The approach used to address the audit objective included the development of audit criteria against which observations, assessments and conclusions were drawn. The audit criteria developed for this audit are included in Appendix A.
Detailed transaction testing was completed based on a judgmental sample of 100 transactions over the scope period. The CFO Sector provided detailed transaction records/expenditures for acquisition cards, travel, hospitality and conferences from departmental financial reporting system (Oasis). This information formed the basis for the selection of the audit sample. The following table summarizes the number of sample items selected by transaction type and location. The sample sizes were based on the relative amount of dollar expenditures noted in section 1.6 and the need to have reasonable sample sizes (i.e. minimum of 5 samples for each of hospitality and conference) with representation from Headquarters and Regions. IDEA was used to randomly generate sample transactions to be audited.
Based on a combination of the evidence gathered through the examination of documentation, analysis and interviews, each audit criterion was assessed by the audit team and a conclusion for each audit criterion was determined. Where a significant difference between the audit criterion and the observed practice was found, the risk of the gap was evaluated and used to develop a conclusion for each audit criterion and to document recommendations for future improvement initiatives.
The audit team identified weaknesses in the design and operation of internal controls, resulting in three recommendations. The findings and recommendations are organized according to the following two broad areas: Delegation of Authorities; and, Monitoring and Oversight.
4.1 Internal Controls and Compliance
The audit selected a total of 100 transactions (as outlined above), split evenly between headquarters and regions, to test in detail acquisition card, travel, hospitality and conference expenditures. These transactions were tested for operating effectiveness of FAA section 32, 34, and 33 controls as well as compliance with applicable policies (National Joint Council Travel Directive and AANDC Policy on Acquisition Cards). The results of our testing, by type of transaction, are provided in sections 5.1.1 to 5.1.4.
Internal controls governing taxi expenditures and ARI fleet cards were not substantively tested as part of the audit due to the low level of materiality these expenditures represent on an annual basis. In absence of substantive testing, the audit team analyzed the respective control frameworks to identify potential control gaps. The results of our analysis are provided in sections 5.1.5 and 5.1.6.
4.1.1 Section 32
Section 32 is the authority to approve a commitment on behalf of the government to enter into a contractual or other arrangement. Section 32 is typically completed by a physical signature from an employee with delegated authority; however, in the case of acquisition cards, the cardholder themselves (typically an administrative assistant), and not the responsibility centre manager, has Section 32 authority over purchases made on the card.
All employees requiring Section 32 delegated authority must undergo training before the authority is delegated. In the case of acquisition cards, the cardholder is required to undergo training on delegated authority before delegated authority and the acquisition card is granted.
Preapproval for travel, hospitality and conferences are evidenced by a signature approving the travel, hospitality or conference on the requisite form (e.g. a Travel Authorization and Advance form).
Acquisition card expenditures: Delegation of authority for Section 32 on all acquisition cards is evidenced by the cardholder signing a specimen card upon card issuance. Signing cards are retained in Finance (Headquarters or Regional) and used to pre- and post-audit acquisition card transactions. Out of the 30 sample transactions selected, only four (4) transactions were found to have appropriate Section 32 authority in evidence.
It was noted by management that prior to November 25, 2010, no delegation of authority form was prepared (i.e. signature card) for cardholders. Of the remaining transactions selected after November 25, 2010, two (2) of seven (7) samples did not have documented evidence of Section 32.
Travel card expenditures: Before an employee is eligible for travel status, they must obtain pre-approval (Section 32) for their planned expenditures from the appropriate delegated authority. In the majority of cases, this occurs via the Travel Authority and Advance (TAA) form that lists the estimated costs by line item (e.g. accommodations, transportation, meals, etc.). In instances where employees are required to travel frequently and on short notice, they may receive "blanket" approval for their travel at the beginning of the year.
Audit testing noted 11 of 50 transactions did not have documented Section 32 delegated authority in evidence (seven (7) in Regions, four (4) in Headquarters). Exceptions included: no physical Section 32 signatures on the TAA form, dates of approval outside the effective date of authority as per the signature card; unavailable signature cards; and, unavailable TAA forms.
Hospitality expenditures: Hospitality request forms are completed by employees to obtain prior approval for hospitality. Section 32 was found to be operating in eight (8) of the 10 sample transactions tested. The two exceptions were found to have a signature; however, the supporting delegation of authority specimen signature card was not provided during the audit and was therefore noted as an exception.
Conference expenditures: Request forms are completed by employees to obtain Section 32 approval in advance of registering and attending the conference. Section 32 was found to be in existence in all 10 sample items tested during the audit.
4.1.2 Section 34
Section 34 is the request for payment out of the Consolidated Revenue Fund. It is typically evidenced by a physical signature from an individual with delegated authority who is responsible to review the documentation provided by the employee to support the expenditure. Documentation typically includes original receipts or invoices that demonstrate the type of expenditure to be paid.
Acquisition card expenditures: Of the 30 transactions reviewed, Section 34 was generally found to exist as evidenced by a sign-off from the individual with delegated authority over the funds in question. All of the Headquarters transactions assessed were appropriately approved under Section 34 authority, whereas three (3) out of 15 Regional sample items did not have the appropriate Section 34 approval in evidence.
Travel card expenditures: The audit noted seven (7) of 50 transactions where Section 34 was not in evidence. Reasons for the exceptions included: unclear approval as no signature provided on the Section 34 stamp or signature not legible; date of approval outside the effective date of authority as per the signature card; and no signature card provided to substantiate the Section 34 authority of the approver.
Hospitality expenditures: Section 34 was found to be in existence in all 10 sample items tested during the audit.
Conference expenditures: Section 34 was found to be in existence in all 10 sample items tested during the audit.
4.1.3 Section 33
Section 33 is approval for payment. Payment is certified by the approver based on the goods or services receipt, terms of the contract or eligibility of the payee. Section 33 within the Department is exercised by Finance first in the Region (Section 33a) and then in Headquarters in the CFO Branch (Section 33b).
Acquisition card expenditures: In all but two (2) instances, the 30 transactions reviewed provided evidence of appropriate approval. Of the two exceptions, one occurred at Headquarters and the other occurred in a regional office. In the Region, the supporting documentation was not able to be found and in Headquarters the batch was not able to be found.
Travel card expenditures: Section 33 was found in evidence for 47 of the 50 test transactions. Lack of documentation was the reason noted in the three (3) cases where Section 33 was not in evidence.
Hospitality expenditures: Section 33 was found in evidence for all 10 sample items tested during the audit.
Conference expenditures: Section 33 was found in evidence for all 10 sample items tested during the audit.
Cardholder acknowledgement of responsibility: The Acquisition Card Policy (effective April 1, 2010) requires a written acknowledgement stating the cardholder's understanding of, and agreement to, the responsibilities and restrictions placed on acquisition card usage (section 6.1). These signed acknowledgement documents must be retained on file by the Regional (or Headquarters) Acquisition Card Coordinator. In reviewing the transaction sample, we noted that up-to-date acknowledgement statements were only available for 22 of the 30 cardholders assessed (four (4) not available in Headquarters and four (4) not available in Regions).
Compliance with the Travel Directive: In addition to the testing of internal controls, the audit assessed the compliance of all 50 travel claims with the National Joint Council Travel Directive. Specifically, the audit reviewed the following details for compliance, as applicable to the sample item selected: class of car rental; nightly accommodations rate; kilometric rates; per diem rates; foreign exchange rates; and, accounting for travel advance payments. No exceptions were noted in the 50 sample items reviewed.
4.1.5 Taxi Expenditures and ARI Fleet Cards
Taxi expenditures: Taxi chit use is primarily found in the National Capital Region (NCR) where the Department has multiple office locations. In reviewing taxi chit transactions, it was noted that almost 95% of taxi chit expenditures occurred in the NCR (approximately $430,000 in 2010-11). In regions where there is often only one regional office, taxi chit expenditures were much lower. For the period under review, regional office expenditures on taxi chits ranged from $3,000 to $10,000 annually per region.
The process followed across NCR and regions differs somewhat, however, each reportedly completes a detail review pursuant to Section 34 to pay invoices received from taxi companies. The audit noted that in the NCR, taxi chits are managed centrally by the Corporate Accounting and Reporting Directorate of the CFO Sector. As invoices are received, there is a detail review of each taxi chit to ensure it was used by a departmental employee (marked with an AANDC stamp on the back) and the total of the invoice is verified.
ARI fleet cards: The Assets and Environmental Management Section of the CFO Sector serves as the Department's functional authority on fleet management and the use of ARI cards. Annual expenditures for the Department in 2010-11 were reported to total $450,165. The audit obtained ARI Fleet billing reports electronically for the period April 1, 2009 through June 30, 2011 and noted total expenditures of approximately $1.1M and a total capital cost of $79.9M.
The majority of fleet vehicles are located in AANDC's Saskatchewan and Northwest Territories (NT) regions where fleet vehicle use is driven by environmental factors (NT Region) and the proximity of the office to client sites (Saskatchewan Region). There are only two fleet vehicles located at Headquarters.
The audit noted that based on detailed transaction information provided, almost 70% of expenditures over the period October 2010 through October 2011 were incurred in Saskatchewan and NT.The audit reviewed the process for administering and monitoring the use of ARI fleet cards in both Saskatchewan and NT. There are a number of controls reportedly in place to administer the use of the ARI fleet cards, which include: reconciling monthly ARI invoices against employee receipts; requiring garages to notify ARI and the AANDC regional fleet manager in advance of a repair; and maintaining a log book for each fleet vehicle to document who used the vehicle, for what purpose, and to which location(s).
1. The Chief Financial Officer should communicate the delegation of authority requirements to reinforce responsibilities to exercise DOA and ensure evidence is maintained to demonstrate compliance with authorities.
4.2 Monitoring and Oversight
Acquisition and travel card expenditures: The audit team observed discrepancies between the level of training and awareness provided to cardholders to advise them of their responsibilities. It was noted that all acquisition cardholders receive training on card use and exercising their delegated authority (Section 32) prior to card issuance, as required by the Acquisition Card Policy. The audit did not observe any training requirements for AMEX cardholders, who do not have Section 32 authority over their expenditures.
Monitoring is conducted on a monthly basis by the National Acquisition Card Coordinator and the National American Express (AMEX) Coordinator at the corporate level and by Regional Card Coordinators at the regional level through on-line reports made available by the Department's card service providers (e.g. Bank of Montreal and American Express).
The National Acquisition Card Coordinator reviews the monthly transactions of all active cards for unusual merchant numbers, dollar amounts and transaction types (e.g. hotel and spa charges). The National AMEX Card Coordinator noted that reports for travel cards are also prepared on a monthly basis. These reports are then distributed to each of the regional coordinators for review and follow-up.
The level of monitoring and follow-up procedures was noted to vary considerably across regions. While there is a Acquisition Card Policy in effect at the Department (April 1, 2010) that outlines the monitoring expectations for acquisition card coordinators, no such policy or documented procedures exist to communicate the roles and responsibilities of National and Regional AMEX Coordinators for monitoring transactions. During interviews, it was noted that while a policy has been drafted for travel cards, it is not up-to-date and has yet to be formally published.
Conferences: The monitoring of conference expenditures at the corporate level is performed by the Resource Management and Financial Advisory Services group of the CFO Sector. On a monthly basis a report is produced and used by Financial Management Advisors assigned to each Headquarters functional area to monitor the expenditures for travel, hospitality and conference. The Director Resource Management and Financial Services indicated that this monitoring is conducted to help promote the achievement of the Department's targeted reduction in spending in these areas, from $29.29M in 2011-12 to $28.3M for the 2012-13 fiscal year.
Data Analytics: The audit team obtained detailed transaction files for both BMO acquisition cards and AMEX travel cards for a portion of the period under review [Note 8] The audit used IDEA software to run a limited number of routines [Note 9] against the transaction files to identify unauthorized vendors that should not be included (e.g. liquor stores or big box retailers); cash withdrawals (that may be made for purposes other than travel); weekend transactions; and, transportation charges on acquisition cards (which should be made on AMEX travel cards). The audit team noted a number of transactions that may (or likely) have related to personal use transactions instead of travel and has informed the CFO Sector that it should conduct a thorough review of historical transaction data to ascertain the extent to which individual travel cards are being used for personal use transactions. Going forward, these transactions would be more readily identified with the implementation of a more formalized and rigorous monitoring framework that utilizes technology to highlight transaction requiring follow-up.
2. The Chief Financial Officer should complete and communicate the policy related to the use of individual designated travel cards (American Express cards). This policy should outline the roles and responsibilities governing card issuance, monitoring and reporting, consequences for card misuse, and the requirement for training to help ensure cardholders understand the policy.
3. The Chief Financial Officer should implement more formalized monitoring framework to effectively track, follow-up and take appropriate action against all cardholders (acquisition cards, travel cards and ARI cards) who are not in compliance with the respective policy. Such a monitoring framework should be documented, risk based, [Note 10] and should include clear roles and responsibilities. This process should also take advantage of technology tools (e.g. IDEA, ACL, etc.) that can help identify potential problem or unauthorized charges from the entire population. The use of technology would enable a more efficient and effective monitoring program that can identify and resolve issues before they become larger, more complex problems.
4.3 Opportunities for Efficiencies
During the course of the audit, the audit team observed opportunities in the areas of taxi chit monitoring and acquisition card monitoring for increased efficiencies.
Taxi chit monitoring: The audit noted the existence of a Microsoft Access database developed in-house to help track taxi chit booklets. Through interviews with staff, it was found that this database as not functioning properly and was not supported by the departmental IT group. It was also noted that the database has not been updated since the June 2011 due to excess workload and the lack of perceived benefits of the database given its current functionality. The CFO Sector indicated they would assess the merits of fixing the database, replacing it or removing it from the process entirely after considering the value it brings to the overall monitoring framework for taxi chits.
Acquisition card payments: The audit noted that the National Acquisition Card Coordinator tracks the amount of rebate earned by the Department for the use of the BMO and VISA credits cards. The Department can receive rebates of between 1.08% and 1.44%, depending on the volume of transactions and the timeliness of the payments. The Coordinator noted that the Department has not been able to take advantage of higher rebates (currently at 1.08% on all transactions) as payments are decentralized and the time taken to pay acquisition card statements is longer than the days required to obtain a higher rebate. The Coordinator noted that many other departments have centralized the payment of acquisition cards and AANDC is considering moving to a centralized payment process to receive a higher rebate. In addition to higher rebates, centralized payments would also help to reduce interest charges associated with late payments.