Audit of the Immigration Program at the Canadian Mission in Lagos

Audit Report
Internal Audit and Accountability Branch
Citizenship and Immigration Canada
May 2013

Table of Contents

• Executive summary
  • Objective
  • Why this is important
  • Key findings
  • Conclusion
• Statement of conformance
• Introduction
• Environmental context of the mission
• Findings: Governance
• Findings: Risk Management and quality assurance
• Findings: Internal control framework
• Appendix A – Lagos Processing Summary 2009–2012
• Appendix B – Detailed audit criteria
• Appendix C – Management action plan

Executive Summary

Objective

The three objectives of the audit were to assess the adequacy of:

1. the mission’s governance framework for administering the Immigration Program;
2. the mission’s risk management and quality assurance practices to support the delivery of the Immigration Program; and
3. the mission’s internal control framework over administrative, financial and operational activities related to the Immigration Program.

The scope of the audit includes the roles and responsibilities of the Citizenship and Immigration Canada (CIC) National Headquarters to support the delivery of the Immigration Program at missions. The time period covered by the audit is from September 1, 2011 to August 31, 2012, with the exception of an inventory count and reconciliation performed during the on-site examination in January 2013.

Why This Is Important

The 2002 Immigration and Refugee Protection Act (IRPA) is the legal federal framework for immigration and refugee protection in Canada. Through implementation of theIRPA in over 70 missions (embassies, consulates, High Commissions) worldwide, CIC employees manage access to Canada through receiving and processing applications for permanent and temporary residence.

The operating environment in which overseas immigration staff conduct their duties can be challenging. Sound governance, risk management and quality assurance practices, and internal controls must be in place to ensure compliance with core legislative, policy and operational requirements, as well as stewardship of funds and safeguarding of key assets.

Key Findings

Improvements to the governance framework are required to ensure that roles, responsibilities and accountabilities are all clearly documented, and that budget allocations are not exceeded without approval for additional funding from the CIC Operations Sector. The importance of values and ethics was understood and promoted within the mission, and the mission is encouraged to communicate regularly with staff regarding potential conflicts of interest.

Risk management and quality assurance mechanisms are in place at the mission, but they could be strengthened by requiring documentation on mitigating strategies in the templates developed for missions by the Operations Sector. Assistance is required from the CIC Operations Sector to complete regularly scheduled quality assurance exercises at the mission with the level of independence required for these activities.

Improvements have begun and continue to be required for the internal control framework to ensure that manual cost recovery and forms management procedures comply with operational guidance. Updated templates should be put in place at the mission to ensure that travel, hospitality, and overtime expenditures are pre-approved as required by policy and the Financial Administration Act.

Conclusion

The governance framework at the mission for administering the Immigration Program requires improvement. The risk management practices and quality assurance practices at the mission require improvement, with assistance from the CIC Operations Sector. The mission’s internal control framework for administration, financial, and operational activities related to the Immigration Program requires improvement.

Statement of Assurance

The conduct of this engagement conforms with the Internal Auditing Standards for the Government of Canada, as supported by the results of the quality assurance and improvement program. We examined sufficient, relevant evidence to support the conclusions reached.

Introduction

Delivery of Canada’s Immigration Program abroad is the responsibility of the International Region (IR) in the Operations Sector at National Headquarters and its network of visa offices at missions abroad. The IR manages an overseas workforce of 1,300 immigration mission employees consisting of public servants and Locally Engaged Staff (LES) who screen and process applicants for admission to Canada. Application types include permanent resident visas (for family class and economic class immigrants, refugees and protected persons); temporary resident visas (for foreign students, visitors and temporary workers); and other immigration documents, such as permanent resident travel documents, temporary resident permits and authorizations to return to Canada.

In addition to facilitating admission to Canada and providing operational support to mission staff, the IR is responsible for non-Immigration Program activities, such as resource management administration, performance analysis and reporting, liaising with foreign governments and program delivery partners. The IR is supported by other branches within CIC in the development of policy and procedures, program integrity activities, and information technology systems. Administrative services in missions abroad are provided by the Department of Foreign Affairs and International Trade (DFAIT) under the terms of a Memorandum of Understanding.

Environmental Context of the Mission

The Lagos mission provides citizens of Nigeria with temporary resident immigration services and other non-immigration application processing, such as permanent resident travel documents. All permanent resident (PR) applications from Nigeria are processed in Accra, Ghana. The Lagos mission also oversees temporary resident services for fee-exempt diplomatic, military and government officials of Nigeria and other foreign countries, and remote printing services at the Canadian High Commission in Nigeria’s capital, Abuja.

The mission is small and has the highest rated level of hardship—five out of five—according to DFAIT’s classification system. The Immigration Program is staffed with seven immigration full-time equivalents: two Canada-based Officers and five LES. Given the small size of its staff complement, Emergency LES (ELES) are regularly employed, and Lagos is a priority for Temporary Duty support. There was 100% turnover for the two CIC and two DFAIT Canada-based staff at the mission in 2012.

During the audit period of September 1, 2011 to August 31, 2012, the Lagos mission received approximately 19,043¹ temporary resident (TR) applications and finalized 15,788 cases. The processing time for visitor applications doubled from 14 to 28 days between 2009 and 2011 due to a number of factors, including an intake increase and the introduction of the Global Case Management System (GCMS). Political tensions arose as a result of this increase in processing times, but they have since quieted because the mission has reduced the backlog from 5,000 to 1,739 (as of February 7, 2013).

Reliability of applicant information, particularly identity and family composition, is a consistent challenge for the mission, and there has been a noticeable increase in the use of forged documents in applications in recent years. The approval rate for temporary resident applications in Lagos for 2012 was 50%.

Findings: Governance

We expected to find that roles, responsibilities and accountabilities for the Immigration Program were clearly defined and communicated; that financial and human resources were planned and managed to support program delivery; and that public service values and ethics are promoted, documented and understood within the mission.

Roles, Responsibilities and Accountabilities

We expected to find that roles and responsibilities for all areas of the Immigration Program were clearly defined and communicated in the mission. We also expected to find that financial accountabilities for the Immigration Program and designated authorities for decision-making under the IRPA were appropriate within the mission.

We found that the Immigration Program’s organizational structure is clear and understood, and that the Immigration Program staff members actively participate in the governance of the mission through its various committees in Lagos and Abuja. Standard operating procedures were not documented; however roles in the immigration section are understood and generally static, given the size of the mission. All immigration staff provided the new Immigration Program Manager with a written description of their responsibilities following the turnover of Canada-based staff in August 2012. Individuals assigned cost recovery duties were aware of their responsibilities, but not all had formally acknowledged them in writing as required by the CIC Cost Recovery Manual. This issue also arose in the report of the Audit of the Immigration Program at the Canadian Mission in Nairobi, and the entire network of overseas offices would likely benefit from a reminder of this requirement from the CIC Operations Sector. Training for the discharge of duties is provided to staff as needed, either due to operational requirements or to performance appraisals and informal quality assurance exercises. 

Given the small staff complement, Canada-based Officers and LES perform multiple duties that would be segregated in a larger mission. The Cost Recovery Clerk performs cost recovery duties and operates the immigration window. The roles and back-ups of the Forms Control Officer, Cost Recovery Officer, and CAIPS/GCMS Manager are shared between the two Canada-based officers. Mission management is aware of any risks these shared duties may present and has developed some undocumented mitigation strategies to address them. Please see Risk Management Findings for more details.

Accountabilities for decision-making were appropriate, and delegated financial authorities were established and documented. CIC staff with delegated authority sign both a CIC and DFAIT signature specimen card. CIC signature specimens had not yet been updated to include section 32 of the Financial Administration Act, in accordance with CIC’s most recent delegation of authority matrix, introduced following the audit period. A recommendation to the CIC Operations Sector regarding the clarification of delegation of authorities is included in the concurrent report on the Audit of the Immigration Program at the Canadian Mission in Nairobi; therefore, no recommendation will be made in this report.

Recommendation 1 (Low Risk):

The Lagos mission should ensure that all individuals assigned cost recovery duties read and acknowledge in writing the Cost Recovery Instructions and Undertaking for their respective role. 

Resource Management

We expected to see that processes were in place to ensure that financial and human resources were planned and managed to support program delivery and that program performance tracking informs decision-making and resource allocation.

Weaknesses were observed in the budget planning and management processes during 2011–12. Budget estimates were submitted and approved through the annual International Region Integrated Management Plan (IRIMP) process. Overtime estimates were provided as part of the original 2011–12 IRIMP submission and they were exceeded. Additional funding was not requested by the mission nor was it granted; however, Canada-based Officers continued to accumulate and be remunerated for overtime until the 2011 fiscal year end. Mission-level controls for pre-approval of overtime by the Area Director were implemented in the following fiscal year 2012–13. Inconsistency in the documentation of pre-approvals for overtime was also noted in the concurrent Audit of the Immigration Program at the Canadian Mission in Nairobi; therefore, this issue may be systemic in nature and merit further investigation by the CIC Operations Sector.

Planning and management of human resources for the mission is challenging. Given its small staff complement, the mission requires frequent temporary duty support and ELES funding to process the volume of applications it receives and to perform cost recovery, forms control and governance duties. The mission requests Temporary Duty support, ELES funding, and additional resources at various points in the year when call letters are sent out to missions. Officers also frequently work overtime, although this is not a sustainable method of program delivery. Program performance tracking is being done and reported to National Headquarters while the mission clears its backlog.

Recommendation 2 (Medium Risk):

The CIC Operations Sector should examine controls in place to avoid exceeding mission budget allocations without pre-approval. 

Values and Ethics

We expected to see that the Immigration Program staff has been made aware of and acknowledged in writing their obligations regarding values, ethics and conflict of interest.

Signed codes of conduct were on file for all Immigration Program LES and ELES staff employed in August 2012. The importance of values and ethics was communicated by the current Deputy High Commissioner during a recent mission all-staff meeting, and current LES and ELES understand their obligations.

Findings: Risk Management and Quality Assurance

We expected to find that mechanisms were in place to identify, mitigate, and monitor risks to the Immigration Program, and that resource allocation was informed by this assessment. We also expected to find that the mission conducts quality assurance exercises and uses the results of these reviews to improve operations.

The mission provided a general overview of risks in its IRIMP and managerial checklist, a questionnaire designed by the CIC Operations Sector to help identify risks in missions, although missions are not required to identify mitigating actions for these risks. Given the rotational nature of mission staffing, there is a risk that if these mitigation strategies remain undocumented, they will be lost or have to be recreated in the event of staff turnover. Current management has put some mitigating procedures in place, but this information has yet to be documented. A recommendation to the CIC Operations Sector to require documentation of risk mitigation strategies is included in the concurrent Audit of the Immigration Program at the Canadian Mission in Nairobi; therefore, no recommendation will be made in this report.

The Immigration Program staff had completed its critical function sheets as required for business continuity planning purposes. The mission’s emergency plan, which includes mission-wide business continuity planning and is the responsibility of DFAIT to complete in consultation with its partners, was being developed at the time of the audit.

The mission did not conduct any formal quality assurance exercises during the audit period; however, with only two Canada-based Officers on-site, it is difficult to achieve the independence required for quality assurance activities without help from National Headquarters or the region. Some informal quality assurance is performed on student and worker files, as the bulk of the application assessment is completed by LES and forwarded to Canada-based officers for review, admissibility, and final decision.

Measures are in place to ensure proper tracking of files received from and sent to Visa Application Centres (VACs), but no formal quality assurance is done on the services provided. Until VAC quality assurance procedures for missions are released by National Headquarters under the upcoming global contract, issues will continue to be addressed by the mission’s VAC liaison.

Recommendation 3 (High Risk):

The CIC Operations Sector should develop a solution to facilitate quality assurance activities in the missions that lack the capacity or independence to do so autonomously.

Findings: Internal Control Framework

We expected to find that controls for administrative, financial and operational activities, including access to the immigration work space and systems, application processing, controlled documents, cost recovery and administrative expenditures, were in place at the mission to ensure compliance with legal, policy and operational requirements.

Systems and Work Space Access

We expected to find that access to and use of the mission’s Immigration Program systems were appropriate and that the work space was secure.

Access to GCMS is appropriate and in accordance with position requirements at the mission. The mission participates in a regional strategy under which all GCMS Managers in Africa have access to each other’s office to act as back-up if required or to provide processing assistance to the mission in the event of a local GCMS outage.

Access to the cost recovery Point of Sale system (POS+) and the forms management inventory system, Controlled Key Forms Inventory Tracking System (CKFITS), was appropriate and consistent with operational guidelines, designated authorities, and position requirements at the mission. The POS+ system archiving was not performed during the audit period, which resulted in a large backlog of information and may have caused system errors at the mission, such as loss of data. The current Cost Recovery Officer has initiated the required maintenance to resolve the issue.

Access to the immigration work space, records and key information is limited to authorized individuals through the Intrusion Detection Access Control System (IDACS), and codes, as required. The immigration section is also located on the same floor in the operational zone with DFAIT administration; however, non-immigration staff members have been asked not to enter the immigration area without a specific purpose. The layout of the office makes supervising staff difficult, as there are many blind corners and alcoves. The layout has been identified as a significant risk by the mission and requires coordination to ensure that one of the two Canada-based Officers is always within the immigration work space during working hours. All immigration staff have access to the Cost Recovery Clerk’s office and its contents, including records of revenue and cheques during the work day, because the office also functions as the immigration window. This arrangement presents an opportunity for collusion between clients and staff. Current management has put some mechanisms in place to mitigate this risk, but these strategies remain undocumented. A recommendation to require documentation of mitigation strategies in mission risk management templates is included in the concurrent Audit of the Immigration Program at the Canadian Mission in Nairobi; therefore, no recommendation will be made in this report. 

Access to the high-security zone and deep storage vault is restricted through IDACS, overseen by mission security, and cell-phones are not permitted in that area. The working storage safe, which holds the daily supply of counterfoils, is located in the Immigration Program Manager’s office. The code for the working safe is shared by both Canada-based Officers, but once opened in the morning the safe is not secured again during the day, which presents the potential for theft.

Recommendation 4 (Medium Risk):

The Lagos mission should perform regular maintenance on POS+, as required by operational procedure, to ensure proper functionality of the system, per the POS+ system manual. 

Recommendation 5 (High Risk):

The Lagos mission should ensure that working safes are kept locked during the day to restrict access to controlled documents.

Application Processing

We expected to find that standard procedures were in place for processing TR and permanent resident travel document (PRTD) applications, that key decisions were made by the appropriate authority, that applications were complete, and that files were adequately documented.

Standard documented procedures were not in place for processing TR or PRTD applications, although work on those procedures has begun and immigration LES have all recently documented their application processing duties. Any changes or updates to operational procedures are communicated at immigration staff meetings or by email to the immigration section.

For all TR and PRTD files reviewed, eligibility, admissibility and final decisions were made by individuals with the designated authority to do so, and documentation on file and in case notes for most files was adequate to support compliance with relevant legislation, policies and procedures. For some files for which a legal representative was used, such as an immigration consultant, this information was not noted in the GCMS, as required.

Recommendation 6 (Medium Risk):

The Lagos mission should continue to develop and implement standard procedures for application processing to ensure consistency in processing and documentation.

Cost Recovery

We expected to find that controls were in place at the mission to ensure that immigration revenues are safeguarded and that cost recovery activities are performed in compliance with applicable legislation, policy and standard operating procedures.

Cost recovery revenue at the Lagos mission is all reconcilable, such as bank drafts and certified cheques. New procedures were put in place upon arrival of a new cost recovery officer at the end of the audit period; additional improvements are required to ensure compliance with legislation, policy and procedures. The Controls Over Revenue – Attestation Checklist had not been completed by the IPM and the DFAIT Management Consular Officer at the time of the audit.

Some control weaknesses were observed in the recording and processing of transactions, specifically for voids. During the audit period, a copy of the void receipt and the reasons for voids were lacking in the physical file and in the system notes. Moreover, there was no officer signature for two of the daily reconciliations performed that included voids, even though it is standard procedure for the Cost Recovery Officer to sign the daily reconciliation forms upon completion. Although no refund payments fell under the audit scope, a walk-through of the CIC portion of the process was reviewed and found to be appropriate.

Reconciliation and certification of immigration revenues procedures were performed during the audit period, as required.

Recommendation 7 (Medium Risk):

The Lagos mission should ensure the Controls Over Revenue – Attestation Checklist is completed and signed by the Immigration Program Manager and DFAIT Management Consular Officer in compliance with the joint DFAIT and CIC Standard Procedures for Fee Collection.

Recommendation 8 (Medium Risk):

The Lagos mission should ensure that application payment voids are appropriately documented and verified by the Cost Recovery Officer.

Controlled Documents

We expected to find that standard procedures were in place to ensure the safeguarding and handling of controlled documents, such as visa counterfoils and seals, in accordance with the forms management program.

Expected forms management procedures, as per functional guidance, were not in place during the majority of the audit period. New procedures had been developed and implemented by the current Forms Control Officer at the time of the audit, but require further improvement.

Control weaknesses over the management of forms were observed. No daily sign-out and sign-in log for the printing of counterfoils was in place during the audit period. Counterfoils were removed from the safe in the exact amount required for batch printing; however, the counterfoils removed from the safe were not recorded in a log. Manual records were maintained to trace counterfoils used and cancelled, although an inventory count revealed that the number of seals recorded in the CKFITS was overstated because the missing serial numbers were not identified in the system. In addition, transfers and receipt of forms at the mission were not consistently signed or dated by the Forms Control Officer and witness, as required by policy and procedures. Further, reasons for the transfer were not documented as required by the Forms Management Policy and Procedures, and there is no field on the Certificate of Destruction/Transfer/Receipt of Transferred Immigration Key Control Form (IMM-5448B) to provide this information.

Quarterly inventory reporting was completed by the mission during the audit period; however, weaknesses were identified in the electronic tracking and quarterly reporting functions in the CKFITS, resulting in unreliable electronic records. The calculation of amounts transferred to and from the Lagos mission did not match the physical records on site. Although all counterfoils and seals were accounted for during the on-site inventory count, transfers required confirmation through packing slips, manual records, and discussions with Forms Management at National Headquarters. The unreliability of the CKFITS was also observed in the concurrent Audit of the Immigration Program at the Canadian Mission in Nairobi and a recommendation to the CIC Operations Sector to resolve the issue is included in that report; therefore, no recommendation will be made here.

Recommendation 9 (Medium Risk):

The Lagos mission should ensure that standard procedures for forms management are implemented, including signing for the receipt of forms and transfers between missions.

Administrative Expenditures

We expected controls to be in place to ensure that travel, hospitality and overtime expenditures are managed in compliance with the applicable policies, regulations and collective bargaining agreements.

Some weaknesses in controls over travel, hospitality and overtime expenditures were observed. Supporting documentation for travel transactions—one travel authority and advance and one claim—were not available for review during the on-site examination. Justification for hotel expenditures above city limit rates and additional per diem expenditures were not on file. Further, an updated Travel Authority and Advance form, which clarifies the authorization of expenditures according to section 32 of the Financial Administration Act and which was introduced during the audit period, had yet to be used at the mission.

Quarterly and annual hospitality advances provided to the IPM were approved by the Head of Mission, as required, but no details or estimates for events were included as justification for the advance. DFAIT’s Official Hospitality Outside Canada policy states that all hospitality advances should be supported by an appropriate justification.

Pre-approvals for overtime were not documented by the mission in 2011–12, which resulted in the mission’s exceeding its budget allocation for overtime. For a portion of 2012–13, overtime claims were submitted to the Area Director for approval prior to submission for payment; however, overtime hours had already been accumulated. New procedures have been put in place while the backlog is being cleared by the mission. The current Immigration Program Manager provides an estimate of the hours required to the Area Director prior to incurring overtime and these are approved. The mission is encouraged to continue this practice after it has cleared its backlog.

During the audit period, immigration section LES and ELES were not hired and managed in compliance with applicable policies and directives. Evaluation criteria, assessments and job descriptions were not on file for all individuals. ELES contracts were extended beyond the maximum 125 days without approval from the Head of Mission , resulting in potential financial repercussions for CIC. Further, documented performance appraisals for LES were not on file for the audit period. Current Lagos DFAIT and CIC mission management has ensured that appropriate controls for the hiring of LES have been put in place at the mission.

Recommendation 10 (High Risk):

The Lagos mission should ensure that administrative expenditures are pre-approved in accordance with the Financial Administration Act and applicable policies.

Appendix A – Lagos Processing Summary 2009–2012

Appendix B – Detailed Audit Criteria

The sources of criteria for the audit are based on Citizenship and Immigration legislation, policies, guidelines and procedures, and on the Office of the Comptroller General Audit Criteria related to the Management Accountability Framework.

Objective 1: To assess the adequacy of the mission’s governance framework for administering the Immigration Program.

Criterion 1.1

Roles, responsibilities and accountabilities for the Immigration Program are clearly defined and communicated.

• A clear organizational structure is established, documented, and communicated.
• Roles and responsibilities have been determined and documented.
• Delegated financial authorities have been established and documented.
• Designated decision-making authorities are appropriate.
• Staff are provided with the appropriate training in order to discharge their responsibilities.

Criterion 1.2

Resources are planned and managed to support Immigration Program delivery.

• Processes are in place for budgeting and program resource allocation.
• A framework is in place for planning and managing human resources to meet program delivery requirements.
• Program performance information is gathered and used to support decision-making, resource allocation, service standards and achievement of targets.

Criterion 1.3

Public service values and ethics are promoted within the mission, documented, and clearly communicated.

• Staff are made aware of their obligations regarding values, ethics and conflict of interest.
• Processes are in place at the mission to deal with malfeasance and conflict of interest issues.

Objective 2: To assess the adequacy of the mission’s risk management and quality assurance practices to support the delivery of the Immigration Program.

Criterion 2.1

Risk management practices are integrated into mission operations and support the maintenance of program integrity.

• Mechanisms are in place to identify and mitigate risks to the Immigration Program.
• Risks are periodically monitored throughout the year.
• Risk information informs operational and financial decision-making.
• Business continuity planning for the Immigration Program is in place at the mission.

Criterion 2.2

Quality assurance measures, including oversight of third-party service providers, are in place at the mission level to support program integrity.

• Quality assurance and control mechanisms for program activities have been identified and implemented in the mission.
• Quality assurance activities for thirdparty service providers have been established and implemented.
• Issues arising from quality assurance activities are periodically reported to NHQ.

Objective 3: To assess the adequacy of the mission’s internal control framework over administration, financial and operational activities related to the Immigration Program.

Criterion 3.1

Controls are in place to ensure appropriate access and use of the mission’s Immigration Program systems and a secure work space.

• Access to and use of GCMS/CAIPS is consistent with operational guidelines, designated authorities and position requirements at the mission.
• Access to and use of POS+ is consistent with operational guidelines, designated authorities and position requirements at the mission.
• Access to other applicable systems is consistent with operational guidelines, designated authorities and position requirements at the mission.
• Access to the immigration work space and controlled information and records is limited to authorized individuals.

Criterion 3.2

Controls are in place to ensure that immigration applications are processed in accordance with applicable legislation, regulations, policies, and standard operating procedures.

• Standard application processing procedures, which incorporate applicable requirements, have been established and implemented at the mission.
• Applications are complete and required supporting documentation is maintained.
• Key decisions are in compliance with designated authorities.
• Warrants and loans are granted to applicants in accordance with program terms and conditions. 

Criterion 3.3

Controls are in place to ensure that revenues are safeguarded and that cost recovery is performed in compliance with applicable legislation, policy, and standard operating procedures.

• Standard procedures for cost recovery have been established and implemented at the mission.
• Cost recovery transactions are processed and recorded according to standard procedures.
• Reconciliation and verification is performed periodically, in accordance with standard procedures.

Criterion 3.4

Controls are in place to ensure the safeguarding and handling of controlled documents in accordance with the forms management program.

• Standard procedures for forms management have been established and implemented at the office. 
• Inventory is managed and securely stored in accordance with program guidelines.
• Quarterly and periodic verification and reporting exercises are completed as required.

Criterion 3.5

Controls are in place to ensure administrative activities are conducted in compliance with applicable policies and regulations.

• Travel expenditures are managed in compliance with applicable legislation and policies.
• Hospitality expenditures are managed in compliance with applicable legislation and policies.
• Overtime expenses are approved and paid in compliance with applicable legislation and guidelines.
• Other expenses are approved and paid in compliance with applicable legislation and policies.  (as applicable for special expenditures)
• Employees are hired and managed in compliance with applicable legislation and policies.

Appendix C – Management Action Plan