Audit of design and operating effectiveness of entity level controls

• Values and Ethics Code and training
• Values and Ethics Working Group and officer
• Conflict of Interest Disclosure Officer
• Procedures for Making Wrongdoing Disclosure standard
• Disclosure Officer responsibility
• Workplace Harassment and Violence Prevention Policy

• Departmental Audit Committee Values and Ethics Code and training
• Commissioners
• Executive Management Committee
• Audit and Evaluation Services

• Chief Audit and Evaluation Executive and Chief Financial Officer are independent and reporting directly to the Chief Commissioner
• Chief Audit and Evaluation Executive, Chief Financial Officer and external auditors have unrestricted access to the Departmental Audit Committee
• Organizational charts are maintained

• Human resources policies and procedures
• Talent management plans
• Learning and development plans
• National Employment Equity, Diversity and Inclusion Committee
• People and succession planning
• Job descriptions and classifications
• Official languages development

• Performance management program
• Awards and recognitions program

• Integrated Risk Management Policy
• Integrated Risk Management Working Group
• Corporate Risk Register

• Integrated Risk Management Policy
• Integrated Risk Management Working Group

• Departmental Audit Committee
• Values and Ethics Code
• Responsibility for managing conflicts of interest
• Procedure for Making Wrongdoing Disclosure
• The Integrated Risk Management Working Group considers fraud risks
• Finance rates fraud risks
• Audit and Evaluation Services considers fraud risks in developing a multi-year risk-based audit plan and while planning each internal audit engagement
• Orientation to the Public Service course
• System of controls over accounting transactions
• External auditors perform testing of controls over financial statements
• The Internal Control Management Framework
• Industry Services maintains a quality management system
• Security clearances
• Senior Disclosure Officer

• Integrated Risk Management Working Group
• Corporate Risk Register
• Cyclical financial statement risk assessment and control monitoring
• External auditors perform testing of controls over financial statements

• Internal Control Management Framework
• Set of financial control policies and procedures
• Service level agreements
• Business continuity planning

• Set of financial control policies and procedures
• Internal Control Management Framework

• Canadian Grain Commission public website and StaffNet include policies and procedures
• Newsletters, town halls, announcements
• Departmental plans and results documents
• Corporate Information Services (Communications, Multimedia and Translations Services)

• Results of internal and external control assessments are timely and effectively communicated to appropriate stakeholders
• Audit results that do not pose issues to the security and privacy are published on the Canadian Grain Commission’s public website

• Control assessment performed by internal and external auditors as well as by other government departments (horizontal audits)

• Results of internal and external control assessments are timely and effectively communicated to appropriate stakeholders
• Audit results that do not pose issues to the security and privacy are published on the Canadian Grain Commission’s public website
• Management action plans are developed and followed up until implemented

The Canadian Grain Commission has established a department-specific Values and Ethics Code titled “Living our Values”. The code has been developed to support the government-wide Values and Ethics Code for the Public Sector under the Public Servant Disclosure Protection Act and the provisions of the Office of Conflict of Interest and Ethics Commissioner. All new employees and contractors acknowledge the Values and Ethics Code.

All new Canadian Grain Commission employees are required to complete the mandatory Orientation to the Public Service course, which contains values and ethics training.

As part of the commitment to ethical values, the Canadian Grain Commission has established responsibility and a process for documenting, managing and resolving conflict of interest disclosures.

The Canadian Grain Commission's Making Wrongdoing Disclosure standard supports the Public Servants Disclosure Protection Act. The Disclosure Officer responsibility was established and delegated to the Chief Audit and Evaluation Executive.

In support of the Canada Labour Code and Occupational Health and Safety Act, the Canadian Grain Commission has established the Policy on Workplace Harassment and Violence Prevention. This policy clearly outlines the roles and responsibilities of all Canadian Grain Commission employees for the prevention, detection and reporting of workplace harassment and violence.

Upon testing a sample of new hires for the initial Values and Ethics Code sign-off, we found that Human Resources records do not contain evidence of the signed Values and Ethics Code for 76% of sampled employees.

There is no requirement for periodic and ongoing values and ethics education after the initial hiring process.

1. We recommend that the Human Resources Director commit to:

1.1 an analysis of the initial Values and Ethics Code signing process and identify actions that will ensure that all new hires sign the Values and Ethics Code on a timely basis

1.2 explore and evaluate options for the periodic and ongoing values and ethics education and incorporate acceptable options into the employees' learning plans

Controlled risk.

In the letter of offer, a standardized paragraph is included, which specifies that adherence to the Values and Ethics Code and forms part of the conditions of employment. The Values and Ethics Officer is to determine if an additional sign-off through the onboarding process is required. If deemed necessary, the business support and pay integration unit will collaborate with regional administrative employees to determine the root cause of why we are not receiving the Values and Ethics Code sign-off promptly and implement an improved procedure by September 30, 2021.

In concert with a review of all Canadian Grain Commission required training and development of our learning strategy, training options for values and ethics is to be further examined. A requirement for periodic values and ethics awareness and/or training for all employees is to be implemented by March 31, 2022. The Values and Ethics Officer will be responsible for the implementation.

2. We recommend considering the Canadian Grain Commission's business resumption status, that the regular Values and Ethics Working Group activities resume and that the Values and Ethics Officer's role and responsibilities are formalized.

Controlled risk.

The Values and Ethics Officer, responsible for implementing this action plan, is currently acting as the Director of Human Resources. The Values and Ethics Officer's portfolio will be temporarily reassigned to a Senior Labour Relations Advisor effective September 2021. The Values and Ethics Committee recommenced meetings in November 2020 with a regular meeting schedule being re-established by October 29, 2021.

The Values and Ethics Officer roles and responsibilities are to be articulated in the terms of reference by October 29, 2021. A 3-year values and ethics action plan for 2021 to 2023 will be prepared and presented to the Chief Operating Officer and Chief Commissioner for approval by October 29, 2021. The Departmental Audit Committee is to be briefed on the values and ethics action plan in November 2021.

Independent oversight responsibility is exercised by the Departmental Audit Committee, comprised of 3 members acting exclusively in an advisory capacity to the Chief Commissioner. This oversight includes challenging and providing advice regarding the sufficiency and quality of the assurance provided on the adequacy and functioning of the Canadian Grain Commission financial statement and internal controls.

The Canadian Grain Commission is led by a team of 3 Commissioners appointed by the Governor in Council per section 3 of the Canada Grain Act. The Canadian Grain Commission's responsibility and authority are formalized in the terms of reference.

The Executive Management Committee was established to assist the Chief Operating Officer in providing leadership and executing strategies related to the day-to-day management of the organization.

3. We recommended that the Chief Operating Officer ensure that the Executive Management Committee terms of reference are updated and presented to the Chief Commissioner for feedback and approval.

Well controlled risk.

The Chief Operating Officer is responsible for the updating of the Executive Management Committee terms of reference in consultation with the Executive Management Committee and the Commission. The objective is to ensure that roles and responsibilities between the Executive Management Committee and the Commission are clearly articulated in their respective terms of reference.

Final sign off of the Executive Management Committee terms of reference will be at the Chief Commissioner authority level by December 31, 2021.

The Canadian Grain Commission decided to support and maintain its own internal audit function. The audit function's purpose, authority and responsibilities are outlined in the Audit and Evaluation Services Charter, which is reviewed by the Departmental Audit Committee and approved by the Chief Commissioner annually. The Charter grants the audit team unrestricted access to all activities, operations, records, databases and workplaces, and the authority to obtain information and explanations from any employee and contractor, as necessary, to provide objective assurance and consulting services to the Canadian Grain Commission.

To support the departmental structure, authority and responsibility, the Canadian Grain Commission maintains up-to-date organizational charts that delineate responsibilities and reporting lines within the Canadian Grain Commission. The Classification Officer is reviewing all new positions to ensure the appropriate corporate hierarchy.

An independent and objective reporting structure has been ensured by making the Chief Financial Officer and the Chief Audit and Evaluation Executive report directly to the Chief Commissioner. In addition, the Chief Financial Officer, the Chief Audit and Evaluation Executive and external auditors have direct and unrestricted access to the Departmental Audit Committee including in-camera discussions.

No recommendations.

Well controlled risk.

• talent management plans
• learning and development plans
• the National Employment Equity, Diversity and Inclusion Committee
• people and succession planning: job descriptions and classifications

The audit noted that key National Employment Equity, Diversity and Inclusion Committee information, including the terms of reference, committee members, and diversity and inclusion plans, have not been updated since 2015.

There is no evidence of the integration between the divisional and executive people and succession planning.

4. We recommend that the Humans Resources Director ensure that:

4.1 the National Employment Equity, Diversity and Inclusion Committee terms of reference, member composition, new diversity and inclusion plan and other relevant information are updated to inform the Canadian Grain Commission staff on new equity and diversity initiatives

4.2 a process is developed to ensure periodic integrated divisional people planning is conducted

Controlled risk.

Membership listing for National Employment Equity, Diversity and Inclusion Committee is under review and solicitation for new members will take place as required. National Employment Equity, Diversity and Inclusion Committee co-chairs are working with the Communications unit to update the committee's section on the Canadian Grain Commission’s internal website, StaffNet, by September 30, 2021.

Discussions at the executive committee meetings will take place at least bi-annually to discuss cross-divisional planning and corporate initiatives. The Human Resources Director accepts responsibly for implementing these actions by December 31, 2021.

The Canadian Grain Commission has established a robust performance management program that includes annual and mid-year performance appraisals for all employees. The review process allows managers and employees to communicate and provide feedback through the government-wide Public Service Performance Management (PSPM) platform. Responsibility for the performance reviews is built into each director’s performance objectives. This resulted in the Canadian Grain Commission's average performance appraisal completion rate of over 90%.

The awards and recognition program has been designed to reward employees for their achievements and contributions that reflect the values of the Canadian Grain Commission.

No recommendations.

Well controlled risk.

The Canadian Grain Commission has the Integrated Risk Management Policy, which aims to enforce a culture of proactive risk management at all levels of the Canadian Grain Commission. The policy defines the risk management governance structure and roles and responsibilities to ensure a seamless incorporation of integrated risk management into all operational levels of the Canadian Grain Commission.

5. The Director, Innovation and Strategy, should review and update the Integrated Risk Management Policy to reflect the most current organizational environment and respective roles and responsibilities.

Controlled risk.

The organization identifies risks to the achievement of its objectives across the entity and analyses risks as a basis for determining how the risks should be managed.

The organization identifies and assesses changes that could significantly impact the system of internal control.

The audit found that the Canadian Grain Commission's current risk identification and assessment process is focused exclusively on high-level strategic risks and not aligned with the organization's risk information at operational levels.

Without the bottom-up integration, there is a potential for the risk information to not be consistently analysed and escalated to appropriate senior decision-makers to ensure timely mitigating actions. This coordination will also enable sharing of risk information across the organization to ensure consistent approaches for similar risk-based decisions and avoid overlapping or duplicating efforts.

6. We recommend that the Executive Management Committee define a process and responsibility for coordinating the operational level risk assessment and integrate it with the strategic risk assessment process across the Canadian Grain Commission.

Moderate issues.

The Director, Innovation and Strategy, in consultation with the Executive Management Committee, will define a process for operational level risk assessment and how it will be integrated with the strategic risk assessment process by March 31, 2022.

Responsibility for coordinating the process will lie with the Integrated Risk Management Working Group, while tracking and mitigating operational level risks will continue to be the responsibility of individual business areas.

The audit identified elements and players contributing, directly or indirectly, to the fraud risk framework at the Canadian Grain Commission. These elements and players are grouped by the 4 key fraud framework components as follows:

Governance: The Canadian Grain Commission has an oversight body, the Departmental Audit Committee, and the Values and Ethics Code. There is a responsibility for managing conflicts of interest disclosures. Under the Procedures for Making Wrongdoing Disclosure, employees have the opportunity to raise concerns regarding potential fraud and are guaranteed protection under the Public Servant Disclosure Protection Act.

Fraud risk assessment: The Integrated Risk Management Group considers fraud risks in identifying and assessing risks to the strategic objectives. Finance rates fraud risks during the development of a systematic financial statement monitoring plan. Audit and Evaluation Services considers fraud risks in developing a multi-year risk-based audit plan and while planning each internal audit engagement.

Operational controls: All new employees must take the mandatory Orientation to the Public Service course offered through the Canada School of Public Service, which includes training on anti-fraud controls and fraud scenarios. Under the Chief Financial Officer's responsibility, the Finance team maintains a system of controls over accounting transactions and financial statements that directly or indirectly prevent fraudulent transactions. Annually, external auditors perform testing of controls over financial statements, including analysing data to identify possible fraudulent transactions. Also, internal controls are assessed on a cyclical basis under the Internal Control Management Framework. To prevent forgery of official grain documents, Industry Services maintains a robust quality management system. All Canadian Grain Commission employees are subject to background and security clearances and are held accountable for their conduct through annual and mid-year performance appraisals.

Investigation and management of fraud allegations: The Canadian Grain Commission has a Senior Officer for Disclosure, who is a certified fraud examiner with expertise in investigating fraud allegations. This could help determine the path forward if an allegation of fraud was to arise.

Governance: While there are several governing controls in place, there is no established policy and overall responsibility for the fraud framework. Together, these 2 controls would demonstrate management's position on fraud tolerance and commitment to enforcing the anti-fraud controls and mechanisms.

Fraud risk assessment: This audit found that there is currently no process to identify, document and assess fraud risks across the Canadian Grain Commission. Without a formal assessment of fraud risk, including analysis and mitigation planning, there may be an increased risk of fraudulent activities.

Operational controls: While there is a fraud component in the mandatory training taken by all new employees, there is no requirement for periodic targeted fraud training. The absence of systematic fraud training and awareness might result in employees not identifying and reporting potentially fraudulent activities.

7. We recommend that the Executive Management Committee assigns responsibility for maintaining the fraud risk framework and develops a plan to address those components of the Canadian Grain Commission's fraud management framework that require further strengthening. Specifically, the plan must consider a fraud policy or an anti-fraud statement, periodic fraud training and awareness and a systematic fraud risk identification and documentation process.

Controlled risk.

The Chief Operating Officer, in consultation with the Executive Management Committee, will establish operational leads to ensure that an anti-fraud risk statement is sent to Canadian Grain Commission employees to enhance anti-fraud awareness and determine what organizational training may be required to supplement this anti-fraud statement. This will be done by December 31, 2021.

The Chief Operating Officer will ensure that the Director, Innovation and Strategy integrates an anti-fraud component into the annual strategic risk assessment process so that potential fraud risk is identified and documented. This will be done by September 30, 2022.

Responsibility for coordinating the process will lie with the Integrated Risk Management Working Group, while tracking and mitigating operational anti-fraud risks will continue to be the responsibility of individual business areas.

Principle 10:
The organization selects and develops control activities that contribute to the mitigation of risks to the achievement of objectives to acceptable levels.

Principle 12:
The organization deploys control activities through policies that establish what is expected and procedures that put policies into action.

To ensure the appropriateness of internal controls management, the Canadian Grain Commission has developed an Internal Control Management Framework and a periodic risk-based financial control monitoring plan. The framework includes the process to identify, document, evaluate and test key controls including testing of information technology general controls. The framework provides a mechanism to report deficiencies to business process owners, the Departmental Audit Committee and senior management.

The Canadian Grain Commission's Finance team developed a set of control-specific policies and procedures. Some of these governing documents are posted on the Canadian Grain Commission’s internal website, StaffNet, and a complete set of policies and procedures are available to all Finance employees. Finance policies are periodically reviewed and updated to ensure compliance and consistency with Treasury Board Secretariat policies, procedures and directives. There is an established responsibility to continuously monitor changes to Treasury Board Secretariat policies and update the Canadian Grain Commission's policies accordingly.

Part of the Canadian Grain Commission's control environment includes relying on third-party service providers, primarily other government agencies such as Agriculture and Agri-Food Canada and the Treasury Board Secretariat. The third-party providers maintain their own systems of internal controls that directly affect the Canadian Grain Commission's financial information. Under the Financial Administration Act, the government partners' accountabilities for maintaining and assessing their system of internal controls have been formally defined through service level agreements. Results of the third-party providers' internal control assessments and related action plans have been reported to the partner organizations, including the Canadian Grain Commission, to mitigate gaps and deficiencies, if applicable.

The 2017 entity level control audit found that the Canadian Grain Commission's business continuity planning was not finalized and recommended that it be addressed accordingly.

8. We recommend that the Chief Financial Officer ensures that the business continuity planning is finalized. As per the Treasury Board Secretariat Policy on Government Security, the Operational Security Standard – Business Continuity Planning Program, business continuity planning must consider essential components such as governance, business impact analysis and preparedness activities.

Moderate issues.

The Chief Financial Officer will seek approval from the Executive Management Committee to resume business continuity planning in the first quarter of the 2021-2022 fiscal year. The critical functions and business impact analysis will also be reviewed and renewed in 2021-2022.

In the 2022-2023 fiscal year, the draft business continuity plan will be updated based on lessons learned from the pandemic and submitted to the Executive Management Committee for approval. Training and testing will also be completed in the 2022-2023 fiscal year. The Chief Financial Officer is responsible for this management action plan.

Principle 14:
The organization internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of internal control.

Principle 15:
The organization communicates with external parties regarding matters affecting the functioning of internal control.

The Canadian Grain Commission's mandate, vision, mission and values are communicated to the public through the Canadian Grain Commission's website and include all financial and non-financial reporting documents related to internal controls.

The Canadian Grain Commission effectively communicates the results of internal control audits and assessments to relevant stakeholders. For example, the results of internal control assessments are reported through the departmental performance reports and the annex to the Statement of Management Responsibility. Audit and Evaluation Services' audit reports are published on the Canadian Grain Commission's public website. The Departmental Audit Committee is informed in a timely manner of the results of the internal control assessments performed by the Audit and Evaluation Services and external auditors.

To ensure the quality of information communicated to the public, the Canadian Grain Commission has established the Corporate Information Services team that comprises Communications, Multimedia and Translation Services. The team produces internal and external communications such as print publications, web content, presentations and social media content. Several information management and communications policies and procedures were developed and posted on the Canadian Grain Commission’s internal website called StaffNet.

The Canadian Grain Commission leadership has been continuously communicating with the employees on various organizational topics, including, but not limited to, the departmental plans and departmental results, new initiatives, and changes to the Government of Canada policies. Leadership communicates through town hall meetings, all staff messages, internal website updates and ongoing email notifications.

In 2020, the Canadian Grain Commission Open Government Working Group established the Open Data Release Procedure to support the Government of Canada's Directive on Open Government. This procedure aims to uphold transparency, accountability and citizen engagement in government decisions and processes. This procedure guides Canadian Grain Commission employees to handle requests for data and information and determines what requested information can or cannot be shared.

No recommendations.

Well controlled risk.

Principle 16:
The organization selects, develops and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning.

Principle 17:
The organization evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action.

The Canadian Grain Commission's internal controls are assessed by various means, including audits by the Office of Audit General and the Office of Comptroller General, annual financial statement audits conducted by external auditors, audits by the Audit and Evaluation Services, and others. As part of the internal control monitoring approach, results of the Canadian Grain Commission's internal control assessments are communicated to stakeholders responsible for taking corrective actions to develop management action plans to address identified control gaps. Internal control assessments and audit results are shared with the Executive Management Committee and the Departmental Audit Committee, whose members provide comments on recommendations and resulting action plans.

Audit recommendations are followed up twice a year by Audit and Evaluation Services to ensure planned actions and timelines are resolved. Finance is responsible for following up on the external auditors' recommendations and other internal controls assessments for financial reporting. The results of all follow-ups are presented to the Departmental Audit Committee.

No recommendations.

Well controlled risk.