Audit of Procurement at Missions Supported By CSDP Mexico

June 2022

Table of contents

• 1. Background
  • Policy Requirements
  • Administration and Management
  • Procurement Symbols and Terms
• 2. Objective, Scope and Methodology
  • About the Audit
  • Methodology - Data Analytics
  • Population
  • Methodology - Sample Selection
• 3. Findings
  • Overall Assessment
  • 3.1 Data Integrity
  • 3.2 Compliance
  • 3.3 Supporting Documentation
  • 3.4 Contract Monitoring and Reporting
• 4. Conclusion
• 5. Recommendations and Management Response and Action Plan

1. Background

Policy Requirements

• Financial Administration Act (FAA)
• Treasury Board:
  • Contracting Policy
  • Policy on Materiel Management
  • Policy on Financial Management
  • Directive on Delegation of Spending and Financial Authorities
• Global Affairs Canada:
  • Delegation of Financial and Contractual Signing Authorities Instrument
  • Official Hospitality Outside Canada Policy
  • Directive on Membership Fees
  • Procedures Specified Purpose Accounts

Administration and Management

• The Contracting Authority (as per the Delegation of Financial and Contractual Signing Authorities) is accountable for ensuring the contracting process satisfies legal, policy, and trade obligations. The Contracting Authority exercising section 41 of the FAA will either be the mission or Mission Procurement (AAO).
• The Fund Centre Manager or Project Authority at mission or Mission Procurement (AAO), is responsible for expenditure initiation; administering and managing procurement; certifying financial commitments (FAA, section 32); and certifying contract receipt (FAA, section 34).
• The Common Services Delivery Point (CSDP) is responsible for approving requisitions for payments and authorizing payments (FAA, section 33) related to procurement transactions at missions.
• Contracting and Materiel Management Policy (SPP) is responsible for monitoring and enforcing procurement and materiel management policies and providing functional direction and advice.
• Financial Operations, International (SMFF) develops procedures and guidance on mission payments and monitors payments. Ensures, in consultation with Corporate Accounting Unit (SMOQ), that proper financial codes are inputted in FAS for mission payments.
• All procurement must be approved by the appropriate authorities and compliant with applicable policies listed on the previous slide.

Procurement Symbols and Terms

2. Objective, Scope and Methodology

About the Audit

Objective

• The objective of the audit was to determine whether Global Affairs Canada has effective controls in place to support compliance of mission procurement activities with applicable regulations and policies.

Criteria

1. The Department put in place appropriate and effective oversight and monitoring controls to mitigate risks of non-compliant procurement activities.
2. Procurement activities at missions comply with applicable regulations and policies.
3. Information regarding procurement activities at missions is accurate and complete.

Scope

• Population Testing
  • FY 2018-19 to 2020-2021
  • 26 missions
  • 97 021 transactions (KR and RE)
  • $111 million
• Sample Testing
  • FY 2020-2021
  • 21 missions
  • 278 samples representing 616 transactions
  • $3.5 million

Statement of Conformance

The audit was conducted in conformance with the Institute of Internal Auditors' International Standards for the Professional Practice of Internal Auditing and with the Treasury Board Policy and Directive on Internal Audit, as supported by the results of the external quality assurance assessment.

Methodology - Data Analytics

Risk-Based Planning

• Conduct an assessment of high risk procurement and contracting practices in South America region
• Develop in-depth quantitative understanding of data

Data Analytics and Testing

• Assess control effectiveness, identify control deficiencies, and detect potential fraud (e.g., double payment)
• Population analysis
• Transaction testing as required
• Conduct contextual and informational interviews

Implementation of Continuous Monitoring Approach

• Explore data analytics monitoring practices
• Provide timely information and potential findings related to key controls and management of processes
• Transfer data analytic scripts to program area and internal controls.

Population

26 Missions supported by CSDP Mexico:

• Acapulco
• Bogota
• Buenos Aires
• Cancun
• Caracas
• Guadalajara
• Guatemala
• Havana
• La Paz
• Lima
• Los Cabos
• Managua
• Mazatlán
• Mexico
• Monterrey
• Montevideo
• Panama
• Playa del Carmen
• Puerto Vallarta
• Punta Cana
• Quito
• San Jose
• San Salvador
• Santiago
• Santo Domingo
• Tegucigalpa

Procurement Numbers by Fiscal Year:

Methodology - Sample Selection

The audit team selected and tested 278 samples representing 616 transactions from fiscal year 2021:

• The samples were selected using a risk-based approach where results cannot be extrapolated to the population:
  • This approach allows identification of instances where controls may have been absent or not functioning as intended.
  • Data analysis was used to categorize transactions, identify trends and anomalies, and analyze available contracting data. The audit team used this information to identify risk-based selection criteria for the sample.
  • The selection criteria were based on:
    • Mission risk factors such as frequency and volume of transactions, total spending, local environment, and mission characteristics;
    • Transaction and contracting information such as commodity type, procurement instrument, and approval requirements; and
    • Outlier transactions and potential split contracts or duplicate payments.
  • The samples were selected from fiscal year 2020-2021 to take into account recent changes to procurement policy as well as operations during the pandemic.
• The tests assessed compliance and operating effectiveness.

3. Findings

Overall Assessment

3.1 Data Integrity

Requirement

• According to TB’s Policy on Financial Management and GAC’s Directive on Recording of Contracts in FAS/MM, timely and accurate departmental financial information should be available to support decision making in the department and across government.

Controls

• The mission ensures that all information is recorded accurately in the financial administration system before certifying that goods have been delivered or services have been rendered (Section 34 of the FAA).
• Mission Procurement (AAO) monitors activities by sampling transactions to verify the accuracy and completeness of documentation and data entry.

Findings

• Based on population and sample testing results, transactions were recorded accurately into the financial administration system.
• Exception: The audit team noted a contract valued at $500 million, which is unusual since no mission has a budget of that magnitude. This was confirmed to be an error. This contract never reached signature point (ratification) and therefore, no payment was made against it. Existing system controls did not prevent the recording of such a high amount.
• As part of the analysis of proactive disclosure of contracts above $10,000 CAD, the audit team identified system and manual errors in the financial administration system that resulted in 9 contracts not being disclosed as required.

Recommendation 1:

The Assistant Deputy Minister of Corporate Planning, Finance and Information Technology (SCM) should identify data inaccuracies caused by the financial administration system and take corrective measures.

3.2 Compliance

Requirements

• All financial transactions must comply with the requirements of the Financial Administration Act (FAA).
• According to TB’s Contracting Policy, contracting authorities must not split contracts or contract amendments in order to avoid obtaining the appropriate approval required by legislation or policies.
• According to department’s Standard on Pre- and Post- Contractual Work, when the work is performed in absence of a written agreement and the value is greater than $2,000 CAD, a confirming order is required before an invoice can be paid. This threshold increased to $5,000 during the pandemic.
• As per departmental guidelines (i.e. Procedures for Petty Cash, Directives on Recording of Contracts in FAS), monetary thresholds determine which procurement instruments must be used when obtaining goods and services.

Controls

• The mission oversees that the nature and purpose of the request for purchases are accurate and comply with all applicable policies and procedures through appropriate delegation of authorities.
• Mission and HQ staff exercising FAA delegated spending and financial authorities have specimen signature cards documenting the extent of their delegated authority. These signature cards are available in the financial administration system to allow verification of transactions. Staff must complete departmental training before being granted FAA delegated authorities.
• The CSDP reviews any supporting documentation submitted by the mission before authorizing payment and can challenge purchases made by the missions.

Findings

57 samples out of 278 (21%) had 73 instances of non-compliance with the Financial Administration Act (FAA)

• 37 instances – FAA delegated authority not exercised in the right order
• 15 instances – FAA signatures not dated
• 10 instances – Invalid specimen signature card
• 7 instances – FAA delegated authority not documented
• 4 instances – Segregation of duties not properly exercised

In addition:

• 2 instances: The audit team identified contract splits that had multiple contracts for the same good or service, location, and period.
• 22 instances: The mission did not use the correct procurement instrument.

Recommendation 2:

The Assistant Deputy Minister of Corporate Planning, Finance and Information Technology (SCM) and the Assistant Deputy Minister of International Platform (ACM) should:

• Continue to provide support to missions to enable greater compliance with applicable procurement policies and the Financial Administration Act, especially the delegation of authority.
• Continue the implementation of electronic signatures across all Common Services Delivery Points so that approvals on key documentation comply with the Financial Administration Act.

3.3 Supporting Documentation

Requirements

• As per TB’s Policy on Contracting, the departmental Directive for Recording of Contracts in FAS-MM, and GAC’s Directive on Information Management, procurement activities should be fully documented and recorded, including contractual commitments and payments.
• According to the Finance and Materiel Management Service intranet page, as of October 2, 2018, procurement officers are required to attach a complete copy of the signed contract and any subsequent amendments to the contract document in the Material Management module (FAS-MM).

Controls

• Departmental guidance is in place to outline supporting documentation to upload into the financial administration system.
• Contracting authorities and program managers at missions receive training on procurement and payment documentation requirements.
• The CSDP reviews and can challenge supporting documentation submitted by the mission before authorizing payment (Payment Authority - Section 33 of the FAA).
• Contracting and Materiel Management Policy (SPP) and Mission Procurement (AAO) conduct monitoring to assess completeness of data entry.

Findings

99 Contracts were signed after October 2, 2018

• Out of the 88 contracts initiated at the missions, 86 had an incomplete copy of the contract in the system.
• Out of the 11 contracts initiated at headquarters, 3 had an incomplete copy of the contract in the system.

In addition:

• Among the 278 samples, there were 8 confirming orders, of which 2 did not have justification forms attached.
• 15 samples out of 278 did not have all the required documentation (such as invoices or hospitality forms) attached in the financial administration system.

Recommendation 3:

The Assistant Deputy Minister of Corporate Planning, Finance and Information Technology (SCM) and the Assistant Deputy Minister of International Platform (ACM) should review supporting documentation requirements and communicate these requirements to strengthen awareness and reinforce compliance.

3.4 Contract Monitoring and Reporting

Requirements

• According to TB’s Contracting Policy:
  • The department is responsible for establishing, monitoring and maintaining internal controls over contracting activities to support effective stewardship of public funds and compliance with legislative and policy requirements; and
  • Contracts valued at $10,000 CAD or above must be proactively disclosed every quarter. There are limited exceptions, most notably related to national security and legal services.
• As per departmental approval authorities, contracts above certain monetary thresholds must be approved by various committees or Mission Procurement (AAO) and those decisions must be documented.

Controls

• The department put in place Regional Contract Review Boards (RCRBs) and a Departmental Contract Review Board (DRCB) to support effective management and oversight of mission procurement activities.
• DCRB and RCRB decisions are manually tracked through Excel spreadsheets.
• Contracting and Materiel Management Policy (SPP) is responsible to track and report contracts over $10,000 CAD.

Findings

Of the 121 contracts included in the 278 samples, 49 contracts did not have documented evidence demonstrating that they were approved at the appropriate level.

• 37 contracts signed before November 2020 were informally tracked and therefore RCRB approvals were not readily available.
• 8 contracts out of the 9 signed after November 2020 that had to be approved by RCRB did not have documented approval. As of November 2020, it was mandatory for all procurement activities to be processed through Shop@DFATD, and CSDPs started using the automatically generated identification number to track RCRB decisions.
• 1 contracts out of the 8 that had to be approved by AAO did not have documented approval; and
• 3 contracts out of the 3 that had to be approved by DCRB had documented approval.

There were 575 contracts above $10,000 that were required to be disclosed.

• 57 of these contracts were not publicly disclosed of which 14 did not have rationale for the non-disclosure.
• Included in the 14 contracts that had no rationale for non-disclosures are the 9 contracts mentioned at finding 3.1 that were not disclosed because of system and manual errors. Please see Recommendation #1 for this issue.

In addition:

• When funds are closed, some of them are simply repurposed into new and different funds while keeping the same identification number. Consequently, when monitoring these funds, expenditure trends may be misleading with no information to explain it as a result of a loss of an accurate audit trail.

Recommendation 4:

The Assistant Deputy Minister of International Platform (ACM) should accurately track decisions made by the Regional Contract Review Board that is coordinated by the Common Service Delivery Point-Mexico.

4. Conclusion

The effectiveness of controls were assessed on a risk-based sample of transactions using data analytics as the main methodology and as such, this audit report documents results that are exceptions.

Based on an examination of procurement activities of missions supported by the Common Service Delivery Point - Mexico, effective controls were generally in place to support compliance with applicable regulations and policies. Overall, transactions were recorded accurately into the financial administration system based on the population and sample testing results. To support a stronger mission procurement program, areas of improvement include monitoring, compliance, and information management.

5. Recommendations and Management Response and Action Plan