Audit of the Immigration Program at the Bogota Mission

Internal Audit & Accountability Branch
Citizenship and Immigration Canada
September 2012


Table of Contents


Executive Summary

The Citizenship and Immigration Canada (CIC) Risk-Based Audit Plan (RBAP) identifies audit and advisory engagements to be undertaken by weighing a combination of departmental priorities and risks. Completed by the Internal Audit and Accountability (IAA) Branch and approved by the CIC Audit Committee in April 2011, the 2011–14 RBAP identified the need for an audit of the immigration program at the Canadian mission in Bogota, Colombia, in Q4 2011–12.

The Bogota mission is a full service centre in Canada’s overseas network of visa offices. As of January 2012, the mission had 18 immigration employees as follows:

  • 5 Canada-based officers (CBO), including 1 migration integrity officer
  • 13 locally engaged staff (LES)

The audit objectives were to assess the adequacy of the mission’s

  • governance framework for administering the immigration program;
  • risk management processes and practices in place to support program objectives; and
  • internal control framework governing administrative, financial and operational activities.

The criteria used in the audit were based on Treasury Board and CIC applicable legislation, policies and directives, and can be found in Appendix B. The audit covered the period from October 1, 2010, to the end of the site visit on March 9, 2012.

We found that

  • the governance framework generally met our expectations;
  • risk management processes and practices partially met our expectations; and
  • the internal control framework partially met our expectations.

This audit report sets out the recommendations for addressing our observations, as well as management’s responses, action plans and proposed completion dates.

Statement of Assurance

The conduct of this engagement was done in accordance with the Internal Audit Standards for the Government of Canada, which incorporates the Institute of Internal Auditors’ International Standards for the Professional Practice of Internal Auditing. Sufficient and appropriate auditing procedures were performed to provide a high level of assurance over the findings and conclusion in this report.

Gibby Armstrong
Chief Audit Executive Citizenship and Immigration Canada

Introduction

Citizenship and Immigration Canada (CIC) recruits, selects and processes applications from foreign nationals who want to come to Canada temporarily or permanently and contribute to building a stronger Canada by settling and fully integrating into Canadian society and the economy. The Operations Sector at CIC National Headquarters, which is divided into domestic and overseas operations, is responsible for carrying out these tasks. Overseas operations fall under the responsibility of the International Region (IR) and its network of visa offices (or missions) abroad. As of September 2011, this network was comprised of 90 points of service in 76 countries.

There are four categories of visa offices or missions abroad: regional program centres (RPCs), full service centres, satellites, and specialized offices. RPCs and full service centres both deliver the full range of immigration services for the countries they serve, but RPCs also oversee satellite offices. The full range of immigration service includes the processing of permanent and temporary resident applications, as well as other immigration applications, such as requests for travel documents or temporary resident permits. Satellites and specialized program offices do not deliver the full range of immigration services.

The Bogota mission is a full service centre. Consequently, the mission provides the full range of immigration services from residents of Colombia and Ecuador, with the exception of Quebec economic class applications, which are processed in Mexico City (effective March 2010).

Appendix A sets out a summary of the mission’s processing statistics for 2008–11, and a comparison with CIC’s overseas network.

Environmental Context

This section of the report highlights some of the environmental context in which the mission operates. They are presented here for information purposes only and do not reflect any particular order.

Mission management identified the following challenges related to the operating environment in their 2011–12 International Region Integrated Management Plan (IRIMP):

  • While the armed conflict in Colombia has eased somewhat for urban populations, urban militias and organized gangs continue to gain ground.
  • The movement from Ecuador is dominated by business and family visitors, English-as-a-second-language and other students, as well as some intending to work.
  • The majority of resources are diverted to temporary resident processing during the high season, thereby impeding permanent resident processing for approximately one third of the year.
  • The mission enters the summer high season in March, with peak applications in May and June, and continues to August. Applications pick up again in November with a drop in December and January. Like other missions in the region, Bogota is now seeing less of a dip in demand in the low temporary resident season.
  • As of November 2011, Bogota is no longer a source country class. The source country class allows Canada to resettle persons who are in a refugee-like situation but remain in their country of origin, and therefore, they do not come under the protection mandate of the United Nations High Commissioner for Refugees. The mission retains a number of outstanding source country cases to be considered following operational instructions.

Observations and Recommendations

Governance Framework

The audit examined the adequacy of four areas of the governance framework for administering the Immigration Program:

  • governance and strategic direction;
  • public service values;
  • results and performance; and
  • accountability.

To assess components of the governance framework, we interviewed program staff and other mission staff with links to the Immigration Program, reviewed documents, observed processes, tested information, and reviewed samples of management files for compliance.

We expected to find that

  • the mission had clearly defined and communicated strategic directions and strategic objectives, aligned with its mandate;
  • the mission had operational plans and objectives in place aimed at achieving its strategic objectives;
  • management, through its actions, had demonstrated that the mission’s integrity and ethical values cannot be compromised; and that values and ethics were promoted within the mission, documented, and clearly communicated;
  • relevant information on results was gathered, used to make decisions, and reported; and
  • a clear and effective organizational structure was established and documented.

The governance framework in place at the mission generally met our expectations.

Governance and Strategic Direction

The immigration program’s annual IRIMP submission to IR provided a good overview of the program’s strategic direction, and internal and external environmental factors affecting program management and operations. The mission managed the workload through the use of temporary duty, emergency and term LES, as well as temporary reassignment of staff, given resource limitations and the seasonal peak of temporary resident processing. This is reflected in the mission’s budget request.

Public Service Values

Values and ethics were promoted, reinforced, and clearly communicated. Staff indicated that they understood management’s commitment to values and ethics and the reasons for it. Staff also indicated that they felt it was important, and recalled participating in training. Review of a sample of human resource files found that all LES had signed codes of conduct on file, and management was notified on-site regarding the requirement to sign the codes annually. A review of recently completed competitions showed consideration of values and ethics, including risk of conflict of interest, in the staffing process.

Results and Performance

There was limited documented information on results gathered or reported. However, due to the size of the mission and the organizational structure, performance information flowed through reporting lines appropriately to support decision-making. Progress towards permanent resident targets is monitored, as required. There was less formal monitoring of processing times, response times for inquiries, and achievement of service standards.

Accountability

There was a clear, established and documented organizational chart in place. Interviews and the human resource files reviewed supported that the organizational chart was reflective of reporting lines. Functional duties between officers were well distributed to avoid concerns regarding the segregation of duties.

Risk Management

The audit examined the adequacy of risk management processes and practices in place to support program objectives.

We expected to find that

  • the mission identified and documented the risks that may preclude the achievement of objectives;
  • management appropriately communicated risk and risk management strategies to key stakeholders; and
  • planning and resource allocations considered risk information.

To assess risk management processes, we interviewed program staff and other mission staff with links to the Immigration Program, reviewed documents, observed processes, tested information, and reviewed samples of management files for compliance.

The mission provided a good overview of its internal and external environmental context through its IRIMP. Mission management was aware of the risks which may preclude achievement of its objectives. Business continuity plans are developed for most critical functions.

No quality assurance exercises, other than participation in a departmental family class priority exercise, were conducted; however, the 2012–13 IRIMP includes plans to review reliability of process and conduct decision-making quality assurance exercises.

The risk management processes and practices in place at the mission partially met our expectations.

Recommendation 1

Bogota program management should ensure that quality assurance reviews are conducted as planned in a systematic manner, that results are disseminated to staff, and that any resulting recommendations to improve operations are implemented.

Internal Control Framework

The audit examined the adequacy of eight areas of the internal control framework governing administrative, financial, and operational activities:

  • application processing;
  • access controls;
  • controlled documents;
  • cost recovery;
  • travel and hospitality;
  • people;
  • client-focused service; and
  • learning, innovation and change management.

Overall, we found that the internal control framework partially met our expectations. The specific details are outlined below by line of inquiry.

Application Processing

The audit of internal controls included an examination of application processing.

We expected to find that

  • decisions are adequately documented, and required supporting documentation is maintained;
  • designated and delegated authorities for decisions are appropriate and comply with departmental policy; and
  • appropriate controls are in place to ensure that admissibility requirements are met.

For all permanent and temporary resident cases finalized within the audit period, we examined criminality, security and final decisions entered to test compliance with decision-making authorities. We also reviewed the process in place to assess immigration applications in order to ensure adequate controls were in place to safeguard compliance with operational and legislative requirements. In addition, we interviewed program staff and other mission staff with links to immigration operations, reviewed documentation, observed processes, and documented controls.

Overall, our file review found that the mission processed the applications reviewed in compliance with the relevant policies and procedures. For most cases, applications were complete, selection and final decision were generally well documented, admissibility checks were performed and well documented, delegated authorities were adhered to, files were adequately organized, and applications were processed in a timely manner.

Decisions made on all temporary and permanent resident cases finalized over the audit period were made by individuals with the authority to do so.

Appropriate controls were in place to ensure that admissibility requirements were met. The mission uses a private organization to issue criminal clearance certificates, however a formal memorandum of understanding or agreement with the organization is not in place.

Recommendation 2

Bogota program management and the International Region should consult with legal services to confirm whether a formal agreement with the private organization used to issue criminal clearance certificates during applicant admissibility checks is required.

Access Controls

As part of the audit of the internal control framework, we examined system access controls over the Computer-Assisted Immigration Processing System (CAIPS) and the Global Case Management System (GCMS).

We expected to find that

  • appropriate controls are in place for the management and use of CAIPS and GCMS user accounts at the mission; and
  • appropriate controls are in place to safeguard CAIPS and GCMS information technology hardware at the mission.

CAIPS was the main system used to facilitate immigration work at the mission and in all visa offices abroad until the implementation of the GCMS. The GCMS was introduced at the Bogota mission in September 2010, and is currently being used to process certain types of visas. It is expected that, over time, the GCMS will become the main system used by visa officers overseas and that CAIPS will eventually be decommissioned.

To assess the administration of CAIPS and the GCMS, we interviewed program staff and reviewed information technology hardware inventory. We also examined user profiles to determine whether access levels exceeded authorities, accounts belonging to former employees remained in the system, or employees had multiple profiles (although permitted in CAIPS).

Controls were in place for the management and use of CAIPS and GCMS user accounts at the mission. No major issues were identified. There was one account belonging to a former employee in the system. This account was removed while we were on-site and had not been used during the period covered by this audit to enter decisions.

A recommendation in the May 2012 Audit of System Access Controls was made to address the issue of review procedures for GCMS accounts, and management identified an action plan item in that report. This recommendation is being followed up to ensure action is taken.

Appropriate controls were in place to safeguard CAIPS and GCMS information technology hardware at the mission.

Controlled Documents

At the time of the audit, controlled documents in missions abroad were comprised of counterfoils and seals that were issued together as a visa. Counterfoils are the documents on which missions print visa information. Seals are documents that are affixed over counterfoils after they are placed in an applicant’s passport to prevent tampering. Use of the security seal was eliminated effective April 1, 2012.

As part of the audit of the internal control framework, we examined controls over controlled documents.

We expected to find that

  • the roles and responsibilities are appropriate for the custodianship, safeguarding and handling of controlled documents; and
  • adequate controls are in place for the custodianship, safeguarding and handling of controlled documents.

We interviewed program staff, including the Forms Control Officer; reviewed documents, including the last four quarterly reports submitted either through Controlled Key Forms Inventory Tracking System or the previous paper version; observed visa printing processes; and documented controls. We also conducted a physical inventory count to reconcile inventory on hand with usage records, and reviewed a sample of transactions to assess the office’s accuracy in record keeping.

The roles and responsibilities were generally appropriate; however, they were not operating as defined adequate for the custodianship, safeguarding and control of controlled documents. Three of the four quarterly reports were not submitted to the Forms Management Officer until requested for audit purposes.

During our site visit, we were unable to reconcile the total counterfoils or seals on hand (physical count) with the quantity indicated in the records retained by the mission. For counterfoils, records showing usage during the period following the last quarterly report were maintained; therefore, we can conclude that the last quarterly report did not reflect the actual inventory on hand at December 31, 2011. Records of individual seals used were not maintained prior to March 2012; therefore we cannot validate the daily usage logs or draw any conclusions on the reason for the discrepancy in seals.

Recommendation 3

Bogota program management should ensure that adequate controls are in place to safeguard and account for its controlled documents inventory.

Cost Recovery

The audit examined the control framework in place to safeguard revenues. The mission accepts payment by direct deposit, bank draft or certified cheque in Canadian dollars.

We expected to find that there is an effective control framework in place to safeguard revenues collected in the immigration section of the mission:

  • Roles and responsibilities assigned and procedures performed are in accordance with policies; and access to cost recovery records and information is limited to authorized individuals.
  • Controls are in place to ensure accurate recording and processing of cost recovery transactions.
  • Cost recovery records are retained, and are periodically monitored and verified.

We interviewed program and other embassy staff with responsibilities related to cost recovery; reviewed logs and reports produced by POS+ (the cash register system in use at missions abroad); reviewed documents produced by the mission, including descriptions of processes and fee schedules (which change due to exchange rates in effect); reviewed samples of completed transactions, including application fees, refunds and voids; reconciled annual revenue reports from POS+ and SAP (CIC financial system); and observed processes, including end-of-day reconciliation.

The roles and responsibilities were generally assigned and the procedures performed were generally in accordance with policies; access to cost recovery records and information was limited to authorized individuals. One LES appeared to have access that is beyond the restrictions set in the POS+ Manual, though not specifically prohibited in the Cost Recovery Manual (compact database and repair and compact database). Access restriction requirements are therefore unclear.

Controls were generally in place to ensure accurate recording and processing of cost recovery transactions. The mission had not updated the fee schedule according to the changes in exchange rates. Management was notified on-site and updated the fee schedule shortly after our visit.

Refunds reviewed were incorrectly coded and did not take into account exchange rates as of the refund date. The department’s refund form template does not formally acknowledge section 34 of the Financial Administration Act; however, it does document approval under section 20. Recommendations to International Region or NHQ Finance regarding the following issues have been included in the September 2012 Audit of the Immigration Program at the Mexico Mission, and will be followed up accordingly:

  • POS+ access requirements,
  • refund exchange rates, and
  • procedures to formally acknowledge section 20 and 34 approvals for refunds.

Cost recovery records were retained, and were periodically monitored and verified.

Travel and Hospitality

As part of the audit of the internal control framework, we examined the controls over travel and hospitality expenditures.

We expected to find that the internal control framework for managing travel and hospitality expenditures is in compliance with the applicable policies and directives.

In examining travel and hospitality expenditures, we interviewed program staff and other mission staff with links to immigration operations, documents, and documented controls. Specifically, we reviewed a sample of travel and hospitality claims to assess the effectiveness of the controls in place.

Controls related to travel and hospitality expenditures met our expectations. Office procedures relating to administering travel and hospitality generally complied with the applicable policies and were being followed.

People

The audit examined the human resources practices in place to support the delivery of the immigration program.

We expected to find that:

  • human resource management is aligned with strategic and business planning;
  • the mission provides employees with the necessary training, tools, resources and information to support the discharge of their responsibilities; and
  • the mission has in place a system for evaluating the performance of employees.

We interviewed program staff and other mission staff with links to the Immigration Program, and reviewed documents and samples of management files for compliance, including employee human resource files, performance evaluations, and completed staffing files.

All staffing files reviewed included the advertisement, established criteria, evidence of assessment against the criteria, and results of the competition. The mission provided employees with the necessary training, tools, resources, and information to support the discharge of their responsibilities. Interviews suggested that staff know their jobs well. This is also generally supported by results in the other areas within the scope of this audit.

The mission has a system in place for employee performance evaluations. We reviewed evaluations in a sample of human resource files and found that they were generally completed for the last fiscal year (2010–11). The one file that lacked a performance evaluation did have evidence of discussion on file. Performance indicators are primarily qualitative; however, quantitative indicators are also included.

Client-Focused Service

The audit examined the extent to which the services provided were client-focused.

We expected to find that

  • the mission takes measures to facilitate access to its services;
  • the mission leverages technology to enhance user services and access; and
  • a formal process is in place to consider feedback and impact on short- and long-term objectives.

To assess client-focused service, we interviewed program staff; reviewed documents and communications, including the mission’s website; and reviewed performance information.

The mission took measures to facilitate access to its services, and leveraged technology to enhance user services and access. Response times to members of Parliament and other inquiries are not systematically tracked, but the general inboxes are occasionally reviewed to ensure that there are no outstanding queries.

There was no formal process in place for client feedback, other than the general mailbox.

Learning, Innovation, and Change Management

The audit examined the learning, innovation, and change management practices in place at the mission.

We expected to find that

  • learning and development activities are used to promote innovation and change management at the mission; and
  • change management practices supported the implementation of the GCMS at the mission.

To assess learning, innovation and change management, we interviewed program staff and other mission staff with links to the Immigration Program, reviewed documents, and observed processes.

We found that the learning, innovation and change management framework in place at the mission generally met our expectations.

Learning and development activities were used to promote innovation and change management at the mission, and change management practices supported the implementation of the GCMS at the mission. Staff generally felt that management implemented the GCMS well; and that management was organized and provided training.

Planning of the mission move was well documented and demonstrated consideration of risk, communication and resource requirements. Staff also felt it was well conducted and appreciated the new space.

Recent and in-process changes at the mission include modernization, introduction of the Visa Application Centre, the end of source country class, and the ongoing development of GCMS knowledge.

Appendix A – Bogota Processing Summary

Line of Business 2011 2011 – All
Offices Abroad
2011 – Bogota as
a % of All Offices
2010 2009 2008
Permanent Residents Visas Issued 2,135 230,986 0.9% 2,867 3,534 4,309
Applications Finalized  2,598 281,769 0.9% 4,554 5,472 4,899
Applications Received  2,050 303,524 0.7% 3,162 4,363 5,305
Temporary Visitors Visas Issued 15,634 865,933 1.8% 14,283 14,291 16,386
Applications Finalized 21,948 1,058,085 2.1% 21,009 20,518 22,272
Applications Received 22,250 1,076,606 2.1% 21,765 20,375 22,613
Temporary Workers Permits Issued 160 132,101 0.1% 218 249 796
Cases Finalized 261 146,482 0.2% 367 475 1,067
Applications Received 284 154,438 0.2% 393 411 1,116
Students Permits Issued 1,072 98,769 1.1% 1,192 730 620
Cases Finalized 1,615 133,332 1.2% 1,788 1,182 933
Applications Received 1,661 136,787 1.2% 1,933 1,188 956

Permanent Resident Application
Inventory as of April 8, 2012
Economic Family Refugees
3,347 1,229 2,197

Source: Data from International Region (NHQ) records as at April 8, 2012.
Note: All data above is in persons rather than cases. A case is comprised of an application that may include multiple applicants (persons), for example: a family.

Appendix B – Detailed Audit Criteria

Objective # 1: To assess the adequacy of the mission’s governance framework for administering the Immigration Program.

1.1 Governance and strategic direction

  • The mission has clearly defined and communicated strategic directions and strategic objectives, aligned with its mandate.
  • The mission has in place operational plans and objectives aimed at achieving its strategic objectives.

1.2 Public service values

  • Through its actions, management demonstrates that the mission’s integrity and ethical values cannot be compromised.
  • Values and ethics are promoted within the mission, documented, and clearly communicated.

1.3 Results and performance

  • Relevant information on results is gathered, used to make decisions and reported.

1.4 Accountability

  • A clear and effective organizational structure is established and documented.

Objective # 2: To assess the adequacy of the mission’s risk management processes and practices in place to support program objectives.

2.1 Risk management

  • The mission identifies and documents the risks that may preclude the achievement of objectives.
  • Management appropriately communicates risk and risk management strategies to key stakeholders.
  • Planning and resource allocations consider risk information.

Objective # 3: To assess the adequacy of the mission’s internal control framework governing administrative, financial and operational activities.

3.1 Application processing

  • Decisions are adequately documented, and required supporting documentation is maintained.
  • Designated and delegated authorities for decisions are appropriate and comply with departmental policy.
  • Appropriate controls are in place to ensure that admissibility requirements are met.

3.2 Access controls

  • Appropriate controls are in place for the management and use of CAIPS and GCMS user accounts at the mission; and
  • Appropriate controls are in place to safeguard information technology hardware at the mission.

3.3 Controlled documents

  • Roles and responsibilities are appropriate for the custodianship, safeguarding and handling of controlled documents; and
  • Adequate controls are in place for the custodianship, safeguarding and handling of controlled documents.

3.4 Cost recovery

  • There is an effective control framework in place to safeguard revenues collected in the immigration section of the mission.
    • Roles and responsibilities assigned and procedures performed are in accordance with policies; and access to cost recovery records and information is limited to authorized individuals;
    • Controls are in place to ensure accurate recording and processing of cost recovery transactions; and
    • Cost recovery records are retained, and are periodically monitored and verified.

3.5 Travel and hospitality

  • The internal control framework for managing travel and hospitality expenditures is in compliance with applicable policies and directives.

3.6 People

  • Human resource management is aligned with strategic and business planning.
  • The mission provides employees with the necessary training, tools, resources, and information to support the discharge of their responsibilities.
  • The mission has in place a system for the performance evaluation of employees.

3.7 Client-focused service

  • The mission takes measures to facilitate access to its services.
  • The mission leverages technology to enhance user services and access.
  • A formal process is in place to consider feedback and impact on short- and long-term objectives.

3.8 Learning, innovation and change management

  • Learning and development activities are used to promote innovation and change management at the mission.
  • Change management practices supported the implementation of GCMS at the mission.

Appendix C – Management Action Plan

Recommendation Risk Ranking Action Plan Responsibility Target Date
1. Bogota program management should ensure that quality assurance reviews are conducted as planned in a systematic manner, that results are disseminated to staff, and that any resulting recommendations to improve operations are implemented. High

In 2011–12 QA activities included interviewing students returning from a work/study program, and participation in the Family Class 1 headquarters-managed QA exercise in January 2012. IPM reviews all replies to Members of Parliament representatives and uses this opportunity to review language of correspondence, systemic issues, and cases that may become controversial.

There are two planned QA exercises for 2012-13.

The 2012–13 QA activities are planned for completion by the end of the 2012 calendar year. New exercises for 2013–14 will be identified in the upcoming International Region Integrated Management Plan cycle and included in annual cycles thereafter.
Bogota Completed
2. Bogota program management and the International Region should consult with legal services to confirm whether a formal agreement with the private organization used to conduct admissibility checks is required. High

This recommendation is being worked on. International Region Headquarters to consult with Legal to confirm whether a formal agreement is needed.

IR HQ December 2012
3. Bogota program management should ensure that adequate controls are in place to safeguard and account for its controlled documents inventory. Medium

This recommendation has been implemented. Technical difficulties with CKFITS have been investigated and rectified. Physical counts and records are reflective of each other and a review of controlled document inventory controls has been conducted to ensure that practices meet departmental guidelines.

Bogota Completed

Page details

Date modified: