outlines the engagements to be undertaken. 

Alternative text

Core Responsibilities

• International Advocacy and Diplomacy
• Trade and Investment
• Development, Peace and Security Programming
• Help for Canadians Abroad
• Support for Canada's Presence Abroad
• Internal Services

Enterprise Risks

• Health, Safety & Well-being
• Digital Transformation
• Resilience & Cyber/ Digital Security
• Human Resources Capacity
• Management & Security of Real Property

Audit Risks / 2021-2023 Engagements

Ongoing COVID-19 Activities

Year #1:

• Remote Work Assessment
• Follow-up on COVID-19 After Action Review

Program Design & Delivery

Year #1:

• CSDP Procurement, Management of Honorary Consuls, Duty of Care

Year #2:

• Country Program Audit, Mission Audits, CSDP – Procurement – Washington, Berlin, Brussels, Trade Regional Operations

Transfer Payments

Year #1:

• Grants & Contributions, International Assistance Innovation Program, Feminist International Assistance Program

Year #2:

• Repayable Contributions – climate finance

Internal Service Delivery

Year #1:

• Costing Methodology, Mission Acquisition Cards, IT Risk Assessment , Privacy Practices, Real Property, Internal Controls, IT Application Portfolio Management, IT Project Management, and Departmental Sustainable Development Strategy

Year #2:

• Real Property – minor capital projects and maintenance

Transformation

Year #2:

• Costing S4Hana

4.0 Two-year Risk-Based Audit Plan

4.1 Overview

This section presents an overview of the 2021-2022 to 2022-2023 Risk-based Audit Plan. Descriptions of the planned engagements for the years are in Appendices B, C, and D respectively.  

Table 1: Risk-Based Audit Plan

*Based on the risk assessment, Tanzania, Mozambique or Ethiopia could be selected for the country program audit.

** Based on the mission risk assessment the following missions could be selected for the mission audits - Dar Es Salaam, Port au Prince, Kinshasa, Accra, Ouagadougou, Dakar, Dhaka, Havana, Colombo, Kyiv or Lima.   

4.2 Audit Coverage

The engagements deemed to be of high risk and high priority have been included in the two-year plan. The variety of engagements covered in the plan cover a broad spectrum of core responsibilities, departmental priorities, ministers’ mandate letters, enterprise risks, and government-wide risks (see Appendix E).

4.3 Changes to the Audit Plan

The audit plan is updated annually with adjustments made during the year based on an environmental scan of departmental context and emerging risks.  The following engagements have been affected by the prioritization exercise:

• Export Import Control System – to be covered in the Audit of IT Project Management
• GAC Data Strategy – to be completed jointly with Evaluation in 2023-24
• Digital Strategy – to be completed jointly with the Office of the Comptroller General
• Foreign Service Directives – Oversight and Administration – on the reserve list
• Organizational Culture – replaced with the Remote Work Risk Assessment
• New Direction in Staffing – Five-year Cycle Assessment – completed by the Human Resources Branch and submitted to Public Service Commission.

The six mission audits were postponed due to COVID-19 travel restrictions and have been replaced with a series of seven remote audits examining procurement delivery from the various Common Service Delivery Points. The points of delivery are from Mexico, Washington, Berlin, Brussels, London, Manila and Delhi. These hubs service the mission network in the delivery of commons services such as finance, HR, contracting and procurement.

4.4 Challenges in Implementing the Audit Plan

Internal audit has identified the following risk factors that could impede the successful implementation of the audit plan:

• The ongoing impact of the pandemic on operations such as the continued international travel restrictions
• The pace of change, the growing complexity and large transformational initiatives in the department are challenges. Management is facing complex issues, requiring Internal Audit to be agile to react in a timely manner to the changing environment.
• Competing priorities and new demands from stakeholders may adversely affect Internal Audit’s ability to deliver on expected results.

Given this context, the audit plan remains flexible to respond to emerging risks and policy/program changes. If these changes emerge and suggest higher priority audit activity, the plan will be adjusted, so that we respond accordingly.

Internal audit has adopted an approach whereby internal resources are supplemented with qualified contractors when specialized services are required or when the function is faced with a shortage of its own qualified auditors. The renewal of the Professional Audit Support Services Supply Arrangement (PASS) in 2021-2022 will provide the internal audit function with professional contract auditors from pre-qualified firms.  These resources allow the internal audit function to supplement audit teams with subject matter expertise and allows the function to continue to provide opportunites for its staff to take on departmental assignments abroad, within headquarters or with other organizations.

4.5 Internal Audit Services

Internal audit’s suite of services includes assurance, advisory, health checks, milestone-based funding validation and consulting. The type of service chosen is based on the best fit for the department. The services are carefully designed to add value and improve the department’s operations (see Appendix F).

4.6 Delivering the Audit Plan – Resources

Internal audit currently has a human resource allocation of 40 full-time equivalent (FTE) staff. Currently, the division supports six staff on various one to two-year assignments (1 with the Public Health Agency undertaking COVID support; 1 with the International Space Agency – Internal Audit; 2 staff on rotational assignments abroad; and one on a six-month assignment with the Peace and Stabilization Operations team in the department).  We also have four vacant positions at the auditor level.  

Overall, the remaining team of 30 staff are well positioned to deliver on the current two-year plan and have approximately 45,000 hours available each fiscal year to devote to engagements taking into consideration leave and professional development.  As mentioned, co-sourcing will be used as required to increase audit expertise and/or capacity. 

Appendix B – Description of 2021-2022 Engagements

Appendix C – Description of 2022-2023 Engagements

Appendix D – Reserve List of Engagements 2021-2023

Appendix E – 2021-2023 Engagements Mapped to Priorities

Appendix F – Internal Audit Suite of Services

Alternative text

Office of the Chief Audit Executive (OCAE)

Assurance and Advisory Services

Assurance

1. Internal Audits – independent and objective assessments of governance, risk management and control processes against defined criteria
2. Data Analytics – automated collection and analysis of data and indicators from IT systems to test the effectiveness of controls

Other Services

3. Review Engagements are requested by management seeking independent advice on a matter of importance.
4. Health Checks for transformation initiatives to provide formal structured quick reviews covering a specific program aspect
5. Funding Milestone Assessments for transformation initiatives to provide formal, structured, and quick validation of milestone completion
6. Risk Assessments – assessments of inherent and residual risks to inform management of risk exposure that may require further examination

Professional Practices

Risk-based Audit Plan

A multi-year plan that considers areas of highest risk and significance

Quality Assurance and Improvement Program

Systematic process to ensure IIA Standards are met relating to quality of engagements and internal audit activity

Management Action Plan Follow-Up

Status updates to Departmental Audit Committee of management action plans to address recommendations

External Assurance Liaison

Single point of contact to coordinate activities with external assurance providers

Departmental Audit Committee Secretariat

Coordination of essential part of internal audit governance that provides objective advice and recommendations to the Deputy Minister

Other Support

Contribution to corporate reports, and review and advice regarding Treasury Board submissions and audit reports of multilateral organizations.