Continuous Auditing of Key Controls for Selected Processes - Annual Report for Fiscal Year 2020-21

Audit and Evaluation Branch
Natural Resources Canada

Presented to the Departmental Audit Committee
October 19, 2021

Table of Contents

• Introduction
  • Accomplishments this Year
  • Objectives
  • Scope
  • Methodology
• Key Findings and Recommendations
• Conclusion
  • Acknowledgments
  • Conformance with Professional Standards
• APPENDIX A - Audit Criteria- Continuous Audit of Pay and Benefit Processes
• APPENDIX B - Audit Criteria- Continuous Audit of Offshore Revenues and Transfers

Introduction

Continuous auditing provides ongoing assurance on specific management processes and controls to enable more timely insight into possible risk and control issues. It enables the provision of findings to management on key controls related to financial and non-financial processes in a timely manner. The combination of continuous and regular audit activities provides adequate coverage of the Department’s key processes and controls. During the annual risk-based audit planning exercise, consideration is given as to whether a continuous or standard assurance audit is the most effective approach for providing assurance.

Continuous audits can significantly enhance the internal control processes and frameworks within an organization. They differ from traditional audits, which tend to be more comprehensive in terms of their scope. Continuous audit activities undertaken by Natural Resources Canada’s (NRCan) Audit and Evaluation Branch (AEB) are formally reported through this annual assurance report on key controls. This report presents the results of the continuous auditing activities undertaken by the AEB in fiscal year (FY) 2020-21.

Accomplishments this Year

With support from the Deputy Minister, Senior Management, and the Departmental Audit Committee (DAC), the AEB continued to provide continuous auditing capacity for NRCan in FY 2020-21.

The continuous audit activities conducted in FY 2020-21 focused on identifying potential control issues related to specific processes identified in the approved 2020-25 Integrated Audit and Evaluation Plan (IAEP). Accordingly, the following two areas were assessed via continuous auditing:

• Pay and Benefits Processes; and
• Offshore Revenues and Transfers.

The AEB was able to provide timely assurance to senior management and the DAC on the functioning of key controls for the areas identified above. Findings and recommendations resulting from the examination of these processes were provided to management in order to assist them with further improving existing control mechanisms. These findings and recommendations were also presented to the DAC along with the associated management responses and action plans.

In addition to AEB’s continuous audit activities, NRCan’s management was engaged in continuous monitoring in accordance with the Treasury Board’s (TB) Policy on Financial Management. The combined efforts by both the AEB and management have resulted in improvements to control processes and the correction of any identified control deficiencies.

Objectives

The objectives of the Continuous Audits performed was to provide reasonable assurance that:

• Core management and oversight controls are in place and working as intended to support key pay and benefits processes. This objective takes into consideration the results of the most recent Office of the Auditor General’s (OAG) Public Accounts Audit, which identified opportunities for NRCan to strengthen key areas around its Human Resources (HR)-to-Pay process; and
• Key financial and monitoring controls are operating effectively for selected offshore revenues and transfers.

Scope

The scope and period of review for each of the continuous audit activities was:

The key controls assessed during the two continuous audits are provided in Appendices A and B.

Methodology

• Given that core management and oversight controls were assessed for the Continuous Audit of Pay and Benefit Processes, the engagement reviewed related sample testing results and approaches performed by the Office of the Primary Interest, as it related to the audit criteria provided in Appendix A; and
• The sample size for the Continuous Audit of Offshore Revenues and Transfer was selected to provide sufficient information to conclude on the operating effectiveness of selected controls. As such, the engagement examined fifteen (15) key controls for a sample of 25 transactions that belonged to one of the following categories: (i) offshore royalties and transfers; (ii) corporate income tax transfers; (iii) forfeiture receipts and transfers; and (iv) crown share adjustments.

Key Findings and Recommendations

The following summarizes the findings and recommendations for each of the continuous audit engagements. The audits provided reasonable assurances when arriving at conclusions for the key controls that were tested, which were assessed as either- effective, partially effective, or ineffective, based on the following criteria:

• Effective: The key control was operating effectively throughout the audit period;
• Partially effective: The key control was not operating effectively throughout the audit period; and
• Not effective: The key control was not in place.

Continuous Audit of Pay and Benefit Processes

The continuous audit found that, of the six key management and oversight controls assessed, one control was effective, four controls were partially effective, and one control was not effective as it has yet to be implemented. This engagement resulted in five recommendations, specifically around the following management and oversight controls environment: (i) monitoring of timely completion of certification authority (Section 34 (S.34) of the Financial Administration Act [FAA]) approvals for pay transactions; (ii) manual interventions in pay transaction processing; (iii) document retention in support of pay transaction processing; and, (iv) HR-to-Pay process training.

The continuous audit also followed up on prior year recommendations conducted in FY 2018-19 and confirmed that three of the four recommendations have been fully implemented, and the remaining recommendation is partially implemented.

Audit of Offshore Revenues and Transfers

The continuous audit found that of the 15 key financial and monitoring controls tested, 14 were operating effectively and one was partially effective. There were no recommendations resulting from this year’s continuous audit. The engagements noted that related S.33 checklists were going through an electronic transformation to adapt to the changing work environment, as a result of the COVID-19 pandemic. During this period, the usual verification steps were followed and no errors were observed during the course of the audit.

The continuous audit also followed up on prior year recommendations and confirmed that the recommendations had been fully implemented and no additional follow-up was required.

Conclusion

One of the two continuous audits performed during FY 2020-21 will continue to be a part of the AEB’s 2021-26 IAEP, given that:

• The Continuous Audit of Pay and Benefits Processes will continue to provide management with assurance on the functioning of key controls in place around NRCan’s HR-to-Pay process and the topic continues to be an on-going priority for the Department.
• The Continuous Audit of Offshore Revenues and Transfers rendered positive results, and all previous recommendation have been fully implemented, as such, the AEB will replace this engagement in FY 2021-22 with the Continuous Audit of Acquisition Cards.

Acknowledgments

The AEB would like to thank those individuals who contributed to these continuous audits and particularly employees who provided their insights and comments.

Conformance with Professional Standards

In my professional judgement as Chief Audit and Evaluation Executive, the continuous audit activities along with this annual report conform with the Institute of Internal Auditors' International Standards for the Professional Practice of Internal Auditing and the Government of Canada’s Policy on Internal Audit, as supported by the results of the Quality Assurance and Improvement Program.

Michel Gould, MBA, CPA, CMA, CIA
Chief Audit and Evaluation Executive
October 19, 2021

APPENDIX A - Audit Criteria- Continuous Audit of Pay and Benefit Processes

The objective of this continuous audit was to provide reasonable assurance that NRCan core controls are in place and working as intended to support key pay and benefits processes, taking into consideration the results of the most recent OAG Public Accounts Audit for which NRCan was identified to further strengthen its HR-to-Pay Process.

Core Control Activities by Area of Focus

1. #1. Timely Completion of Certification Authority (Section 34) - The Department has implemented a process to monitor that Section 34 approvals are performed in a timely manner and that appropriate supporting documents exist
   1. 1.1 The Department has implemented monitoring procedures to assess the timeliness of Section 34 approvals and to assess whether the appropriate source documents exist.
   2. 1.2 The Department has implemented a process for following up on exceptions found during monitoring, and reporting results to senior management.
   3. 1.3 The Department has documented its monitoring program.
2. #2 Manual Intervention within Pay Administration Process - The Department has established a clear understanding of the manual interventions required for the treatment of pay transactions
   1. 2.1 The Department has clearly identified the manual interventions required to process pay.
   2. 2.2 The Department has documented and communicated procedures that identify when and how manual interventions should be performed.
   3. 2.3 The Department has established an approach to evaluate the effectiveness of the procedures related to manual interventions.
   4. 2.4 Relevant documented procedures are periodically reviewed and updated.
3. #3 Document Management related to HR-to-Pay Process
   1. a) The Department has established an approach for clearly communicating document retention guidelines to be followed by staff and ensuring that the guidelines are easily accessible for reference.
   2. b) The Department has established monitoring procedures to ensure that the appropriate documents are being retained in the right places according to Library and Archives Canada’s guidelines.
   1. 3.1 (per 3a) The Department ensures that document retention policies are communicated to relevant audiences.
   2. 3.2 (per 3a) Document retention policy/guidance is readily available to all employees.
   3. 3.3 (per 3b) The Department has established monitoring procedures to assess that the appropriate documents are retained in accordance with established guidance, including follow-up procedures for identified exceptions.
4. #4 HR-to-Pay Process Training
   1. a) The Department assesses and identifies training needs at all levels and communicates them to key stakeholders (e.g. Public Services and Procurement Canada [PSPC]).
   2. b) The Department tracks participation in both current and new training and takes corrective measures to ensure employee participation.
   1. 4.1 (per 4a) The Department ensures that key stakeholders (e.g. supervisors and team leads) are involved in identifying trends in errors or knowledge gaps that exist with staff.
   2. 4.2 (per 4a) The Department communicates training needs to key stakeholders (e.g. PSPC, Office of the Chief Human Resource Officer) on a timely basis.
   3. 4.3 (per 4b) The Department has established participation targets for relevant training programs.
   4. 4.4 (per 4b) The Department has established an approach for evaluating the effectiveness of relevant training programs.

APPENDIX B - Audit Criteria- Continuous Audit of Offshore Revenues and Transfers

The objective of the continuous audit was to provide reasonable assurance that key financial and monitoring controls were operating effectively for the selected offshore revenues and transfers.

This Appendix details the specific key control areas that were tested, as they relate to offshore revenues and transfer payments.

Key Financial and Monitoring Controls

1. Offshore revenue cash receipts:
   1. An accurate notification of incoming revenue with SAP financial coding is sent to Accounts Receivable (A/R).
   2. The notification of incoming revenue is matched to the Credit Notice Report.
   3. Cash receipts are recorded accurately [General Ledger Account/Financial Reporting Account/Object Code (GL/FRA/ECON)] and for the proper period in SAP.
2. Transfer payments:
   1. Transfer payments are approved in accordance with Financial Administration Act (FAA) Section 34 (S.34) requirements- i.e. for account verification purposes. 
   2. Transfer payments are approved in accordance with FAA S.33 requirements for quality assurance purposes (including completion of the Account Verification Statutory Payment Checklist).
   3. Payment vouchers are recorded accurately [GL/FRA/ECON] and for the proper period in NRCan’s Financial Management and Accounting System (SAP).
3. Compliance with legislative and regulatory timelines:
   1. NRCan ensures that receipts from oil companies are received by the last day of the month following the month to which they relate.
   2. NRCan’s Revenue Fund is credited within 10 working days after the end of each month that the remittance is received.
   3. Payment is made to the province before the end of the month in which the credit to the revenue fund was made.
4. Accruals of revenues (receipts) and transfers (payments):
   1. Receivables at year-end and reversal entries are established, are accurate, recorded in the correct period, and reviewed and approved by the Corporate Reporting Unit.
   2. Payable at year-end (PAYE) and reversal entries are prepared accurately and recorded in the correct period.
   3. PAYEs are approved in accordance with FAA S.34 requirements.
   4. PAYEs are approved in accordance with FAA S.33 requirements by Finance Services (including the Quality Assurance Checklist for PAYE), and reviewed and approved by the Corporate Reporting Unit.
5. Tracking, monitoring, and reconciliation:
   1. Incoming offshore revenues (receipts) and outgoing transfers (payments) are accurately tracked in a central repository.
   2. An annual reconciliation between a cash basis and a year-end basis is performed.