Audit of the Caracas Immigration Program

Audit Report
Internal Audit and Accountability Branch
Citizenship and Immigration Canada
September 2007

Table of Contents

• 1.0 Introduction
  • 1.1 Background
  • 1.2 Audit Objectives
  • 1.3 Audit Scope
  • 1.4 Audit Methodology
• 2.0 Audit Conclusion
• 3.0 Observations and Recommendations
  • 3.1 Management Control Framework—Management Function
  • 3.2 Compliance of the Immigration Program
  • 3.3 Internal Control Framework—CAIPS Management
  • 3.4 Internal Control Framework—Controlled Documents
  • 3.5 Internal Control Framework—Cost Recovery
• Appendix A: Management Action Plan
• Appendix B: Audit Time Line

1.0 Introduction

The Citizenship and Immigration Risk-Based Audit Plan for 2006–2009 includes the conduct of three mission audits a year. To meet this commitment, the Caracas immigration program was selected in consultation with the International Region at Citizenship and Immigration Canada (CIC) national headquarters. The audit was based on an assessment of the mission’s operations in relation to other offices. The on-site field work was done from September 26 to October 3, 2006.

1.1 Background

The Caracas mission is a full-service visa office responsible for the delivery of immigration program services to Venezuela, Aruba, Bonaire and Curacao. The Caracas mission processes applications for both permanent and temporary residence to Canada. The majority of permanent resident cases are in the economic class while the majority of the temporary resident cases are for visitor visas.

In 2005, the Caracas mission exceeded its target and issued 866 permanent resident visas, mostly in the economic category: skilled workers, business class and provincial nominees. In addition, the mission issued 326 student permits, 139 temporary worker visas and 8,063 temporary resident visas. The Caracas mission’s 2006 permanent resident visa target is 750. By September 1 of that year, the mission had already met 89% of its target, having issued 669 permanent resident visas, and was well on track to meet its full target.

The number of immigrant and non-immigrant visas issued by the Caracas mission has increased significantly since 2003 (see Table 1). Overall, there was a 32% increase in immigrant visas and a 125% increase in non-immigrant visas over the period 2003 to 2005.

In 2005, the Caracas mission had one Canada-based officer (CBO) and four permanent locally engaged staff (LES) for the delivery of the immigration program. The mission also hired temporary LES during the year to address work fluctuations in peak processing periods.

1.2 Audit Objectives

The audit objectives were to assess:

• The management framework in place at the mission to administer the immigration program;
• The degree of compliance of practices and procedures with applicable legislation and policies associated with the delivery of the immigration program; and
• The internal control framework in place to manage the operational delivery and administer the immigration program at the mission.

1.3 Audit Scope

The audit only involved operations at the Caracas mission. It covered all significant aspects of CIC operations at the Caracas mission, including the full range of immigrant and non-immigrant program activities, with associated financial and administrative components typically found in a full-service centre. The audit examined the activities of the mission from July 1, 2005, to October 3, 2006, the end of the on-site examination period.

1.4 Audit Criteria

The criteria used in the audit are based on legislation and CIC policies and procedures. The audit expected to find that:

• For the management framework used to administer the program provided for the effective delivery of services at the mission:
  • roles and responsibilities facilitated the efficient and effective management of the immigration program;
  • human resources were managed appropriately;
  • risk management and quality assurance reviews were applied; and
  • performance information was captured and used in decision making.
• For immigrant and non-immigrant case processing:
  • decisions were adequately documented;
  • processes and procedures in place at the mission were in compliance with the applicable legislation and policies;
  • all decisions made complied with delegated authority; and
  • practices and procedures were in place to ensure that adequate admissibility information was available and used at the mission level, and admissibility decisions were made by authorized personnel and documented.
• For the mission’s internal control framework, in place to manage the operational delivery and administer the immigration program at the mission:
  • controls were in place to ensure the safeguarding of CAIPS (Computer-Assisted Immigration Processing System) assets;
  • access controls for the management of CAIPS were adequate to ensure appropriate use of the system;
  • appropriate roles and responsibilities were in place for controlled documents;
  • an effective control framework was in place for the custodianship, safeguarding and control of controlled documents at the mission;
  • roles, responsibilities and procedures were in compliance with policies for cost recovery;
  • adequate controls over the cost-recovery process were in place; and
  • an adequate monitoring regime was in place to ensure cost-recovery controls were working and that funds collected were appropriate and properly accounted for.

1.5 Audit Methodology

There were three lines of enquiry: management control framework, compliance of the immigration program and the internal control framework.

The audit performed audit tests for each line of enquiry by reviewing files and documentation and observing operational activities. As part of the audit, interviews were also conducted with the CBO responsible for the delivery of the immigration program, locally engaged immigration program officers and staff, and other embassy staff with links to immigration operations.

The audit of the compliance of the immigration program involved the examination of a random sample of 20 immigrant and 20 non-immigrant cases for the period July 1, 2005, to June 30, 2006, to assess compliance with legislation, regulations and policy requirements.

The controls in place over CAIPS, the controlled documents and cost recovery were examined as part of the audit of the internal control framework. The audit also examined the decisions in permanent resident and temporary resident cases finalized over the period July 1, 2005, to June 30, 2006, to test compliance with delegated authorities. And finally, it examined samples of controlled documents inventory transactions and cost-recovery revenue transactions to assess compliance with applicable legislation, policies and procedures.

The audit was conducted in accordance with the Government of Canada’s Policy on Internal Audit and the auditing standards set out by the Institute of Internal Auditors.

2.0 Audit Conclusion

Overall, the audit found weaknesses in the control framework in place to support the administration and operation of the immigration program. While immigrant and non-immigrant decisions complied with legislation, the controls in place to ensure program integrity were not occurring as expected. It also found that the internal controls in place were not functioning as intended and that there were areas for improvement to safeguard CIC assets. The audit makes recommendations to improve the controls in place.

3.0 Observations and Recommendations

3.1 Management Control Framework — Management Function

Overall, the audit found that staff roles and responsibilities were clearly defined and communicated and that staff were informed of changes to procedures in a timely manner. It also found that human resource practices complied with departmental expectations. It was noted that the Immigration Program Manager (IPM) had a positive working relationship with the Head of Mission. However, it observed that the mission had not been systematic in undertaking quality assurance reviews and that it could improve the management of its performance by employing tools that it has at its disposal.

3.1.1 Governance

The mission prepares an annual plan, in compliance with the Department’s planning process. This document establishes the office’s objectives and is the main vehicle for resource allocation requests. It is therefore the foundation for the mission’s work plans for the coming year.

The audit found that staff roles and responsibilities in the immigration section were clearly defined and were generally in accordance with departmental policy. The mission has a Designated Immigration Officer (DIO) and three program assistants: two who review cases and one who is responsible for cost recovery and reception duties. Staff were knowledgeable about immigration legislation, policies and procedures and their application, and about recent changes to policies and procedures, including the new requirements associated with the simplified application process for certain categories of permanent residents.

Overall, there has been little turnover in the immigration section since the IPM arrived in the summer of 2004, although the audit noted that locally engaged staff had little experience with CIC, which may account for the disequilibrium in work distribution at the mission. This is discussed further in the report (see 3.1.4: Performance Information). The mission also hires temporary local staff to address work fluctuations in peak processing periods in the summer.

3.1.2 Human Resources Management

Overall, the local staff employed by the immigration section were very knowledgeable and worked well as a team. The IPM has an open door policy and consults staff on a regular basis about cases and office policies and procedures.

The audit found that the performance appraisals and security clearances of the LES and CBO were up to date. The audit noted that staff were provided French-language training and training on immigration-related work processes.

Although the audit found that there were no formal training plans for the immigration staff, it found no deficiencies that could or should be addressed by future training. That being said, training plans should be created not only to allow management to plan for future requirements in a more strategic manner, but also to document the training needs of staff for future management to take into consideration.

3.1.3 Quality Assurance

The mission does not manage risk in a systematic manner. Rather, risk management is performed in an informal way during the processing of cases. The IPM relies on the knowledge of the local officer and program assistants with regard to the local conditions and language in the processing of cases.

Quality assurance refers to a set of ongoing, planned and systematic activities designed to provide adequate confidence that a particular system or program satisfies given requirements for quality. Quality assurance looks at a particular group of cases to gather information that validates or refines current knowledge. The mission undertook two ad hoc quality assurance reviews over the last two years on permanent and temporary resident files. The audit did not find evidence that these reviews were planned systematically or that they focused on the high-risk areas of the two programs. In spite of this, the reviews identified a few areas for improvement in the processing of cases.

Recommendation 1

The mission must incorporate a program of ongoing, planned and systematic quality assurance reviews, focusing on areas of high risk in the immigration program, in order to assure management of the quality of the program and provide input into future program improvement initiatives.

Management Response

As of April 1, 2007, the mission will conduct random quality assurance checks. The IPM will verify three times a year (every four months) 10 immigrant files (all types) for which visas have been issued or refused, 20 visitor files, 10 student files, 10 worker files and five travel document applications. These applications will be randomly selected and verified for the quality of the decisions, the documentation of the decisions (notes and supporting documents), the quality and timeliness of processing, and cost-recovery controls. The results will be documented.

3.1.4 Performance Information

The mission manually tracks its performance against the target for immigration visas every day. It does not use the functions in CAIPS to manage workload or monitor performance.

The audit also observed that the CAIPS command mode is not used to assign cases or keep track of case processing. Staff at the mission have only a basic understanding of CAIPS and, consequently, it is not being used as a management tool. The CAIPS command mode function is a powerful tool that managers have at their disposal to manage case processing at the mission level. It can be used to assign cases and produce reports on aspects of case processing productivity.

A compensating control in place at the mission is the high involvement of the CBO in case processing. Our review found that over the period July 1, 2005, to June 30, 2006, the only CBO at the office was responsible for the majority of decisions for both streams of the immigration program, making 87% and 70% of the final decisions for permanent and temporary residence applications respectively and virtually all (96%) of the security decisions at the mission. The remainder of the security decisions were made by temporary duty staff sent to the mission to replace the officer during periods of leave. Without the benefit of CAIPS use in this manner, however, there is a risk that the management of the case workload could be more inefficient and that the mission could be missing value-added performance information.

Recommendation 2

The mission must work toward developing capabilities to better utilize performance management tools in order to better manage program resources.

Management Response

Management agrees that command mode is an important management tool, even in a small office. Management’s knowledge of command mode is, however, limited. A request for a course on CAIPS management and command mode was made to CIC headquarters last year, but was not accepted because of the then imminent deployment of the Global Case Management System (GCMS). With the delay in the implementation of GCMS, it would be useful if command mode training and CAIPS manager training could be offered to officers in small missions.

3.2 Compliance of the Immigration Program

The audit examined the program integrity of application processing and whether statutory and policy requirements were met. To this end, it reviewed the documentation of policies and procedures, conducted interviews and reviewed a random sample of case files comprised of applications for permanent and temporary residence.

Overall, the audit found that immigrant and non-immigrant decisions were in compliance with departmental policies. However, it also found that the mission was not in compliance with a number of procedural processing steps with respect to documentation procedures that are expected of missions. These issues are discussed in the following sections.

3.2.1 Immigrant Program—Permanent Residents

The immigrant program at the Caracas mission consists of family class and economic immigrant applications. The audit reviewed a sample of permanent resident cases: skilled worker, family and business classes.

Overall, the audit found that the immigrant program at the Caracas mission was very efficient in processing cases and all staff had good knowledge of the policies, procedures and legislation within which they assessed and processed cases. However, it found issues with respect to the documentation of processes and procedures in support of case decisions at the mission. In several cases (13 out of 20), the audit did not find either interview notes or, if the interview was waived, an explanation for waiving the interview. It also found that in 70% of cases (14 out of 20), the reasons for the decisions had not been entered in the notes. Lastly, the audit found that in other cases (8 out of 20), documents had not been retained or had not been sufficiently detailed in CAIPS notes.

The overseas processing manual states that officers should ensure that case notes not only document any decisions taken during case evaluation, but also clearly reflect the process the officer followed in reaching those decisions. The manual also sets out guidance on document retention and notes that while offices must ensure efficient space management, documents essential to the decision-making process should be retained. However, they may be disposed of, with certain exceptions, provided they are sufficiently documented in CAIPS notes.

The audit found that the mission did not provide adequate notes in CAIPS. In one instance, it found evidence that inadequate CAIPS notes presented certain challenges to officers at national headquarters who required more information from the mission in order to take the necessary action to process the case. For this reason, good case notes are of critical importance as a record of what transpired at an interview or the processing steps followed to reach a decision. Case notes are used to prepare refusal letters, to respond to enquiries, or as a record in the case of an appeal or a court challenge. Lastly, staff in other offices in the Department have direct access to individual electronic files and may call upon this record for various reasons. These issues are discussed further in the next section.

3.2.2 Non-Immigrant Program—Temporary Residents

The non-immigrant program at the Caracas mission is comprised of student, temporary worker and temporary resident processing. The audit reviewed a sample of each non-immigrant category as part of our case file review.

Overall, the audit found that the Caracas office provided very quick processing of cases. The office has a better than average processing time in the Americas and even with a significant increase in case volume, these processing times have not been affected. However, it found that the mission did not document properly the processes and procedures in support of case decisions.

The audit found that the same issues present in the immigrant program were also present in the non-immigrant program. In most cases (18 out of 20), a reason for the decision had not been documented. Moreover, many of these cases (14 out of 20) had no notes at all. While discussions with staff revealed that they knew the requirements of the policy with respect to processing steps and required documentation, it found that most cases (19 out of 20) either did not have copies of supporting documents or a notation in case notes of what was seen in order to render a decision.

The overseas processing manual does not make a distinction between immigrant and non-immigrant cases with respect to documentation of the process and the retention of supporting documentation.

Recommendation 3

The mission must ensure that processes, procedures and decisions for immigrant and non-immigrant cases are documented in a manner that complies with policies.

Management Response

For immigrant cases: From now on, more extensive notes will be put in CAIPS and, in cases of waived interviews, we will indicate why the interviews were waived.

For non-immigrant cases: At this time, CAIPS notes are written only on borderline or refused cases. Implementing this recommendation for all cases is difficult at this time because of the large volume of applications received in relation to the small number of officers (one CBO and one DIO). With the arrival of a second CBO this summer, officers will input notes for all cases, and this will be done as of September 1, 2007. At the same time, documents taken into consideration in the study of an application will be retained or, when they are not kept (because of the thin-file policy), notes will be put in CAIPS to the effect that the documents have been seen. Efforts will be made to implement this recommendation as soon as possible.

The current IPM, who is leaving, will ensure that this is brought to the attention of the new IPM.

3.2.3 Admissibility

Immigration legislation stipulates that applicants must meet security, criminality and medical requirements in order to come to Canada. Missions should have an admissibility framework in place that complies with authorities and provides staff with the information required to discharge their responsibilities.

Overall, the audit found that admissibility activities at the mission complied with legislation and CIC policies and procedures. The roles and responsibilities for admissibility screening were clear. The CBO made admissibility decisions, while the LES provided support through their knowledge of the cultural, social and financial environment. Key strategic partners in the admissibility network were also established and were functioning together as intended.

3.3 Internal Control Framework—CAIPS Management

CAIPS is the main system used to facilitate immigration work in visa offices abroad. Interviews were conducted as part of the examination, user profiles were reviewed, mission facilities were observed and decision-making statistics were analysed for cases finalized during the period July 1, 2005, to June 30, 2006.

Overall, the audit found that adequate controls were in place to safeguard CAIPS assets. However, the audit also found that access controls were not in place with respect to CAIPS user profiles. These findings are discussed in the following sections in greater detail.

3.3.1 CAIPS Assets

The audit found that system back-ups were being done on a weekly basis and the back-up tapes were securely stored in the filing cabinet when not in use. It found that access to the CAIPS room and the server room, which houses the main CAIPS terminal, was restricted. Moreover, regularly scheduled maintenance was occurring as required.

The combination of these procedures reduces the risk of a system interruption or failure. Consequently, the audit concluded that the controls in place complied with policies and ensured that CAIPS assets were safeguarded.

3.3.2 Access Controls

As part of the audit, the list of CAIPS profiles at the mission was reviewed. It found that accounts of former staff had not been systematically deleted, that some staff had authority levels that exceeded their delegated authority, and that some staff had access to certain functions which they should not have had access to. These issues increase the risk of unauthorized access and inappropriate use of the system. To test the authority levels, the audit reviewed the decisions of all cases finalized between July 1, 2005, and June 30, 2006. It found three instances where one individual rendered security decisions without having the delegated authority. All three decisions were rendered within a short time period of time. The mission was advised of these issues while the audit team was on site, and adjustments to user profiles were made to ensure compliance with departmental policies.

The audit found that user profiles were not reviewed on a periodic basis nor was a list of old user profiles or charge-out tables kept to ensure there was a record of CAIPS users at the mission for accountability purposes. If the CAIPS profiles had been reviewed as per departmental policy, these issues would likely have been prevented.

Recommendation 4

The mission must ensure that adequate paper records are maintained and that periodic reviews of CAIPS profiles be performed to ensure the appropriateness of access at the mission.

Management Response

The CAIPS profiles of former staff have been deleted. The mission will ensure that this procedure is maintained and will periodically review the CAIPS profiles and keep a record of charge-out tables.

3.4 Internal Control Framework—Controlled Documents

Controlled documents are official documents used by CIC. In the mission, these are the forms used to produce official government visas, which permit access into Canada by certain foreign nationals and therefore require a higher level of security than other documents.

Overall, the audit found weaknesses in the controls over controlled documents at the mission. Departmental policies emphasize the important role that proper systems and internal controls play in the safeguarding of immigration counterfoils and seals. Specifically, the audit noted that there were some weaknesses in the practices and procedures of the mission. It found some discrepancies in the current inventory of seals and counterfoils used. These weaknesses are discussed in more detail in the following sections of the report.

3.4.1 Roles and Responsibilities

A Forms Control Officer had been designated at the mission and was aware of his responsibilities. However, the audit found that some responsibilities with respect to the use of controlled forms in the immigration process had been assigned to locally engaged staff when they should not have been. The mission was informed of these irregularities with policies and it corrected the practice while the audit team was still on site.

3.4.2 Control Framework

3.4.2.1 Inventory Logs for Controlled Documents

As stated earlier, controlled documents require a higher level of security than other documents in use at missions. The audit found that the mission maintained a one-week supply of its immigration seals in working storage, with the bulk being stored in the CAIPS server room in a Chubb safe. Subsequent to our on-site examination, the bulk of the seals were transferred to the mission’s deep storage. We also found that the mission did not maintain adequate logs of the controlled documents kept in either deep or working storage. Departmental guidelines recommend maintaining logs of inventory to track the movement of these documents until the time of issuance when they will be recorded as used. In the absence of logs listing the inventory of controlled documents, the mission will be unable to determine where documents are located or, if some go missing, which ones have been lost.

Recommendation 5

The mission must ensure that its inventory controls in place for deep and working storage comply with departmental policy by ensuring that controlled documents are securely stored and accurately tracked.

Management Response

The mission now has a log for controlled documents kept in deep storage and another for those in working storage. Both are kept up to date.

3.4.2.2 Discrepancy in Inventory of Seals and Counterfoils

Upon arrival, the audit noted that the mission had a discrepancy in the records of its inventory of seals and counterfoils. The mission could not account for 11 seals and they had three more counterfoils than they should have had. At the time of our visit, this discrepancy had not been reported to National Headquarters Forms Control.

During the on-site testing of the mission’s inventory of controlled documents, the audit found that there was indeed a discrepancy, but that there were 18 seals missing and a surplus of 11 counterfoils rather than the numbers reported by the mission. It noted that the mission was improperly reporting spoiled forms and it found errors in the control register. The mission has expanded its review of seals and counterfoils used in the past two years to determine why this discrepancy has occurred. Our testing in this area found that the discrepancy had likely occurred because inadequate records were being kept as opposed to the documents being lost.

Recommendation 6

The mission must continue its inventory review of seals and counterfoils and report the findings to national headquarters upon completion. It must ensure that spoiled forms are properly reported and that inventory is recorded in the control register correctly.

Management Response

The mission has undertaken two inventory reviews of seals and counterfoils since the fall. It has reported the findings of the first inventory review in our quarterly report (form IMM-5392, third quarter, dated October 2, 2006) to the forms management officer at national headquarters. The report indicates that the mission was missing 18 seals and had a surplus of 11 visas. A second review conducted a few weeks ago showed the same results. Now that we have established a solid base, we will continue to record all used and spoiled seals and visas to ensure a better control. Any discrepancy will be properly reported to CIC headquarters.

3.5 Internal Control Framework—Cost Recovery

The Caracas mission accepts certified cheques in bolivars and Canadian dollars as payment for immigration fees and services. Cost-recovery revenue at the mission totaled approximately $1.2 million in fiscal year 2005–2006. The audit examined the controls for the cost-recovery function at the mission by interviewing staff, reviewing files, documenting the process and work flows, and conducting tests to ensure the integrity of the cost-recovery program.

Overall, the audit found that the mission had put in place a good system to safeguard cost-recovery revenues. It found that staff roles and responsibilities were in compliance with departmental policies and procedures. The audit found some areas where improvements could be made to further strengthen the control framework in place for cost recovery. These are discussed in more detail in the following sections.

3.5.1 Roles and Responsibilities

The audit found that the roles and responsibilities for cost recovery were clearly articulated and understood. The audit tests confirmed that the cost-recovery staff demonstrated sound knowledge and practices in safeguarding revenues collected at the mission.

3.5.2 Internal Controls

The audit found that the Cost Recovery Clerk (CRC) was provided with a separate office and a POS+ terminal, which enabled access to be restricted and made secure storage and accounting of daily receipts possible. However, immigration staff also accessed this area as the CRC also performed reception area duties. The practice at the mission of accepting bolivars only in the form of certified cheques is a good compensating control for the lack of restriction to this area. The CRC was also responsible for maintaining the cost recovery file which was appropriately secured and stored.

An examination of POS+ user profiles and the chart of immigration fees revealed some errors. Errors in user profiles and immigration fees in the system compromise the security of the system and allow for the potential of unauthorized access and use of the system in addition to potentially collecting incorrect fees. These issues were discussed with the mission and addressed while the audit staff was still on site. They are discussed in the next section on monitoring.

3.5.3 Cost-Recovery Monitoring

The Single Officer Mission Manual (SOMM) and POS+ 2000 Manual provide guidance on establishing adequate internal controls to ensure that funds collected are appropriate, properly accounted for and safeguarded while in the immigration section. The audit expected to find that immigration monitoring of the cost-recovery function, including periodic review of the POS+ system, was occurring as outlined in the policies.

The audit found that immigration monitoring of the cost-recovery function was not taking place at the mission. The monitoring includes reviewing the cost-recovery file to ensure that processes and procedures are followed, reviewing POS+ 2000 user profiles and fees on a periodic basis, performing POS+ system maintenance and archiving data. However, our testing of cost recovery revealed no errors or omissions in the period examined, in spite of the lack of periodic monitoring by the mission.

The absence of monitoring increases the risk that cost-recovery funds may not be collected by the immigration section. Periodic monitoring of procedures ensures compliance with policies and provides mission management assurance that the office is safeguarding immigration funds. Furthermore, by not performing the required system maintenance, the office increases the risk that the POS+ system may experience a system failure, during which time the mission would lose processing capacity.

Recommendation 7

The mission must periodically monitor the cost-recovery function and perform POS+ system maintenance as directed in the SOM and POS+ 2000 manuals. To facilitate this, the mission must ensure that cost-recovery files are adequately maintained and securely stored.

Management Response

POS+ user profiles were reviewed during the audit and corrected for level of authority. From now on, fees and user profiles will be reviewed periodically.

The mission has also requested that a lock be put on the cashier’s door to ensure that the cost-recovery files are securely stored.

Appendix A: Management Action Plan

Appendix B: Audit Time Line

Audit planning — July 2006

Site visit to Seoul mission — September 26 – October 3, 2006

Clearance draft to IPM and IR for comments — March 19, 2007

Management action plan finalized — April 26, 2007

Report approved by Audit Committee — September 14, 2007