Audit of Management of Cash (Project Number: AU0801)

Reports 2008


OVERALL ASSESSMENT

This report presents the results of an internal audit of cash received by the department. The purpose of the audit is to provide assurance that cash is received, controlled, accounted for, deposited in a timely manner and in compliance with applicable policy and regulations.

Even though cash related to fiscal year (FY) 2006/07 was generally reported in a satisfactory manner in the government financial system (GFS), the audit was not able to assess the completeness of cash received from non-tax revenues (Royalties) and precludes us from providing assurance that:

  • Appropriate monitoring and reporting strategies are in place;
  • Risks are understood and appropriately managed; and
  • Cash is managed in compliance with applicable policies and procedures.

The royalties in the non-tax revenues and in cash in general are significant representing almost 80 per cent of the total value of $ 579 million; however, essential and timely management information was not available. This lack of information limits management's ability to assess the accuracy of the total amount for cash receipts and receivables on an accrual basis accounting perspective. Although the Offshore Petroleum Boards are responsible for providing both the royalty revenues and related business information according to the Accord acts; NRCan remains responsible for improved disclosure of royalties. Enhancing the related management information is a principal issue identified by this audit.

Two other issues were raised regarding cash in general: assessment and mitigation of risks, and compliance to the policies.

If a risk assessment was undertaken for the management of cash, then re-allocation of resources to riskier and more significant activities could be performed. For example, increasing wire transfers and reducing cheque processing activities could permit re-allocation of resources. In doing so, the management could align cash practices to TB and NRCan compliance requirements and improve the efficiency of petty cash despite the fact that it was considered low risk due to materiality.

Lack of compliance with policies, including lack of segregation of duties, lack of timeliness of deposits, reporting, etc. represent a weakness in basic controls. This is not only a concern for the Department, but it also places departmental staff in a potentially awkward position should significant errors or problems occur.

INTRODUCTION AND BACKGROUND

Cash is defined as any payment made by liquid cash, debit or credit card, wire transfer and cheque for various services, sales of products, taxes or fees collected, received, controlled and deposited by Natural Resources Canada (NRCan). During FY 2005/06, NRCan managed cash receipts (CRs) for $686M, and $579M for FY 2006/07, as shown in Fig. 1.

Management of cash receipts by month, in millions of dollars, for FY 06 and FY 07.

In FY 2006/07 petty cash transactions totalled 2,070 amounting to $159K.

In FY 2006/07, almost 10 per cent of the transactions (2,276) were greater than $5K, amounting to $575M. 80 per cent of revenues consisted of non-tax revenues, with a significant portion relating to royalties received through the Energy Policy Sector (EPS). 83 per cent of cash was reported in GFS by the Shared Services Office-Accounts Receivable (SSO -AR Unit).

This audit was completed in accordance with the Audit and Evaluation Branch (AEB) Internal Audit Plan 2007/08.

Management of cash process is governed by numerous TB policies, NRCan policies and other policies such as:

  • Policy on Receivables Management, July 1, 2002;
  • Policy on Recording Receipts of Money, June 1, 1996;
  • Policy on Deposits, July 1, 1995;
  • Policy on Petty Cash, October 1, 1994;

NRCan has also developed departmental guidelines to control and manage the cash process. They are all available on the departmental web site.

OBJECTIVE, SCOPE AND TIMING

The objective of the audit was to provide assurance to senior management that cash is controlled, accounted for and deposited in a timely manner:

  • Assess the compliance with TB and NRCan policies and procedures;
  • Review internal controls over cash receipts, deposits and entries;
  • Verify that financial transactions were properly recorded; and
  • Review the process for cash and petty cash management.

The audit scope covered the FY 2006/07 ending March 31, 2007 and excluded a determination of the financial impact of non-compliance.

APPROACH AND METHODOLOGY

The approaches used to carry out the audit consisted of:

  • Interviewing managers and key staff at headquarters;
  • Testing compliance with applicable TB and NRCan legislation, regulations, policies, procedures and guidelines;
  • Determining the existence of physical controls and processes by performing a confirmation “walkthrough” of the SSO -AR Unit and the ESS Map Office (Map Office);
  • Reviewing detailed transactions of five samples consisting of:
    • Statistically representative sample of 184 transactions totalling $5.3M;
    • 20 Petty cash transactions totalling $1.4K;
    • 5 transactions totalling $190K for the Map Office;
    • Non-tax revenue payments (royalties) totalling $101M covering the last two months of FY 2006/07; and
    • Cash receipts for royalty production totalling $464M for FY 2006/07.
  • Developing finding statements; and
  • Preparing a report and debriefings.

OBSERVATIONS

ACCURACY AND ADEQUACY OF ROYALTIES MANAGEMENT

While the reconciliation of cash received for royalties was appropriately reported in GFS, the audit observations include weaknesses in establishing accountability, and insufficient and incomplete information that render the process challenging and distort eventually the financial statement (F/S) reports. Since royalties represent the largest component of NRCan’s cash flow from revenues, they have a material impact on the F/S. The requirement for improved information management has been a long-standing issue.

Royalties management - Cash
  • Segregation of duties in the process is non-existent. While the payments are deposited by the SSO -AR Unit, they are actually received and sometimes reported by project managers from EPS.
  • No sign-off sheets are used when money changes hands between EPS and SSO -AR Unit. In most cases, cheques are sent to the Sectors instead of being sent directly to SSO -AR Unit, which would reduce the movement of money from hand to hand. For example, the audit identified one cheque for $8.4K that was deposited 27 days after receipt.
  • On average, there are 5.43 days between the date on which the notification letter is received from the depositor (assuming the payment was received at this time), and the deposit date. However, the audit identified two cases where $3.8M and $1.2M were deposited after 41 and 42 days, respectively.
  • Analysis showed that there is a delay between the time when funds are deposited in the bank and when revenues are recorded in GFS. For example, an amount of $23M was recorded in GFS 10 days after the transaction took place.
  • Sample analysis identified that some Sectors create their own CRs instead of following the proper process of using SSO services ($4.8M for EPS in FY 2006/07).
Accuracy of data disseminated by EPS
  • Reconciliation of payments was not achievable between GFS data and the revenue reports produced by EPS for FY2006/07. This results in inaccurate and insufficient information that is disseminated to other government departments (i.e., Department of Finance and Statistics Canada).
Recognition and completeness of royalty revenues
Process flow diagram of the recognition of revenues.
  • Even though the audit reconciled the last two months reported for royalties in FY 2006/07 ($101M) with GFS data, the cut-off process remains challenging and time consuming. Also, there were no documented procedures on how to determine cash owed to the Department at year-end.
  • All revenues under royalties are not properly supported by persuasive evidence that an arrangement exists. Without accounts receivable (AR) records, there is no document to support that revenues are completely stated;
  • Current practice does not require Provinces or the Canada-Newfoundland Offshore Petroleum Board to send reports/ invoices with expected amounts to be paid by companies. This results in the absence of AR for royalties;
  • A difficulty encountered by the Department is when and how to recognize receivables. A detailed analysis of the royalty payments process identified that there is approximately a 2-months time delay between the completion of production and the period for which payments are received. As a result, additional information needs to be disclosed if readers are to be better informed about the substance of revenue generated by a project in the current FY.
  • The audit concluded that the F/S prepared and provided by the Financial Management Branch (FMB) for FY2006/07 had a disclosure error of $128M for Nova Scotia and Newfoundland royalties revenues.
COMPLIANCE WITH TB AND NRCan POLICIES / PROCEDURES

The audit revealed that there is a lack of compliance with TB and departmental policies and procedures governing cash management. Cash is collected by staff within various Sectors and program offices. The failure to follow generally accepted controls for cash also indicates that supervisors are not reviewing the internal controls, which could leave the Department vulnerable to the risk of fraud, waste and potential loss. Controls need strengthening.

Receipt of cash
  • Cheques accounted for 39.43 per cent of the total amount ($2.09M) in our sample, representing the largest type of revenues. Audit walkthrough and interviews confirmed that in both, the SSO -AR Unit and Map Office, mail is opened in the presence of only 1 employee instead of 2, as required by the TB and departmental policies.
Segregation of duties
  • One of the principles of good internal controls is maintaining adequate segregation of duties. Currently the SSO -AR Unit has 3 employees, and the Map Office has 2 employees to perform five key functions (granting of credit, billing of amounts due, handling of public money, collection of overdue amounts, and reconciliation of deposits) for which segregation of duties must be respected. Segregation of duties becomes even more challenging when employees are away.
Mishandling of money
  • Sample analysis confirmed that sign-off sheets are not always used when money changes hands. Without a sign-off record, the Department cannot hold staff accountable. Some transactions in our sample contained no proof of cash receipt date at the SSO -AR Unit or Sectors/Branches, or of transfer from Sectors/Branches to SSO -AR Unit for Special Purpose Accounts (SPAs).
Frequency of deposits
  • Our sample indicated that cash receipts were deposited on a timely basis by the SSO -AR Unit (i.e., within 2 days on average); but, on average, cheques were deposited only after 4 days. However, the analysis indicated that the Map Office takes on average 8 days to deposit cash and cheques, despite policy requirements. (See “Summary of non compliance” table below)
Timing of input to GFS
  • While TB policy states that public money must be posted into GFS within 5 working days, during sample analysis the audit found that, on average, it takes 3 days.
  • But, in some cases, the transactions were processed in GFS before getting a confirmation from the Receiver General for wire transfer or the deposit. (See “Summary of non compliance” table)
SUMMARY OF NON COMPLIANCE

Sample observations of
184 transactions for $5.3M

Frequency of
occurrence
Reported in GFS more than 5 days
Example: $ 250K deposited after 17 days

25/184 (14%)

Deposited on average after 2 days
Example: $ 318K deposited after 26 days

42/184 (23%)

Entered in GFS before deposit
Example: $ 318K in GFS 23 days before deposit

66/184 (36%)

Recorded without sufficient documentation

2/184 (  1%)

Missing supporting documentation for petty cash

8/20 (40%)

RISK MONITORING OF CASH

Monitoring is a key control for management. With respect to the management of cash, the policy states that managers / supervisors should conduct regular and periodic reviews to ensure compliance with policies and procedures. Even though the audit revealed that the SSO -AR Unit is operating properly as required, the audit identified that there is an absence of risk assessments regarding overall cash handling which could result in inconsistencies in the process, insufficient information and work overload. A risk-based approach could bring significant efficiencies to internal control assessments.

Absence of risk portfolio
  • TB policy requires that a risk assessment be undertaken, taking into consideration such items as materiality, frequency and numerous types of transactions. The audit revealed that no such risk assessment was performed on receivables and management of cash processes.
Value for money
  • Although the policy stated that all public money shall be deposited by the SSO -AR Unit, the audit noticed that 2 different couriers for deposits are used by SSO -AR Unit and Map Office even though the two offices are located in the same building. Last year, approximately $4K was spent by the 2 offices for courier services.
  • The pattern of cash collections, which dramatically increases at the end of the year, seems to be inconsistent with a royalty revenue stream that one expects to be more regular. Delayed cash receipts can represent a significant benefit to the source organizations. 30 per cent of cash was received in the last month of the FY 2006/07, and 50 per cent in the last quarter.
No periodic or regular review
  • Interviews indicated that no reviews of the process were done by senior management within the last 5 years to ensure that the process is effective, efficient, and in accordance with policies and guidelines.
  • In the past 7 years, no periodic, unannounced verification visits were made to the petty cash office.
Mode of cash reception and reconciliation
  • The sample indicated that cheques currently account for 39.43 per cent ($2.09M) of the cash received and that 33.77 per cent ($1.79M) are wire transfers. Cheques are considered risky and inefficient due to frequent movement of funds. The use of wire transfers could substantially reduce the number of financial transactions handled by staff, but the process needs improvement since information related to the depositor is missing in the PWGSC report and assumptions must be made. For example, the audit identified 1 instance where it took 41 days to reconcile and report a $3.8M royalty deposit.

PETTY CASH CONTROLS

While petty cash was considered low risk based on its materiality, inconsistencies were found in the application of the petty cash policy and procedures (i.e., reimbursements for disallowed expenses, missing documentation and weak controls, and the absence of third party monitoring resulting in non-compliance).

Disallowed expenses
  • The audit identified petty cash reimbursements for travel, membership fees, or supplies occurring before December 2006 increased workload. Even though new procedures were implemented as of December 2006, which prevent the reimbursement of travel and membership fees through petty cash, further reduction of the demand for petty cash could permit the allocation of resources to activities that are riskier and more material in value such as cash receipts.
Supporting documentation
  • Sample analysis revealed that not all copies of receipts are stamped “cancelled” to prevent their future reuse.
  • Controls on documentation such as attaching original invoices or receipts and vouchers are weak.
  • 8 out of 20 petty cash claims requested for audit could not be located.

Recommendation and management response

1. EPS / FMB / SSO

  1. EPS, in consultation with the FMB and SSO , should review and document guidelines and process on how to recognize, manage and monitor royalties. This would help to provide more accurate and timely information for the financial statements.
     
  2. Attention should be given by EPS, with SSO -AR UNIT and FMB, to improving information flow between the Provinces or the Canada Nova Scotia Offshore Petroleum Board, PWGSC and the Department, allowing close monitoring of cash and facilitating cash consolidation particularly for Non-tax revenues.
Management Response
  1. EPS, through the Petroleum Resources Branch, will review and document guidelines with regard to managing royalties, in consultation with FMB and SSO.
    Expected completion date: December 2008.
     
  2. Information flow between the Sector, FMB, SSO, PWGSC, Offshore Board and Provinces (in regards to offshore royalties) will be highlighted in the guidelines, to create efficiency.
    Expected completion date: December 2008.

2. CMS / SSO

  1. CMS and SSO should take appropriate action to ensure that the SSO -AR Unit and Sectors are in compliance with TB and NRCan policies, guidelines and procedures, and resolve the challenges of the adequacy and effectiveness of internal controls in managing cash and petty cash.
Management Response
  1. The SSO -AR Unit has already begun to make appropriate changes in order to assure compliance with TB and NRCan policies, guidelines and procedures, in effort to resolve the challenges of the adequacy and effectiveness of internal controls in managing cash and petty cash. Two employees now open the mail daily. The SSO -AR Unit and the Map Office have consolidated deposits to one courier and one bank. We will review the current system access and tasks of employees in the SSO AR unit in order to optimize the segregation of duties. All the other SSO cash management procedures will be reviewed with the assistance of FMB.
    Expected completion date: December 2008.

    FMB will take into account the TB and NRCan policies applicable to management of cash and petty cash when establishing priorities in the context of its Financial Policy Monitoring Framework activities.

3. SSO / Sectors

  1. SSO and Sectors must improve current cash collection processes and encourage the use of wire transfer. This would decrease the number of intermediaries in the cash handling and information flow and, in turn, increase timeliness and reduce the risks.
  2. SSO should conduct a rigorous risk assessment with consideration given to all modes of cash receipt, operations and for revenue recognition and accounts receivables as well as their collection.
Management Response
  1. SSO will undertake a full review of the cash collection process with the objective of streamlining the process and ensuring better control on the point of entry of cash receipts in the department. We will also publish information on the intranet on the possible uses of wire transfer for collections of cash receipt.
    Expected completion date: December 2008.
     
  2. SSO will review and evaluate with the assistance of FMB the level of risk associated with the current SSO Revenues and Account Receivable processes in NRCan.
    Expected completion date: December 2008.