Audit of the Immigration Program at the Canadian High Commission in Kuala Lumpur

Audit Report
Internal Audit and Accountability Branch
Citizenship and Immigration Canada
July 2008

Table of Contents

• Acronyms used in this report
• 1.0 Introduction
  • 1.1 Background
  • 1.2 Audit Objectives
  • 1.3 Audit Criteria
  • 1.4 Audit Scope
  • 1.5 Audit Methodology
• 2.0 Audit Conclusions
• 3.0 Observations and Recommendations
  • 3.1 Management Framework
  • 3.2 Integrity of the Immigration Program
  • 3.3 Internal Control Framework
• Appendix A: Detailed Criteria for the Audit
• Appendix B: Management Action Plan
• Appendix C: Audit Time Line

Acronyms used in this report

1.0 Introduction

The Citizenship and Immigration Canada (CIC) Risk-Based Audit Plan for 2007–2010 calls for the conduct of mission audits. The Canadian High Commission in Kuala Lumpur was selected in consultation with the International Region (IR) Branch at CIC national headquarters (NHQ). The selection was based on an assessment of the mission’s operations in relation to other offices, taking into consideration the processing volumes. The on-site field work was conducted from October 22 to 26, 2007.

1.1 Background

1.1.1 Operations

CIC is responsible for the recruitment, selection and processing of foreign nationals who wish to come to Canada on a temporary or permanent basis and who will stimulate economic growth and enrich Canada's social and cultural environment. Within the Department, this responsibility has been assigned to the Operations Sector, which is divided into domestic and overseas operations. Overseas operations fall under the responsibility of the IR Branch, which accomplishes this through its network of visa offices (or missions) abroad. These are broken down into regional program centres (RPCs), full-service centres, satellites and specialized offices. RPCs and full-service centres are responsible for the delivery of the full range of immigration services for the countries they serve. The distinction between the two is that RPCs are responsible for overseeing satellite offices. Satellites and specialized program offices do not deliver the full range of immigration services.

The Kuala Lumpur mission is a full-service visa processing office and is responsible for the delivery of all immigration services. It opened in September 2002 with the re-establishment of a visa requirement for Malaysians and it was established as a full-service office in October 2004. The office is one of the newest of the 32 full-service centres around the world. The Visa Section has seven full-time employees, including two Canada-based officers (CBOs) and five locally engaged staff (see figure 1 below).

All staff report to the immigration program manager (IPM), but the second CBO oversees non-immigrant processing. Due to the size of the office, all staff may be involved in the processing of immigrant and non-immigrant cases depending on work load fluctuations. However, the IPM and his program assistant primarily process immigrant applications while the rest of the staff are involved in both. The second program assistant also performs the duties of cost recovery.

Kuala Lumpur processes applications for permanent residence from citizens and residents of Malaysia and the two provinces to the east on the island of Borneo. The mission also processes applications for temporary residence made in Malaysia. In 2007, the mission’s overall visa target for permanent resident applications was 550. The inventory of applications awaiting a decision at the mission as of November 2, 2007, was 2,421, of which approximately 88% were skilled workers. On the temporary resident side, the office issued 7,497 visitor visas, 328 student visas and 98 temporary worker visas in 2006. However, in 2005, the office issued 7,534 visitor visas, 329 student visas and 70 temporary worker visas, indicating that production has remained relatively stable. Mission statistics for 2007, 2006 and 2005 are summarized in table 1 below.

Table 1. Kuala Lumpur Statistics

1.1.2 Environmental Context

This section of the report highlights some of the mission’s operating environment issues. They are presented here for information purposes only and are not given in any particular order.

Kuala Lumpur is one of the newest full-service missions within CIC’s network of overseas offices. The mission management advised us that the Immigration Section in Kuala Lumpur faced the following challenges:

• Evolving environment — The mission operates in an evolving and operationally demanding environment. As a full-service mission, it has pressures in all aspects of the program, exacerbated by case volume and a level of fraud that demands vigilance.
• Diversity of clientele — While Malaysia is but one country, it is made up of two distinct and geographically separate regions and comprises “three solitudes”: the Malay, Chinese and Indian communities. Within each of these unique environments, there are different circumstances that require a complex understanding to be able to integrate them into the decision framework.

1.2 Audit Objectives

The audit objectives are to assess the following:

• the management framework in place at the mission to administer the immigration program;
• the degree of compliance of the practices and procedures with the applicable legislation and policies associated with the delivery of the immigration program; and
• the internal control framework in place to support the operational delivery at the mission and safeguard assets and revenues.

1.3 Audit Criteria

The criteria that were used in the audit are based on applicable Treasury Board and CIC legislation, policies and directives. The detailed criteria for the audit are presented in appendix A.

1.4 Audit Scope

The audit only involved operations at the Canadian mission in Kuala Lumpur. The scope covered all significant aspects of CIC operations at the mission. This included the full range of immigrant and non-immigrant program activities with associated financial and administrative components typically found in a full-service centre. The audit examined the activities of the mission from July 1, 2006, to the end of the on-site examination period of October 26, 2007.

1.5 Audit Methodology

There were three lines of enquiry: management framework, compliance of the immigration program and the internal control framework.

As part of our examination of the management framework, we interviewed immigration staff as well as other embassy staff with links to immigration operations; reviewed documents; observed processes; documented controls; tested information; and reviewed samples of management files to test for compliance.

As part of our examination of program integrity, we examined all decisions related to permanent resident determination travel documents, temporary resident and permanent resident cases and temporary resident permits finalized over the period of July 1, 2006, to June 30, 2007, to test compliance with delegated authorities. We also conducted interviews with immigration staff and other embassy staff with links to immigration operations, we reviewed documents, we observed processes and we documented controls. The audit also examined a judgmental sample of 20 temporary resident cases and 20 permanent resident cases that were finalized between July 1, 2006, and June 30, 2007, in order to assess compliance with legislation, regulations and policy requirements of the case file. The sample size was judgmentally determined taking into consideration mission processing volumes. Individual sample cases were randomly selected from the population. The file review of sample cases was done to validate our observations from interviews, our observation of the procedures in place at the mission, and our documentation reviews.

As part of our examination of the internal control framework, we examined controls over the Computer-Assisted Immigration Processing System (CAIPS), controlled documents, cost recovery, and travel and hospitality expenditures. To this end, we interviewed immigration and other embassy staff with links to immigration operations, reviewed documents, observed processes, documented controls, tested information and reviewed samples of management files to test for compliance. Specifically, we examined CAIPS user profiles, tested CAIPS inventory controls, samples of controlled documents inventory transactions and cost-recovery revenue controls, and reviewed a sample of travel and hospitality claims to assess compliance with applicable legislation, policies and procedures and conclude on the state of controls in place.

The audit was conducted in accordance with the Government of Canada’s Policy on Internal Audit and the auditing standards set out by the Institute of Internal Auditors.

2.0 Audit Conclusions

The audit found that:

• the management framework was appropriate to manage the mission resources;
• the immigration program was compliant; and
• the internal control framework to support the operational delivery at the mission and safeguard assets and revenues was appropriate for CAIPS, for controlled documents and for travel and hospitality, but that the controls in place over cost recovery required adjustment.

Our detailed observations and recommendations in these areas are discussed in the next section of the report. Management’s responses and action plan, along with the proposed implementation dates for our recommendations, can be found in appendix B.

3.0 Observations and Recommendations

3.1 Management Framework

The audit examined seven areas of the management framework: governance and strategic direction; public service values and ethics; people/human resources management; client-focused service; risk management; results and performance; and learning, innovation and change management. We expected to find that accountabilities were appropriate, values and ethics were promoted and reinforced, the office was managed to ensure an effective work place, services delivered by the office met the requirements of its clients, risk management was employed by the office, information on results was gathered, used to make decisions and reported, and learning and development activities were in place.

The audit found that the management framework was appropriate to manage mission resources. Specifically, we found that:

• governance structures were appropriate;
• values and ethics were promoted and reinforced;
• the human resources function was operating as intended, as evidenced by the mission’s human resources files;
• client service was managed appropriately;
• risk management practices were appropriate, given the mission’s operating environment;
• results and performance were captured and used for decision making; and
• learning was used to support change initiatives.

3.2 Integrity of the Immigration Program

The audit of program integrity examined the degree of compliance of practices and procedures with applicable legislation and policies associated with the delivery of the immigration program at the Kuala Lumpur mission. To this end, immigrant and non-immigrant processing was examined. We expected to find that application decisions were adequately documented, that processes and procedures complied with the applicable legislation and policies, that appropriate controls were in place at the mission to ensure that admissibility requirements were met, and that delegated authorities for decisions were appropriate and in compliance with departmental policy.

The audit found that the immigration program at the mission was generally compliant. Reviews of documentation, interviews with staff and observation of processes revealed that the mission had the knowledge and necessary tools to ensure that the office was compliant. We reviewed all decisions made on applications finalized between July 1, 2006, and June 30, 2007, and found that all decisions were rendered by staff with delegated authority.  

To validate the compliance of the immigration program application processing, we also reviewed a sample of temporary resident and permanent resident cases. We found no issues with temporary resident case processing. With regard to the permanent resident cases, however, we found that not all processing steps had been consistently documented in CAIPS to demonstrate performance. While our review did not find any particular area where there was a systematic weakness, given the newness of the mission, some variation is to be expected as procedures solidify. However, over time, we would expect this to improve.

Recommendation 1
The mission management must ensure that all processing steps related to decisions on permanent resident cases are consistently documented in CAIPS notes.

Management Response
Agreed.

3.3 Internal Control Framework

As part of the audit of the internal control framework, the controls in place over CAIPS, controlled documents, cost recovery, and travel and hospitality expenditures were examined.

The audit found that the internal control framework to support operational delivery at the mission and safeguard assets and revenues was appropriate for CAIPS, for controlled documents and for travel and hospitality, but that the controls in place over the recording and reporting of cost recovery required adjustment. Our observations are discussed in the following sections.

3.3.1 CAIPS

As part of the audit of the internal control framework, controls over CAIPS were examined. We expected to find that there were controls in place to ensure the appropriate use of CAIPS at the mission and that CAIPS assets were safeguarded.

The audit found the control framework surrounding CAIPS to be appropriate. Specifically, we found that sufficient review was occurring to ensure that CAIPS use and access were appropriate and in accordance with delegated authorities. We also found that inventory controls were sufficient to safeguard the CAIPS physical assets. Our testing in both areas found no issues, and it confirmed that the controls in place over CAIPS were adequate and functioning as intended.

3.3.2 Controlled Documents

As part of the audit of the internal control framework, controls over controlled documents were examined. The audit expected to find that roles and responsibilities (duties) were appropriate and that there was an effective control framework in place for the custodianship, safeguarding and control of controlled documents.

Overall, we found that appropriate controls were in place to ensure the safekeeping of controlled documents. As part of our audit testing, we were able to reconcile the mission’s physical inventory with its paper records. Furthermore, our review of other controlled document controls found these controls to be functioning as intended. However, we noted some areas where the mission could improve its inventory records and advised mission management of these issues as part of our audit for their consideration.

Guidance for controlled documents is fragmented over several policy manuals, with responsibility overseas divided between two branches at NHQ (the International Region and Information Management and Technologies). As part of our audit planning, and based on our experience in past mission audits and in-Canada audits, we have identified NHQ management of this function as an area for audit and will be auditing this in the near future.

3.3.3 Cost Recovery

The mission accepts payment of immigration fees in bank drafts in either Canadian dollars or Malaysian ringgits. Cost-recovery revenue collected by the mission totaled $1.1 million and $1.2 million in fiscal years 2005–2006 and 2006–2007 respectively.

The audit expected to find that roles and responsibilities (duties) were in accordance with departmental policies for cost recovery, that adequate controls were in place to safeguard the cost recovery revenues, and that an adequate monitoring regime was in place.

Overall, the audit found that roles and responsibilities were in accordance with departmental policies for cost recovery, but that some physical controls and monitoring procedures for the recording and reporting of cost recovery required adjustment (e.g.  the frequency of exchange rate monitoring and use of some GL codes). We found some issues with the administration of POS+, the system used to record the collection of fees, and with the recording of revenue refund transactions in the financial system (e.g.  incorrect use of GL). Though we note that the frequency and magnitude of these instances were low and unlikely to materially impact overall reporting.

We informed management of these issues while we were on site. Management indicated they would incorporate improved monitoring procedures into cost recovery to ensure that these issues were properly addressed.

During our audit, we found that historical users of POS+ who are no longer at the mission still had user profiles.

Recommendation 2
When staff no longer require POS+ access, the mission should delete their user profiles or remove access rights from their user profiles until such time as their profiles can be deleted from the system.

Management Response
Agreed.

3.3.4 Travel and Hospitality

As part of the audit of the internal control framework, controls over travel and hospitality expenditures were examined. The audit expected that controls would be in place to ensure that travel and hospitality transactions were processed in compliance with applicable policies and regulations.

We reviewed the single travel and hospitality claims processed, which accounted for 100% of the respective budgets during the year, and interviewed staff as part of our examination. Consequently, we found that the internal controls in place were appropriate to ensure that travel and hospitality expenditures were authorized, approved and recorded appropriately and in a timely manner.

Appendix A: Detailed Criteria for the Audit

Objective 1: Management Framework

The adequacy of the management framework will be assessed against the following criteria:

• Governance structures are in place to ensure that accountabilities are adequately discharged.
• Public service values and ethics are promoted and reinforced.
• The office is managed to ensure an effective workplace for staff to successfully contribute to the work objectives.
• Services delivered by the office reflect the requirements of its clients.
• Processes are in place at the office for the identification and development of risk mitigation strategies.
• Relevant information on results is gathered, used to make decisions and reported.
• The office employs learning and development activities to promote innovation and change management in order to learn from its performance.

Objective 2: Program Integrity

The degree of compliance of practices and procedures with applicable legislation, regulations and policies associated with the delivery of the immigration program will be assessed against the following criteria:

• Decisions are adequately documented, and the required supporting documentation is maintained.
• Delegated authorities for decisions are appropriate and in compliance with departmental policy.
• Appropriate controls are in place at the mission to ensure that admissibility requirements are met.

Objective 3: Internal Controls

The adequacy of the internal control framework in place to support operational delivery at the mission and safeguard assets and revenues will be assessed against the following criteria:

• CAIPS Management
  • Appropriate controls are in place for the management and use of CAIPS user accounts at the mission.
  • Appropriate controls are in place to safeguard CAIPS assets at the mission.

• Controlled Documents
  • Roles and responsibilities (duties) are appropriate for the custodianship, safeguarding and control of controlled documents.
  • Adequate controls are in place for the custodianship, safeguarding and control of controlled documents.

• Cost Recovery
  • Roles and responsibilities (duties) assigned and procedures performed are in accordance with departmental policies for cost recovery.
  • Adequate controls are in place to ensure that the physical environment is in place to safeguard the cost-recovery system.
  • An adequate monitoring regime is in place to ensure that controls are working and that funds collected are appropriately and properly accounted for and safeguarded while in the Immigration Section.

• Travel and Hospitality
  • Internal controls should be in place to ensure that travel and hospitality transactions comply with policies and regulations to protect against fraud, financial negligence and other violations of rules and principles.

Appendix B: Management Action Plan

Appendix C: Audit Time Line

Audit planning — August/September 2007

On-site examination — October 22 to 26, 2007

Clearance draft to IPM and IR for comments — February 20, 2008

Management action plan finalized — March 10, 2008

Report approved by Audit Committee — July 3, 2008