Audit of Procurement Practices

Presented to the Departmental Audit Committee (DAC)

October 30, 2025

Introduction

NRCan has been subject to many procurement-related audits since 2021 (refer to Appendix A for details) and during this same period there have also been many new developments and guidance issued to federal organizations by central agencies. In this rapidly changing environment, it is critical that federal organizations ensure controls, processes, and policies are in place to support fair, open, and transparent procurements that demonstrate value for money.

The Treasury Board of Canada Secretariat (TBS) establishes procurement directives and guidance for federal departments and agencies. The TBS Directive on the Management of Procurement first came into effect in May 2021 and has since been amended four times. Additionally, TBS issues Contracting Policy Notices to provide updates, interpretation and guidance related to federal procurement, and support government departments and agencies in awareness and compliance with regulations, Treasury Board policy instruments and trade agreements. During the 2025 calendar year, the TBS issued six Contracting Policy Notices for departments to implement.

Public Services and Procurement Canada (PSPC) is the Government of Canada’s central purchasing and contracting authority. It issues and administers contracts on behalf of departments and agencies when the contract value exceeds certain delegated procurement authorities. It also issues standing offers and supply arrangements that can be used by all departments and agencies. In order to use and access the procurement tools managed by PSPC, departments must ensure that their procurement activities and processes, including templates, are in alignment with PSPC requirements. In July 2025, PSPC put into effect ten measures to strengthen requirements for procurement of professional services using the mandatory methods of supply.

Within the Corporate Management and Service Sector (CMSS), the Finance and Procurement Branch (FPB) is responsible for the core operations of the procurement function, including the interpretation and implementation of guidance from TBS and PSPC.

Objective

The objective of this audit was to provide assurance that an effective process is in place to monitor new developments and guidance in procurement and ensure timely updates to internal processes and controls to support compliance and continuous improvement.

Please refer to the About the Audit section for more information on the audit.

Results of the audit

Strengths

The Department has invested significant efforts to ensure compliance and alignment with central agency policies and guidance, and to address previous audit findings. In response to new and rapidly changing procurement requirements, the Department has implemented procurement controls and processes in a timely and consistent manner. Procurement staff and business owners receive regular communication and training on procurement changes.

Areas for improvement

There is an opportunity to expand and formally document the current monitoring process to support the Department to adapt to the changing procurement landscape, including changes to procurement policy, and recommendations from audits and reviews. There is also an opportunity to establish a reasonable frequency for the review and update of the Procurement Management Framework to align with central agency guidance, including the Directive on Management of Procurement.

Conclusion

The Department would benefit from a more formally documented process to monitor new developments and guidance in procurement; however, the audit observed that the Department is making timely updates to internal processes and controls to support compliance and continuous improvement and providing regular communication and training on procurement changes. The Department is encouraged to continue these practices in support of compliance and continuous improvement.

Statement of conformance

In my professional judgement as Chief Audit and Evaluation Executive, the audit conforms with the Institute of Internal Auditors' Global Internal Audit Standards and the Government of Canada’s Policy on Internal Audit, as supported by the results of engagement supervision and the Quality Assurance and Improvement Program.

Acknowledgements

The audit team would like to thank those individuals who contributed to this project and particularly employees who provided insights and comments as part of this audit.

Michel Gould, MBA, CPA, CIA
Chief Audit and Evaluation Executive
October 30, 2025

Audit findings and management response and action plan

Audit findings	Recommendations and management response
Monitoring of new developments and guidance The audit examined whether the Department has a documented and operational process to identify, assess, and monitor new developments and guidance in procurement. The audit found that while the Department has been monitoring and assessing trends in procurement, it could benefit from a formally documented process to identify and monitor new developments and guidance in procurement, including responsibilities for monitoring external procurement developments. While the Procurement Policy Analysis and Reporting (PPAR) unit fulfills this function in practice, the lack of a formal assignment of responsibility may reduce clarity, increase reliance on informal processes, and elevate the risk of inconsistent monitoring coverage. This could include formal records, logs, or trackers documenting the identification and assessment of new procurement developments and trends. The audit noted that there were two trackers used to document the analysis and assessment of (1) new requirements from the amended Directive on the Management of Procurement and (2) audit findings and recommendations: The audit examined the process that FPB undertook to identify and assess new requirements from the amended Directive on the Management of Procurement (2024), which included the addition of the Mandatory Procedures for Business Owners When Procuring Professional Services. The audit observed that FPB had reviewed and assessed the implications of the changes, including the identification of existing processes and procedures, gaps between existing processes and the new requirements, the impacts on service when implementing the new requirements, and the actions needed to be taken in order to implement the new requirements. This analysis was documented in a spreadsheet, and a summary of updates on changes to procurement was presented to the Finance and Real Property Committee in September 2024. The audit team believes that this tracker could be expanded to include updates for other changes to policy requirements, including subsequent Contracting Policy Notices that were issued in 2024 and 2025. The audit also examined the process used by FPB for identifying and assessing key findings and recommendations resulting from internal and external audits. The audit found that FPB maintains an Audit Tracker to log key findings and recommendations from internal and external audits and reviews. The tracker identifies management action plan items, actions taken to date, date of implementation, and results achieved from the actions. AEB acknowledges that in this time of rapidly changing requirements and frequent and intense scrutiny of government procurement, the Department has made significant efforts to address, prioritize, and take action to ensure compliance and alignment with central agency policies and guidance, in addition to addressing audit findings. To better enable the Department to keep pace with the ongoing changes, it may be beneficial to expand the current monitoring process to ensure timely identification of changes through proactive environmental scanning and engagement with central agency sources; complete documentation of these developments in a centralized log or tracker; clear accountability for monitoring, assessment, and follow-up actions; comprehensive communication to all relevant stakeholders; and documented decision-making, including assigned responsibilities, implementation timelines, and status updates.	Recommendation 1: It is recommended that the ADM CMSS expand the current monitoring process to formally capture the changing procurement landscape, including changes to procurement policy and recommendations from audits and reviews. Management response: Procurement will leverage existing trackers to consolidate and create a master tracking document, to be made available to the procurement managers and senior management, ensuring procurement updates are centrally managed and accessible to relevant stakeholders. This tracker will be updated as central agencies advises of changes, via updates to Directive on the Management of Procurement, updates sent to the NRCan Senior Designated Official for Procurement (SDO), etc. The master tracker will include who is responsible for updates, timelines for implementation, departmental specific considerations, etc. This master tracker will be updated on an ongoing basis. Updates to the SDO are issued via AEB’s quarterly audit tracker and as an information note when not a result of an audit. In addition, all relevant stakeholders, including the SDO of Procurement, can be provided the internal master tracker to review when updates to internal procurement processes are required. Position responsible: Senior Director, Finance and Procurement Services (FPS) Manager, Procurement Policy Analysis and Reporting (PPAR) Timing: Spring 2026
Updating of policies, controls and processes The audit examined whether internal procurement policies and procedures are reviewed and updated in response to new developments and guidance. The audit also examined whether changes to procurement controls and processes are implemented in a timely and consistent manner across the organization and whether there is a supporting verification process to ensure compliance. The audit found that changes to procurement controls and processes are implemented in a timely and consistent manner across the organization. For templates and forms that were developed by central agencies, FPB has implemented their use immediately. This includes the Digital Services Contracting Questionnaire which business owners must complete and submit to the Office of the Chief Information Officer of Canada for IT-related professional services procurement requests. FPB also took action in a timely manner to develop internal processes and forms to address changing policy requirements. For example, a Contracting-Out form was developed and implemented for business owners to document their need and justification to contract-out professional services. The audit observed that procurement managers and procurement team leads regularly conduct file reviews as part of the Contract Quality Assurance Program to ensure that the required templates are used and that the new processes are being followed to ensure compliance. This practice helps to identify gaps and support learning and continuous improvement. The Department has developed a Departmental Procurement Management Framework (PMF), as per the requirement in the TBS Directive on the Management of Procurement. The PMF and accompanying notes are intended to provide guidance on the effective stewardship and common behaviors toward achieving governmental and departmental procurement objectives, and to ensure that activities are sufficiently and appropriately risk managed and controlled. The PMF came into effect in January 2023 and is intended to be an evergreen document. The audit team noted that there is no indication of how often the PMF would be reviewed and updated. In 2024, TBS amended the Directive on the Management of Procurement to include Mandatory Procedures for Business Owners in Appendix F. The Contracting Policy Notice 2024-1 summarized the four key areas that are impacted by the amended Directive, including actions that Departments must implement. The Contracting Policy Notice also advised departments to update and revise their PMFs to align with the amended Directive. While the Department had implemented these new requirements, the audit found that NRCan’s PMF has not been updated to reflect these new elements. Although not mandated by TBS, the audit team believes that NRCan’s PMF should be updated and expanded to address the new elements that have been added.	Recommendation 2: It is recommended that the ADM CMSS establish a reasonable frequency for the review and update of the Procurement Management Framework to align with central agency guidance, including the Directive on the Management of Procurement. Management response: The Procurement Management Framework (PMF) is to be updated by March 31, 2027, as part of the Investment Planning and Project Management (IP-PM) Letter of Recommendations. Once the PMF has been updated and signed by the Senior Designated Official for Procurement, Procurement will implement a yearly review cycle on a go forward basis. Position responsible: Senior Director, FPS Manager, PPAR Timing: PMF to be updated March 31, 2027 Yearly review of PMF to determine if updates are needed.
Training and awareness The audit examined whether staff receive timely training and communication on updated policies, procedures, and risk management practices. The audit team noted that FPB has developed a Procurement 101 training session to inform business owners of the process for procurement at NRCan. This training is hosted twice annually, and the materials are made available on the eProcurement Procedures and Documents page. That page is also kept up to date to inform business owners of changes impacting their work and documents required for the submission of procurement requests into the eProcurement system. The audit team was informed that FPB plans to develop a new Procurement 102 training that will focus on new and additional roles and responsibilities of business owners in light of the amended Directive. This is recognized as a good practice and FPB is encouraged to continue to develop and provide support and training to support business owners through the procurement life cycle. There is formal mandatory training for procurement staff at onboarding and for system access, which includes Procurement Fundamentals, Overview of Materiel Management, and Overview of Real Property Management. When procurement policies change, procurement managers provide targeted training to implicated procurement officers, who are organized by commodity teams. This restructuring of the Procurement Services Unit into commodity teams took place in April 2024 and has allowed teams to develop specialized expertise in their commodity type, provide more consistent information to business owners, and to increase efficiency in how procurement requests are processed. Organizing procurement officers into commodity teams has also enabled team leads and managers to focus training and communication efforts depending on the type of commodity, as the policy changes may not be relevant or applicable to all commodity teams. A summary of changes is shared at all-staff meetings as appropriate. Commodity team leads also take the initiative to create and deliver targeted materials, but this is not formally required or standardized, resulting in variability in the quality and depth of training provided. Informal practices such as verbal debriefs, email clarifications, and shared folders for templates and checklists are used to for communication and awareness. Efforts to verify staff understanding and application of changes rely heavily on individual oversight approaches by team leads, such as file reviews, real-time coaching, and peer collaboration. These practices help to identify gaps and support ongoing learning; the current approach could be improved by making it more systematic and consistently implemented across all procurement commodities. We would encourage FPB to expand these practices to ensure consistency in the quality and depth of training provided across commodity teams.	There are no recommendations related to these findings.

About the audit

A risk-based approach was used in establishing the objectives, scope, and approach for this audit engagement.

Audit purpose and objective

The audit was included in the 2025-2026 Integrated Audit and Evaluation Plan, approved by the Deputy Minister on June 17, 2025

Scope

Significant recent audit work by external auditors, including the Office of the Auditor General and the Office of the Procurement Ombud, has focused on examining and testing the Department’s compliance to procurement rules by reviewing specific contracts and transactions. (Refer to Appendix A for further details on previous audits.) To avoid duplication the current audit relied on this previous work and focused on areas not included in those previous audits. The audit also excluded acquisition cards and related processes, due to recent continuous audit coverage in this area. The audit considered activities undertaken for the period from April 1, 2022 to September 1, 2025, in order to include the most recent activities and processes.

Approach and methodology

The approach and methodology followed the Institute of Internal Auditors' Global Internal Audit Standards and the Treasury Board Policy on Internal Audit.
The audit included tests considered necessary to provide such assurance. Internal auditors performed the audit with objectivity as defined by above-mentioned Global Standards.
The audit included the following key tasks:

Interviews with relevant stakeholders and walkthrough of processes
Document reviews and analysis, based on interviews and walkthroughs

Audit criteria to address the objectives of the audit were developed in conjunction with the TBS Directive on the Management of Procurement. The criteria guided the fieldwork and formed the basis for the overall audit conclusion.

Audit objective	Audit criteria
To provide assurance that a process is in place to monitor new developments and guidance in procurement and ensure timely updates to internal processes and controls to support compliance and continuous improvement.	1.1 Monitoring of new developments and guidance The organization has a documented and operational process to identify, assess, and monitor new developments and guidance in procurement.
	1.2. Updating of internal policies and procedures Internal procurement policies and procedures are reviewed and updated in response to new developments and guidance.
	1.3 Implementation of updated controls and processes Changes to procurement controls and processes are implemented in a timely and consistent manner across the organization and there is a supporting verification process.
	1.4 Training and awareness Staff receive timely training and communication on updated policies, procedures, and risk management practices.

Appendix A – Previous audits

The following 6 audits and reviews were conducted between 2021 and 2025 on NRCan's procurement practices; three of these were horizontal audits and include other departments in their scope. The areas reviewed in these reports were not included in the current audit to avoid duplication. The Office of the Comptroller General of Canada also recently completed in April 2025 a Horizontal Internal Audit of Procurement Governance, which NRCan was not included in but is included in the table below as the audit findings and recommendations were considered relevant in the scoping of the current audit.

Note: All of the recommendations to NRCan contained in the reports and related management action have either been fully implemented or are currently being implemented by management.

Audit name and year	Audit objective
August 2025 Office of the Procurement Ombud Follow-up report to the 2020-2021 procurement practice review of Natural Resources Canada	In 2020-2021 the Office of the Procurement Ombud (OPO) conducted the “Procurement Practice Review of Natural Resources Canada”(NRCan), which included 8 recommendations to address identified issues. This follow-up report includes a summary of results from the initial review and OPO’s assessment regarding progress made by NRCan in implementing its 8 recommendations.
June 2025 Office of the Auditor General of Canada Report 4—Professional Services Contracts with GCStrategies Inc.	This audit focused on whether professional services contracts awarded and payments made by federal organizations to GCStrategies and other companies incorporated by its co-founders were in accordance with applicable policy instruments and whether value for money for these contracts was obtained. NRCan was one of 31 federal organizations included in the audit.
April 2025 Office of the Comptroller General of Canada Horizontal Internal Audit of Procurement Governance	The audit aimed to assess whether TBS and PSPC provide sufficient guidance, direction and support to support compliant procurement. The audit also assessed whether procurement management frameworks in selected departments are established, aligned with applicable requirements and implemented; and support the fulfillment of procurement specific roles and inform decision-making. NRCan was not included in the scope of this audit, but this audit is included in this table as the audit findings and recommendations were considered in the scoping of the current audit.
June 2024 Office of the Auditor General of Canada Report 5—Professional Services Contracts	This audit focused on whether professional services contracts were awarded to McKinsey & Company in accordance with applicable procurement policies and whether the federal public sector obtained value for money. NRCan was one of 10 departments included in the audit.
March 2024 Office of the Procurement Ombud Procurement Practice Review of Contracts Awarded to McKinsey & Company	This review was undertaken to determine whether procurement practices pertaining to contracts awarded to McKinsey were conducted in a fair, open, and transparent manner. NRCan was one of 10 departments included in the practice review.
March 2023 Natural Resources Canada Internal Audit of Federal Government Consulting Contracts Awarded to McKinsey & Company	This audit was undertaken to determine whether the integrity of the procurement process was maintained, procurement practices were conducted in a fair, open, and transparent manner consistent with the Treasury Board Policy and with the organization’s internal processes and control frameworks.
July 2022 Natural Resources Canada Audit of the Management of Procurement Services - Natural Resources Canada	The objective of this audit was to assess the effectiveness and efficiency of management processes related to the procurement function, and the adequacy of governance over procurement operations, as it related to meeting the needs of the Department.
November 2021 Office of the Procurement Ombud Procurement practice review of Natural Resources Canada	This review was undertaken to determine whether NRCan’s procurement practices pertaining to evaluation criteria and selection plans, solicitation documents, and evaluation of bids and contract award, supported the principles of fairness, openness and transparency.

Language selection