Audit Universe

Management Accountability and Core Controls

Consultations

Risk Assessment

Audit Accomplishments 2009-2010

Recommended Audits for 2010-2011

Recommendation to DFAIT Audit Committee 2011-2012

Recommendation to DFAIT Audit Committee

Appendix A: OPERATIONAL PLAN FOR 2010-2011

Appendix B: Audit Plan for 2009-2010

Appendix C: Audit Plan for 2010-2011

Appendix D : Audit Plan for 2011-2012

Appendix E: AUDIT PLAN MAF AND CORE CONTROL COVERAGE

Appendix F: AUDIT UNIVERSE MAPPED TO DFAIT PROGRAM ACTIVITY

Appendix G: DFAIT CORPORATE RISK PROFILE 2010-2011

Preface from the Chief Audit Executive

I am pleased to present an update to our three-year Risk Based Audit Plan.

This document has been developed by the Office of the Chief Audit Executive with partners, in careful accordance with the requirements of Treasury Board Secretariat and the Office of the Comptroller General. We have consulted widely, particularly with senior management of our Department and the Offices of the Auditor General and Comptroller General.

This review has given us the opportunity to refresh our audit plan, in keeping with changing risks and priorities. The document provides an assessment of what has been accomplished in DFAIT’s audit program in 2009-2010. It also offers an objective assessment of DFAIT’s audit requirements, and our capacity to complete the remaining two years of our Risk-based Audit Plan.

Our challenge in 2009-2010 was to balance planned internal audit activities with urgent audit assignments related to our decision to undertake the Financial Resource Management Risk Assessment.

It is important to note that this assessment led to the identification of additional priority audit projects to be completed in 2009-2010, which were considered critical to the Department.

I am confident that our recommendations for planned internal audits in the next two business years support stronger financial management and emphasize effective risk management and stewardship of resources.

One of the key requirements of the Treasury Board Policy on Internal Audit is for the Chief Audit Executive to provide an annual overview assurance report on the state of departmental risk management, control and governance processes. The results of our audit work to date, and our recommendations for future audits as described in this refreshed Plan, will be central to my assurance report.

I have appreciated the wide co-operation and joint effort in the planning and implementation of our three year audit program for the Department of Foreign Affairs and International Trade.

Yves Vaillancourt
Chief Audit Executive
Foreign Affairs and International Trade

Executive Summary

This document describes the risk-based planning and selection of the Department of Foreign Affairs and International Trade’s (DFAIT) internal audits for the period of 2010 to 2012. This updated version of the Risk-based Audit plan has been prepared in accordance with the applicable requirements of the 2009 Treasury Board Policy on Internal Audit, its directives and guidelines.

The Audit Plan was prepared following an analysis of the DFAIT audit universe, a review of significant audit findings resulting from past audit reports, interviews with senior management of the Department, and a final ranking exercise which took into consideration materiality, risk, relevance and value-added criteria.

Selection of audit projects for 2010-2011 also took into consideration “in reserve” audits (re: audit engagements not undertaken in 2009-2010) as well as coverage of audit subject matters by external auditors such as the Public Service Commission, the Office of the Comptroller General and Office of the Auditor General. Finally, over the course of the year, senior management suggested specific management issues which they sensed merited audit attention, such as the Delivery of Corporate Services at DFAIT headquarters and Strategic Use of Travel. These suggestions were also considered in developing our Audit Plan.

The Departmental Audit Committee considered the selection of these projects at a meeting held in February 2010. Their recommendations are incorporated in this Plan. Once formal approval has been granted by the Deputy Ministers, the Office of the Chief Audit Executive will move to complete approved audits for 2010-2011.

1. Overview of Planning

a) Audit Universe

Audit entities defined as management business processes were presented in the original 2009-2012 Risk-based Audit Plan. For the purposes of this refresh exercise we have considered these audit subjects and their initial risk analysis. Additional audit subjects have been identified in our refresh, resulting in an updated audit universe. All audit subjects were reviewed, and their risk assessed, in selecting and recommending audit projects for 2010-2011 and 2011-2012.

b) Management Accountability and Core Controls

Our review and analysis of risk has resulted in a recommendation of six audits in 2010-11 and five audits in 2011-2012. We have also reviewed how these new projects will increase our knowledge of DFAIT and provide adequate coverage of the department’s operational processes. The results of our review of past audit findings, coupled with an assessment of how the proposed audits cover key core management controls is presented in Annex E.

The audit work we conducted in 2009-2010 concentrated on stewardship, more specifically on gaining a better understanding of DFAIT’s risks related to financial management. The recommended audits for 2010-2011 continue our review of the Department’s resource management and its progress in implementing the management actions flowing from the Financial Management Project.

As well, the audits of the Management of Real Property and Non-IT Assets further our understanding of the accounting by DFAIT of these expenditures including the processes for their recording, valuation, use and disposal.

Given the planned audits by external auditors, an assessment of DFAIT’s management of staffing will provide important information on the “people” core management control. Finally, understanding of the management of Grants and Contributions will be gained from TB-directed audits.

c) Consultations

In preparing its plan for 2010-2011, Internal Audit considered:

• Audits which would assist in implementing Year 2 of the recommendations of the Financial Resource Management Risk Assessment and Audit of Resource Allocation.
• Views of DFAIT senior management of risk through interviews across the Department at HQ and missions.
• Views, as well as planned audits, of external auditors and other providers of assurance. In 2010-2011, the resources of the CAE will work with external auditors in an assessment of DFAIT’s internal management of staffing (with PSC), internal audit (with OAG), contracting temporary help (with PSC), as well as delivery of a mandate related to water management (with the Commissioner for Sustainable Development). DFAIT may also be asked to take part in an OCG-led audit of Business Case Development.

• Assessment of risk by peer Executives responsible for oversight in the areas of inspection, investigations and evaluations at DFAIT.

d) Risk Assessment

The assessment of risk in this review has benefited from the CAE’s increased knowledge of DFAIT’s programs. This has been achieved through audits we have conducted in the first year of the Plan, the further development of DFAIT’s Corporate Risk Profile, and the role of the CAE in reviewing the Department’s changing priorities.

The final ranking of recommended audit projects for 2010-2011 and 2011-2012 was achieved following:

• A review by Internal Audit, of the initial risk assessment presented in the 2009-2012 Risk-Based Audit Plan, to validate risk information against any changes in DFAIT’s program structure and priorities. This exercise emphasized the need to continue audit work that contributes to strengthening the Department’s resource management regime.

• An assessment of areas of significance (for the entity/topic examined). Consideration was given to audit projects which examine those areas of the department where there is greater financial significance or considerable resources have been directed, and which support directly and substantially departmental objectives and priorities.

2. AUDIT ACCOMPLISHMENTS IN 2009-2010

Much was accomplished by DFAIT’s Internal Audit work in 2009-2010. Completing the Financial Resource Management Risk Assessment was central to our support of effective risk management and sound resource stewardship of the Department. Our contribution to this critical area was further strengthened through audits in such areas as Resource Allocation, Expenditure Controls, Headquarters Growth and a Progress Report on Implementation of Strategic Review Reductions.

For good reason the audit program we implemented in 2009-2010 was not entirely in keeping with the originally approved Risk-based Audit Plan. Figure 1 illustrates what was originally planned, and what was completed. It also indicates the consequence of necessary changes, in particular audits that required re-scheduling to 2010-2011, and 2011-12.

Ten audit projects had been approved for 2009-2010. Based on available funding, the Office of the Chief Audit Executive decided to proceed with 7 of the 10: departmental governance structures, resource allocation, expenditure controls for high risk payments, information for decision making, real property, systems governance and systems management. The first three in italics were completed and reported on. Due to a shift in Departmental priorities, and budget reductions for Internal Audit, the remaining audits to be completed in 2009-2010 were moved to 2010-2011 to be reconsidered following a refresh exercise.

Figure 1: Risk-based Audit Plan

In 2009-2010, DFAIT faced serious matters concerning its budget and financial administration. There were further challenges in preparing for the presentation of DFAIT’s Financial Statements.

Senior management requested, and the CAE agreed, that the four audit projects below be completed as a priority:

• An analysis of Note 3, supporting work to approve the Department’s Financial Statements;
• Effective coordination between the External Review on Budgeting and Forecasting (which led to the Financial Resource Management Risk Assessment) and the conduct of an internal audit of Resource Allocation.
• An audit opinion on growth at DFAIT’s headquarters
• An audit of progress in the implementation of the 2007 Strategic Review Reductions.

During the review of the Financial Statements, requests of senior management and the DAC for supporting details of Financial Statement line items could often not be answered in a timely fashion. As a result, a reconciliation of Note 3 was completed. Also, a lack of information on departmental charges which drove DFAIT’s spending in 2008-09 was compounded with a sudden short fall in DFAIT’s operating budget at mid-year.

Internal Audit was asked to undertake a Financial Resource Management Risk Assessment to provide early analysis of the reliability of the Department’s forecast. Other audit tasks were completed in the early Winter to further the Department’s overall understanding of the root causes of the budgetary shortfall and recommend financial management practices to prevent this situation from recurring.

As the above-noted audits examined in depth DFAIT’s management of its finances, three additional audits planned for 2009-2010 were covered by other assurance providers:

• Audit of Risk Management was completed through DFAIT being included in the OCG Horizontal Audit of Corporate Risk Profiles. The OCG reported in March 2010 on the results for the Department.
• Information Technology Asset Management was also covered with OCG including DFAIT in its Horizontal Audit of IT Asset Management.  The OCG will report in September 2010 on this matter to the Government of Canada Audit Committee.
• Treasury Board Submissions and MCs was covered as part of work initiated under the Financial Resource Management Rick Assessment. The resulting management action plan addresses improved coordination and management of this function.

As well, a mandatory audit of the management of grants and contributions of the Global Partnership Program was initiated in the fourth quarter of 2009-2010, and should be completed in the first quarter of 2010-2011. It is important to note that although the 10 audits originally scheduled for 2009-2010 were not all completed as planned, 10 audits were completed as described.

3. Recommended Audits for 2010-2011

For reasons explained, some audits scheduled for 2009-2010 were not undertaken. These were moved to 2010-2011 for review under the refresh exercise.

The original Risk-based Audit Plan lists a further eleven audits for consideration in 2010-2011. Suggestions from senior management added a further two audits to be considered in our refresh exercise for 2010-2011. These are the Delivery of Corporate Services at Headquarters and Strategic use of Travel.

Our refresh exercise for 2010-2011 therefore considered eighteen audit subjects. The review and priority ranking exercise considered first the need to complete a program of audit which supplemented the work of the Financial Resource Management Risk Assessment and further our knowledge of significant DFAIT program components such as Real Property and non-IT assets. The review also included an analysis of materiality, risk, and key factors such as sun-setting provisions for the review of some transfer payment programs at DFAIT. The latter part of our analysis involved consultations with senior management in DFAIT, and partners outside of the Department.

Our recommendation, after this review and assessment of priorities, is that six audits go forward in 2010-2011 with one audit held in reserve. The remaining twelve audits will be reconsidered in the 2011-12 planning exercise. Appendix C provides further detail on these audits.

Figure 2: lists the six audits, as well as one in reserve project, that will be undertaken in 2010-2011 using Internal Audit resources.

Figure 2 – Audits planned in 2010-11

These are:

• Six planned audits resulting from our risk based analysis, and scheduled in the Audit Plan.
• Five funded audits required by Treasury Board.
• Five external audits conducted by other agencies, which involve DFAIT and require some audit coordination and support.

As noted above, the choice and priority of audits planned for 2010-11 has been heavily influenced by the findings of our Financial Resource Management Risk Assessment, and other audit work, completed in 2009-10. It is management’s view that action taken in 2009-10 to strengthen financial management be further supported with audits that inform on DFAIT’s financial position in the short and longer term and report on the reliability of financial and non-financial information used for decision-making.

The proposed internal audits for 2010-2011 consist of the first six projects noted below, with the remaining audit held in reserve.

4. Recommended Audits for 2011-2012

Determination of the internal audits that the Office of the CAE will undertake in 2011-2012 is based on the same refresh and ranking exercise described in Section 3 of this document.

At this early stage, the proposed Audit Plan for 2011-2012 consists of five audits identified in Figure 3 (see green audit topics). The Revenue Controls audit is held in reserve. We will conduct an additional review of materiality, risk, and other factors toward the end of 2010-2011 to ensure that the final year of DFAIT’s Risk-based Audit Plan is current and in keeping with highest priority needs.

Figure 3 also lists the remaining audit topics, which had originally been listed in the Audit Plan. These will be reconsidered in the refresh exercise of 2011-12.

A description of the planned audits for 2011-12 is provided in the table that follows:

Our information on planned audits by external auditors (such as the OAG and Comptroller General) as well Treasury Board directed work in 2011-2012 is incomplete at this time.

Also, at this early stage we do not foresee DFAIT undertaking any mandatory audits during this period. We will add these elements of audit work to our planning for 2011-2012 as information comes available.

5. Recommendation to the DFAIT Audit Committee

It is requested that the Departmental Audit Committee review the Draft Audit Plan and recommend to the Deputy Minister implementation of the projects as presented and costed for 2010-2011. Should audit priorities change over the course of 2010-2011, following management directions, Internal Audit will return to the Departmental Audit Committee to inform them of recommended changes.

To note: An Operational Plan for audits selected in 2010-11 is presented at Appendix A. At Appendix B, we present the 2009-2010 risked-based audits as well as results following the first year of implementing the Plan. Appendices C (2010-2011) and D (2011-2012) list and provide consideration for audits to be completed in those years as well as considerations for those audits held in reserve.

Appendix A: Operational Plan for 2010-2011

Operational Plan 2010 - 2011

Appendix B: Audit Plan for 2009-2010

Appendix C: Audit Plan for 2010-2011

Appendix C: Audit Plan for 2010-2011

Appendix C: Audit Plan for 2010-2011

Appendix C: Audit Plan for 2010-2011

Appendix D: Audit Plan for 2011-2012

Appendix E - Audit Plan MAF and Core Control Coverage

MAF : Resulting coverage 2010-11 Audits

Appendix F – Audit Universe Mapped to DFAIT Program Activity

Appendix G - DFAIT Corporate Risk Profile 2010-2011

^*If you require a plug-in or a third-party software to view this file, please visit the alternative formats section of our help page.