2012-13 continuous audit of expenditure management

NRC's Finance Branch is responsible for the functional administration, oversight and control of travel expenses. These activities must be managed so that they demonstrate value for money and use the most economical options to minimize and/or reduce such costs whenever possible.

NRC's control framework for travel includes readily available polices, tools and guidance, standard forms with built-in controls, timely communication of policy changes, centralized processing of travel claims and monthly monitoring and reporting of results. The 2010-11 NRC Continuous Audit of Travel found that most of the selected key controls for travel were operating effectively and the majority of transactions were compliant with applicable polices and directives. The two recommendations from the audit were fully implemented by early 2012-13.

The scope of the current audit related to travel expenditures includes: budgeting, administration, travel cards and proactive disclosure of expenses.

Budgeting

NRC has committed to limiting travel whenever possible and ensuring the most economical options are used to minimize costs. In fiscal year 2012-13, NRC expenditures were $9.5 million for travel by Public Servants and $1.3 million for travel by non-Public Servants.^Footnote5 The total amount of annual expenditures at $10.8 million reflects a downward trend from previous years, where expenditures were $12.3 and $13.4 million in 2011-12 and 2010-11 respectively.

The audit found that the 2012-13 annual budget for travel expenditures was prepared and appropriately approved by NRC's President on a timely basis, as required by the Treasury Board Directive. NRC management receives travel expenditure reports on a monthly basis, which supports effective monitoring and decision making.

Administration (including preapproval, authorization and verification)

Staff travel reservations must be made through the Government of Canada Shared Travel Service online booking tool. Expenditure preapproval (FAA Section 32) and a Travel Authorization Number (TAN) must be obtained in order to make reservations through the booking tool. In 2012-13, TANs were centrally controlled and issued by the Travel Office for employees in the National Capital Region (NCR). For employees outside of the NCR, TANs were issued by delegated staff within each P/B/I. There is a need to ensure that personnel granted delegations are provided with timely guidance and training, in order to minimize the risk of unauthorized and/or unnecessary travel.

Audit testing of travel claims found overall high compliance with respect to the authorization, eligibility and accuracy of travel claims. These findings are consistent with the results of monitoring conducted by the Travel Office. Strengths were found for the execution of FAA Section 32 and Section 34 approvals, which serve to ensure compliance with Government of Canada and NRC travel requirements and the effective use of NRC resources. Justification of how travel expenses are aligned with NRC objectives and priorities, and whether alternative means of reducing costs were considered, as required by the Treasury Board (TB) Directive, were appropriately documented in most cases. There is further opportunity for budget holders and administrative personnel to ensure the justification is appropriately documented for all travel.

Finance Branch has developed a robust process for verifying and processing travel claims and executing payment authority (FAA Section 33). The Travel Office has established a strong monthly monitoring process that includes detailed verification criteria and reporting of findings to Finance Branch management. The Travel Office and Accounts Payable effectively coordinate to identify potential instances of duplicate claiming of travel, hospitality and/or conference expenses and take remedial action when required.

American Express (AMEX) Designated Travel Cards

The American Express (AMEX) corporate travel card is currently available to NRC employees for authorized business travel and hospitality expenses. From the standpoint of economy and administrative efficiency, travel cards have been the federal government's preferred approach over issuing temporary travel advances or travellers cheques. Use of the travel card is mandatory for NRC Executives and employees not represented by a union, and is strongly recommended for other employees. Employees are required to repay their account balance in full, and must submit a separate claim for reimbursement of eligible expenses.

The audit found that the Travel Office has robust processes in place to monitor overdue accounts, and to follow-up and recover funds on overdue accounts where required. The audit found instances of personal use of the travel card, which is contrary to Government of Canada and NRC policies and the cardholder agreement, and demonstrates the need for continued monitoring. All charges incurred were paid for by the respective cardholders, and thus the audit found a low residual financial risk for NRC. There is opportunity for more timely escalation of cases of repeat overdue payments by cardholders, often related to personal transactions. Card cancellation, disciplinary action and/or other measures, where appropriate, would decrease follow-up effort by the Travel Office.

Proactive Disclosure of Travel Expenses

Government of Canada policy requires timely, proactive disclosure of the organization's total annual travel expenditures and of the individual travel claims for senior-level employees on NRC's Internet website.

The audit found that NRC's total annual travel expenditures for 2011-12 were appropriately disclosed on a timely basis.

With respect to the proactive disclosure of senior-level travel claims, the audit found that disclosure was timely, accurate and complete for the majority of claims. However, on-site process walkthroughs and interviews with responsible positions identified that required procedures were not always well understood, often increasing administrative effort. The process for identifying the requisite travel claims and preparing the disclosure report is neither documented nor systematic, which increases the risk of inefficiency and the risk of inaccurate, incomplete or untimely disclosure, particularly in the event of organizational changes.

The design and operational effectiveness of the key controls included in the audit's scope is adequate. Most processes and transactions are in compliance with Government of Canada and NRC policies, acts and directives.

Opportunities for improvement exist with respect to:

• Ensuring that appropriate roles, responsibilities and authorities for TAN issuance are established and communicated, and ensuring employees with TAN issuance responsibilities receive sufficient training;
• Continued monitoring and enforcement of Government of Canada and NRC policies on travel cards, including timely escalation, card cancellation, disciplinary action and/or other measures, where appropriate; and
• Reviewing and documenting disclosure processes for senior-level travel claims.

Refer to Recommendations 1 and 2 (section 3.1)

Finance Branch should ensure that roles, responsibilities and authorities related to Travel Authorization Number (TAN) issuance are clarified and supported by sufficient and timely training. With respect to travel cards, the Chief Financial Officer should ensure there is continued monitoring and enforcement of Government of Canada and NRC travel card policies. [Priority: Moderate]

Finance Branch should develop desktop procedures and guidance to support efficient and robust proactive disclosure of senior-level travel and hospitality claims. [Priority: Moderate]

Hospitality may be provided as part of a spectrum of different government activities or events, whether hosted by the Government of Canada or attended by government representatives. These activities must be managed so that they demonstrate value for money and use the most economical options to minimize and/or reduce such costs whenever possible.

NRC's control framework for hospitality includes readily available policies, tools and guidance, standard forms with built-in controls, Accounts Payable verification, and timely communication of policy changes. The 2010-11 NRC Continuous Audit of Hospitality found that most of the selected key controls for hospitality were effective and the majority of transactions were compliant with applicable polices and directives. The two recommendations from the audit were fully implemented in early 2012-13.

The scope of the current audit includes budgeting, recent changes to the policy framework, administration and proactive disclosure of hospitality expenses.

Budgeting

NRC has committed to reducing hospitality costs whenever possible. During fiscal year 2012-13, NRC executed a total of $268,000 in hospitality expenditures.^Footnote6 This reflects a decrease from previous years, where hospitality expenditures were $354,000 and $405,000 in 2011-12 and 2010-11 respectively.

The audit found that the 2012-13 annual budget for hospitality expenditures was prepared and appropriately approved by NRC's President on a timely basis, as required by the Treasury Board Directive. NRC management receives hospitality expenditure reports on a monthly basis, which supports effective monitoring and decision making.

Updated Policy and Control Framework

In October 2012, the Treasury Board Directive on the Management of Expenditures on Travel, Hospitality and Conferences was amended to increase oversight and ministerial awareness of events where planned costs exceed $25,000. The audit found that Finance Branch was proactive in updating and communicating processes, policies, authorities and tools in a timely manner to ensure compliance with the Directive.

Administration (including preapproval, authorization and verification)

Overall, the audit found high compliance with Government of Canada and NRC hospitality policies and directives. Strengths were found with respect to FAA Section 32 and Section 34 approvals, including approval by the President and/or Minister where required, use of requisite forms and the accuracy and appropriateness of claims. Accounts Payable and the Travel Office effectively coordinate to identify potential instances of duplicate claiming of hospitality and/or travel expenses and take remedial action when required. Justification of how hospitality expenses support NRC priorities and objectives, as required by the Treasury Board (TB) Directive, was appropriately documented for most claims. There is further opportunity for budget holders and administrative personnel to ensure the justification is appropriately documented for all hospitality.

Accounts Payable verifies all hospitality claims, due to their sensitive nature, to ensure compliance with TB and NRC policies and procedures prior to executing FAA Section 33 payment authority. For the sample examined, all hospitality transactions had been verified by Accounts Payable (AP).

Proactive Disclosure of Hospitality Expenses

Government of Canada policy requires timely, proactive disclosure of the organization's total annual hospitality expenditures and of the individual hospitality claims for senior-level employees on NRC's Internet website.

The audit found that NRC's total annual hospitality expenditures for 2011-12 were disclosed on a timely basis.

With respect to the proactive disclosure of senior-level hospitality claims, the audit found there was timely, accurate and complete disclosure of all claims tested. However, on-site process walkthroughs and interviews with responsible positions identified that required procedures were always not well understood, often increasing administrative effort. The process for identifying requisite claims and preparing the disclosure report is neither documented nor systematic, which increases the risk of inefficiency and the risk of inaccurate, incomplete or untimely disclosure, particularly in the event of organizational changes.

The design and operational effectiveness of the key controls included in the audit's scope is adequate. Most processes and transactions are in compliance with applicable Government of Canada and NRC policies, acts and directives.

Opportunity for improvement exists with respect to reviewing and documenting disclosure processes for senior-level hospitality claims.

Opportunities for improvement exist with respect to Accounts Payable processes, as noted in section 3.4 below.

Refer to Recommendations 2 and 3 (sections 3.1 and 3.4 respectively)

During fiscal year 2012-13, NRC executed a total of $11.8 million in acquisition card purchases. Acquisition cards are credit cards that provide a convenient and practical method of procuring and paying for goods and services and, when used appropriately, allow for efficiencies in procurement and expenditure processing. The use of acquisition cards is recommended for purchases of day-to-day expenses, excluding large dollar purchases, complex transactions, capital assets and sensitive expenses such as travel and hospitality. NRC uses acquisition cards from MasterCard issued under the Government of Canada service contract with the Bank of Montreal (BMO).

NRC's control framework for acquisition cards includes readily available polices and guidance, verification and reconciliation by Accounts Payable, and quarterly monitoring and reporting by the Financial Monitoring Division. The 2010-11 NRC Continuous Audit of Acquisition Cards found most of the selected key controls for acquisition cards were operating effectively and the majority of transactions were compliant with relevant polices and directives.

The scope of the current audit includes the administration, monitoring and efficiency of acquisition card transactions and processes.

Administration (including preapproval, authorization, verification and reconciliation)

Through audit testing and review of Finance Branch monitoring results, the audit found that acquisition card expenditures are generally appropriate and compliant with Government and NRC requirements. The audit found a high level of accuracy in financial coding and high compliance for preapproval (FAA Section 32), performance certification (FAA Section 34), and with relevant polices and directives (including no payment splitting). Some issues were noted with respect to incorrect recording of sales taxes, as well as a few cases of security concerns related to the protection of acquisition card numbers.

Verification and payment certification (FAA Section 33) is performed by Accounts Payable for selected aspects of all acquisition card transactions, including whether the expenditure was appropriate, authorized and properly coded. Findings related to verification processes are noted under section 3.4 Account Verification below.

Monitoring

In support of FAA Section 33 payment authority and as part of the Finance Branch's work in support of the Treasury Board Policy on Internal Controls, the Financial Monitoring Division (FMD) conducts walkthroughs of acquisition card processes and quarterly testing of transactions. Detailed quarterly and annual reports are presented to management. Instances of financial signing authority or other regulatory infractions are communicated to the respective P/B/I, regularly recorded in Finance Branch's Offence Tracking Database and formally addressed through the Financial Oversight Committee. The audit found that the scope of FMD monitoring activity is well defined, results are adequately communicated, and remedial actions are taken where required.

Process Efficiency

The 2010-11 NRC Continuous Audit of Acquisition Cards recommended that NRC explore additional options to increase the efficiency of procurement and expenditure processes through increased use of acquisition cards for lower dollar value purchases, while still maintaining appropriate controls to mitigate risk. Implementation of the associated management action plan was completed during 2012-13; however, NRC's Administrative Services and Property Management (ASPM) branch plans to continue to explore further options in this area during 2013-14.

Subsequent audit analyses completed for fiscal year 2011-12 had noted inefficient use of acquisition cards by several ASPM procurement officers. In 2012-13, ASPM took appropriate action to address this inefficiency through increased training and support.

The design and operational effectiveness of the key controls included in the audit's scope is adequate. Most processes and transactions are in compliance with applicable Government of Canada and NRC policies, acts and directives.

Opportunities for improvement exist with respect to Accounts Payable processes, as noted in section 3.4 below.

Refer to Recommendation 3 (section 3.4)

Account Verification Processes

Account verification and payment certification (FAA Section 33) is performed by the Finance Branch Accounts Payable (AP) function for all (100% of) hospitality, acquisition card, and certain other sensitive expenditures, as defined in the NRC Account Verification Guide. Although every transaction is reviewed for appropriate signing authority, certain other expenditures are further verified by Accounts Payable only if they meet certain predefined criteria, such as exceeding a predefined dollar value threshold. These lower risk expenditures, including those completed by acquisition card, are verified further only by the Financial Monitoring Division (FMD) on a periodic sample basis.

As noted above, audit testing of in-scope expenditures found overall high compliance for most audit criteria. However, the audit found that Accounts Payable (AP) verification criteria and desktop procedures are not formally documented. Instead, AP personnel rely on partial instructions contained in the AP Account Verification guide, email communications, memoranda, relevant policies, and knowledge developed through on-the-job training and experience. On-site process walkthroughs and interviews with verification personnel and management identified that scope of verification procedures is not always well understood by verification personnel. The absence of documented verification criteria and desktop procedures reduces the efficiency and robustness of verification processes and increases the risk of insufficient or excessive verification. For acquisition card transactions, which are reviewed by both AP and FMD, there is also a risk duplication of effort.

There may also be opportunity to improve the efficiency and robustness of FAA Section 33 account verification processes by implementing a risk-based stage gate process for payments within SAP, whereby transactions are automatically risk-ranked for verification on the basis of predetermined risk criteria.

Account Verification Findings

Finance Branch has established a tracking database for significant violations of signing authority and other financial policies. Due to the high threshold for inclusion, a small number of cases were input in the database by Accounts Payable during fiscal years 2011, 2012 and 2013. Data was primarily used to issue warning notices or support disciplinary actions. Due to the high volume of transactions verified by Finance Branch, the database is not used a means of systematically tracking the majority of errors or control weaknesses identified by Accounts Payable or other monitoring activities. Significant violations are addressed at the NRC Financial Oversight Committee. The audit found there is opportunity to better leverage intelligence obtained from Accounts Payable verification to assess the adequacy and efficiency of processes and controls for hospitality and other expenditures.

Interviews conducted with Finance personnel from Accounts Payable and Sector Financial Services regarding follow-up actions taken on verification findings indicated that there is opportunity to improve feedback to operational personnel for issues identified during AP verification. There is also a need to ensure all verification personnel fully understand and execute required follow-up action for significant errors and issues including escalation and/or inclusion in the offense tracking database.

Opportunities for improvement exist for reviewing and formalizing Accounts Payable verification processes to ensure the desired accuracy of the verification procedures is achieved in an efficient manner corresponding to the level of risk.Specifically, Accounts Payable verification processes could be further improved by:

• Formally documented Accounts Payable criteria and desktop procedures for verification of hospitality, acquisition card and other expenditures that are understood and applied by verification personnel;
• Considering the benefit of implementing an automated risk-based stage gate process within SAP for classifying transactions for FAA Section 33 verification;
• Reviewing the verification scope of Accounts Payable and the Financial Monitoring Division for acquisition cards transactions to ensure there is no duplication of effort;
• Reviewing the means by which intelligence obtained through account verification is leveraged to assess risks and improve processes and controls; and
• Clarifying the required follow-up action for verification findings including escalation and/or inclusion in the offense tracking database.

Refer to Recommendation 3

Recommendation 3

Finance Branch should review the effectiveness and efficiency of Accounts Payable verification, including the effectiveness of the use of verification findings in strengthening controls and continuous improvement. [Priority: High]

NRC incurs expenses for relocating new and existing employees, based on requirements established by the National Joint Council. Relocation expenditures by NRC are modest at $374,000 in fiscal year 2011-12 and $539,000 in fiscal year 2012-13. Relocation expenditures are administered by Brookfield Relocation Services for all federal government departments based on the terms and conditions of a contract held with Treasury Board. Although the contract is held by Treasury Board, the responsibility for verifying the work executed by Brookfield rests with each department.

Administration (including preapproval, authorization, verification and reconciliation)

The processing of payments to Brookfield for NRC relocation expenses is done through the combined efforts of the Finance Branch (FB) Travel Office and two units within the Human Resources Branch (HRB). The audit found that preapproval (FAA Section 32) and performance certification (FAA Section 34) for relocation expenses and amendments are exercised by the appropriate NRC authorities and funding is appropriately committed. Although the work of FB and HRB includes approvals and some review, the audit found that there are gaps and duplications in the process, which increases the risk of inefficiency and errors.

The audit found that NRC oversight of relocation expenditures includes verifying the mathematical accuracy of each claim and an administrative on-line close-out, but does not include verification of the file administration and expense approval executed by Brookfield. Other federal government departments with higher relocation expenditures have established separate verification functions that perform comprehensive testing of selected claims, and report any issues and recommendations to Brookfield. Lack of appropriate verification increases the risk that NRC's due diligence responsibilities are not met as well as the risk of over- or underpayment.

The design and operational effectiveness of the key controls included within the audit's scope is adequate.

Opportunities for improving the efficiency and operational effectiveness of processes and controls for relocation include:

• Developing and documenting an updated process for administering NRC relocation expenditures that assigns lead responsibility for financial matters to FB, and ensures roles and responsibilities within HRB and between HRB and FB are clearly defined and understood; and
• Developing and implementing an NRC approach, commensurate with level of risk, to verify the work of Brookfield in order to minimize financial and due diligence risks.

Refer to Recommendation 4

Recommendation 4: Finance Branch should strengthen administrative and verification processes for relocation expenditures. The process should include verification of the third party file administration and expense approval executed by Brookfield, based on an approach that is reflective of risk. [Priority: Moderate]

During fiscal year 2012-13, NRC commuting assistance payments totaled $13,000. Commuting assistance is provided to help defray excessive costs incurred when employees are assigned to work at a remote worksite. Commuting assistance can only be paid to employees commuting to a worksite that meets the eligibility requirements under the National Joint Council (NJC) Commuting Assistance Directive. The only NRC worksite that meets these eligibility requirements is the Dominion Radio Astrophysical Observatory (DRAO) worksite located in Penticton, British Columbia.

Administration (including preapproval, authorization, and payment)

The audit found that weaknesses found in previous internal audits have been fully addressed, and the current commuting assistance process and transactions are compliant with the NJC Directive, including requirements related to preapproval, expense authorization, the appropriate mileage rate, worksite eligibility and payment.

The design and operational effectiveness of the key controls included within the audit's scope is strong. Process and transactions are in compliance with applicable Government of Canada and NRC policies, acts and directives.

No areas for improvement were identified.

1. Adequate processes are in place to ensure compliance with newly amended, more stringent Government of Canada policies
2. Prepaid meals at conferences or hospitality expenses are not also reimbursed through travel claims
3. Travel cards are not used for personal benefit; outstanding balances are recovered from employees
4. Sufficient information is available to support monitoring and decision making by management
5. Expenditures are adequately disclosed on NRC's Internet website

1. Adequate processes are in place to ensure compliance with newly amended, more stringent Government of Canada policies and directives
2. Hospitality expenses are not also reimbursed through travel claims
3. Personal expenditures are not reimbursed through hospitality
4. Sufficient information is available to support monitoring and decision making by management
5. Expenditures are adequately disclosed on NRC's Internet website

1. Acquisition cards are not used for unauthorized / disallowed / personal purchases
2. Transactions are not split to avoid authorization controls
3. Adequate monitoring of key controls is exercised through transactional testing by the Finance Branch Financial Monitoring Division

1. Adequate processes are in place to ensure compliance with Government of Canada policies and directives

1. Adequate processes are in place to ensure compliance with Government of Canada policies and directives

1. Finance Branch should ensure that roles, responsibilities and authorities related to Travel Authorization Number (TAN) issuance are clarified and supported by sufficient and timely training. With respect to travel cards, the Chief Financial Officer should ensure there is continued monitoring and enforcement of Government of Canada and NRC travel card policies. [Priority: Moderate]

Finance Branch is centralizing the issuance of all TAN numbers to the Central Travel Office. Roles and responsibilities will be clarified and TAN issuing staff will be fully trained.

An effective and manageable monitoring of travel card overdue balances has been in place since 2010. The government program and the process established in conjunction with NRC-HR Labour Relations results in little to no financial risk to NRC with respect to overdue balances of card holders. Timely escalation of problem issues to cardholder managers is also in place.

Date: November, 2013

Contact: Director, Accounting Operations

2. Finance Branch should develop desktop procedures and guidance to support efficient and robust proactive disclosure of senior-level travel and hospitality claims. [Priority: Moderate]

Desktop procedures for the completion of the proactive disclosure of travel and hospitality expenses were documented in summer 2013 to ensure completeness and accuracy of the information.

Date: Completed

Contact: Director, Accounting Operations

3. Finance Branch should review the effectiveness and efficiency of Accounts Payable verification, including the effectiveness of the use of verification findings in strengthening controls and continuous improvement. [Priority: High]

The NRC-AP Account Verification Guide will be reviewed and additional detail will be added where needed to clarify quality assurance requirements.

Results from FMD quarterly review reports are considered when establishing risk levels within the account verification strategy, and in account verification procedures.

A full review of the account verification strategy will be made once the planned improvements to the NRC financial system to further automate transactions and electronic approvals are fully implemented.

Date: September 2014

Contact: Manager, Accounts Payable

4. Finance Branch should strengthen administrative and verification processes for relocation expenditures. Processes should include verification of the third party administration and expense approval executed by Brookfield, based on an approach that reflects the level of risk. [Priority: Moderate]

Finance Branch performed an analysis of the relocation related tasks and responsibilities performed by Finance Branch and Human Resources staff in summer 2013. As a result, to improve efficiency within the relocation services, all relocation duties will be centralized within the NRC Central Travel Office in Q3 2013-14.

As NRC's relocation expenditures are modest, a separate verification function is not considered efficient. Before final payment of relocation files are made, a review of the reasonableness of the final claim to the amount planned will be completed by the NRC relocation Departmental National Coordinator, and further investigated with Brookfield if gaps exist.

Date: December 31, 2013

Contact: Director, Accounting Operations