Audit of the Immigration Program in the Canadian Mission in Tokyo

Audit Report
Internal Audit and Accountability Branch
Citizenship and Immigration Canada
June 2009

Table of Contents

• List of Acronyms
• 1.0 Introduction
  • 1.1 Background
  • 1.2 Audit Objectives
  • 1.3 Audit Criteria
  • 1.4 Audit Scope
  • 1.5 Audit Methodology
• 2.0 Audit Conclusion
• 3.0 Observations and Recommendations
  • 3.1 Governance Framework
  • 3.2 Risk Management
  • 3.3 Internal Control Framework
• Appendix A: Tokyo Mission Organization Chart
• Appendix B: Detailed Criteria for the Audit
• Appendix C: Management Action Plan
• Appendix D: Audit Time Line

List of acronyms

1.0 Introduction

The Citizenship and Immigration Risk-Based Audit Plan for 2008-2011 identifies the conduct of mission audits. The selection of the Immigration Program in Tokyo was done in consultation with the IR Branch at CIC NHQ and was based on an operational assessment of the mission’s operations in relation to other offices. The dates for the on-site fieldwork were November 4 to 7, 2008.

1.1 Background

1.1.1 Operations

CIC is responsible for the recruitment, selection and processing of foreign nationals who wish to come to Canada on a temporary or permanent basis for reasons which will stimulate economic growth and enrich Canada’s social and cultural environment. Within the Department, this responsibility has been assigned to the Operations Sector which is divided into domestic and overseas operations. Overseas operations fall under the responsibility of the IR Branch. IR accomplishes this through its network of visa offices (or missions) abroad. These are broken down into RPC, FSCs, satellites and specialized offices. RPC and FSCs are responsible for the delivery of the full range of immigration services for the countries they serve. The distinction between these two is that RPC are responsible for overseeing satellite offices. Satellites and specialized program offices do not deliver the full range of immigration services.

At the time of this audit, the Tokyo mission was a satellite office of the RPC in Manila; however, it became a FSC in December 2008. Prior to the change, the Visa section had the following staff:

• 3 CBOs including 1 MIO;
• 3 locally-engaged officers (a DIO, an NIO and MIO assistant); and
• 7 LES.

Appendix A presents a summarized organizational chart as of August 18, 2008.

Prior to becoming an FSC, non-immigrant applications from Japan comprised the bulk of those applications submitted to Tokyo. The office was also responsible for non-immigrant applications from Guam, Johnston Atoll, Kosrae, the Marshall Islands, Micronesia, Midway Island, Northern Mariana Islands, Pacific Islands, Palau (Belau), Ponape, Truk Island, Wake Island, and Yap Island. In addition, the mission conducted immigrant interviews for applicants residing in Japan, on behalf of the RPC in Manila.

All immigration applications from residents of Japan received by the RPC in Manila before December 1, 2008, but not yet paper screened, were transferred to Tokyo. Approximately 700 to 800 applications were expected. Residents of Japan are also now able to send immigrant applications directly to the mission. Concurrent with this change, responsibility for non-immigrant processing of the South Pacific Islands listed above was shifted to Manila.

Application processing in Tokyo is overseen by a non-immigrant officer (NIO), a designated immigrant officer (DIO), and a CBO who report to IPM. In addition, the MIO also reports to the IPM.

In 2008, the mission finalized 2,519 temporary resident visa cases (visitors), 3,794 student visa cases, and 6,942 temporary worker visa cases. The approval rate for each line of business was 75%, 96%, and 96% respectively. Mission statistics for 2008, 2007 and 2006 are summarized in the Table 1 below. The mission has seen a decline in visa issuance for each of the major categories. While in-line with figures reported by other-like minded embassies in the region, mission management had indicated possible causes for these declines to be the shrinking demographic of school age children owing to the ageing population of Japan and economic restraint due to financial turmoil seen in both the Japanese and overseas markets.

Table 1. Tokyo Statistics

1.1.2 Environmental Context

This section of the report highlights some of the operating environment issues which face the mission. These are presented here for information purposes only and do not reflect any particular order.

The following challenges were identified by management:

• Staffing – The Visa section faces a 30 per cent changeover in staff in addition to a new IPM. Three new staff positions have also been created to deal with an anticipated increase in workload as the mission begins to process immigrant applications.
• Training – Training needs are described as heavy due to the amount of new staff, the repatriation of the immigration program and the large amount of change underway in the mission.
• Space – By reconfiguring the office, the Visa section expected to be able to accommodate new staff as well as rolling shelves which were to be installed by mid-December.
• New archiving system – An adjustment period of several weeks was expected as information archives are moved into a new system. There were concerns that it could have an effect on the amount of time required to locate and retrieve files, causing an initial impact on office productivity and efficiency. Mission management believes that they could catch up over the course of the year.
• Anticipated increase in Working Holiday Program targets (set by DFAIT) - Processing runs from about October to April, and accounts for a large portion of the mission’s temporary worker cases (5,000 out of the total number of work permit applications received in 2007). The 2009 target for the program is 10,500, which is more than double that of recent years.

1.2 Audit Objectives

The audit objectives were to assess:

• the adequacy of the governance framework in place at the mission to administer the immigration program;
• the adequacy of risk management processes and practices to support the achievement of the program’s objectives; and
• the adequacy of the internal control framework in place over operational, administrative and financial activities at the mission.

1.3 Audit Criteria

The criteria that were used in the audit are based on applicable Treasury Board and CIC legislation, policies and directives. The detailed criteria for the audit are presented in Appendix B.

1.4 Audit Scope

The audit only involved operations at the Canadian Mission in Tokyo. The audit scope covered all significant aspects of CIC operations at the mission. This included the full range of non-immigrant program activities with associated financial and administrative components. Immigration application processing was not included as part of our audit as the full transfer of responsibility had not yet been implemented in the Tokyo mission. The audit examined activities of the mission from July 1, 2007 to the end of the on-site examination period on November 7, 2008.

1.5 Audit Methodology

There were three lines of enquiry: governance framework, risk management practices and the internal control framework.

As part of our examination of the governance framework and risk management, we interviewed immigration staff, as well as other embassy staff with links to immigration operations; reviewed documents; observed processes; documented controls; tested information; and reviewed samples of management files to test for compliance.

As part of our examination of the internal control framework, we examined controls over application processing, CAIPS, controlled documents, cost recovery, and travel and hospitality expenditures.

In our examination of application processing, we examined all decisions related to permanent resident determination travel documents, temporary resident cases and temporary resident permits finalized over the period of July 1, 2007 to June 30, 2008 to test compliance with delegated authorities. We also conducted interviews with immigration staff and other embassy staff with links to immigration operations, reviews of documentation, observation of processes and documentation of controls. The audit also examined a judgmental sample of 35 temporary resident cases which were finalised during the period of July 1, 2007 to June 30, 2008 to assess compliance with legislation, regulations and policy requirements of the case file. The sample size was judgementally determined taking into consideration mission processing volumes. Selection of individual sample cases was done randomly from the population. The file review of sample cases was done to validate our observations from interviews, documentation reviews and observation of procedures in place at the mission.

For other areas under examination as part of our review of internal controls, we conducted interviews with immigration staff and other embassy staff with links to immigration operations, reviews of documentation, observation of processes and documentation of controls. Specifically, we examined CAIPS user profiles, tested CAIPS inventory controls, tested samples of controlled documents inventory transactions, examined cost recovery revenue controls, and reviewed a sample of travel and hospitality claims to assess compliance with applicable legislation, policies and procedures in order to conclude on the state of controls in place.

The audit was conducted to be in accordance with the Government of Canada’s Policy on Internal Audit as well as with auditing standards set out by the Institute of Internal Auditors.

2.0 Audit Conclusion

We found that:

• The governance framework generally met our expectations;
• Risk management processes and practices met our expectations; and
• The internal control framework to support the operational, administrative and financial activities at the mission partially met our expectations as improvement was required in the areas of financial and administrative controls.

Our detailed observations and recommendations, in these areas, can be found in the following sections.

3.0 Observations and Recommendations

3.1 Governance Framework

The audit examined six areas of the governance framework. These were governance and strategic direction, values and ethics, human resources management, client-focused service, results and performance, and learning, innovation and change management. We expected to find that there was a sound planning process in place which ensured accountabilities were appropriate, values and ethics were promoted and reinforced, the office was managed to ensure an effective work place, services delivered by the office reflected the requirements of its clients, information on results was gathered, used to make decisions and reported, and that the learning and development activities supported innovation and change management.

Overall, we found that the governance framework in place at the mission generally met our expectations. Specifically we found that:

• there was a sound planning process in place which ensured accountabilities were appropriate,
• values and ethics were promoted and reinforced,
• the office was managed to ensure an effective work place,
• services delivered by the office reflected the requirements of its clients,
• information on results was gathered, used to make decisions and reported; and
• learning and development activities supported innovation and change management

In Tokyo, a revised organization chart had been developed which better reflected the mission’s reporting relationships and supported changes which were underway at the mission. This revised structure included additional resources and accountabilities that would support its transition to a full service centre and the resulting introduction of new business lines. Planning largely followed the International Region’s planning process and we found that appropriate information was captured and considered in developing its plans. The promotion of values and ethics was primarily done through the management of the human resource function. We also found that this function also helped to ensure staff were aware of their responsibilities. In addition, we found that there were controls in place to ensure that services met client needs. Performance information was captured at the office level and allowed for comparison of plans to results. Though we note, quantitative performance expectations were not set, captured or shared with staff. Doing so may allow for improved results.

One issue of note was the large amount of change underway at the mission at the time of our audit. While we found that appropriate actions were undertaken to support these changes, we found that they were not as well documented as we would have expected. For instance, at the time of our audit, the mission was in the process of adjusting the layout of its office space. Discussions with staff and a review of information to support this change initiative found that the appropriate actions had been taken and the appropriate information had been considered. However, the documentation to support this was very thin.

By not documenting changes, the mission may find it difficult to revisit decisions taken and adjust its plan accordingly. For instance, if it were found that there were problems with the layout design upon implementation, the mission may need to recapture this information. Alternatively, when program management changes in the future, future management would not have the benefit or corporate memory to understand why changes had occurred and may reverse such changes unknowingly. By better documenting such change activity, the mission would ensure smoother implementation and have in place controls to better allow for additional changes.

We found this had occurred largely owing to the fact that there were such a large number of change initiatives underway in such a brief period of time which was exacerbated by staff vacancies in key positions. The IPM had indicated that since their arrival earlier that summer, they have had to manage all of these changes while adjusting to the mission. We note that there were indeed a large number of changes underway and that to accomplish them all, documentation was risk managed as a time-saving factor. Our discussions with the IPM found that they were aware of this fact and concurred with our findings and that future changes would be better documented moving forward.

3.2 Risk Management

As part of the audit of Tokyo, we examined the adequacy of risk management processes and practices in place to support the achievement of the mission’s objectives. We expected to see that processes were in place to identify, assess, mitigate and monitor risks, that management appropriately communicated risk and risk management strategies to key stakeholders, and that planning and resource allocation considered risk information.

We found that risk management practices met our expectations. In reviewing planning and monitoring documents, we found that the mission assessed risks to its operations and developed mitigation strategies with support from the International Region network, as needed. Formally, documentation of this was done in the IRIMP with less formal review and documentation occurring throughout the year. Given the size of the Tokyo mission, this appears to be appropriate. However, as the mission is in the process of growing, the mission should reconsider increasing the frequency of review and documentation of risk at the mission. The documentation of risk not only improves the management of risk but provides for more information for decision making for things such as program design and can also strengthen practices such as QA. Also, as staff rotate throughout the network of missions abroad, this documentation would serve as a form of corporate memory for future management.

3.3 Internal Control Framework

As part of the audit of the internal control framework, controls in place over application processing, CAIPS, controlled documents, cost recovery and travel and hospitality expenditures were examined.

The audit found that the internal control framework to support the operational delivery at the mission partially met our expectations as improvement was required in the areas of financial and administrative controls.

3.3.1 Application Processing

The audit of application processing examined the degree of compliance of practices and procedures with applicable legislation and policies associated with the delivery of the immigration program at the Tokyo mission. To this end, non-immigrant processing was examined. We expected to find that application decisions were adequately documented, processes and procedures were compliant with applicable legislation and policies, sufficient controls were in place at the mission to ensure admissibility requirements were met and that delegated authorities for decisions were appropriate and in compliance with departmental policy.

We found that controls over application processing generally met our expectations. As part of our review, we found that the division of work was performed by program between the officers in the mission. Our review found that controls were adequate to ensure the completion of admissibility requirements and that the exercise of delegated authorities complied with legislation. This was confirmed through our review of a sample of 35 application files and our testing of decisions for all cases finalized during our review period.

However, we did find some weaknesses in terms of documentation of application procedures to demonstrate performance. However, we also note that none would impact the decision-making process. We informed management of these observations for their consideration.

Our review of standard operating procedures found some instances where local practices did not agree with Departmental policies. These instances referred more to the mechanical processing of the case rather than how to evaluate the case. We advised management of these discrepancies at the time of our audit. With the addition of PR application processing subsequent to our audit, we note that it may prove to be an opportune time for the mission to review its local policies to ensure compliance.

3.3.2 CAIPS

As part of the audit of the internal control framework, controls over CAIPS were examined. We expected to find that there were appropriate controls in place to ensure appropriate use of CAIPS at the mission and that CAIPS asset were safeguarded.

The audit found the control framework surrounding CAIPS met our expectations. As part of our testing of user profiles, we found that accounts needed to be updated to reflect some recent changes in staff which were done while we were on-site. Once done, CAIPS accounts complied with policy. We also found that physical controls were in place at the mission to ensure that CAIPS assets were safeguarded to ensure their continued use.

3.3.3 Controlled Documents

As part of the audit of the internal control framework, controls over controlled documents were examined. The audit expected to find that roles and responsibilities (duties) were appropriate and that there was an effective control framework in place for the custodianship, safeguarding and control of controlled documents. In missions abroad, controlled documents are comprised of counterfoils and seals that are issued together as a visa. Counterfoils are the documents on which missions print visa information and seals are documents which are affixed over counterfoils when they are placed in passports to prevent tampering.

The audit found that controls in place to safeguard controlled documents did not meet our expectations and needed improvement. As part of our testing, we reviewed inventory usage transactions during the most recent quarter and attempted to reconcile the inventory at the time of our audit to the last reported inventory at the end of the previous quarter.   Our testing was unable to reconcile the mission’s inventory, though we note the variance was small. As part of our testing we also found:

• Mathematical errors in mission inventory reporting; and
• Errors in controls logs recording usage with respect to sequence of documents usage.

Things we noted which likely had an impact on our ability to reconcile the inventory were:

• Reconciliation of controlled documents occurred daily, but there was no record of this reconciliation maintained which would allow for review;
• The inventory was recorded using manual tools rather than electronic tools; and
• Lack of continuity in inventory record keeping between Forms Controlled Officers.

We provided the details of our inventory review to the mission for their consideration at the time of our audit. Mission management was advised to review this and also consider reviewing its inventory levels at that time. We also provided the mission examples of electronic tool sets used by other missions abroad which may help in the recording of inventory transactions.

We also noted as part of our audit testing that the mission maintained a larger than normal inventory in both deep and working storage. Departmental guidance recommends that missions keep no more than a one week supply of documents in working storage and a minimum of six months supply in deep storage at which time they should replenish their supply. By maintaining a large inventory, the mission increases the number of documents which require secure storage and could potentially go missing. It also increases the possibility that documents may become obsolete, either through changes in format which invalidate the current supply or decay in quality due to the age of its inventory.

However, we note that with the addition of permanent resident application processing subsequent to our audit, the inventory level at the mission may no longer be as excessive. Proper controls will ensure that controlled documents are appropriately safeguarded and accounted for.

As well, IR has gathered different electronic forms and tools used locally by various missions and will review and test these in order to have Departmental tools by the first quarter of FY 2009/2010. This should facilitate, and at the same time increase, the production and the exactitude of the controlled forms in Tokyo and elsewhere.

3.3.4 Cost recovery

The audit examined the control framework in place to safeguard revenues collected in the Visa section of the mission. Applicants residing in Japan must submit payment in Yen using the inter-bank remittance system. The mission accepts payment in Canadian dollars from applicants residing outside Japan by certified cheque, bank draft, or money order to the Receiver General for Canada. The mission’s immigration revenues totaled $0.8 million CAD in 2007/08 and $0.9 million CAD in 2006/07.

We expected to find that roles and responsibilities (duties) were in accordance with departmental policies for cost recovery, adequate controls were in place to safeguard cost recovery revenues, and that an adequate monitoring regime was in place.

Overall, the mission generally met our expectations in this area. We found that funds were collected at time of receipt in a timely fashion. However, we found that further improvements could be implemented regarding the recording of revenues to allow for improved revenue reporting.

Our audit testing of cost recovery procedures found

• Minor weaknesses in the administration of POS+;
• Inconsistent recording of the collection of global payments (payments made on behalf of multiple applicants at once) that did not allow for the traceability of payments to individual applications; and
• Recording of overpayments when the applicant presented an inter-bank remittance slip did not allow for proper revenue reporting.

Management has implemented compensating controls or taken appropriate actions to correct these issues.

Generally, fees collected should be recorded in a manner which reflects the reality of how they are collected and allow for them to be traced to their source and reported in an accurate manner. If this is not the case, it undermines the validity of financial reporting, which is based on these transactions.

3.3.5 Travel and Hospitality

As part of the audit of the internal control framework, controls over travel and hospitality expenditures were examined. The audit expected that controls would be in place to ensure that travel and hospitality transactions were processed in compliance with applicable policies and regulations.

In discussions with staff and our review of a sample of travel and hospitality claims (representing 98% and 100% respectively of actual expenditures to date for the current fiscal year for the Visa section) we found that controls over travel and hospitality expenditures met our expectations.

Appendix A: Tokyo Mission Organization Chart, (Visa Section)

Source: Adapted from 2008-09 IRIMP

Text version: Organizational Chart

Appendix B: Detailed Criteria for the Audit

Objective 1: Governance Framework

The adequacy of the management framework will be assessed with the following criteria:

• Governance structures are in place to ensure that accountabilities are adequately discharged.
• Values and ethics are promoted and reinforced.
• The office is managed to ensure an effective work place for staff to successfully contribute to the work objectives.
• Services delivered by the office reflect the requirements of its clients.
• Processes are in place at the office for the identification and development of risk mitigation strategies.
• Relevant information on results is gathered, used to make decisions and reported.
• The office employs learning and development activities to promote innovation and change management in order to learn from its performance.

Objective 2: Risk Management

The adequacy of risk management practices and procedures associated with the delivery of the immigration program will be assessed against the following criteria:

• Processes are in place to identify, assess, mitigate and monitor risks.
• Management appropriately communicates risk and risk management strategies to key stakeholders.
• Planning and resource allocation considers risk information.

Objective 3: Internal Controls

The adequacy of the internal control framework in place over financial, administrative and operational activities will be assessed under the following lines of enquiry with the following criteria:

• Application processing:
  • Decisions are adequately documented, and required supporting documentation is maintained.
  • Delegated authorities for decisions are appropriate and in compliance with departmental policy.
  • Appropriate controls are in place at the mission to ensure admissibility requirements were met.
• CAIPS Management:
  • Appropriate controls are in place for the management and use of CAIPS user accounts at the mission.
  • Appropriate controls are in place to safeguard CAIPS assets at the mission.
• Controlled Documents:
  • Roles and responsibilities (duties) are appropriate for the custodianship, safeguarding and control of controlled documents.
  • Adequate controls are in place for the custodianship, safeguarding and control of controlled documents.
• Cost Recovery
  • Roles and responsibilities (duties) assigned and procedures performed are in accordance with departmental policies for cost recovery.
  • Adequate controls are in place to ensure that the physical environment is in place to safeguard the cost-recovery system.
  • An adequate monitoring regime is in place to ensure that controls are working and that funds collected are appropriately and properly accounted for and safeguarded while in the Immigration Section.
• Travel and hospitality:
  • Internal controls should be in place to ensure that travel and hospitality transactions are in compliance with policies and regulations to protect against fraud, financial negligence and other violations of rules and principles.

Appendix C: Management Action Plan

Appendix D: Audit Time Line