Audit of Intellectual Property (IP)-related royalties and awards

Executive summary

As an agent of the Government of Canada (GC), the National Research Council (NRC) creates and manages a portfolio of intellectual property assets in support of its mandate and the advancement of scientific and technological knowledge and innovation for Canada. During fiscal year 2017–2018, the NRC maintained approximately 1,700 patents and realized approximately $12M of licence and royalty revenues.

In 1994, the NRC established the Inventor and Innovator Award Program (IIAP) in accordance with the Treasury Board's Award Plan for Inventors and Innovators Policy, allowing employees responsible for scientific and technological inventions to share in the financial benefits accruing from commercialization of inventions. The NRC's IIAP was in place until 2012, when it was replaced with the Patent Recognition Program (PRP), allowing inventors to receive a fixed amount award at key stages of patentable inventions. As part of the transition from the IIAP to the PRP, the NRC determined that some inventions would be grandfathered and award payments would continue to be made to the NRC's employees in accordance with the IIAP. Starting in 2017, the NRC has been re-evaluating how to recognize employees for invention and innovation and is in the process of developing a new awards program. The NRC Business Services Team (BST), currently under the Vice President (VP) of Business and Professional Services (BPS), is responsible for the management of the NRC intellectual property (IP) portfolio, as well as related royalties and awards payments since fiscal year 2012-13.

The NRC's Office of Audit and Evaluation conducted an audit of the IP-related royalties and awards upon the request of senior management. The objective of this audit was to provide assurance that the appropriate governance, risk management, and controls have been implemented for the framework that supports the NRC's royalties and awards activities related to the Intellectual Property (IP) it generates, to ensure it is managed according to GC and NRC policy, while enabling the organization's innovation and research-based mandate. The audit focused on practices in place between April 1, 2017 and November 30, 2018.

The audit noted that in 2018 the NRC conducted an internal review of the IIAP with the goal of ensuring adequate controls were in place and also understanding the NRC's current and future obligations under the IIAP and recommending a more robust process for administering grandfathered awards. As a result of this review, a number of process improvements were implemented including the development of standardized tools and templates to calculate and track the collection of royalties and payment of awards and the implementation of additional internal controls in the royalties and awards processes. Furthermore, an effort was undertaken to obtain supporting documentation from the NRC's 14 research centres relating to active licensing agreements grandfathered under the IIAP.

In addition to these improvements, the audit identified key areas for improvement as outlined below and further clarified in the audit report.

Long description of Figure 1: key takeaways

This flow chart summarizes the 2 main findings of the audit, related to 3 areas. Which are policy, governance and control.

1. Policy guidance for IP-related royalties and wards is not clear. This is most notable in relation to the transition from IIAP to PRP (Finding 2)

   Decisions on interpretation of policy has been ad hoc, resulting in a governance weakness in the framework.

2. Governance and decision making for IP-related royalties and awards is unclear. Decisions were not always formally documented or communicated, and policy has not been updated (Finding 1)

   This resulted in a policy weakness in the framework.

3. Business process control weaknesses (lack of automated controls: and lack of compliance monitoring (Finding 2)

   In cases where requirements were clear, there was not always adherence given poor controls and a lack of monitoring resulting in a control weakness in the framework.

The impact of governance, policy, and control weaknesses result in four risk exposures: incomplete invoicing of royalties; errors (under or over) in award payments; non-compliance with NRC and or GC policies; and legal and reputational repercussions.

Finding 1 – governance and decision making

Decisions made by the Senior Executive Committee (SEC), comprised of the President and VPs, did not always translate into program requirements when the IIAP program was rescinded and replaced with the PRP program in 2012. As decisions were made, program policy and related documentation to operationalize these decisions were not updated, nor were these decisions effectively or formally communicated to stakeholders throughout the NRC at the time.

Furthermore, in the case of the grandfathered IIAP files, the policy requirements were interpreted by the NRC's staff on a "case-by-case" basis. A few instances were identified during the audit period, mostly related to making changes to the individuals listed on an award distribution agreement sharing the IP revenue. As a result of some of the actions taken by the NRC's management and staff in the absence of formal guidance, inconsistent practices have been adopted that are not aligned with SEC decisions or the documented policies, but continue to be applied in the payment of awards. As updates to the NRC awards program are contemplated, effective governance mechanisms and communication of decisions are of increased importance to ensure similar issues do not occur.

Finding 2 – policy and compliance

Policy requirements for IP-related royalties and awards are not clear, and more detailed operational guidance and related training have not been developed. Processes for monitoring the royalty and awards payment processes could also be further improved, given the degree to which current processes are highly manual, increasing the risk of errors or miscalculations. An overall compliance program to ensure individuals involved in the royalties and awards processes are adhering to requirements, as well as to identify problematic files, has not been established. Going forward, this carries the risk of inconsistent or inappropriate management of IP-related royalty and awards payments.

Overview of recommendations and priority

Long description of Overview of recommendations and priority

This chart shows which recommendations will be implemented in the short term, medium term, and longer term.

• 2 recommendations need to be implemented in the short-term, before completing the implementation of all other recommendations in order to ensure accountability is clear for decision making.
  • (Rec 1) Define accountabilities and responsibilities for the royalties and awards processes including monitoring and oversight.
  • (Rec 2) Implement the required governance mechanisms, in terms of how and whom can make decisions related to royalties and awards process(es). Include how decisions are communicated to the organization.
• 3 recommendations should be done in the medium-term:
  • (Rec 3) Develop a complete royalties and awards policy suite for all active awards programs.
  • (Rec 3) Document guidance that reinforces the roles and responsibilities of all groups involved in the payment of awards.
  • (Rec 3) Develop and communicate training material Although all should be done in the medium-term, there are dependencies in that policies should be completed first to inform tools/templates, and then training developed on those.
• 1 recommendation could be implemented in the longer-term:
  • (Rec 4) Implementing a policy compliance process for IP-related royalties and awards, including processes to monitor the payment of royalties and awards. Opportunities to further automate workflows and controls should be identifies that would then require less resource intensive monitoring.

Note: Some "quick wins" related to automation could be introduced much sooner.

Audit opinion and conclusion

In my opinion as Chief Audit Executive, improvements to the NRC's IP-related royalty and awards governance, risk management, and controls are required to ensure they are managed in accordance with Government of Canada and NRC policy, while enabling the organization's innovation and research-based mandate. The NRC should continue to strengthen its management practices through various ongoing improvements and risk-based considerations, as set out in this audit report. Until the recommendations of this report are implemented, it is recommended that NRC management invest resources in increased data analysis and monitoring of IP related royalties and awards.

Statement of conformance

In my professional judgement as Chief Audit Executive, the audit conforms to the Institute of Internal Auditors' International Standards for the Professional Practice of Internal Auditing (IIA Standards) and the Code of Ethics, as supported by the results of the Quality Assurance and Improvement Program.

Alexandra Dagger, CIA, Chief Audit Executive

Audit team

The audit was undertaken by Deloitte on behalf of the NRC Office of Audit and Evaluation.

Audit report

Introduction

The National Research Council (NRC) generated more than $12M in licensing revenues from Crown-owned Intellectual Property (IP) in fiscal year (FY) 2017-2018. A portion of the revenue, $1.3M, was paid to approximately 250 individuals as awards for their contribution to the development or the commercialization of the licensed IP. One of the key strategic objectives of the NRC is to drive innovation through mechanisms such as the development of IP. The Audit of IP related royalties and awards was identified as a high-priority project and approved by the President of the NRC following the recommendations of the Senior Executive Committee (SEC) and the Departmental Audit Committee (DAC) as part of the NRC's 2019 to 2021 Risk-based audit plan.

Background and Context

The NRC is an agency of the Government of Canada (GC), reporting to Parliament through the Minister of Innovation, Science and Economic Development (ISED). It is governed by a Council of appointees drawn from its client community. The NRC is led by a Deputy head-equivalent President, and a number of Vice Presidents (VPs).

As outlined in the NRC's Priorities for FY2018–2019, a key goal for the NRC is advancing scientific and technological knowledge through, among other things, the creation of intellectual assets by the NRC's experts. The NRC conducts and sponsors a wide range of scientific activities during which it creates, acquires, or procures various forms of IP to support the mandate of the NRC and the priorities of the federal government.

As stated in its Intellectual Property policy, the NRC seeks to extract the maximum value from the IP that it develops and co-develops, and seeks to ensure that its IP protection and commercialization strategies support the current and future needs of Canada and the NRC. This is in part, achieved through the development of formal licensing agreements with external parties as the NRC receives royalty payments from licensees. Depending on the applicable awards program, current or former NRC employees may be eligible to receive awards at key stages of the patenting process or as royalties are collected from licensees.

In 1994, the NRC established the Inventor and Innovator Award Program (IIAP) in accordance with the Treasury Board's Award Plan for Inventors and Innovators Policy. This Treasury Board policy required that Federal departments and agencies establish an award plan to allow employees responsible for scientific and technological inventions to share in the financial benefits accruing from commercialization of these inventions.

The NRC's IIAP was in place until 2012, when it was replaced with the Patent Recognition Program (PRP) following the rescinding of the Treasury Board's Award Plan for Inventors and Innovators Policy. Through the rescinding of this policy, departments and agencies were given discretion in the provision of awards for the development of IP by public servants on behalf of the Crown. Where the IIAP required award payments to be made to inventors and innovators (non-inventors who play a role in the development or commercialization of IP) based on a percentage of royalty revenues received by the NRC, the PRP provided a new structure for awards payments. The PRP required payment of a flat fee per patent to inventors at key stages of the invention patenting process and no longer permitted the NRC to make awards payments to innovators. As part of the transition from the IIAP to the PRP, the NRC determined that some inventions would be grandfathered and award payments would continue to be made to the NRC's employees in accordance with the IIAP. Since 2017, the NRC has been re-evaluating how to compensate employees for invention and innovation and is in the process of developing and implementing a new awards program to replace the PRP. Appendix B presents further detail on the payments executed under both IIAP and PRP over the last 4 years.

In 2018, the NRC conducted an internal review of the IIAP with a goal of ensuring adequate controls were in place and also understanding the NRC's current and future obligations under the IIAP and recommending a more robust process for administering grandfathered awards. As a result of this review, a number of process improvements were implemented including the development of standardized tools and templates to calculate and track the collection of royalties and payment of awards and the implementation of additional internal controls in the royalties and awards processes. Furthermore, the review noted that the transfer of supporting documentation relating to active licensing agreements from research centres to the Business Management Services team (now called the Business Support Team [BST]), part of the 2012 centralization of responsibility for managing the royalty collection and awards payment processes, was incomplete. An effort was undertaken in 2018 to obtain all supporting documentation from the 14 research centres relating to active licensing agreements including those grandfathered under the IIAP. The BST has continued to improve processes and controls beyond the period covered in this audit. They have informed us of BST actions taken to review all active IIAP files, a BST initiative to review the roles and responsibilities and plans for the NRC Oversight Committee to undertake monitoring activities.

Key stakeholders in the royalties and awards activities related to the IP the NRC generates include:

• Business Services Team under the Director General (DG), National Programs and Business Services, reporting to the VP, Business and Professional Services
• Finance and Procurement Services Branch (Accounting Ops, Advisory Services and Resource Management, Accounts Receivable, Accounts Payable) under the DG, Finance and Procurement Services reporting to the VP, Corporate Services and Chief Financial Officer (CFO)
• Research Centres (Management, Researchers) led by Directors General reporting to a Research VP.

Accountabilities of key stakeholders as they relate to the royalties and awards processes are outlined in Figure 2.

Long description of Figure 2: key stakeholders

This image represents 3 groups of key stakeholders, each with a short description of their accountabilities in the management of intellectual property and related royalties and awards, using integrated circles:

1. NRC's 14 Research Centres (RC's) which each report to a Research VP.
   • Accountability for the identification of inventions, patenting of IP, and the execution of licensing agreements with partners rests with each of the NRC Research Centres led by their respective Directors General reporting to a Research VP.
2. National Programs and Business Services (NPBS) under the VP Business and Professional Services
   • Accountability for the invoicing of royalties from partners with whom NRC has entered into licensing agreements and the managements of award payments to NRC employees rests with the Business Services reporting to the VP, Business and Professional Services.
3. Finance and Procurement Services Branch under the VP, Corporate Services and Chief Financial Officer (CFO)
   • Accountability for the financial management of royalties and awards with specific responsibilities for processing awards payments to NRC employees rests with Finance and Procurement Services (FPS) under the DG, FPS, reporting to the VP, Corporate Services and Chief Financial Officer.

The NRC has 2 key IT systems used for the management of the invoicing and collection of royalties, as well as the payment of awards:

• A cloud-based IP Management System (IPMS) used by the Business Services Team (BST) to record the terms and conditions of licensing agreements upon the execution of a licensing agreement. Throughout the life of each licensing agreement, the system is also used to track the collection of royalties and payment of awards.
• The Departmental Financial Management System (DFMS). The Sales and Distribution Module (SDM) is used by the NRC's Finance Branch to record and manage all financial processes from order to delivery including the billing and collections of royalties. Payments of awards are processed through the accounts payable function of the DFMS.

About the audit

Objective

The objective of the audit was to provide assurance that the appropriate governance, risk management, and controls have been implemented for the framework that supports the NRC's royalties and awards activities related to the IP it generates, to ensure it is managed according to GC and NRC policy, while enabling the organization's innovation and research-based mandate.

Scope

Based on the Planning phase risk assessment, the Conduct phase of the audit focused on the following key foundational elements:

• The governance and policy framework for IP royalties and payment of awards
• Business processes related to the collection of IP royalties and payment of awards
• IT systems and reporting processes.

An assessment of the licensing agreement process with external parties in which IP may ultimately be identified, has been included within the scope of a separate audit ^{Footnote 1}. Excluded from the scope of this audit, were processes related to the identification (i.e., invention disclosures and patenting decisions) and administration of IP (i.e., IP protection and enforcement). The scope of the audit was focused on testing the design and implementation, as well as the operating effectiveness of the current state business process controls related to the collection of royalties and payment of awards for licensing agreements, including agreements subject to the PRP and agreements grandfathered under the IIAP, that were active during the audit period (April 1, 2017 to November 30, 2018).

Approach

The audit was conducted in accordance with Institute of Internal Auditors (IIA) Standards and the Treasury Board Policy on Internal Audit and related policy instruments. Through the Conduct phase of the audit (refer to Appendix A for audit criteria), fieldwork was conducted through the review of documentation and the completion of interviews with key stakeholders including management and staff of the following groups within the NRC:

• Business Services Team reporting to the VP, Business and Professional Services
• Finance and Procurement Services Branch (Accounting Ops, Advisory Services and Resource Management, Accounts Receivable, Accounts Payable) reporting to the VP, Corporate Services and Chief Financial Officer (CFO)
• Research Centres (Management, Researchers) reporting to a Research VP

A total of 4 research centres were selected for site visits to ensure coverage across multiple research divisions and geographic locations.

Long description of Figure 3: Scoped-in Research Centres

Map of Canada indicating the general location of four NRC research centres visited for this audit:

• Energy, Mining and Environment (EME) in British Columbia
• Automotive and Surface Transportation (AST) in Ontario
• Human Health Therapeutics (HHT) in Quebec
• Medical Devices (MD) in Quebec

A sample of 42 licensing agreements were also selected to assess the effectiveness of key business process controls related to the collection of royalties and payment of awards. To ensure broad coverage of the agreements in scope for the audit, a number of attributes were taken into consideration when selecting the sample, including research centre and type of client. As they represent a large percentage of the NRC's licensing agreements, an emphasis was placed on agreements subject to the IIAP due to the higher degree of complexity related to the payment of awards for these agreements.

Long description of Figure 4: licensing agreements by research centre

Research Centre	Total License Agreements	Selected for Detailed Testing
Human Health and Therapeutics	237	13
Automotive and Surface Transportation	17	3
Energy Mining and Environment	19	4
Medical Devices	31	7
Advanced Electronics and Photonics	13	1
Aerospace	12	2
Aquatic and Crop Resource Development	25	3
Construction	2	0
Digital Technologies	51	4
Metrology	30	2
Nanotechnology	0	0
Ocean, Coastal and River Engineering	6	2
Security and Disruptive Technologies	15	1

Audit findings and recommendations

As outlined earlier, as a result of the 2018 internal review of the IIAP, a number of process improvements were implemented including the development of standardized tools and templates for the collection of royalties and payment of awards and the implementation of additional internal controls in the royalties and awards processes. For example, a control was implemented whereby the Director, BST reviews and approves all invoices for IP royalties. This improvement, along with a number of others, was implemented to address issues related to the inaccurate invoicing of royalties and calculation of awards for 1 contract with a key client.

This audit identified areas for improvement. An overview of these key findings and their impact on current business process controls and compliance to policy are outlined in Figure 2. Further details on these findings as well as recommendations intended to improve the NRC's IP-related royalties and awards processes are detailed further in this report.

Long description of Figure 1: key takeaways

This flow chart summarizes the 2 main findings of the audit, related to 3 areas. Which are policy, governance and control.

1. Policy guidance for IP-related royalties and wards is not clear. This is most notable in relation to the transition from IIAP to PRP (Finding 2)

   Decisions on interpretation of policy has been ad hoc, resulting in a governance weakness in the framework.

2. Governance and decision making for IP-related royalties and awards is unclear. Decisions were not always formally documented or communicated, and policy has not been updated (Finding 1)

   This resulted in a policy weakness in the framework.

3. Business process control weaknesses (lack of automated controls: and lack of compliance monitoring (Finding 2)

   In cases where requirements were clear, there was not always adherence given poor controls and a lack of monitoring resulting in a control weakness in the framework.

The impact of governance, policy, and control weaknesses result in four risk exposures: incomplete invoicing of royalties; errors (under or over) in award payments; non-compliance with NRC and or GC policies; and legal and reputational repercussions.

Finding 1 – Governance and Decision Making

Observations

Both the IIAP and PRP policies indicate that the NRC President is responsible for implementing the program(s) and for authorizing all award payments. Although the respective policies indicated specific groups are responsible for the management of the program(s), they do not articulate accountability for decision making, or specific thresholds for the delegation of decision rights (i.e., the level of approval required for decisions impacting the programs as a whole versus the level of approval for 'one off' decisions with a narrower scope / impact).

Decisions in 2012–2013, made by the Senior Executive Committee (SEC), comprised of the President and VPs, have not always translated into program requirements. For instance, in December 2012 SEC approved a payment amount of $400 flat fee per invention; however, the PRP is using an award amount of $375. In addition, although the SEC limited the grandfathering of agreements under the IIAP to agreements signed prior to September 2011 for which an Awards Distribution Agreement was in place, a decision was communicated by a VP in 2014 to also grandfather agreements for which no Awards Distribution Agreement existed if awards payments had been paid against that agreement prior to September 2011. Evidence that this decision was formally documented or approved was not able to be provided.

Furthermore, due to the lack of formally documented guidelines for the transition from the IIAP to the PRP, the policy requirements for the grandfathering of IIAP files were interpreted by the NRC's management and staff on a "case-by-case" basis. Decisions made in 2012–2014 (outside the audit period) were not reflected in the IIAP program policy and related documentation to operationalize these decisions, nor were these decisions effectively or formally communicated to stakeholders throughout the NRC. As a result of some of the actions taken by the NRC's staff in the absence of formal guidance, in the case of the IIAP program, precedents have been set that are not aligned with SEC decisions or the documented policies, but continue to be applied in the payment of awards. Examples include program management allowing for changes to the individuals listed on an award distribution agreement without additional approval, as well as continuing to make payments based on gross and not net revenue.

The NRC Financial Signing Authorities (FSA) Matrix provides that expenditure initiation authority for award payments rests with the NRC President for amounts over $500. In December 2018, the President signed a briefing note noting that the NRC's IIAP and PRP policies serve as expenditure initiation authority for all awards payments that meet the policies' criteria for as long as the policies remain in effect; however, formalized processes are not in place to verify the NRC's unencumbered balances or manage commitments on an ongoing basis in accordance with Treasury Board's requirements.

Finding 2 – Policy and Compliance

Observations

During the transition from the IIAP to the PRP in 2012, the NRC determined that some inventions would be grandfathered, and award payments would continue to be made to current and former NRC employees in accordance with the IIAP for inventions that were grandfathered. A comprehensive set of rules or guidance related to this transition was not developed. Policy documents have also not been developed or updated to reflect decisions related to the IIAP awards program that have been made by senior management and the NRC's staff, nor has more operational guidance documentation been developed to ensure IIAP policy requirements are interpreted correctly. In relation to the grandfathered IIAP files, the lack of a clear and comprehensive policy for awards payments increases the risk of the inconsistent application of award payment decisions as well as non-compliance with policy, or appearance of such.

The IIAP required that award payments are to be made to the individuals listed on the applicable Award Distribution Agreement, unless management approval has been obtained and changes are communicated to all employees affected by the change. A formal process, and applicable guidance documentation, to ensure these updates are made and approved has not been codified for the grandfathered files. Detailed audit file testing identified 2 instances out of 14 files tested where award payments were made to individuals that were not on the originally approved version of the Award Distribution Agreement. Evidence that management approved the changes and employees were notified of the changes was not able to be provided to the audit team.

The IIAP required that payments to DGs are approved by the respective VP to manage conflict of interest or appearance of such. A process, and applicable guidance, to operationalize this practice has not been developed for the grandfathered IIAP files. Detailed audit file testing identified 1 example of an award payment made during the audit period to a DG without obtaining the approval of the responsible Vice President (VP).

Instances where application of the original IIAP policy requirements was not clear and has been inconsistently applied before and after the policy rescinding were also identified. Examples include deduction of expenses from IP revenues and royalties paid at 100% of IP revenues where revenues are under $1,000. Payments have been made on gross revenues and calculated at a rate of 35% of IP revenues under $1,000.

Processes for monitoring the royalty and awards payment processes could be further improved, given the degree to which current processes are highly manual, increasing the risk of errors or miscalculations. BST calculates royalties using a spreadsheet based on sales reports that are provided by clients. The spreadsheet is sent to Finance to create the invoice, which is sent back to BST to send to the client. When the invoices are paid to Finance, there is no automated indication provided to BST. When BST becomes aware of a payment, BST completes the awards spreadsheet, which is then sent to Finance for payment. There is no automated indicator provided to BST of when the payment is made. Supporting documentation is not stored in a centralized repository accessible to finance, business support and research centre staff.

A compliance program to ensure individuals involved in the royalties and awards processes are adhering to policy and business process requirements has not been established. It was noted that the IIAP and PRP policies do not explicitly assign responsibility for ensuring compliance or performing monitoring of program activities.

In addition to the lack of an awards program compliance function, there is no formal training and learning strategy or plan (identifying the training required for different stakeholders). Of note, the development of a training program would first require there to be clarity around the policy and operational procedures to be followed. The lack of a formal training plan and documented guidance increases the likelihood of non-compliance with policy and the potential for decisions to be made that are not aligned with senior management's expectations.

Appendix A – lines of enquiry

The Conduct phase of the audit was completed based on the lines of enquiry below, the scope of which included both the management of research and licensing agreements as well as the management of IP-related royalties and awards (noting that the outcome of some licensing agreements are the payment of royalties and awards). For reporting purposes, 2 separate reports were prepared, 1 related to IP-related royalties and awards (this report) and a separated Audit of Research and licensing agreements.

Lines of enquiry

1. There is clearly defined accountability for IP-related royalty and awards activities that is supported by an effective governance and risk management framework.
2. A policy framework has been implemented for IP-related royalty, and awards activities that is complete and clearly communicated, which is supported by processes, guidelines, templates and staff training and awareness. Adherence to the policy framework is monitored.
3. An internal control framework is in place to guide IP-related royalty and awards process. Key controls are appropriately designed and operating effectively.
4. IT systems provide support and audit trail functionality for IP-related royalty and awards activities.
5. Reporting has been established for IP-related royalty and awards activities, and reporting provides the appropriate insight to staff and senior management for decision-making.

Appendix B – NRC IP-related awards program value and recipients

Total amount of awards invoiced between the NRC's Inventor and Innovator Award Program (IIAP) ^{Footnote 2} and Patent Recognition Program (PRP) between FY2016 and FY2019.

Long description of Appendix B – total amount of awards

	IIAP	PRP
FY2016	$1,344,573	$46,125
FY2017	$1,809,759	$33,375
FY2018	$1,251,177	$60,750
FY2019	$1,882,144	$76,875

The total number of recipients of IP related awards across the PRP and grandfathered IIAP between FY2016 and FY2019.

Long description of Appendix B – total number of recipients

Number of recipients	IIAP	PRP
FY16	175	94
FY17	152	66
FY18	147	109
FY19	159	111

Appendix C – management action plan