Audit Report - Audit of the Bucharest Immigration Program

Audit Report
Internal Audit and Accountability Branch
Citizenship and Immigration Canada
June 2006

Table of Contents

• 1.0 Background
  • 1.1 Audit Objectives
  • 1.2 Audit Scope
  • 1.3 Audit Methodology
• 2.0 Conclusion
• 3.0 Observations and Recommendations
  • 3.1 Management Function
    • 3.1.1 Risk Management
    • 3.1.2 Performance Information
  • 3.2 CAIPS Management
  • 3.3 Program Integrity and Compliance
    • 3.3.1 Admissibility Framework
  • 3.4 Cost Recovery
    • 3.4.1 Verification of Receipts
    • 3.4.2 Monitoring the Cost-Recovery Function
  • 3.5 Controlled Documents
    • 3.5.1 Monitoring Spoilage of Visa Counterfoils
    • 3.5.2 Maintaining Accurate and Complete Records
  • 3.6 Human Resources Management
• Appendix A: Management Action Plan
• Appendix B: Audit Time Line

1.0 Background

The Internal Audit and Accountability Branch of Citizenship and Immigration Canada (CIC) will periodically audit the delivery of the immigration program in missions abroad. Mission audit locations are selected in consultation with the International Region (IR) and in accordance with the Branch’s Risk-Based Audit Plan.

The Bucharest visa office is a full-service centre offering immigrant and non-immigrant services. It is responsible for the delivery of immigration programs and services to three countries: Romania, Bulgaria and Moldova. The economic conditions prevailing in all three countries have generated continuing interest in immigration to Canada.

The majority of temporary resident visa and permanent residence applications come from nationals of Romania. Most temporary resident applicants are elderly parents wishing to visit their children. Quebec actively recruits immigrants in all three countries, especially Romania and Bulgaria. In 2004, the Quebec program accounted for over two-thirds of the immigrant movement.

In 2004, Bucharest issued 6,782 permanent resident visas and 87% were in the economic category. Its 2005 immigrant visa target of 6,580 was 81% achieved after 10 months. Bucharest issued 11,573 temporary resident visas in 2004 and 12,210 in the first 10 months of 2005. The number of temporary resident applicants has steadily increased: from 2002 to 2004, it increased 12%. Cost-recovery revenues in fiscal year 2004–05 were $7 million.

There are four Canada-based officers (CBO), including the immigration program manager (IPM), and 16 locally engaged staff (LES) at the Bucharest visa office. Additional employees are periodically engaged, usually during the busier summer period. Plans are under way to move the visa office to a new embassy building in a different location in mid- to late 2006.

1.1 Audit Objectives

The objectives of the audit were to assess the effectiveness of the management control framework and the degree of compliance with legislation, policies and procedures associated with the delivery of the immigration program.

1.2 Audit Scope

The audit scope included the management of the immigration functions, the Computer-Assisted Immigration Processing System (CAIPS), program integrity and compliance, cost recovery, control documents and human resources management.

1.3 Audit Methodology

The audit of the immigration program at the Bucharest mission took place between September and December 2005. It was conducted in accordance with the Government of Canada’s Policy on Internal Audits, as well as auditing standards prescribed by the Institute of Internal Auditors.

In carrying out the audit, we reviewed files and documents, observed operational activities and interviewed the CBOs and locally engaged program officers and staff. We also met with the ambassador, the management consular officer and other embassy staff with links to immigration operations.

2.0 Conclusion

We concluded that the IPM has an effective management control framework in place that is well suited to the environment of the Bucharest visa office and responsive to its changing conditions. Immigrant and non-immigrant programs were compliant with applicable legislation, policies and procedures. We identified some areas for improvement that the IPM, with the support of NHQ, can implement locally in the safeguarding of cost-recovery revenue and in control document management.

3.0 Observations and Recommendations

3.1 Management Function

The focus for this line of inquiry was on the Bucharest IPM’s activities and practices for managing operations. We conducted interviews with immigration staff at all levels, reviewed documents and reports and observed processes.

We expected to find that the roles and responsibilities facilitate the efficient and effective management of the program; that risk management practices are applied at all appropriate levels and activities; and that performance information is reported and used for decision making.

(Section Removed). The IPM spends over fifty percent of the time on operational matters and the balance on management or embassy activities. The IPM maintains responsibility for all CIC program activities and expenditures at the visa office. We found that roles and responsibilities were well defined and communicated by the IPM and understood by staff. This was evident in the immigrant case assignments to three processing teams, each led by a CBO.

The IPM attends weekly meetings with the head of mission and other program directors at the embassy, and enjoys good relations with the mission administration and with NHQ. The IPM also holds regular staff meetings and internal procedures requiring attention are documented and circulated to staff. The IPM scrutinizes the level and nature of client enquiries and ensures that they are responded to promptly.

The office accommodations for the immigration section present some disadvantages as staff are spread over three separate buildings, with limited storage and meeting areas. The move to a new embassy in mid- to late 2006 is expected to remedy this situation. In the meantime, the IPM has alerted IR-NHQ to the situation and works with staff to make the best of the current accommodations.

3.1.1 Risk Management

IR introduced its risk management strategy in 2003. The IPM’s management plan included a commitment to quality assurance activities, and the risk management program in place focused on the verification of post-secondary diplomas, work records and police certificates. A high reliance is placed on these documents for the selection of skilled workers. We found that the tools developed for quality assurance interviews and file information verification were well designed and suited to the clientele.

We observed that risk management was applied at all stages of operational delivery through the supervision of staff, clear internal procedures, clear roles and responsibilities, segregation of complementary duties, and a process for waiving interviews. Our file review for the period July 1, 2004, to June 30, 2005, confirmed that risk management practices were in place for caseload management and work distribution (for example, for conducting document verification on assessed level of risk for each case).

Overall, we concluded that appropriate risk management practices were applied at the mission.

3.1.2 Performance Information

We expected that the IPM would have sufficient performance information to manage and monitor operations. (Section Removed). Monthly reports on processing times, case intake, cases in process and final decisions were relied on to manage operations. The IPM found that the combination of CAIPS reports and NHQ statistical reports provided adequate data on immigrant and non-immigrant processing activities.

At the time of the audit, the mission had achieved 81% of its annual target for immigrant visa output, demonstrating an ability to reach this key objective by year end. Generally, processing times for permanent residents and the significant temporary resident movement were comparable to other visa offices in the geographic area. From October 2004 to September 2005, Bucharest finalized 88% of temporary resident applications within two days. Our review of the mission immigration website showed the standard coverage of processing times and other client information. The IPM has plans to enhance the website to ensure clients are provided with clear and accurate information.

We concluded that t he mission was generating and using appropriate performance information to monitor the program and adjust to workload fluctuations, and to share information on processing times with its clients and stakeholders.

3.2 CAIPS Management

CAIPS is a tool to process and monitor the caseload and is essential for supporting visa office operations. As part of our examination, we analysed decision-making statistics for cases finalized in the period July 1, 2004, to June 30, 2005. We expected that CAIPS-related equipment was properly used, staff were trained, controls over CAIPS user accounts existed, user profiles were in accordance with delegated authorities, and CAIPS assisted in processing efficiency.

We found that the CAIPS manager was (section removed) in their duties and supported by an (section removed) backup CAIPS manager and (section removed) LES assistants. Overall, the CAIPS user accounts were well controlled and decisions entered over the period we examined were in compliance with delegated authorities.

We noted some best practices using CAIPS functionality, which contributed to processing efficiency. File locator features were used extensively to allocate and monitor the caseload, particularly in the registry section. This provided a detailed way to track the cases in process at any stage.

We concluded that there is an effective control framework in place over the CAIPS management function.

3.3 Program Integrity and Compliance

The focus of this line of enquiry was the program integrity of application processing and whether statutory and policy requirements were met. We expected decisions to be transparent, consistent and well documented, with adequate verification of information, appropriate oversight and guidance of staff, and a commitment to client service.

Our file sample of 30 immigrants and 20 non-immigrant cases (finalized between July 1, 2004, and June 30, 2005) represented all types of immigration processing. We found the processing to be compliant with applicable legislation, regulations and policies. There were minor issues on the documentation of decisions, but improvements were already under way at the mission.

We found appropriate oversight and guidance of staff and a client service commitment. The IPM updated the mission’s Program Integrity Risk Identification Guide developed in 2003. This guide provides detailed guidelines to staff on internal procedures, responsibilities, documentation standards and records management. Our review of client communications showed that the mission has taken measures to improve how it serves various client groups and that it plans other initiatives to ensure the standardization of available information for clients.

We concluded that program integrity met departmental and legislative requirements.

3.3.1 Admissibility Framework

Legislation stipulates that applicants must meet security, criminality and medical requirements in order to come to Canada. We expected that the admissibility framework in place at the visa office ensured compliance with authorities and that staff were able to obtain the information required to discharge their responsibilities.

We found the IPM had a complete system of strategic partners for admissibility determination. The migration integrity officer covering Bucharest works from Vienna and medical admissibility is decided by the Vienna regional medical office.

Roles and responsibilities for admissibility screening were clear and effective. Each CBO made admissibility decisions, while the LES provided support through their knowledge of the cultural, social and financial environment. We found that all delegated authorities for security and criminality decisions and for temporary resident permits were appropriate over the review period. In addition, the mission provided information on admissibility requirements to clients on its website, through local form letters and in application kits.

We concluded that an appropriate admissibility framework was in place to ensure the availability, use and integrity of admissibility information at the visa office.

3.4 Cost Recovery

We examined the controls for the cost-recovery function at the mission by interviewing staff, reviewing files, documenting the process and workflows, and conducting tests to ensure the integrity of the cost-recovery program. We expected to find that the control framework for the cost-recovery program was adequate to ensure the proper recovery of immigration fees for services, and that duties and procedures were in compliance with the Department’s policies for cost recovery.

In general, we found that the cost-recovery function was running as intended but that there were some areas where the control framework could be strengthened. These were discussed with management, who began to improve controls while the audit team was on site.

3.4.1 Verification of Receipts

In the management of public money, verification is a function that provides assurance that all funds are recorded and accounted for. We expected the visa office to perform a systematic verification of its direct deposit receipts, used as proof of payment of immigration fees, against bank records in order to provide assurance that the fees are actually being collected. Doing so will reduce the risk of fraudulent receipts being accepted as proof of payment of immigration fees or valid receipts being submitted multiple times.

We found that the IR has no clear guidelines on how verification of direct deposit receipts should be handled at the mission level. The visa office was verifying 10% of direct deposit receipts against bank records. One reason a larger percentage was not done was due to the lack of high-speed Internet access to facilitate the work, which will be available when the visa section moves to new premises. The mission has agreements in place with specific banks in Romania and Bulgaria for residents of those countries to make immigration fee payments directly to these banks. Once the client has paid the immigration fees at the bank, the bank provides the client with a receipt which the client submits with the application as proof of payment of the immigration fees. The mission obtains a daily update on the deposits made at the banks by clients.

Recommendation 1

IR should initiate a review of the adequacy of guidance on the subject of verification of direct deposit receipts so that missions are informed of their roles and responsibilities in the matter.

Management Response

IR agrees to establish clearer guidelines for missions on reconciling deposits against services provided. Given that the losses of several years have averaged approximately $1,000 on well over $260 million collected per year, our intention is to provide instructions on conducting quality assurance testing through sampling techniques. With a reinforced monitoring of the cost-recovery function as agreed under section 3.4.2 below, we believe this will provide the mission with sound risk management practices. IR has already been in touch with the Department of Foreign Affairs and International Trade (DFAIT) to review the reconciliation guidelines, and it expects to complete these revisions by December 31, 2006.

In the longer term, we support the move to 100% reconciliation when this can be accomplished electronically as is done in Canada. We will work with CIC corporate finance, the Global Case Management System (GCMS) and DFAIT to accomplish these goals.

3.4.2 Monitoring the Cost-Recovery Function

 The control framework for the cost-recovery function includes monitoring the POS+ system and the procedures carried out by the cost-recovery clerk. This monitoring is to be carried out on a quarterly basis by the cost-recovery officer (CRO) to ensure that areas of risk are identified and compliance with departmental policies occurs. We expected to find a cost recovery monitoring file and performance of quarterly routine checks of the POS+ system.

(Section removed). The required monitoring procedures are set out in departmental manuals, specifically section 2.8.2 of the Single Officer Mission Manual (SOMM). Although we found no evidence of errors or omissions during the on-site review, the lack of monitoring increases the risk of such occurrences.

Recommendation 2

The IPM should ensure that the CRO performs the required cost-recovery monitoring procedures in compliance with departmental manuals.

Management Response

POS+ authorities are currently in accordance with the guidelines contained in section 2.8.2 of the SOMM and the first quarterly review was initiated in January 2006.

IR agrees with the need to do regular monitoring of cost-recovery procedures. The issue will be stressed during training with IPMs on matters related to cost recovery and risk assessment.

3.5 Controlled Documents

We examined the control framework for the controlled document function at the Bucharest visa office. We interviewed staff, examined files, documented processes and workflows, and conducted tests to ensure the integrity of the controlled document program. We expected to find that the control framework for the controlled document program was adequate to ensure the safeguarding of controlled assets and that duties and procedures were in compliance with the Department’s policies for controlled documents.

We found that some processes for control document management were effective, but we also identified areas where the control framework could be strengthened. These areas can be addressed by the IPM and the forms control officer (FCO) with the support of NHQ.

3.5.1 Monitoring Spoilage of Visa Counterfoils

Missions must take measures to ensure that controlled forms are protected. We examined the use of controlled forms at Bucharest and found, for the third quarter of 2005, a spoilage rate of 14.4% (133 forms) for the visa counterfoil, IMM 1346 forms. Higher than normal spoilage levels result in more costs for the waste incurred. It also creates a risk to be managed, since spoiled visas have to be accounted for in a secure way. We did not find a high spoilage rate for the immigration security seal.

The spoilage was likely attributable to the lack of a climate-controlled environment for the controlled forms printer in the non-immigrant unit as most spoilage occurred there. Discussions with mission management revealed that the spoilage was not restricted to the third quarter. The IPM and IR informed us that a new system to replace the current visa printing process would be implemented in early 2006, and it is expected to address the spoilage deficiency of the current system. Because of this and the anticipated move to new premises, the mission had not adopted any other interim measures to reduce spoilage prior to our audit beyond seeking technical examination of the printers.

Recommendation 3

The IPM should adopt interim visa printing procedures aimed at reducing spoilage, and monitor their implementation to ensure effectiveness until the new printing system is in place.

Management Response

Since the departure of the audit team and the installation of the new printers, a system to keep the counterfoils in a cooler with a plastic ice block was instituted and was found to reduce the amount of spoilage. The printers arrived in February 2006 and have now been installed.

Recommendation 4

IR-NHQ should ensure that the new visa printing system to be implemented will address the spoilage deficiency of the current system.

Management Response

The new printers were selected in part to ensure a reduction in visa spoilage. Based on initial feedback from missions where the new system is installed, the spoilage rate has been reduced substantially. A more formal assessment of the impact of the new visa printers will be done once the implementation is completed.

3.5.2 Maintaining Accurate and Complete Records

The FCO is required to verify control document shipments, maintain control records to ensure all the documents are accounted for and prepare a quarterly inventory report. We expected to find proper completion of inventory reports and control records.

Visa offices use registers and logs to track visa counterfoils and immigration seals from the time the forms are received to the time they are used, voided or destroyed. We found that:

• seal serial numbers for immigrant processing were not listed in the daily control register. This register tracks the number of visas used or spoiled and ensures that it equals the number of seals used or spoiled;
• a sequential order of serial numbers in the non-immigrant visa counterfoil log was not maintained. Keeping the numerical sequence ensures control in tracking use; and
• daily reconciliation was not carried out on the immigrant visas used or spoiled versus seals used or spoiled. However, it was done weekly for the non-immigrant visas and seals. This reconciliation is a monitoring tool to ensure errors or omissions are identified promptly.

We conducted a reconciliation of the records covering the period October 3 to November 1, 2005, and were able to conclude that visas used or spoiled could be traced to the appropriate seals used or spoiled.

We reviewed Bucharest’s quarterly inventory reports covering the period October 2004 to September 2005 and conducted an inventory of the control documents on hand. We found some discrepancies related to how spoiled documents and shipments were recorded for inventory purposes. These were:

• Spoiled documents were counted correctly as destroyed inventory, but also counted as used inventory, thus understating the inventory; and
• When shipments were verified, the documents removed as part of the quality assurance print run were recorded as inventory received, overstating the inventory on hand.

The discrepancies were discussed with the FCO and NHQ Forms Control to ensure that the necessary adjustments would appear on the inventory reports. We also found that the four inventory reports we reviewed were submitted beyond the due date by three to 25 days, a point that NHQ Forms Control had noted.

(Section removed). The NHQ responsibility for guidance is shared between IR and Information Management. Information Management issues the Forms Management Guide and IR has issued the Single Officer Mission Manual. There is no cross reference between these sources so FCOs may not consult both. We learned that Information Management will issue an updated version of the Forms Management Guide on the CIC intranet site in March 2006. In addition, IR informed us that they have a longer term project under way to update the control document guidance in the Single Officer Mission Manual.

Recommendation 5

The FCO should maintain accurate records to properly monitor and report on control document activities and carry out the daily reconciliation control of matching visas to security seals.

Management Response

(Section removed). The daily reconciliation of visas and seals is now in place with the visa log initialed at the end of each working day. We look forward to the arrival of the new Forms Management Guide in March 2006.

Recommendation 6

IR-NHQ and Information Management should continue to collaborate so that missions abroad are well informed on policies and practices related to the control document function.

Management Response

IR will continue to ensure the necessary consultation and will clarify guidance on the control document management with FCOs. A new guide for IR forms management is being written for IR FCOs and should be released in the next few months. An additional officer has just been assigned in IR to finalize this drafting. The guide will be available on CIC Explore on the IR website and an all-mission message will be sent as soon as it is available.

Information Management will ensure the necessary consultation and will clarify guidance on the control document management with FCOs. It will continue to collaborate with IR to ensure that policies and practices related to the control document function are better informed. It will work with IR on the guidance with reporting requirements. An updated version of the Forms Management Program was released in February 2006 on CIC Explore and NHQ sent a copy of the chapter to each mission FCO.

3.6 Human Resources Management

Our review of human resources management covered both CBOs and LES. We expected to find that staff training needs were addressed and that annual performance reviews were conducted. We also expected that LES met the security requirements for their positions and were aware of the Code of Conduct and the Conflict of Interest Guidelines. We conducted interviews with immigration staff and mission administration officials, and examined files.

We found the IPM was well informed on his human resources responsibilities. The IPM met with each LES to review performance expectations and ensured that each LES was aware of the Code of Conduct and the Conflict of Interest Guidelines. The files we reviewed were up to date and the mission has a set cycle for performance reviews for LES. The training needs of all staff are identified as part of the performance review process and addressed through various training methods. Our file review confirmed that the LES had undergone a security clearance in the past five years. We also found that LES turnover in the immigration program was very low.

We concluded that human resources practices in the immigration program were sound and staff were suitably trained to carry out their responsibilities.

Appendix A: Management Action Plan

Appendix B: Audit Time Line

Audit planning — September 2005

Site visit to Bucharest mission — October 31 to November 10, 2005

Clearance draft no. 1 to IPM and IR for comments — February 2, 2006

Clearance draft no. 2 to IPM and IR for comments — March 17, 2006

Management action plan finalized — May 2006

Report approved by Audit Committee — July 2006