Joint Report of the Audit Committee and Chief Audit Executive to the Chief Electoral Officer of Canada for the Year 2018–2019
This report summarizes the activities of the Departmental Audit Committee (DAC) and the Chief Audit Executive (CAE) of Elections Canada (EC) for the fiscal year 2018–2019.
2. Departmental Audit Committee
DAC was established in compliance with the Federal Accountability Act. It is composed of external members and the Chief Electoral Officer (CEO). It provides the CEO with independent advice on stewardship, management controls and accountability practices. The Terms of Reference guide the Committee's activities and are updated each year.
Throughout 2018–2019, the Committee was chaired by Stéphane Perrault, who was appointed as the new CEO on June 8, 2018. External members were Kevin Lindsey, André Grondines and Karen Jackson, who were renewed for 2019–2020.
DAC held four regular meetings during the year: on August 29 and October 31, 2018, and January 30 and March 27, 2019. It also held a teleconference on February 12, 2019, to review the 2019–2020 Departmental Plan. There was full attendance at all meetings.
The CAE, the Deputy Chief Electoral Officer and Chief Financial Officer, Internal Services (hereafter referred to as the CFO) and the Assistant Director, Assurance, attended the meetings, as did, with the exception of the March 2019 meeting, an official from the Office of the Auditor General (OAG). During 2018–2019, the agency's other DCEOs – the DCEO, Regulatory Affairs, and the DCEO, Electoral Events and Innovation – also attended meetings regularly.
As required, members of senior management and staff made presentations and responded to matters raised by the Committee. All meetings included in camera sessions between the external members and the Chair. An annual in camera session between the external DAC members and the CFO took place at the March 2019 meeting; a similar in camera session between the external DAC members and the CAE is scheduled for August 2019. In October 2018, the CEO began a new practice of holding a teleconference with the external members to review the agendas of future meetings.
Karen Jackson and André Grondines observed the fall 2018 regional meetings with field personnel in Toronto and Quebec City, respectively, noting that the sessions were very informative and that the field personnel were engaged in EC's change process. André Grondines and Kevin Lindsey took part in the observers program on ordinary polling day at the December 3, 2018, by-election in Leeds–Grenville–Thousand Islands and Rideau Lakes. They noted that introducing technology at the polls should address some of the challenges associated with an aging electoral workforce, including voter accessibility and convenience at the polls, and the efficiency of the voter administration process.
3. Internal Audit
The internal audit function provides independent and objective assurance services to add value to the agency and improve its operations. The function plans and conducts its activities in accordance with sections 16.1 and 16.2 of the Financial Administration Act, and the Treasury Board Secretariat's (TBS) Policy on Internal Audit, as adapted to EC's status as an agent of Parliament. Its audit activities are determined by EC's Risk-based Audit Plan (RBAP). The current triennial RBAP was developed following a comprehensive assessment by senior management of organizational risks and assurance needs; it was approved in 2017–2018.
The CAE is Jane Dunlop, who replaced Josée Villeneuve in August 2018 as Senior Director, Electoral Integrity and Internal Audit, and as CAE. She reports functionally to the CEO on internal audit. She can engage the Audit Committee directly and reports regularly to it on audit activities. The Assistant Director, Assurance, Erik Lairot, manages audit engagements and supports the Audit Committee, while the Senior Analyst, Electoral Integrity and Internal Audit, Rhianne Saville, provides analytical and logistical support.
The members wish to recognize and thank Josée for her contributions to the Audit Committee and to welcome Jane in her new functions.
4. 2018–2019 Year in Review
a) Highlights for DAC and CAE
In light of the 43rd federal general election in October 2019, the 2018–2019 DAC meetings were marked by the agency's focus on successfully implementing its transformation agenda and associated change management, progressing in its electoral readiness activities and ensuring the security and integrity of the impending general election, while implementing aspects of new legislation (Bill C-76).
(1) Corporate Transformation Agenda
DAC members continued to be engaged in the agency's progress in implementing its significant transformation agenda, which comprises over 20 projects to modernize service delivery and renew critical assets for the 43rd general election and beyond.
At the August DAC meeting, the members reviewed the final risk assessment of, and recommendations on these projects provided by Gartner Consulting, which, in early 2018, had conducted an external review of the aggregated project plans and their impacts. The members reviewed EC's management response to the recommendations in October 2018, and Gartner's final report in January 2019.
At several meetings, the Committee paid particular attention to EC's transformation projects. The external members were given regular updates on the projects, were consulted on project management, contracting and communications aspects, and in turn provided advice and recommendations that would strengthen the projects' business cases. In addition, they discussed the impact of legislative reform on these projects and their inclusion in system integration and testing activities before the general election.
Overall, DAC recognized EC's efforts to modernize its assets and processes, noting the progress made in implementing the transformation projects and mitigating identified risks. It agreed that, to maximize the agency's chances of success, EC should begin to implement Gartner's recommendations. It also continued to support strong, integrated oversight and management of all major projects, and underscored the importance of change management, knowledge transfer and communication with staff and stakeholders alike leading up to the general election.
(2) Electoral Readiness
Management kept DAC members regularly apprised of the agency's electoral preparedness activities and its readiness to deliver the next general election. The CEO regularly addressed this item in his opening remarks, and it was added as a recurring item to DAC's agenda. The discussion encompassed aspects such as human resources, IT, communications and engagement, risk and issues management and planned simulation testing.
The members were also kept informed of the status of Bill C-76 throughout the year, given the potential challenges associated with implementing aspects of the new legislation in an election year. After the legislation received Royal Assent in December 2018, the members received an overview of the main provisions of the Act and regular updates on the impact of the new legislation on the agency's electoral readiness activities.
The members were satisfied that, despite the added complexity of legislative reform, the agency was, as of the March 2019 meeting, progressing well with its readiness activities for the next general election.
(3) Electoral Security
Electoral security was discussed on several occasions at DAC meetings. In August 2018 and March 2019, the Chief Information and Security Officer presented EC's electoral security strategy for the 43rd general election, noting the key pillars of the strategy to address physical security and cyber-security-related risks for the general election. In March 2019, the members received an update on the inter-agency collaboration to strengthen Canada's democratic resilience for the general election, which was an area of interest for the Committee.
In addition, in January 2019, Samson and Associates presented the findings from their audit of IT security, noting EC's organizational strengths and weaknesses, and making recommendations for the 2019 general election and beyond. In March 2019, management presented its action plan to address the audit recommendations for the 2019 general election. Management's response to post-general election recommendations will be presented at DAC after this election.
Overall, the members were assured that significant effort had been made to increase the maturity of the agency's electoral security posture in advance of the general election and to mitigate potential electoral security risks.
b) Activities of the Audit Committee
In 2018–2019, the Audit Committee continued to use the eight specific areas of oversight proposed in the TBS's Policy on Internal Audit as a best practice for organizing its activities.
DAC examined key areas during the past year, as outlined below.
(1) Values and Ethics
- It heard the Audit Committee's update on initiatives to integrate values and ethics into all aspects of the workplace.
- It noted the agency's efforts to innovate in this area, such as creating a "results gallery" to share values and ethics commentary and activities among staff.
- It was kept informed of the results of the Public Service Employee Survey for the agency, receiving an update on the 2017 and 2018 reports in August 2018 and March 2019, respectively. While both reports pointed out areas for improvement, the overall results remained positive, and improvements were observed in several areas from 2017 to 2018, indicating that EC's actions in this regard remain beneficial.
(2) Risk Management
- DAC received periodic updates on evolving issues and the steps that EC was taking to manage its affairs and deliver on its mandate.
- The 2018–2019 year also saw the continued development of the agency's risk management approach and activities. The members received an update on corporate risk in March 2019, during which the updated corporate risk framework and the results of the quarterly review of the agency's corporate risks were presented. A new Integrated Risk Register that captures the various risks within the agency has been developed by the Office of the Chief Planning Officer to better coordinate risk management activities and responses across the organization.
- The members received updates on other risk management activities across the agency. In addition to the physical and cyber-security risk management activities noted earlier, the members received an overview in March 2019 of the Electoral Integrity and Internal Audit sector's mandate and activities. This overview included efforts to strengthen the electoral integrity and assurance capabilities of the agency, such as its capacity to anticipate, detect, deter and respond to incidents that could interfere with the electoral process or affect the outcome of an election.
(3) Management Control Framework
- Robert Ashton was named Acting Deputy Chief Financial Officer (DCFO) in February 2019, replacing France Labine. The members wish to recognize and thank France for her contributions to the Audit Committee.
- DAC heard management's response to the OAG's recommendations on payroll management in regard to the Phoenix pay system in August 2018. This response included an overview of the controls that are in place to mitigate issues with the system.
- In August 2018, the members received an overview of the findings of the audit of EC's procurement practices by the Procurement Ombudsman, which stated that EC was in good standing, with only minor items to address. DAC suggested that procurement be included in the agency's triennial risk-based audit planning.
- In spring 2019, the members will receive an updated version of EC's Internal Controls over Financial Management. A full update of the agency's internal controls will be scheduled for after the 2019 general election, once the DCFO position has been staffed permanently.
(4) Internal Audit Function
- During 2018–2019, the members were informed of the findings of EC's remaining assurance engagement in its RBAP, the audit of IT security conducted by Samson and Associates.
- The members received concluding updates on two previous assurance engagements: management's response to the Review of the Political Finance Program, in August 2018; and management's response to Gartner's review of EC's transformation projects, in October 2018, and their final report, in January 2019.
(5) Office of the Auditor General of Canada and Central Agencies
- With the attendance at DAC meetings of a representative of the OAG, the Committee was kept informed of matters it raised and of its audit plans.
- In August 2018, the OAG official presented an overview of the OAG's audit of EC's financial statements and noted that they were in accordance with Canadian public sector accounting standards.
- At the January 2019 DAC meeting, the OAG official outlined the OAG's plan for the annual audit of the year ending on March 31, 2019.
- External DAC members, as well as the CAE, attended the DAC Symposium sponsored by TBS on November 27, 2018. The symposium informed participants of trends and priorities for management and audit in the federal government.
(6) Follow-up on Management Action Plans
- DAC follows a systematic approach to monitoring the action plans presented by management in response to external and internal audits. The members received a follow-up on these plans in August 2018.
- In January 2019, the members were apprised of the status of the activities undertaken in response to the recommendations outlined in the 2015 audit by the Office of the Commissioner of Official Languages (OCOL) on EC's provision of official languages in the field. This included OCOL's plan to publish, in August 2019, a follow-up report on EC's progress in implementing the audit's recommendations. The members made suggestions about how EC should approach the release of the report, including the importance of continuing to provide a consistent, reasonable and well-managed operational approach to providing official languages services in the field.
(7) Financial Statements and Public Accounts Reporting
- At its August 2018 meeting, the Audit Committee reviewed and endorsed the disclosure contained in EC's financial statements. The members approved the financial statements with minor edits.
- In October 2018, the members received an overview of the budget estimate for the 2019 general election. They agreed with the CEO's interest in releasing the estimate before the general election to ensure transparency regarding the costs of addressing legislative reform and readiness leading up to the 43rd general election, and they recommended that the estimate be released with the Departmental Plan to provide additional context.
(8) Accountability Reporting
- In August 2018, DAC reviewed and endorsed the 2018–19 Departmental Results Report.
- In February 2019, DAC reviewed and endorsed the 2019–20 Departmental Plan.
c) Activities of the Chief Audit Executive
- The internal audit function's capacity was bolstered with the appointment of the new CAE and the Director, Electoral Integrity and Internal Audit.
- The CAE's reporting relationship on the management of internal audit matters was clarified, in light of the appointments of the CEO and DCEO, Regulatory Affairs.
- The internal audit function completed its remaining assurance engagement commitments, as stated in its revised triennial 2017–2018 to 2019–2020 RBAP: the review of the Political Financing Return Program and the audit of IT security.
- The internal audit function has sought to incrementally modernize several aspects of Audit Committee functioning, including planning with the external members and revising its planning documents, such as the forward agenda.
- Significant effort was devoted to assisting PricewaterhouseCoopers (PwC) in conducting its mandatory independent audit of the performance of poll workers. PwC received direct support to audit five by-elections in 2018–2019. The internal audit function also worked closely with PwC and EC stakeholders to revise PwC's audit plan and contract with EC to reflect recent, significant changes to the materials and training offered to poll workers. The function also began preparation activities to conduct the mandatory independent audit of the 43rd general election in fall 2019.
- The CAE provided logistical and informational support to the Audit Committee and to external assurance providers.
The CAE deems that EC's internal audit responsibilities were met in 2018–2019.
The Audit Committee recognizes the accomplishments of the CAE during the past year. It encourages the CAE to continue to mature the internal audit function and its ability to provide assurance to the agency with respect to key programs and initiatives.
The Audit Committee considers that its activities for the year constitute a satisfactory basis for fulfilling its role. It was provided with relevant and transparent information responsive to its mandate.
The DAC notes EC's efforts to implement its transformation agenda and to prepare for the 2019 general election while implementing aspects of the new legislation. Based on its observations throughout 2018–2019, the Committee considers that EC has a systematic and rational approach to delivering its mandate, managing risks, monitoring results and reporting publicly.