Audit of the Case Processing Centre - Mississauga

Audit Report
Internal Audit and Accountability Branch
Citizenship and Immigration Canada
October 2008

Table of Contents

• 1.0 Introduction
  • 1.1 Background
  • 1.2 Preliminary Assessment
  • 1.3 Comments from Management
• 2.0 Financial Audit
  • 2.1 Audit Objective
  • 2.2. Audit Criteria
  • 2.3 Audit Scope
  • 2.4 Audit Methodology
  • 2.5 Audit Conclusion
• 3.0 Observations and Recommendations
  • 3.1 Management Controls
  • 3.2 Expenditure Management
  • 3.3 Revenue Management
• Appendix A — Summarized Organization Chart for CPC Mississauga
• Appendix B — Detailed Criteria for the Audit
• Appendix C — Control Self-Assessment
• Appendix D — Audit Time Lines

1.0 Introduction

The Internal Audit and Accountability Branch developed a Risk-based Audit Plan that identified engagements to be undertaken by weighing a combination of departmental priorities and risks. Based on this analysis, an audit of the Case Processing Centre (CPC) Mississauga was to be undertaken in 2007–2008 with the objective of assessing the adequacy of the management control framework.

1.1 Background

CPC Mississauga opened for full processing in April 1994 and is responsible for:

• processing all family class sponsorship applications from Canadian citizens and permanent residents living in Canada or overseas who wish to sponsor close family members living abroad;
• managing the inventory of unprocessed parent and grandparent sponsorship applications;
• ensuring that Citizenship and Immigration Canada (CIC) upholds its commitment to the provinces to deter sponsors from defaulting on their sponsorship obligations;
• ensuring that the sponsorship eligibility information assessed at CPC Mississauga is conveyed to visa offices abroad for inclusion in their evaluation of a sponsored relative’s Application for Permanent Residence under the Family Class;
• participating in sponsorship information exchange and enforcement initiatives with provincial ministries responsible for social assistance programs, as the central repository for family class undertakings in the context of debt recovery and sponsorship defaults.

The primary objective of the CPC is to maintain a balance between faster processing and program integrity. This objective forms the basis of the CPC’s activities, which involve processing applications for 60,000 spouses and dependent children, and 7,000 parents and grandparents annually. B-based funding was received in 2007–2008 to process additional applications for 14,500 parents and grandparents for a total of 21,500  parents and grandparents.

Table 1 provides information on the revenue, budget, employees, and number of applications received and processed, as well as the inventory at the CPC since 2005–2006.

Note 1 – Data for 2007–08 is as of 31 December 2007 (except FTEs, which are as of 30 September 2007)

The CPC organization comprises one Director, a Corporate Services Manager and an Operations Manager who manages five processing teams; each processing team is supervised by an Operations Coordinator. The administration section, under the Corporate Services Manager/Chief Financial Officer, is responsible for providing financial and human resources support. The Manager of Corporate Services also manages the mailroom operation. An organizational chart is found in Appendix A.

1.2 Preliminary Assessment

During the planning phase of this engagement, a preliminary assessment was conducted of governance, risk management and control processes, by reviewing documentation and conducting a site visit of the CPC on 17–18 October 2007. In order to conduct this assessment, we reviewed the following areas of the management control framework: governance and strategic direction; accountability; citizen and client-focussed service; risk management; people/human resources; values and ethics; stewardship; results and performance; and learning, innovation and change management.

1.2.1 Governance and Strategic Direction

The organizational structure is clear, and operational accountabilities and responsibilities are clearly delegated and communicated. The CPC business plan outlines annual operational targets which are translated into processing targets for staff and included in their performance agreements. All staff interviewed were aware of the processing targets. The CPC has protocols in place with all external stakeholders.

Internal service standards have been established, and processing times are published on the CIC website. All inquiries are dealt with through the Client Service Unit (CSU), which maintains statistics on each type of inquiry.

The management team indicated that they had all received training on values and ethics; issues pertaining to values and ethics are also raised regularly in unit team meetings and management team meetings as they arise. In addition, ethical dilemmas are discussed during formal training for new processors.

Processing targets are based on a time study conducted with the introduction of the family class redesign in 2002, and have been in use since then. All staff interviewed felt that the targets were reasonable. The CPC system tracks the work being done by each processor, and supervisors monitor their team as a whole as well as individual team members. Supervisors produce reports to review the number and outcome of applications being processed by each employee on a weekly and monthly basis. Any significant errors are brought to the attention of the processor responsible for ensuring that this is not a recurring event.

The Operations Manager monitors the operational targets daily and produces a weekly report to all staff with guidance on the type of application to be processed over the course of the week, as well as the processing times. These monitoring reports are used to ensure consistency of practices and attainment of overall processing objectives.

The management team informally encourages staff to come forward with new ideas, and this is done on an ad hoc basis. Generally, solutions are found to address problems as they arise.

A human resource plan was developed in accordance with departmental direction. Pay and benefits are managed by the CPC, while staffing support is provided by the Ontario Regional Headquarters. The main challenge is retention of staff, as well as the nature of the staffing process. The CPC has allocated funding to pay for this support.

The CPC has a training program for processors, and coaching and monitoring is performed. Staff interviewed felt that the training they had received was sufficient.

1.2.2 Risk Management

The CPC considers risk as part of the business planning process and then communicates this risk to management. Resource allocation is affected by the risks identified in the business plan; the B-based funding provided to allow the processing of FC4 applications provides evidence of this linkage. Beyond this annual assessment, there is an ongoing risk management process within the CPC; however, it is not formally documented. The management team feels that this process is sufficient because the nature of the work is fairly stable.

In terms of risk exposures relating to the organization’s governance, operations and information systems, the governance processes described above and the controls described below mitigate the risks inherent in these areas.

1.2.3 Controls

The final area that we examined as part of the planning process was the adequacy and effectiveness of controls over program integrity and finance.

In relation to program integrity, National Headquarters (NHQ) conducted a Quality Assurance (QA) review of sponsorship applications in March 2007 that involved a review of a sample of 453 files to verify the accuracy of the recommendations rendered by CPC Mississauga and ensure that applications were being processed within the policy and legislative framework. The review concluded that “the CPC staff is diligent in applying the Immigration and Refugee Protection Act and Regulations as well as maintaining program integrity.” It is the intention of those responsible for the QA program at NHQ to conduct this type of review regularly.

In order to assess whether we could rely on the results of the QA exercise, we reviewed the methodology used to conduct it. As well, we reviewed, on a random basis, 22 files that had been reviewed during the QA exercise to ensure that the applications were being processed within the policy and legislative framework. Our findings concurred with those of the QA review on each file examined.

In addition to the QA review, controls include the review of all applications where the outcome is “not met,” and the review of a random sample of applications that are returned to the client (for various reasons, such as missing documents) to ensure that the decision is appropriate. These review practices, in addition to the QA process, demonstrated strong controls in the area of program integrity to mitigate the risk of operational non-compliance. Consequently, as a result of strong monitoring of QA practices, the audit team did not undertake further testing with respect to program integrity.

In relation to financial controls, the Finance Branch conducted a financial assessment in 2002. It reviewed all major elements of financial management including budgeting and reporting, management of transfer payments and operating funds, and control over physical assets. Since that time, no further review has been conducted. Consequently, it was decided that an audit was required to review the current financial control framework.

The audit team decided to conduct an audit of financial controls. The criteria associated with each element of the audit can be found in Appendix B.

While at the CPC, the audit team also decided to conduct a Control Self-Assessment (CSA). The objective, methodology and results of the CSA are presented in Appendix C.

1.3 Comments from Management

Managers at CPC Mississauga concur with the report as presented with the addition of the following comments on the financial audit and the CSA.

Financial management practices and controls at CPC Mississauga are in compliance; therefore, no further action/follow-up is required.

During the CSA, a number of suggestions and/or recommendations were discussed and evaluated in regards to the effective management of processing and program integrity.

It was determined that the triage unit for processing parent and grandparent (FC4) applications would not be piloted. After further review, it was concluded that the delays (time frames) in processing could be contributed to other factors. While inventory reduction would necessitate the processing of this particular family class more efficiently, no additional funding has been allotted to reduce the FC4 inventory at present. It should be noted that the delays are not necessarily the result of “competing processing priorities” but due to the decision not to provide additional resources to reduce backlogs in this category. This pilot may be revisited at a future date if the resource allocation changes and/or additional funding is provided to reduce this inventory.

The two options discussed/suggested in regard to client inquiries have been implemented and are ongoing. The CSU responsibilities have been reorganized to shift some of the workload to individuals within the various processing units. The implementation of this reorganization has helped to clarify priorities within the CSU and has re-emphasized the need to rely on existing CIC resources (i.e., Call Centre) to deal with general and/or routine inquiries.

2.0 Financial Audit

2.1 Audit Objective

The objective of this audit is to determine whether CPC Mississauga’s financial management practices are compliant with applicable legislation, regulations and policy.

2.2 Audit Criteria

Criteria for each line of inquiry are derived from the Accounting Internal Control Framework, the Financial Policy manual and Financial Accounting manual. The Framework draws on the Financial Administration Act (FAA) and the Treasury Board policies on Delegation of Authorities, Commitment Control, Account Verification, and Receivable Management.

The primary criterion is compliance of financial management practices with applicable legislation, regulations and policy. Detailed criteria are found in Appendix B.

2.3 Audit Scope

The audit scope includes financial management, expenditure management and revenue management for the last quarter of 2007. Right of Permanent Residence Fee  refunds resulting from the rate reduction have been excluded from the scope of the audit as we examined these in another audit in 2007.

2.4 Audit Methodology

There were three lines of inquiry: management, expenditure management and revenue management. As part of our examination of these areas, we reviewed documentation and performed audit tests of a sample of financial transactions, where appropriate, and met with staff to gather and confirm information.

The audit was conducted to be in accordance with the Government of Canada’s Policy on Internal Audit as well as auditing standards set out by the Institute of Internal Auditors.

2.5 Audit Conclusion

The audit found that CPC Mississauga’s financial management practices are compliant with applicable legislation, regulations and policy. Specifically, we found that:

• management controls were in place;
• controls were in place to ensure expenditures are processed in compliance with applicable policies; and
• controls were in place to ensure that revenues are collected.

3.0 Observations and Recommendations

3.1 Management Controls

As part of our review of the management controls in place over financial administration at CPC Mississauga, we examined the appropriateness of accountabilities and the adequacy of managerial reviews. Consequently, we expected to find that:

• financial delegated authorities at CPC Mississauga were compliant; and
• sufficient review and monitoring were occurring.

To this end, we reviewed the CPC’s organization chart and authorities delegated at CPC Mississauga and compared these to the CIC’s chart of delegated authorities. Within the Government of Canada context, financial delegated authorities refer to granting individuals the ability to approve financial transactions. Our results found that all were in accordance with the CIC’s chart of delegated authorities.

Moreover, we found that appropriate segregation of duties was maintained to ensure that accountability is in place at the mission.

In discussions with CPC staff, we found that budgets are controlled and monitored by the management team. Management discusses operational plans and requirements in meetings, taking into account financial implications, and takes the necessary action. These are tracked in the Department’s administration systems.

As per the Department’s financial policy, the Chief Financial Officer at CPC is required to attest to the office’s adherence to financial policies. We therefore expected that the Chief Financial Officer would issue these certifications of conformity and that sufficient review of operations was occurring to support these certifications. As part of our audit, we therefore reviewed a sample of these certifications and a sample of the reviews to support these certifications.

We found that the Chief Financial Officer for CPC Mississauga made certifications as per the departmental policy with respect to frequency. Moreover, we found that the Chief Financial Officer would take a sample of expenditures and review them for compliance with applicable policies. This process produced similar findings to our testing of expenditures; therefore, we found this process to be adequate.

Consequently, the audit found that proper management controls were in place at CPC Mississauga.

3.2 Expenditure Management

The office’s expenditures can be split into two broad categories: salaries and non-salaries. As is evident from Table 2, the non-salary portion of expenditures account for a relatively small portion of total expenditures. The largest portion of non-salary expenditures is for postage (greater than 60 percent of the total for each of the three years 2005–06 to 2007–08), which is to be expected since the office must ship complete applications to missions around the world for further processing once a sponsorship application has been approved.

Note 1 – Data for 2007–08 is as of 31 December 2007

We expected that controls would be in place to ensure that

• appropriate approvals are obtained and funds are committed at the time the decision to purchase is made;
• a sufficient review of requests for payments is occurring and is appropriately approved; and
• sufficient documentation is maintained and payment is made by an authorized individual.

Discussions with management found that non-salary expenditures can originate in the following manner:

• purchase order – expenditures entered into through a contract or standing offer;
• acquisition card – used to purchase low-dollar items using a corporate credit card. Only two individuals have this capability at CPC Mississauga; and
• pre-approval – in the case of travel and hospitality expenditures, expenditures must be pre-approved by an individual with delegated authority.

As part of our audit, we reviewed a sample of expenditure claims paid in the last quarter of 2007. For these types of purchases, there were 24 payments made against a purchase order, eight acquisition card purchases and 30 travel claims made in the final quarter of 2007. There were no hospitality claims made during this period. We selected the three largest dollar-value claims for each category as part of our sample, as presented in Table 3. In the case of the acquisition card purchases, we selected the largest dollar value purchase on the statement for each of the three months in the period.

In the case of purchase orders and travel claims, we found that normal approvals had been obtained prior to the commitment in accordance with policies. Due to the nature of acquisition cards, this was not a criterion for these expenditures. We also found that for all sample items, appropriate review and authorizations were done and that sufficient documentation was on file to support the claims when they were being processed and when payments were being issued.

We therefore found that controls are in place to ensure expenditures at CPC Mississauga are processed in compliance with applicable policies.

3.3 Revenue Management

CPC Mississauga collects revenues for applications for permanent residence in the family class category from overseas. These fees include the fee for application for sponsorship, application for permanent residence and the right of permanent residence. The majority of these revenues are collected through an in-Canada electronic payment system known as the Handling of Public Money (HPM). Under this process, payments are made at a Canadian financial institution or online by credit card. Applicants are then provided with an HPM receipt for submission with their application, which is later matched up with electronic financial records to ensure that the receipt is genuine and that it has not been previously submitted by one of the three CPCs (located in Mississauga or Vegreville for immigration applications, or Sydney for citizenship applications). This process is managed by NHQ and, consequently, this review did not test this process. The CPC’s responsibility with respect to the HPM system is to record receipt of these payments and allocate them as applications are received and processed by updating their status in the HPM system via the case processing system.

These revenues are uploaded daily from the CPC database to the central database at NHQ. If there are issues resulting from inappropriate actions by a CPC, an error message is generated and staff at NHQ resolve the issues, working with CPC staff where appropriate. We examined resolution procedures in place to ensure data recorded by CPC Mississauga are loaded into the central database at NHQ. Our audit found no discrepancies.

We were advised by the CPC that applicants occasionally send payment for fees by a means other than HPM. For client service reasons, the application is accepted and revenues are processed. Consequently, we expected that there would be appropriate controls to ensure that:

• funds received were appropriately safeguarded between time of receipt and recording in the financial system;
• funds were accurately recorded and traceable to the applications; and
• funds were transferred to administration and deposited in the bank in a manner which maintains accountability.

To this end, we reviewed and documented the process to collect these payments and found them to be appropriate. We also tested a two-week period for the collection of payments and found that sufficient controls are in place and functioning as intended. In a financial assessment of the office carried out by NHQ Finance in 2003, two recommendations were made in the area of physical controls over non-HPM payments. Our review found that these two recommendations had been implemented.

In the collection of revenues, applicants may submit payments in error that will result in the requirement to issue refunds. Reasons for refunds vary on a case-by-case basis and can be initiated by the CPC, in the case of an overpayment, or by the applicant, in the case of a change in processing service. We note that the process in place to issue a refund at the time of our audit is different from the process in place at the time of the financial assessment carried out in 2003. As part of our audit, we reviewed controls over this process at CPC Mississauga. Refunds at CPC Mississauga are generally processed by the office, with payment issued by NHQ in Ottawa. In this scenario, the CPC staff reviews the claim to ensure there is sufficient cause to issue a refund and a refund has not previously been issued. This is done by processing staff with delegated authority to authorize a refund (from section 20 of the Financial Administration Act). Once approved by the CPC processing staff, CPC administration staff authorizes the payment, and NHQ Finance issues the actual payment to the client.

We expected that in processing refunds:

• verification that a refund was justified was occurring;
• verification that a refund had not previously been issued was occurring; and
• the refund was approved by an authorized individual.

In the last quarter of 2007, CPC Mississauga issued 2,979 refunds, of which 360 were issued as a result of the rate reduction in the Right of Permanent Residence Fee and, consequently, were excluded from this audit. The refunds issued over this period are summarized in Table 4 below. We also found that, at the time of our audit, delegation of authority to authorize a refund had been given to 62 staff members at the CPC. All were in accordance with the Department’s chart of delegated authorities.

As part of the audit testing of controls in place over the issuance of refunds, we took a randomly drawn statistical sample (95 percent confidence interval with 1  percent error rate and 3 percent level of precision) of 43 refunds issued in this period to ensure the CPC was processing refunds appropriately. We found all refunds were compliant.

Consequently, we conclude that adequate controls were in place for the collection of revenues at CPC Mississauga.

Appendix A – Summarized Organization Chart for CPC Mississauga

(as at Sept. 27, 2007)

Text version: Organizational Chart

Appendix B – Detailed Criteria for the Audit

Line of Inquiry 1 – Management

The degree to which management controls over financial administration in place at CPC Mississauga comply with the Accounting Internal Control Framework will be assessed using the following criteria:

• Financial accountability is maintained at CPC Mississauga:
  • delegated authorities at CPC Mississauga are in compliance with the departmental delegated authorities as delegated by the Deputy Minister;
  • budgets are being adequately reviewed and monitored to support the discharge of delegated authorities.
• Procedures are in place to support the periodic letters of representation made by CPC Mississauga:
  • adequate monitoring and review of expenditures, revenue and financial transactions are occurring to support periodic representations;
  • periodic letters of representation are issued by CPC Mississauga in compliance with departmental requirements.

Line of Inquiry 2 – Expenditure management

The degree to which expenditure management practices at CPC Mississauga comply with the Accounting Internal Control Framework will be assessed using the following criteria:

• Initiation – adequate controls are in place to ensure compliance with section 32 of the FAA for expenditures at CPC Mississauga:
  • anticipated expenditures are committed at the time that the decision to purchase is made;
  • commitments and adjustments to commitments must be approved by a person with appropriate delegated authority; and
  • a periodic review of the appropriation balances is conducted using Integrated Financial and Materiel System (IFMS) fund reports to ensure that the future commitments are not expected to exceed the allotted funds.
• Account verification – adequate controls are in place to ensure compliance with section 34 of the FAA for expenditures at CPC Mississauga:
  • requests for payment are reviewed to ensure eligibility for payment;
  • individuals approving payment for expenditures have appropriate delegated authority.
• Payment approval – adequate controls are in place to ensure compliance with section 33 of the FAA for expenditures at CPC Mississauga:
  • requests for payments have been certified pursuant to section 34 and authorize the issuance of payment in accordance with section 33;
  • all entries included for payment are supported with the appropriate documentation;
  • there is a daily reconciliation of payment requests submitted to the Receiver General for cheque issuance with IFMS;
  • adequate monitoring is occurring to ensure the proper exercise of authorities.

Line of Inquiry 3 – Revenue Management

The degree to which revenue management practices at CPC Mississauga comply with the Accounting Internal Control Framework will be assessed using the following criteria:

• Adequate physical controls are in place to ensure the safeguarding of revenues collected by the CPC:
  • access is appropriate and updated to reflect organizational changes; and
  • physical controls are appropriate and take into account access, duties and forms of payment accepted.
• Processes and procedures in place at the CPC ensure that revenues are collected and recorded in accordance with departmental policy:
  • appropriate controls are in place to record the recovery of revenue;
  • funds are deposited daily and in accordance with the Receipts and Deposit of Public Money Regulations; and
  • staff are aware of their responsibilities with respect to the recording and safeguarding of revenues.
• An adequate review of revenues collected is occurring to prevent misappropriation of revenues collected:
  • periodic reconciliation is occurring between the bank statement and receipts collected; and
  • appropriate periodic monitoring of revenue collected is occurring.

Appendix C – Control Self-Assessment

Objective

The objective of the Control Self-Assessment (CSA) is to assess the CPC’s processes to determine the most effective way for it to meet its objective of maintaining a balance between faster processing and program integrity. Another objective of the CSA is to make recommendations to streamline processes, identify risks and develop appropriate mitigating controls.

Methodology

A CSA is a technique that involves the managers and staff in self-assessing their business processes and associated risks and controls, under the supervision of the auditor. The CSA technique is highly effective and efficient because it draws on the knowledge and experience of managers and staff to self-assess the adequacy and efficiency of the business practices. A CSA adds value by involving the “process owners” in improving the efficiency of their operations, as well as designing and maintaining control and risk systems.

The CSA included all operational procedures involved in processing sponsorship applications. The CSA was conducted with 10 participants from CPC Mississauga and two observers — one from the Case Processing Centre in Vegreville and one from the Permanent Resident Card Centre in Sydney. A workshop session took place over a half-day on November  28, 2007. The participants were asked to evaluate the efficiency of the business processes, the risks involved in achieving their business objectives, and the identification of internal controls designed to manage those risks. The final step was for participants to develop action plans to address the concerns and risks identified.

Results of the CSA

Application Receipt – The main issue discussed was the recognition that incomplete applications cause considerable delays in processing. CPC Vegreville undertook an inquiry to address this issue, and the outcome could eliminate considerable workload. Managers at CPC Mississauga will follow up on the results of the inquiry.

Application Processing – Generally, it was felt that applications for spouses/dependent children and adopted children are being processed efficiently. However, applications for parents and grandparents are subject to considerable delays as a result of competing processing priorities. There is currently a 25-month delay in processing this type of application from the date that the application is received to the date that it is processed. Because of this delay, applications often require additional documentation by the time they are processed. The CPC discussed the introduction of a triage unit as a pilot to review the potential efficiencies and determine how these could affect processing times

Client Service Unit – The Client Service Unit (CSU) receives all inquiries regarding case files. In an average month, the CSU receives approximately 800 inquiries. The participants assessed ways to increase efficiency in responding to these inquiries. Two options were discussed: rotation of staff through the CSU, and reorganization of the CSU function so that instead of having a single team to deal with inquiries, members of processing teams would process inquiries on behalf of their team. These options will be explored further subsequent to implementation of the pilot for the triage unit, which was considered the priority.

Conclusion

Overall, the participants in the CSA found a number of opportunities to improve the efficiency of the business processes. The CPC’s priority was to improve the efficiency in processing parent and grandparent applications by implementing a triage unit on a pilot basis. The improvement of feedback from the CSU on processing errors, and the possible reorganization of the function should also improve processing efficiency over the longer term. The decision not to respond to requests for information within the posted wait times will significantly reduce the workload of the CSU, thereby allowing more time for processing. The implementation of these actions should help the CPC meet its goal of more efficient processing while maintaining program integrity.

Appendix D: Audit Time Lines

Audit planning — December 2007

On-site examination — January 22 – 23, 2008

Clearance draft to CPC–Mississauga for comments — July 17, 2008

Management action plan finalized — July 29, 2008

Report reviewed by Audit Committee and approved by Deputy Minister — October 7, 2008