Unaudited financial statements for the period ending March 31, 2022, Environment and Climate Change Canada, chapter 7

Annex to the Statement of Management Responsibility Including Internal Control Over Financial Reporting 2021-22 

1. Introduction

This document provides summary information on the measures taken by Environment and Climate Change Canada (ECCC) to maintain an effective system of Internal Control over Financial Reporting (ICFR), including information on internal control management, assessment results and related action plans.

Detailed information on ECCC’s authority, mandate and program activities can be found in the last Departmental Results Report and the current Departmental Plan.

2. Environment and Climate Change Canada's System of Internal Control Over Financial Reporting

2.1 Internal Control Management

ECCC has a well-established governance and accountability structure to support departmental assessment efforts and oversight of its system of internal control. A departmental internal control management framework, approved by the Deputy Minister, is in place and includes:

• Organizational accountability structures as they relate to internal control management to support sound financial management, including roles and responsibilities of senior departmental managers for control management in their areas of responsibility;
• Values and ethics code;
• Ongoing communication and training on statutory requirements, and policies and procedures for sound financial management and control;
• An internal financial attestation process in support of certification by the Deputy Minister and the Chief Financial Officer, whereby senior departmental managers who report to the Deputy Minister attest that they have implemented and maintained a risk-based system of internal control over financial management in their areas of responsibility;
• A Fraud Risk Management program that is designed to protect the departments’ resources from fraud, waste and abuse through a prevention and detection framework; and
• Semi-annual monitoring of, and regular updates on, internal control management, as well as the provision of related assessment results and action plans to the Deputy Minister and senior departmental management and, as applicable, the Departmental Audit Committee.

The Departmental Audit Committee provides advice to the Deputy Minister on the adequacy and functioning of the department’s risk management, control and governance frameworks and processes.

2.2 Service Arrangements Relevant to Financial Statements

ECCC relies on other organizations for the processing of certain transactions that are recorded in its financial statements as follows:

Common Service Arrangements

• Public Services and Procurement Canada (PSPC) provides accommodation services and administers the procurement of goods and services, and the payments of salaries in accordance with ECCC’s delegation of authorities. PSPC also administers the Receiver General Central Systems used to issue cheques on behalf of the department. ECCC relies on the effectiveness of the PSPC Phoenix pay system and related activities and practices;
• Shared Services Canada (SSC) provides information technology (IT) infrastructure services to ECCC in the areas of data centre and network services. The scope and responsibilities are addressed in the interdepartmental arrangement between SSC and ECCC;
• The Department of Justice provides legal services to ECCC;
• The Public Prosecution Service of Canada provides prosecution services to ECCC; and
• The Treasury Board of Canada Secretariat provides services related to public sector insurance for ECCC employees and centrally administers payment of the employer’s share of contributions toward statutory employee benefit plans on behalf of ECCC.

Specific Arrangements

• Agriculture and Agri-Food Canada (AAFC) provides ECCC with a System Applications Products (SAP) financial system platform to capture and report all financial transactions. Under this arrangement, ECCC relies on AAFC for the management of certain IT controls and procedures (e.g., security, configuration, change management, business continuity) and of various master data functions in SAP.

Readers of this Annex may refer to the Statement of Management Responsibility (SOMR) Annexes of the above-noted organizations for a greater understanding of the systems of ICFR related to these specific services.

3. Departmental Assessment Results During Fiscal Year 2021-22

The following table summarizes the status of the ongoing monitoring activities according to the previous fiscal year’s rotational plan.

ECCC continued to evolve its main ICFM business processes to reach the “ongoing monitoring” stage by 2023-24, as per Management Accountability Framework (MAF) expectations. The key findings and significant adjustments required from the current year’s assessment activities are summarized below.

3.1 New or significantly amended key controls

As the situation related to the pandemic has evolved, ECCC has revised its strategies in Financial Management with a focus on resuming normal activities while keeping a modernized and strengthened delivery model and effective financial services. There are risks inherent in this approach and ECCC accepted a measure of risk to continue to use some established methods after the pandemic.

As part of its risk mitigation strategy and as a best practice, ECCC continued assessing its risks and adjusted its key controls, as the impacts of the COVID-19 pandemic on the control environment continued to evolve, by:

• Evaluating changes in governance, risk management and internal controls, including those related to resource allocation and financial management in times of budgetary uncertainty, to delegation of authority and to reporting structure;
• Reviewing the adequacy of oversight procedures established over the impacted areas for enhanced monitoring. As such, ECCC applied its ICFM Framework including an update to the ICFR framework, in alignment with ECCC Integrated Risk Management Framework, the Treasury Board Policy on Financial Management and in with other government departments practices;
• Remaining vigilant of the potential financial fraud vulnerabilities during the pandemic, including relaxation of monetary limits, remote access to financial systems and potential threats for cybervulnerabilities; and
• Documenting and communicating the results of the assessment of processes and controls and supporting business process owners and senior management in addressing them. A key control enhancement is illustrated by having ECCC deployed an SAP tool-application called Invoice to Payment (I2P) to ensure business process improvements related to the receipt, processing and payment of invoices for the entire Department. The I2P project is leveraging various technology components including imaging, automated workflow, electronic authorization as well as enhanced reporting capabilities.

3.2 Ongoing Monitoring Program

In 2021-22, ECCC followed its rotational ongoing monitoring plan of ICFM and performed an assessment of the following business processes: Delegation of Spending and Financial Authorities, Purchasing, Payables and Payments, Planning, Budgeting and Forecasting, Costing and IT General Controls.

Delegation of Spending and Financial Authorities

The ongoing monitoring assessment served as an update of the design assessed in 2014-15 to ensure alignment with the Directive on Delegation of Spending and Financial Authorities (DSFA) and departmental practices.

A plan was developed to strengthen the establishment, communication and monitoring of Roles and Responsibilities in the ECCC DSFA and related supporting documentation as well as the activation process and monitoring of the validity of Specimen Signature Records used to delegate financial authority.

Purchasing, Payables and Payments

The ongoing monitoring assessment served as an update of the design originally assessed in 2015-16 to ensure alignment with the Directive on Delegation of Spending and Financial Authorities (DSFA) and departmental practices.

The ongoing monitoring assessment has been completed and the results were communicated to the responsible area. A plan will be developed in early 2022-23 to ensure compliance with the Directive on Delegation of Spending and Financial Authorities.

Planning, Budgeting and Forecasting

The design effectiveness testing has been completed and the results were communicated to the responsible area. A plan will be developed in early 2022-23 to ensure compliance to the Policy on Financial Management.

The operational effectiveness testing on key controls will be performed later in 2022-23.

Costing

Assessment of the Costing process is underway to reach the ongoing monitoring stage by 2023-24, as per MAF expectations. The Treasury Board Submissions and Costing Unit has retained consulting firm to conduct a review of the costing function within ECCC’s management and governance processes and gather information and documentation on the various costing components and functions across the Department. This will help to advance the documentation and design effectiveness assessment of the Costing process as part of the ICFM assessment.

IT General Controls

An integration between Internal Controls and Financial systems functions, as supported by the Office of the Comptroller General through the Internal Control Working Group, has occurred to enhance controls over system changes and implementation of new financial systems to ensure that all ITGCs are designed and operating effectively to support departmental ICFM, including ICFR.

4. Departmental action plan for the next fiscal year and subsequent years

In 2016 and as validated through MAF assessment results, ECCC reached the ongoing monitoring status on all processes related to ICFR. Since then, ECCC implemented a risk-based ongoing monitoring program and conducted an annual risk-based assessment to monitor the effectiveness of its ICFR. In 2018, the scope of this monitoring was extended to include its ICFM and ECCC is planning to reach ongoing monitoring by 2024, as per Treasury Board Secretariat expectations.

Ongoing monitoring involves:

• Using a risk-based approach;
• Assessing the design and operating effectiveness of internal controls regularly in accordance with the monitoring plan; and
• Determining whether any actions need to be taken to address weaknesses.

Ongoing monitoring of internal controls begins after completion of initial control assessment. The control assessment involves:

• Documenting the controls;
• Testing for design effectiveness and operating effectiveness; and
• Developing a management action plan to correct gaps or weaknesses.

ECCC’s five-year risk-based ongoing monitoring plan is rotational and is based on the 2021-22 risk assessment results of ICFM processes (including ICFR processes), departmental priorities, available resources and workload, and other considerations, such as the COVID-19 pandemic context, that have an impact on the plan.

In summary, this fiscal year’s risk-based assessment resulted in continuing to consider most components related to expenditure management processes as being at higher risk due to the interim measures and processes implemented during the COVID-19 pandemic. The Department will continue to prioritize and realign its ICFM assessments to assist the organization in effectively navigating through the next normal.