Audit of CIHR’s Core Management Controls – Procurement and Human Resources

Table of Contents

• Executive Summary
  • Introduction
  • Risk Addressed by the Audit
  • Objective
  • Scope
  • Overall Audit Opinion
  • Statement of Conformance
  • Summary of Strengths
  • Summary of Improvement Opportunities
• Detailed Report
  • Methodology and Criteria
  • Observations, Recommendations, and Management Action Plan
• Appendix
  • Audit criteria

Executive Summary

Introduction

The Internal Audit of CIHR’s Core Management Controls – Procurement and Human Resources (CMC) was part of the 2012-13 Risk-Based Annual Internal Audit Plan (RBAP) which was approved by the Canadian Institutes of Health Research’s (CIHR) Governing Council (GC).

The Canadian Institutes of Health Research

The Canadian Institutes of Health Research is the Government of Canada's agency responsible for funding health research in Canada. CIHR was created in June 2000 under the authority of the CIHR Act and reports to Parliament through the Minister of Health. CIHR's mandate is to "excel, according to internationally accepted standards of scientific excellence, in the creation of new knowledge and its translation into improved health for Canadians, more effective health services and products and a strengthened Canadian health-care system." CIHR comprises 13 "virtual" institutes – each headed by a Scientific Director, who is assisted by an Institute Advisory Board – which bring together all partners in the research process – the people who fund research, those who carry it out, and those who use its results – to share ideas and focus on what Canadians need: good health and the means to prevent and fight disease. Each Institute supports a broad spectrum of research in its topic areas and, in consultation with its stakeholders, sets priorities for research in those areas. CIHR funds over 14,000 researchers and trainees in universities, teaching hospitals, and other health organizations and research centres in Canada and abroad.

Core Management Controls

Core management controls are the key internal controls reasonably expected to be in place in most, if not all, federal departments and agencies. These may represent the fundamental controls that support each of the elements of the Management Accountability Framework, or they can be other controls that are unique to an organization’s mandate or environment.

The Office of the Comptroller General (OCG) has developed audit criterion to address the ten areas of CMC that should exist in all federal departments and agencies.

The 2012–2015 RBAP identified CMC as a recurring annual project, and the ten primary areas identified by the OCG will form the basis of what this audit and subsequent audit projects will examine. Given the resources available to Internal Audit, it is expected that each annual project will examine on a rotating basis two or three of the areas identified by the OCG. This audit project reviewed the controls relating to procurement, and the management of non-permanent employees, performance pay, and pay administration.

Risk Addressed by the Audit

The audit addresses the risk that CIHR’s CMC are not operating in the manner intended and that the organization could be impacted by events (i.e. fraud, reputational damage, security breach, etc.) these controls were intended to prevent. This risk is related to the TBS Management Accountability Framework (MAF) elements of Policy and Programs, Stewardship, and Accountability.

Objective

The audit assessed whether the core management controls related to procurement and the management of non-permanent employees, performance pay, and pay administration are operating effectively at CIHR.

Scope

The audit focused on the controls that relate to the management of the procurement process at CIHR, as well as non-permanent employees, performance pay, and payroll administration.

Overall Audit Opinion

The audit has concluded that the CIHR’s CMC surrounding the procurement process, as well as non-permanent employees, performance pay, and payroll administration are well controlled, with minor opportunities for improvement.

Statement of Conformance

In my professional judgement as Chief Audit Executive, sufficient and appropriate audit procedures have been conducted and evidence gathered to support the accuracy of the opinion provided in this report. The audit of CMC was conducted in accordance with the Federal Government’s Policy on Internal Audit and related professional standards. It conforms with the Internal Auditing Standards for the Government of Canada, as supported by the results of a quality assurance and improvement program.

Summary of Strengths

Through the course of the audit, the following Core Management Control strengths were observed:

• A robust procurement process exists that properly manages and documents contract initiation, bid solicitation, bid evaluation and contract amendment;
• Sole-source and non-competitive contracts are appropriately justified;
• Security requirements and intellectual property rights in contracts are appropriately managed;
• CIHR adhered to the proactive disclosure requirements in place during the period reviewed;
• A robust process exists to commit funds, verify accounts, initiate expenditures and issue payments for procurement and CIHR’s performance pay;
• The terms and conditions for hiring term employees and students are followed;
• Employees are properly screened before being hired;
• Adequate segregation of duties exists in the pay administration roles; and
• Departure procedures are appropriately followed.

Summary of Improvement Opportunities

The following aspects of CIHR’s CMC require management’s attention:

• Retroactive contracts and confirming orders are not recorded in CIHR’s financial management system or reported on CIHR’s website as part of the policy on procurement’s requirement for proactive disclosure;
• CIHR’s bid solicitation documents do not address all of the requirements of the Government of Canada procurement guidelines regarding former public servants; and
• Departure procedures are not formalized for employees on paid and unpaid leave

Internal Audit thanks management and staff for their assistance and cooperation throughout the audit.

Martin Rubenstein
Chief Audit Executive
Canadian Institutes of Health Research

Management agrees with the conclusions of this audit.

Thérèse Roy
CFO/VP, Resource Planning and Management

Detailed Report

Methodology and Criteria

The internal audit of CIHR’s Core Management Controls was conducted in accordance with the Federal Government Policy on Internal Audit. The principal audit techniques used included:

• interviews with management and staff at the Canadian Institutes of Health Research;
• examination of relevant documentation, policies, reports and electronic records used as part of the procurement and human resources processes; and
• recalculation of salary and procurement amounts.

Controls were assessed as adequate if they were sufficient to minimize the risks that threaten the achievement of objectives. Detailed criteria and conclusions are contained in the Appendix to this report.

The audit was conducted between September, 2012 and June, 2013.

Observations, Recommendations, and Management Action Plan

The following are audit observations, recommendations, and management action plans to address the weaknesses identified during the audit.

Overall conclusion

The overall conclusion considers the cumulative risk exposure related to the audit observations in the context of the above criteria. The audit has concluded that the core management controls over procurement, non-permanent employees, performance pay, and payroll administration are well controlled, with minor opportunities for improvement.

In the course of our audit, some minor opportunities for improvement were identified that could improve systems of internal control, streamline operations and/or enhance financial reporting processes. We have documented these observations in a management letter.

Appendix

Audit criteria

The audit uses the following definitions to make its assessment of the internal control framework.

Date modified:

2014-06-16