Passport Canada Revenue (PPTC Fees) Audit
←
→
Page content transcription
If your browser does not render page correctly, please read the page content below
Passport Canada
Revenue (PPTC Fees) Audit
June 2008
Foreign Affairs and International Trade Canada
Audit Division
This document may not be fully accessible. For an accessible version, please visit
http://www.international.gc.ca/about-a_propos/cae-dv/passport_fees-recettes_passeport08.aspxTABLE OF CONTENT
EXECUTIVE SUMMARY................................................................................................. 1
1.0 BACKGROUND ......................................................................................................................3
2.0 AUDIT OBJECTIVE, SCOPE, APPROACH AND TIMING ....................................... 3
OBSERVATIONS AND RECOMMENDATIONS ............................................................. 4
3.0 MANAGEMENT CONTROL FRAMEWORK - ISSUING OFFICES ............... 4
4.0 DEPOSITS AND REVENUE CONTROLS - PPCF FINANCIAL SERVICES 10
5.0 INTERNAL CONTROL FRAMEWORK PROJECT ...................................... 22
APPENDICES
Appendix A - Audit Objectives and ScopeEXECUTIVE SUMMARY
The Audit Division carried out an audit of Passport Canada=s revenues in
accordance with the 2006/07 Audit Plan. The objective of the audit was to assess the
adequacy of the management control framework related to the collection and reporting
of revenues during the 2006/07 fiscal year. Passport Canada reported a total of $231 M
in revenues for the 2006/07 fiscal year.
Domestic Issuing Offices
Generally, roles and responsibilities are well understood by management and
staff and are applied consistently across issuing offices. Duties are, overall, properly
segregated amongst staff. The audit concluded that, overall, appropriate management
oversight is exercised for the reconciliation process at the local level.
Documents describing the revenue and cash management practices to be
applied by issuing offices contain gaps in coverage and have not been consistently
published and distributed to all concerned. In addition, no financial training is available
to office and assistant managers in support of discharging their financial management
responsibilities. This has adversely affected the level of compliance by issuing offices,
created gaps in internal controls, weakened the effectiveness of existing internal
controls and reduced operational efficiency.
Measures to enhance the safety of employees and to promote the safeguarding
of assets were implemented in each of the issuing offices visited by the Audit Team.
These measures included the installation of security cameras in key areas of the office
and the use of dual cash drawers with locks. There is a need, however, to improve the
effectiveness of the controls related to the receipt of mail in the mail-in environment,
petty cash and change funds, and the transfer of cash between the officer and the
assistant manager.
Financial Services Division
The Audit Team tested the key financial controls related to bank deposits and
revenues and found that they had been effectively applied by the Financial Services
Division during 2006/07. Accordingly, the results of the audit provide Passport Canada
Senior Management with assurance that the bank deposits and revenue information
recorded in PASSAP1, which is used for internal and external reporting, is accurate and
complete.
1 PASSAP = Passport Canada Financial SAP System
1While the key financial controls were effectively applied during 2006/07, some
improvements can, however, be made. Standards for the application of the controls
need to be defined and formalized in business process documentation. In addition,
existing management oversight practices can be expanded. These improvements will
reduce the risk of error and inconsistency, improve operational efficiency and
strengthen employee morale.
A detective control applied by Passport Canada Corporate Services identified
274 instances in 2006/07 where a passport2 was in the custody of the applicant but
where a payment (i.e. DZ) and revenue (RV) entry had not been recorded in PASSAP
(herein referred to as instances of no DZ/RV). There were also 628 additional instances
identified where a revenue (RV) entry had not been recorded in PASSAP (herein
referred to as instances of no RV3). The above instances of no DZ/RV and no RV have
been subject to some degree of management oversight by Passport Canada Senior
Management.
However, the Audit Team is of the view that greater effort needs to be invested
into determining the specific root cause(s) of the identified instances of no DZ/RV and
no RV. An inadequate explanation was received by Financial Services Division from
issuing offices for 62% or 171 of the 274 reported instances of no DZ/RV. Follow-up of
the 628 reported instances of no RV is underway to identify the associated cause(s).
*****
Passport Canada Corporate Services has launched an Internal Control
Framework initiative in 2006/07 in anticipation of the Treasury Board Secretariat=s
promulgation of a policy on internal control. The thrust of the audit recommendations
contained in this report are very much in line with the objectives of the Internal Control
Framework initiative. For this reason, the Audit Team regards the Internal Control
Framework as a key corporate initiative.
2
PPCA, Administrative Services Division, ensured that the instances did not represent Agratis@
issued passports.
3
Instances of no RV differ from the no DZ/RV scenario in that the client=s payment (i.e. DZ) is
recorded in PASSAP.
2Financial Services Division has developed an action plan to implement the
Internal Control Framework initiative over a three year time span (i.e. 2006/07 to
2008/09). The action plan has been prepared at a summary level, identifying major
tasks by fiscal year and providing a high level consideration of resource requirements.
The Audit Team is of the view that a more detailed action plan is, however, required
given the importance of the Internal Control Framework initiative both in terms of
complying with TBS policy requirements and addressing the observations raised by the
audit.
1.0 BACKGROUND
1.1. Under the Canadian Passport Order, Passport Canada is entrusted with
the responsibility of issuing travel identity documents to Canadians and residents of
Canada for the purpose of travelling abroad. The Canadian Passport Order charges
Passport Canada with the administration of all matters relating to the issuing, revoking,
withholding, recovery and use of the Canadian passports.
1.2 Passport Canada operates on a revolving fund basis and is self-financing
through user fees charged for various travel documents. Unlike other government
departments, Passport Canada has no annual parliamentary appropriation for its
operations and must generate sufficient revenues to meet its expenses. In December
2001, the passport fee was raised to $87 for a regular adult passport. Of this fee, $62
funds the operations of the PPTC through its revolving fund and the remaining $25
recovers consular service costs. The amount of revenue reported by Passport Canada
for the 2006/07 fiscal year was $231 M.
1.3 Passport Canada currently offers domestic passport-related services to in-
person clients through 33 local offices as well as a central directorate, which receives
and processes applications submitted by mail.
1.4 Given the importance, risks, and high dollar value that are associated with
the management of passport service fees, the Departmental Audit and Evaluation
Committee approved an audit of Revenues in the 2006/07 Audit Plan.
32.0 AUDIT OBJECTIVE, SCOPE, APPROACH AND TIMING
2.1 Audit Objective and Scope
2.1.1 Overall, the objective of the audit was to assess the adequacy of the
management control framework related to the collection and reporting of revenues
during the 2006/07 fiscal year. Appendix A contains a detailed description of the
audit=s objectives and scope.
2.2 Audit Approach and Timing
2.2.1 The key tasks associated with the audit approach consisted of reviewing
applicable Passport Canada policies and procedures, conducting interviews with
management and staff and testing the effectiveness of key internal controls related to
the revenue cycle applied by a sample4 of issuing offices and the Financial Services
Division.
2.2.2 The audit took place during the period of October 2006 and May 2007.
4
The Audit Team visited the following issuing offices: Ottawa, Winnipeg, Toronto, Montreal, Laval
and National Processing Services (NPS)
4OBSERVATIONS AND RECOMMENDATIONS
3.0 MANAGEMENT CONTROL FRAMEWORK - ISSUING OFFICES
3.1 Role, responsibilities and authorities
3.1.1 Generally, roles and responsibilities are well understood by management
and staff and are applied consistently across issuing offices. Segregation of duties is
generally respected. The roles and responsibilities recognized by staff are in
accordance with prescribed policies and procedures.
3.1.2 Overall, appropriate management oversight is exercised for the
reconciliation process related to the Office Tally Report, including sign-off by the office
manager or his/her delegate.
3.1.3 Situations where staff roles and responsibilities were not accomplished
effectively were generally due to a lack of awareness or understanding of the financial
policies and procedures and of the impact their actions have on other areas of the
organization (eg. change fund management; adequacy of supporting documents).
3.2 Information
3.2.1 Interviews with Managers and Assistant Managers indicate that there is
limited awareness of financial policies as they apply to the processing and receipt of
revenues. Knowledge is generally passed on from one manager to the next through on
the job training. This lack of awareness is mostly notable in the National Processing
Centre where the reconciliation of the Cashier=s Daily Tally was transferred from
Support Services to the Assistant Managers approximately 2 years ago without
adequate training and supporting information.
3.2.2 Financial policies have not been translated into operational procedures.
Consequently, procedures to support operational requirements have been
independently developed at the local level and, for the most part, meet the needs of the
office. However, in some circumstances, procedures do not fully account for policy
requirements and lead to situations of non-compliance or gaps in internal controls.
3.2.3 Issuing offices do not consistently reconcile by payment method.
Although this is a key control that ensures the accuracy of the amounts reported on the
Office Tally Report, and of the information on client records, the requirement to
reconcile by payment method has never been formalized. The Cash and Revenue
Management Manual provides guidance on the reconciliation requirements. Although,
the Cash and Revenue Management Manual (CRMM) was created several years ago, it
had not been formally released at the time of the audit.
53.2.4 There is limited and high level information regarding the information
required to support the Office Tally Report discrepancies. Internal documents do not
provide sufficient guidance regarding the type and level of information required to justify
overage/shortages, only that a justification is required. Consequently, justifications are
provided on a number of different forms, include varying level of information, sign-off by
the officer and assistant manager is haphazard and, occasionally, no information is
provided at all.
3.2.5 Assistant managers have a limited understanding of the information
captured under the section of the Office Tally Report entitled AListing of Cashiers and
ESRF Statuses (Over/Under Payment)@. This section represents a listing of accounts
where payments are processed for services sold in a previous day or the service was
sold in the current day but payment has yet to be processed (e.g. credit card payment
declined). If used effectively, the information contained in this part of the Office Tally
Report (OTR) could be useful for monitoring purposes.
3.2.6 Adjusting entries are ill-defined. Guidance of when and how an adjusting
entry is to be prepared is not available and poorly understood by issuing offices.
According to the Cash and Revenue Management Manual (CRMM), the Aoffice manager
is to prepare an adjusting entry for the overage/shortage@. Based on our interviews with
office managers, observations and review of the Office Tally Report, none of the issuing
offices visited prepare adjusting entries since, at this time, these are input by Financial
Services Division.
3.2.7 Office managers, or delegates, are responsible for authorizing the creation
and distribution of codes used for the debit/credit card machines. However, there are
no policies and procedures regarding the use and set up of the debit/credit card
machines. Consequently, it is unclear what the business practices and standards are
with respect to:
$ Requirements for User IDs;
$ Roles, responsibilities and authorities;
$ Access controls;
$ Authorizing refunds;
$ Processing of deposits (i.e. by machine or at the office level); and,
$ Information on receipts.
3.2.8 In some cases, individual user ID=s for the use of debit/credit card
machines has not been implemented. Although such a requirement hasn=t been
formally stated, the absence of this financial control minimizes accountability for the
financial transactions processed by an officer and preempts management ability to
conduct an effective and thorough reconciliation by payment type and by officer.
3.2.9 Overall, documents describing the revenue and cash management
practices to be applied by issuing offices contain gaps in coverage and have not been
6consistently published and distributed to all concerned. Consequently, there are varying
levels of awareness of Passport Canada’s revenue and cash management policies,
procedures and directives which adversely affect the level of compliance by issuing
offices.
Recommendation - Director Financial Services Division
3.2.10 As a priority, ensure existing financial documents relating to operational
reconciliation policies and procedures are valid, up to date and accessible
to all staff.
3.2.11 Prepare, in consultation with the Operations Bureau, a document that fully
describes the Office Tally Report reconciliation process to be adopted by
issuing offices, including National Processing Centre. At a minimum, the
following areas should be addressed in the business process
documentation:
$ Role, responsibilities and authorities of management and staff,
including review and approval requirements;
$ Standards and procedures to apply when documenting the
overages/shortages, including supporting documentation;
$ Description of the purpose of the information contained in the Office
Tally Report;
$ Guidance on resolving anomalies, requirements for reconciling by
payment method and tools available in support of these functions;
and,
$ Description of reports available MARA and IRIS and their intended
use.
3.2.12 Distribute the Office Tally Report reconciliation business process
documentation developed per 3.2.11 to applicable stakeholders and
provide related training.
3.2.13 Establish standards to apply for the use and set-up of debit/credit card
machines.
Management Action Plan and Time Frame
3.2.10 PPCF will ensure appropriate policies exist, are up-to-date and are
accessible to all staff. They will also ensure that reconciliation
procedure internal to Financial Services Division exist, are up-to-date
and are accessible to all Financial Services Division staff.
73.2.11 PPCF will take the lead to create a joint working group, which is
composed of representatives of Operations, Systems, Human
Resources HR training and Financial Services Division, whose
purpose is to develop a document that fully describes the
reconciliation and provide an advanced IRIS training course (3.3.3)
for office managers and assistant managers.
3.2.12 A new FI02 position (Operational Liaison) will be created in Fiscal
Year 2007/08 in Financial Services Division Corporate Accounting
and Quality Assurance. One of the responsibilities on this position
will be to provide input and advice to Operations and Human
Resources HR Training on fee management to ensure operational
procedures respect policies and regulations. They will also assist
Operations in designing and signing off specs for change or
development requests related to systems, reports and forms that
involve fee management.
3.2.13 Each office will be supplied with instructions from the supplier on
the use and set-up of terminals in addition to internal standards and
requirements set by Passport Canada. Financial Services Division
also recommends that the Operational Liaison ensures this
information is updated into an Office Managers Operational Manual.
3.3 Training
3.3.1 Passport officers are generally well versed on procedures as described in
the Officer Training Manual. All offices commented that the formal officer training is
supplemented by on the job training, including particularities of each office.
3.3.2 There is no financial training available to office managers and assistant
managers in support of their reconciliation responsibilities. The Audit Team found
limited knowledge of the potential cause(s), impact(s) and resolutions to anomalies
found in the Office Tally Report which require in-depth knowledge of IRIS= Aservice sold@
and Afee processing@ functionalities. Although reconciliations are completed with
varying degrees of efficiency, there is limited use of tools and reports available in IRIS
and, particularly, in MARA.
Recommendation - Director Financial Services Division
3.3.3 In partnership with the Operational Training Division, initiate the
development of an advanced IRIS training course for office and assistant
managers with a specific objective of providing education required to
effectively discharge their financial management responsibilities with
particular focus on the Office Tally Report reconciliation process.
8Management Action Plan and Time Frame
3.3.3 Financial Services Division will take the lead, in consultation with
Operations, IT and HR Training to develop the Office Tally Report
reconciliation process and provide an advanced IRIS training course
for office managers and assistant managers. In order to accomplish
this, Financial Services Division will commit that the new FI-02
(Operation Liaison officer), will provide input for and sign off on the
fee related sections. Operations will initiate and carry out training
combined with HR training after the courses are developed (included
in the official training material). Operations will ensure that policy
changes are communicated to the issuing offices.
3.4 Safeguarding of Assets
3.4.1 Measures to enhance the safety of employees and to promote the
safeguarding of assets were implemented in each of the issuing offices visited. These
measures included the installation of security cameras in key areas of the office and the
use of dual cash drawers with locks. *****
3.4.2 Financial policies require that when money is received by mail, the mail
opening process must always involve two employees. This requirement is not
consistently applied in the Mail-in environment.
3.4.3 In one of the issuing offices visited, the Audit Team observed that there
was no sign off between the officer and the assistant manager during the transfer of
cash. The absence of this control increases the risk of improprieties and of potential
issues should a loss or theft of monies occur.
3.4.4 The Audit Team noted inconsistency in the management and control of
the change funds. Only one of the six offices visited has implemented the processes
and controls as described in the Petty Cash and Change Fund Directive. The remaining
offices have developed in-house procedures with varying degrees of efficiency and
effectiveness. Issues observed include:
$ *****
$ Petty cash and change funds were used interchangeably;
$ Change fund was used to Atop-up@ shortages or to deposit overages; and,
$ *****
3.4.5 The above observations are due to gaps in guidance and the inconsistent
enforcement of existing standards by issuing offices. *****
9Recommendation - Director Financial Services Division
3.4.6 To promote the complete segregation of the petty cash and change fund,
re-issue the Petty Cash and Change Fund directive in two separate
documents. As part of this exercise, re-assess the change fund
management procedures with a view of simplifying control activities and
promoting a greater degree of compliance.
Recommendation - Director General Operations
3.4.7 Implement dual control (ie. two persons attending) for the opening of
passport applications in the Mail-In work environment.
Management Action Plan and Time Frame
3.4.6 Financial Services Division will separate the petty cash and change
fund directives.
Financial Services Division will consult with offices to clarify what is
preventing them from respecting the procedural requirements in the
change fund directive.
3.4.7 Operations will determine the feasibility and impact on staffing. The
impact will be considerable as it would double the number of staff
required to open the mail.
3.5 System Controls
3.5.1 The automated controls and functionalities in IRIS for recording the receipt
of cash payments were generally found to be weak as demonstrated by the following:
$ Officers rarely use the function of AAmount Tendered@, preferring to manually
calculate the Achange due@. Situations of overages/shortages usually arise
because the wrong change is given to the client particularly in cases where
multiple services are sold; and
$ The controls for the processing and recording of cash payments are inadequate
when compared to the controls for debit/credit card payments, as officers are not
required to retain a copy of the payment receipt for reconciliation purposes.
3.5.2 IRIS profiles are regularly reviewed by Office Managers to ensure ongoing
validity of the access privileges. However, assigned profiles are not in line with
operational responsibilities of issuing offices staff. Passport Canada processes require
that Production Clerks be assigned the same IRIS privileges and user profile as those of
Passport Officers thereby increasing the risk of inappropriate actions (ie. passport
entitlement). *****
10Recommendations - Director Financial Services Division and DG, Operations
3.5.3 Investigate the reason(s) why Operations Bureau staff are not using IRIS=
AAmount Tendered@ and AChange Due@ functionality with a view of
improving this function or introducing alternate controls.
3.5.4 Implement a requirement that a second receipt for cash payment be printed
from IRIS and attached to the Office Tally Report.
3.5.5 Establish user profiles that appropriately reflect the operational
responsibilities of issuing offices staff and grant officer privileges only to
those employees that have completed the Examiner Training course and
that are granted entitlement privileges.
3.5.6 *****
Management Action Plan and Time Frame
3.5.3 Operations will broadcast a reminder to office managers and cashiers
to use IRIS= the AAmount Tendered@ and AChange Due@ functionality
with a view of improving this function or introducing alternate
controls.
3.5.4 PPCF does not see the added value/control of requiring an additional
cash receipts be printed and attached to the Office Tally Report (OTR)
at the end of each day. The additional printing will add processing
time to each ESRF and each receipt will have to be saved and
provided to the manager at the end of the day. Providing a copy of
each examiner=s cash tally report may be the better solution.
Operations and Financial Services Division will explore this solution.
3.5.5 Operations will take the lead and work with IT Development and
Security to implement this recommendation. Lead: Software
Development
3.5.6 Operations will work with IT Services and Security to implement this
recommendation.
114.0 DEPOSITS AND REVENUE CONTROLS - PPCF FINANCIAL SERVICES
DIVISION
4.1 Bank Deposit Reconciliation Process
4.1.1 Financial Services Division, Financial Quality Assurance reconciles the
bank deposits5 information recorded in PASSAP through the IRIS/PASSAP and Bank
Cash Management System6 (BCMS)/PASSAP interfaces on a monthly basis. The bank
deposits reconciliation process represents a key financial control as it provides Passport
Canada Senior Management with assurance that PASSAP=s deposits information (i.e.
receipts), used for internal and external financial reporting, is accurate and complete.
4.1.2 Overall, the reconciliation control was effectively exercised by Financial
Services Division, Financial Quality Assurance during the 2006/07 fiscal year.
$ Financial Services Division, Financial Quality Assurance prepared, in a timely
manner, a total of 4257 Excel reconciliation spreadsheets, one for each issuing
office and month of the fiscal year. The reconciliation spreadsheets identified
shortages/overages8 by day and by payment method9 and provided a net
shortage/overage for the day and the month.
$ Adjustments to reconcile PASSAP=s deposit information to the amounts recorded
in the BCMS are posted to GL 30015 (PPT Cash over/short). The total net
amount posted to GL 30015 during 2006/07 by the Financial Quality Assurance
Officer amounted to a net shortage of $9.2K10. The Audit Team tested a sample
of adjusting entries and found that they were properly substantiated and
accurately posted in PASSAP.
5
Deposits, for reconciliation purposes, relate to cash, debit card and credit card payments.
PASSAP, through the use of an Assignment Coding structure, separately records cash, debit card and
credit card payments by office, month and value date.
6
The BCMS interface records, in PASSAP, the deposits made at the Bank of Canada by issuing
offices.
7
35 issuing offices x 12 months = 420 + 4 reconciliation spreadsheets associated with the
Renewal Centre for the period of April to July 07 + 1 reconciliation spreadsheet for the Mississauga (216).
8
Overages/shortages are quantified by comparing the amount recorded in PASSAP through the
BCMS/PASSAP interface (i.e. deposits per Bank of Canada) to the amount recorded in PASSAP through
the IRIS/PASSAP interface (i.e. deposits per Passport).
9
Payment methods consist of cash, debit and credit cards.
10
This figure represents a net shortage derived from total debits of $112.7K (i.e. shortage) and
total credits of $103.5K (i.e. overage).
124.1.3 Passport Canada Senior Management can take comfort that:
$ A reconciliation process is in place that identifies and substantiates when
adjustments are required;
$ A review of a sample of Excel reconciliation spreadsheets indicated that the
figures contained in the spreadsheets agreed with the deposit information
recorded in PASSAP and relevant data captured in the applicable Office Tally
Report (OTRs) (i.e. correct figures were used for reconciliation and adjusting entry
purposes); and,
$ The net amount (i.e. $9.2K) of adjusting entries posted in PASSAP in 2006/07 as
a result of the reconciliation process was not material when compared to the
amount of deposits generated by the domestic issuing offices in 2006/07 (i.e.
approximately $283M). This indicates that, for the most part, the amount of
deposits recorded in PASSAP through the IRIS/PASSAP interface agreed with
the amount of deposits in PASSAP posted through the BCMS/PASSAP interface.
Accordingly, the reconciliation process results in assurance as to the integrity of
the bank deposits information related to domestic operations recorded in PASSAP
(i.e. entries posted to GL 62200 and GLs 119XX).
4.1.4 While the reconciliation process was effectively exercised in 2006/07, some
improvements can, however, be made. The Audit Team=s review of the 425
reconciliation spreadsheets prepared in 2006/07 indicated that:
$ 194 (46%) of the 425 reconciliation spreadsheets identified a net
overage/shortage for the month that exceeded the $8711 threshold. 47 (24.2%) of
the spreadsheets did not contain an explanation(s) of the net overage/shortage as
required by Financial Services Division Financial Quality Assurance practice;
$ 239 (56.2%) of the 425 reconciliation spreadsheets did not identify whether a
correcting entry was recorded in PASSAP as a result of the reconciliation process;
$ 182 (98%) of the 186 reconciliation spreadsheets that did identify that a
correcting12 entry was posted in PASSAP did not specify, with the exception of
11
PPCF Financial Services established a $87 dollar threshold for purposes of identifying when an
analysis of the month=s net overage/shortage was required. The threshold was increased to $261 for the
months of February and March 2007.
12
A correcting entry is posted in PASSAP, where applicable, in order to correct the deposit figures
used for reconciliation purposes. For example, the transfer of an applicant=s file, with an accompanying
PPT-218, results in a correcting entry being recorded in PASSAP to affect the transfer of the payment
amongst the two applicable offices. (Note - effective March 13/07, a new transfer procedure was
introduced that no longer requires the posting of a correcting entry in PASSAP to transfer the deposits
amongst the applicable offices).
13transfers, the applicable PASSAP document number used to effect the entry.
Financial Quality Assurance reports, however, that this information was
consistently noted in the reconciliation working paper files;
$ Different practices were used to document the impact of the correcting entries on
the numbers used for reconciliation purposes (i.e. adjusting the amount
associated with a particular assignment and value date versus reflecting the net
impact of all correcting entries as a single number on the reconciliation sheet);
$ The level of detail contained in the explanation of the net overage/shortage for the
month, when it exceeded the $87 threshold, varied;
$ The layout/design of the reconciliation spreadsheet varied (i.e. different practices
used to document the correcting entries made and the explanation of the net
overage/shortage for the month);
$ The Atext field@ of the clearing entries identified on the reconciliation spreadsheet
and posted in PASSAP did not accurately capture the reason for the entry (i.e.
typically contains text such as ARecon@ followed by the name of the issuing office
with no mention that an amount had been posted to GL 30015
(overage/shortage);
$ Different practices were used to clear amounts recorded in GL 62200 (Treasury
Clearing X - CRF). That is, at times, a clearing entry was posted in PASSAP for
the amounts recorded in GL 62200 associated with a day, a group of days or the
entire month; and,
$ The results of the reconciliation process are not formally reviewed nor approved
by either the Manager, Financial Operations nor the Deputy Director, Financial
Operations and Systems (i.e. no formal approval documented on the
reconciliation spreadsheet).
4.1.5 At present, a document does not exist which describes the reconciliation
business process. This explains, in part, the variation in practice that was observed by
the Audit Team as described above. As well, the absence of business process
documentation creates risks from an operational efficiency perspective and for corporate
memory purposes.
4.1.6 Overall, there is some management oversight being exercised by the
Manager, Financial Operations and the Deputy Director, Financial Operations and
Systems over the reconciliation process applied by the Financial Quality Assurance
Officer. This occurs periodically through their review of an Excel spreadsheet that
indicates the issuing offices and months for which the reconciliation procedures have
been completed. It also occurs through both formal and informal meetings with the
Financial Quality Assurance Officer to discuss the status of the reconciliation process
and any issues that may exist. There is a need, however, to strengthen Financial
14Services= oversight practices by having an individual in a managerial capacity formally
review and approve the results of the monthly reconciliation process, including an
analysis of the reasons for the reported net overages/shortages. We also noted that
Financial Services Division does not conduct any active monitoring of operational
reconciliation and financial management activities at the local level. The Audit Team is
of the view that this additional oversight is justified considering that:
$ Carrying out and documenting the reconciliation process represents a key
financial control;
$ The reconciliation process often results in correcting, adjusting and clearing
entries being posted in PASSAP; and,
$ A document describing the reconciliation process does not currently exist thereby
increasing the risk of inconsistency and error.
4.1.7 In summary, the domestic operations of Passport Canada processes a
significant amount of client payments (i.e. approximately $283M in 2006/07) that are
deposited in financial institutions across the country. Reconciling the amount of deposits
reported by the financial institutions to the amount of deposits recorded in PASSAP
becomes, therefore, a key financial control. The Audit Team reviewed the reconciliation
practices followed by Financial Services Division during 2006/07 and found that they
were effectively applied. Accordingly, the results of the audit provide assurance as to the
integrity of the bank deposits information related to domestic operations recorded in
PASSAP (i.e. entries posted in GL 62200 and GLs 119XX).
While the reconciliation process was effectively exercised in 2006/07, some
improvements can, however, be made. Standards for documenting the application of the
reconciliation process need to be defined and formalized in business process
documentation. In addition, Financial Services Division management oversight efforts
need to be augmented given the significance, from a financial control perspective, of the
reconciliation process.
Recommendations - Director Financial Services Division
4.1.8 Prepare a document that describes the bank deposits reconciliation
process. At a minimum, the following areas should be addressed in
the business process documentation:
$ The objectives of the bank deposits reconciliation process;
Role and responsibilities of Financial Services Division and Issuing
office stakeholders, including review and approval requirements;
$ Frequency of the reconciliation process;
$ Tasks to be performed and their associated timing;
$ Threshold(s) to apply for purposes of explaining the net
15overage/shortage for the month;
$ Standards to apply when documenting the results of the
reconciliation process; and,
$ Working paper file content, structure and archiving practices.
4.1.9 Promulgate the business process document per 4.1.8 to applicable
Financial Services Division and issuing offices stakeholders and
provide related training.
4.1.10 Augment existing management oversight practices by having the
Manager, Financial Operations:
$ Review and approve the results of the monthly bank deposits
reconciliation process;
$ Review a report, prepared on a quarterly basis, which provides an
analysis of the reasons for the reported net monthly
overages/shortages; and,
$ Implement remedial action, based on the review of the quarterly
report, when warranted.
$ Conduct periodical monitoring visits in the Regions.
Management Action Plan and Time Frame
4.1.8 PPCF Financial Systems is currently redesigning the IRIS-PASSAP
interface, which will significantly change the revenue and cash
management procedures. Therefore part of this project will be to
document, deliver, and train all Financial Services Division staff on the
new bank reconciliation procedures. A requirement to add oversight
procedures into this documentation will be added to the project
documentation requirements. This will include regular review and sign
off on bank reconciliation reports in addition to analysis and
explanation of overages and shortages and follow-ups.
4.1.9 See 4.1.8
4.1.10 See 4.1.8
4.2 Financial Controls over Revenue
4.2.1 Financial Services Division carries out a number of procedures that provide
comfort as to the accuracy and completeness of the revenue data recorded in PASSAP.
The Audit Team examined procedures with respect to:
$ Reconciling IRIS sales and PASSAP revenue information;
16$ Clearing Customer Account (CA) open items; and,
$ Investigating instances of a passport being issued without associated payment
and/or revenue entries being recorded in PASSAP.
4.3 IRIS/PASSAP Revenue Reconciliation
4.3.1 Financial Services Division Revenues, Accounts Payable and Receivables
reconciles IRIS= sales information to PASSAP=s revenue data (herein referred to as the
revenue reconciliation). The revenue reconciliation occurs as part of the year-end
procedures applied by Financial Services Division. The revenue reconciliation represents
a key financial control. It provides Passport Canada Senior Management with comfort
that the revenue data recorded in PASSAP, which is used for financial reporting, is
accurate and complete.
4.3.2 Financial Services Division, Accounts Payable and Receivables documents
the application of the revenue reconciliation procedures by way of preparing a series of
Excel spreadsheets. The spreadsheets compare and identify variances between the
sales information recorded in IRIS and the revenue data recorded in PASSAP, at the
issuing office level. The total net variance between IRIS= sales figures and PASSAP
revenue data was $270K on a total reported revenue of $231M for the 2006/07 fiscal
year. The total net variance represents less than one percent of the total reported
revenue and is, therefore, immaterial. The Audit Team traced the amounts appearing in
the spreadsheets to source data from both IRIS and PASSAP and established that the
figures used for the revenue reconciliation were accurate.
4.3.3 While a reconciliation of IRIS= sales information and PASSAP=s revenue
data is occurring, opportunities exist to strengthen the control, as evidenced by the
following:
$ The revenue reconciliation is currently being performed on an annual basis as part
of Financial Services Division= year-end procedures. Increasing the frequency
from an annual to a quarterly basis would allow the division to detect and
investigate significant variances (if they arise) and take corrective action in a timely
manner. Moreover, a more frequent application of the revenue reconciliation is
warranted as it represents a key financial control;
$ IRIS information contained in the 2006/07 reconciliation spreadsheets was
supported by a hard copy IRIS report detailing service fees by issuing office.
This was not the case for the PASSAP revenue information13 recorded on the
reconciliation spreadsheets. In 2005/06, the Financial Services Division Accounts
13
An interview with the PPCF RAPR staff member who prepared the 2006/07 revenue
reconciliation spreadsheets indicated that he accessed PASSAP and Acopied and pasted@ the revenue
information into the spreadsheets. There was, however, no note to this affect inserted into the
spreadsheet such that it was not evident as to how the PASSAP revenue information was specifically
derived.
17Payable and Receivables revenue reconciliation file contained a hard copy of a
AProfit and Loss@ report which supported the PASSAP figures used for
reconciliation purposes;
$ Documentation used and prepared in relation to the 2006/07 revenue reconciliation
process was not consolidated into a well organized working paper file;
$ Dollar and percentage thresholds have not been formally established to guide the
analysis of variances identified by the revenue reconciliation process;
$ Documentary evidence does not exist indicating that the variances associated with
the 2005/06 revenue reconciliation were analyzed. To date, PPCF Financial
Services Division has not investigated the variances identified in the 2006/07
revenue reconciliation spreadsheets. *****
$ The results of the 2006/07 revenue reconciliation was subject to management
oversight. That is, the Manager, Financial Operations and the Deputy Director,
Financial Operations and Systems both reviewed the revenue reconciliation
spreadsheets and provided feedback to the staff member who had prepared them.
However, the spreadsheets do not bear any evidence (i.e. signatures) that the
management oversight had been exercised.
4.3.4 The Audit Team attributes the observations raised above to the absence of
formal business process documentation that specifies standards for purposes of
conducting and documenting the application of the revenue reconciliation process. The
absence of standards increases the risk of inconsistency and error and reduces
operational efficiency. Moreover, there is also a risk that staff will become frustrated
given the absence of specific guidance on how the revenue reconciliation process is to be
performed and documented.
4.3.5 In summary, reconciling IRIS= sales information to PASSAP=s revenue data
represents a key financial control. This control has been incorporated into PPCF
Financial Services Division= management control framework and evidence exists that it
has been applied on an annual basis. Opportunities do exist, however, to strengthen the
design and application of the control. Standards need to be articulated by way of
preparing and promulgating business process documentation and greater emphasis
placed on variance analysis.
Recommendations - Director Financial Services Division
4.3.6 Prepare a document that describes the IRIS/PASSAP revenue
reconciliation process. At a minimum, the following areas should be
addressed in the business process documentation:
18$ The objectives of the revenue reconciliation process;
$ Roles and responsibilities of Financial Services Division staff,
including review and approval requirements;
$ Frequency of the reconciliation process;
$ Tasks to be performed and their associated timing;
$ Reports to be generated to substantiate IRIS/PASSAP figures used for
reconciliation purposes;
$ Threshold(s) to apply for variance analysis purposes;
$ Standards to apply when documenting the results of the revenue
reconciliation process; and,
$ Working paper file content, structure and archiving practices.
4.3.7 Promulgate the business process document per 4.3.6 to applicable
Financial Services Division stakeholders and provide the appropriate
training.
4.3.8 Perform the IRIS/PASSAP reconciliation on a quarterly basis.
(Note - quarterly frequency should be incorporated in the business process
documentation per recommendation 4.3.6)
4.3.9 Establish a threshold(s) for purposes of analysing selected variances
identified in the 2006/07 revenue reconciliation spreadsheets. The
results of the variance analysis should be documented and remedial
action defined and implemented, when warranted.
(Note - established threshold(s) for variance analysis purposes should be
incorporated in the business process documentation per recommendation 4.3.6)
4.3.10 Ensure that the Manager, Financial Operations and Deputy Director,
Financial Operations and Systems sign the revenue reconciliation
spreadsheets as evidence of having reviewed and approved
respectively the results of the revenue reconciliation process.
Management Action Plan and Time Frame
4.3.6 PPCF Financial Systems is currently redesigning the IRIS-PASSAP
interface, which will significantly change the revenue and cash
management procedures. Therefore part of this project will be to
document, deliver, and train all relevant staff on the new revenue
reconciliation procedures. The requirements for signed quarterly
reports, thresholds, variance analysis, and follow actions
requirements, will be added to the documentation requirements of this
system=s project.
194.3.7 See response to 4.3.6
4.3.8 See response to 4.3.6
4.3.9 See response to 4.3.6
4.3.10 See response to 4.3.6
4.4 Clearing of Customer Account (CA) Open Items.
4.4.1 Clearing of Customer Account (CA) open items is a financial control that is
designed to improve the integrity and reliability of the revenue and consular fee liability
information recorded in PASSAP.
4.4.2 Financial Services Division Financial Quality Assurance clears about 30
customer account open items each month, for an average of 360 open items per year.
Customer Account (CA) open items are not, therefore, material either in terms of volume
nor dollar value14. The Audit Team determined that there were no outstanding Customer
Account (CA) open items at March 31st, 2007.
4.4.3 Clearing of Customer Account (CA) open items results in entries being
posted in PASSAP. Financial Services Division, Financial Quality Assurance did not,
however, consistently maintain a record of the entries posted in PASSAP during the
2006/07 fiscal year. In addition, the unit did not consistently access an Excel
spreadsheet, that had been introduced by the Manager Financial Operations in January
2007, to record that the month-end task had been completed. Accordingly, the above
indicates that the documentation practices associated with clearing Customer Account
(CA) open items could be improved. The Audit Team attributes this situation to the
absence of formally promulgated documentation which describes the business process
for clearing Customer Account (CA) open items.
Recommendations - Director Financial Services Division
4.4.4 Prepare a document that describes the process to clear CA open
items. At a minimum, the following areas should be addressed in the
business process documentation:
$ The objectives of the Customer Account (CA) open items clearing
process;
$ Roles and responsibilities of Financial Services Division staff;
$ Frequency of the clearing process;
14
Approximate value of $31K (i.e. 360 x $87).
20$ Tasks to be performed and their associated timing;
$ Standards to apply when documenting the results of the clearing
process; and,
$ Working paper file content, structure and archiving practices.
4.4.5 Ensure that documentation practices are improved by maintaining a
complete record of the entries posted in PASSAP and by updating the
AYear End and Month End@ Excel spreadsheet once the clearing of CA
open items has been completed.
Management Action Plan and Time Frame
4.4.4 PPCF Financial Systems is currently redesigning the IRIS-PASSAP
interface, which will significantly changes the service request revenue
and A/R procedures which can account for open Customer Accounts
(CA). Under this re-design we will reduce the number of transaction
that post to customer accounts from 15,000 to 50 daily which
significantly reduces the time and effort to monitor open customer
accounts. Some of the previous mandatory clearing procedures will
also be automated under the new interface design.
4.4.5 See response to 4.4.4
4.5 Passports issued without associated payment and/or revenue
4.5.1 Passport Canada has put in place a month-end procedure whereby issuing
offices perform a physical count of the passports held on hand. The physical count
information (quantity and location of the various types of passports) is compared to the
equivalent data recorded in PASSAP. Discrepancies are identified and communicated to
the headquarters Administrative Services Division (PPCA) which investigates the noted
instances.
4.5.2 Administrative Services Division identified 274 instances in 2006/07 where a
15
passport was in the custody of the applicant but where a payment (i.e. DZ) and
revenue (RV) entry had not been recorded in PASSAP (herein referred to as instances of
no DZ/RV) as detailed below. These instances were listed in a series of Quattro Pro
spreadsheets that were forwarded to Financial Services Division, Financial Quality
Assurance for further investigation and corrective action.
15
PPCA ensured that the instances did not represent Agratis@ issued passports.
21Fiscal Year 2006/07 - Instances of no DZ/RV
Issuing Office # of Passports Percentage (%)
NPS 158 58%
MP 30 11%
IPS 72 26%
Other 14 5%
Total 274 100%
4.5.3 Financial Services Division, Financial Quality Assurance contacted
representatives from the applicable issuing offices and requested an explanation of the
reported instances of no DZ/RV. The Audit Team=s review of the feedback received from
the issuing offices indicated that either they could not explain why the instance of a no
DZ/RV occurred or attributed its occurrence to non-compliance with work flow procedures
as detailed below.
Fiscal Year 2006/07 - Explanation of Instances of no DZ/RV
Explanation
None Provided Non-Compliance
Issuing Office Operational Procedures Total
NPS 68 90 158
MP 25 5 30
IPS 64 8 72
Other 14 0 14
Total 171 (62%) 103 (38%) 274 (100%)
4.5.4 Financial Services Division, Financial Quality assurance manually posted
entries associated with the sales order cycle in PASSAP in order to recognize the
revenue associated with the 274 passports. It also posted entries to GL 30015 to record
the shortage in cash (i.e. no payment received for the 274 passports issued).
4.5.5 Administrative Services Division also identified 628 instances in 2006/07
where a passport was in the custody of the applicant but where a revenue (RV) entry had
22not been recorded in PASSAP (herein referred to as instances of no RV16). These
instances were listed in a series of Quatro Pro spreadsheets that were forwarded to
Financial Services, Revenues, Accounts Payable and Receivables for further
investigation and corrective action. Discussions with Financial Services Division
indicated that corrective action was taken by means of manually posting entries
associated with the sales order cycle in PASSAP in order to recognize the revenue
associated with the 628 passports. At the time of the audit, the Deputy Director, Financial
Operations and Systems was investigating the reason(s) why the instances of no RV
occurred.
4.5.6 *****
4.5.7 Corporate Services Senior Management are aware that there may be
potential instances of non-compliance with Passport Canada=s refund policy and fee
regulations. Details as to the instances of no DZ/RV and no RV were shared by the
Deputy Director, Financial Operations and Systems with the Director Financial Services
Division. Passport Canada Corporate Services have launched an initiative entitled
AInternal Control Framework@. Objectives of the initiative include revising Passport
Canada policies and procedures (as required) and documenting business processes for
effective staff training. The Internal Control Framework will likely be a step in the right
direction to address instances of no DZ/RV given that Operations Bureau staff attribute
their occurrence, in part, to procedural related issues.
4.5.8 In summary, an effective detective control is in place to identify instances of
no DZ/RV and no RV. These instances have been subject to some degree of
management oversight. Passport Canada Senior Management have launched an
initiative in 2006/07 to improve the degree of staff compliance with the organization=s fee
regulations and policies. This initiative is a positive step.
However, the Audit Team is of the view that greater effort needs to be
invested into determining the specific root cause(s) of the identified instances of no
DZ/RV and no RV. An inadequate explanation was received from issuing offices for 62%
or 171 of the 274 reported instances of no DZ/RV. Follow-up of the 628 reported
instances of no RV is underway to identify the associated cause(s). *****
Recommendations - Director Financial Services Division
4.5.9 Investigate, in consultation with staff from the Operations Bureau, the
reported instances of no DZ/RV and no RV related to the 2006/07 fiscal year
16
Instances of no RV differ from the no DZ/RV scenario in that the client=s payment (i.e. DZ) is
recorded in PASSAP.
23in order to determine with certainty the specific cause(s) for their
occurrence.
4.5.10 Implement remedial action based on the results of 4.5.9, including creating
an automated control within IRIS which would prevent a passport (with the
exception of a gratis passport) from being issued to an applicant without
having previously recorded a service fee and payment.
4.5.11 Until such time the automated control per 4.5.10 is programmed in IRIS,
continue to detect and investigate all reported instances of no DZ/RV and
no RV and implement appropriate remedial action.
Management Action Plan and Time Frame
4.5.9 Operations will monitor, investigate and resolve instances that fees
are not being collected or services are not being selected in IRIS (F12).
Operations will develop and implement procedures for preventing fees
transactions being overridden (in IRIS F12). Financial Services
Division will document all cases that are related to interface technical
problems and have them remedied. Any others will be forwarded to
Operations for their follow up.
4.5.10 Operations will monitor, investigate and resolve instances that fees
are not being collected or services are not being selected in IRIS (F12).
Operations will develop and implement procedures for preventing fees
transactions (IRIS F12) from being overridden. *****
4.5.11 PPCF will formalize procedures to identify and notify Operations of all
cases. Operations will be responsible for formalizing procedures to
identify the reasons (lack of training, lack of IRIS functionality B need
electronic transfer, no money was ever received, money missing, etc).
This information will be used to identify other possible IRIS or
procedural changes
5.0 INTERNAL CONTROL FRAMEWORK PROJECT
5.1.1 Passport Canada Corporate Services launched an Internal Control
Framework (ICF) initiative in 2006/07 in anticipation of the Treasury Board Secretariat=s
(TBS) promulgation of a policy on internal control. The initiative=s objectives are to:
$ Ensure Passport Canada internal controls are in full compliance with the
requirements of the TB policy on internal control by April 1, 2010;
$ Revise Passport Canada policies and procedures, as required;
24$ Document business processes for effective staff training and eliminate loss of
corporate memory; and,
$ Provide effective tools/reference sources to staff.
5.1.2 Several of the Audit Team=s recommendations point to a need to strengthen
Passport Canada (PPTC=s) cash and revenue management internal controls through
documenting business processes, establishing documentation standards, improving
active monitoring practices and following-up noted deficiencies with internal stakeholders.
The thrust of the recommendations are, therefore, very much in line with the objectives of
Passport Canada (PPTC=s) Internal Control Framework initiative. For this reason, the
Audit Team regards the Internal Control Framework initiative as a key means by which
Passport Canada could address the observations raised during the course of the audit.
5.1.3 Financial Services Division has developed an action plan to implement the
ICF initiative over a three year time span (i.e. 2006/07 to 2008/09). The action plan has
been prepared at a summary level, identifying major tasks by fiscal year and providing a
high level consideration of resource requirements. The Audit Team is of the view that a
more detailed action plan is, however, required given the importance of the ICF initiative
both in terms of complying with the Treasury Board Secretariat=s policy requirements and
addressing the observations raised by the audit.
Recommendations - Director, Financial Services Division
5.1.4 Develop a detailed implementation plan for the Internal Control
Framework (ICF) initiative that:
$ Describes the tasks required to be performed;
$ Develops an estimate of the level of effort required to implement each
task;
$ Articulates a resourcing strategy;
$ Assigns the responsibility for completing the defined tasks to specific
staff resources; and,
$ Establishes key milestone dates for monitoring and reporting
purposes.
5.1.5 Submit the Internal Control Framework detailed implementation plan
developed per 5.1.4 to the Director General, Corporate Services for
approval.
5.1.6 Provide periodic reports on the status of the Internal Control
Framework implementation plan to the Director General, Corporate
Services.
25Management Action Plan and Time Frame
5.1.4 Financial Services Division will submit a detailed plan for this fiscal
year and will include the activities cited within this management
response.
5.1.5 See response under 5.1.4
5.1.6 Upon approval, at a minimum, quarterly updates will be submitted to
the Director of Finance.
26Appendix A- Audit Objectives & Scope
Audit Objective (AO) Audit Scope FY
Management Control Framework - Issuing Offices
AO-1.1 Assess the management ‘ Controls in place for the 2006/07
control framework in regards to handling, recording and
the effectiveness, adequacy safeguarding of revenues at
and relevance of the revenue five (5) issuing offices.
policies, procedures, ‘ Authorities, responsibilities and
processes and systems that accountabilities.
have been established by ‘ Adequacy of Information,
Passport Canada. communication and training.
AO-1.2 Assess the compliance with ‘ Receipt, Deposit and Recording 2006/07
Passport Canada policies and of Public Money.
procedures. ‘ Refunds and Remissions.
‘ Petty Cash and Change Funds.
‘ Cash and Revenue
Management.
Deposits and Revenue Controls - PPCF
AO-2 To assess the adequacy of the ‘ Reconciliation of bank deposits 2006/07
bank deposits reconciliation from domestic issuing offices.
process applied by Financial ‘ Exclusion - deposits from
Services, Financial Quality receiving agents and missions.
Assurance. ‘ Exclusion - deposits recorded
in GL 61200 through the RGGL
interface.
AO-3 To assess the adequacy of the ‘ Year-end process for 2006/07
controls exercised by Financial reconciling IRIS and PASSAP
Services to ensure that the revenue data.
revenue associated with the ‘ Monthly process for reviewing
services rendered by Passport and clearing Customer Account
Canada is accurately recorded in open items.
PASSAP. ‘ Periodic process for
investigating passports issued
to an applicant with no
corresponding deposit and
revenue information recorded
in PASSAP.
27You can also read
