Continuous Auditing of Key Controls for Selected Processes Annual Report for Fiscal Year 2019-20

Audit and Evaluation Branch
Natural Resources Canada
Presented to the Departmental Audit Committee
September 29, 2020

Table of contents

• Introduction
  • Accomplishments this Year
  • Objectives
  • Scope
  • Methodology
• Key Findings and Recommendations
• Conclusion
  • Acknowledgments
  • Conformance with Professional Standards
• APPENDIX A - Audit Criteria - Continuous Audit of Grants and Contributions
• APPENDIX B - Audit Criteria - Continuous Audit of Offshore Revenues and Transfers

Introduction

Continuous auditing provides ongoing assurance on specific management processes and controls to enable more timely insight into possible risk and control issues. It enables the provision of findings to management on key controls related to financial and non-financial processes in a timely manner. The combination of continuous and regular audit activities provides adequate coverage of the Department’s key processes and controls. During the annual risk-based audit planning exercise, consideration is given as to whether a continuous or standard assurance audit is the most effective approach for providing assurance.

Continuous audits can significantly enhance the internal control processes and frameworks within an organization. They differ from traditional audits, which tend to be more comprehensive in terms of their scope. Continuous audit activities undertaken by Natural Resources Canada’s (NRCan) Audit and Evaluation Branch (AEB) are formally reported through this annual assurance report on key controls. This report presents the results of the continuous auditing activities undertaken by the AEB in fiscal year (FY) 2019-20.

Accomplishments this Year

With support from the Deputy Minister, Senior Management, and the Departmental Audit Committee (DAC), the AEB continued to provide continuous auditing capacity for NRCan in FY 2019-20.

The continuous audit activities conducted in FY 2019-20 focused on identifying potential control issues related to specific processes identified in the approved 2019-24 Integrated Audit and Evaluation Plan. Accordingly, the following two areas were assessed via continuous auditing:

• Grants and Contributions (Gs&Cs); and
• Offshore Revenues and Transfers.

The AEB was able to provide timely assurance to senior management and the DAC on the functioning of key controls for the areas identified above. Findings and recommendations resulting from the examination of these processes were provided to management in order to assist them with further improving existing control mechanisms. These findings and recommendations were also presented to the DAC along with the associated management responses and action plans.

In addition to AEB’s continuous audit activities, NRCan’s management was engaged in continuous monitoring in accordance with the Treasury Board’s (TB) Policy on Financial Management. The combined efforts by both the AEB and management have resulted in improvements to control processes and the correction of any identified control deficiencies.

Objectives

The objectives of the Continuous Audits performed was to provide reasonable assurance that:

• Key financial and monitoring controls are in place and operating as intended for selected Gs&Cs payments; and
• Key financial and monitoring controls are operating effectively for selected offshore revenues and transfers.

Scope

The scope and period of review for each of the continuous audit activities was:

Grants and Contributions	November 1, 2018 – July 31, 2019
Offshore Revenues and Transfers	March 1, 2019 – March 31, 2020

The key controls assessed during the two continuous audits are provided within Appendix A – Audit Criteria.

Methodology

The sample sizes for all continuous audits were selected to provide sufficient information to conclude on the operating effectiveness of selected controls.  

• The Continuous Audit of Grants and Contributions examined 10 key controls for a sample of 25 payment transactions, reflecting the administration of 18 separate contribution agreements in place during the scope period.
• The Continuous Audit of Offshore Revenues and Transfers examined 16 key controls for a sample of 25 transactions that belonged to one of the following categories: (i) offshore royalty receipts and transfers; (ii) corporate income tax transfers; (iii) forfeiture receipts and transfers; and (iv) crown share adjustments.

Key Findings and Recommendations

The following summarizes the findings and recommendations for each of the continuous audit engagements. The audits provided reasonable assurances when arriving at conclusions for the key controls that were tested, which were assessed as either- effective, partially effective, or ineffective, based on the following criteria:

• Effective: The key control was operating effectively throughout the audit period;
• Partially effective: The key control was not operating effectively throughout the audit period; and
• Not effective: The key control was not in place.

Continuous Audit of Grants and Contributions

The continuous audit found that all 10 key financial and monitoring controls are in place for the administration of Gs&Cs, and they are generally working as intended. There were no recommendations resulting from this year’s continuous audit.

The continuous audit also followed up on prior year recommendations and confirmed that the recommendations had been fully implemented and no additional follow-up was required.

Audit of Offshore Revenues and Transfers

The continuous audit found that all 16 key financial and monitoring controls examined were effective and did not identify any opportunities for improvement. There were no recommendations resulting from this year’s continuous audit.

The continuous audit also conducted a follow-up on prior year recommendations. Two of the four recommendations focused on updating the standard operating procedures manual, which were assessed as “in preparation for implementation”. Management has committed to the timely implementation of these recommendations during FY 2020-21. The remaining two recommendations are no longer applicable to NRCan, following the transfer of some roles and responsibilities to a Government of Canada crown corporation.

The AEB will continue to follow-up on the implementation of the management action plans, on an annual basis.

Conclusion

The continuous audits performed during FY 2019-20 will continue to be a part of the AEB’s 2020-25 Integrated Audit and Evaluation Plan, given that:

• The Continuous Audit of Grants and Contributions will continue to provide management with assurance on the functioning of key controls in place for the management of Gs&Cs payments, given that, NRCan relies significantly on Gs&Cs to deliver its programs.
• The Continuous Audit of Offshore Revenues and Transfers provides management with assurance on the functioning of key controls in place, to ensure that the offshore revenues and transfers are accurate and processed in accordance with the Atlantic Offshore Accords Acts and the related Regulations. The continued testing will also ensure follow-up on the implementation of outstanding audit recommendations that resulted from previous iterations of this audit.

Acknowledgments

The AEB would like to thank those individuals who contributed to these continuous audits and particularly employees who provided their insights and comments.

Conformance with Professional Standards

In my professional judgement as Chief Audit and Evaluation Executive, the continuous audit activities along with this annual report conform with the Institute of Internal Auditors' International Standards for the Professional Practice of Internal Auditing and the Government of Canada’s Policy on Internal Audit, as supported by the results of the Quality Assurance and Improvement Program.

Michel Gould, MBA, CPA, CIA
Chief Audit and Evaluation Executive
September 29, 2020

APPENDIX A - Audit Criteria - Continuous Audit of Grants and Contributions

The objective of this continuous audit was to provide reasonable assurance that key financial and monitoring controls are in place and working as intended, for the selected Gs&Cs payments and related contribution agreements. The controls that were tested are as follows.

Key Financial and Monitoring Controls

1. The selected project met the selection criteria of the program and was recommended by the selection committee.
2. The contribution agreement or amended contribution agreement is signed by an individual with the appropriate delegated financial signing authority for transfer payments / Gs&Cs.
3. Commitments (section 32 (S.32) of the Financial Administration Act [FAA]) are entered into the NRCan SAP financial system when agreements are signed.
4. Requests by recipients for payments are reviewed:
   1. to ensure compliance with stacking provisions;
   2. with sufficient procedures and rigour to assess their accuracy, reasonableness, eligibility and compliance with program terms and conditions and are authorized pursuant to S.34 of the FAA by individuals with appropriate delegated financial signing authority; and
   3. to ensure advance payments (if any) are in accordance with program terms and conditions and comply with the Directive on Transfer Payments.
5. Authorization is completed pursuant to S.33 of the FAA and approved in the SAP financial system by an individual with the appropriate delegated financial signing authority.
6. Payments to recipients are recorded in the appropriate fiscal period.
7. Repayable contributions are monitored and recorded in the AMI system and any prior year payments deemed repayable have been correctly recouped in a timely manner.
8. A risk-based plan for recipient audits is established, implemented and progress is monitored.
9. Findings and recommendations identified during prior year site visits or recipient audits are addressed in a timely manner.
10. Proactive disclosure of Gs&Cs over $25,000 is verified for accuracy and approved prior to web posting.

APPENDIX B - Audit Criteria - Continuous Audit of Offshore Revenues and Transfers

The objective of the continuous audit was to provide reasonable assurance that key financial and monitoring controls are operating effectively for the selected offshore revenues and transfers. This Appendix details the specific key control areas that were tested as they relate to offshore revenues and transfer payments.

Key Financial and Monitoring Controls

1. Offshore revenue cash receipts:
   1. An accurate notification of incoming revenue with SAP financial coding is sent to Accounts Receivable (A/R).
   2. The notification of incoming revenue is matched to the Credit Notice Report.
   3. Cash receipts are recorded accurately [General Ledger Account/Financial Reporting Account/Object Code (GL/FRA/ECON)] and for the proper period in SAP.
2. Transfer payments:
   1. Transfer payments are approved in accordance with FAA Section 34 (S.34) requirements- i.e. for account verification purposes. 
   2. Transfer payments are approved in accordance with FAA S.33 requirements for quality assurance purposes (including completion of the Account Verification Statutory Payment Checklist).
   3. Payment vouchers are recorded accurately [GL/FRA/ECON] and for the proper period in NRCan’s Financial Management and Accounting System (SAP).
3. Compliance with legislative and regulatory timelines:
   1. NRCan ensures that receipts from oil companies are received by the last day of the month following the month to which they relate.
   2. NRCan’s Revenue Fund is credited within 10 working days after the end of each month that the remittance is received
   3. Payment is made to the province before the end of the month in which the credit to the revenue fund was made.
   4. The calculation of the deflated oil price is provided to the oil companies within the first seven days of the month.
4. Accruals of revenues (receipts) and transfers (payments):
   1. Receivables at year-end and reversal entries are established, are accurate, recorded in the correct period, and reviewed and approved by the Corporate Reporting Unit.
   2. Payable at year-end (PAYE) and reversal entries are prepared accurately and recorded in the correct period.
   3. PAYEs are approved in accordance with FAA S.34 requirements.
   4. PAYEs are approved in accordance with FAA S.33 requirements by Finance Services (including the Quality Assurance Checklist for PAYE), and reviewed and approved by the Corporate Reporting Unit.
5. Tracking, monitoring, and reconciliation:
   1. Incoming offshore revenues (receipts) and outgoing transfers (payments) are accurately tracked in a central repository.
   2. An annual reconciliation between a cash basis and a year-end basis is performed.