Integrated risk-based internal audit and evaluation plan 2016-21

Table of contents

1. Executive Summary
2. Planning Context
3. Planning Approach
4. Audit and Evaluation Plan Summary

• Appendix A. Detailed Audit and Evaluation Plan
• Appendix B. Audit and Evaluation Prioritization
• Appendix C. Audit and Evaluation Universe

1. Executive summary

1.1 Introduction

This document presents the Integrated Risk-Based Audit and Evaluation Plan (RBAEP) for the Office of the Commissioner Lobbying of Canada (OCL) for the five years (2016-17 to 2020-21). The objective of the RBAEP is to allocate resources to the areas of most significant risk and priority to OCL, as well as to align with the requirements of Treasury Board (TB) policies on internal audit and evaluation.

The Risk-Based approach focuses on the most significant areas to meet the organizational priorities, while balancing resources to ensure that they are efficiently and effectively utilized for assurance activities and provide the greatest benefit to OCL.

As an Agent of Parliament, OCL is independent from government and the oversight of the Treasury Board of Canada Secretariat (TBS). Consequently, OCL considers its internal oversight mechanisms (including internal audits and evaluations) of significant importance in helping ensure that adequate management practices are in place.

1.2 Proposed audits and evaluations

The audit and evaluation coverage proposed in the RBAEP strives to achieve an effective balance between a number of requirements and considerations in the context of budget constraint, and allows for one or two projects per year. The five-year plan takes into account alignment with organizational risks and priorities.

2. Planning context

2.1 Background

The Commissioner of Lobbying is the Agent of Parliament responsible for the administration of the Lobbying Act (the Act). The Act seeks to improve transparency and accountability regarding communications between lobbyists and federal public office holders, and increase the confidence of Canadians in the integrity of government decision-making. The authority of the Commissioner is derived from the Act, and the mandate is threefold:

• Establish and maintain the Registry of Lobbyists, which contains and makes public the registration information disclosed by lobbyists;
• Develop and implement educational programs to foster public awareness of the requirements of the Act; and
• Undertake administrative reviews and investigations to ensure compliance with the Act and the Lobbyists’ Code of Conduct (the Code).

Under the Act, the Commissioner also has the authority to grant exemptions to former designated public office holders who are subject to a five-year prohibition on lobbying activities.

OCL works to achieve the following strategic outcome: Transparency and accountability in the lobbying of public office holders contribute to confidence in the integrity of government decision-making.

Three programs contribute to the achievement of the mandate and strategic outcome. These programs and their expected results are as follows:

1. Education and Research
   • Lobbyists, their clients, public office holders, and the public are aware of the requirements of the Act.
2. Registration of Lobbyists
   • Lobbyists can register in accordance with the requirements of the Lobbying Act.
   • Canadians have access to information about lobbying activities.
3. Reviews and Investigations
   • Suspected, alleged or known breaches of the Lobbying Act and the Lobbyists’ Code of Conduct are reviewed or investigated, and appropriate measures taken to ensure compliance.
   • Exemptions from the five-year prohibition are granted or denied in a manner consistent with the purposes of the Lobbying Act.
   • Information contained in monthly communication reports submitted to the Office of the Commissioner of Lobbying is accurate and complete.

2.2 Government priorities

As one might expect, the priorities of the Government of Canada are quite broad and to a certain extent subject to some fluctuations in the context of the complex global environment. Fiscal Restraint, Blueprint 2020, and Deliverology are Government Priorities that touch the mandate of OCL.

Fiscal restraint

The current government has articulated a number of key priorities that are anticipated to require significant investment, while at the same time stating an intention to achieve a balanced budget by 2019 -2020 while continuing to reduce the debt-to-GDP ratio. In this context, it is reasonable to assume that the current climate of fiscal restraint will continue to be a reality for the foreseeable future.

Blueprint 2020

Blueprint 2020 sets out a vision of a world-class Public Service equipped to serve Canada and Canadians now and into the future. This is a Public Service recognized as having the best people working together with citizens, making smart use of new technologies and achieving the best possible outcomes with efficient, interconnected and nimble processes, structures and systems. The Public Service’s core objective is to improve the lives of our citizens and secure a strong future for our country.

The Blueprint 2020 vision sets out four guiding principles to help examine how work is done in the Federal Public Service:

• An open and networked environment that engages citizens and partners for the public good.
  Together with…
• A whole of government approach that enhances service delivery and value for money.
  Enabled by…
• A modern workplace that makes smart use of new technologies to improve networking, access to data and customer service.
  And…
• A capable, confident and high-performing workforce that embraces new ways of working and mobilizing the diversity of talent to serve the country’s evolving needs.

The mandate of OCL is to achieve transparency and accountability in the lobbying of public office holders and contribute to confidence in the integrity of government decision-making. The demand for accountability mechanisms and transparency is rising in Canada. This is consistent with a global trend of an increasing number of lobbyist offices and/or registration processes at all levels of government. One would expect a world-class Public Service to include mechanisms encompassed within OCL’s mandate and as such, OCL is quite relevant to the vision of Blue Print 2020.

Deliverology

Deliverology focuses on measuring a government’s progress on delivering on things that it announced it would. This approach to managing for results is a significant priority for the current government.

2.3 OCL Strategic outcome and operational priorities

In its 2016–2017 Report on Plans and Priorities (RPP), OCL identifies its strategic outcome as “Transparency and accountability in the lobbying of public office holders contribute to confidence in the integrity of government decision-making”

As outlined in the 2016-17 RPP, OCL’s operational priorities are as follows:

• Modernize the Lobbyists Registration System (LRS) application.
• Assess and enhance the effectiveness of the Outreach and Education program.
• Refine compliance verification processes.
• Implement the Information Management/Information Technology (IM/IT) strategy by migrating the rest of the OCL's IT infrastructure to the same service provider as for the LRS.

2.4 Key organizational risks

OCL undertook an exercise to update its corporate risk profile between May and July 2016 to identify, update and assess key risks. The risk profile serves as the foundation for effective risk mitigation and management, and informs corporate planning and decisions. The following seven risks were identified by management.

3. Planning approach

3.1 Key audit and evaluation requirements

There are a number of TB policies, and TBS directives and guidelines that establish the requirements and best practices for audit and evaluation planning in the federal government.

3.1.1. Treasury board policy on evaluation

In the Government of Canada, evaluation is the systematic collection and analysis of evidence on the outcomes of programs to make judgements about their relevance, performance and alternative ways to deliver them or to achieve the same results.

In accordance with Treasury Board Policy on Evaluation, federal institutions are required to prepare a rolling five-year evaluation plan, and to update the plan annually. According to the Treasury Board Directive on the Evaluation Function, evaluation plans must;

1. align with and support the departmental Management, Resources and Results Structure;
2. support the requirements of the Expenditure Management System, including strategic reviews;
3. include all direct program spending, excluding grants and contributions;
4. include all ongoing grant and contribution programs for which their department is responsible, as required under section 42.1 of the Financial Administration Act;
5. include the administrative aspect of all major statutory spending;
6. include programs that are set to terminate automatically after a specified period of time, if requested by the Secretary of the Treasury Board following consultation with the affected deputy head; and,
7. include specific evaluations, if requested by the Secretary of the Treasury Board following consultation with the affected deputy head.

3.1.2 Internal audit and evaluation plan

Internal audits and evaluations provide independent, objective and substantiated conclusions on the effectiveness of risk management, control and governance processes. The focus is on all management systems, processes and practices, including the integrity of financial and non-financial information. Internal audit assurance services provide evidence-based opinions on the extent to which the system of internal controls is adequate and effective to support the following imperatives:

• achievement of operational objectives;
• safeguarding of assets;
• economy and efficiency of operations;
• reliability and integrity of financial and operational information; and
• compliance with legislation, policies and procedures.

In accordance with TB policy, internal audit and evaluation plans must ensure coverage of areas of higher risk and significance. The internal audit and evaluation plan should also have the following characteristics:

• be risk-based;
• be reviewed by the audit committee;
• be focused predominantly on the provision of assurance services;
• have a multi-year horizon;
• address risks and internal audits identified by the Comptroller General as part of government-wide coverage; and
• support annual assurance reporting on the overall state of organizational risk management, control and governance processes.

3.2 Planning approach

The approach on which this plan is based complies with the Institute of Internal Auditors' International Professional Practices Framework. The RBAEP was developed using the approach outlined in the following figure.

Risk-based audit and evaluation planning approach

1. Identification of the Audit and Evaluation Universe
   • PAA aligned
   • Defines potential scope of internal audit and evaluation activity
   • Comprised of “auditable” or “evaluable” entities
2. Environmental Scan of the Audit and Evaluation Universe
   • Strategic consultations with the Commissioner, senior management & Audit Committee Chair
   • Review of key documents (e.g., PAA, RPP, CRP)
   • Leveraging recent Corporate Risk Profile
3. Prioritization of Audit and Evaluation
   • Context sensitive weighted criteria-based approach for each universe entity
   • Risk exposure – 40%
   • Importance – 60%
4. Project Selection and Plan Development
   • Consider feasibility, previous audits, evaluations, other assessments
   • Consider available resources, timing, scope and objectives
   • Update annually

3.2.1 Identification of the audit and evaluation universe

The audit and evaluation universe defines the potential scope of proposed engagements and comprises individual “universe entities” that may be the subject of internal audit or evaluation activity. To ensure alignment between the focus of internal audit and evaluation projects with OCL’s operational structure, the universe entities were aligned with OCL’s program and internal services, as identified in the 2016-2017 Program Alignment Architecture (PAA).

The following table presents OCL’s audit and evaluation universe. A more detailed overview of each element is provided in Appendix C.

3.2.2 Environmental scan

An extensive environmental scan was conducted for the purposes of updating the OCL Corporate Risk Profile (CRP) in May/June 2016. This exercise represents a timely and accurate picture of OCL’s business conditions and risks as they stand as of July 2016. This formed the basis of the risk analysis that was conducted for each audit universe component.

Input was gained from the Audit Committee at the July 8, 2016 Audit Committee meeting identify organizational changes, key risks to which operations are exposed, and areas in which internal audit or evaluation could provide the most value in supporting the achievement of organizational objectives.

Follow-up conversations were held with the Director of Finance and Deputy Chief Finance Officer to review the initial risk analysis of each audit universe component. The full analysis and risk rankings were reviewed with the management team on August 10, 2016 to ensure that all risk considerations had been captured.

3.2.3 Prioritization of audit and evaluation entities

Relevant to OCL’s operations, overall prioritization of audit and evaluation entities included consideration of inherent risk, the risk that would be posed if no controls or mitigating factors were in place and residual risk, the risk that remained after controls were considered. Each entity of the audit universe was ranked using two criteria: risk exposure and importance. Each criterion was assessed and weighted based on the relative importance of three sub-elements, as follows:

Risk exposure

• review of corporate risk profile and consultations;
• degree and recentness of changes; and
• complexity, dependencies and legislative requirements.

Importance

• materiality (the entity’s budget: low = <$100,000; moderate = >$100,000 but <$400,000; high =>$400,000);
• sensitivity and public profile; and
• link to mandate

Taken together, these criteria were used to derive a total weighted priority score from which preliminary prioritization of the audit universe was generated. Then, recent audit coverage of the entity was considered before assigning it a requirement-for-audit rating. The outcome is a preliminary ranked list of audit priorities, details of which can be found in Appendix B.

3.2.4 Project selection and plan development

The project team selected audit and evaluation projects to be included in the five-year RBAEP. To this end, the highest audit priorities identified served as the starting point and provided the main but not only consideration for project selection. The team examined the top priority entities against a variety of constraints and opportunities, including the following:

• budget for internal audit and evaluation resources over the five-year period;
• feasibility of conducting an audit or evaluation;
• other reviews providing oversight (i.e. evaluations, Office of the Auditor General [OAG] audits);
• mandated audit projects (i.e. follow-ups, OAG and Public Service Commission obligations for horizontal audits);
• management requests; and
• Audit and Evaluation Committee and senior management direction

In finalizing the RBAEP, care was taken to ensure the audit and evaluation universe was appropriately covered.

4. Audit and evaluation plan summary

The audit and evaluation coverage proposed in the RBAEP strives to achieve an effective balance between a number of requirements and considerations in the context of budget constraint, and allows for carrying out one or two projects per year. The five-year plan takes into account the necessary alignment with organizational risks and priorities. An overview of the risk assessment of the OCL universe elements is presented in Appendix B.

It is expected that OCL will achieve coverage of its highest audit and evaluation priorities over the five-year planning horizon. When the feasibility or value of either conducting or continuing an audit or evaluation project is in question—due to factors such as major changes, new priorities, or lack of resources or subject-matter expertise—the Deputy Commissioner will bring this to the attention of the Audit and Evaluation Committee for formal consideration and approval.

To date, OCL has completed the following audits:

• Audit of Registration and Client Services, OCL’s Lobbyists Registration System
• Audit of staffing (Public Service Commission)
• Audit of procurement and contracting
• Audit of Internal Controls Over Financial Reporting For Selected Expenditures
• Threat and risk assessment

The following table summarizes all audit and evaluation projects planned over the next five years. The table is organized according to the audit and evaluation universe. A more detailed overview of the audit and evaluation universe entities is presented in Appendix C.

Appendix A. Detailed audit and evaluation plan

A.1 Detailed internal audit and evaluation plan

The table below provides the scope, objective and rationale for each of the audit and evaluation projects proposed for 2016 to 2021. It should be noted that final scope, objectives and estimated budgets for the proposed audits/evaluations is subject to confirmation as part of the detailed planning phase of each of the respective projects.

A.2 Audit and evaluation resources

The following table sets out estimates by fiscal year of the resources needed to carry out the proposed audit and evaluation engagement. The actual resources allocated to each engagement may vary depending on the scope of the project.

Appendix B. audit and evaluation prioritization

B-1 Prioritization criteria

The RBAEP targets higher risk areas; the following criteria are used to evaluate the overall risk of each component in the audit universe.

All criteria are based on an equidistant three (3) point scale allocated 1,5,10 points based on the descriptions noted above.

When determining audit priority ratings for each entity, the following scale is used:

• Low: <6
• Moderate: 6 to <8
• High: > or equal to 8

Taken together, these criteria were used to derive a total weighted priority score from which preliminary prioritization of the audit universe was generated. Then, recent audit coverage of the entity was considered before assigning it a requirement-for-audit rating. The outcome is a preliminary ranked list of audit priorities, details of which can be found in Appendix B.

In developing the plan, each universe entity was assessed in relation to the extent of coverage provided and the perceived value of the information gained by management to contribute to the enhanced effectiveness and efficiency of OCL operations.

B.2 Prioritization of internal audit projects

The following table provides a complete analysis of risk exposure, importance and recent audit coverage for each activity included in the audit universe. This analysis ensures that the RBAEP focuses on high-risk areas and areas of concern for management.

ⁱ Materiality is the term used to describe the significance of financial statement information to decision makers. An item of information, or aggregate of items, is material if it is probable that its omission or misstatement would influence or change a decision. Materiality is a matter of judgement in the particular circumstances.

Appendix C. audit and evaluation universe

C.1 OCL audit and evaluation universe

The audit and evaluation universe defines the potential scope of internal audit and evaluation activity and comprises individual “auditable and evaluable entities” that may be subjected to audit and/or evaluation activity. This table sets out OCL’s audit and evaluation universe, and includes a description of each of the entities.