Audit of the Departmental Departure Process

Recommended for Approval to the Deputy Minister by the Departmental Audit Committee on April 20, 2012

Approved by the Deputy Minister on April 23, 2012

Table of contents

• 1.0 Summary
  • 1.1 Introduction
  • 1.2 Main Findings and Recommendations
  • 1.3 Audit Opinion
  • 1.4 Overall Conclusion
  • 1.5 Statement of Assurance
• 2.0 About the Audit
  • 2.1 Background
  • 2.2 Audit Objective
  • 2.3 Audit Scope
  • 2.4 Methodology
• 3.0 Findings and Recommendations
  • 3.1 Introduction
  • 3.2 Overall Process
  • 3.3 Departure Process Controls
  • 3.4 Departure Form
• 4.0 Overall Conclusion
• Appendix A: Audit Criteria
• Appendix B: Management action plan

1.0 Summary

1.1 Introduction

The Treasury Board Directive on Financial Management of Pay Administration deals with departure procedures. It requires that the Chief Financial Officer establish management practices and controls to ensure effective internal control over the financial management of pay administration.

This includes establishing, in collaboration with Human Resources, a departure report and checklist process to sign off and certify that all money owing to the Crown, or any other material, is accounted for before an employee leaves the department. The process is to include sign off by such areas as human resources, security, material management, administration, library, and financial services.

In September 2010, Industry Canada assessed its departure process. The review led to the development of a new process that includes a departmental directive, an automated notification and a revised form. Prior to the implementation of the new process, six different departure forms and different processes existed within Industry Canada. The new process introduced a single, consistent and mandatory approach and served to integrate the different parties involved in the departure process. Following various communication activities, it was launched in December 2010 in the National Capital Region, and in June 2011 in the Regions.

The objective of the new directive is to establish a consistent and mandatory departure process across the department, in compliance with Treasury Board and departmental policies and directives. The new directive applies to all Industry Canada employees (indeterminate, term, casual, part-time and students) who are either terminating their employment or taking a leave of absence for more than three months, and to non-employees (contractors, temp help) who are leaving the department.

The Director General (DG), Corporate Finance, Systems and Procurement Branch (CFSPB) within the Comptrollership and Administration Sector (CAS) is the process owner of the Departure Process. While the process owner has the overall responsibility over the Directive and the process and the ability to make necessary changes, the responsibility of complying to the process is shared between managers and services providers.

In accordance with the approved Industry Canada 2011-2014 Multi-Year Risk-Based Audit Plan, the Audit and Evaluation Branch undertook an audit of the Departmental Departure Process.

The objective of this audit was to provide reasonable assurance that the new Industry Canada Departmental Departure Process is sound and is operating as intended.

1.2 Main Findings and Recommendations

Overall Process

The new Departmental Departure Process presents a consistent and integrated approach in tracking departures.

Overall, the introduction of a directive and an automated email notification and the revisions made to the departure form present improvements over the previous departure processes.

Departure Process Controls

Existing controls to support the departure process and safeguard departmental assets were highlighted during the audit. These controls, such as automated end dates on access cards and a review of inactive IT accounts, are being exercised by Finance, Security, Human Resources and CIO and mitigate some of the risks associated with departures. Additional improvements to the departure process have been made and other improvements are planned.

The audit found instances in which the departure process was not used or was completed after the departure date.

Recommendation 1:

The DG, CFSPB should ensure that managers clearly understand the situations requiring the completion of a departure form and actions required under the Departmental Departure Directive.

The audit did not reveal any significant issues with regards to building or IT systems access being revoked, the recovery of outstanding advances or the cancellation of travel or acquisition cards.

The audit procedures did not include confirming with each manager and/or branch custodian from the sample that other assets had been returned to the department.

Recommendation 2:

For the departures identified during the audit in which no notification was sent or departure form completed, the DG, CFSPB should work with the respective manager and/or branch custodian to confirm whether assets, if applicable, were returned.

Some departure procedures and forms were not fully completed. The audit identified cases in which forms were missing key signatures, such as those of the manager, authorized financial officer or compensation advisor.

Recommendation 3:

The DG, CFSPB, should work with managers and service providers to ensure departure procedures are fully actioned and forms are completed in accordance with the instructions provided in the Departmental Departure Directive.

The approach to ongoing monitoring of the departure process does not include procedures to identify departures that have not completed the departure process. These procedures could help reduce the risk of departures occurring without the departure process being completed.

Recommendation 4:

The DG, CFSPB should strengthen regular monitoring to identify departures from Industry Canada that are subject to the Departmental Departure Directive and determine if they have completed the departure process.

Departure Form

The departure process and form account for different types of advances and assets. Employee leave and overdrawn leave have not been included on the employee departure form. Omitting employee leave from the departure form does not allow for the necessary assurance that leave balances have been reviewed and, if applicable, overdrawn leave has been recovered.

Recommendation 5:

The DG, CFSPB, should review the departure form and process to ensure employee leave and overdrawn leave are appropriately addressed as per the Departmental Departure and Treasury Board directives.

1.3 Audit Opinion

In my opinion, Industry Canada's Departmental Departure Process has some weaknesses with low to moderate risk exposures related to control processes that require management's attention.

1.4 Overall Conclusion

Although some weaknesses in controls of the Industry Canada Departmental Departure Process were noted, the audit found that the process is sound. Money and information assets are returned and accesses are revoked.

Recommendations are identified in the report that require management's attention.

1.5 Statement of Assurance

In my professional judgment as Chief Audit Executive, sufficient and appropriate audit procedures have been conducted and evidence gathered to support the accuracy of the opinion provided and contained in this report. The opinion is based on a comparison of the conditions, as they existed at the time, against pre-established audit criteria that were agreed on with management. The opinion is applicable only to the entities examined and within the scope described herein. This audit was conducted in accordance with the Internal Auditing Standards for the Government of Canada.

Susan Hart
Chief Audit Executive, Industry Canada

2.0 About the Audit

2.1 Background

In accordance with the approved Industry Canada 2011-2014 Multi-Year Risk-Based Audit Plan, the Audit and Evaluation Branch (AEB) undertook an audit of the Departmental Departure Process.

The Treasury Board Directive on Financial Management of Pay Administration deals with departure procedures and requires that the Chief Financial Officer establish management practices and controls to ensure effective internal control over the financial management of pay administration. This includes establishing, in collaboration with Human Resources, a departure report and checklist process to sign off and certify that all money owing to the Crown, or any other material, is accounted for before an employee leaves the department. The process is to include sign off by such areas as human resources, security, material management, administration, library, and financial services.

In September 2010, Industry Canada (IC) assessed its departure process. The review led to the development of a new Departmental Departure Process that includes a directive, an automated notification and a revised form. Prior to the implementation of the new process, six different departure forms and different processes existed within Industry Canada. Establishing a new process also served to integrate the different parties involved in the departure process and eliminate "silos" within the department. Communication activities were undertaken prior to the implementation, which included briefings to management committees, information sessions, emails to managers and employees and the development of a new Departure Process Website. The new process was launched December 20, 2010 in the National Capital Region and June 6, 2011 in the Regions.

The objective of the directive is to establish a consistent and mandatory departure process across the department, in compliance with Treasury Board (TB) and departmental policies and directives. The new departure process aims to ensure that all money owing to the Crown, or any other material, is accounted for before an employee or non-employee leaves the department.

The new directive applies to all Industry Canada employees (indeterminate, term, casual, part-time and students) who are either terminating their employment or taking a leave of absence for more than three months, and to non-employees (contractor, temp help) who are leaving the department. It was put in place to improve communication between service providers and reduce the risk of unauthorized physical and network access.

The Chief Financial Officer is responsible for ensuring, in collaboration with all service providers, the effective and efficient management of the departure process, and for monitoring and reviewing the effectiveness of the directive. The Director General (DG), Corporate Finance, Systems and Procurement Branch (CFSPB) within the Comptrollership and Administration Sector (CAS) is the process owner of the Departure Process. While the process owner has the overall responsibility over the Directive and the process and the ability to make necessary changes, the responsibility of complying to the process is shared between managers and services providers.

Although all IC employees and non-employees must comply with the directive and complete the departure process, managers are responsible for ensuring the departure process is initiated and that the appropriate form is completed and approved. Managers are also responsible for the safeguarding of departmental information and the recovery of the assets and resources for which they are accountable. This responsibility includes recording and monitoring assets assigned to employees and non-employees, and revoking access privileges and financial authorities.

A manager who has been informed of a departure completes an on-line notification which is automatically sent to the service providers involved in the departure process. Employees/non-employees are then required to complete the departure form and obtain sign-offs from service providers. The manager reviews the completed form, takes action to clear outstanding items where necessary, then approves and delivers the form to the authorized financial officer. The financial officer reviews and approves the form, sending employee forms to a compensation advisor and non-employee forms to the manager for inclusion on the contract file.

Service Providers are responsible for developing and maintaining policies, guidelines, systems and/or procedures to support the application of the directive, for advice and guidance, and for safeguarding assets and information. Each service provider is responsible for identifying its own risks and incorporating mitigation strategies in the departure process and internal procedures.

The departure process covers six areas:

• CAS – Security: Ensure that access to buildings and assets is cancelled (e.g., building access cards, secure briefcases, secure telephone equipment and keys, etc.);
• Chief Informatics Officer (CIO): IT Service Desk: Ensure that access to corporate IT systems and applications is suspended on the employee's departure date.
• Small Business, Tourism and Marketplace Services: Information Management: Recover all material borrowed from the Library and Knowledge Centre; ownership of electronic files is transferred and paper files/folders are returned.
• CAS – Facilities Management: Ensure that parking passes and calling cards have been recovered and deactivated on the departure date; manage floor plans and nameplates.
• CAS – Financial Services: Ensure that departmental assets including acquisition, credit and travel cards, etc., are recovered and deactivated on the departure date and that financial and contractual authorities are revoked; recover amounts owed to the Crown or advise Compensation and Benefits Services as to the type of recovery, and the amount to be recovered.
• Human Resource Branch (HRB): Compensation and Benefits Services: Upon receipt of the completed departure form from Finance, initiate recoveries, if applicable, sign and file the completed form on the employee's personnel file.

To promote consistency and compliance with the new Departmental Departure Directive, an internal audit was to be conducted within a year of the launch of the new process.

2.2 Audit Objective

The objective of this audit was to provide reasonable assurance that the new Industry Canada Departmental Departure Process is sound and is operating as intended.

Key areas the audit assessed included: whether the process ensures that all money or any other material owing to the Crown is accounted for before an employee or non-employee leaves the department; whether the process ensures that all information assets owned by the department are secured; and, whether the process ensures that access to buildings and systems is removed from departing individuals in a timely manner.

2.3 Audit Scope

The scope of the audit included reviewing a sample of employee and non-employee departures that took place between December 20, 2010 and September 30, 2011 in the National Capital Region. Because Regional implementation of theDepartmental Departure Process did not take place until June 6, 2011, the period covered for the Regions is June 6, 2011 to September 30, 2011.

More than 1,000 departures occurred within IC during this period: 370 indeterminate, 419 casuals and students, 262 leave of absences of more than three months and approximately 120 non-employees.

Limitations

An independent list of non-employee departures did not exist at the time of the audit therefore the audit was not able to determine if any non-employees left the department without completing the departure process.

For the period under review, historical data on access cards' cancellation/deactivation dates was not kept. As a result, the audit cannot provide assurance that building access for departed employees and non-employees was cancelled or deactivated in a timely manner and in accordance with the directive on departmental departures.

2.4 Methodology

This internal audit was conducted in accordance with Treasury Board's Policy on Internal Audit and its Internal Auditing Standards for the Government of Canada. The audit approach consisted of the following:

• Planning phase: The planning phase included a risk assessment of the departure process based on a combination of elements from the Office of the Comptroller General Core Management Control Framework and the TB policies and directives related to the departure process. The results of the risk assessment contributed to the development of the audit criteria and program used during the conduct of the audit. The audit criteria for this engagement are listed in Appendix A.
• Document review: Over 30 key policy and process related documents were reviewed to gain an understanding of the departure process and the roles and responsibilities of each service provider.
• Interviews: Interviews were conducted with service providers and managers for inquiry and corroboration.
• File testing: The audit included judgmental and random sampling methodologies; 159 departures were sampled to verify compliance with the directive. Testing was performed for both employees and non-employees which included 104 departures from the National Capital Region and 55 departures from the Regions. Due to the low volume of departures from each Region during the period under audit, the sample represented 40% of total departures in the Regions.

The planning phase took place from July to November 2011. File reviews were performed in December 2011 and January 2012. Debriefing meetings were held in February and March to validate the findings in this report.

3.0 Findings and Recommendations

3.1 Introduction

This section presents detailed findings from the audit of the Departmental Departure Process. Findings are based on the evidence and analysis from both the initial risk assessment and the detailed audit work.

In addition to the findings presented below, AEB has communicated observations of conditions that were non-systemic and of low materiality and risk to management, verbally and/or in a management letter for consideration.

3.2 Overall Process

The departure of an Industry Canada employee or non-employee impacts many different areas of the department, as evidenced by the number of service providers involved in the departure process. It is important that the department handle departures in a consistent manner to ensure departmental assets are properly safeguarded. It is also important that all involved parties be informed of departures in a timely manner so they can activate controls as required.

Prior to the implementation of the new process, six different departure forms and different processes existed within Industry Canada. The new process introduced a single, consistent and mandatory approach that applies to employees as well as non-employees. The Directive on the Departmental Departure Process established roles and responsibilities of employees, non-employees, managers and service providers.

The new departure form documents additional and detailed verifications resulting from departures, including an attestation from an Authorized Financial Officer on the recovery of outstanding advances or debts from future compensation.

An Intranet site was created which informs managers and employees on the steps to take when a departure occurs. The site has a link to the new departure directive that is applicable to all sectors in Industry Canada, the automatic notification, the departure form and the Frequently Asked Questions. In addition, the directive provides guidance on determining the employment status by providing definition of an employee (indeterminate and term employees, casual and part-time workers and students) and a non-employee (contractor, temp-help, volunteer, consultant).

In reviewing the Departmental Departure Directive, process flowchart, departure form and employee files, the audit found that the new process presents a consistent and integrated approach. The on-line automatic email notification component is an improvement to the process ensuring that all service providers are advised of a pending departure in a coordinated manner. During interviews with managers, positive feedback was received on the implementation of the on-line notification.

Overall, the introduction of a directive and an automated email notification and the revisions made to the departure form present improvements over the previous departure processes.

3.3 Departure Process Controls

Existing Controls and Ongoing Improvements to Procedures

During the audit, we were made aware of existing internal controls that mitigate the risk of loss of assets to the department. Some of these controls include:

• Finance—regular and year-end reconciliations for advances are performed
• Security—has automated end dates for access cards; physical access is only granted to regional employees travelling to Headquarters and that have requested access; appropriate forms are signed for individuals with Top Secret security clearance and included in the employee's file prior to the file transfer to another department.
• HRB—uses Struck Off Strength (SOS) checklists; has automated contract end dates for casuals and students.
• CIO—performs a monthly sweep for inactive accounts.

The audit also found that improvements to the departure process are being made and others are planned. Examples of improvements made are as follows:

• The Security Directorate has implemented a new procedure to retain historical data on employees and non-employees who have departed. This procedure will help the Directorate to document that it has fulfilled its responsibilities under the departure process.
• Since the fall of 2011, the Security Directorate is obtaining written justification from managers for any exception to the requirement to deactivate/cancel all accesses and privileges on an employee's or non-employee's last day of work. The Directorate previously relied on wording in the automatic email notification. However, this wording refers only to IT system access and not to building access.
• Since October 2011, HRB has implemented a second level of review to ensure proper sign-offs from the compensation advisor. This review should help improve HRB's compliance with the departure process.
• Since January 2012, Security verifies with respective areas on a monthly basis the validity of building access permissions provided to contractors.

We were also informed that CAS is planning changes to the departure process. The intention is to implement these changes at the same time as other potential modifications identified during the audit rather than proceed with separate, multiple adjustments within the first year of the new process.

Compliance with the New Departmental Departure Process

A complete departure process helps provide assurance that the department's assets are accounted for and that access to the premises and key IT systems is removed prior to the departure of an employee or non-employee.

Managers are responsible for ensuring the departure process is initiated and that the appropriate form is completed and approved.

The departure of an indeterminate employee is defined in the Departmental Departure Directive as either a permanent or a temporary leave (leave of absences – LOAs) of more than three months. Reasons for permanent departures include retirement, deployment to other government departments, termination, resignation, etc. Reasons for temporary departures include leave such as; sick, maternity, parental, training, etc. For casuals, students and non-employees (contractors, temp help, volunteers), reasons of departures often relate to the end of a work term.

During the file review, the audit identified:

• 15 cases in which a notification or a departure form was not completed; and
• 22 cases in which the email notification and departure process were performed after the departure date;

The following table provides further information:

The table shows instances where a form was not completed, or completed after the date. They are from a mix of indeterminate employees, students, casuals, and employees on a temporary leave of absence; the latter represent a lower risk, given that they are expected to return to the department. The table also shows the instances in which non employees' forms were completed after the departure date. However, because the department does not maintain a list of all departing non employees, it was not possible for the audit to determine whether some of them left without a notification being sent or a departure form being filled out.

A period of adaptation is often required for new users of a process to become familiar with changes to existing processes. The audit found that close to half of the cases where a notification and form were completed after the departure occurred were for departures that occurred in the month following the launch of the process. Ongoing monitoring and further communication of the directive should contribute to improvements in consistency and compliance with the new Departmental Departure Directive.

Through interviews and the file review, some of the causes for not completing the departure process or completing it after the departure date appear to have been the result of oversights on the part of the applicable manager. Although mitigating controls may be in place, some of the controls are exercised after the departure has occurred and may not be effective in a timely manner. When an employee departs without completing the departure process:

• there is no certification that assets have been recovered;
• building access may be retained by departed employees/non-employees;
• individuals may retain access to the department's IT systems;
• departmental assets may not be returned to the branch custodian.

The directive on the Departmental Departure Process provides direction as to when a departure form is required. However, some uncertainty remains. The audit found that, in some cases, managers were not sure of their responsibilities and if a departure form was required for casuals, non-employees (temp help) or students, especially when there are frequent or multiple breaks in service.

Recommendation 1:

The DG, CFSPB should ensure that managers clearly understand the situations requiring the completion of a departure form and actions required under the Departmental Departure Directive.

Verification of Access Revoked and Assets Returned

For the entire sample, the audit examined whether accesses were revoked and assets were returned as a result of a departure. The audit procedures included verifying if accesses had been cancelled for IT systems and buildings. No significant findings were noted.

During the file review, reports from the financial system were generated to verify if salary advances, travel advances, advances under the Initial Appointee Relocation Program, petty cash funds, acquisition and travel cards, were returned or cancelled as a result of the departure.

Analysis of the reports showed no accountable advances as being outstanding. Some of the casuals, students and leave of absence employees in our sample subsequently returned to work, further reducing the risk that assets would not be recovered.

The audit procedures did not include confirming with each manager and/or branch custodian from the sample that other assets, e.g. cellular telephones, hand held devices, had been returned to the department.

Recommendation 2:

For the departures identified during the audit in which no notification was sent or departure form completed, the DG, CFSPB should work with the respective manager and/or branch custodian to confirm whether assets, if applicable, were returned.

Completeness of Departure Procedures and Forms

An essential component of the new process is the requirement that service providers fully complete the departure form and that the signatures of the employee (except in exceptional circumstances), manager, authorized financial officer and compensation advisor appear on the departure form.

In addition to requiring a signature from each service provider, the new form requires that an email confirmation or initials be provided for each specific item verified and accounted for. The audit identified 26 cases in which forms for employees and non-employees were missing key signatures, such as those of the manager, authorized financial officer or compensation advisor.

The audit also found that in some cases, the departure form was not fully completed as per the instructions on the form. In other cases, some used the previous departure form which excluded the notification email, an essential step in ensuring all service providers are made aware of a departure.

In addition, some final forms were not available for review as the employee and the employee file including the departure form had been transferred to another government department.

A form that is not fully completed is not in compliance with the Departmental Directive on the departure process and does not provide assurance that assets and advances have been recovered.

Recommendation 3:

The DG, CFSPB should work with managers and service providers to ensure departure procedures are fully actioned and forms are completed in accordance with the instructions provided in the Departmental Departure Directive.

Monitoring

Since the implementation of the new directive in December 2010, the Quality Assurance group in CAS has been responsible for monitoring the effectiveness of the process on a quarterly basis for departure forms that were completed. It has conducted four monitoring exercises for the National Capital Region and one for the Regions and subsequently submitted three reports to the DG, CFSPB and each of the service providers. Management has agreed to take action resulting from these monitoring exercises.

Through interviews, we were informed that an effort to reconcile employee departures and completed forms had been attempted but resulted in unexplained variances. Because of the unexplained variances, which were most likely due to timing differences between the date of departure and the date the departure form was provided to CAS, the reconciliation exercise has been put on hold and will be revisited in the future.

Procedures to identify departures subject to the Departmental Departure Directive could help reduce the risk of employees and non-employees leaving the department without completing the departure process. Appropriate actions could then be taken to reduce the likelihood of loss of assets and unauthorized accesses.

Recommendation 4:

The DG, CFSPB should strengthen regular monitoring to identify departures from Industry Canada that are subject to the Departmental Departure Directive and determine if they have completed the departure process.

3.4 Departure Form

Employee Leave

The Treasury Board Directive on Financial Management of Pay Administration requires that as part of departure procedures the Chief Financial Officer establish, in collaboration with Human Resources, a departure report and checklist process to sign off and certify that all money owing to the Crown, or any other material, is accounted for before an employee leaves the department.

Overdrawn leave is specifically mentioned in the TB and IC directives. In addition, the Departmental Departure Directive states that the process will ensure the return of overdrawn leave.

The audit found that outstanding advances, acquisition cards, travel cards, identity cards and material on loan are identified on the employee departure form. However, there is no reference to employee leave including overdrawn leave, nor is there any area where a signatory takes responsibility for having verified leave balances prior to an employee's departure.

Managers are accountable for ensuring that all employee leave has been declared and reported appropriately. The process of determining whether or not there is overdrawn leave requires the expertise of a compensation advisor from the Human Resources Branch. At the time of departure, compensation advisors, through the Regional Pay System (RPS), process the information pertaining to pay administration to determine whether salary overpayments or overdrawn leave exist and ensure the recovery of any money owed to the Government of Canada.

Omitting employee leave from the departure form does not allow for the necessary assurance that leave balances have been reviewed and, if applicable, overdrawn leave has been recovered.

Recommendation 5:

The DG, CFSPB should review the departure form and process to ensure employee leave and overdrawn leave are appropriately addressed as per the Departmental Departure and Treasury Board directives.

4.0 Overall Conclusion

Although some weaknesses in controls of the Industry Canada Departmental Departure Process were noted, the audit found that the process is sound. Money and information assets are returned and accesses are revoked. Recommendations are identified in the report that require management's attention.

Appendix A: Audit Criteria

Appendix B: Management action plan