Audit of Contracting and Procurement (Goods and Services)
Audit Report - March 2010

Audit of Contracting and Procurement (Goods and Services) Audit Report - March 2010 PDF Version (163 KB)

1.0 Executive Summary

1.1 Background

Public Safety Canada (PS) manages a budget of $430 million and has a workforce of approximately 900 employees. The volume of contracts processed in 2007-2008 was approximately 2,200 transactions for a total amount of about $31 million. Contracting and procurement activities are essential to support the department in achieving its objectives but are also subject to a high level of public scrutiny across the federal government. One of the key challenges across the federal government is to establish contracting and procurement policies and practices that are flexible enough to meet business needs and also ensure fairness, openness and transparency.

The Risk-based Audit Plan, which was approved by the Internal Audit Committee in June 2008, included the carry-over assurance audit of contracting and procurement activities to be completed in 2008-2009. Given that no review or audit of contracting and procurement activities had been conducted, it was felt that an audit would provide valuable information to improve the efficiency and effectiveness of the procurement activities.

Building capacity for the future is a major thrust for the Contracting and Procurement Unit (CPU). As the lead position for the CPU only assumed responsibility in February 2007, most of the efforts during the period audited – fiscal year 2007-2008, were towards gaining an understanding of the nature of the contracts and planning for the development of a contracting and procurement management control framework, while maintaining the day-to-day activities.

The responsibility for procurement and contracting activities are shared between program managers and the CPU. Program managers are responsible for much of the upfront work such as the definition of the requirements, the selection of the contracting method, and the selection of the vendors as well as the administration of contracts. The CPU is responsible for the development of policies, procedures and guidelines; the provision of advice; and, the implementation of monitoring and quality assurance processes. Also, as the procurement authority, the CPU manages the procurement process.

1.2 Audit Objectives and Scope

The purpose of the audit was to assess the appropriateness and effectiveness of the management control framework in place to support contracting and procurement activities.

The audit focused on the end-to-end contracting and procurement activities for the fiscal year 2007-08.

1.3 Audit Opinion

In my opinion, the management control framework was not adequate to support contracting and procurement activities and thus, requires significant improvements and management focus. With a lack of proper documentation for some aspects related to contracting activities, inappropriate approvals and insufficient procedural guidelines, the department is exposed to inappropriate and ineffective contracting and procurement practices.

1.4 Statement of Assurance

In the professional judgment of the Chief Audit Executive, sufficient and appropriate audit procedures have been conducted and evidence gathered to support the accuracy of the opinion provided and contained in this report. The opinion is based on a comparison of the conditions, as they existed at the time, against pre-established audit criteria that were agreed to by management. The criteria were based on the TB Management Accountability Framework (MAF) element related to “Effective Procurement” and the Canadian Institute of Chartered Accountants “Criteria for Control” (COCO) model. The opinion is applicable only to the entity examined. In our professional judgment, the evidence that has been gathered was sufficient to provide senior management with reasonable assurance of the accuracy of the opinion from this internal audit.

1.5 Audit Findings

At the time of the audit, the CPU was in the process of strengthening its management control framework, moving from informal processes to a formal management control framework. This is illustrated by initiatives such as the preparation of a departmental Contracting Policy and Procedures Guide, and plans to have a Contract Review Committee (CRC) in place for the fiscal year 2009-2010. Although there still remains a lot of developmental work, these initiatives indicate that the CPU is going in the right direction.

It should be noted that while the CPU had already begun addressing some of the issues raised in this report at the time of the audit, the impact of the new controls and procedures was not fully realized. This is due to the significance and the nature of the changes compounded with CPU's capacity issues. Specifically, the audit made the following observations:

Compliance

While the audit determined that the business requirements were appropriately defined, improvement opportunities exist with regard to the upfront planning in order to support the appropriate contracting method, to ensure that the contracting and procurement of goods and services result in best value, and to ensure policy requirements are met.

The audit noted the absence of sufficient information and guidelines to support managers when exercising delegated spending authority. As a result, a number of improper signing authorities were found. Notwithstanding the issues noted above, the procurement of the goods and services appeared legitimate and reasonable.

Also, the audit found the documentation trail surrounding contracting files to be cumbersome and in some cases incomplete.

Management Control Framework

The audit found that the key components of a sound management control framework were not in place during the period audited to effectively support contracting and procurement activities. Key weaknesses included the absence of: clearly defined roles and responsibilities; policies, procedures and guidelines to support individuals performing their assigned responsibilities; and the need to perform trend analysis supporting informed decision-making.

1.6 Management Response

Management agrees with all recommendations included in the Internal Audit of Contracting and Procurement and is committed to do what is necessary to address each recommendation. Work is now underway or completed in relation to each of these nine recommendations. This audit focused on the procurement activities for the period between April 1^st, 2007 and March 31^st, 2008. As recognized in the audit report, at the time of the audit, the Contracting and Procurement Unit (CPU) was already in the process of strengthening its management control framework. This is illustrated by initiatives such as the preparation of the Departmental Contracting Policy and Procedures Guide and the plans to have the Contract Review Committee in place.

Management expects that substantial implementation will be achieved before the end of the fiscal year 2009-10 and full implementation early in the following year.

To this end, policies and procedures surrounding delegated financial authorities have been developed and communicated to managers, the procurement review mechanism is now in place and the review of the security roles in the financial system has been completed.

Work remains to be done in the area of the development of a risk-based approach of the monitoring activities and service standards.

2.0 Audit Report on Contracting and Procurement

2.1 Background

The Contracting and Procurement Unit (CPU) within Public Safety Canada is under the responsibility of the Corporate Management Branch. The CPU manages departmental contracting and procurement strategies, develops tools, training and guidelines for program managers, and prepares/processes all departmental contracts and purchase orders.

The expected results are as follows:

• Departmental contracting and procurement activities are conducted in conformity with Government Contract Regulations, Contracting Policy and Values and Ethics.
• Departmental contracting and procurement activities are conducted with prudence and probity and display value for money.
• Program managers are provided with timely and effective advice and guidance in support of the exercise of their contracting and procurement responsibilities.

Public Safety Canada (PS) manages a budget of $430 million and has a workforce of approximately 900 employees. The volume of contracts processed in 2007-2008 was around 2,200 transactions for a total amount of about $31 million. Contracting and procurement activities are essential to support the department in achieving its objectives but are also subject to a high level of public scrutiny across the federal government. One of the key challenges across the federal government is to establish contracting and procurement policies and practices that are flexible enough to meet business needs and also ensure fairness, openness and transparency.

The risk-based audit plan, which was approved by the Internal Audit Committee in June 2008, included the carry-over assurance audit of contracting and procurement activities to be completed in 2008-2009. Given that no review or audit of contracting and procurement activities had been conducted, it was felt that an audit would provide valuable information to improve the efficiency and effectiveness of procurement activities.

Building capacity for the future is a major thrust for the CPU. As the lead position for the CPU only assumed responsibility in February 2007, most of the efforts during the period audited – fiscal year 2007-2008, were towards gaining an understanding of the nature of the contracts and planning for the development of a contracting and procurement management control framework, while maintaining the day-to-day activities. The departmental 2008-2009 Integrated Human Resources and Business Plan identified the lack of a core group of permanent contracting and procurement staff as an important risk to the efficiency of the operations, consistency of direction and conformity to policies and procedures. The CPU continues to face the challenge of attracting qualified staff as it builds capacity within the procurement function, as all departments are competing for the same skill sets.

The responsibility for procurement and contracting activities are shared between program managers and the CPU. Program managers are responsible for much of the upfront work such as the definition of the requirements, the selection of the contracting method, the selection of the vendors, as well as the administration of the contracts. The CPU is responsible for the development of policies, procedures and guidelines; the provision of advice; and the implementation of monitoring and quality assurance processes. Also, as the procurement authority, the CPU manages the procurement process.

At the time of the audit, the CPU was in the process of strengthening its management control framework, moving from informal processes to a formal management control framework. This is illustrated by initiatives such as the preparation of a departmental Contracting Policy and Procedures Guide, and plans to have a Contract Review Committee (CRC) in place for the fiscal year 2009-2010. Although there still remains a lot of developmental work to do, these initiatives indicate that CPU is going in the right direction.

2.2 Audit Objectives

The purpose of the audit was to assess the appropriateness and effectiveness of the control framework in place to support contracting and procurement activities. More specifically, the audit objectives were to provide reasonable assurance that:

1. An adequate management control framework was in place to effectively support contracting and procurement activities; and
2. Contracting and procurement activities were processed in a manner that was compliant with applicable policies, procedures and regulations.

2.3 Scope and Approach

The audit focused on the end-to-end contracting and procurement activities for the period between April 1, 2007 and March 31, 2008. The components of the management control framework that were examined as of March 31, 2008, included: business plans, risk management processes, roles, responsibilities, accountabilities, authorities, procedures, and monitoring mechanisms.

The audit included various tests, as considered necessary, to provide senior management with reasonable assurance of the accuracy of the opinion. These tests included, but were not limited to, interviews, observations, walkthroughs, review of supporting documentation, sampling of transactions and analytical reviews.

Approach for Audit Objective 1:

The audit approach involved interviews with CPU personnel, reviews of documentation (organization charts, roles and responsibilities, allocation of resources), and walkthroughs of the contracting and procurement processes.

Approach for Audit Objective 2:

Sampling techniques were used to identify the transactions that were tested for compliance.

Image Description

A statistical sample of transactions was randomly selected from the population for testing of overall compliance with elements within the scope of the audit. The sample size was 81 contracts^{Note 1}. The majority of the sample was randomly selected, with the remaining portion established based on data analysis or judgement depending on the various contracting and procurement activities included in the audit scope. (See Appendix B for details)

The audit, based on conventional benchmark standards, used the following guidelines to identify the level of deviations:

• Significant: > 15% deviations within sample population
• Moderate: 6% - 15% deviations within sample population
• Minor: 0 - 5% deviations within sample population

2.4 Findings, Recommendations and Management Response

At the time of the audit, the CPU was in the process of strengthening its management control framework, moving from informal processes to a formal management control framework. This is illustrated by initiatives such as the preparation of a departmental Contracting Policy and Procedures Guide, and plans to have a Contract Review Committee (CRC) in place for the fiscal year 2009-2010. Although there still remains a lot of developmental work, these initiatives indicate that the CPU is going in the right direction.

It should be noted that while the CPU had already begun addressing some of the issues raised in this report at the time of the audit, the impact of the new controls and procedures was not fully realized. This is due to the significance and the nature of the changes compounded with CPU capacity issues. Specifically, the audit made the following observations:

2.4.1 Contract Initiation Policy and Procedure

The CPU, similar to the department as a whole, is relatively new and in the early stages of defining its systems of internal control. The CPU has been mainly focused on staffing, training and fulfilling the day-to-day activities which has delayed the development and communication of risk-based policies, procedures and guidelines. The absence of formal policies and procedures brought about some compliance issues related to the initiation of the contract and key standard government terms and conditions. While the audit noted that the business requirements were appropriately defined, improvement opportunities exist with regard to the upfront planning done by Responsibility Centre Managers (RCM) to select the appropriate contracting method, to ensure the contracting and procurement of goods and services results in best value, and to ensure that policy requirements are met. More specifically, the audit noted the following:

• In a moderate number of incidents, work commenced prior to the approval of a written contract. In several cases, a written contract was eventually drafted and approved after the commencement of work; however, in many cases, no written contract was ever created. The audit noted however that when Financial Services discover invoices for which a written contract should have been put in place, RCM's are required to provide details in writing related to the absence of a written contract. As RCM's continue to strengthen their planning processes and become more aware of the procurement and contracting requirements, it is expected that these deviations will diminish.
• The audit noted that a few suppliers were selected repeatedly, through individual contracts, for the continual supply of specific goods and services. This practice is not consistent with the TB Policy on Contracting which requires a consolidated long-term planning approach. In some cases, it was apparent that, in order to meet operational requirements while complying with the Standing Offer dollar limits, the time period for the provision of services was being adjusted. While there did not appear to be any intent to circumvent delegation of authorities, these contracts should have been done through a different contracting vehicle given that the requirements were foreseeable. This also puts the department at further risk of undertaking work without the necessary upfront planning for cost-effective contracting solutions. This issue rests with the RCM's because it requires the upfront communication by the RCM's and the integration of business needs to allow the CPU to provide sound advice and select the best contracting approach.
• In a moderate number of incidents, the appropriate security clearance was not received for contractors working on-site and dealing with classified information. While it is the responsibility of CPU to ensure each purchase requisition addresses the security clearance requirements, each RCM has the responsibility to validate the clearance before providing the contractor with access to classified information.

Recommendation:

1. The CPU should develop policies, procedures and guidelines related to contracting and procurement activities. These policies, procedures and guidelines should be effectively communicated to both CPU and program managers.

2.4.2 Approval Processes

PS has implemented some control mechanisms over its delegated authorities including, but not limited to, a departmental Delegation of Authority (DOA) matrix, signature cards, and an internal contract review process. Based on a review of these control mechanisms, the audit identified a number of opportunities for improvement, which once addressed will contribute to strengthening the approval structure.

The audit noted that the DOA matrix could be more comprehensive. For instance, some procurement methods were not indicated. Further, aside from the DOA matrix, the audit found limited documents providing information and guidelines to support employees and managers when exercising delegated spending authority (e.g. expenditure initiation, commitment, and contracting authorities, and the authority to confirm contract performance and price granted to officers).

As required by the TB Policy on Delegation of Authority, when contracting authority is delegated as a subdivision of the spending authority to a centralized function, the contracting authority must be exercised only when the RCM responsible for the budget authorizes it. For a significant number of contracts, no evidence was found whereby RCM duly authorized the CPU to exercise contracting authorities on their behalf. This is important in order for RCM's to maintain the accountability for the management of their resources.

In addition to the DOA matrix, signature cards provide further authority details specific to each person, including restrictions when deemed necessary, as well as their original signature. The signature cards also provide the documentary support to ensure that the signatures of persons authorized to exercise authorities can be authenticated before or after the processing of various transactions. The audit found the following deviations indicating that the authentication and monitoring activities need to be strengthened.

• A moderate number of incidents were found where contracting authorities were exercised by individuals who did not have a valid signing authority (excluding the above issue whereby PS CPU had not been delegated approval by the RCM related to Contracting Authority).
• Generally, the procedures surrounding the certification pursuant to Section 34 of the Financial Administration Act (FAA) (i.e. contract Performance) were compliant (excluding those incidents where we were unable to find the invoice to substantiate the Section 34 of the FAA, as further explained in the section 2.4.3).

PS has developed a “routing slip” in support of a comprehensive approval and monitoring process. Various approvals and reviews are required based on the nature and value of the contracting vehicle. While the audit found that the use of the “routing slip” was generally compliant with internal policies, improvement opportunities exist to improve the clarity regarding the use of the “routing slip”.

It is noteworthy to mention that the incidents noted above had no specific trend with regard to any one individual, type of contract, or dollar value. Also, while there were insufficient approval levels or inappropriate delegation to these individuals, the procurement of the goods and services appeared legitimate and reasonable.

The audit has noted that control improvements pertaining to Approval processes have been made recently, including 1) the requirement for DOA training before delegation is granted, 2) the electronic posting via the intranet of the DOA matrix, and 3) developing a new DOA matrix.

Recommendations:

2. Financial Services, in conjunction with the CPU, should ensure that policies and procedures surrounding delegated financial authorities are effectively communicated to RCM's.

3. Financial Services, in conjunction with the CPU should develop effective review processes to monitor compliance to the DFSA matrix and the TB Policy on Delegation of Authority.

2.4.3 Documentation

The TB Contracting Policy requires that all options, decisions, approvals and justifications be documented. While all contracting files do not require the same level of documentation, files should include enough information, based on the level of risk, materiality and significance, in order to support accountability and transparency. The audit found that there were no formal guidelines surrounding documentation requirements of contracting files. As a result, during the process of obtaining and reviewing key contracting and procurement documents, the audit found the documentation trail to be cumbersome and in some cases incomplete.

Also, in a moderate number of payments, invoices could not be found. Without these invoices, the audit could not determine whether:

• the work was performed, the goods supplied or the services rendered or in the case of other payments, the payee was entitled to or eligible for the payment; and
• relevant contract or agreement terms and conditions were met including price, quantity and quality.

The failure to maintain complete contracting and procurement files that contain contracting details related to relevant communications and decisions including the identification of involved officials and contracting approval authorities hinders the ability of the department to facilitate appropriate management oversight.

2.4.4 Management Control Framework

The audit found that the key components of a sound management control framework were not in place during the period audited to effectively support contracting and procurement activities. Key weaknesses included the absence of: clearly defined roles and responsibilities; policies, procedures and guidelines to support individuals performing their assigned responsibilities; and the need to perform trend analysis supporting informed decision-making. Specific issues noted during the audit were:

• Roles and Responsibilities – Roles and responsibilities related to contracting and procurement activities were not documented. Clarity is needed for both the Responsibility Centre Managers and the CPU to avoid confusion, duplication of efforts and to ensure that decisions are made and actions taken by the appropriate individuals in a timely manner.
• Segregation of Duties - One area of concern is the lack of segregation of duties through the assigned SAP (financial application software) access. A few employees have a combination of incompatible functions such as the ability to set up supplier information, change the delivery addresses, initiate a contract, perform goods receipt and approve payment. Although the audit did not find any misuse of these system functions, the absence of an appropriate segregation of duties increases the risk of inappropriate transaction processing and the risk that individuals might misappropriate assets.
• Training and guidance – Limited training and guidance was available regarding contracting and procurement policies and requirements for the period under review. The new contracting course, recently developed by the CPU, should help support employees and managers across the department to fulfill their roles and responsibilities in relation to contracting and procurement activities.
• Reporting – There was limited reporting done on contracting and procurement activities. The audit found that only a limited number of ad hoc reports were produced in response to specific requests. Also, consistent with policy requirements, the CPU prepared the annual report providing an overall summary of contracting activities. However, the CPU does not produce reports which identify, explore and analyze contracting trends and anomalies to support monitoring and decision-making.
• Monitoring and Quality Assurance Function – During the audit period, the CPU implemented pre-contracting controls to ensure contracts comply with applicable regulations and policies before they are awarded. This includes the requirement for RCM's to complete a Contract Information Record that must be forwarded to the CPU for review and approval. The level of review and approvals required are based on the amount of the contract. While the dollar value of contracts is a key factor to determine the selection of contracts to be reviewed, other factors such as, but not limited to, inherent risks, type of transactions, results of trend analysis, etc should be considered. Improvement opportunities exist to adopt a risk-based approach for the selection of contracts, across the entire population, subject to review.

For the fiscal year 2008-09, although not included in the scope of our audit, the CPU has defined their business strategy and objectives, including an assessment of HR requirements.

The audit also noted inefficiencies within the procurement processes. These inefficiencies burden the procurement capacity and increase the risk of errors. Examples of areas for improvement include:

• The procurement of goods or services may be more efficiently achieved using an acquisition card as opposed to a written contract and applicable purchase orders (e.g., books, training, low dollar value supplies). Clarity on the usage of the acquisition card program, which is recognized as having significant opportunities for savings in the procurement through to payment process, in conjunction with the development of the overall procurement risk management strategies, will help in addressing efficiency issues.
• As noted previously, long-term planning by RCM's and consolidating individual requirements would also improve the level of efficiency.

Recommendations:

4. The CPU should continue to strengthen all key components of a sound management control framework related to planning, including the development of: an integrated human resources and business plan; a performance management process; and service standards.

5. The CPU should adopt a risk-based approach for the identification and selection of contracts subject to monitoring, as well as for determining the frequency and timing of monitoring activities.

6. The CPU should produce reports which identify, explore and analyze contracting trends and anomalies to support monitoring and decision-making.

7. The CPU should clearly define and communicate roles and responsibilities in regard to the contracting and procurement activities.

8. The Comptrollership directorate should address the operational segregation of duties within the SAP system applications.

9. PS, as a whole, led by the Corporate Management Branch, should continue to strengthen the upfront responsibility of program managers for the overall planning and understanding of contracting and procurement activities.

Appendix A – Audit Criteria

The following is a summary of the key criteria developed to provide a framework in assessing the extent to which CPU activities, were meeting the audit objectives.

• Contracting awarding is open, fair and transparent. There is a clear Statement of Work, bid solicitation method, evaluation criteria, and a consistently applied evaluation process.
• Contracts are compliant with TB Policy, and key standard government conditions have been applied correctly.
• The contract files contained sufficient and appropriate evidence as required by TB Policy.
• Appropriate approvals are obtained in accordance with the FAA and TB Policy and supporting evidence is maintained for all approvals.
• The contract details were reviewed by the designated individuals in accordance with PS Policy.
• Contracts are appropriately disclosed externally as per TB Policy.
• There is an effective and efficient management control framework to ensure the delivery of PS objectives. Specifically:
  • Strategic business plans, objectives, and performance standards are clearly defined and effectively communicated.
  • Roles and responsibilities are clearly defined, communicated and consistent with polices and legislation.
  • Sufficient and relevant information is identified and communicated in a timely manner to enable individuals to perform their assigned responsibilities.
  • Monitoring mechanisms are in place to ensure compliance with laws, regulations, policies, and terms & conditions of individual contracts. Further, trends, analysis and monitoring are done.
  • Contracting and procurement processes are efficient.

Appendix B – Contract and Audit Sampling Statistics (Fiscal 2007-2008)

Date modified:

2022-08-09