Internal Controls Framework

Table of Contents

1. Context
   1. 1.1 MPCC Context
2. Roles and Responsibilities
3. General Principles
4. On-going Monitoring Approach
5. Work plan
   1. 5.1 Entity Level and Business Process Controls
   2. 5.2 IT General Controls

1. Appendix A. Risk Analysis
   1. A.1 Entity-Level Controls
   2. A.2 Key Business Process Controls
2. Appendix B. Ongoing Monitoring Approach

1. Context

Internal control is designed to assist departments and agencies in achieving their objectives. Monitoring of controls is an ongoing process to periodically assess and sustain the management of internal controls over time in support of continuous improvement.

In 2017, the Treasury Board approved a new Policy on Financial Management, replacing the Policy on Internal Controls (PIC). With the introduction of this new policy, the focus of internal control is on financial management.

2. Roles and Responsibilities

MPCC management's role in the implementation of the Policy on Financial Management and monitoring of its internal control system is essential to its effectiveness. As illustrated below, the deputy head, Chief Financial Officer and senior departmental managers (managers who report directly to the deputy head) all have accountabilities for the department's system of internal control.

Alternate format

The graph represents the accountabilities for the department’s system of internal control

• The Chairperson is responsible for measures taken to maintain effective systems of internal controls and signs the Statement of Management of Responsibility.
• The Chief Financial Officer leads and coordinates the establishment and execution of the annual assessment plan.
• The Corporate Services Branch acts as the lead for coordinating and ongoing monitoring of the Internal Control Over Financial Management.
• The Office of the Comptroller General acts as lead for internal audits.
• Managers/Business Process Owners are responsible for maintaining effective systems, validate risk assessments, inform Comprtollership branch of significant changes, provide supporting documentation, and contribute to the assessment of key risks and controls.
• The Information Technology Specialist acts as the lead for infrastructure and system applications, and contributes to assessments of systems and application controls.
• A small department Audit Committee may wish to monitor the implementation of the Policy on Financial Management and provide insight on plans and results.
• The Commission relies on other departments and agency service providers, specifically Public Services and Procurement Canada, Shared Services Canada, Treasury Board of Canada Secretariat, the Common Departmental Financial System Cluster Group, and the Canadian Centre for Cyber Security for the processing of certain transactions, who in turn must report the results of their annual assessement of the services they provide.

The following presents roles and responsibilities shared in the organization regarding the ICFM monitoring.

• Chairperson
  • As accounting officer and Chief Executive Officer, the Chairperson is responsible for measures taken to maintain effective systems of internal controls; and
  • Signs the Statement of Management of Responsibility which includes the Annex.
• Chief Financial Officer (CFO)
  • Leads and coordinates the establishment and execution of the annual assessment plan, and the ongoing maintenance and monitoring of an effective and integrated departmental system of ICFM and reporting; and
  • Leads and coordinates the effective and timely production of the annual Statement of Management Responsibility Including Internal Control Over Financial Reporting.
• Corporate Services Branch
  • Lead MPCC role for coordinating the ICFM assessment and ongoing monitoring; and
  • Informs internal controls assessment results and necessary changes in processes and controls.

  Note: Financial operations activities (changes) may impact the ICFM framework and the identified key controls.

• Office of the Comptroller General
  • Acts as lead MPCC role for internal audit (including a key source of expertise).

  Note: Internal controls assessment results can inform future internal audit plans as internal audit findings can be leveraged to support the internal control assessment

• Managers/Business Process Owners
  • Responsible for maintaining effective systems of internal controls in programs for which they are responsible;
  • Validate risk assessments and controls documentation for the area within their responsibility;
  • Inform Comptrollership branch of significant changes to controls and processes and provide updates to the process documentation;
  • Provide supporting documentation and other information requested to support to the team conducting the testing; and
  • Contribute to the assessment of key risks and controls in their area of responsibility.
• IT Specialist
  • Lead MPCC role for IT infrastructure and system applications (including a key source of expertise); and
  • Contributes to assessments of IT systems and application controls.
• Small Department Audit Committee
  • As part of its oversight and advisory role on internal control, the Audit Committee may wish to monitor the implementation of the Policy on Financial Management and as such, will provide insight on the assessment plans and results.
• Other Departments and Agency Service Providers
  • MPCC relies on other organizations (Common Service Providers – CSPs) for the processing of certain transactions. These CSPs must report the results of their annual risk-based assessment of the system of internal controls regarding the services they provide:
  • Public Services and Procurement Canada administers the payments of salaries and the procurement of goods and services, and provides accommodation services.
  • Shared Services Canada provides information technology (IT) infrastructure services in the areas of data centre and network services.
  • Treasury Board of Canada Secretariat provides information related to public service insurance and centrally administers payment of the employer's share of contributions toward statutory employee benefit plans.
  • MPCC's financial system related functional services are shared with the CDFS Cluster Group. The services are administered through an MOU where MPCC shares equally the expenses (including maintenance, training, user support, etc.) as well as the responsibilities and risks in relation to the financial system.
  • Canadian Centre for Cyber Security (CCCS) provides cyber alerts to all departments including MPCC where the IT administrator reviews, evaluates and implements the alerts when they are applicable to the organization. This involves application updates, windows security updates, firewall site blocking and more.

3. General Principles

The internal controls environment includes a set of internal controls components as demonstrated in the diagram below:

Alternate format

The graph represents a breakdown of the internal controls components. There are four controls, mainly manual controls, applications controls, IT general controls and entity-level controls.

Manual controls, applies to business processes, namely:

• Purchases and payments to suppliers
• Pay administration
• Information technology investment planning
• Travel management
• Budgeting and forecaasting
• Financial reporting
• Annual report
• Investigations
• Security of non-financial information

Application controls pertain to four applications supporting business processes, namely:

• Management Reporting Module (Common Departmental Financial System)
• Shared Travel Services
• MyGCHR; and
• Pheonix

IT general controls encompasses infrastructure (security of non-financial information) and access control (only relevant financial area for the Commission). These controls applies to three IT infrastructure services, namely:

• database, operating system
• servers; and
• network

Entity level controls, which include culture, values & ethics, governance, transparency and accountability applies to all three previous controls.

4. On-going Monitoring Approach

The proposed framework will provide MPCC with its first ongoing monitoring plan through the risk assessment update, while integrating additional financial management and program related processes.

The approach adopted by MPCC for its ongoing monitoring has been developed around the proposed guidance issued by the Treasury Board Secretariat (Guide on Internal Controls Over Financial Management, Guide to On-Going Monitoring of Internal Controls Over Financial Management), and includes the following five steps:

Alternate format

The graphic represents the five steps on-going monitoring approach adopted by the Commission

1. Step 1 - Undertake a risk assessment
2. Step 2 - Develop the ongoing monitoring plan
3. Step 3 - Complete assessments
4. Step 4 - Capture assessment results and actions
5. Step 5 - Create internal and external reports

Step 1:

A detailed risk assessment determines areas of high risk in the department's system of ICFM that need to be reviewed as part of the risk-based approach to ICFM (conducted every five years). A more limited risk assessment, called an environmental scan, will take place in the intervening years to ensure that the plan is updated as required to reflect changes to the department.

Step 2:

The ongoing monitoring plan, which is based on the risk assessment and an analysis of the processes and controls within the department, describes:

• The frequency of the assessments;
• The types of assessments; and
• The person who will conduct the assessments.

Step 3:

The department completes the assessments according to the ongoing monitoring plan.

Step 4:

The assessment results are captured, and remediation actions are developed.

Step 5:

The assessment is then detailed in internal and external reports that inform and communicate the results and recommendations for remedial actions to be taken.

The approach will enable MPCC management to determine whether ICFM within the organization functions as intended (on a continuous basis), to identify internal control deficiencies, to take corrective measures to address those deficiencies and to communicate results to senior management as appropriate.

The framework includes a multi-year monitoring plan that will need to be reviewed and updated regularly. The monitoring plan is a live document and management needs to keep in mind the following fundamental questions while reviewing and updating this monitoring plan on a regular basis:

• Has MPCC identified the meaningful risks to its objectives?
• Which controls are “key controls” that will best support a conclusion regarding the effectiveness of internal control in those risk areas?
• What information will be persuasive in telling MPCC management whether the controls are continuing to operate effectively?
• Have these controls changed due to recent events?
• Is MPCC monitoring the appropriate control activities and at the appropriate frequency (e.g., every year, every 3 years)?
• Are there controls being monitored that are not key controls, if so, should they be removed from the scope?
• Are deficiencies identified and communicated in a timely manner to the responsible parties?
• Is the ongoing monitoring plan sustainable?

5. Work plan

The first step of the MPCC multi-year monitoring plan is to conduct an annual risk assessment on entity level controls, business processes, and ITGC areas to ensure that ongoing testing focuses on the highest risk areas. MPCC has adopted a model where the risk assessment is revisited in full every five years with a simpler environmental scan for the other years. This will ensure changes in risks are considered and any needed amendments to the multi-year monitoring plan are made. The decision to determine when business processes or ITGCs will be assessed is selected based on their risk rating to ensure the priority toward higher risk processes.

Appendix A. Risk Analysis

The risk analysis was conducted through the assessment of inherent risk and control risk:

• Inherent Risk (IR) is the susceptibility of an assertion to material misstatement, assuming no related controls. In other words, IR is the likelihood that a material misstatement exists in the financial statements without the consideration of internal control. The following factors were considered when assigning an inherent risk rating:
  • Size in dollars of transactions within the process;
  • Level of complexity of relevant accounting standards;
  • Extent of judgment required for process financial reporting (e.g. estimations, valuations, subjectivity required);
  • Attributes of individual transactions (e.g. homogeneity of transactions, extent of automation, volume of activity); and
  • Susceptibility to misstatement (e.g. nature of account, ability to hide failures, fraud history).
• Control Risk (CR) is the risk that material misstatements that could occur will not be prevented or detected by internal controls. That risk is a function of the effectiveness of the design and operation of internal control in achieving the entity's objectives relevant to preparation of the entity's financial statements. Some CR will always exist because of the inherent limitations of internal control. The following factors were considered when assigning a control risk rating:
  • Degree of change in underlying control process;
  • Instances of control breakdowns / gap in the past; and
  • Complexity of the underlying control.

The tables below illustrate our analysis of entity-level controls and business process controls. The combined or overall risk rating will determine the extent and frequency of testing.

Appendix B. Ongoing Monitoring Approach

There are three key steps in the monitoring of activities:

• Completing the Assessments (Testing)
• Capturing Assessment Results and Actions
• Reporting on Assessment Results

Note – It is recommended to conduct a walkthrough of each key process every year to confirm process flow and controls. This may not always be possible based on allocated resources.

5.1 Completing the Assessment

The multi-year monitoring plan can build upon the documentation, testing methodologies, sampling strategies, etc. developed from the design effectiveness and operating effectiveness stages of the previous ICFR roadmap. As such, the assessment for previously identified (and assessed) business processes will involve:

• An update of the process documentation, key controls and control matrix;
• The conduct of design effectiveness testing (walkthrough); and
• The conduct of operating effectiveness testing (actual testing of controls).

For new business processes, MPCC will need to:

• Document the process, identify the key controls and prepare a control matrix;
• Conduct design effectiveness testing (walkthrough); and
• Conduct operating effectiveness testing (actual testing of controls).

The nature, extent and frequency of control testing is linked to the risk level associated with the processes and/or the systems in place. The following sections will provide guidance on the level of testing required.

5.1.1 Nature of Testing

Level of testing

Type of Activities	Processes Documentation	Design Effectiveness	Operating Effectiveness
Definition	Support the assessments of design and operating effectiveness at all levels Key controls need to be appropriately documented.	Refers to whether controls are properly designed to achieve control objectives if they operate as defined.	Refers to whether controls consistently operate as designed.
How	Development or update of process narratives, process flowcharts, and risk and control matrices.	Walkthrough to confirm flow of information to get an understanding of the operation of controls.	Testing a sample of transactions to determine whether internal controls are operating effectively over the period.
Frequency	Annually	As necessary (following a remediation measure, a change/new process, controls or new risk identified).	Operating effectiveness testing is performed once successful design effectiveness testing has occurred. Multi-year rotational based on risk: HIGH: Annually MEDIUM: Every 2 years LOW: Every 3 years
Sample Size	All processes	One transaction	See Sampling Table

5.1.2 Sampling for Testing Operating Effectiveness

The table below is based on widely recognized statistical theory and principles.

Recognized statistical theory and principles

Nature of Control	Frequency of Operation	Range for Sample Size
		With Lower Risk of Key Control Failure	With Higher Risk of Key Control Failure
Manual	Many times a day	25	40
Manual	Daily	15	25
Manual	Weekly	5	8
Manual	Monthly	2	3
Manual	Quarterly	1	1
Manual	Annually	1	1
Automated	Test of one for each automated control activity

Following the testing, it is essential to complete the documentation of the testing results and analyze the testing results and the need of remediation, as necessary. It is also important to brief and validate the overall testing results and action plans with the process owners/business partners.

The following table provides an overview of the key stakeholders and their responsibilities on this important step:

Alternate format

The table represent the overview of the key stakeholders and their key roles throughout the year.

• The internal control team leads and reviews
• The business process owners lead, participate and review
• The internal audit does not have any key roles
• The external team (if required) leads
• The corporate risk team does not have any key roles
• The Director of internal control does not have any key roles
• The Chief Financial Officer approves
• The senior department managers participate and approve
• The Deputy head inform
• The Departmental Audit Committee does not have any key roles

Appendix B Alignment with COSO Framework

In performing its assessment of Internal Controls over Financial Management, MPCC may choose to select a framework such as the 2013 COSO Framework as its applicable internal control framework, which is in-line with other federal departments and agencies.

In 1992, The Committee of Sponsoring Organizations of the Treadway Commission (COSO) developed its Enterprise Risk Management — Integrated Framework which is often referred to as the “COSO Framework”.

Alternate format

The table represent the COSO Framework.

The are three categories, namely:

• Effectiveness and efficiency of operations;
• Reliability of financial reporting; and
• Compliance with applicable laws and regulations.

There are five interrelated components of internal control within these three categories:

• Control environment;
• Risk assessment;
• Control activities;
• Information and communication; and
• Monitoring activities.

The COSO Framework states that “Internal control” is a process, affected by an entity's directors, management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories:

• Effectiveness and efficiency of operations;
• Reliability of financial reporting; and
• Compliance with applicable laws and regulations.

When performing its risk assessment, MPCC needs to ensure that these objectives are addressed. For example, the key business process controls identified during the risk assessment are aligned with the following objectives:

Risk Assessement Objectives

Business Processes Controls	Operations	Reporting	Compliance
Payments (Expenditures)		n/a
IT Asset Planning			n/a
Travel Expenditures		n/a
Pay Administration		n/a
Budgeting and Forecasting			n/a
Financial Reporting	n/a
Security of non-financial information		n/a
Investigations		n/a

As demonstrated above, there is significant overlap between the three main objective categories, which demonstrates the importance of the business process controls identified. This includes insuring that both financial and non-financial information is safeguarded, loss through waste, inefficiency or poor business decisions of MPCC's assets are prevented and that activities are conducted in accordance with applicable laws and regulations.

There are five interrelated components of internal control. Four components relate to the design and operation of the system of internal control:

• Control environment;
• Risk assessment;
• Control activities;
• Information and communication; and
• Monitoring activities.

These components are the basis and foundation for the testing of entity level controls.