Audit of the Management Control Framework of the Grants and Contributions Process at Health Canada

February 7, 2003

Report Summary

Objectives

To assess the adequacy of the Management Control Framework (MCF) in place within Health Canada (HC) for the administration of grants and contributions. Specifically, the audit assessed the extent to which the MCF is designed to ensure that:

1. grants and contributions (G&C) programs adhere to applicable legislation, policies and procedures;
2. G&C program objectives are met;
3. G&C programs are appropriately planned, implemented, and monitored;
4. timely and useful information is available used for decision making.

The audit also assessed the extent of progress with respect to key commitments made to the Office of the Auditor General (OAG) concerning the grants and contributions process.

Scope

The audit focussed on the management controls, from a department-wide perspective, that are in place to administer programs which use G&Cs as a means of delivery. Such controls involve those policies, procedures, processes, structures, systems, and practices that management has at its disposal to help ensure the achievement of objectives. Statutory transfers (i.e., ongoing transfers required by existing legislation) were excluded from the scope.

With respect to the follow-up on recent OAG commitments, Chapter 13 of the 1997 OAG Report - First Nations Health and subsequent follow-up dated 2000 (Chapter 15) were excluded from the audit scope due to the ongoing Public Accounts Committee (PAC) focus on this subject and the requirement to report on progress made to Parliament through the annual Departmental Performance Report (DPR).

Background

Over the years and increasingly so, grants and contributions programs managed by the Federal Government have received significant attention from the media, Parliament, Central Agencies, and the general public. For Health Canada, the substantial amount of funds administered through G&Cs ($1.22 B) and the direct impact such programs have on the health of Canadians will ensure such scrutiny will continue.

In April 2002, as a result of department-wide consultation with senior management, an audit of the management control framework for G&Cs was approved. This report presents the findings, conclusions and recommendations resulting from the audit, which was initiated in December 2002.

Profile of Grants and Contributions Administration at Health Canada

Health Canada is comprised of six program branches that use grants and/or contributions as a means of delivering health-related programs to Canadians, as well as a corporate services branch that is responsible for maintaining a sound management framework departmentally. They are:

• Health Policy and Communication Branch (HPCB)
• Population and Public Health Branch (PPHB)
• Health Products and Food Branch (HPFB)
• Healthy Environments and Consumer Safety Branch (HECSB)
• First Nations and Inuit Health Branch (FNIHB)
• Information, Analysis and Connectivity Branch (IACB)
• Corporate Services Branch (CSB)

Although numbers vary due to the introduction and termination of various G&C programs, approximately 53 programs are administered by the department, involving approximately $1 Billion. The size, nature, and history of the various programs vary considerably, from direct delivery of health services to First Nations and Inuit (FNI) communities, to funding research and development activity to improve the health infrastructure. However, all are subject to a common policy and legal framework that includes: the Financial Administration Act (FAA); Privacy and Access to Information (ATI) legislation; various Treasury Board (TB) policies and standards, including the Transfer Payment Policy (TPP) and the associated Treasury Board Secretariat (TBS) Guide on Grants, Contributions and Other Transfer Payments.

Issues Examined

During the Preliminary Survey Phase, a department-wide risk assessment was conducted relating to the management of G&C programs. As a result of the risk assessment, seven audit issues were carried forward to the Detailed Examination Phase: availability of information for evaluating programs; skills and knowledge of staff; legal risks; recipient performance against agreement; departmental compliance to legal/policy framework; impediments to program/project delivery; and effectiveness of G&C information technology (IT) systems.

Work Performed and Methodology

The Preliminary Survey Phase involved the following activities: documentation review; a series of control/risk self-assessment (CRSA) workshops; validation of workshop results; and additional audit testing. A total of eight CRSA workshops were conducted across the department, involving approximately 85 individuals from the various functions that influence the management of G&C programs. The risk assessment included assessments of "gross" risk (i.e., risk before mitigation is considered) as well as "net" or residual risk. These assessments, while useful for management decision making, were used for the purposes of this audit as a means of identifying audit issues to be carried forward to the Detailed Examination Phase and future audit engagements.

The Detailed Examination Phase was conducted between March 20 and May 5th, 2003. This phase focused on the audit issues listed above and involved a series of interviews with management and staff from program and functional areas, documentation review, analysis of information gathered, and direct observation of management controls. Audit criteria used to assess each audit issue were derived from two models of management control: the Deloitte and Touche management model used as the basis for the 2001 Management Framework Study for G&Cs commissioned by Corporate Services Branch (CSB), and a model established for audits of management control frameworks developed by Public Works and Government Services Canada (PWGSC) in 2002.

Due to the significant usage of grants and contributions within Health Canada and the size and complexity of the supporting infrastructure, the audit was focussed on the adequacy of the MCF design, as opposed to the extent to which all management controls were working as intended. Controls of higher significance will be the subject of further audit by the Audit and Accountability Bureau (AAB) as per the risk based audit planning process.

Key Findings

With respect to the adequacy of the MCF design, the following control elements were found to be lacking or require improvement:

• central tracking of Results-based Management Accountability Frameworks (RMAFs) and evaluation progress, for programs that have not identified a need for Departmental Program Evaluation Division (DPED) involvement;
• monitoring the use of TB authorized funding for performance measurement and evaluation;
• standard departmental guidelines regarding Legal Services consultation (including contemplated changes to standard agreements), Section 34 procedures, recipient management issues, and recipient administrative costs.
• a specific departmental vision and approach for an on-going G&C training program;
• resources allocated to the Centre of Expertise for G&Cs (COE) and Legal Services;
• timeliness of funding allocations and signing of contribution agreements
• identification and coordination of existing and planned program initiatives dealing with informing recipients of their accountability requirements.

AAB also conducted a follow-up of selected recommendations made by the OAG in its 2001 Report - A Pro-active Approach to Good Health. It was found that the Population and Public Health Branch (PPHB) is making steady progress and that outstanding action items relate to challenging and complex issues which would require a long-term and sustained approach in order to achieve success.

Overall Conclusion

The audit team applied the internal auditing standards for the Government of Canada in conducting this engagement. With a high level of assurance, the MCF in place at Health Canada regarding the administration of G&Cs was found to be adequately designed in most respects. Since March 2001, when the Management Framework Study for G&Cs was completed, the department has made significant progress in strengthening the MCF design. In the context of ensuring the MCF for G&Cs adequately supports departmental adherence to policy/legislation, the fulfillment of program objectives, due diligence requirements, and effective decision-making, the above mentioned findings require management attention. Specifically, the audit findings point to control gaps that, if left unchecked, increases the risk that G&C objectives will not be attained.

A number of recommendations are presented in this report focussing on the standardization of certain departmental controls. During the design of such standards, consultation with program staff is essential.

With respect to the AAB follow-up of key OAG commitments relating to G&Cs, while substantial progress has been achieved, sustained effort is needed with regard to priority-setting; evidence-based decision making; program evaluation and in ensuring information contained in the departmental tracking database is accurate and up-to-date.

Recommendations

It is recommended that the ADM, CSB:

• via G&C Steering Committee and in consultation with DPED, identify standard information requirements regarding the status of RMAF and evaluation developments, and initiate a process to gather such information from all program branches and regions where such information is not already available to DPED.
• re-visit the current process involving Legal Services with a view to providing standard guidance to program staff and, if necessary, revisions to the routing process.
• conduct a follow-up resourcing study for G&C support. At minimum, the study should re-examine the allocation of resources devoted to the Centre of Expertise and Legal Services, taking into consideration emerging requirements stemming from a defined vision for an on-going G&C training program, authorities renewal, and actions recommended as part of this audit.
• establish standard guidelines relating to recipient management, Section 34 approval (including Consolidated Agreements), and recipient administration costs.
• review the departmental planning and funding allocation process relating to G&Cs, as called for in the Departmental Action Plan for G&Cs.
• ensure the soon-to-be released G&C Portal is populated with best practices and tools produced by the various program and administrative branches, including those that pertain to informing recipients about Health Canada requirements and programs.

It is recommended that the ADM, HPCB:

• establish an Audit and Evaluation/Review Committee, or equivalent, as per the Departmental Internal Audit Policy.