Audit of the Competition Bureau report

Audit and Evaluation Branch

May 2019

Audit of the Competition Bureau report [PDF - 371 KB]

Table of contents

1. 1.0 Executive summary
   1. 1.1 Introduction
   2. 1.2 Audit background
   3. 1.3 Overview of audit results
   4. 1.4 Audit opinion and conclusions
   5. 1.5 Management response
   6. 1.6 Statement of conformance
2. 2.0 Background
   1. 2.1 Competition bureau overview
   2. 2.2 Previous audit engagements
3. 3.0 About the audit
   1. 3.1 Audit objective, scope and methodology
4. 4.0 Findings and recommendations
   1. 4.1 Introduction
   2. 4.2 Governance and oversight
   3. 4.3 Stakeholder engagement
   4. 4.4 Intake and triage
   5. 4.5 Enforcement instruments
   6. 4.6 Information management
   7. 4.7 Service standards
   8. 4.8 Revenue collection
   9. 4.9 Values and ethics
   10. 4.10 Training and continuous improvement
   11. 4.11 Management response and action plan
5. 5.0 Overall conclusion
6. Appendix A: Audit criteria

List of acronyms used in report

ACR

Alternative Case Resolution

AEB

Audit and Evaluation Branch

AMP

Administrative Monetary Penalty

BIMS

Bureau Information Management System

CDMPB

Cartels and Deceptive Marketing Practices Branch

CPB

Competition Promotion Branch

CSB

Corporate Services Branch

DC

Deputy Commissioner

EDF

Essential Decisions Folder

MEAC

Major Enforcement Advocacy Committee

MMPB

Mergers and Monopolistic Practices Branch

MOU

Memoranda of Understanding

PPSC

Public Prosecution Services of Canada

SIR

Supplementary Information Request

1.0 Executive summary

1.1 Introduction

The Competition Bureau (the "Bureau") is an independent law enforcement agency that ensures Canadian businesses and consumers prosper in a competitive and innovative marketplace.

The Bureau's mission is to prevent and deter anti-competitive behaviour and deceptive marketing practices, review mergers to ensure they do not harm competition and empower consumers and businesses.

Headed by the Commissioner of Competition, the Bureau is responsible for the administration and enforcement of several Acts (the Competition Act, the Consumer Packaging and Labelling Act (except as it relates to food), the Textile Labelling Act and the Precious Metals Marking Act), and promotes competition-enhancing policies and practices.

In FY 2017-18, the Bureau had an estimated 360 employees, and an operating budget of approximately $50M. $10.6M of this budget comes from vote netted revenues (VNR), which are subject to requirements prescribed in the Service Fees Act, including cost and performance standards requirements. During that period, the Bureau had four branches, including its headquarters in Gatineau, and three regional offices located in Montreal, Toronto and Vancouver.

1.2 Audit background

The objective of the audit was to provide assurance that the Competition Bureau's activities effectively support the administration of legislation governing the protection and promotion of competitive markets and informed consumer choice.

The audit scope focused on activities and processes of the Competition Bureau between April 1, 2017 and June 1, 2018, including:

• Governance and oversight processes;
• Case management;
• Enforcement activities;
• Information management;
• Financial management;
• Service standards;
• Values and ethics; and
• Activities related to training and continuous improvement efforts.

1.3 Overview of audit results

Strengths

The Bureau has established key oversight committees to support policy, planning, financial management and decision-making over major case and outreach/advocacy activities. Roles and responsibilities for these committees are defined, and key decision- making mechanisms are in place.

The Bureau has several key memoranda of understanding that govern its relationship with various partners, which support the Bureau's enforcement actions and enabling information-sharing. A compliance framework is in place for the Bureau's enforcement activities, supported by defined and documented approval processes.

The Competition Bureau Guidelines on Conflict of Interest are communicated regularly, and employees are aware of their responsibilities when faced with an apparent or real conflict of interest.

Areas for Improvement

Some opportunities for improvement were identified by the audit. The process and criteria used for triaging and prioritizing requests and complaints received by the Bureau is not documented, and there is no defined criteria for prioritizing the complaints or requests received. There is also no formal documented process to monitor alternative case resolutions and consent agreements to ensure continued compliance is being achieved.

There are limited internal system controls and processes over information management within the Bureau, and the Bureau's revenue narrative does not accurately reflect the current processes being used within the Bureau. Finally not all branches have uniform training programs for competition law officers, and no formal process exists for regularly reviewing Bureau processes and sharing good practices and lessons learned.

1.4 Audit opinion and conclusions

The Competition Bureau has processes and oversight functions in place to support the delivery of its mandate. However, there are opportunities to improve the documentation around several key processes, and to strengthen information management controls and competition law officer training.

1.5 Management response

Management has agreed with the findings included in this report and will take action to address all recommendations by December 31, 2019.

1.6 Statement of conformance

This audit was conducted in accordance with the Internal Auditing Standards for the Government of Canada, as supported by the results of the Audit and Evaluation Branch's quality assurance and improvement program.

Dawn Lumley-Myllari
Chief Audit Executive
Innovation, Science and Economic Development Canada

2.0 Background

2.1 Competition bureau overview

Entity Background

The Competition Bureau (the "Bureau") is an independent law enforcement agency that ensures Canadian businesses and consumers prosper in a competitive and innovative marketplace.

The Bureau's mission is to prevent and deter anti-competitive behaviour and deceptive marketing practices, review mergers to ensure they do not harm competition, and empower consumers and businesses.

Headed by the Commissioner of Competition, the Bureau is responsible for the administration and enforcement of several Acts (the Competition Act, the Consumer Packaging and Labelling Act (except as it relates to food), the Textile Labelling Act and the Precious Metals Marking Act), and promotes competition-enhancing policies and practices.

The Competition Act is the federal law that governs most business conduct in Canada and aims to prevent anti-competitive market practices. Its purpose is to maintain and encourage competition in Canada in order to:

• Promote the efficiency and adaptability of the Canadian economy;
• Expand opportunities for Canadian participation in world markets while at the same time recognizing the role of foreign competition in Canada;
• Ensure that small and medium-sized enterprises have an equitable opportunity to participate in the Canadian economy; and
• Provide consumers with competitive prices and product choices.

The Consumer Packaging and Labelling Act, the Textile Labelling Act and the Precious Metals Marking Act are regulatory statutes relating to the packaging, labelling and marketing of products, and enable activities, such as inspections, to help deter anti-competitive activities. These Acts set out specifications for mandatory label information relating to prepackaged consumer products and textiles, uniform descriptions, quality markings for precious metals, and prohibit the false and misleading representations.

Major Areas of Activities

The Bureau has developed the Competition and Compliance Framework, which outlines the various outreach, enforcement and advocacy instruments used to promote compliance with the Acts^{Footnote 1}. This framework describes the general approach of the Commissioner and the Bureau to the administration and enforcement of the Acts, which includes instruments that range from informal to formal actions, and is publically available on the Bureau's website.

The Bureau has authority to apply discretion in each case, and the decisions of the Commissioner and the resolution of issues will depend on the particular circumstances of the matter in question. Final interpretation of the law is the responsibility of the Competition Tribunal and the courts.

The Bureau has three major areas of activities:

Advocacy

The Bureau participates in a range of activities to promote and advocate for the benefits of a competitive marketplace and addresses competition issues through the use of advocacy instruments such as advice to governments, market studies, and regulatory interventions.

Outreach

The Bureau conducts outreach efforts to inform stakeholders about the mandate and requirements under the Acts, and also produces publications and other resources to promote compliance.

Enforcement

The Bureau's enforcement mandate seeks to promote and protect competition by identifying and addressing potential and actual areas of non-compliance with the Acts. The Bureau aims to facilitate voluntary compliance in cases of potential or actual non-compliance, including measures such as negotiated settlements, where possible.

Competition Bureau Branches

The Bureau has four branches, the Cartels and Deceptive Marketing Practices Branch, the Mergers and Monopolistic Practices Branch, the Competition Promotion Branch and the Corporate Services Branch, all of which report directly to the Commissioner. All regional offices carry out activities under the Cartels and Deceptive Marketing Practices directorates, while Toronto also has a satellite Mergers office supporting HQ, and Montreal manages the labelling investigation activities for the Bureau.

In FY 2017-18, the Bureau had an estimated 360 employees with an operating budget of approximately $50M. $10.6M of this budget comes from vote netted revenues (VNR), which are subject to requirements prescribed in the Service Fees Act, including cost and performance standards requirements. During that period, the Bureau operated under four branches, including its headquarters (HQ) in Gatineau, and three regional offices located in Montreal, Toronto and Vancouver.

Cartels and Deceptive Marketing Practices Branch (CDMPB)

The Cartels and Deceptive Marketing Practices Branch is responsible for investigating criminal conduct and deceptive marketing practices.

Cartel Directorate activities are focused on the investigation of the criminal offences in relation to cartel sections of the Competition Act, including cases of price-fixing and bid-rigging. Deceptive Marketing Practices Directorate activities are focused on the deceptive marketing provisions of the Competition Act and the labelling statutes, including civil and criminal investigations of violations of the Act.

Mergers and Monopolistic Practices Branch (MMPB)

The Monopolistic Practices Directorate detects, investigates and deters business practices that have a negative impact on competition, such as abuse of dominance, as well as certain types of anti-competitive agreements or arrangements between competitors.

The Mergers Directorate conducts merger reviews to assess whether the transactions are likely to substantially prevent or lessen competition in the marketplace with service standards for both complex (45-day service standard) and non-complex (14-day service standard) merger reviews.

Competition Promotion Branch (CPB)

The Competition Promotion Branch is responsible for encouraging the adoption of pro-competition positions, policies, and behaviors by businesses, consumers, regulators, governments and international partners.

The Branch is made up of five directorates that are responsible for internal and external communications, strategic planning and reporting, advocacy, economic support, advice and research, and share compliance. CPB also provides services related to some of these activities to the other Bureau branches.

Corporate Services Branch (CSB)

The Corporate Services Branch provides financial, human resources (including training and talent management), and administration services including being responsible for the management of revenues generated by fees collected by the Bureau, the Conflict of Interest Program, as well as services for evidence handling and enforcement activities.

The Branch provides a variety of information management services to the Bureau, including assessing, supporting, and procuring information technology tools, and managing the Information Centre, which receives and triages the majority of complaints and information requests received by the Bureau.

2.2 Previous audit engagements

An audit of the Competition Bureau was conducted in 2009 by the Audit and Evaluation Branch, with the objective to provide assurance that the Bureau's existing internal control, risk management, and governance processes in place were functioning as intended, and would enable the Bureau's objectives and goals to be met. The audit resulted in four recommendations in the areas of communication related to changes in the market place (e.g. mergers between two companies with significant market share), strategies for knowledge and information management, procedures regarding the expected and acceptable level of file documentation, and quality controls over compliance.

In 2013, an Audit of Competition Bureau - Criminal Matters Branch was conducted by the Audit and Evaluation Branch. The objective of this audit was to provide assurance regarding the CMB's processes around governance, risk management and internal controls to support the investigation and the advancement of prosecution in accordance with the Competition Act. The audit resulted in five recommendations in the areas of investigation management, the coordination of Public Prosecution Service of Canada (PPSC) referrals and consultations related to alternative case resolutions, the management of immunity and leniency programs, conflict of interest, and external resources management, including external experts and research assistants. In December 2014, all five recommendations were deemed fully implemented.

3.0 About the audit

3.1 Audit objective, scope and methodology

In accordance with the approved Innovation, Science and Economic Development (ISED) 2017-18 to 2020-21 Risk-Based Internal Audit Plan, the Audit and Evaluation Branch (AEB) undertook an audit of the Competition Bureau.

Audit Objective

The objective of the audit was to provide assurance that the Competition Bureau's activities effectively support the administration of legislation governing the protection and promotion of competitive markets and informed consumer choice.

Audit Scope

The audit scope focused on activities and processes of the Competition Bureau between April 1, 2017 and June 1, 2018, including:

• Governance and oversight processes;
• Case management;
• Enforcement activities;
• Information management;
• Financial management;
• Service standards;
• Values and ethics; and
• Activities related to training and continuous improvement efforts.

Methodology

The audit was conducted in accordance with the Internal Auditing Standards for the Government of Canada.

Based on the identified risks, AEB developed the audit criteria and sub-criteria linked to the overall audit objective (see Appendix A).

The methodology used for this audit included various procedures to address the engagement's objective. This included review of documentation, interviews, file and system testing, site visits and walkthroughs.

Samples from each region were tested to assess controls over the Bureau's mandate, including documented approval processes throughout the case lifecycle. This included reviewing elements related to information management and system access, as well as decision-making and controls over enforcement activities.

A debrief meeting was held with the Commissioner of the Competition Bureau on April 8th, 2019 to validate the findings that form the basis of this report. This meeting also provided the auditee an opportunity to offer any additional information and clarification regarding the findings.

4.0 Findings and recommendations

4.1 Introduction

This section presents detailed findings from the audit of the Competition Bureau.  The findings are based on evidence and analysis from both the initial risk assessment and the detailed audit work.

4.2 Governance and oversight

The Bureau has the mandate to protect and promote competition through investigating deceptive marketing practices and cartels, preventing abuse of market power, reviewing mergers, as well as through advocacy and international efforts.

The Bureau has several key oversight committees, which oversee the coordination and use of the organization's resources. These include:

• The Senior Management Committee, which is responsible for the leadership, direction, and management oversight of the Bureau;
• The Strategic Policy and Planning Committee, which is responsible for setting the Bureau's overall strategic direction, operational and policy priorities and directions; and
• The Practices and Procedures Committee, which is responsible for developing, implementing and evaluating the effectiveness and efficiency of competition enforcement and promotion guidelines.

These committees have documented terms of reference covering a variety of areas including policy, planning, financial management and decision-making over major cases and outreach/advocacy activities. The committees meet on a regular basis and records of decisions are documented.

The Major Enforcement Advocacy Committee's (MEAC) is another key oversight committee and its mandate includes overseeing the resourcing of major enforcement and competition promotion initiatives, and supporting the Commissioner in his decision-making role. Major enforcement and competition promotion initiatives are required to be presented to MEAC through case team submissions. These initiatives include commencing an inquiry, seeking search warrants, market studies, formal interventions, settlement discussions, litigation, and high-profile promotion activities.

Submissions made to MEAC include the directorate's recommended course of action. MEAC members can challenge aspects of the submissions, including the recommended course of action, and make recommendations to the Commissioner for approval, provide amendments or recommend the case team cease or postpone actions, or require more information from the case team. MEAC's current members include:

• Deputy Commissioner, Monopolistic Practices Directorate
• Deputy Commissioner, Deceptive Marketing Practices Directorate
• Director, Finance and Administration, Corporate Services Branch
• Executive Director, Competition Bureau Legal Services
• Assistant Deputy Commissioner, Mergers Directorate
• Assistant Deputy Commissioner, Cartels Directorate
• Special Economic Advisor, Competition Promotion Branch
• Director, Compliance, Competition Promotion Branch
• Assistant Deputy Commissioner,  Policy, Planning and Advocacy, Competition Promotion Branch

The case teams provide MEAC with a description of the initiative, the impact of the proposed intervention, including the magnitude of the harm involved, and the effect of the proposed intervention. Strategic considerations are also presented to demonstrate the alignment with the Bureau's priorities and estimated resource implications. The information presented is based on analysis performed at the directorate-level. MEAC members are to challenge the submitted initiative, followed by an in camera deliberation before providing a recommendation to the Commissioner on the initiative presented.

However, no financial forecasting and resourcing information related to the Bureau's current and expected investments in other major case initiatives is provided to MEAC, and there is no information presented on the Bureau's available financial and human resources. Further, MEAC's recommendations are based on directorate-level information, including proposed resource allocations, rather than an assessment of proposed actions against the Bureau's priorities and available resources, as prescribed by its mandate. For 11 of the 12 matters tested subject to MEAC's recommendation, MEAC agreed with the recommended approach presented, and no additional information was provided for consideration by the Committee.

Not considering the impact of a recommended major enforcement or a competition promotion initiative on an organization-wide level could lead the Bureau to approve a given matter which may not be aligned with its priorities or with the resources available. A lack of consideration of Bureau-wide human resource information and commitments could result in insufficient resources being allocated to high-risk areas.

Recommendation 1 (Medium Risk)

The Bureau should ensure that Bureau-wide information is presented to MEAC that includes current and future committed financial and human investments against available resources for major enforcement and competition promotion.

4.3 Stakeholder engagement

The Competition Bureau relies on a number of stakeholders to support its activities. Memoranda of Understanding (MOUs) are used to govern the Bureau's relationship with its various partners in order to define the respective parties' roles, responsibilities, and expected services.

Key third-party agreements in place to support the Bureau in carrying out its mandate include:

• Department of Justice (Justice), for the provision of legal services for the litigation of cases under civil statutes;
• Public Prosecution Service of Canada (PPSC), for the provision of legal services for the litigation of cases under criminal statutes; and
• Other governmental departments and agencies, to enable information sharing for investigative and review activities, such as with Transport Canada, Health Canada, and other jurisdictions, such as the Ontario Securities Commission and the Inspector General of Montreal.

The agreements with the Department of Justice, Health Canada and Transport Canada were identified as meeting expectations and provided support for enforcement pursuits and vehicles for information-sharing. However, with respect to the agreement with the PPSC, while general roles and responsibilities are outlined, expectations for PPSC support during the investigative stage are not clearly defined. The MOU indicates that the PPSC counsel may delegate their duties to Justice or private sector counsel, and interviews suggested that there was confusion regarding the ultimate responsibility for the provision of pre-litigation support.

Further, while the MOU outlines the roles and responsibilities of officers during the prosecution stage, expectations for supporting enforcement services are not outlined, and the agreement, signed in May 2010, does not have a defined review period or termination date. There is no formal process for managing MOUs across the Bureau, and accountabilities over the management of MOUs are not established.

Without clearly defined roles and responsibilities in MOUs, the intended outcomes of these agreements may not be achieved. A lack of formal processes for managing MOUs can result in outdated and ineffective MOUs, limiting the support needed for the Bureau to achieve its mandate.

Recommendation 2 (Low Risk)

The Bureau should define and implement a process to regularly review and update MOUs, including the MOU with the Public Prosecution Service of Canada, and ensure that resourcing expectations, roles, and responsibilities are clearly defined.

4.4 Intake and triage

The Bureau receives and responds to public complaints and requests for information related to the various Acts under the Bureau's mandate. Complaints from the public can help to identify potential competition issues, including, but not limited to, false or misleading marketing practices, labelling issues, conspiracies, or bid-rigging.

Requests and complaints under the provisions of the various Acts can be brought forward to the Bureau through the Information Centre using an online form, mail, fax, or telephone. The Bureau can also receive complaints related to potential competition issues directly through competition law officers, the Commissioner, industry partnership meetings, and immunity and leniency applications.

For FY 2017-18, the Bureau received 10,339 requests and complaints. The majority of requests and complaints come to the Bureau through the Information Centre. The Information Centre performs an initial triage of the complaints and determines how they will be processed:

• If the complaint is considered low value, the Information Centre responds to the complainant with predefined answers based on the applicable area.
• If the complaint is considered moderate to high-value, the Information Centre assigns the complaint to the appropriate branch, along with the relevant information for further review.

The Information Centre identifies complaints by level of priority, type of response, responsible branch, and potential referral of the matter to information officers for further review. The quality assurance officer, within the Information Centre, performs the prioritization of requests and complaints received. However, there are no defined procedures for triaging requests and complaints, and no defined criteria for determining whether the complaints or requests received are low, moderate, or high value. Further, the methodology used for prioritizing the requests or complaints received is not documented.

The Information Centre experienced backlogs in processing complaints and requests during the period of the audit. As of June 1st, 2018, there were 244 requests or complaints received by the Bureau that were awaiting triage. Currently, only one quality assurance officer conducts the initial triage and approves responses to the public, which can cause delays in intake.

Labelling investigations are generally driven by complaints, the majority of which the Information Centre receives, and all complaints under the labelling and textile acts may be subject to further investigation. While the target for processing labelling matters is 48 hours, in six of the 15 labelling matters tested, there were delays of 20 to 46 days from the time the complaint was received to when it was assigned to an officer.

The lack of defined processes and criteria for triaging complaints may cause inconsistencies, omissions, errors and delays in how complaints are assessed, referred, or closed. The absence of a process for prioritizing complaints could lead to delays in resolving potential labelling and competition issues effectively. This impact could be compounded without sufficient capacity to triage requests and complaints.

Recommendation 3 (Medium Risk)

The Bureau should document and implement a process with a defined methodology and criteria for triaging and prioritizing requests and complaints to ensure that they can be resolved efficiently. The process should also include capacity considerations.

4.5 Enforcement instruments

In response to actual or potential non-compliance, the Bureau relies on a range of instruments to enforce the Acts. The Competition and Compliance Framework outlines the various enforcement instruments used by the Bureau to both resolve concerns around non-compliance without litigation, or to facilitate resolutions to non-compliance through litigation or other means.

Enforcement instruments available include Alternative Case Resolutions (ACRs), information or warning letters, consensual resolutions for civil cases through consent agreements, which can include remedies or penalties, and criminal cases through the Bureau's immunity and leniency program. When consensual resolutions are not possible or appropriate, the Bureau may pursue litigation, which includes contested proceedings before the Competition Tribunal or the courts and can include remedies and penalties.

Samples from each region were tested to assess controls over the Bureau's documented approval processes throughout the case lifecycle, including decision-making and controls over enforcement activities. The Bureau used a variety of enforcement instruments in the case files tested, including information letters, Alterative Case Resolutions (ACRs), consent agreements, immunity applicants, and litigation proceedings, some of which may include administrative monetary penalties.

Documented approval processes were in place for each enforcement branch, and included the applicable procedures and the level of approval required for enforcement activities. For the majority of the enforcement instruments used, the approval process procedures were followed and documented.

However, for activities resulting in an ACR, the case team is required to notify the Special Advisor and the Deputy Commissioner (DC) that they are engaging in this activity, which was not performed or documented consistently. For the 20 files tested, appropriate notifications to the DC were not documented in 13 files, including: one out of two files in the Ontario region; three of seven files in the Pacific region; and nine out of 11 files in the Quebec region.

Further, the varying notification practices in regions related to the communication of enforcement activities, such as ACRs, to headquarters could lead to inconsistent use of enforcement measures across the organization.

A process is in place for tracking the issuance of AMPs in each directorate. However, there is no formal process for monitoring enforcement instruments, such as ACRs and consent agreements, for continued compliance during the scope of the audit, with the exception of the Mergers Directorate.

Since the time of the audit, the Deceptive Marketing Practices Directorate has designed a compliance monitoring initiative for consent agreements and created a Compliance Monitoring Unit.

Inconsistent monitoring of enforcement instruments may lead to continued non-compliance. Absence of a formal and documented process for monitoring alternative case resolutions and consent agreements could lessen the deterrent character of the enforcement instrument.

Recommendation 4 (Medium Risk)

The Bureau should develop, document and implement a process to monitor alternative case resolutions and consent agreements.

4.6 Information management

Records Management

The Bureau maintains case files for their investigations, which include evidence and sensitive information, such as information related to immunity and leniency applicants. Information management and records handling are essential to the Bureau's enforcement activities. Information related to enforcement matters must follow chain of possession rules in order to be admissible in court, and sensitive information must be appropriately safeguarded.

The Bureau uses several systems to record and store information, including but not limited to:

• The Bureau Information Management System (BIMS), an in-house-developed information management system;
• A shared network drive located on the Bureau's server; and
• Ringtail, a commercially available web-based case management software.

The Bureau's Record Creation, Handling and Destruction Policy, which describes the general rules for the creation, retention, transfer and destruction of records, was created in 2008 and remains current. There is no process to review records management practices and staff indicated that the prescribed records retention periods are not being adhered to, with the exception of Mergers and Monopolistic Practices Branch, which has its own policy to supplement the Bureau policy.

Case file information is primarily maintained on the Bureau's shared drive. However, there is no prescribed method to structure shared drive case files to ensure information and related approvals are organized and maintained in a consistent and defined manner, allowing files to be easily retrievable.

Samples from each region were tested to assess controls over the Bureau's mandate, included reviewing elements related to information management and system access. The Essential Decisions Folder (EDF) in case files on the shared drive is expected to contain documentation of approvals and key decisions in cases. However, approvals were not documented within the EDF in 24 of the 79 cases tested. In 12 of the 24 files tested, the approvals were located in different folders within the shared drive case folder. For the remaining 12 files, cases did not have the approvals documented in the shared drive folder.

BIMS is used to track case events and entries in this system. These entries are intended to be a summary of information used to track case events and should not include any sensitive case information to prevent BIMS users, outside of the case team, from accessing information involving targets or immunity applicants. In 20 of the case files tested, entries included information which was a direct copy-and-paste of correspondence or decision documents. While it was not clear whether this information was considered sensitive or not, there is no defined policy on BIMS entries to ensure that information, such as immunity applicants or correspondence with targets, entered in the system is not sensitive and would not compromise a given case.

An outdated records management policy could lead to inconsistent records management practices across the Bureau. Further, the absence of detailed records management guidance could hinder the Bureau's ability to retrieve key documents efficiently, and could lead to the potential loss of records.

Systems Access

Users of the Bureau's information management systems are given different levels of access to files stored on these systems based on their directorate. Files can also be restricted to specific individuals by system administrators.

The Ringtail administrators perform account activation validation annually and only administrators have additional access. The Corporate Services (CSB) and CDMP branches both maintain a shared drive access tracking file, where group access and changes to folder access are documented.

However, there is a lack of account management policies and related processes for the Bureau's systems. No regular access revalidation is performed, and there is no monitoring of access to restricted files for both BIMS and shared drive.

The ability to delete or re-open matters in BIMS is widely held. Of the 98 matters tested, 19 had been deleted. Reasons for deleting these files included errors made in opening the files, incorrect branch assignment, and in some cases the reasons were unknown as they were older files and the responsible officers no longer were at the Bureau.

Further, while controls exist to ensure no outside access to files, there are no controls around the file restriction or deletion function in BIMs, which allows matters to be deleted or hidden without management's knowledge, and there are no defined roles and responsibilities for users given additional access rights to all matters across branches, which allows them to perform all functions within BIMS.

Lastly, there is no process for account deactivation, and administrators are not always notified when accounts are terminated.

A lack of internal system controls could reduce the Bureau's ability to ensure protection of personal and case-sensitive information within the Bureau. Without defined polices and controls around system access, information could be internally accessed and potentially altered without the appropriate authority.

Recommendation 5 (High Risk)

The Bureau should strengthen their information management policies to include key methodologies and controls to support the Bureau's record-keeping requirements throughout the information lifecycle, including record retention periods.

Recommendation 6 (High Risk)

The Bureau should develop and implement system access controls with defined roles and responsibilities associated with user access authorities and permissions.

4.7 Service standards

Under the Service Fee Act, the Bureau is committed to establishing service standards for fee-based services. The objective of these service standards is namely to ensure transparency, accountability and predictability of service fees charged to Canadians.

The services provided by the Bureau are subject to varying service standards based on the applicable sections of the Competition Act, and the complexity, including:

• Notifiable merger reviews: 14 calendar days for non-complex mergers, 45 calendar days for complex mergers, and 30 calendar days for complex mergers where a Supplementary Information Request (SIR) is issued;
• Merger-related written opinions : 14 calendar days for non-complex matters, 28 days for complex matters;
• Non-merger written opinions: between two to six weeks for non-complex requests, and six to ten weeks for complex requests; and
• Identification numbers: five business days for online applications, and 20 business days for applications by mail.

Service standard data is collected by the Competition Promotion Branch and is published on the Bureau's external website on a quarterly basis. Generally, service standards were achieved for merger reviews (both complex and non-complex) with no supplementary information requests (SIRs).

However, service standards for complex written opinions, which are related to the deceptive marketing provisions of the Act, were only achieved in a minority of case tested. Based on the tested samples, the following service standard compliance rates were calculated:

Further, inconsistencies were identified in the recording of service standards. For merger reviews, the service standard was initiated in BIMS up to several days after matter creation in 12 of the 35 cases sampled, without a note to the file, varying from one day to 22 days, with an average time of six days to be started. For identification numbers, system calculations are used for reporting, but a programming error consistently caused underreporting of service standard completion. At least 60 requests, representing 4.6% of all requests during the scope of the audit, were impacted. The Bureau has subsequently resolved the identification number system calculation error since the time of the audit.

Service standards are tracked through the BIMS system and information is pulled manually for reporting purposes. While processes exist to support the tracking function of these service standards, it was found that they are informal and undocumented.

Undocumented processes for tracking and reporting of service standard information, including delayed service standard initiation in BIMS, may cause inaccurate information to be reported to the public.

Recommendation 7 (Low Risk)

The Bureau should document and implement processes for the measurement, calculation, tracking and reporting of service standards.

4.8 Revenue collection

To ensure the proper processing and recording of revenues, appropriate controls over the collections process should be defined, documented, implemented and monitored. The revenue collections process should reflect the organization's current environment and be reviewed and updated as needed.

The Bureau collects revenue for services provided as well as for civil and criminal fines issued. A documented process narrative for the Bureau's revenue collection activities is in place to that effect. The narrative outlines the processes in place to support the Bureau's revenue collections, including relevant controls. The revenue narrative provides an overview of how the Bureau manages and processes orders, receives and records payments and maintains customer files associated with their revenue service lines including:

• Pre-merger notifications/advanced rulings;
• Written opinions;
• Penalties and fines; and
• Consent agreements.

The current revenue narrative was last updated in October 2016 and it does not accurately reflect the current processes being used within the Bureau. Under the current revenue process, controls are largely reliant on the BIMS financial module, which is no longer utilized by the Finance directorate within CSB.

While monthly reconciliations are prescribed, there are outstanding revenues to be collected. As of June 1, 2018, $2.16M in merger revenues were outstanding, while outstanding amounts for uncollected AMPs, fines or costs were not centrally tracked.

The Bureau has stated that the revenue narrative and revised controls have been updated and are in the process of being implemented, however, this had not been completed at the time of the audit. Proposed controls over the collection process include branch-level collections representatives, semi-annual monitoring, and cost-benefit analysis for collection actions.

Without a current, fully implemented revenue narrative there could be control gaps within the revenue collections process. Further, a lack of documented controls and processes surrounding revenue collection can result in an increase in uncollected revenues, and limit the accuracy of financial information available.

Recommendation 8 (Medium Risk)

The Competition Bureau should develop and implement controls and processes over revenue collection, including a finalized process narrative.

4.9 Values and ethics

The Bureau's ability to preserve and secure the integrity of commercially sensitive information and other information not available to the public is essential to its ability to deliver on its mandate. As per Section 29 of the Competition Act, employees of the Bureau are required to maintain the confidentiality of certain classes of information, including information obtained pursuant to the Act.

Due to the nature of the Bureau activities, all employees of the Bureau are expected to be aware of their responsibilities and expected behaviours in all activities related to their professional duties, including in situations of both apparent and real conflicts of interest. In addition to the Treasury Board Values and Ethics Code for the Public Sector and Policy on Conflict of Interest and Post-Employment, supplemented by ISED's Values and Ethics Code, employees are expected to comply with the Competition Bureau Guidelines on Conflict of Interest.

These guidelines describe situations which could give rise to real, apparent or potential conflict of interest situations resulting from (i) the Bureau's access to commercially sensitive information that is not otherwise available to the public; (ii) assets and liabilities held by employees; (iii) outside employment and activities of employees; or (iv) the receipt of gifts, hospitality and other benefits. The Guidelines also describe the compliance measures to be followed should a real, apparent or potential conflict of interest situation arise during the course of employment at the Bureau.

These guidelines are communicated in employees' letter of offer, as well as in annual attestations completed and signed by employees and consultants. These attestations are managed by the Corporate Services Branch.

There is also mandatory training provided on conflicts of interest internally by the Bureau for all new employees supporting the Guidelines. Information on related conflict of interest and communication on confidential information are also communicated through information bulletins or on the Bureau's intranet.

Further, the Bureau has a delegated official in the Corporate Services Branch who has delegated authority from the Deputy Minister to administer and enforce these guidelines, and staff indicated they use this official for advice and guidance around potential conflict of interest situations.

4.10 Training and continuous improvement

Training

In order to carry out their activities, the Bureau's competition law officers are required to undertake a variety of investigative techniques and activities, including the use of formal powers available to the Bureau, such as executing search warrants, production orders, and interviewing witnesses. These enforcement powers are impacted by jurisprudence as well as new technologies, and require specialized skills in order for the evidence to be used in proceedings before the Competition Tribunal or the courts.

The Learning Unit acts as a centralized learning and development support function for the Bureau. The Unit is intended to develop, coordinate and deliver a wide range of training and development opportunities as well as provide guidance and support related to learning and development. An annual training needs assessment is conducted through a call-out from the Learning Unit, where branches are asked to rank learning priorities and submit what types of training their branch would benefit from.

However, branches indicated that limited technical training was delivered or made available by the Learning Unit. MMPB has a mandatory training program for new officers. However, there is no mandatory training program for CDMPB officers, and officers in this branch do not consider themselves to be provided sufficient training in order to carry out their duties.

An internal working group has the mandate to develop a new training program for competition law officers within CDMPB. At the time of the audit, a consultant had been hired to assist with developing a training program. However, nothing has been formalized or implemented, and there are no defined timelines for the creation of this program.

Without a defined training program for competition law officers, occasional centrally provided training sessions may not reflect the needs of the Bureau. Further, not having sufficient training for competition officers limits their ability to perform their duties, which can prevent the organization from effectively achieving its mandate.

Continuous Improvement

Due to the nature of the Bureau's work, the environment is constantly changing based on judicial decisions by the creation of new precedents. The Bureau documents and communicates the impacts of these decisions on an ad-hoc and informal basis through training presentations or guidance documentation shared with employees at the branch-level.

As was previously mentioned there is an internal working group in place, which was created following an external review of CDMP Branch's activities in April of 2017, however, the group's current focus is improving the Bureau's training programs. Further, the internal working group does not have dedicated resources and is a side-project for its members. There are no planned or on-going reviews of processes at the organizational level.

Some informal mechanisms to discuss best practices within CDMPB are in place, including an officer-led monthly call with other officers across the regional offices. However, there are no formal or informal mechanisms in place to share best practices or lessons learned at the organizational level.

Without reviewing existing processes and practices on a regular basis, the Bureau's processes and practices may not remain effective and relevant. Not sharing lessons learned and best practices could hinder the Bureau's ability to respond to a changing environment and operational needs.

Recommendation 9 (High Risk)

The Bureau should regularly review the Learning Unit's training offerings to ensure they meet the training needs assessments, and implement a mandatory training program for competition law officers.

Recommendation 10 (Low Risk)

The Bureau should implement formal review processes and share good practices and lessons learned on a regular, pre-determined schedule across the Bureau.

4.11 Management response and action plan

The findings and recommendations of this audit were presented to the Commissioner of Competition, and Competition Bureau senior management. Management has agreed with the findings included in this report and will take action to address all recommendations by December 31, 2019.

Management Response and Action Plan

5.0 Overall conclusion

The Competition Bureau has processes and oversight functions in place to support the delivery of its mandate. However, there are opportunities to improve the documentation around several key processes, and to strengthen information management controls and competition law officer training.

Appendix A: Audit criteria

Audit of the Competition Bureau