Audit of NHQ Monitoring and Oversight of CIC Immigration Controlled Forms

Audit Report
Internal Audit and Accountability Branch
Citizenship and Immigration Canada
June 2009

Table of Contents

• Executive summary
• 1.0 Introduction
  • 1.1 General
  • 1.2 Background
    • 1.2.1 Immigration controlled forms
    • 1.2.2 Process overview
    • 1.2.3 Roles and responsibilities at NHQ
    • 1.2.4 Previous audit activity
    • 1.2.5 Environmental context
  • 1.3 Audit objective
  • 1.4 Audit criteria
  • 1.5 Audit scope
  • 1.6 Audit methodology
• 2.0 Audit conclusion
• 3.0 Observations and recommendations
  • 3.1 Governance processes
    • 3.1.1 Governance and accountability
    • 3.1.2 Monitoring
  • 3.2 Risk management
  • 3.3 Stewardship – internal control
• Appendix A – Audit Criteria
• Appendix B – Controlled Forms Process Overview
• Appendix C – Roles and Responsibilities
• Appendix D – Management Action Plan
• Appendix E – Audit Timeline

List of Acronyms

Executive Summary

The Risk–Based Audit Plan 2007–08 of Citizenship and Immigration Canada’s (CIC’s) Internal Audit and Accountability Branch (IAA) included an audit of National Headquarters (NHQ) monitoring and oversight of immigration controlled forms. Previous audits of CIC inland offices and offices abroad have raised issues in the area of controlled forms. This audit focussed on the management of the process at NHQ. The on–site fieldwork was conducted between April and June 2008.

The audit was conducted to be in compliance with the Government of Canada’s Policy on Internal Audit as well as with auditing standards set out by the Institute of Internal Auditors.

Immigration controlled forms are official documents that, when duly completed, confer resident status on the individual to whom the document is issued, authorizing that individual to enter and/or remain in Canada. CIC has determined that these forms may be particularly vulnerable to theft and misuse because of the risk that they can be used to gain unauthorized entry into Canada.

The objective of the audit was to assess the effectiveness of policies and procedures for NHQ monitoring and oversight of controlled forms and the related management framework. The audit scope comprised three lines of enquiry: governance, risk management and stewardship. The audit was limited to NHQ activities.

The audit concludes that the procedures for the ordering and supply of controlled forms are effective. However, the audit has noted gaps in governance with respect to how accountability for monitoring and oversight of controlled forms is defined and exercised, as well as gaps in the control process relating to the monitoring of reports from inland and overseas CIC offices on the usage and inventory reconciliation of these documents. Thus, NHQ monitoring and oversight of controlled forms are not effective because NHQ cannot draw overall conclusions as to the safeguarding and stewardship of these documents.

The fundamental issue regarding accountability is the accountable ownership of controlled forms. This was not clear during the audit. Defining the owner and making that position accountable for the control framework for NHQ monitoring and oversight would provide a focus that would give impetus to rapid resolution of issues in this important and sensitive area. The audit also fully recognizes that, ultimately, the field offices must ensure that tight control over blank forms is maintained at all times.

The key recommendations of the audit are as follows:

• The Department should clearly define accountabilities for NHQ monitoring and oversight, as well as the communication protocols. The ownership of controlled forms should be clarified and policies, tools and procedures updated and strengthened with respect to stewardship of these forms.
• Local management attestation should be introduced on the quarterly inventory reports to reinforce local accountability.
• Risk assessment on controlled documents should be updated.
• The monitoring of quarterly inventory reports from all users and the reporting of their status should be strengthened. This includes developing a strategy for risk–based monitoring and appropriate training of NHQ staff involved in monitoring and oversight.
• A global reconciliation procedure should be introduced with regard to production, usage, destruction and inventories of controlled forms.

The report provides detailed observations and recommendations. Management responses and action plan along with proposed implementation dates for the recommendations are included.

1.0 Introduction

1.1 General

The Risk–Based Audit Plan 2007–08 of Citizenship and Immigration Canada’s (CIC’s) Internal Audit and Accountability Branch (IAA) included an audit of National Headquarters (NHQ) monitoring and oversight of immigration controlled forms. Previous audits of CIC inland offices and offices abroad have raised issues in the area of controlled forms. This audit focussed on the management of the process at NHQ. The on–site fieldwork was conducted between April and June 2008.

1.2 Background

1.2.1 Immigration controlled forms

Immigration controlled forms are official documents that, when duly completed, confer resident status on the individual to whom the document is issued, authorizing that individual to enter and/or remain in Canada. The status conferred may be a permanent resident status or a temporary resident status. Hence, the forms, when duly completed, represent evidence of a positive departmental decision with respect to immigration processing.

CIC has determined that these forms may be vulnerable to theft and misuse. There are risks that blank controlled forms can be used fraudulently by individuals to make false representations about their status in Canada to gain unauthorized entry into the country. Unauthorized use of such forms can adversely affect CIC’s reputation. For control purposes, all of these forms have unique serial numbers and specialized security features.

There are seven immigration controlled forms currently in use. Two of the forms, exclusively used for immigration processing outside Canada in CIC offices abroad, are the visa counterfoil (IMM1346) and the immigration seal (IMMSeal). These forms are applied together in the passport of an individual travelling to Canada to indicate their resident status. The IMM 1442 is the immigration controlled form used for in–Canada processing in CIC inland offices (including Case Processing Centres) and Canada Border Service Agency (CBSA) ports of entry (POEs) and is referred to as the generic document since it can be used for various types of temporary resident status (visitor, student, temporary worker, etc.). The four other controlled forms—Visitor Record (IMM1097B), Work Permit (IMM1102B), Study Permit (IMM1208B) and Permit to Come into or Remain in Canada (IMM1263B)—are backup forms for IMM1442 that can be manually issued by immigration officers should the information systems become unavailable.

During the 2007–08 fiscal year, approximately 1.3 million visa counterfoils and immigration seals were sent to CIC offices abroad and approximately 619,000 IMM1442 generic forms were sent to CIC inland offices and CBSA POEs.

1.2.2 Process overview

CIC inland offices order the blank controlled forms directly from the forms warehouse. CIC offices abroad and CBSA POEs order the forms via the Information Management Directorate (IMD) at NHQ. The forms are shipped directly from the warehouse, which is managed by a contractor, to the offices through designated channels. Forms destined to offices abroad are sent to national headquarters of the Department of Foreign Affairs and International Trade (DFAIT) to be shipped via the diplomatic bag service. Offices are required to submit a quarterly inventory report to IMD, accounting for their use of forms and indicating the inventories of blank forms on hand, which should be confirmed by a physical count.

The process overview is provided in a graphic form in Appendix B.

1.2.3 Roles and responsibilities at NHQ

At NHQ, there are three main branches/directorates that provide functional guidance and oversight over controlled forms. IMD, which is part of the Information Management and Technologies Branch (IMTB), looks after the supply of forms and receives the quarterly inventory reports on forms usage. IMD has issued policy guidance on the control and management of these forms through the Service and Administration Manual, Chapter 6: Forms Management Program (SA 6). The Administration, Security and Accommodation Branch (ASA) provides advice regarding security provisions in contracts for the production and warehousing of these forms. International Region (IR) provides guidance to CIC offices abroad and is responsible for follow–up if issues noted in the quarterly inventory reports of offices abroad are brought to its attention by IMD. Additional information is provided in Appendix C.

The Operational Management and Coordination Branch (OMC), under the Assistant Deputy Minister, Operations, has the responsibility to coordinate all operational activities of the Department domestically and internationally. In February 2008, the coordination of CIC’s program/policy manuals and the publishing of Operational Bulletins was transferred from the Service Improvement Office (SIO) to OMC. Further, OMC has recently appointed a Director of Stewardship. The role of OMC with regard to stewardship of controlled forms is evolving.

1.2.4 Previous audit activity

Internal audits of CIC offices abroad and inland offices have noted weaknesses in quarterly reporting, on–site safeguarding of immigration controlled forms, and on–site monitoring of the function.

CBSA recently conducted an internal audit of immigration controlled forms managed by CBSA. The audit noted weaknesses and identified areas for improvement in the management of immigration controlled forms at CBSA. The complete report is located at the following web address:
(http://www.cbsa.gc.ca/agency–agence/reports–rapports/ae–ve/2008/form–imm–eng.html)

1.2.5 Environmental context

• The forms management function within CIC faces a number of challenges. A mixture of automated and manual processes, multiple layers and cross–organizational involvement and engagement, along with externally controlled reporting systems, do not make for an end–to–end forms continuum.
• Generic forms, like systems supporting several business lines, do not have a dedicated owner to take ownership of the issues, determine priorities and ensure the evolution of the products.
• The administrative environment supporting the logistics required to acquire, distribute, store, use and report on business forms spans three departments (CIC, CBSA and DFAIT). Each department has its own distinct technical environment, distribution process, priorities, reporting structure and reporting requirements.
• With the creation of the Service Improvement Office (SIO), several innovative projects have been launched over the last two years. These projects, when fully implemented, will have a significant impact on the systems, forms and processes being used to deliver citizenship and immigration services.
• A Temporary Resident Document Working Group was recently established by the SIO to identify potential alternate options to the existing paper documents being generated for our clients. A short–term deliverable of the working group will be the identification of an alternate option to the existing four–ply IMM1442 design. Changes in technology will result in the four–ply IMM1442 being phased out.
• A review of the functional accountabilities model for corporate services is currently under way at CIC. When completed, the principles of this model could be leveraged to streamline the multiple layers and cross–organizational involvement relating to forms control.
• While the CIC/CBSA memorandum of understanding (MOU) addresses high–level issues, aspects of program–related forms require that additional details be included or clarified. To remedy this situation, CIC and CBSA must work together to implement the recommendations of this audit.
• Over the last 30 months, significant organizational changes within the Operations Sector have been implemented, including the creation of the Operational Management and Coordination Branch. Since then, OMC’s mandate within the Sector has evolved further.
• A Stewardship Office within OMC was created and tasked with coordinating the implementation of the recommendations coming out of audits throughout the network. Opportunities to implement best practices and process improvements that could benefit the Operations Sector will also be addressed. One of the planned key activities includes a forms review, which will address the management of controlled forms. The Stewardship Office activities were initiated on October 1, 2008.

1.3 Audit objective

The objective of the audit was to assess the effectiveness of policies and procedures for NHQ monitoring and oversight of controlled forms and the related management framework.

1.4 Audit criteria

The audit criteria are outlined in Appendix A by line of enquiry, as stated in the audit scope below. The criteria are based on CIC legislation and applicable CIC and Treasury Board policies and directives. Prior to the examination phase of the audit, the criteria were provided to the directors general and directors of CIC organizational units at NHQ that have responsibility for controlled forms, for information and comments.

1.5 Audit scope

The audit scope comprised three lines of enquiry: governance, risk management and internal control, which encompassed stewardship. The audit was limited to NHQ activities. The audit scope did not include the cost–recovery processes associated with controlled forms.

1.6 Audit methodology

During the planning phase of the audit, the directors general or their representatives, for the key organizational units involved with immigration controlled forms, were interviewed in order to determine the significant risks and areas of concern with regard to immigration controlled forms. Upon completion of the planning phase, the audit plan was finalized and circulated to all applicable parties.

In the examination phase, the audit approach included the following:

• analysis of observations from previous audits of missions and inland offices
• review of relevant departmental policies and procedures, agreements with external parties for production and warehousing (i.e. contracts/MOUs, etc.) and other information
• interviews with key personnel responsible for controlled forms activity at NHQ
• interview with CBSA internal audit representatives in connection with their recent audit of CBSA immigration controlled forms
• process mapping and analysis
• audit testing of quarterly inventory reports, order forms and supporting information as deemed appropriate

The audit was conducted to be in compliance with the Government of Canada’s Policy on Internal Audit as well as with auditing standards set out by the Institute of Internal Auditors.

2.0 Audit conclusion

The audit concludes that the procedures for the ordering and supply of controlled forms are adequate and effective. However, the audit has noted gaps in governance with respect to how accountability for monitoring and oversight of controlled forms is defined and exercised, as well as gaps in the control process relating to the monitoring of reports from inland and overseas CIC offices on usage and inventory reconciliation of these documents. Thus, NHQ monitoring and oversight of controlled forms are not effective because NHQ cannot draw overall conclusions as to the safeguarding and stewardship of these documents.

The fundamental weaknesses regarding accountability raise the issue as to who is the accountable owner of controlled forms. This was not clear during the audit. Defining the owner and making that position accountable for ensuring that adequate controls are put in place and monitored and that deficiencies are addressed would provide a focus that would give impetus to rapid resolution of issues in this important and sensitive area. The audit also fully recognizes that, ultimately, the field offices must ensure that tight control over blank forms is maintained at all times.

The key recommendations of the audit are as follows:

• The Department should clearly define accountabilities for NHQ monitoring and oversight, as well as the communication protocols. The ownership of controlled forms should be clarified and policies and procedures updated and strengthened with respect to stewardship of these forms.
• Local management attestation should be introduced on the quarterly inventory reports.
• Risk assessment on controlled forms should be updated.
• The monitoring of quarterly inventory reports from all users and the reporting of their status should be strengthened. This includes developing a strategy for risk–based monitoring and appropriate training of NHQ staff involved in monitoring and oversight.
• A global reconciliation procedure should be introduced with regard to production, usage, destruction and inventories that are available.

Detailed observations and recommendations in these areas are discussed in section 3.0 of the report. Management’s response and action plan along with proposed implementation dates for the recommendations can be found in Appendix D.

3.0 Observations and recommendations

3.1 Governance processes

3.1.1 Governance and accountability

In assessing the governance of and accountability for NHQ monitoring and oversight of CIC immigration controlled forms, we expected to find that:

• operational plans are in place to achieve departmental objectives with respect to immigration controlled forms
• communication protocols exist for clients, partners, employees and external stakeholders with regard to immigration controlled forms
• accountabilities and responsibilities are clearly defined, delegated and communicated through appropriate policies and guidelines, and these accountabilities and responsibilities are adequately discharged

The IMTB 2008–11 Business Plan incorporates initiatives with respect to managing supplier contracts for producing and warehousing controlled forms and initiatives for improving the management of quarterly inventory reporting.

There was open and frequent communication between IMD and IR with regard to immigration controlled forms. However, there was no evidence of formal communication protocols between IMD and other clients (e.g. OMC and CIC inland offices), partners, employees or external stakeholders. The SA 6 Forms Management Program manual notes that regional headquarters directors general and program managers would be notified by IMD with regard to non–compliance, but there was no evidence of this. Also, there were no documented procedures for regular reporting to program managers at headquarters and in the regions with regard to the status of quarterly inventory reporting and the issues noted therein. Without formal communication protocols and escalation procedures, there is no assurance that the proper parties will be informed should an issue arise such as a lack of or improper quarterly reporting. There is also no assurance that the communication between all relevant parties will be open and regular.

The audit found that the roles and responsibilities of IMD staff with respect to the ordering and supply of controlled forms were generally understood by the staff members themselves. The work description for the Forms Management Officer (FMO) outlined the responsibilities with regard to quarterly reporting. However, the audit found several gaps with respect to accountabilities and responsibilities for monitoring and oversight of immigration controlled forms:

• Accountabilities and responsibilities were not clearly defined, delegated or communicated for the remaining areas of CIC–NHQ involved with immigration controlled forms, i.e. IR, Domestic Regions, Central Processing Region (CPR), OMC and Corporate Security.

• Escalation procedures – IR provides support to IMD with regard to escalation procedures for quarterly reporting for CIC offices abroad. However, there was no equivalent area within CIC–NHQ to support IMD for issues on quarterly reporting for the remainder of the Operations Sector (CIC inland offices and CPR).
• Manuals – There are three guidance manuals for the immigration controlled forms activity. The Forms Management Program manual (SA 6) produced by IMD is the primary policy document governing the use of and controls required for immigration controlled forms. A second manual, the Forms Management Guide, is produced by IR and emphasizes the internal controls that CIC offices abroad are required to have in place. A third manual, IC 3, is produced by CBSA and focusses on the security features of immigration controlled forms. Upon reviewing the three manuals for consistency of information, we noted multiple instances of discrepancies and conflicting information (e.g. different guidance is provided for the required levels of inventory to be maintained by each office). We also noted that SA 6 is not very explicit as to how the numbers used, as reported on the quarterly inventory report, should be reconciled with operational information that is available locally. It was not clear who in CIC is accountable for ensuring that these various manuals are consistent and that the guidance is adequate.
• The Forms Management Program manual did not provide specific guidance aimed at managing and controlling the immigration controlled forms used in CIC inland and CBSA offices. This is important, as the specific form used in inland offices (IMM1442) has different handling requirements than the forms used in offices abroad.
• In October 2005, a statement detailing the roles and responsibilities of CIC and CBSA with respect to immigration controlled forms was finalized. We understand that the document was to form part of the Corporate Services annex in the MOU between CIC and CBSA, but this was not done. Therefore, the current roles and responsibilities of CIC and CBSA with respect to controlled forms are generally understood but are not formalized.
• Attestation – On the current revised quarterly inventory report form, the Forms Control Officer (FCO) and the manager are required to sign the report prior to submitting it to NHQ. It was not clear what the signature of the manager meant. Accountability at the local level can be strengthened if the form specifies what the local manager’s signature is certifying, such as that a physical inventory count has been completed as required, usage has been verified and the safeguarding measures have been complied with. During previous audits in the field, it was noted that there is unevenness in the quarterly reporting and reconciliation procedures.
• Training – It was not clear who at NHQ was accountable for ensuring that staff in domestic regions and international region had been effectively trained with respect to controlled forms. IR does have a structure but provides only limited training to officers going out in the field for the first time or officers returning to the field after an extended absence from the mission environment. Similarly, it was not clear who is accountable for training NHQ staff in the monitoring and oversight of controlled forms.

The fundamental weaknesses regarding accountability raise the issue as to who is the accountable owner of controlled forms. This was not clear during the audit. Defining the owner and making that position accountable for ensuring that, adequate controls are put in place and monitored and that deficiencies are addressed would provide a focus that would give impetus to rapid resolution of issues in this important and sensitive area.

The audit did note that change initiatives were identified from time to time and undertaken informally within IMD. The most recent change opportunity identified and put into practice in December 2007 was the change of guidance and format of the form used for quarterly inventory reporting. This was accompanied by significant dialogue between IMD and CIC offices abroad to help the local offices understand how to complete the quarterly reports. In February 2008, the coordination of CIC’s program/policy manuals and the publishing of Operational Bulletins were transferred from the SIO to OMC under the Director of Operational Information Management position. In addition, OMC has designated a new Director of Stewardship position. We were informed that these positions may assume some of the oversight and monitoring roles. We believe that these initiatives are positive and create opportunities to firm up clear accountabilities for oversight and monitoring of controlled forms activity.

Recommendation 1

The Department must clarify and strengthen governance of and accountability for controlled forms by:

a. developing protocols to ensure proper communication of incidents, status reports and changes in policies and procedures between all relevant parties; and

b. determining, formalizing and clearly articulating the accountability for the oversight and monitoring of immigration controlled forms at NHQ.

Management response

OMC’s Stewardship Office will establish and lead a working group that will be tasked with developing and recommending a governance structure and accountability framework for the controlled forms. This working group will include representatives from all key stakeholders (OMC, Regions, CPR, IMTB, ASA), as well as subject matter experts as required. The working group’s recommendations will be submitted to senior management for endorsement and implementation.

Recommendation 2

The Director General, IMTB, in consultation with the Directors General of OMC, IR, Domestic Regions and CPR, must:

a. take action to correct the anomalies noted above, especially with regard to manuals, policy direction and training; and

b. review the format of the quarterly inventory report to include an attestation by the local manager detailing the performance expectations for quarterly reporting, to reinforce accountability at the end–user level.

Management response

a. While the issue of governance and accountabilities was being addressed, IMTB and OMC began working together to identify interim solutions for more pressing issues such as expanding the guidance provided to CIC domestic offices and aligning the forms manuals.

b. IMTB will revise the format of the quarterly inventory report to reinforce accountability at the end–user level. OMC, IMTB and IR are currently reviewing previous communication to the network on this subject so that the communication strategy can be clarified to address reporting relationships and problem areas.

3.1.2 Monitoring

We expected to find that:

• processes exist to ensure adequate reporting of immigration controlled forms activity to identify potential mismanagement, including incident reporting
• management monitors immigration controlled forms activity, including results of internal audits, on a regular basis and takes corrective action as required

Incident reporting

During the audit, interviewees indicated that they were not aware whether there had been any recent incidents of lost or unaccounted–for blank immigration controlled forms. While this is a positive situation, there was a lack of clarity with regard to the procedures for incident reporting within CIC. Within the policies and manuals available, we noted that security incidents relating to controlled forms are to be reported to the Enforcement and Comptrollership branches within CBSA. The manuals did indicate that IMD was to be advised of such incidents, but our interviews indicated that IMD had received no notification of such incidents in recent years and was not aware of any incidents that might have been reported to the CBSA Enforcement and Comptrollership branches. It was also not clear whether such incidents should be reported to Corporate Security and how such information would affect risk assessment.

In order for CIC to adequately discharge its mandate, responsible officials at NHQ must be made aware of incidents and significant breakdowns of control in a timely manner, even though they do not have enforcement responsibility. Further, CIC should be conducting regular follow–ups with those responsible for enforcement. We note that the Administration, Security and Accommodation Branch has a formal reporting tracking system in place, managed by the Corporate Security Directorate.

Management reporting on controlled forms activity

We did not find any evidence of regular, formal management monitoring of the immigration controlled forms activity at the time of audit. Specifically, there was no monitoring of the status of quarterly inventory reports received, reviewed and approved by IMD. It was indicated that in the past, management reporting had occurred in IMD with regard to immigration controlled forms activity.

As part of an “Enhanced Stewardship” initiative, IR had identified the need to address several recurring areas of weakness, including the immigration controlled forms activity identified in previous internal audits. At the time of our audit, implementation of this positive initiative had just begun.

Regular monitoring of controlled forms activity is essential, not only to determine adequacy of service levels, but also to determine whether the intended controls are effectively applied.

Recommendation 3

The Director General, IMTB, must request periodic activity oversight and monitoring reports, and these reports must be provided to relevant operations staff for their information and follow–up.

Management response

IMD is already working with International Region and OMC to improve monitoring and oversight activities. Individual follow–up was completed with FCOs to clarify reporting processes, and it will be followed by regular e–mail communication to all FCOs to remind them of the proper usage of the quarterly reporting tool. OMC will support IMD’s work by monitoring the reports and escalating issues within the Operations Sector and CBSA. OMC has started working with IMD to ensure that the reporting and oversight practices are aligned with the new Governance and Accountabilities Framework.

3.2 Risk management

In assessing the risk management system in place for immigration controlled forms, we expected to find that:

• processes are in place to identify, assess, mitigate and monitor risks with respect to immigration controlled forms
• management appropriately communicates risk information to key personnel
• planning and resource allocation take risk information into consideration

The audit found that CIC Corporate Security recently completed threat and risk assessments (TRAs) of CIC inland offices, including an assessment of the physical security of immigration controlled forms in the specific offices. The TRA process did not reveal any general systemic issues or concerns over controlled forms. Physical security in CIC offices abroad is the responsibility of DFAIT, but it is incumbent upon CIC to identify its unique security requirements to DFAIT.

The audit found that there is a perceived high level of risk associated with blank immigration controlled forms, and this risk is informally communicated to staff working in CIC offices abroad. The audit did not find a formal risk assessment of immigration controlled forms, including the likelihood and impact of security incidents, nor did it find a formal communication protocol in place to communicate risk information to all key personnel. The lack of an updated risk assessment is related to issues in the overall accountability for the immigration controlled forms activity. Without a formal risk assessment, there is no assurance that the control framework around the immigration controlled forms activity is up to date and appropriate. One of the areas of interest would be whether the risks are similar for the forms used by inland offices as compared to the forms used by offices abroad.

Since there was no formal risk assessment completed, the risk information could not be taken into consideration in planning and resource allocation.

Recommendation 4

The Director General, OMC, in consultation with the Directors General of Domestic Regions, CPR and IR, must conduct a formal risk assessment of immigration controlled forms. Risk information should be communicated to all key personnel and must be taken into consideration in planning and resource allocation.

Management response

OMC, with the guidance of the Management Accountability Office, will perform a formal risk assessment of the immigration controlled forms being used throughout the network. IMTB and ASA will assist with the formal risk assessment of immigration controlled forms. Findings will be used to modify manuals and processes.

3.3 Stewardship – internal control

The internal controls in place at NHQ to safeguard immigration controlled forms were assessed, including ensuring that an adequate supply of these forms is available. The expectations of the audit are detailed more specifically below.

The audit expected to find that:

• contracts for the procurement and storage of immigration controlled forms as well as any memoranda of understanding regarding their transportation contain adequate security requirements to safeguard their physical location, and to control and minimize the risk of fraud
• CIC Corporate Security is involved in determining the physical security requirements associated with the production, transportation and handling of controlled forms
• procedures and guidance for ordering, shipping and confirmation of delivery are in place and are followed to ensure that forms are delivered in a secure and timely manner
• the inventory at NHQ is adequately safeguarded
• procedures and guidance for reviewing quarterly inventory, destruction and transfer reports, including investigating and reporting discrepancies, are in place and are followed
• reconciliations between amounts ordered, used and in hand are performed regularly to determine any unusual losses or significant gaps

Security requirements in contracts

The audit found that security requirements imposed on contractors to physically safeguard the immigration controlled forms during production, storage and delivery were reviewed and approved by appropriate Corporate Security personnel. The contracts stipulate that facility security clearances with approved document safeguarding must be issued by the Industrial Security Directorate of Public Works and Government Services Canada for the contractors. As well, they require that any subcontractors involved in the process hold equivalent clearances.

CIC Corporate Security approved the security levels and requirements included in the current contracts in place for immigration controlled form production and warehousing.

Ordering blank controlled forms and reporting

There were procedures and guidance in place for offices to order blank immigration controlled forms. CIC offices abroad and CBSA offices place their orders directly with the designated employee within IMD, and CIC inland offices place their orders directly with the warehouse. The audit found that these practices were consistent with the expectations of the end users and that the average turnaround between the time the employee received an order request and the time the order was placed with the warehouse was 1 to 2 days.

There were two areas where issues were noted:

• Currently there is no requirement for the employee within IMD to receive either a confirmation from the warehouse indicating when the order was sent out and how many immigration controlled forms were included in the order or a confirmation from the ordering office indicating that the order was received and how many forms were received in the order. Without a confirmation of the volume of immigration controlled forms shipped out from the warehouse and the volume received by the office, IMD is not able to verify in a timely manner that the correct volumes have been provided to the office to prevent disruption in services and that the proper volumes of immigration controlled forms have been included in the office’s inventory levels.
• There is a lack of clarity in the ordering and reporting requirements for satellite offices abroad. Some satellite offices were ordering from and reporting to the FMO, others were ordering and reporting through CIC offices abroad and yet others were ordering from the FMO but reporting through an office abroad. It was difficult to monitor the inventory volumes in these offices because of the inconsistencies noted in the ordering and reporting of immigration controlled forms.

Recommendation 5

The Director, IMD, must amend the procedures so that the warehouse and receiving offices are required to submit a confirmation of shipment and receipt to the Directorate (currently e–Information Services).

Management response

Until the new contract was implemented, interim solutions were established with St. Joseph and the FCO network was informed of the new receiving/confirmation processes. IMTB has successfully completed transferring the warehousing of CIC’s controlled forms from St. Joseph to Canadian Bank Note (CBN), and these recommendations were implemented at that time.

Recommendation 6

The Director General, IR, must clarify the reporting requirements for satellite offices and ensure that they are consistently implemented for all CIC satellite offices abroad.

Management response

International Region, with the support of IMTB, has completed a review of all missions to determine possession and usage of key documents. IR has identified corrective measures resulting from the review that will clarify both the reporting structure and reporting requirements for all missions overseas. The corrective measures are being implemented.

International Region, with the support of IMTB, has completed a review of all missions to determine possession and usage of key documents. IR has identified corrective measures resulting from the review that will clarify both the reporting structure and reporting requirements for all missions overseas. The corrective measures are being implemented.

Storage of blank forms at NHQ

Blank immigration controlled forms are stored in a warehouse in the National Capital Region managed by a contractor. CIC has had a contract with the current warehouse for many years. The audit found that the controlled forms at NHQ were adequately safeguarded and monitored by CIC staff through periodic visits to the warehouse and annual inventory counts.

Monitoring of quarterly reports

CIC policy requires that all offices using immigration controlled forms, both inland and abroad, undertake an inventory count and reconciliation at the end of each calendar quarter and submit a quarterly inventory report to IMD. The purpose of this inventory count is to enable tight control over the controlled forms in circulation and detect missing forms in a timely manner.

The audit noted that as of April 28, 2008, approximately 58% of the reports received from CIC offices abroad for 2007 had been reviewed and finalized by IMD. Seventeen percent of offices abroad had not submitted an inventory report for the December 2007 quarter. In addition, although 50% of CIC inland and CBSA offices had submitted quarterly inventory reports for the four reporting periods of 2007, none of these reports had been reviewed.

Both IMD and IR have been aware of issues with regard to quarterly report reconciliation. In 2007, the role of processing orders for blank immigration controlled forms from offices and reviewing quarterly inventory reports was split into two separate positions, because reviewing quarterly reports is a time–consuming process. The reconciliation process is largely manual and the reporting is paper–based. In addition, IMD issued new guidance and a new version of the form used for quarterly inventory reporting in December 2007. Upon review of quarterly inventory reports using the new form, the audit noted an improvement in the quality and reliability of information being reported, which should decrease the time spent by the FMO on reviewing the quarterly reports.

One strategy to consider when reviewing reports would be to take a risk–based approach to monitoring, to ensure that higher–risk offices, as defined based on specific criteria, are reviewed as a priority. We did not see any indication of such a risk–based strategy. A second issue, once the accountabilities are clarified, is to ensure that the NHQ staff involved in monitoring and oversight of the quarterly reports receive appropriate training.

The quarterly inventory reports are a fundamental control element for NHQ monitoring and oversight. If these reports are not reviewed in a timely manner and the anomalies effectively reported, the offices reporting such information may get less diligent in their control and reporting practices. For example, in a few of IAA’s CIC office audits, it was noted that the quarterly inventory reports contained rounded inventory numbers and that NHQ had not followed up.

It was also noted that the largest CIC user of the controlled form IMM1442, CPC–Vegreville, did not submit any quarterly inventory reports to NHQ. During interviews, it was reported that management had approved an exemption to the reporting requirement for CPC–Vegreville, but written documentation to this effect was not provided.

Recommendation 7

The Director General, IMTB, must ensure that the quarterly inventory reports from all offices are submitted and reviewed on a timely basis and the results promptly reported to Operations. As part of an effective review process, a risk–based approach should be considered in order to ensure timely and accurate reporting from all high–volume and high–risk users of CIC immigration controlled forms, and the staff involved in the review should be appropriately trained.

Management response

IMTB will continue to work with OMC and CBSA to provide more timely reporting. In addition, CIC is re–examining its plans to implement an online system to facilitate the tracking and reporting of forms. The original plan to implement an online system last fiscal year has been hampered by a lack of human and financial resources, as well as stewardship issues. The recommendations of the internal audit will greatly assist the Department in addressing its stewardship issue.

Quality control

The producer of the forms removes samples from batches produced to test the quality of the product. The producer records the volume and serial numbers of forms removed to ensure that the office receiving the batch knows exactly how many forms remain. Once the forms are delivered to the warehouse for storage, another list of removed forms is created, which is the list that offices receiving the forms for use rely on when the volume of forms received in a shipment is recorded in inventory. NHQ officials indicated that consistent problems were reported with the recording by the warehouse of volumes and serial numbers of forms removed for quality control. This was attributed to lack of attention by the warehouse. This contributed to problems with reporting of inventory volumes during quarterly reporting and required the FMO to rely on FCOs for accuracy of such information, thus further weakening the oversight role.

Recommendation 8

The Director General, IMTB, must follow up with the warehouse and the producer of the forms to ensure that the information on the volume and serial numbers of forms removed for quality assurance is accurately reported.

Management response

Work in IMTB is under way to transfer the warehousing of CIC’s controlled forms from St. Joseph to Canadian Bank Note, and some of these recommendations will be implemented at that time, as CBN will be required to build an inventory management system to assist with this activity.

Global reconciliation of controlled forms

The audit found that although the information to perform high–level reconciliation of controlled forms production, usage and inventories on hand exists, no such monitoring is currently being performed. The audit also noted that there were no comparisons conducted between the forms reported by the offices as used for immigration visas and the volume of visas issued as per CIC processing systems.

The rationale for not performing such reconciliation is that the current process is manual and therefore would be very time–consuming. IMD is developing an automated system to assist in tracking and reconciliation, but this system is not expected to be completed until the next fiscal year.

High–level monitoring of global inventory is an important control from NHQ perspective. A global reconciliation is a key control element for serially numbered sensitive forms. This type of monitoring could provide assurance that significant volumes of forms are not lost or missing and act as a test for reasonableness. High–level monitoring can also help identify potential risk areas.

Recommendation 9

The Director General, OMC, must ensure that a global reconciliation of controlled forms is performed to detect significant gaps in inventories and that immediate corrective action is taken.

Management response

As part of its ongoing quality assurance activities, OMC will implement a process where selected manual reconciliations of controlled forms against operational data will be performed. This process will be based on quality control methodology and will compare the forms usage reported by the offices and the volume of documents issued as per CIC’s systems.

Appendix A – Audit Criteria

Governance processes

Risk Management

Internal Control

Appendix B – Controlled Forms Process Overview

Text version: Appendix B

Appendix C – Roles and Responsibilities

Figure 1: Key Players Involved in NHQ Monitoring and Oversight of Immigration Controlled Form

Text version: Roles and Responsibilities

The following is a detailed description of these key players.

Information Management Directorate (IMD)

The Information Management Directorate, within the CIC’s Information Management and Technologies Branch (IMTB), is responsible for managing CIC’s electronic and paper–based forms, including immigration controlled forms.

CIC contracts with a company for the manufacturing of immigration controlled forms. Once produced, the forms are warehoused by another company in the NHQ area until they are shipped to offices to replenish on–site inventories.

Within IMD, three full–time employees are dedicated to managing forms, which includes managing the contracts with suppliers, receiving and processing orders from offices for forms, managing warehouse inventory, processing cost–recovery transactions and monitoring reporting requirements of offices that use the forms. One of these three full–time employees is dedicated to reviewing and finalizing quarterly inventory reports received from all immigration controlled form users, and another employee receives and places orders for blank immigration controlled forms from offices.

Guidance related to the creation/revision, distribution, disposition and protection of controlled and non–controlled forms has been developed by IMD. This guidance is provided in the internal Service and Administration:  Forms Management Program Chapter 6 (SA 6) manual. The SA 6 manual applies to all offices responsible for immigration controlled forms.

Corporate Security

CIC Corporate Security, which is part of the Administration, Security and Accommodation Branch, is responsible for the overall management of security, including physical and personnel security, business continuity planning, emergency preparedness and planning, and security training and awareness for Citizenship and Immigration Canada. The Director General, Administration Security and Accommodation, is also the Departmental Security Officer (DSO). Corporate Security is required to review all contracts with regard to security matters.

International Region (IR)

International Region, within CIC Operations, is responsible for approximately 91 CIC offices abroad. Part of IR’s responsibility is to provide immigration officers working abroad with the necessary guidance and tools to carry out their duties. IR has published a Forms Management Guide, which provides guidance to Forms Control Officers working in CIC offices abroad on how to adequately control and safeguard immigration controlled forms.

Canada Border Services Agency (CBSA)

With the creation of CBSA in December 2003, immigration responsibilities at POEs were transferred from CIC to CBSA. An MOU is in place between the two organizations to set out the basis for cooperation between CIC and CBSA in the delivery of the immigration program, information sharing and the provision of various services.

Appendix D – Management Action Plan as of May 2009

Appendix E – Audit Time Line