Audit of conflict of interest management

Executive summary and conclusion

Background

The Treasury Board Policy on Conflict of Interest and Post-Employment defines a conflict of interest (COI) as "a situation in which the public servant has private interests that could improperly influence the performance of his or her official duties and responsibilities or in which the public servant uses his or her office for personal gain". Conflicts of interest can impair an individual's ability to perform his or her duties and responsibilities in an impartial manner. Given the National Research Council of Canada's (NRC's) dynamic and complex environment and external relationships, effective prevention and management of conflict of interest situations is critical for ensuring the integrity of the NRC's research, operations and culture, and for maintaining public trust and confidence in the NRC's ability to achieve its mission and uphold its values.

The NRC Office of Audit and Evaluation has undertaken an audit of COI management upon the request of senior management. The objective of the audit engagement was to provide independent assurance that COI management at the NRC is proportionate to the level of risk and aligned with Government of Canada and NRC values, policies and codes of conduct. The audit's scope included the framework supporting the NRC's COI management program and its implementation across the NRC research centres, branches, and the Industrial Research Assistance Program (CBIs) from January 1, 2016 to February 1, 2019.

Audit Opinion and Conclusion

In my opinion as Chief Audit Executive, while NRC's Policy on Conflict of Interest and Post-Employment is aligned with Treasury Board (TB) Policy requirements, there is a need to further strengthen the Policy and other elements of the management framework to better reflect NRC's operating environment and to ensure that COI management is more proactive. Specifically, there is a need to better align the COI program with the level of risk of the NRC's various business areas and activities, increase organizational awareness and monitoring of COI, implement key mechanisms to ensure conflicts are appropriately declared, and better equip managers and employees to proactively manage COI.

Key Takeaways

The NRC has established some necessary elements of an effective COI management framework. In addition to incorporating COI into its Code of Conduct, the NRC has established a separate Policy on Conflict of Interest (COI) and Post-Employment (PE) which facilitates organizational awareness on these topics. The NRC's Policy on COI and PE is aligned with the corresponding Treasury Board Policy and stipulates most basic expectations and requirements related to COI, including most key roles and responsibilities, requirements for employees, and consequences of non-compliance. The NRC has also established several guidance documents on key COI-related topics, and has established a process and form for declaring conflict situations. A review and revision of the NRC's Policy on COI and PE was initiated in 2018 but not completed. The 2018 review as well as this audit have identified some opportunities to strengthen the Policy, guidance and tools to address certain COI risk areas related to the NRC's operational environment.

The Director of Corporate Secretariat (CS), reporting directly to the Secretary General, has been formally delegated the responsibility and authority for the Values and Ethics (V&E) Office, which supports the implementation of the Policy on COI and PE and provides independent advice and assistance to staff on COI matters. As well, we observed some new initiatives to support values and ethics and improve COI management within the NRC in late fiscal year 2018-19 and early 2019-20. These initiatives include the preliminary design of a new values and ethics file management system and workflow; draft content for a new COI training course for employees; establishment of an Ombudsperson position (responsible for managing the V&E Program as well as offering ombuds services); and some recent values and ethics-related outreach by the Corporate Secretariat's Office to specific business units. The Corporate Secretariat further plans to provide high-level V&E information sessions (which include some limited COI content) to all research centres, branches and IRAP within 2019-20. While these initiatives, if continued, will strengthen COI management at the NRC, the audit identified additional areas for improvement.

The audit found that an assessment of the inherent and residual risks for the various types of conflicts that could occur at the NRC has not been conducted. Several positions have been identified as having high inherent risks related to post-employment and are subject to specific requirements to mitigate these risks. However, we found that a sufficient risk-based approach has not been adopted for managing COI risks for new employees outside of the Industrial Research Assistance Program (IRAP) or for current employees. In contrast, IRAP has identified that it has high inherent risks related to COI and has implemented additional controls to mitigate these risks, including the requirement for all new employees to submit a COI declaration form regardless of whether or not they have a conflict. All staff members outside of IRAP, regardless of their position level or responsibilities, are only required to submit a COI declaration form if they identify a potential, actual or apparent COI situation. There is also no requirement for any NRC position to update a previously submitted declaration on a specific periodic basis (e.g. annually).

IRAP management, with support from the Corporate Secretariat's (CS) Office, has been proactive in discussing, promoting awareness, and providing information related COI to IRAP staff. Outside of IRAP, the audit found that the NRC does not provide sufficient information or training to support employee and management awareness and understanding of COI and their individual responsibilities. There are also insufficient mechanisms to support employees in identifying and declaring COIs. For example, there are no periodic reminders or communications regarding COI issued to employees. There is also no periodic requirement for staff to confirm that they have reviewed the Policy and discussed their situation with their supervisor, which was previously required on an annual basis. Further, we identified opportunities to strengthen processes for documenting, assessing and managing COI declarations and consultations, and to clearly define and communicate management's responsibility and accountability for ongoing monitoring of risk mitigation activities.

COI monitoring and oversight activities by the CS team include some COI-related reporting to the NRC Departmental Audit Committee, regular coordination with IRAP related to IRAP's COI program, and some limited ad hoc discussions with other specific business units. We found that the CS team demonstrated awareness of many key issues and challenges related to the COI program. However, there is a need for more structured and frequent monitoring and oversight by the CS and individual business units. Assessments of the effectiveness of the COI program are not performed on a regular basis and no COI-related reports are currently provided to senior management or individual business units.

Given the opportunities for improvement noted above, there is a need to ensure that internal capacities to support the implementation of recommended changes to the COI program are sufficient and appropriate.

Recommendations

1. The Secretary General should identify and assess the NRC's COI vulnerabilities, including the types of conflicts, business areas, positions and activities at greatest risk and strengthen the COI management program accordingly. Based on the results of the risk assessment and the appropriate mitigation strategies, the Secretary General should also assess internal capacities needed to implement changes to the program. [Priority: High]
2. The Secretary General should update the NRC's COI Policy, guidance and procedures to reflect the results of the risk assessment as well as to clearly define the responsibilities and accountabilities of NRC managers. [Priority: High]
3. The Secretary General should develop an overall COI training and communication program that reflects the level of risk of various business areas. The program should include multiple mechanisms to support open dialogue, and increase employee and management understanding of COI risks, scenarios and required actions throughout the employment lifecycle. The following should be included in the program:
   • A requirement that all employees attest, at least annually, that they have reviewed their situation and comply with the COI Policy.
   • A mechanism to clearly communicate the requirements for leaves of absence and post-employment. [Priority: High]
4. The Secretary General should strengthen and define a risk-based approach for managing COI declarations and consultations to ensure more timely and consistent documentation, assessments, decisions and communications. There is also a need to define approval authorities for decisions and action plans. [Priority: Moderate]
5. The Secretary General should increase coordination activities with, and COI information available to, managers to support more active management and monitoring of COI across the NRC. The Secretary General should also regularly monitor the effectiveness of the COI program. [Priority: Moderate]

Acknowledgements

The audit team would like to thank those who collaborated in this effort to highlight the NRC's strengths and opportunities for improvement as they relate to this audit project.

Statement of conformance

This audit engagement was conducted in conformance with the Institute of Internal Auditors' International Standards for the Professional Practice of Internal Auditing and Code of Ethics, as supported by the results of the NRC Quality Assurance and Improvement Program.

Alexandra Dagger, CIA, Chief Audit Executive

1.0 Introduction

There is an expectation that all public servants uphold the values of the Government of Canada and its institutions. Federal departments and agencies are expected to ensure that public servants do not allow their private interests and affiliations to compromise organizational decision-making and management.

The Treasury Board (TB) Policy on Conflict of Interest and Post-Employment defines conflict of interest as "a situation in which the public servant has private interests that could improperly influence the performance of his or her official duties and responsibilities or in which the public servant uses his or her office for personal gain". Conflicts of interest frequently include, but are not limited to, personal, financial, and business interests pertaining to an institution and/or individual, their family members, friends, or professional associates. Conflict of interest (COI) situations may arise during and/or after employment in the public service. A real COI exists at the present time, an apparent COI could be perceived by a reasonable observer to exist, whether or not it is the case, and a potential COI could reasonably be foreseen to exist in the future.^{Footnote 1}

Conflicts of interest can impair an individual's ability to perform his or her duties and responsibilities in an impartial manner. In cases of fraud and misconduct, conflict(s) of interest are often a significant contributor. A COI can also exist where there is no resulting unethical or improper acts. Conflicts may create an appearance of favouritism, which can undermine stakeholders' confidence in staff, their work and the organization.

1.1 Why is this audit important?

The National Research Council of Canada (NRC) is the Government of Canada's largest research organization supporting industrial innovation, the advancement of knowledge and technology development, and fulfilling government mandates. The NRC employs nearly 4,000 scientists, engineers, technicians and other specialists located across Canada.

The NRC has an extensive number of relationships with external parties, and engages in a wide variety of activities to deliver on its mandate. These include, for example, procuring goods and services, entering into contractual agreements, providing financial assistance and advice to enterprises, providing research and technical services, managing intellectual property related to the commercialization of research discoveries, and making a range of decisions that affect Canadians. In 2017-18, the NRC partnered with 8,288 small and medium-sized enterprises to provide funding and advice, 1,000 companies related to R&D contributions, 152 hospitals, 72 universities and colleges, 34 federal departments, 39 provincial/municipal governments and 36 countries.^{Footnote 2} Given the NRC's dynamic and complex environment and extensive number of external relationships, preventing, managing or resolving COI situations is important to help ensure the integrity of the NRC's research, operations and culture, and to help maintain public trust and confidence in the NRC's ability to achieve its mission and uphold its values.

In an organization with a highly connected and specialized workforce it is virtually impossible to avoid all COI situations. Appropriate identification, assessment and management of conflicts is therefore critical. This necessitates employee and management understanding of COI and the organization's expectations, as well as employees' diligence and willingness to discuss COI situations. This is supported by an organization that builds a culture of trust through open dialogue about values and ethics and COI.

1.2 Introduction to the NRC's COI policy and declaration process

The NRC has developed its own Policy on Conflict of Interest (COI) and Post-Employment (PE), and the implementation of the Policy is managed by the NRC's Corporate Secretariat's (CS) Office. COI management is applicable to 3 phases of an employee's tenure with the organization: screening or onboarding a new employee, ongoing throughout employment, and post-employment. The Policy is also applicable to non-permanent employees, casual employees, students, people who are seconded to the NRC, and volunteers. External (non-employee) committee and board members, such as advisory boards and peer review committees, members of the NRC's Council, and the Departmental Audit Committee, are also subject to COI requirements which may be governed by the NRC and/or the Government of Canada.

With the exception of prospective/new employees from the NRC's Industrial Research Assistance Program (IRAP), the NRC does not have a 'positive declaration' requirement, which means that employees are not automatically required to submit a COI declaration form either upon hiring or on an annual basis. NRC employees are required to make a declaration by submitting a COI declaration form (or equivalent) to the Corporate Secretariat's Office when they identify a situation that might give rise to a real, apparent or potential COI in relation to their official duties.

Declarations submitted to the CS Office (including declarations from IRAP) are assessed by CS staff to confirm whether or not the situation constitutes a real, apparent or potential conflict between the individual's personal interests and official duties and/or responsibilities within the NRC. If such a conflict is found to exist, advice is provided and/or mitigation measures are developed to address the situation.

The NRC's Policy on COI and PE also stipulates special measures for designated positions to reduce post-employment COI situations (i.e. real, apparent or potential COIs between someone's responsibilities at the NRC and their subsequent employment outside of the NRC). The following positions are subject to special post-employment measures: IRAP Industrial Technology Advisors and Client Relationship Leaders as well as all managers in the MGT classification category.

2.0 About the audit

The purpose of the NRC's internal audit function is to help the NRC ensure that the proper controls, governance and risk management processes are in place. By nature, it is an independent function that presents objective findings and makes recommendations for corrective measures.

Objective

The objective of the audit engagement was to provide independent assurance that conflict of interest management at the NRC is proportionate to the level of risk and aligned with Government of Canada and NRC values, policies and codes of conduct.

Scope

The audit assessed the NRC's conflict of interest management framework and its implementation. The audit's scope is depicted in Figure 1 below.

Figure 1: Key framework elements and activities included in the audit's scope

Long description

6 text boxes are forming a circle, which represents COI management

COI management framework:

• Risk assessment and mitigation plans
• Roles, responsibilities and accountabilities
• Policy, Code of Conduct and guidance
• Training, awareness, and outreach

Implementation of the COI framework:

• Processes for declaring and managing COIs
• Oversight and monitoring

The audit included an examination of COI management activities across all NRC research centres, branches, and IRAP (CBIs) from January 1, 2016 to February 1, 2019, including:

• individual conflicts of interest throughout the employee lifecycle from screening/hiring to post-employment, as well as non-NRC employees such as non-salaried workers, committee / board members, etc.
• conflicts of duties (i.e., conflicts that arise as a result of concurrent or competing responsibilities in an outside position)

Except where they specifically relate to conflict of interest, the following NRC values and ethics sub-programs were excluded from the scope of the audit:

• Disclosures of wrongdoing under the Public Servants Disclosure Protection Act
• Discrimination, harassment prevention or interpersonal conflict resolution
• Research and scientific integrity
• Political activity
• Research with human or animal subjects

Approach and methodology

The audit criteria, detailed in Appendix A, were derived with consideration of the key risks identified during the planning phase of the audit, as well as the key control objectives set out in the Office of the Comptroller General's Audit Criteria related to the Management Accountability Framework: A Tool for Internal Auditors. The criteria were also developed based on Government of Canada and NRC Codes of Conduct and Policies on Conflict of Interest and Post-Employment, and with consideration to external COI management frameworks and best practices.

The audit criteria formed the foundation of a detailed audit program that allowed us to perform a thorough assessment of the current COI management framework and its implementation.

The audit methodology included the following:

• Review of literature on COI management frameworks
• Interviews with NRC staff from key branches, select research centers as well as IRAP
• Review of relevant documentation and key information systems
• Benchmarking the NRC's COI framework with 4 Government of Canada science-based departments and agencies (SBDAs). Identified best practices are noted throughout the report.
• Review of the log of COI declarations and consultations
• Review of a sample of 27 COI declarations and requests for advice^{Footnote 3}

An external COI subject matter expert was contracted to provide targeted services during the planning, conduct and reporting phases of the audit. The subject matter expert also supported the assessment of the NRC's framework against external best practices and comparator institutions.

This audit was conducted in accordance with Institute of Internal Auditors' International Professional Practices Framework, and the Treasury Board Policy on Internal Audit.

3.0 Audit findings and recommendations

Each section below provides a summary of findings supported by detailed observations, a description of the risk and impact, and recommendations to address areas for improvement.

3.1 Risk assessment and mitigation plans

Both the Treasury Board Policy on Conflict of Interest and Post-Employment as well as the NRC's Policy require that conflict of interest risks related to the organization's mandate be identified and managed. An assessment of COI risks provides information to support an organization in tailoring its COI program to most efficiently and effectively address the highest priority areas.

Some commonly occurring sources of conflicts and risk factors have been identified and documented in the NRC's Policy and guidance, as well as in the designated form that staff can use to declare any real, potential, or apparent conflicts. However, there has not been a comprehensive assessment of the NRC's various COI risks in terms of which types of conflicts are most likely to occur or have the greatest potential impact on the organization, nor which business areas, activities or positions are at highest risk. Though the CS Office collects and records data on COI declarations and consultations, this data has not been analyzed to identify trends or areas of increased risk. The audit identified several operational activities with particular COI considerations for which there is insufficient information available to staff and/or other controls in place to mitigate COI-related risks including adjunct professorships, travel sponsored by external parties, new grants/contributions programs, and spin-off companies (the NRC activities that are spun-off from the organization to form private enterprises).

The audit found that the NRC Industrial Research Assistance Program (IRAP) has identified that, due to the nature of the program, there is a higher inherent risk for conflicts to occur, and have implemented additional processes and mechanisms to manage its COI-related risks. For example, IRAP requires that all prospective Industrial Technology Advisors submit a COI declaration prior to being hired by the organization, and that all other IRAP staff submit a declaration upon being hired. While there is still opportunity to further strengthen the IRAP's COI risk management practices for staff on an ongoing basis, the audit found that IRAP has been proactive in identifying and managing its COI risks and strengthening its COI program.

The NRC has also adopted a risk-based approach to managing post-employment risks, with departing employees in certain designated positions subject to specific measures. However, a risk-based approach has not been adopted for managing COI risks for new hires outside of IRAP or for current employees on an ongoing basis. All non-IRAP staff, regardless of their position level, are only required to submit a declaration when they identify situations, assets or interests that might give rise to a real, apparent or potential COI with respect to their official duties. As well, no employees at the NRC are currently required to update their COI declarations on a set schedule, such as on an annual basis. As such, we found that there is a need for an assessment of the NRC business areas and positions at greatest risk for conflicts to occur and to identify specific positions that should be subject to initial and ongoing declaration requirements.

Using a risk-based approach in the design of the COI program will allow the NRC to focus efforts on areas that possess a greater risk for conflict between employees' personal interests and employment responsibilities. A greater understanding of the risk areas and scenarios will also support the development of efficient and effective plans for training, communication and outreach as well as other necessary controls or mitigation strategies. For example, a low risk COI situation may be mitigated through sufficient awareness of the requirements, whereas a high risk conflict may require explicit policy/directive/guidance, active monitoring, and/or other detection/mitigation measures.

As risk mitigation strategies are developed, there is a need to assess the level of effort required to implement changes to the COI program and ensure that internal capacities are sufficient and appropriate. For example, in deciding whether additional positions should be required to submit mandatory declarations and how frequently employees are required to update their declarations, there is also a need to consider the number of declarations that will be submitted and the estimated time required to process these files.

Recommendation

1. The Secretary General should identify and assess the NRC's COI vulnerabilities, including the types of conflicts, business areas, positions and activities at greatest risk and strengthen the COI management program accordingly. Based on the results of the risk assessment and the appropriate mitigation strategies, the Secretary General should also assess internal capacities needed to implement changes to the program. [Priority: High]

3.2 Roles, responsibilities and accountabilities

The NRC Policy on Conflict of Interest and Post-Employment states that the NRC President has overall responsibility for COI awareness and oversight, management of COI and post-employment situations, and monitoring and reporting. The Policy also specifies that NRC's Secretary General and Senior Ethics Officer are both responsible for supporting the President in executing these responsibilities. The NRC's Director, Corporate Secretariat serves as the Senior Ethics Office and reports directly to the Secretary General. The Corporate Secretariat / Senior Ethics Officer position is included in the NRC's organizational chart, which helps to increase staff awareness of the position. During the audit, a Manager of Ethics, Integrity and Respectful Workplace position (reporting directly to the Senior Ethics Officer) was created and staffed. This position also serves as the NRC's Ombudsperson and is intended to provide a neutral option for employees to discuss the NRC Code of Conduct and ethics and integrity issues including COI. There are 3 V&E Officer positions: one primarily assigned to COI, one primarily assigned to research integrity/ethics and one primarily assigned to harassment prevention^{Footnote 4}.

Staff within the Corporate Secretariat's Office are responsible for processing, assessing and communicating decisions and recommended action plans related to COI declarations and consultations. However, the authority levels for decisions and action plans have not been defined. Through analysis of a sample of 27 declarations and consultations (detailed further in section 3.5.3), we found several instances of complex files processed by staff without evidence of review or input from a higher level of authority. The audit found that there is a need to establish a risk-based approach for review and approval, with more complex files requiring approval by a higher level of authority. Using this type of approach will ensure that there is greater oversight of higher risk cases while also helping to ensure review and approval processes are efficient and effective.

In recognizing its high inherent risks related to COI, IRAP has designated a specific position on a rotational basis to help administer its COI program. Currently, the IRAP Director of Special Initiatives provides COI-related training, guidance and advice to IRAP staff, as well as providing input on the assessment, decisions and action plans for potential / actual / apparent conflicts for IRAP employees. The audit found that IRAP has proactively demonstrated responsibility and accountability in managing COI, which has resulted in stronger practices, as detailed in other sections of the report, and are actively reviewing and developing plans to further strengthen COI management activities.

Outside of IRAP, the NRC's corporate branches and research centres do not have specific positions responsible for supporting the implementation of the COI program, and instead rely on support from the Corporate Secretariat. Through interviews and a review of COI management activities in selected corporate branches and research centres we found that the COI management activities were most commonly focused on dealing with specific conflicts as they arose. CBI managers interviewed as part of the audit reported that COI risk management could be improved by taking a more proactive approach such as promoting increased awareness and discussion about COI and implementing additional controls for higher risk activities (e.g. negotiation of research agreements, security related matters, and contracting). We found that there is a need to ensure managers (as well as employees) better understand their responsibilities and accountabilities with respect to managing and monitoring COI.

During the course of the audit, some new COI-related discussions occurred between the Corporate Secretariat's Office and specific research centres / branches, which resulted in more proactive COI management within those areas. However, there is a need for the Corporate Secretariat's Office (as a second line of defence) to perform more frequent outreach to support management (the first line of defence) in more consistently and proactively monitoring and managing COI across the NRC, in accordance with the level of risk.

Recommendations

Four recommendations later in the report will address these findings.

3.3 Policy, Code of Conduct and guidance

The NRC has developed a Policy on Conflict of Interest (COI) and Post-Employment (PE) (last renewed in 2015) that is separate from the NRC Code of Conduct (2013). The Code of Conduct, which requires updating to reflect the NRC's current vision, mission and value statements, recognizes the importance of preventing, declaring and/or managing real, apparent and potential COIs. The Code of Conduct and Policy on COI and PE form part of the employment conditions for staff.

The benchmarking analysis we conducted identified that some Government of Canada departments and agencies, like the NRC, have established a separate COI policy in addition to incorporating COI into their values and ethics code or code of conduct. Other departments only incorporate COI into their code but do not have a standalone policy. Establishing a standalone COI policy supports increased organizational awareness on this important topic.

In December 2018, the NRC launched its Research and Scientific Integrity Policy. This Policy, based on the Government of Canada's Model Policy on Scientific Integrity, is part of a government-wide initiative to support the responsible conduct of research and the ability of government researchers and scientists to speak freely about their research and science. While the objectives of the Policy are much broader than COI management, it recognizes the importance of high quality work, transparency, openness, and impartiality in helping to ensure that research and science is responsibly conducted. To this end, the Research and Scientific Integrity Policy requires that conflicts are properly recognized, avoided, reported and/or appropriately managed.

In addition to these policies and the Code of Conduct, the NRC has published on its external website the following guidance on key topics related to conflict of interest:

• Guidance for members of NRC advisory committees and boards
• Guidance for IRAP managers and employees
• Outside employment guidelines
• Managing conflict of duties
• COI process flowchart

For the most part, the NRC's Policy on COI and PE mirrors the corresponding Treasury Board Policy and adequately stipulates most basic obligations and considerations with respect to COI, including most key roles and responsibilities, requirements for employees, and consequences of non-compliance. An internal review of the Policy in 2018 identified certain elements that could be strengthened to mitigate specific risks related to NRC operations. Revisions to the Policy were initiated but not finalized. Opportunities to strengthen the NRC's Policy on COI and PE and related guidance that were identified during the internal Policy review as well as during this audit are noted below.

• The NRC's Policy on COI and PE specifies the COI management roles and responsibilities for the President, Secretary General, Senior Ethics officer, and employees. Roles and responsibilities for NRC managers, however, are not documented. The Policy should clearly stipulate management's roles and responsibilities with respect to implementing and monitoring compliance with the Policy.
• As required by Treasury Board, the NRC's Policy currently identifies several designated positions (Client Relationship Leaders, Industrial Technology Advisors and management in the MGT classification category) that are subject to specific measures to reduce post-employment risks. The 2018 Policy review found that this list may not be comprehensive and that further analysis is needed. The designated positions documented in the Policy should therefore be reviewed and updated based on the results of the COI risk assessment recommended in section 3.1.
• There is an opportunity to improve the accessibility of the Policy and guidance by highlighting key obligations of employees and managers, and developing frequently asked questions for common COI situations (e.g. adjunct professorships, travel sponsored by external parties, post-employment, etc.).
• There is a need to more clearly communicate employee obligations related to the protection of proprietary information including intellectual property.

Recommendation

2. The Secretary General should update the NRC's COI Policy, guidance and procedures to reflect the results of the risk assessment as well as to clearly define the responsibilities and accountabilities of NRC managers. [Priority: High]

3.4 Training, communication and outreach

There are many different types and sources of conflicts that can arise, which can vary in complexity and be difficult to identify. It is therefore essential that an organization promotes awareness of the importance of COI management, provides context-specific education, and supports open dialogue about COI.

An NRC-wide COI training and communication plan has not been developed, and we found that most staff outside of IRAP have not received sufficient information on COI. There is a small amount of material on COI in the existing online training program for managers; however, training is completed only once and is not mandatory for managers without direct reports. The management training program is currently being redesigned and the new streamlined program will contain less COI-related content than the previous version.

Outside of IRAP, there is no COI training for employees below management level and there have been no recent corporate-wide communications on COI. Employees' responsibilities with respect to COI are currently communicated via the NRC's Policy on COI and PE, which is referenced in several Human Resources (HR) templates (e.g. offer letters, leaves without pay, alternative work arrangements, acting assignments, secondments, etc.). New employees are also required to electronically sign-off that they have reviewed and understood the Policy.

Previously, the template used to document staff performance appraisals also included a requirement that each employee acknowledge that they had reviewed and understood the NRC's Code of Conduct and Policy on COI and PE, and had been provided with the opportunity to discuss these with their supervisor. NRC's performance appraisal process was transferred to a new online system in fiscal year 2017-18, but no longer includes a requirement to review the Code of Conduct or Policy on COI and PE. However, several managers who we interviewed reported that they continued to rely on this control and were not aware that the new appraisal process no longer included this requirement. There is currently no mechanism in place to remind managers to discuss COI with their staff.

With the exception of IRAP staff, the vast majority of management and staff interviewed indicated that discussions around COI within their team usually occurred when an actual conflict situation was identified. Interviewees frequently reported that general discussions around managing COI risks for their business area, as well as discussions about perceived and potential conflicts, occurred less frequently. Nearly all interviewees reported that there is a need for greater proactive discussion about the types of conflicts that can arise, associated risks, as well as expectations for management and staff.

During fiscal year 2017-18, IRAP provided in person or online training (for those unable to attend in person) to the majority of their staff. The training included common COI scenarios and opportunity for discussion. Discussion about COI also frequently occurred at IRAP senior management team meetings.

IRAP has also implemented COI-related 'onboarding discussions' with prospective candidates for ITA positions, prior to having the candidates submit a COI declaration. Prior to the implementing this onboarding process, IRAP employees were only asked to review the COI Policy and submit a declaration if they identified a potential conflict. However, IRAP found that this was insufficient to properly educate employees on COI and that a significant number of employees did not identify all relevant conflicts. IRAP management reported that having COI-related discussions with prospective employees before the individual joins the organization helps to avoid situations which cannot be easily remedied and helps ensure that the new employment relationship is a suitable fit for both parties.

In fall 2018, the Corporate Secretariat's Office began an initiative to increase awareness about NRC's values and ethics programs and delivered presentations to several teams across NRC. Though these presentations contain a limited amount of content on COI, they have initiated more dialogue about values and ethics, including COI, and helped to increase the visibility of the Corporate Secretariat's Office within these business areas. Management interviewees indicated that discussions with Corporate Secretariat's Office during or after these outreach sessions were helpful in clarifying some uncertainties around COI.

Management interviewees reported that more frequent discussion about COI with the Corporate Secretariat, as well as with representatives from other business areas, would support them in more effectively managing COI risks. The Corporate Secretariat plans to deliver additional high-level V&E presentations to the remaining NRC organizational units within 2019-20.

During the course of the audit, the Corporate Secretariat's Office also initiated the development of content for a new scenario-based online COI training course for staff. There is a need for continued development and implementation of training for general employees, as well as more targeted and in-depth training and outreach for management and those in higher risk positions / business areas.

Recommendation

Recommendation 3 below will address these findings.

3.5 Identifying, declaring and managing conflicts

3.5.1 Identifying and declaring COIs

The NRC's Policy on COI and Post-Employment requires that employees declare any real, apparent or potential conflicts of interest between their official responsibilities and their private affairs. If employees are uncertain whether there is a COI situation, they are expected to seek guidance from the NRC's Senior Ethics Officer and/or their manager. A form for declaring COIs, as well as information on the declaration process, are available on the NRC's external internet site. In addition to receiving formal declarations, the Corporate Secretariat also receives a significant amount of COI-related enquiries from NRC staff via phone or email, which are recorded in the Corporate Secretariat's COI log.

The effectiveness of the NRC's current COI program relies on the awareness and diligence of management and employees to identify and report on COI situations. However, as noted in section 3.4, the majority of staff outside of IRAP have not received any formal training on COI. Further, as there is no annual declaration requirement or mechanism to remind staff to review the COI Policy or their situation, it is likely that the number of real, apparent or potential conflict situations is underreported.

3.5.2 Identifying and declaring conflicts related to post-employment and leaves without pay

As per TBS and the NRC's Policy on COI and Post-Employment, prior to ending their employment with the organization, employees are required disclose any intentions regarding future outside employment or activities that may pose a risk of a real, apparent or potential COI with their current responsibilities and discuss these intentions with their manager or the NRC Senior Ethics Officer. Based on the level of risk, 3 NRC positions (Managers in the executive category (MGT classification), IRAP Industrial Technology Advisors (ITAs) and Client Relationship Leaders (CRLs)) are subject to specific measures to minimize post-employment COI situations. Such measures are important in order to help prevent COI risks prior to and after departure. Examples include the risk that an employee makes a biased decision to benefit a prospective employer or misuses sensitive information for personal benefit or to benefit his or her new employer.

The audit found that only IRAP employees have received formal training on post-employment risks and pre-departure requirements. At the beginning of the audit, there was also no formal mechanism to remind departing staff of their post-employment obligations. During the audit, a one-line reminder was added to the email from HR sent to staff prior to their departure, which contains instructions on the NRC's departure process. However, interviewees reported that this mechanism is insufficient to communicate the requirements to staff. As such, there is a need to ensure employees, particularly those in designated categories, receive more information on post-employment risks and expectations throughout their employment to avoid COI situations that could negatively impact the NRC. Adopting a practice of issuing formal letters to, and/or having discussions with, departing employees (particularly those in designated positions) would help mitigate the risks of situations that could have an adverse impact on the organization.

We also examined some of the controls in place to mitigate the risk of preferential treatment in awarding procurement contracts to former public servants (FPS), including former NRC employees. We found that a process has been established to mitigate the risk of preferential treatment wherein the NRC procurement group identifies prospective procurement contracts that involve FPS and refers them to the Corporate Secretariat for review from a COI perspective. We analyzed FPS procurement contracts executed between January 2016 and December 2018 against consultations in the COI log to assess whether these contracts were referred to the Corporate Secretariat for review. We found that the majority of a sample of repeated contracts with 11 FPS vendors were not referred for review. However, the implementation of a recommendation from a recent separate NRC internal audit, the 2019 Audit of Procurement and Contracting, could help to ameliorate this issue.

In addition, we examined the processes for communicating COI requirements for staff on a leave of absence from the organization. The agreement templates for leaves of absence without pay state that while on leave the individual remains an NRC employee and is obligated to comply with the COI Policy, and to contact the Corporate Secretariat if they have questions regarding the implications of the Policy. Interviewees indicated that additional communication mechanisms are needed to ensure that employees fully understand the types of COIs that could arise while on leave, the associated risks and their obligations to the organization, as well as to ensure that situations that may create a conflict are promptly reported.

Recommendation

3. The Secretary General should identify and assess the NRC's COI vulnerabilities, including the types of conflicts, business areas, positions and activities at greatest risk and strengthen the COI management program accordingly. Based on the results of the risk assessment and the appropriate mitigation strategies, the Secretary General should also assess internal capacities needed to implement changes to the program.
   • A requirement that all employees attest, at least annually, that they have reviewed their situation and comply with the COI Policy.
   • Mechanisms to more clearly communicate the requirements for leaves of absence and post-employment. [Priority: High]

3.5.3 Processing, assessing and communicating decisions on COI files

The audit examined the processes executed by the Corporate Secretariat in processing, assessing and communicating decisions regarding COI declarations and consultations submitted by staff. To assess these processes, we reviewed a sample of 27 COI declaration and consultation files to determine if key steps were followed, there was sufficient documentation, appropriate parties were consulted or informed, the assessment and mitigation strategy was reasonable, and the process was timely.

We noted the following opportunities to strengthen the management of COI files:

1. Sufficient information and documentation

   Documentation to support each COI file typically included the COI declaration, email consultations, some notes recorded in the COI log and occasionally a memorandum for complex files. Through the file reviews, we found that some key information to support assessments and decisions was not documented, particularly in cases where discussions took place via phone or in-person. As well, some key information was not recorded in the COI log such as whether the assessment determined there was a conflict and whether a mitigation plan and ongoing monitoring were recommended. There is a need to ensure relevant supporting information and decisions are documented in the file as well as the COI log.

2. File management practices

   We reviewed all 528 COI declarations and consultations recorded in the COI log between January 2016 and December 2018 to assess the length of time between the date the declaration was received and date the file was closed. A detailed aging chart is presented in table 1 below.

   Table 1: Processing time for COI declarations and consultations (2016-2018)

   Length of time taken (from receipt to closure, in business days)	% of Files
   Less than 30 days	84
   30 to 90 days	8
   90 days to 1 year	4
   Greater than 1 year	4
   Data not available	1

   Benchmarking best practice

   95% of files closed within 30 business days, as per the service standard target.

   Source: SBDA

   Though complex cases can require the need for consultations with multiple parties which can lengthen the processing time, audit testing identified that delays were often due to file management practices. Examination of files selected for detailed testing found that 2 of 27 files were not processed at all and no assessment was conducted. For an additional 5 files, an assessment was initiated but not completed and/or insufficient guidance was provided. There is a need to ensure declarations and requests for advice are immediately logged and files requiring further assessment are flagged to ensure timely action is taken.

3. Information and clear expectations to support compliance and monitoring

   The Corporate Secretariat's Office has adopted an advisory approach with respect to communicating decisions and recommended actions for COI declarations/consultations. Decisions and recommended actions are communicated via email and no formal report or letter is produced. Employees are generally not required to provide evidence that they have taken action to correct the situation, and the Corporate Secretariat's Office does not perform any ongoing monitoring.

   We also identified several instances where the Corporate Secretariat's Office concluded there was a conflict but the decision and mitigation plan was communicated to the employee alone, or where the employee was told to notify their manager of the situation. This approach increases the possibility that mitigation measures are not properly implemented. File reviews identified several cases where the recommended actions and/or follow-up were not completed. There is a need to ensure that managers are informed of conflicts for their employees and the recommended mitigation measures. There is also a need to ensure that individual(s) responsible for implementing the mitigation measures and monitoring the situation are clearly identified and acknowledge their responsibilities.

   Further, we found that because decisions on COI declaration/consultation files are usually only communicated via email and only the Corporate Secretariat's Office has access to the COI log and files, new managers entering a position typically do not have access to information on action plans for their employees that were communicated the previous manager.

As of June 2019, the Corporate Secretariat, in collaboration with IRAP, was in the preliminary stages of developing a new values and ethics file management system including a new workflow for managing COI declarations. As part of the audit, we reviewed an early-stage draft COI workflow, and provided advice on required controls to strengthen the process. As the project design and implementation proceeds, there is a need to ensure the new system and workflow are efficient and effective in order to address the issues noted above.

Recommendations

4. The Secretary General should strengthen and define a risk-based approach for managing COI declarations and consultations to ensure more timely and consistent documentation, assessments, decisions and communications. There is also a need to define approval authorities for decisions and action plans. [Priority: Moderate]

Recommendation 5 also addresses these findings.

3.5.4 Processes for managing suspected or actual violations of the COI policy

Management, with support from the Labour Relations group within the Human Resources Branch, is responsible for managing cases of suspected or actual violations of the COI Policy. Investigations are either conducted internally by the Security Branch or by an external contracted investigator. As needed, and upon the request of the Vice-President for the respective business unit, a Critical Issues Committee (CIC) may be invoked in order to share information and undertake measures to address the possibility of serious wrongdoing or situation that has the potential for a negative impact on the NRC as a whole. The CIC is led by the Vice-President of Corporate Services and Chief Financial Officer, and the composition of the committee may vary depending on the specific situation.

Suspected or actual violations of the COI Policy can be reported through various means, including to management, the Corporate Secretariat, Human Resources, or Security Branch. As per the Public Servants Disclosure Protection Act, the NRC has established a program to protect employees from reprisals when making allegations of wrongdoing. Both of the external NRC webpages on disclosure protection and COI provide contact information for the NRC Senior Ethics Officer and COI office respectively. There is currently no anonymous hotline by which employees or external parties can report suspected or actual cases of wrongdoing. The Corporate Secretariat has identified this as a priority area and has initiated steps to establish an anonymous hotline. Our interviews with management and staff indicated that there is an opportunity to increase awareness of the disclosure protection program amongst staff. During the latter part of the audit, the Ombudsperson position was staffed and a campaign was initiated to increase awareness about the position.

Though the Director of Corporate Secretariat is not responsible for managing COI violations cases, it may be informed or consulted, typically by Labour Relations staff within the Human Resources Branch. The audit found that the Corporate Secretariat's Office was consulted or informed for most but not all cases. While this report does not include a formal recommendation on this matter, there is need to ensure that the Corporate Secretariat is promptly notified of all cases to ensure their independent subject matter expertise is considered, in order to support consistency and fairness between similar cases. As well, timely information on such cases will also inform the Corporate Secretariat of risk areas that may require additional oversight.

3.6 Monitoring and oversight of the COI program

The NRC's Departmental Audit Committee (DAC) provides the President with objective advice and recommendations on values and ethics, one of its key areas of responsibility. Within the period under review, the NRC Secretary General presented to DAC on values and ethics at least once per year, and all presentations included some information on the COI program. At the most recent meeting in March 2019, the DAC identified the opportunity to improve reports by providing more data on reported conflicts. At the same meeting, IRAP also provided some information on its COI management program, as per DAC's request.

The Corporate Secretariat records some data on COI declarations and consultations. However, this information is not currently analyzed or shared with research centres, branches, IRAP or senior management. The Human Resources Branch also collects data on investigations of breaches of the Policy on COI and PE but does not prepare summary reports for the Corporate Secretariat or senior management's information. Analysis of COI data and issues could help identify trends and priority areas, such as the need for an information campaign on a particular COI topic or targeted training / outreach for particular business area / position type.

While the NRC has a Critical Issues Committee that meets to discuss specific incidents as well as a recently established Fraud Risk Management Framework committee, it does not have a standing committee that discusses general matters related to V&E / COI programs.

We found that there is frequent communication and coordination between IRAP and the Corporate Secretariat's Office regarding IRAP's COI program. As well, we found that the Corporate Secretariat's Office performed some consultations with management in business units outside of IRAP to discuss specific issues and/or opportunities to improve the COI management program. However, based on feedback from management, there is a need for more frequent and broader discussions and exchange of information between the Corporate Secretariat's Office and business units and/or across business units. This will ensure management has access to timely and relevant COI information to facilitate monitoring and information on best practices to support continuous improvement of the COI program.

The Corporate Secretariat's Office does not currently conduct formal assessments of the effectiveness of the COI management program or provide COI-related information to senior management. However, we found that the Corporate Secretariat's Office demonstrated awareness of many key issues and challenges related to the COI program and, during the course of the audit, initiated some preliminary activities to strengthen the program (as noted in other sections of this report).

Recommendation

5. The Secretary General should increase coordination activities with, and COI information available to, managers to support more active management and monitoring of COI across the NRC. The Secretary General should also regularly monitor the effectiveness of the COI program. [Priority: Moderate]

Appendix A: Audit criteria

The following criteria were used to evaluate COI management at the NRC:

Appendix B: Management action plan