Final advisory report: Health Check on the Human Resources and Pay Feasibility Project

Date: April 16, 2026

Office of the Chief Audit, Evaluation, and Risk Executive

On this page

• Executive summary
• Management response
• 1. Background
• 2. Focus of the advisory engagement
• 3. Detailed observations and lessons learned
  • 3.1. Decision-making Framework
  • 3.2. Assessment criteria and reported results
  • 3.3. Risks
  • 3.4. Information management
• 4. Conclusion
• Appendix A: Glossary
• Appendix B: Lines of enquiry, criteria, and methodology
• Appendix C: Workstreams and their objectives and weightings
• Appendix D: Relationship between workstreams, criteria and conditions
• Appendix E: Reported results
  • Criterion #1
  • Criterion #2
  • Criterion #3
  • Criterion #4
  • Criterion #5

• Copyright information

  © His Majesty the King in Right of Canada, as represented by the Minister of Public Services and Procurement Canada, 2026

  P4-188/2026E-PDF

  ISBN: 978-0-662-37399-5

Executive summary

Since the launch of the Phoenix pay system in 2016, the Government of Canada (GC) has faced persistent challenges. Independent reviews have highlighted that issues were rooted in business processes rather than technology. In response to a 2018 commitment to replace the Phoenix pay system, Public Services and Procurement Canada (PSPC) launched an agile procurement process to identify a modern, cloud-based human resource (HR) and pay solution, resulting in the selection of Dayforce for a viability assessment in 2021. Results of the viability report confirmed Dayforce as viable in 2024, with the majority of identified gaps being resolvable through software updates or GC process redesign. However, 18 complex, GC-specific gaps remain that require policy changes, collective agreement negotiations, or custom development.

The Enterprise Pay Coordination Office at PSPC was established to lead the transformation and implement an integrated HR and pay strategy, which was endorsed in 2024. It focused on 4 pillars: management, HR, pay, and data. Although Dayforce was proven to be viable, further feasibility work was needed to ensure a successful government-wide implementation. To this end, a 9-month Feasibility Project was launched, ending in March 2025, to assess Dayforce’s enterprise-wide deployment. The scope focused on 18 workstreams, each given a specific weighting, and categorized into 5 criteria and 3 conditions. This helped demonstrate whether the transformation of HR and Pay was worth pursuing.

The Treasury Board of Canada Secretariat’s Office of the Chief Human Resources Officer (TBS-OCHRO) pursued activities that were complementary to the project, including exercising its role as business owner by identifying HR business needs, validating outcomes, supporting policy alignment, and leading simplification efforts. Oversight of the Feasibility Project was provided by the HR and Pay Program Management Committee, which maintained strategic alignment and addressed barriers, and the HR and Pay Deputy Minister Sponsoring Group, which endorsed decisions and approved the final Human Capital Management Feasibility Report.

The objective of this health check was to assess whether a decision-making framework was adequately developed and approved and to assess whether project activity outputs, measures, and weightings were adequately established and executed. Also, it was to assess whether the final report that documented the recommendation was adequately developed in accordance with the approved decision-making framework to inform decision-making. The period of this health check, which covers key Feasibility Project activities, was from April 2024 to September 2025.

Internal audit found that the framework was well developed, incorporating lessons learned, stakeholder input and leading practices. It was aligned with GC commitments and approved by the designated authority; the HR and Pay Deputy Minister Sponsoring Group.

Also, most workstreams developed and refined assessment criteria, and reported results were mainly accurate. Although not all transformation conditions and critical thresholds could be fully assessed, mitigation plans were in place to address gaps and support continued progress.

Additionally, the risk assessment methodology was generally structured, standardized, and aligned with relevant reference materials to evaluate workstream risks, which were reasonably assessed. However, the approach to determining criteria-level risk was not aligned with established risk management guidance. Also, while neither a definition nor a distinct approach for identifying and assessing strategic risks was in place, the strategic risks that were ultimately identified were largely reasonable. Segmenting risks and more concretely articulating their relevance and severity, particularly regarding potential future impacts, could have further informed decision-making.

Information management practices presented ongoing challenges and impacted the availability of evidence to support the final recommendation to the Deputy Minister Sponsoring Group. Internal audit found that information of business value was not consistently organized or reliably retained, which constrained the ability to assess certain results and risk analyses. Although corrective actions were undertaken during the course of this engagement, some gaps persist that could affect transparency, continuity, and accountability.

Overall, the Feasibility Project demonstrated good alignment with its framework and meaningful progress toward enterprise-wide transformation. While some limitations did not allow for a full assessment for all transformation conditions and critical thresholds, decision-makers can rely on the Feasibility Report as a valuable foundation for future planning. By applying lessons learned, management can promote continuous improvement, advance implementation efforts, and, most importantly, further strengthen decision-making.

Management response

PSPC management accepts the findings of the Health Check on the Human Resources and Pay Feasibility Project. We are encouraged by the conclusion that the decision-making framework developed to assess Feasibility Project results adequately supported meaningful progress toward the enterprise transformation of HR and Pay for the GC.

Management accepts that the decision-making framework was found to be well-developed, incorporating lessons learned and stakeholder input. The confirmation that most workstreams effectively developed and refined assessment criteria and that reported results were largely accurate reinforces confidence in the robustness of the Feasibility Project’s approach.

Management also accepts that further work is needed to strengthen strategic risk identification and ensure better alignment with established guidance. To address this, we will enhance our methodology to better align with TBS guidance.

Management acknowledges the challenges related to information management practices, particularly the inconsistent organization and retention of information of business value. Management is committed to improving continuity, transparency, and accountability by providing support to project teams to reinforce best practices in information management.

The two main areas of weakness documented, information management and risk management, are ones where we have seen positive progress over the last few months. Management suggests that it would be beneficial for internal audit to conduct a quick health check as the project moves closer to execution, to ensure that Information Management and Risk Management have steadily improved since they were last reviewed – and hopefully to provide this assessment in real time so the teams can continue to benefit from lessons learned.

Looking ahead, management will continue to apply lessons learned from the Feasibility Project to inform the next phases of the HR and Pay Transformation. Management will leverage insights from the health check to guide the strategies that support the GC’s commitment to modernizing its HR and pay system for public servants.

1. Background

Since the launch of the Phoenix pay system in 2016, the Government of Canada (GC) has faced persistent issues, including a significant case backlog and high support costs. In response, a commitment to replace Phoenix was made in 2018. Independent reviews, including those by Goss Gilroy Inc., and the Office of the Auditor General of Canada (OAG), highlighted that the failure stemmed from underestimating the initiative’s complexity and a lack of sufficient and appropriate governance, consultation, and testing. These findings emphasized that human resources (HR) and pay challenges are deeply rooted in business processes, not just technology.

Recognizing that HR and pay challenges stemmed from business processes as much as technology, Public Services and Procurement Canada (PSPC) launched an agile procurement process in 2018 to identify a modern, cloud-based HR and pay solution. Three software as a service (SaaS) vendors were pre-qualified, and Dayforce was selected in 2021 for a viability assessment. Completed in 2023, the Next Generation Human Resources and Pay Final Findings Report confirmed Dayforce as viable, identifying 90 gaps, though most were considered resolvable through software updates or process redesign. Eighteen complex, GC-specific gaps remained, requiring policy changes, collective agreement negotiations, or custom development.

Building on the technological solution, the GC established the Enterprise Pay Coordination Office at PSPC in 2023 to lead the transformation and implement an integrated HR and pay strategy. Endorsed in 2024, the strategy focused on 4 pillars: management, HR, pay, and data. While Dayforce was proven to be viable, further feasibility work was needed to ensure a successful government-wide implementation. The initiative aimed to streamline operations, improve the user experience, and shift HR and pay professionals toward more strategic, value-added work.

To advance this work, a 9-month Feasibility Project ending in March 2025 was funded in 2024 to assess Dayforce’s enterprise-wide deployment. While not all aspects of full implementation were evaluated, the selected scope focused on 18 workstreams, each given a specific weighting, and categorized into 5 criteria and 3 conditions to demonstrate feasibility and justify moving forward with HR and pay transformation. Refer to Appendix C: Workstreams and their objectives and weightings for a list of workstreams and their objectives, and weightings, as well as Appendix D: Relationship between workstreams, criteria and conditions for an illustration of the relationship between workstreams, criteria and conditions. The Treasury Board of Canada Secretariat’s Office of the Chief Human Resources Officer (TBS-OCHRO) pursued activities that were complementary to the project, including exercising its role as business owner by identifying HR business needs, validating outcomes, supporting policy alignment, and leading simplification efforts. An Associate Deputy Minister and Assistant Deputy Minister committee and a Deputy Minister committee provided oversight of the Feasibility Project. The HR and Pay Program Management Committee maintained strategic alignment and addressed barriers, and the HR and Pay Deputy Minister Sponsoring Group endorsed key decisions and approved the final report.

Refer to the Human Capital Management Feasibility Report for additional information.

2. Focus of the advisory engagement

During summer 2024, the PSPC and TBS integrated internal audit team developed a Risk-based Assurance Strategy for the HR and Pay Portfolio. One of the proposed engagements was a Health Check on the Human Resources and Pay Feasibility Project. This strategy was tabled at PSPC’s and TBS’ Departmental Audit Committees on September 17, 2024, and October 21, 2024, respectively. The Deputy Minister of PSPC and the Secretary of the Treasury Board (TB) subsequently approved it in Fall 2024.

PSPC internal audit led the Health Check on the Human Resources and Pay Feasibility Project in consultation with TBS internal audit.

2.1. Objective

The objective of this engagement was to assess whether a decision-making framework was adequately developed and approved and to assess whether project activity outputs, measures and weightings were adequately established and executed. Also, it was to assess whether the report was adequately developed in accordance with the approved decision-making framework to inform decision-making.

2.2. Scope

The advisory engagement covered key activities of the Feasibility Project.

The period covered in this advisory engagement was from April 2024 to September 2025.

2.3. Criteria, sources, and methodology

The advisory engagement’s line of enquiry, criteria and methodology can be found in Appendix B: Lines of enquiry, criteria, and methodology

The advisory engagement was conducted in accordance with the International Standards for the Professional Practice of Internal Auditing.

3. Detailed observations and lessons learned

In this section

• 3.1. Decision-making Framework
• 3.2. Assessment criteria and reported results
• 3.3. Risks
• 3.4. Information management

A central component of this advisory engagement involved internal audit providing timely advice to senior management and workstream leaders (directors general, directors, and/or project managers). This advice was delivered through various channels, such as verbal updates and dashboards presented at the HR and Pay Program Management Committee. This insight supported senior management and workstream leaders in making informed decisions about whether to implement proactive changes, as needed.

The lessons learned presented in this report reflect issues that were not addressed during the engagement.

3.1. Decision-making Framework

Beginning in Summer 2024, the leaders of the Feasibility Report Summary workstream led the development of the Decision-making Framework. To inform its design, internal audit found that the workstream leaders reviewed various internal and external lessons learned reports, professional frameworks, and guidance documents. The majority of these sources provided insights into project management practices, such as governance, agile procurement, and testing, but did not contain specifics regarding the development of a decision-making framework. Nonetheless, internal audit found that the workstream leaders demonstrated due diligence by considering and leveraging the Lessons Learned on the Transformation of Pay Administration Initiative and the Project Management Body of Knowledge (PMBOK) Guide to inform the framework’s design.

Stakeholder consultations were also conducted to gather input on the framework’s design. Internal audit found that feedback was primarily solicited from project governance committees of various levels, which comprised of membership from numerous departments as well as project vendors. Based on interviews with the 9 leaders responsible for 17 workstreams^{Footnote 1}, internal audit found that most felt sufficiently consulted. Furthermore, workstream leaders generally reported that there was open dialogue and that their feedback was appropriately reflected in the framework. That said, internal audit found gaps in how stakeholder feedback, including from vendors, was documented and tracked (see section 3.4. Information management for details on the documentation of consultations). Addressing these gaps could have helped stakeholder input be fully considered and integrated in the framework’s design.

Additionally, there was an opportunity to strengthen stakeholder engagement and feedback during the development of the Decision-making Framework. In particular, broader engagement with stakeholders from outside the GC and not associated with the project could have provided more diverse and objective perspectives.

The Decision-making Framework required that workstream leaders establish assessment criteria and then evaluate their progress against these criteria. The evaluation (see Table 1) was guided by a matrix with 2 measures: completeness (scope), which describes how much of the work was done, and result (quality), that describes how well it met the expected characteristics. These measures are based on the PMBOK Guide.

Table 1: Evaluation Method Matrix

Result quality to support a recommendation	Substantially incomplete (0 to 59% complete)	Partially complete (60 to 79% complete)	Sufficiently complete (80 to 90% complete)	Fully complete (95 to 100% complete)
Excellent results	Unacceptable	Partially acceptable	Acceptable	Acceptable
Adequate results	Unacceptable	Partially acceptable	Partially acceptable	Acceptable
Insufficient results	Unacceptable	Unacceptable	Unacceptable	Unacceptable

The completeness measure included 4 predefined thresholds with associated percentages. Although no explanation was provided for these percentages, internal audit found these threshold percentages to be reasonable. The result measure included 3 thresholds, but it did not define corresponding percentage ranges. Internal audit found that the percentages applied during evaluation were reasonable, as they largely aligned with those developed by the workstreams.

Also, the Decision-making Framework outlined 3 conditions to transform: System readiness, Enterprise readiness, and Departmental readiness. Internal audit found that these conditions collectively measured that technical infrastructure, organizational alignment, and departmental capacity were sufficiently established to support a successful transformation.

Moreover, the framework defined 2 critical thresholds to recommend continued investment in deploying a Dayforce solution across the GC as follows:

1. An overall weighted result rating in the “Insufficient” range, without validated plans in place to mitigate within a reasonable timeframe
2. A result rating in the “Insufficient” range for the 5 System readiness activities, which is equivalent to the criteria #1 workstreams, without validated plans in place to mitigate within a reasonable timeframe

Internal audit also found the addition of these thresholds provided clear, objective criteria for measuring success and supporting evidence-based decision-making.

Additionally, the framework incorporated a risk dimension consistent with the TB’s Framework for the Management of Risk. The inclusion of residual risk was aligned with the PMBOK Guide.

Moreover, PSPC made 2 commitments related to the Decision-making Framework to be completed by September 2024. First, it committed to proposing a list of key decision points, including 2 interim checkpoints, to enable the HR and Pay Deputy Minister Sponsoring Group to monitor risks, timelines, and progress, and to provide oversight throughout the project. These decision points were endorsed by the Sponsoring Group on September 5, 2025. Second, PSPC committed to presenting the framework to the HR and Pay Deputy Minister Sponsoring Group for endorsement. Although the endorsement of the framework, including criteria and weightings, occurred on October 31, 2024, slightly after the committed date, this did not impact the achievement of the commitment.

3.2. Assessment criteria and reported results

As outlined in the Decision-making Framework that was discussed and endorsed across all levels of project governance, from Director General to Deputy Minister, with representation from all workstreams, and in accordance with operational direction, workstream leaders were required to establish assessment criteria. Specifically, workstream leaders were asked to define measures of completeness (scope) and result (quality) for their respective workstream(s).

Workstream leaders were given the flexibility to develop criteria using key performance indicators with associated thresholds, labels and percentages or percentage ranges for evaluating outputs. They were also responsible for determining methods for combining the results into a workstream score and label, which would then inform the weighted criteria score and label. This information was summarized in a 2-pager that required approval from the accountable Assistant Deputy Minister.

Internal audit found that Assistant Deputy Minister approval was provided for all 17 workstream 2-pagers^{Footnote 2}. For each workstream, leaders established completeness and result measures using a combination of scales, steps, options (for example, pass and fail) or percentage ranges. These measures were developed using professional judgement, stakeholder consultations, industry best practices, and/or data. Internal Audit found that these approaches were acceptable.

Additionally, internal audit found that the 2-pagers varied in terms of content and rigour. Internal audit provided real-time advice to workstream leaders so that they could clarify and/or refine the assessment criteria’s goals, measurability, thresholds, and/or data source as well as the methods for summarizing the results. As a result, 7 of the 8 workstream leaders refined their respective assessment criteria to improve clarity and facilitate subsequent evaluation of the outputs. Notably, 5 workstream leaders clarified their assessment criteria in a separate document to complement their 2-pagers.

At the conclusion of the Feasibility Project, internal audit found that all 17 workstreams’ assessment criteria were partially or fully aligned with the Decision-making Framework and their respective objectives. For 15 of the 17 workstreams, the completeness and result measures were largely adequately established, including:

• Key performance indicators were aligned with the scope of the Feasibility Project
• Key terminology was defined with sufficient clarity
• Methodologies to establish threshold percentage or percentage ranges, labels, and scores were articulated

Workstream leaders were also required to evaluate their respective workstream outputs against the assessment criteria in alignment with the Decision-making Framework and operational direction. Of note, a Results Review Panel was proactively convened to provide a challenge function for the workstreams’ reported results.

Internal audit found that results reported for the 17 workstreams by leaders were mainly accurate. Specifically:

• Completeness (scope) measures were accurate for 14 of the 17 workstreams, and partially accurate for 3 workstreams
• Result (quality) measures were accurate for 8 of 17 workstreams, partially accurate for 6 workstreams, and unable to assess^{Footnote 3} for 3 workstreams

For 2 of the 3 workstreams (Vanguard department backlog reduction plan and Vanguard department preparedness plan), internal audit was unable to assess the result measures due to an absence of a clear and well-defined assessment criteria. Notably, workstream leaders made efforts to improve the criteria, but they were not sufficiently defined to support an assessment. Furthermore, the supporting documentation provided did not align with the criteria established by the workstreams. For the third workstream, the Enterprise Integrated Target Operating Model, the result measure was intended to reflect senior management’s endorsement of the model and an assessment of the ongoing validity of its underlying assumptions. Early in the Feasibility Project, workstream leaders informed internal audit that, even with the flexibility granted to develop their own criteria, the Decision-making Framework did not meet their needs. They found it difficult to assess the assumptions and provide evidence to support their assessment. This challenge, along with some documentation not being retained, limited internal audit's ability to fully assess the reported results.

Additionally, activities of 6 workstreams were deemed partially accurate due to challenges in assessing stakeholder consultations. While comprehensive consultations were conducted with various stakeholders, such as industry, leading consulting firms, governance committees outside of HR and Pay, and/or other levels of government, documentation of feedback and its integration into final deliverables was inconsistent (see section 3.4. Information Management for additional details on the documentation of consultations). These workstreams were:

• Data, artificial intelligence (AI), and service frameworks
• Vanguard department preparedness plan
• Implementation plan development
• Data migration
• Deployment option selected
• Implementation plan costing

Regarding the reported criteria results, internal audit found that the score and label for criterion #1 were accurate. For the remaining 4 criteria, scores could not be calculated and resulting labels determined as internal audit was unable to assess some of the supporting workstreams in whole or in part.

Finally, as outlined in section 3.1. Decision-making Framework, 3 transformation conditions and 2 critical thresholds were established to define a baseline for determining whether to support a recommendation for continued investment in deploying the Dayforce solution across the GC. Internal audit found that the reported results for the System Readiness condition, covering all criterion #1 workstreams, were accurate. Critical Threshold #2, also comprised of all criterion #1 workstreams, was successfully achieved.

For the Enterprise Readiness and Departmental Readiness conditions as well as Critical Threshold #1, internal audit was unable to assess some of the supporting workstreams in whole or in part; therefore a score could not be calculated and the resulting label determined. That said, in instances where internal audit was unable to assess the accuracy of a workstream’s reported score or label, validated plans to mitigate risks within a reasonable timeframe for the workstreams were in place. Refer to section 3.3. Risks for details.

Refer to Appendix E: Reported results for additional details on workstream results reported by criteria.

3.3. Risks

The approved Decision-making Framework required an assessment of residual risk as of March 31, 2025, and necessitated that all potential “showstopper” risks have mitigation plans to support the recommendation of continued investment in deploying Dayforce. Operational direction, along with an associated template, was provided to workstream leaders to guide their risk assessment.

Internal audit found the risk assessment methodology was developed in alignment with relevant frameworks, guidance, and leading practices, including the TB’s Framework for the Management of Risk. Consultations with workstream leaders further informed the methodology, and the HR and Pay Program Management Committee and the HR and Pay Deputy Minister Sponsoring Group subsequently endorsed and approved it.

The methodology provided a structured and standardized way to identify and rate workstream risks, but it addressed criteria-level risks by simply adding up the risks from each workstream. It also did not include a definition of or a specific approach for assessing strategic-level risks. Leading risk management practices emphasize the importance of strategic risk management and outline that it is management’s responsibility to define strategic risks. Internal audit would have expected strategic risks to be considered given their forward-looking effect on the achievement of transformation, which could have provided clear direction for executing tasks.

Based on documentation reviews, internal audit found that all 17 workstreams^{Footnote 4} partially or fully completed the risk assessment template according to operational direction, and that their assessments were generally reasonable. Areas for improvement include:

• Data, AI, and services frameworks—internal audit assessed a higher residual risk rating (or score) than workstream leaders as the proposed mitigation strategies were not sufficiently robust to justify the reduction from the inherent risk level
• Other technical development—internal audit identified 2 additional risks related to accessibility compliance and the security assessment and authorization process. Workstream leaders agreed with the former but disagreed with the latter
• AI virtual assistant—internal audit found the residual risk template was not sufficiently completed to derive an assessment
• Internal audit found that in some cases, workstream leaders did not clearly distinguish between mitigation strategies and planned activities within an established process. Furthermore, mitigation strategies and contingency plans were often used interchangeably. These examples demonstrate a potential lack of understanding and confusion with and between risk and issue management

Overall, internal audit found that the risk information developed by workstream leaders was largely reflected in the Feasibility Report in terms of accuracy and completeness.

For criteria-level risks, personnel of the Transformation Management Office, Human Capital Management Solutions Branch, at PSPC indicated that professional judgment was used to identify risks that could impact project success for each of the 5 established criteria. Yet, internal audit found that criteria risk ratings were calculated based on a mathematical average of the workstreams’ residual risk ratings. This approach does not align with policy, frameworks, or leading practices in risk management as it assumes equal weighting of all risks regardless of their relevance or severity and does not account for their compounding effects. Furthermore, although the criteria risk ratings were accurately calculated, 2 of the 5 criteria were incorrectly labelled. In particular, criterion #1 was reported as “High” instead of “Moderate” and criterion #5 was reported as “High” instead of “Extreme.” An improved approach identifying criteria-level risk with accurate results could have better informed decision-making.

Moreover, the Human Capital Management Feasibility Report outlined that a structured approach was used to identify strategic risks. Specifically, Transformation Management Office personnel indicated that they performed a review of the Risks, Actions, Issues, Decisions, and Dependencies log, consulted with workstream leaders, and applied professional judgment to obtain a full understanding of potential risks and issues. That said, the log used for this purpose was not saved and cannot be recovered (see section 3.4. Information management for details regarding the documentation of activities). As such, internal audit was unable to fully corroborate the analysis.

Transformation Management Office personnel also conducted a theme and trend analysis using professional judgment that internal audit found to be largely reasonable given the context of the Feasibility Project. That said, one additional theme and one additional trend were included without supporting explanations. As personnel could not clarify these additional elements, internal audit could not determine their significance or relevance to decision-making.

Additionally, although the Feasibility Report indicated that an impact synthesis was done to determine the likelihood and impact of each strategic risk, internal audit found that this analysis was not performed. As a result, no strategic risk ratings were identified.

Lastly, internal audit found that there was limited collaboration between the Transformation Management Office and the Enterprise Project Coordination Office, Human Capital Management Strategy and Integration Branch at PSPC to identify strategic risks. Notably, the Enterprise Risk Management and Issues Register, which is designed for this purpose, was not leveraged by the Transformation Management Office.

Upon reviewing the analysis and the Enterprise Risk Management and Issues Register, internal audit found that the 5 strategic risks identified in the Feasibility Report were largely reasonable. However, these risks were a consolidation of several strategic risks, which may dilute the relevance or severity of individual risks. Furthermore, the supporting analysis focused primarily on risks associated with the Feasibility Project itself, with limited consideration for the forward-looking effect on the achievement of transformation. Segmenting risks and more clearly articulating their relevance and severity, particularly with respect to potential future impacts, could have further informed decision-making.

3.4. Information management

Sound information management practices are essential for the effective delivery of programs, services, and activities, and for efficiency, transparency, and accountability to the Canadian public. This has been a consistent lesson learned from past GC projects and warrants particular attention, especially in time-constrained environments, such as the Feasibility Project, which was conducted over a 9-month period.

Throughout this engagement, internal audit provided real-time advice to management regarding information management practices employed by the PSPC project team. Notably, internal audit found that information of business value was not well organized or consistently retained in accordance with the TB’s Policy on Service and Digital. While some corrective actions were taken, significant issues persist.

Specifically, records supporting strategic and operational decisions or rationales made by governance and management were not consistently captured or retained. For example:

• At the time the commitments were made, the HR and Pay Deputy Minister Sponsoring Group did not possess formal decision-making authority, and its role was to provide endorsement. While the Terms of Reference intended to confer this authority was tabled for approval at the November 14, 2024 meeting, the secretariat was unable to provide written confirmation of its approval
• While the respective Assistant Deputy Ministers approved all 17 workstreams’ 2-pagers^{Footnote 5}, 8 of these approvals were only provided verbally
• Expectations for supporting evidence of activities were largely undocumented

In some cases, documentation to support or confirm activities was unavailable, and certain project-related documents remain unrecovered. This includes the loss of touchpoint data to support the closure of backlog cases and the version of the Risks, Actions, Issues, Decisions, and Dependencies log that was used to support strategic risk analysis.

Additionally, for key performance indicators pertaining to consultations, internal audit expected they would be actively monitored, measured, and documented throughout the project lifecycle. While extensive internal and external consultations were held to provide input on various workstream-related deliverables, internal audit found that records of these meetings were often undocumented. Furthermore, the logs or trackers intending to capture resulting actions were not consistently used or maintained. As a result, for 6 workstreams, there was limited evidence demonstrating how stakeholder feedback was considered and incorporated into the final deliverables (see section 3.2. Assessment criteria and reported results for the list of workstreams).

Moreover, internal audit found that the PSPC’s project team used a variety of information management systems, including personal drives, Microsoft Teams, Microsoft SharePoint, and GCdocs, to store information of business value. As GCdocs is the designated corporate repository for PSPC, all information of business value should have been retained in this repository.

Overall, the absence of proper records documenting decisions or feedback from consultations risks the loss of valuable insights and corporate knowledge. This issue is further compounded by staff turnover, which makes it difficult to understand past actions. Maintaining comprehensive records is critical not only to support continuity, transparency, and accountability, but also for informed decision-making, preserving institutional memory and enabling effective risk management.

4. Conclusion

This advisory engagement confirmed that the Feasibility Project was generally executed in alignment with its approved Decision-making Framework. Specifically, the framework was well developed based on lessons learned, best practices, and stakeholder consultations, aligned with commitments, and approved by the designated authority.

Also, most workstreams established and refined assessment criteria, and reported results were mainly accurate. While some limitations did not allow a full assessment of all transformation conditions and critical thresholds, where gaps existed, mitigation plans were in place for workstreams to address risks and support continued progress.

Additionally, the risk assessment methodology was generally structured, standardized, and aligned with relevant reference materials to evaluate workstream risks, which were, for the most part, reasonably assessed. However, the approach to determining criteria-level risk was not aligned with established risk management guidance. Also, while neither a definition nor a distinct approach for identifying and rating strategic risks was in place, the strategic risks that were ultimately identified were largely reasonable. Segmenting risks and more concretely articulating their relevance and severity, particularly regarding potential future impacts, could have further informed decision-making.

Information management practices also impacted the availability of evidence to support recommendations to decision makers. Information of business value was not consistently well organized or reliably retained, which hindered internal audit’s ability to assess certain results and risk analyses. Although corrective actions were undertaken during the course of this engagement, some gaps persist.

Taken together, these limitations introduced some constraints in fully assessing readiness across all transformation conditions and critical thresholds. Nonetheless, the Feasibility Project demonstrated good alignment with its framework and meaningful progress toward enterprise-wide transformation. Decisionmakers can rely on the Feasibility Report as a valuable foundation for future planning, while remaining mindful of the lessons learned to support continuous improvement, advance implementation efforts, and, most importantly, further strengthen decision-making.

Appendix A: Glossary

Cloud extension:

A form of customization that the vendor develops, manages, and supports throughout the life of a subscription to meet specific customer requirements that cannot be met in the core software offering.

 

Contingency plan:

A reactive fallback plan to be undertaken if the risk materializes and becomes an issue.

 

GCdocs:

The GC's standardized electronic document and records management solution.

 

Health check:

A point in time assessment of the adequacy of the governance, risk management and/or control processes as they are being designed and implemented for a new program, project or business function to provide a timely, but more limited opinion.

 

Information of business value:

Published and unpublished materials, regardless of medium or form, that are created or acquired as they enable and document decision-making in support of programs, services and ongoing operations, and support departmental reporting, performance and accountability requirements.

 

Interoperability:

The ability of computer systems or software to exchange and make use of information.

 

Mitigation strategy :

An action plan developed to reduce the impact or likelihood of a potential risk.

 

Results review panel:

A panel of workstream leaders to enable the timely and accurate reporting of results.

 

Security assessment and authorization process :

An ongoing approach to managing security risk that involves evaluating security practices and controls to confirm they are implemented correctly, operating as intended, and meeting defined requirements. Based on these results, a formal security risk management decision is made to explicitly accept any related residual risk and maintain authorization for operation.

 

Single Employee Profile:

A single, accurate, and authoritative version of an employee's information across the GC, which provides a unified and standardized view of an employee's profile, and can be used for decision- making, analytics, and strategic HR initiatives. It is supported by HR and pay data standards to enable data sharing between HR and pay systems, as needed.

 

Touchpoint data:

Digital records and metrics generated when users interact with a system, platform or application. These interactions are tracked to understand user behaviour, improve services or optimize system performance.

 

Vanguard:

A small-scale pre-production pilot conducted with PSPC and Shared Services Canada (SSC) and to validate configuration, processes and procedures required to successfully run a subset of pay and post-payroll processing activities for the GC.

Appendix B: Lines of enquiry, criteria, and methodology

Table 2: Lines of enquiry and criteria

Lines of enquiry	Criteria
1. A decision-making framework is adequately developed and approved	The decision-making framework is developed in consideration of lessons learned, best practices, consultations with key stakeholders, is aligned with Treasury Board of Canada (TB) commitments, and is approved by the appropriate authority
2. Project activity outputs and measures are adequately established and evaluated in accordance with the approved decision-making framework	Each project activity establishes their respective outputs and measures
	Each project activity accurately evaluates their respective outputs
3. The feasibility report is adequately developed in accordance with the approved decision-making framework to inform decision-makingtable 2 note 1	The report includes accurate, complete and weighted project activity results
	The report includes an adequate assessment of residual risks
Table 2 Note Table 2 Note 1 The feasibility report subject to internal audit’s assessment was the version provided to the HR and Pay Deputy Minister Sponsoring Group for decision-making; not the published Human Capital Management Feasibility Report. Return to table 2 note 1 referrer

Methodology

• Conduct interviews with project stakeholders, such as executives and project managers
• Review and analyze industry approaches, frameworks, policies, and plans
• Review and analyze project documentation, such as the decision-making framework, project activity 2-pagers, and the feasibility report

Appendix C: Workstreams and their objectives and weightings

Table 3: Workstreams, objectives and weightings

Workstream name	Workstream objective
1. Systems configuration Weighting: 13%	To assess whether Dayforce can be designed and configured to: meet the GC’s 17 critical to HR-to-pay capabilities meet all pay related requirements contained within Collective Bargaining Agreements from across the Core Public Administration and Separate Agencies eliminate gaps through planned product enhancements
2. HR capabilities Weighting: 5%	To assess whether Dayforce can be designed and configured to meet the 11 prioritized HR capabilities, which were selected for their downstream impact on pay processes and their role in transitioning from legacy systems.
3. Cloud extension development Weighting: 7%	To assess whether Dayforce is able to design, develop, and implement 3 cloud extensions.
4. Third-party integration Weighting: 5%	To assess whether Dayforce is able to accurately and consistently exchange and integrate HR and pay data residing in Dayforce with various third-party systems.
5. Other technical development opportunities Weighting: 3%	To assess whether Dayforce is able to meet mandatory GC requirements regarding security and accessibility.
6. Post-payroll process design Weighting: 20%	To assess whether the GC can design and validate a subset of post-payroll processes that are using integration files generated by Dayforce.
7. Data, AI, and service frameworks Weighting: 5%	To develop a set of processes, standards and rules governing how HR and pay data is collected and managed.
8. Data hub procurement Weighting: 3%	To establish a challenged-based procurement for modern data management, science, and business intelligence platforms and tools.
9. Data migration Weighting: 5%	To plan, develop, test and execute data migration from legacy systems to Dayforce via an automated system using an iterative process consisting of 3 data loads.
10. AI virtual assistant Weighting: 2%	To implement and test the Virtual Assistant with Compensation Advisors to resolve 3 specific pay cases.
11. Vanguard department backlog reduction plan Weighting: 5%	To assess whether the GC is able to successfully reduce/eliminate a segment of the backlog to onboard to a new HR and pay system. Specifically, to bring SSC Active Pay Accounts to a ready state for a pilot by March 31, 2025.
12. Vanguard department preparedness plan Weighting: 7%	To support Vanguard departments in their readiness for meeting identified criteria and organizational data status necessary to support successful onboarding to Dayforce.
13. Deployment option selected Weighting: Combined 10%table 3 note 1	To develop an analysis to inform GC decision makers of the options available to deploy the system at scale.
14. Implementation plan development Weighting: Combined 10%table 3 note 1	To develop an analysis to inform GC decision makers outlines the overall approach to implement the system across the GC.
15. Implementation plan costing Weighting: Combined 10%table 3 note 1	To develop a costing to inform GC decision makers based on the detailed work breakdown structure associated with the multi-year deployment.
16. Pay simplification Weighting: 5%	To address critical gaps that are not supported by the off-the-shelf Dayforce solution, which involves negotiating amendments to collective agreements and modifying Employer’s regulations and policies to simplify pay rules.
17. Enterprise integrated target operating model Weighting: 5%	To monitor the ongoing underlying assumptions used in the development of the model.
18. Feasibility Report Summary Weighting: Not applicable	To summarize the results of the Feasibility Project in accordance with the Decision-making Framework into a report.
Table 3 Note Table 3 Note 1 Denotes a combined score of 10% for Deployment options selected, Implementation plan and Implementation plan costing. Return to table 3 note 1 referrer

Appendix D: Relationship between workstreams, criteria and conditions

Appendix E: Reported results

The tables in the following sections present the reported results for each workstream, organized by criteria and assessed in terms of completeness (scope) and results (quality). Internal audit’s assessment of these results is included, using the legend provided below. Additional observations are outlined in the paragraphs that follow each table.

In this section

• Criterion #1
• Criterion #2
• Criterion #3
• Criterion #4
• Criterion #5

Criterion #1

Internal audit found that criterion #1 workstream outputs were accurately evaluated against the assessment criteria. For the completeness (scope) measure, all individual workstreams and the weighted criteria measure scores and labels were assessed as accurate.

With respect to the result (quality) measure, internal audit found the Cloud extension development workstream score was 93.3%, representing a variance of less than a 1% from what the workstream reported. Despite this minor adjustment, the “Excellent” label remains appropriate and unchanged. All other workstream scores and labels were similarly assessed and found to be accurate. The weighted criteria results measure score was calculated at 90.6% and the “Excellent” label remains appropriate and unchanged.

Table 4: Reported results: Criterion 1

Workstream	Weight	Completeness (scope)		Result (quality)
		Results reported	Internal audit assessment	Results reported	Internal audit assessment
System configuration	13%	86% - Sufficiently Complete	100% - Accurate	87% Adequate	100% - Accurate
HR capabilities	5%	100% - Fully Complete	100% - Accurate	100% - Excellent	100% - Accurate
Cloud extension development	7%	78.3% - Partially Complete	100% - Accurate	94% - Excellent	100% - Accurate
Third party integration	5%	100% - Fully Complete	100% - Accurate	92% - Excellent	100% - Accuratetable 4 note 2
Other technical development	3%	98% - Sufficiently Completetable 4 note 1	100% - Accurate	82.5% - Adequate	100% - Accurate
Criteria #1 consolidated	33%	89.7% Sufficiently Complete	Accurate	90.7% Excellent	Accurate table 4 note 2
Table 4 Notes Table 4 Note 1 The Feasibility Report Annex A outlined a label of both Fully Complete and Sufficiently Complete for this workstream, with the latter being accurate. Return to table 4 note 1 referrer Table 4 Note 2 Minor differences were found between the results reported and the assessment. Return to table 4 note 2 referrer

Criterion #2

For criterion #2, internal audit found that the evaluation of workstream outputs against the assessment criteria was partially accurate for both the completeness (scope) and result (quality) measures.

With respect to the Post-payroll process design workstream, internal audit found the completeness score and label were accurate as processes were designed and executed for identified interfaces. When assessing the result measure, internal audit found it partially accurate. In particular, the system-generated files met GC requirements, and the system successfully integrated third-party data and operated within the Receiver General framework. That said, the automation of end-to-end interoperability was found to be lacking due to manual intervention of both inbound interfaces. The resolution for the gaps was outlined in the Interoperability Services Framework, which includes a Proof of Concept that is anticipated to be delivered by October 2025. Furthermore, activities are reflected in the change request.

Regarding the Data hub procurement workstream, for both the completeness and result measures, internal audit found the scores and labels were accurate.

In the Data, AI, and service frameworks workstream, internal audit found completeness scores and labels were partially accurate. In particular, certain deliverables, such as the algorithmic impact assessment, the establishment of a review board and steering committee, and publishing of the quarterly reports, were assessed as completed. For other deliverables, such as the Single Employee Profile standards and the human-centered design strategy and roadmap, while internal audit found that consultations were conducted with stakeholders, documentation of feedback and its integration into final deliverables was inconsistent (see section 3.2. Assessment criteria and reported results for details). For the result measure, the workstream scores and labels were assessed as accurate.

In terms of the Data migration workstream, internal audit found the completeness scores and labels were partially accurate. In particular, while migration for Vanguard employees was within scope and rated as accurate, the broader GC migration strategy lacked evidence regarding the documentation of feedback and its integration into final deliverables, similar to the Data, AI, and services frameworks workstream (see section 3.2. Assessment criteria and reported results for details).

Regarding the result measure, internal audit found that the data mapping as well as the transmission and conversion of data was accurate. While data extraction was also completed, internal audit was unable to assess the score and label as workstream leaders did not establish a clear methodology in this regard. Additionally, internal audit found that the data loading was not accurate. In particular, while records in scope were loaded, 2 of the 3 data loads were not loaded on time. Also, the third data load was conducted beyond feasibility period, and its duration was incorrectly calculated.

Additionally, in performing an assessment of the Data migration workstream, internal audit identified data integrity issues in the migration process, including an absence of a clear chain of custody, a lack of data validation procedures, and unexplained discrepancies in the data. Also, during this advisory engagement, workstream leaders learned that the test environment was decommissioned due to the vendor’s 90-day retention policy. Once workstream leaders became aware, remediation efforts commenced to address these issues.

Table 5: Reported results: Criterion 2

Workstream	Weight	Completeness (scope)		Result (quality)
		Results reported	Internal audit assessment	Results reported	Internal audit assessment
Post-payroll process design	13%	100% - Fully Complete	100% - Accurate	82.4% - Adequate	75% - Accurate 25% - Not accurate
Data hub procurement	5%	60% - Partially Complete	100% - Accurate	0% - Insufficient Result	100% - Accurate (100%)
Data, Artificial Intelligence (AI), and service frameworks	7%	97.8% - Fully Complete	40% - Accurate 60% - Unable to assess	71% - Adequate	100% - Accurate (100%)
Data migration	5%	96% - Fully Complete	50% - Accurate 50% - Unable to assess	94% - Excellent	60% - Accurate 20% Unable to assess 20% - Not accurate
Criteria #2 consolidated	33%	95.5% - Fully Complete	Partially accurate	74.9% - Insufficient Result	Partially accurate

Criterion #3

Internal audit found that the evaluation of criterion #3 workstream outputs against the assessment criteria was partially accurate for the completeness (scope) measure but unable to assess for the results (quality) measure.

For the AI virtual assistant workstream, internal audit found the completeness measure scores and labels to be partially accurate. This was due to only 2 of 3 case types developed during the feasibility period, with the third being completed beyond the feasibility period in June 2025. The number of compensation advisors trained was found to be accurate.

Internal audit also found that the result measure scores and labels were partially accurate, with notable observations below.

• Error logs were inconsistently maintained for the 3,566 cases closed, not the 4,000 cases as reported, using the AI virtual assistant tool, which limited the ability to determine the extent of the errors and determine an exact score and label (see section 3.4. Information management for details regarding the documentation of activities)
• The reported results for the AI-generated outputs were incorrectly calculated resulting in a score of 92%; not 89%, and the label of “Insufficient” results remains the same
• AI demonstrated the ability to provide “truthful information,” in other words accurate information, over time and across different contexts
• Some of the touchpoint data was lost and a decision was made to focus on closing cases rather than recording touch times given the level of effort required (see section 3.4. Information management for details regarding the documentation of activities)

In terms of the Vanguard department backlog reduction plan workstream, internal audit found that the completeness measure score and label to be accurate. With respect to the results measure, internal audit found that the workstream’s assessment criteria resembled mitigation strategies related to backlog management rather than quality measures. Workstream leaders acknowledged that the measure lacked sufficient clarity regarding goals, measurability, thresholds, and/or data source but did not revise the criteria due to time constraints. Internal audit also found that the documentation provided did not align with the assessment criteria. That said, based on interviews with workstream leaders and the documents provided, internal audit can attest to work being done to advance backlog reduction efforts.

Regarding the Vanguard department preparedness plan workstream, internal audit found the completeness score and label were accurate. In terms of the result measure, internal audit found that the workstream’s thresholds and scales lacked clarity. For example, the deliverables “level of detail,” “readiness for broader socialization” or the extent of consultations were not concretely defined. Accordingly, internal audit advised workstream leaders that this ambiguity may lead to an over-reliance on professional judgment, potentially leading to results not being reproducible. Workstream leaders acknowledged the assessment criteria lack clarity but did not revise the criteria due to time constraints. Also, limited supporting documentation was provided that did not allow for internal audit to assess the reported results.

Table 6: Reported results: Criterion 3

Workstream	Weight	Completeness (scope)		Result (quality)
		Results reported	Internal audit assessment	Results reported	Internal audit assessment
AI virtual assistant	2%	100% - Fully Complete	100% - Partially accurate	93% - Excellent	100% - Partially accurate
Vanguard backlog reduction plan	5%	88% - Sufficiently Complete	100% - Accurate	96% - Excellent	100% - Unable to assess
Vanguard departmental preparedness plan	7%	84% - Sufficiently Complete	100% - Accurate	90% - Excellent	100% - Unable to assess
Criteria #3 consolidated	14%	87.5% - Sufficiently Complete	Partially accurate	91.8% - Excellent	Unable to assess

Criterion #4

Regarding criterion #4, internal audit found that the evaluation of workstream outputs against the assessment criteria was accurate for the completeness (scope) measure and partially accurate for the result (quality) measure.

For all workstreams under criterion #4, Deployment option selected, Implementation plan development and Implementation plan costing, internal audit found that the completeness scores and labels were accurate as deliverables were produced. When assessing the result measures, internal audit found mixed accuracy across all 3 workstreams. The deliverables produced were comprehensive, aligned to global best practices, and the overall approach validated and supported senior management. Additionally, as indicated in section 3.2. Assessment criteria and reported results, while comprehensive consultations were conducted with stakeholders, documentation of feedback and its integration into final deliverables was inconsistent.

Table 7: Reported results: Criterion 4

Workstream	Weight	Completeness (scope)		Result (quality)
		Results reported	Internal audit assessment	Results reported	Internal audit assessment
Deployment option selected	2%	100% - Fully Complete	100% - Accurate	100% - Excellent	75% - Accurate 25% - Unable to assess
Implementation plan development	4%	100% - Fully Complete	100% - Accurate	100% - Excellent	75% - Accurate 25% - Unable to assess
Implementation plan costing	4%	100% - Fully Complete	100% - Accurate	50% - Insufficient Result	67% - Accurate 33% - Unable to assess
Criteria #4 consolidated	10%	100% - Fully Complete	Accurate	80% - Adequate Result	Partially accurate

Criterion #5

Internal audit found that the evaluation of workstreams for criterion #5 outputs against the assessment criteria was accurate for the completeness (scope) measure and unable to assess for the result (quality) measure.

For the Pay simplification workstream, internal audit found that the scores and labels were accurate for both the completeness and result measures.

Regarding the Enterprise integrated target operating model workstream, as stated in section 3.2. Assessment criteria and reported results, the result measure was intended to reflect senior management’s endorsement of the model and an assessment of the ongoing validity of its underlying assumptions. Early in the Feasibility Project, workstream leaders shared that the Decision-making Framework did not meet their needs as they found it hard to assess the assumptions and provide evidence to support their assessment. This challenge, along with some documentation not being retained, limited internal audit's ability to fully assess the reported results.

Table 8: Reported results: Criterion 5

Workstream	Weight	Completeness (scope)		Result (quality)
		Results reported	Internal audit assessment	Results reported	Internal audit assessment
Enterprise integrated target operating model	5%	100% - Fully Complete	100% - Accurate	100% - Excellent	100% - Unable to assess
Pay simplification	5%	78.6% - Partially Complete	100% - Accurate	82.5% - Adequate	100% - Accurate
Criteria #5 consolidated	10%	89.3% - Sufficiently Complete	Accurate	91.3% - Excellent	Unable to assess