Guide to Internal Control Over Financial Management

Annex: internal control over financial reporting

• A.1

  Introduction

  This document provides summary information on the measures taken by [name of department] to maintain an effective system of internal control over financial reporting, as well as information on internal control management, assessment results and related action plans.

  Detailed information on the department’s authority, mandate and core responsibilities can be found in the Departmental Plans for the [YYYY] to [YYYY] fiscal year and the Departmental Results Report for the [YYYY] to [YYYY] fiscal year ([titles and links to the reports]).

• A.2

  Departmental system of internal control over financial reporting

  • A.2.1

    Internal control management

    [Name of department] has a well-established governance and accountability structure to support departmental assessment efforts and oversight of its overall system of internal control. A departmental internal control management framework, is in place and comprises:

    • organizational accountability structures as they relate to internal control management to support sound financial management, including the roles and responsibilities of senior departmental managers for control management in their areas of responsibility;
    • values and ethics;
    • ongoing communication and training on the legislative and policy requirements for sound financial management and control; and
    • monitoring and regular updates on internal control management, as well as provision of related assessment results and action plans to the deputy head and senior departmental management and, as applicable, the Departmental Audit Committee.

    The Departmental Audit Committee is an independent advisory committee to the deputy head. It is responsible to provide advice to the deputy head on the adequacy and functioning of the department’s risk management, control and governance frameworks and processes.

  • A.2.2

    Service arrangements relevant to financial statements

    [Name of department] relies on other departments for processing certain transactions that are recorded in its financial statements, as follows.

    • A.2.2.1

      Common service arrangements

      • Public Services and Procurement Canada administers the payment of salaries, the procurement of goods and services, and provides accommodation services;
      • Shared Services Canada provides information technology (IT) infrastructure services;
      • Department of Justice Canada provides legal services; and
      • Treasury Board of Canada Secretariat provides information on public service insurance and centrally administers payment of the employer’s share of contributions toward statutory employee benefit plans.

      Readers of this annex may refer to the annexes of the above-noted departments for a greater understanding of the systems of internal control over financial reporting related to these specific services.

      [Name of department] relies on other external service providers [and/or] departments for the processing of certain information or transactions that are recorded in its financial statements, as follows:

      [Add details]

    • A.2.2.2

      Specific arrangements

      • An external service provider, under contract with the Government of Canada, administers [name of the program or activity] on behalf of [name of department]’s program. The external service provider has the authority and responsibility to ensure that [specific transactions or payments] are made in accordance with the terms and conditions set out by [name of department]’s program. As a result, the control procedures of the external service provider are relied upon.
      • [Name of department] provides [name of applicable department or agency] with a financial system platform to capture and report all financial transactions.

• A.3

  Departmental assessment results for the [YYYY] to [YYYY] fiscal year

  The following table summarizes the status of the ongoing monitoring activities according to the previous fiscal year’s rotational plan.

  Progress during the [YYYY] to [YYYY] fiscal year

  Previous fiscal year’s rotational ongoing monitoring plan for the current fiscal year	Status
  Entity-level controls, grants and contributions, financial close, and master data on vendors and customers	Completed as planned; no remedial actions required
  Capital expenditures	Completed as planned; remedial actions started

  In the [YYYY] to [YYYY] fiscal year, in addition to the progress made in ongoing monitoring, the department tested the design and operating effectiveness of a new payroll system.

  The key findings and significant adjustments required from the current fiscal year’s assessment activities are summarized in subsection A.3.1.

  • A.3.1

    New or significantly amended key controls

    In the current fiscal year, there were no significantly amended key controls in existing processes that required a reassessment. Design and operating effectiveness testing was conducted on the key controls for a new payroll system. Significant adjustments were not required for the new key controls.

  • A.3.2

    Ongoing monitoring program

    As part of its rotational ongoing monitoring plan, the department completed its reassessment of entity-level controls and the financial controls within the business processes of:

    • grants and contributions;
    • capital expenditures;
    • financial close; and
    • master data on vendors and customers.

    For the most part, the key controls that were tested performed as intended, with remediation required as follows. For example, significant control issues related to the segregation of duties and system access for asset custodians were identified in the capital expenditure area. A management action plan addressing the recommendations was developed by the business process owner.

• A.4

  Departmental action plan for the next fiscal year and subsequent fiscal years

  [Name of department]’s rotational ongoing monitoring plan over the next three fiscal years is shown in the following table. The ongoing monitoring plan is based on:

  • an annual validation of high-risk processes and controls; and
  • related adjustments to the ongoing monitoring plan as required.

  Rotational ongoing monitoring plan^{table 1 note *}

  Key control areas	[YYYY] to [YYYY] fiscal year	[YYYY] to [YYYY] fiscal year	[YYYY] to [YYYY] fiscal year
  Table 1 Notes Table 1 Note 1 The length of the ongoing monitoring plan is at the discretion of the department and will depend on how often the department conducts its risk-based assessment. For example, a plan could cover a 1-, 3- or 5-year cycle. Return to table 1 note * referrer
  Entity-level controls	Yes	Yes	Yes
  Information technology general controls under departmental management	No	Yes	Yes
  Grants and contributions	No	Yes	Yes
  Operating expenditures	Yes	No	Yes
  Capital expenditures	No	Yes	No
  Financial close	No	Yes	No
  Master data on vendors and customers	No	Yes	No
  Payroll	Yes	No	Yes
  Revenue	No	Yes	No

  [Insert the following text, as applicable: In addition to the ongoing monitoring rotational plan, [name of department] plans to conduct the following assessment work [insert, for example, planned new or significantly amended key controls, deferred control work, remediation to be completed] in the fiscal years indicated.]

  [Report any deviations from the ongoing monitoring plan from the previous fiscal year.]

• A.5

  Common service provider’s annual assessment results for the [YYYY] to [YYYY] fiscal year

  [Name of department], as a common service provider of [common services provided], has completed a risk-based assessment of the internal controls for these services. The results of this assessment are described below.

  Status of assessment of common services

  Key control areas	Design effectiveness testing and remediation	Operational effectiveness testing and remediation	Ongoing monitoring rotationtable 2 note *
  Table 2 Notes Table 2 Note 1 The frequency of the ongoing monitoring of key control areas is risk-based and may occur over a multi-year cycle. Return to table 2 note * referrer
  Information technology general controls	Complete	Complete	[YYYY] to [YYYY] fiscal year
  Legal services costs	Complete	Complete	[YYYY] to [YYYY] fiscal year
  Payroll services	[YYYY] to [YYYY] fiscal year	[YYYY] to [YYYY] fiscal year	Future fiscal years
  Public service insurance	Complete	Complete	[YYYY] to [YYYY] fiscal year

  As a result of design and operating effectiveness testing and ongoing monitoring of key controls, the department identified the following required remediation:

  [Details on remediation activities.]

• A.6

  Departmental status and action plan

  Building on progress to date, [name of department] is positioned to complete the full assessment of its system of internal control over financial reporting in the [YYYY] to [YYYY] fiscal year. At that time, the department will be applying its rotational ongoing monitoring plan to reassess control performance on a risk basis across key control areas. The status and action plan for the completion of the identified control areas for the next fiscal year and for subsequent years are shown in the following table.

  Status and action plan

  Key control areas	Risk Assessment and Documentation	Design effectiveness testing and remediation	Operational effectiveness testing and remediation	Ongoing monitoring rotationtable 3 note *
  Table 3 Notes Table 3 Note 1 The frequency of the ongoing monitoring of key control areas is risk-based and may occur over a multi-year cycle. Return to table 3 note * referrer
  IT general controls under departmental management	Complete	Complete	Complete	[YYYY] to [YYYY] fiscal year
  Capital assets	Complete	[YYYY] to [YYYY] fiscal year	[YYYY] to [YYYY] fiscal year	[YYYY] to [YYYY] fiscal year
  Operating expenses and accounts payable	Complete	Complete	Complete	[YYYY] to [YYYY] fiscal year
  Payroll and benefits	Complete	Complete	Complete	[YYYY] to [YYYY] fiscal year
  Transfer payments	Complete	Complete	[YYYY] to [YYYY] fiscal year	[YYYY] to [YYYY] fiscal year
  Revenue and accounts receivable	Complete	Complete	Complete	[YYYY] to [YYYY] fiscal year

  As a result of design and operating effectiveness testing and ongoing monitoring of key controls, the department identified the following required remediation:

  [Details on remediation activities.]

• B.1

  Introduction

  In support of an effective system of internal control, [Name of department] conducted self-assessments of key control areas that were identified to be assessed in the [YYYY] to [YYYY] fiscal year. A summary of the assessment results and action plan is provided in subsection B.2. 

  [Name of department] completed the assessment of key control areas as indicated in the following table. A summary of the results, action plans, and additional details are also provided.

• B.2

  Assessment results for the [YYYY] to [YYYY] fiscal year

  [Name of department] completed the assessment of key control areas as indicated in the following table. A summary of the results, action plans, and additional details are also provided.

  Key control areas	Remediation required	Summary results and action plan
  Delegation	Yes	Issues to required training were identified. Remedial actions addressed.
  Transfer payments	No	Internal controls are functioning as intended, no action plan required.

  With respect to the key control areas of the delegation of spending and financial authorities, for the most part, controls related to spending and financial authorities were functioning well and form an adequate basis for the department’s system of internal control. Some issues to the required training were identified and addressed during the fiscal year.

  [Name of department] was audited by the Office of the Comptroller General on key control areas in [key control]. A summary of the audit results and remedial actions are provided below:

  [Add details.]

• B.3

  Assessment plan

  [Name of department] will assess the performance of its system of internal control by focusing on key control areas over a cycle of years as shown in the following table.

  Assessment plan

  Key control areas	[YYYY] to [YYYY] fiscal year	[YYYY] to [YYYY] fiscal year	[YYYY] to [YYYY] fiscal year	[YYYY] to [YYYY] fiscal year	[YYYY] to [YYYY] fiscal year
  Delegation	Yes	No	No	No	No
  Transfer Payments	Yes	No	No	No	No
  Contracting	No	Yes	No	No	No
  Year-end Payables	No	Yes	No	No	No
  Receivables	No	Yes	No	No	No
  Pay Administration	No	No	Yes	No	No
  Travel	No	No	Yes	No	No
  Financial Management Governance	No	No	Yes	No	No
  Hospitality	No	No	No	Yes	No
  Fleet Management	No	No	No	Yes	No
  Accountable Advances	No	No	No	Yes	No
  Acquisition cards	No	No	No	No	Yes
  Leave	No	No	No	No	Yes
  Special Financial Authorities	No	No	No	No	Yes