Internal Controls Monitoring – 2023‑24 Results (Year 3)

3.1 Previous Year Recommendations

MPCC undertook a review of these internal controls for the first time during the year 2021/22. Five recommendations were issued for the three business processes reviewed, and three recommendations were issued for two business processes for the assessment for the year 2022/23. All the recommendations were assessed as low and medium risk ratings.

At the time of our assessment for the year 2023/24, steps had been taken to implement the management action plan developed, whereas four recommendations have been closed, while the others are in various stages of implementation. Samson examined documentation to validate that the management action plans have been implemented. It is expected that MPCC will continue to ensure that the majority of its recommendations will be implemented in the next year. Samson will monitor the progress during this assessment again next year.

For additional details on the previous recommendations issued, management action plans and their progress, refer to Appendix C.

3.2 Procure to Payment

The scope of the controls for the Procure to Payment business process starts with completing a MPCC local purchase form. The form is sent to Financial Administration Act (FAA) section (S.) 32 approval and the commitment is recorded in CDFS. To ensure that commitments are maintained and updated in a timely manner, MPCC maintains a tracking spreadsheet for all commitments recorded.

A contract or purchase order is created for the purchase. After the goods have been received or the services rendered, invoices are received in the Finance inbox and sent to the appropriate delegated authority who performed a review of the invoice and certifies pursuant to FAA S.34. Then the invoice is sent back to Finance Services for payment. When the invoice is received by Finance Services, quality assurance is performed to ensure the payment is appropriate in support of FAA S.33. Once the payment has been approved it is released through SPS.

When needed, changes made to the vendor master file are received from the supplier. The request is received and verified by the Procurement Officer or the Financial Clerk who enters the change in CDFS through the financial authority FIN-GR access. All changes input are reviewed and approved by the FAA S.33 Finance Officer.

3.3 Travel

The scope of the controls for the Travel expenditures business process starts with identifying the need to travel, approving travel requests pursuant to Expenditure Initiation Authority and FAA S.32, certifying travel claims pursuant to FAA S.34 and processing the claims for payment pursuant to FAA S.33.

A travel request is created by a travel arranger on behalf of the traveler using the online booking tool in STS. The request is routed to the appropriate delegated authority pursuant to FAA S.32 for approval and the employee can proceed to make travel arrangements once approval has been obtained. Once the travel is complete, the traveler provides all the receipts collected during travel to the travel arranger. The Travel Arranger then creates a travel claim with all the receipts attached as supporting documentation. The travel claim is routed to the delegated authority for approval pursuant to FAA S.34. The travel arranger selects the approver for the travel request and travel claim from a dropdown menu in STS. Afterwards, the claim is routed to the Processor who performs quality assurance on the claim before approving the payment pursuant to FAA S.33. Once the payment has been approved it is released through SPS.

3.4 Financial Reporting and Close

The purpose of the Financial Close business process is to establish the activities necessary in preparation of the period-end to ensure accurate and complete financial information is properly maintain according to Treasury Board and generally accepted accounting standards. These activities support the preparation of timely and accurate internal and external financial reporting.

Finance is responsible for the policies and procedures relating to accounting for payments and receipts and ensuring that adjustments are performed where required. In addition, Financial Services are responsible for ensuring that reconciliations are performed, adjustments are recorded, preparing and communicating the closing schedule, preparing, reviewing and submitting the trial balance which includes the Certificate of Representations at P9 and P12 as well as the preparation and approval of the departmental financial statements.

During our testing of Financial Reporting, it was noted that journal entries are prepared and posted in CDFS by the same individual. To ensure appropriate segregation of duties a compensatory control is in place whereas these journal vouchers are approved by a separate individual with FAA S.34 delegated authority. However, in was noted in one instance that one of these journal vouchers was not approved by a separate individual and was prepared and posted by the same user.

Inappropriate segregation of duties when creating and approving journal vouchers increases the risk that errors remain undetected in the financial system. This increases the risk that financial data which feeds into the financial statements is not accurate.

Recommendation 1: We recommend that, on an ongoing basis, journal vouchers are prepared, approved and posted by two separate individuals.

CONCLUSION ON BUSINESS PROCESS CONTROLS

The assessment found that key internal controls over the business processes were generally operating effectively.

4. RESULTS ITGC’s

4.2 Previous Year Recommendations

The key user access controls are performed when employees arrive within an organization and when they leave. It is upon arrival that majority of the user access assigned, approved, and implemented and upon departure that necessary measures are taken to remove these accesses. 7 user access were tested as part of our assessment. At MPCC, a form is used in both cases to document these steps. While a documented process was not necessarily in place more than 6 years ago, it has been in place for over six years.

We have found the arrival controls to be effective. The few employees where a documented arrival form was not available had been within MPCC for many years and their user accesses were appropriate.

Also, we have found the departure controls to be effective. We were able to confirm if the network access to these employees had been removed in a timely manner.

4.3 On-going User Access Review

A business owner has been identified for each system within the organization. In addition to the approval of user access at the time of hire for each employee (contractor), a regular review of user access should be performed to ensure that accesses are still necessary and appropriate.

CONCLUSION ON USER ACCESS CONTROLS

We consider that the user access controls for the systems in scope are appropriate.