Report on the Audit of the Delegation of Financial Authorities
2. Findings, Recommendations and Management Responses
2.1 Separation of Financial Authorities
- Audit Criterion 11
- There is appropriate separation of duties related to the exercise of financial authorities.
- Key Finding:
- The Delegated Financial Authorities Chart assigns potentially incompatible authorities to functional positions in the Department.
28. The general principles of financial signing authority, as stated on the Department of Justice intranet site, state that:
“In keeping with sound internal control practices, each of the following steps in the spending process shall be separated where possible:
- Procurement (Part 2 of the Delegation Chart);
- Certification of the receipt of goods, the provision of services, and entitlement (Confirmation of Contract Performance and Price under Section 34 of the FAA);
- Determination of entitlement, verification of accounts, and preparation of requisitions for payment or settlement (Account verification under Section 34 of the FAA); and
- Certification of requisitions for payment or settlement (Payment Authority under Section 33 of the FAA).”
29. This is consistent with sound management and control practices and with guidance provided by the TB and TBS.
30. The Delegation Chart assigns potentially incompatible authorities to certain functional positions. For example: position levels 9 and 10 for functional specialists in the Contracting and Materiel Management Division are delegated: full expenditure initiation and commitment authority (Section 32 of the FAA); full certification authority (Section 34 of the FAA); transaction (contracting) authority (Part 2 of the Delegation Chart) ranging from $5K to $2M depending on their position title and the type of expenditure; and, full authority for the disposal, transfer and write-off of Departmental materiel and assets including intangible assets. Similarly, the Delegation Chart allows for the delegation of contracting authority, through acquisition cards, to finance officers that are delegated full financial authorities for spending, certification, and payment.
31. The review of approved signature cards confirmed that the potentially incompatible authorities for certain positions as identified above, have in fact been delegated to individuals in those positions. Detailed testing of payment transactions did not identify any instances where potentially incompatible authorities were actually exercised.
32. FPB has some controls in place to detect the exercise of incompatible duties. Since February 2012, the Financial Policy and Controls Division conducted process testing as per the TB Policy on Internal Control. However, these internal controls process testing was not designed specifically to be a robust, continuous compensating control to address the risk to the delegation and potential exercise of incompatible authorities by functional specialists. In addition, finance staff are expected to identify the exercise of incompatible duties through its pre-payment verification process. The effectiveness of the pre-payment verification control is minimized in the current post-consolidation environment, where finance staff responsible for verification may not have sufficient knowledge of the positions occupied by people with signing authorities in other regions. For example: an accounts payable specialist or finance officer at the Edmonton hub may not know that a person in British Columbia exercising FAA Sections 32, 34, and contracting authority for a transaction is a contracting specialist. Thus, the accounts payable specialist or finance officer may rely solely on the authorities granted on the SSC of the individual.
33. Effectiveness of the pre-payment verification control would be further compromised in an environment of risk-based account verification, where not all payment requests would be verified by finance prior to payment.
34. Separation of incompatible authorities via the delegation chart is a preventative and more effective control in mitigating risk of errors, misappropriation of funds, to the accountability for expenditures and to the stewardship of funds.
Recommendation and Management Response
1. The Manager, Financial Policy and Controls Division, should adequately separate financial authorities to functional positions in the Delegated Financial Authorities Chart. (High Risk)
Agreed. Expenditure initiation authority, commitment authority (Section 32 of the FAA), and certification authority (Section 34 of the FAA) have now been removed from contracting functional specialist positions on the Delegation of Financial Signing Authorities Chart (Delegation Chart) which was approved on October 24, 2013. New Specimen Signature Cards for these positions will also be prepared by March 31, 2014, which will effectively remove these delegations from the incumbents' financial signing authorities. Separation of financial authorities within the duties of the other functional specialist positions will be assessed during the next comprehensive review of the Delegation Chart. Target completion date: November 30, 2015.
2.2 Quality Assurance and Monitoring
- Audit Criterion 13
- Risk-based management practices are established that enhance the effectiveness and efficiency in the exercise of financial authorities.
- Audit Criterion 14
- There is formal process for quality assurance of the payment process and for the monitoring of compliance to the delegation of authorities, related financial management legislation, policies and authorities. Results of quality assurance and monitoring are reported in a timely manner to senior management or delegated oversight body.
- Key Finding:
- A formal, systemic process for continuous quality assurance and monitoring of the exercise of financial authorities has not been implemented.
35. Monitoring is a fundamental component of a management control framework, to identify exceptions which require correction or information that may signal the need to re-evaluate controls. In the context of the exercise of financial authorities, monitoring is primarily accomplished during the verification and payment of accounts, through the quality assurance function exercised by financial officers vested with FAA Section 33 payment authority.
36. The TBS Directive on Account Verification states that: "
accounts for payment and settlement are verified in a cost-effective and efficient manner while maintaining the required level of control to ensure prudent management of financial resources." The directive further requires that payment authority exercised by financial officers is based on risk, which includes a full review of high-risk transactions and a sample review of medium and low risk transactions. Departments are required to develop sampling plans that are cost-effective and respond to Departmental risks. This requirement was first introduced in the 1998 TB Policy on Account Verification and restated in the current 2009 Directive on Account Verification.
37. At the Department of Justice, the FAA Section 33 payment verification review process was not risk-based. Once expenditures have been verified and certified pursuant to FAA Section 34 by RCMs, certified invoices are sent to accounts payable operations, at the Ottawa or Edmonton hub in the post-consolidation environment, for Section 33 and payment processing. These accounts payable operations review and verify 100% of financial transactions prior to payment and validate the Section 34 authority. The initial review and verification is conducted by accounts payable specialists prior to input in the financial system. Prior to exercising FAA Section 33 authority, finance officers then perform a second verification of expenditures that, to a large degree involves re-performing the work of the accounts payable specialists. For transactions processed post-consolidation; this second verification was done for all transactions in one of the hubs and the second hub it was done on a judgmental basis.
38. This process is inefficient as it results in duplication of effort at two levels for FAA Section 33: at the initial review by the Accounting Specialists who re-perform account verification undertaken by RCMs and their assistants; and, during the review by finance officers who perform similar verification procedures to those of the accounts payable specialists. A risk-based approach to account verification by accounts payable operations in the two hubs would enhance process efficiency. 100% pre-payment verification by accounts payable operations increases the possibility of obscuring accountability, as there is a risk that RCMs may come to expect that verification is the responsibility of finance.
39. Results of a benchmarking exercise with other government departments confirmed that for all six respondents-regardless of size, level of activity and operational structure (decentralized, hubs, or Centralized-NCR presence)-there is a risk-based approach and methodology for the quality assurance and monitoring of the FAA Section 34 certification process and related payment verification activities. Although methodologies varied among respondents, all are based on prepayment verification of high risk transactions by finance officers and post payment verification of medium and lower risk transactions using established gating and sampling methodologies.
40. When errors or omissions are identified by accounts payable operations in the two hubs during the verification process, RCM and their assistants are requested to provide the required documentation to correct the errors. Depending on the severity of the errors or omissions, payment may be halted at this stage pending satisfactory resolution of the issue. Accounts payable specialists and finance officers confirmed that there is currently no ongoing process for logging, tracking, analysing and reporting of errors.
41. A formal process that includes tracking, analyzing and reporting of errors by nature, severity, and area of responsibility would be a more effective monitoring tool. Formalizing the process would provide a means of demonstrating the extent to which managers are effectively exercising their financial authorities in accordance with the Departmental delegation instruments. A formal process would also support the appropriateness and efficiency of related internal controls. The results of a formal process, would better inform related training strategies and activities and the process for review of the delegation of financial authorities of the Department.
Recommendation and Management Response
2. The Director, Accounting Operations, should develop and implement:
- A risk-based approach to the quality assurance and monitoring process of account verification for Accounts Payable; and
- A formal process for tracking, analyzing and reporting on monitoring results to senior management. (Medium Risk)
- A risk assessment of accounts payable transactions has been completed and a post-payment sampling methodology has been developed. Full implementation of this risk-based verification and post-payment quality assurance is planned for December 2014.
- A process for tracking, analyzing and reporting to senior management, the results from the monitoring (sampling) of low, medium and high risk transactions is presently being developed. The process to conduct post-payment quality assurance on these transactions is planned to begin January 2015. Formal communication to senior management will commence with the results of the last quarter of the 2014-15 fiscal year, which will be reported to senior management by September 30, 2015.
Target completion date: September 30, 2015.
2.3 Review of Delegated Financial Authorities
- Audit Criterion 7
- There is a process in place for regular (at least annually) consultation on and review of the delegation of authority instruments by senior management in the Department.
- Key Finding:
- Review of delegated financial authorities and related instruments would benefit from formalization and documentation of the process.
42. Informal review and consultation activities took place to assess the relevancy and appropriateness of authorities and to update delegation instruments. This included call letters sent out by the FPB in September 2012 as part of an annual review, followed by email communications discussing specific issues and areas of authority that included: the appropriateness of levels of authority, the effect of certain legislation, trading conventions, treaties, government policies; and, validation and update of the TOEP. However, the audit found no formal documentation or plan that guides the annual review activities which impacts the ability to demonstrate the adequacy of the review in terms of scope and timing.
43. Branch officials reported that the last comprehensive review of the Delegation of Authorities took place prior to the scope of this audit and another comprehensive review is currently in the planning stage. There is no documented explanation of how the scope of a comprehensive review differs from annual or ongoing review activities currently undertaken. Although SSCs were updated in 2012, there is no documented process or rationale for the frequency or extent of their review and update.
44. Formalization and documentation of the process should, at a minimum, address:
- identification of key components to be reviewed (e.g. Delegation Chart, SSC, processes for maintenance of delegations);
- frequency of review (ongoing or periodic);
- key review activities;
- identification of processes that will inform the reviews (e.g., quality assurance and monitoring for account verification, risk assessments, gap analyses); and,
- roles and responsibilities for key positions in the processes that will be either responsible, accountable, consulted or informed.
45. The Financial Policy and Controls Division has a plan to develop and undertake a comprehensive "Review of Delegations of Authority Project." The most recent Gantt chart for the project identifies deliverables and milestones including a Project Charter; Review of Delegation Chart, Supporting Notes and TOEP; development of policy instruments and process flowcharting for the review process; development and delivery of training; and, update of all SSCs. However, Gantt chart timelines for completion and implementation are long as the project is expected to be complete in 2015-2016.
46. A documented and formal process for the review of Delegated Financial Authorities and related instruments would better demonstrate the adequacy of the scope and frequency of the reviews. A documented and formal process would also enhance compliance to the requirement of the TBS Directive on Delegation of Financial Authorities.
Recommendation and Management Response
3. The Manager, Financial Policy and Controls Division should formalize, document and implement the process for the review of the Delegation of Financial Authorities, in compliance with the Treasury Board requirement for annual review. (Low Risk)
Agreed. The process for the annual review of the delegation of financial authorities has been in place since the issuance of the new TBS Directive on Delegation of Financial Authorities on April 1, 2009. The latest review culminated in the Delegation Chart being approved by the Minister on October 24, 2013. The need to formalize and document this process is recognized, and will be completed during fiscal year 2014-15, as part of the comprehensive Review of Delegation of Authorities project. Target completion date: December 31, 2014.
2.4 Delegating authorities through Specimen Signature Cards
- Audit Criterion 2
- Authorities are aligned with responsibilities and are delegated to positions identified by title, not to named individuals.
- Key Finding:
- There is inadequate consideration, review, and challenge in the delegation of authorities to individuals via the current Specimen Signature Card process.
47. The audit found that, without exception, authorities were delegated to positions by title and not to named individuals. This complies with the requirements set out in the TBS Directive on Delegation of Financial Authorities for Disbursements.
48. However, in the SSCs, the limits under the various authorities granted to individuals were always the maximum allowed by the Delegation Chart for any given level of managerial authority. For all SSCs reviewed during the various testing procedures, there were no instances noted where limits of authority designated to individual managerial positions were less than the maximum provided for in the Delegation Chart.
49. Interviews with RCM designated to exercise Financial Authorities confirmed that certain authorities were granted to them without there being an operational requirement. RCMs reported having never or seldom used some authorities. This includes, for example: the authority to dispose or transfer materiel, as well as Grants and Contributions.
50. The audit team is of the opinion that the above observations are indicators of insufficient consideration, review and challenge when managers are designated to exercise financial authorities.
51. Adequate consideration, review and challenge of the delegation of authorities through the SSC process would further align authorities to responsibilities and minimize the risk of the designation and exercise of inappropriate types or levels of authority.
Recommendation and Management Response
4. The Director, Accounting Operations should ensure that there is adequate consideration, review and challenge of the types and level of authorities granted to incumbents through the Specimen Signature Card process. (Low Risk)
Agreed. The Director of Accounting Operations currently ensures that the types and level of authorities requested are in compliance with the Delegation Chart, are properly authorized by the delegated manager and approved by the Functional Specialist(s) as required, and that there is no other RCM that holds direct signing authority for the cost centre. Together with Recommendation 5, more awareness provided through training to RCMs will also ensure future requests are reviewed and challenged by the RCMs prior to the Specimen Signature Card being sent to Accounting Operations for processing. The Procedures for Completing the Specimen Signature Card will also be updated to reflect the requirements that RCMs are to consider, review and challenge the types and levels of authorities being granted to incumbents. Target completion date: December 31, 2014.
2.5 Requirements for further training and guidance
- Audit Criterion 3
- Individuals are designated to exercise authority only after they have acquired appropriate training.
- Audit Criterion 8
- There is effective communication, awareness and training related to financial authorities and related policies and responsibilities.
- Audit Criterion 12
- Financial Authorities are exercised in accordance with the delegation instruments of the Department.
- Key Finding:
- There is a need to further train and guide Responsibility Centre Managers, Administrators and finance representatives performing FAA Section 33 functions.
52. Detailed testing of 139 contract expenditure transactions (60 and 79 processed at the Ottawa and Edmonton accounts payable hubs respectively) was carried out by the audit team. The sample was chosen from a population of 8,386 transactions (3,477 processed at the Ottawa hub and 4,909 processed at the Edmonton hub) focusing on transactions processed after the consolidation of accounts payable activities in the two hubs. There were no exceptions with respect to the certification pursuant to Section 34 of the FAA, all such certifications were performed by persons with authority to do so. The testing did however result in the following findings:
- In 19% (27) of the transactions, there was inadequate evidence of proper spending authority:
- For 17 transactions: there was no expense initiation document, neither a formal FAA Section 32 signature nor other documentation from a person with delegated authority indicating approval of the expenditure.
- For 10 transactions: approval of the expense was done after the fact, either through a formal FAA Section 32 signature or other communication such as email or signed form authorizing the expenditure.
- In 5% (7) of the transactions, there was insufficient evidence supporting the basis for payment (e.g. contract, purchase order, agreement or receipts); and
- There were seven contracts (less than 1%) where a person without delegated authority signed a contract on behalf of the Minister. These exceptions were isolated to one individual in one regional office.
53. For some of the exceptions identified above related to inadequate, incomplete or untimely expense initiation, the accounts payable specialists had identified and noted the exceptions on the Payment Voucher (form summarizing payment information) during the pre-payment verification. For example: notations were evidenced indicating "no training approval" or "no commitment." However, there was no documented follow-up. The accounts payable specialists and finance officers reported that, depending on the nature and severity of the exceptions and the materiality of the transactions, the RCM or the Administrative Assistant may be contacted to obtain clarification or documentation. Interviews also revealed that there is no logging of exceptions and errors, or tracking of follow-up activities.
54. Accounts payable specialists performing FAA Section 33 pre-payment verification of expenditures stated that: they were aware of what to look for when reviewing expenditures. Policies and desktop procedures to guide them for verification of different types of expenditures were also accessible. However, accounts payable specialists did not utilize a checklist to document the specific steps taken when performing FAA Section 33 pre-payment verification. Further, the knowledge in support of FAA Section 33 pre-payment verification duties was gained through on-the-job training with more senior accounts payable specialists, not through formal training. Interviews with representatives of the Financial Policy and Controls Division and with finance officers in Accounting Operations revealed that FPB has not provided specific training on financial authorities to its functional specialists exercising Section 33 accounts verification or to accounts payable specialists. A session was offered for finance officers to train administrative assistants supporting responsibility centre managers; this training provided guidance on many of the principles and activities that are common to both the exercise of Section 33 and 34. As a next step it would beneficial to provide more in-depth training on the specific responsibilities for Section 33.
55. To date, courses provided by the Canada School of Public Service are a prerequisite for RCMs to obtain their financial authorities. This was confirmed through interviews with RCMs and audit testing conducted related to the training requirements for the issuance of SSCs. There is no training provided to RCMs by FPB related to financial authorities specifically at Department of Justice.
56. RCMs and regional finance representatives interviewed stated that the recent consolidation of finance has resulted in realignment of administrative-related financial duties for RCMs. Prior to consolidation of internal services; these duties were to a large part, carried out by the regional finance representatives, reporting to the Regional Directors General. The interviewees expressed concern that RCMs and their administrators may be assuming these duties without the requisite skills. Even though FPB has provided general training to Responsibility Centre Administrators (RCA) to address these concerns, there is a need for more intensive training at the RCM and RCA level with more direction including specific examples for guidance.
57. In addition to the elements identified in the paragraph above, training could also address the following topics for various stakeholders:
- For RCMs: the requirement to ensure that in designating individuals to exercise authorities, the authorities are risk-based and tailored to the individual's scope of responsibilities (see Section 2.4);
- For RCAs and accounts payable specialists: detailed requirements for account verification including the use of a checklist to document verification procedures and specific examples;
- For functional specialists, including finance and procurement officers: the need for minimum training requirements to be met prior to being delegated financial authorities;
- For finance officers: requirements for the review and quality assurance of the work of subordinate staff responsible for FAA Section 33 verification; and,
- The development of tools including forms, checklists and procedures in support of the quality assurance of FAA Sections 34 and 33 verification activities.
58. Regional finance representatives stated that due to competing priorities such as a week of financial training for regional finance officers in January 2013, corporate finance at NCR has been challenged to provide the requisite training and direction required. Accordingly, one regional finance office has designed a common training program for RCMs, RCAs and finance staff with the intent of rolling it out nationally.
59. Based on results of the testing of payment transactions, as well as the concerns and needs expressed by RCMs and regional finance representatives outlined above, a comprehensive training strategy and related training programs are required. A training strategy and program would further mitigate risks related to the delegation and exercise of financial authorities, and enhance account verification activities at both FAA Section 34 (RCM level) and FAA Section 33 (Accounts Payable).
Recommendation and Management Response
5. The Deputy Chief Financial Officer should develop and implement a comprehensive training strategy for the delegation and exercise of financial authorities, including identifying and assigning related responsibilities. (Medium Risk)
Agreed. As part of the comprehensive Review of Delegations of Authority project being undertaken by the Finance and Procurement Branch, a training strategy encompassing Responsibility Centre Managers, Administrators and Functional Specialists will be developed and implemented. The scheduled timeframe for this aspect of the project which is to consider training delivery options, development of material, and actual delivery of the training department wide is October 2014 to November 2015. This delegation of authority training strategy will also link to the Branch's development of an overall financial training program for RCMs and Administrators which will be completed by June 30, 2014. In the interim, the Financial Policy and Controls Division will modify the "Introduction to Delegation of Financial Signing Authorities (for Administrative Staff)" course, offered through the Professional Development Division's Training Calendar, to encompass RCMs. The next sessions for this modified course will be offered by June 30, 2014. Target completion date: November 30, 2015.
- Date modified: