Annex — Assessment of internal control over financial reporting for the fiscal year ended March 31, 2018 (unaudited)

1. Introduction

This document is attached to the Office of the Commissioner of Lobbying Statement of Management Responsibility Including Internal Control Over Financial Reporting for the fiscal year 2017–18. As required by the Treasury Board Policy on Internal Control, this document provides summary information on the measures taken by the Office of the Commissioner of Lobbying (OCL) to maintain an effective system of internal control over financial reporting (ICFR). In particular, it provides summary information on the work performed by the OCL as at March 31, 2018, , including progress, results and related action plans along with some financial highlights pertinent to understanding the control environment unique to the OCL.

1.1 Authority, mandate and program activities

The Office of the Commissioner of Lobbying was established in 2008 under the Lobbying Act. The Commissioner of Lobbying is an Agent of Parliament and is responsible for the administration of the Lobbying Act. The legislation seeks to improve transparency and accountability regarding communications between lobbyists and federal public office holders and increase the confidence of Canadians in the integrity of government decision-making.

Detailed information on the OCL’s authority, mandate and programs can be found in its Departmental Plan, Departmental Results Report and Annual Report.

1.2 Financial highlights

Key financial information for 2017–18 is discussed below. Additional information can be found in the OCL's Financial Statements. Information can also be found in the Public Accounts of Canada.

• Total expenses were $5.2 M. Salaries and employee benefits comprise the majority (59% or $3.1 M for 25 employees) followed by professional and special services (25% or $1.3 M).
• Tangible capital assets comprise 47% of OCL's total assets ($1.6 M).
• Accounts payable and accrued liabilities (82%) followed by vacation pay and other leaves (17%) comprise the main portion of total liabilities ($1.0 M).
• The OCL utilizes the GX financial system.

1.3 Service arrangements relevant to financial statements

The OCL relies on other organizations to process various transactions that are recorded in its financial statements as follows:

Common arrangements

• Public Works and Government Services Canada (PWGSC) centrally administers the payment of salaries and the procurement of some goods and services, and provides cheque-issuing services as well as accommodation.
• Treasury Board of Canada Secretariat (TBS) provides information used to calculate various accruals and allowances, such as the employer’s contribution to the health and dental insurance plans.
• The Office of the Auditor General provides audit services to OCL.

Specific arrangements

• The Canadian Human Rights Commission (CHRC) provides a financial system platform to capture and report all financial transactions and performs financial transaction processing and reporting on behalf of OCL. The scope and responsibilities are addressed in the interdepartmental arrangement between CHRC and OCL, as well as in the attestation and summary of results prepared by CHRC on its ICFR in regards to the impact it has on its clients. OCL relies on CHRC’s internal controls over financial reporting and the financial management system to process the financial data that has been approved, authorized and transmitted by the Office. OCL is responsible to ensure that the financial reports are accurate and fairly present the financial results and position.

1.4 Material changes in 2017–18

No significant changes that are relevant to the financial statements occurred in 2017-18. In 2017-18 the Deputy Commissioner position remained vacant while awaiting the nomination of a new Commissioner. A new Commissioner was named and in position in January 2018.

2. OCL's control environment relevant to ICFR

The OCL is a small entity with low risk associated with its system of internal control. It recognizes the importance of senior management leadership in ensuring that staff at all levels understand their role in maintaining effective systems of ICFR and are well equipped to exercise these responsibilities effectively. The OCL’s focus is to ensure risks are well managed through a responsive and risk-based control environment that enables continuous improvement and innovation.

2.1 Key positions, roles and responsibilities

Below are the OCL’s key positions and committees with responsibilities for maintaining and reviewing the effectiveness of its system of ICFR.

Commissioner (deputy head): As the Accounting Officer, the Commissioner assumes overall responsibility and leadership for the measures taken to maintain an effective system of internal control. In this role, the Commissioner chairs the Executive Management Committee and is a member of the Audit and Evaluation Committee.

Director of Finance and Chief Financial Officer: Reporting to the Commissioner of Lobbying, the Director of Finance and Chief Financial Officer is responsible for integrated strategic and operational planning, including the coordination and implementation of performance measurement, and risk management. The Chief Financial Officer provides leadership for the coordination, coherence and focus on the design and maintenance of an effective and integrated system of ICFR, including its annual review and assessment. The Director of Finance is responsible for the development, implementation and maintenance of the financial and accounting control regime for the OCL. The position is also responsible for the management of the organization’s financial planning and reporting, accounting and contracting activities.

It is not practical for OCL to have a full-time Chief Audit Executive, due to the organization’s size, risk profile and resources. For this reason, the function is performed by the Director of Finance and Chief Financial Officer who assumes administrative responsibility for the internal audit function. Given the size of the organization and limited resources, the OCL must supplement its internal audit capacity by outsourcing most of its internal audit services.

Executive Management Committee (EMC): This Committee is the senior decision-making body at OCL. The Committee is chaired by the Commissioner and its membership also includes the Chief Financial Officer, the two directors and the Senior Legal Counsel.

The primary purpose of EMC is to establish and oversee the Office’s strategic policy and management direction. It provides a forum to consider decisions on policy, administrative practices and management issues and ensures that the Commissioner is strategically prepared to provide direction on the Office’s key activities, in order to help her fulfill her mandate. EMC supports the Commissioner in making strategic decisions on key policy and operational planning issues, ensures integration of cross-cutting decisions and addresses items impacting on the Office’s business. It specifically provides advice to the Commissioner and supports the oversight function with respect to business planning, finance, human resources, information technology, information management, official languages, outreach activities and workplace health and safety, as well as advises the Commissioner on resource allocation prior to making decision.

Audit and Evaluation Committee (AEC): The AEC provides the Commissioner with independent and objective advice on internal audit, program evaluation, risk management, control framework and reporting practices. It consists of three external members and the Commissioner, as an ex-officio member. The committee reviews the Corporate Risk Profile, OCL’s financial statements and its system of internal controls, including internal audit reports, and the assessments and action plans related to the system of ICFR. The AEC meets with the OAG to receive the results of their annual audit of the OCL financial statements. It also reviews other accountability reports, such as the DP and the RDR, and draft internal audit reports. The committee presents its observations in a report annually to the Commissioner.

2.2 Key measures taken by the OCL

The OCL has a comprehensive internal control framework for financial management that is aligned with the federal government’s expenditure management process. The OCL’s funding is controlled through a budgeting and commitment control process in its integrated financial system. Expenditures are approved at the initiation, commitment, contracting, performance certification and payment approval stages. Financial results are monitored through a monthly financial reporting process, and validated by management.

The OCL’s control environment also includes measures and structures to equip staff to be able to manage risks well, through raising awareness, providing appropriate knowledge and tools and developing skills. Key measures include:

• Governance structure and strategic direction through the Executive Management Committee (EMC) and supported by the Audit and Evaluation Committee;
• Regular reporting of financial performance to the EMC;
• Financial policies tailored to the OCL’s control environment and requirements of the Policy on Internal Control;
• Periodic review and update of the Delegation of Financial Signing Authorities Instrument;
• Documentation of key financial processes and related key risk and control points to support the management and oversight of the OCL’s system of ICFR;
• Completion of a multi-year risk-based internal audit and evaluation plan;
• Review of the internal controls over financial reporting framework leading towards an ongoing monitoring plan;
• Preparation and implementation of management actions plans in response to observations and recommendations made during the review of the effectiveness of controls.

3. Assessment of OCL's system of ICFR

3.1 Assessment baseline

The OCL maintains an effective system of ICFR with the objective to provide reasonable assurance that:

• Transactions are appropriately authorized;
• Financial records are properly maintained;
• Assets are safeguarded; and,
• Applicable laws, regulations and policies are complied with.

Over time, this includes assessment of design and operating effectiveness of the system of ICFR leading to ensuring the ongoing monitoring and continuous improvement of the system of ICFR.

Design effectiveness means to ensure that key control points are identified, documented, in place and that they are aligned with the risks (i.e. controls are balanced with and appropriate to the risks they aim to mitigate) and that any remediation is addressed. This includes the mapping of key processes and IT systems to the main accounts by location as applicable.

Operating effectiveness means that the application of key controls has been tested over a defined period and that any required remediation is addressed.

Such testing covers all departmental control levels which include corporate or entity, general computer and business process controls.

The maintenance of an effective system of ICFR is an ongoing process designed to identify, assess effectiveness and adjust as required key risks and associated key controls, as well as to monitor its performance in support of continuous improvement. As a result, the scope, pace and status of those assessments of the effectiveness of their system of ICFR are based on risks and take into account the size of the organization.

3.2 Assessment method at the OCL

In 2017–18, the OCL monitored its internal financial controls in an effort to comply with the Treasury Board Policy of Internal Control and to ensure that controls in place were sound and provided reasonable assurance that financial operations were conducted in compliance with regulations and applicable policies and directives.

The OCL has documented the following significant processes and controls: salary expenditures, procurement and payment to suppliers, acquisition cards, business travel cards, financial delegation, hospitality expenditures, travel expenditures, petty cash, asset management, and cellular phones and other wireless devices.

The monitoring of the internal controls processes consisted walking through the processes with various stakeholders. OCL also relies on controls such as Section 34 sampling reports prepared by CHRC.

As a small organization, the OCL acquires some of its internal services through Memoranda of Understanding for information technology, human resources and financial services from other government departments. Where the OCL relies on these other government departments, they are responsible for the self-assessment of their internal controls.

4. Assessment results

The preparation of internal controls documentation and subsequent assessment of the efficiency of controls is part of a continuous improvement process that will allow the OCL to implement healthy financial management practices.

The internal audit conducted in 2011–12 found that senior management exhibits a strong commitment to internal controls. Subject to the exceptions noted in the report, the documentation in the audited transaction files was complete, approved at the appropriate levels of authority, and in compliance with Treasury Board and OCL policies and directives. The control framework is built on a sound foundation, including appropriate policies and directives, as well as effective monitoring and management oversight practices. The audit results demonstrate that OCL’s internal controls over financial reporting are working well, even if minor improvements were required in some areas. An action plan was developed to strengthen the areas that needed improvements.

In 2014–15 an internal audit of procurement and contracting was completed. The results reiterated that OCL has put in place appropriate internal controls and has strengthened the application of these controls in the past year. The recommendations that resulted from this audit can be found in the Internal Audit of Procurement and Contracting.

In 2017–18, it will be the sixth year that the OCL financial statements are audited by the Office of the Auditor General (OAG). The comparative information presented in the financial statements for the year ended March 31, 2017 is audited.

The OCL has received an un-modified opinion on its financial statements.

Based on the audit work performed, the OAG’s auditors have not identified opportunities for changes in procedures that would improve the systems of internal control, streamline operations, and/or enhance financial reporting practices.

In 2017–18, OCL has continued to refine its internal control processes and tested their effectiveness. When necessary, slight adjustments were made to the processes.

The key findings and significant adjustments required from the current year`s assessment activities are summarized below.

New or significantly amended key controls: In 2017–18 no significant changes were made to key controls.

Ongoing monitoring program: As part of its ongoing monitoring plan, OCL reviews and updates annually, in collaboration with CHRC, its process flows and narratives, which includes documenting controls. In 2017–18, no significant control issues were found. Extensive procedures and detailed variance reporting are in place to efficiently obtain additional internal assurance over the financial reporting.

5. Action plan

5.1 Progress as at March 31, 2018

During 2017–18, the OCL has continued to make progress in improving the implementation of its key controls, as summarized below:

• Collaborated with other Agents of parliament in the development of various internal control and risk management tools;
• Prepared an Integrated Business Plan, that includes a detailed human resource plan; and
• Continued to improve the monthly financial situation reports in order to strengthen financial forecasts, assist management decision making and strengthen the project management delivery.

5.2 Action plan for the next fiscal year and subsequent years

In fiscal year 2018–19, the OCL will continue to strengthen its management accountability framework, including planning and reporting instruments such as Performance Measurement Framework. The evaluation of OCL’s Client Services and Lobbyists Registration System will be completed in 2018–19.

In collaboration with other Agents of parliament tools have been developed to assess the design effectiveness and operational effectiveness with regards to its Entity Level Controls and General IT Level Controls. OCL will implement a monitoring framework based on risk in 2018–19. Due to the recent review and assignment of responsibilities OCL will undertake a revision of its internal control procedures including procurement and its financial delegation instrument.

Senior management is committed to sustaining and continuously improving its framework of effective ICFR. To this end, it includes carrying out ongoing monitoring of internal controls to ensure that they meet the expectations of management and stakeholders, and that measures are in place to appropriately mitigate associated risks. In 2018–19, OCL will begin the audit of compliance and enforcement activities.

OCL will implement an ongoing monitoring plan in 2018–19 based on an annual validation of the high-risk processes and controls.