Audit of the Immigration Program at the Canadian High Commission in Singapore

Audit Report
Internal Audit and Accountability Branch
Citizenship and Immigration Canada
October 2010

Table of Contents

• Acronyms used in this report
• Executive Summary
• 1.0 Introduction
  • 1.1 Background
  • 1.2 Audit Risk Assessment
  • 1.3 Audit Objectives
  • 1.5 Audit Criteria
  • 1.6 Audit Scope
• 2.0 Audit Conclusions
• 3.0 Observations and Recommendations
  • 3.1 Governance Framework
  • 3.2 Risk Management
• Appendix A: Singapore Mission Organizational Chart
• Appendix B: Singapore Processing Summary
• Appendix C: Detailed Criteria for the Audit
• Appendix D: Management Action Plan
• Appendix E: Audit Time Line

Acronyms used in this report

Executive Summary

The Citizenship and Immigration Canada (CIC) risk-based audit plan for 2010–2013 provides for audits of missions abroad. The selection of the immigration program at the Canadian High Commission in Singapore was done in consultation with the International Region (IR) Branch at CIC national headquarters. The on-site field work was conducted from March 29 to April 9, 2010.

The Singapore mission is a Regional Program Centre (RPC) with satellite offices in Bangkok, Dhaka, Ho Chi Minh City and Jakarta. According to IR data, the mission has 36 full-time equivalents (FTEs). The mission processes the full range of immigration applications from residents of Singapore and Brunei and only permanent resident applications from residents of Bangladesh, Cambodia, East Timor, Indonesia, Laos, Myanmar (Burma), Thailand and Vietnam. Singapore is also assisting the mission in New Delhi with the processing of Bhutanese refugees currently located in Nepal.

The audit objectives were to assess the adequacy of the mission’s:

• governance framework for administering the Immigration Program;
• risk management processes and practices for supporting the program’s objectives; and
• internal control framework governing operational, administrative and financial activities.

The criteria used in the audit are based on Treasury Board and CIC applicable legislation, policies and directives.

We found that:

• The governance framework partially met our expectations because external partnerships that serve to extend the organization need to be strengthened;
• Risk management processes and practices met our expectations; and
• The internal control framework partially met our expectations, because improvements were required for operational activities.

The internal control framework partially met our expectations, because improvements were required for operational activities.

1.0 Introduction

The CIC risk-based audit plan for 2010–2013 provides for audits of missions abroad. The immigration program at the Canadian High Commission in Singapore was selected for auditing in consultation with the IR at CIC national headquarters. The on-site field work was conducted from March 29 to April 9, 2010.

1.1 Background

1.1.1 Operations

CIC recruits, selects and processes applications from foreign nationals who want to come to Canada temporarily or permanently and who will stimulate economic growth and enrich and strengthen the social and cultural fabric of Canadian society. Responsibility for those tasks lies with the Operations Sector, which is divided into domestic and overseas operations. Overseas operations fall under the responsibility of the IR and its network of visa offices (or missions) abroad.

There are three categories of visa offices or missions abroad: RPCs, full-service centres (FSCs), and satellites and specialized offices. RPCs and FSCs both deliver the full range of immigration services for the countries they serve, but RPCs also oversee satellite offices. The full range of immigration services includes the processing of permanent and temporary resident applications as well as other immigration applications, such as requests for travel documents or temporary resident permits. Satellites and specialized program offices do not deliver the full range of immigration services.

The Singapore mission is an RPC with satellite offices in Bangkok, Dhaka, Ho Chi Minh City and Jakarta. Consequently, the mission processes the full range of immigration applications from residents of Singapore and Brunei and only permanent resident applications from residents of Bangladesh, Cambodia, East Timor, Indonesia, Laos, Myanmar (Burma), Thailand and Vietnam. Singapore is also assisting the mission in New Delhi with the processing of Bhutanese refugees currently located in Nepal.

According to IR data, the mission had 36 FTEs as follows:

• Eight Canada-based officers (including one migration integrity officer and two medical officers [MOFs])
• Four locally engaged program (LEP) officers
• 24 locally engaged staff (LES)

Appendix A presents the mission’s organizational chart as of November 2009.

The majority of these employees are responsible for the direct processing of immigration applications. Due to changes introduced as a result of Bill C-50¹, the mission has received temporary funding for three FTEs and anticipates improved competitiveness in recruiting Singaporean nationals as permanent residents because of faster and more efficient processing. Singapore also includes specialized immigration activities located in select missions abroad. These include the Canada Border Services Agency through its Migration Integrity Unit involved in anti-fraud and interdiction activities that support program integrity in the Region, and the Medical Unit that oversees the medical screening of applicants for the Region. It is important to note that neither the Migration Integrity Unit nor the Medical Unit has the same geographic coverage as the Singapore immigration program or each other.

The mission’s current target for 2010 is 8,465 permanent residents, which is approximately 4% of the overseas total. As per the mission’s 2010–2011 International Region Immigration Management Plan, the majority of its permanent resident movement comes from two of the countries in its territory (Bangladesh and Vietnam). It has also become one of the largest refugee processing missions in the world. In 2009, the mission issued 1,933 permanent resident visas under its refugee movement, which was about 13% of the total for all missions for that time frame.

Appendix B provides a summary of the mission’s statistics for 2009, 2008 and 2007.

¹The Bill sought to modernize Canada’s immigration system by providing greater flexibility in processing new applications, especially from skilled workers. Under the Bill, the Minister would have the ability to issue instructions to immigration officers related to the processing of applications so that people with the desired skills and experience could be brought to Canada sooner.

1.1.2 Environmental Context

This section of the report highlights some of the operating environment issues which the mission faces. These are presented here for information purposes only and they do not reflect any particular order.

The mission management identified the following challenges related to the operating environment:

• The mission is responsible for a territory that covers 600 million people in 10 countries at vastly different levels of development;
• Area trips are frequent and include regular visits to refugee camps;
• The mission is responsible for processing one of the largest refugee movements to Canada;
• The main drivers of the permanent resident program are family class (spousal) applications from Vietnam, skilled worker applications from Bangladesh, and refugee processing from Bhutanese camps in Nepal;
• The RPC was one of two offices to receive temporary funding for the C-50 initiative;
• The mission has operated under the assumption that Bangladesh would be upgraded to a FSC and that this would result in the transfer of resources from Singapore to Dhaka. However, this plan was cancelled and is unlikely to be revived in the near future.
• The numbers in all temporary resident application categories have declined as a result of the global slowdown, but are expected to increase as the global economy recovers;
• Revenues collected by the mission have declined over the past few years due to a combination of decreased applications, transition plans for the creation of a new FSC in the Region, and a change in the application process as a result of the C-50 initiative.
• While the Republic of Singapore regularly ranks as one of the most transparent nations in the world, the rest of the territory the mission covers is far less transparent, with some areas being viewed as the worst in the world by media monitoring organizations;
• Fraud is prevalent in parts of the Region and includes the submission of genuine documents (including identity documents and passports) that have been fraudulently obtained; and
• Some of the countries in the Region remain fragile as a result of internal political pressures that may become push factors for those populations.

1.2 Audit Risk Assessment

On the basis of reviews and analysis during the planning phase and applicable elements of the Treasury Board Secretariat’s Management Accountability Framework and CIC’s Core Management Controls Framework, the following key risks were identified:

• Governance framework – There are risks that governance structures and processes may not be clearly defined, and results and performance not properly reported on.
• Risk management processes and practices – There are risks that critical events that could impact on the delivery of the Immigration Program have not been identified and appropriately assessed and mitigated.
• Internal control framework – There are risks that adequate controls are not in place for operational and administrative processes used to deliver the Immigration Program.

1.3 Audit Objectives

The audit objectives were to assess the adequacy of the mission’s:

• governance framework for administering the Immigration Program;
• risk management processes and practices for supporting the program’s objectives; and
• internal control framework governing operational, administrative and financial activities.

1.4 Audit Criteria

The audit criteria were based on applicable Treasury Board and CIC legislation, policies and directives. See Appendix C for the detailed criteria.

1.5 Audit Scope

The audit only involved operations at the Canadian mission in Singapore and did not examine activities carried out by satellite offices in the Region. The audit scope covered all significant aspects of CIC operations at the mission, as described in section 1.1.1 of this report. This included the full range of immigrant and non-immigrant program activities with associated financial and administrative components typically found in a full-service centre. The audit examined the activities of the mission from January 1, 2009, to the end of the on-site examination period on April 9, 2010.

1.6 Audit Methodology

There were three lines of enquiry:

• governance framework;
• risk management practices; and
• the internal control framework.

As part of our examination of the governance framework and risk management processes and practices, we interviewed Immigration Program staff and other mission staff with links to immigration operations, reviewed documents, observed processes, documented controls, tested information and reviewed samples of management files to test for compliance.

As part of our examination of the internal control framework, we examined controls over application processing, the Computer-Assisted Immigration Processing System (CAIPS), controlled documents, cost recovery, and travel and hospitality expenditures.

For our examination of application processing, we examined all decisions related to permanent resident determination travel documents, temporary resident and permanent resident cases and temporary resident permits finalized from January 1 to December 31, 2009, to test compliance with decision-making authorities. We interviewed Immigration Program staff and other mission staff with links to immigration operations, reviewed documentation, observed processes and documented controls. The audit also examined a judgmental sample of five permanent resident determination travel documents, 35 temporary resident cases and 40 permanent resident cases that were finalized between January 1 and December 31, 2009, to assess compliance with legislation, regulations and policy requirements in each case file. We determined the sample size based on processing volumes at the mission. Individual sample cases were selected randomly and were reviewed in order to validate findings from the interviews, reviews of documents and observation of procedures.

In examining other internal controls, we interviewed Immigration Program staff and other mission staff with links to immigration operations, reviewed documentation, observed processes and documented controls. Specifically, we examined CAIPS user profiles, tested CAIPS inventory controls, tested a sample of transactions involving the office's inventory of controlled documents, examined cost-recovery revenue controls, and reviewed a sample of travel and hospitality claims to assess the effectiveness of the controls in place.

As part of this process, the Head of Mission was briefed on our preliminary observations.

The audit was conducted to be in accordance with the Government of Canada’s Policy on Internal Audit and the professional practice standards established by the Institute of Internal Auditors.

2.0 Audit Conclusions

We found that:

• The governance framework partially met our expectations, because external partnerships that serve to extend the organization need to be strengthened;
• Risk management processes and practices met our expectations; and
• The internal control framework partially met our expectations, because improvements were required for operational activities.

The next section of this report contains detailed observations and recommendations.

3.0 Observations and Recommendations

3.1 Governance Framework

The audit examined six areas of the governance framework:

• governance and strategic direction;
• values and ethics;
• human resources management;
• client-focused service;
• results and performance; and
• learning, innovation and change management.

We expected to find that:

• accountabilities were appropriate;
• values and ethics were promoted and reinforced;
• the office was managed in a way that ensured an effective workplace;
• the services delivered by the office met client requirements;
• information on results was gathered, used to make decisions and reported; and that
• learning and development activities supported innovation and change management.

The governance framework in place at the mission partially met our expectations. We found that:

• The mission was following the IR planning process and had a clear organizational structure with accountabilities that were clear;
• The mission had recently documented the accountability relationship between itself and its satellites, but further definition of the relationship with the International Organization for Migration (IOM) would strengthen this framework;
• Management had integrated the promotion and reinforcement of values and ethics into its human resources practices;
• Human resources practices were in place to provide staff with regular feedback to ensure an effective workplace;
• Services delivered by the office met client requirements;
• Performance information on results was gathered for the office, primarily in a monthly operational report, and used in decision making; and
• Learning and development activities are occurring to support staff development and process innovation.

In particular, we found that the Singapore mission was working with the IOM to deliver immigration services to certain parts of its geographic area (Vietnam).  While we note that Singapore’s satellite mission in Ho Chi Minh has a Visa Application Centre (VAC) agreement in place with the IOM, this agreement is only for temporary resident services provided in support of Ho Chi Minh’s operations.  Singapore leverages the IOM’s network for permanent resident applications from Vietnam in order to communicate with applicants rather than communicating with these clients directly to deliver and receive information and immigration applications. This is done for applicants residing in Vietnam where traditional means of communication were not reliable.  The nature of this relationship and any accompanying limitations to this relationship were not defined, which exposes the mission to the following risks:

• Service – If standards are not established in advance and documented, the RPC may see unplanned fluctuations in either the quantity or quality of service delivered in the areas served when using partners to deliver services to parts of the RPC’s geographic territory.
• Reporting – The nature of the information and the extent to which it is shared had not been defined (including confidentiality requirements). Without this definition, the mission may lack information on the performance of this relationship, which could serve to inform management on items such as consideration to expand or contract the relationship. Other reporting risks that may occur include the inadvertent disclosure of personal information.
• Dispute resolution – In the event of a dispute between the RPC and its partner, the RPC does not have a clearly articulated mechanism or procedure that defines how these disputes are to be resolved.

Recommendation 1
Singapore mission management should ensure it documents the nature of its partnership with the IOM.

Management Response
On June 28, 2010, the Mission Immigration Program Manager met with the Head of Office of its main external partner, Ho Chi Minh City. The IOM as provider for visa application centres in Vietnam has a service provider agreement already in place with the mission’s satellite office in Ho Chi Minh. The mission and the IOM, in consultation with the International Region (Field Support/RIX), will be developing a documented administrative arrangement with the goal of finalizing the arrangement early in the 2011–2012 fiscal year.

3.2 Risk Management

As part of the audit, we examined the adequacy of risk management processes and practices in place to support the achievement of the mission’s objectives. Specifically, we expected to see that processes were in place to identify, assess, mitigate and monitor risks, that management appropriately communicated risks and risk management strategies to key stakeholders, and that planning and resource allocation took risk information into account.

3.3 Internal Control Framework

As part of the audit of the internal control framework, controls in place over application processing, CAIPS, controlled documents, cost recovery, and travel and hospitality expenditures were examined.

We found that the internal control framework partially met our expectations as some adjustments were required for controls in place for operational activities.

3.3.1 Application Processing

The audit of internal controls included an examination of immigrant and non-immigrant processing. We expected to find that application decisions were adequately documented, that processes and procedures complied with applicable legislation and policies, that sufficient controls were in place to ensure that admissibility requirements were met, and that designated and delegated authorities for decisions were appropriate and complied with departmental policy.

We found that controls in place over application processing generally met our expectations, though some adjustments were required.

We documented and reviewed the application processes in place at the mission and found that the mission appears to comply with departmental standards. In interviews with staff, it was apparent that they were knowledgeable about processing requirements. Moreover, the mission maintained information about its processes to which all staff had access and which they could consult as references. These included standardized note templates and form letters, standard operating procedures for certain processes and screening tools.

We also reviewed all decisions made on cases finalized over our review period and found that most decisions were made by authorized individuals. We found that one LEP staff was granted the ability to make criminality decisions. These are normally made by Canada-based staff. In total, criminality decisions entered by this individual accounted for approximately 9% of criminality decisions made in cases finalized during the period reviewed. The mission management informed us of the reasons why this individual was granted this ability. However, we found that no record of approval was sought or received from IR for this exception.

As part of our audit, we also reviewed samples of case files finalized during our review period. Our observations were as follows:

• Applications were generally complete;
• Application processing procedures (including admissibility requirements) generally complied with policy requirements; and
• Officers entering decisions did not always, or consistently, enter accompanying notes to explain their decisions (primarily in permanent resident cases).

The Overseas Processing Manual states that “Officers should ensure that case notes not only document any decisions taken during case evaluation, but also clearly reflect the process the officer followed in reaching those decisions.”  Case notes are used to prepare refusal letters, to respond to enquiries, or as a record in the case of an appeal or a court challenge. Lastly, staff in other offices in the Department have direct access to individual electronic files and may call upon this record for various reasons. Therefore, if case notes are not complete, then staff may be missing information when responding to various questions regarding the case.

Recommendation 2
The mission should ensure that only staff with the appropriate authority render decisions on cases.

Management Response
The mission is cognizant of the need for only staff with the appropriate authority to render decisions on cases and notes that the LEP staff member granted authority was an exceptional case as he is a Canadian citizen who was employed at CIC in a position of responsibility immediately prior to his employment as LEP at the mission. However, until such time as he has appropriate authority to render criminality decisions, he has ceased to do so.

Singapore will also review the Delegations of Authority (IL3) to amend CAIPS authorities as required. There is a submission presently awaiting approval (expected in the fall of 2010) to update overseas delegations (International Region). The target for the mission to review authorities is 30 days after the delegations are published.

3.3.2 CAIPS

As part of the audit of the internal control framework, we examined controls over CAIPS. We expected to find that appropriate controls were in place to ensure the appropriate use of CAIPS at the mission and that CAIPS assets were safeguarded.

• A small number of active accounts belonged to former staff (7% of total active user profiles);
• Access privileges for remote accounts, a system capability which is not currently used by the mission, had not been reset;
• Some staff had access privileges allowing them to perform functions which they should not be allowed to perform; and
• The mission was not always assigning unique access codes to individuals for traceability.

These issues represent a potential risk to controls over CAIPS. Creating additional access points beyond what is needed increases the risk of unauthorized access. However, our additional audit testing found that all decisions made on immigration applications during the period under review were made by authorized individuals (except as noted in section 3.3.1: Application Processing). We note that some of these issues have been addressed since our onsite review.

We also found that the mission was performing most system administration activities as required by policy. However, the mission performs system tape cleaning on a monthly basis rather than weekly as recommended in the CAIPS manual. The CAIPS manager manual identifies the need to periodically clean the tape drive and periodically review hardware records to ensure that they are up to date. Cleaning the tape drives is a preventative measure to ensure that CAIPS continues to run efficiently and effectively and that a system failure does not occur.

Recommendation 4
The mission management should review and update its CAIPS profiles and inventory lists periodically and make any necessary changes to ensure that they are up to date, meet the mission’s needs and comply with requirements.

Management Response
The mission has reviewed and updated the CAIPS profiles and inventory lists. It will also periodically review the CAIPS Manager User Guide online.

Recommendation 5
The CAIPS Manager should ensure that system administrative functions, such as tape cleaning, are carried out as directed in the CAIPS manager manual.

Management Response
The mission has been cleaning the tape weekly since the audit team informed it of the discrepancy in April 2010. It will also continue to periodically review the CAIPS Manager User Guide online.

3.3.3 Controlled Documents

In missions abroad, controlled documents are comprised of counterfoils and seals and are issued together as a visa. Counterfoils are the documents on which missions print visa information, and seals are documents that are placed over counterfoils, which in turn are placed in passports to prevent tampering.

As part of the audit of the internal control framework, we examined the controls over controlled documents. The audit expected to find that roles and responsibilities were appropriate and that an effective control framework was in place for the custodianship, safeguarding and handling of controlled documents.

3.3.4 Cost Recovery

The audit examined the control framework in place to safeguard revenues collected in the immigration section of the mission. The mission accepts payment by certified instruments in Canadian and Singapore dollars only. The mission’s immigration revenues (in Canadian dollars) totalled $2.6 million in 2009–2010 (up to February 8, 2010), $3.8 million in 2008–2009, and $4.7 million in 2007–2008.

We expected to find that roles and responsibilities complied with departmental policies for cost recovery, that adequate controls were in place to safeguard cost-recovery revenues, and that an adequate monitoring regime was in place.

Overall, the mission met our expectations in this area. We found that roles and responsibilities had been delegated and funds were collected in accordance with policy. Specifically, we found that records of fees collected were maintained, and that payments were traceable to applications processed. We also found that the funds collected were appropriately safeguarded and duly transferred to Administration for deposit to the mission bank account.

3.3.5 Travel and Hospitality

As part of the audit of the internal control framework, we examined controls over travel and hospitality expenditures. The audit expected that controls would be in place to ensure that travel and hospitality transactions were processed in compliance with applicable policies and regulations.

Appendix A: Singapore Mission Organizational Chart

Source: Adapted from the International Region Immigration Management Plan Organizational Chart (November 2009)

Text version: Organizational Chart

Appendix B: Singapore Processing Summary

1. Data from IR data records as at April 2, 2010.
2. Data from IR data records as at December 31, 2009, January 2, 2009, and January 4, 2008, for end of 2009, 2008 and 2007 respectively.
3. Revenues are as per 2009–2010 (to February 8, 2010), 2008–2009 and 2007–2008 fiscal years.

Note (general). Immigration applications are referred to as “cases” in the statistics, while “persons” refers to the number of people who have submitted an application. For example, families generally apply together in one application rather than in several separate applications. The statistics therefore refer to both the number of cases (i.e., the number of applications) and the total number of people who applied (regardless of the number of cases).

Appendix C: Detailed Criteria for the Audit

Objective 1: Governance Framework

The adequacy of the governance framework will be assessed against the following criteria:

• Governance structures are in place to ensure that accountabilities are adequately discharged.
• Values and ethics are promoted and reinforced.
• The office is managed in a way that ensures an effective workplace for staff to successfully contribute to the work objectives.
• The services delivered by the office reflect its clients’ requirements.
• Relevant information on results is gathered, used to make decisions and reported.
• Learning and development activities are used to promote innovation and change management.

Objective 2: Risk Management

The adequacy of the risk management process and practices will be assessed against the following criteria:

• Processes are in place to identify, assess, mitigate and monitor risks.
• Management appropriately communicates risk and risk management strategies to key stakeholders.
• Planning and resource allocation take risk information into account.

Objective 3: Internal Controls

The internal controls in place to support financial, administrative and operational activities will be assessed against the following criteria under the following lines of enquiry:

• Application processing
  • Decisions are adequately documented, and the required supporting documentation is maintained.
  • Designated and delegated authorities for decisions are appropriate and comply with departmental policy.
  • Appropriate controls are in place to ensure that admissibility requirements are met.
• CAIPS management
  • Appropriate controls are in place for the management and use of CAIPS user accounts at the mission.
  • Appropriate controls are in place to safeguard CAIPS assets at the mission.
• Controlled documents
  • Roles and responsibilities are appropriate for the custodianship, safeguarding and handling of controlled documents.
  • Adequate controls are in place for the custodianship, safeguarding and handling of controlled documents.
• Cost recovery
  • The assigned roles and responsibilities and the procedures performed comply with departmental policies on cost recovery.
  • Adequate controls are in place in the physical environment to safeguard the cost-recovery system.
  • An adequate monitoring regime is in place to ensure that controls are working properly and that funds collected are properly accounted for and safeguarded.
• Travel and hospitality
• Internal controls should be in place to ensure that travel and hospitality transactions comply with policies and regulations to protect against fraud, financial negligence and other violations of rules and principles.

Appendix D: Management Action Plan

Appendix E: Audit Time Line