Final Report - Audit of Procurement and Contracting - March 2015

Table of Contents

• Executive summary
• A - Introduction
  1. Background
  2. Audit objective
  3. Audit scope
  4. Audit approach
  5. Statement of conformance
• B - Findings, recommendations and management responses
  1. Governance
     • 1.1 Governance structure
     • 1.2 Authority, roles and responsibilities
  2. Risk management
     • 2.1 Management of procurement and contracting risks
  3. Internal controls
     • 3.1 Guidance and tools
     • 3.2 Procurement and contracting compliance
     • 3.3 Monitoring and reporting activities
     • 3.4 Performance measurement framework
• C - Conclusion
• Appendix A - Specific lines of enquiry and criteria
• Appendix B - Scorecard
• Appendix C - Procurement and contracting governance
• Appendix D - Process flow of procurement transactions centrally managed by the Materiel and Assets Management Division
• Appendix E - Summary of contracts processed by type of goods and services

Executive summary

Contracting is an important vehicle in the delivery of organizational programs and services. In calendar year 2013, the contracting activities at Health Canada (the Department) and the Public Health Agency of Canada (the Agency) were approximately $189 million and $60 million respectively, with about 80% of the contractual arrangements for goods and services being internally processed and awarded.

A sound management control framework for procurement and contracting is essential to ensure that contracting in the organization is carried out in compliance with government contracting policies and regulations. Further, a solid framework ensures that management has sufficient information when approving contact proposals to be able to demonstrate best value, competition, fairness and transparency in the procurement process.

The objective of the audit was to assess the adequacy of the management control framework that supports the procurement and contracting practices at the Department and the Agency. Specifically, it determined whether procurement is being managed in an effective and efficient manner and in compliance with relevant policies and regulations. The audit focused on the management control framework in place for procurement and contracting for the period from January 1 to December 31, 2013.

The audit was conducted in accordance with the Internal Auditing Standards for the Government of Canada and the International Standards for the Professional Practice of Internal Audit. Sufficient and appropriate procedures were performed and evidence gathered to support the accuracy of the audit conclusion.

The audit concluded that the management control framework in place to support the procurement and contracting practices in the Department and the Agency needs moderate improvement.

The audit found that a governance framework was in place to provide oversight of the Department's and Agency's procurement plans and contracting practices and activities, as well as the high-risk and/or complex procurement of goods and services. Authority, roles and responsibilities for key positions related to procurement and contracting were documented and communicated. However, the Shared Services Portfolio Contract Review Committee's terms of reference should be revised to align with the Contracting Guide and to establish the accountability and reporting relationship with the Partnership Executive Committee (PEC). Overall, mechanisms were in place to identify and manage risks related to non-compliant procurement and contracting practices.

Managers with delegated procurement authorities and procurement specialists were provided with the appropriate guidance, tools and training needed to foster compliance with relevant government contracting policies and regulations.

Enhancement to the internal controls for procurement and contracting was observed through the implementation of the Procure-to-Pay (P2P) platform and the review and challenge function performed by procurement specialists. However, improvements are required to ensure that all required documents are maintained in the central repository (SAP) and that there is an audit trail in the contract approval process, so as to demonstrate best value, competition, fairness and transparency.

The existing monitoring and reporting regime should be endorsed by PEC to ensure that it appropriately reflects the risk management and operational needs of each organization. The draft procurement performance measurement framework used to evaluate the effectiveness and efficiency of procurement and contracting practices needs to be updated to ensure that there is a comprehensive assessment of compliance and procurement service delivery at an organizational level and that it identifies areas for risk mitigation and operational enhancement.

Management agrees with the four recommendations and has provided an action plan to further strengthen the management control framework supporting procurement and contracting at the Department and the Agency.

A - Introduction

1. Background

Public Works and Government Services Canada (PWGSC) acts as the procurement authority for the Government of Canada and is responsible for improving the overall efficiency of the contracting process, as well as providing advice and contracting services. It generally administers the award of complex, high-value contracts, while departments and agencies administer routine, low-value contracts. Some organizations assign contracting responsibilities to procurement specialists, who enter into contracts based on the commitment authority of a delegated manager. Government officials are expected to exercise contracting authority so that the responsible deputy head is in compliance with the Financial Administration Act, the Government Contracts Regulations and Treasury Board (TB) Contracting Policy, directives and guidelines.

As defined in the Government Contracts Regulations and in keeping with the contract limits delegated by PWGSC, the procurement authorities of Health Canada (the Department) and the Public Health Agency of Canada (the Agency) are set out in Table 1.

In addition, the Minister of Health may enter into a contract of up to $2 million for the provision of health care services to First Nations and Inuit, to a maximum amended amount of $1 million.

Government procurement and contracting is governed by a complex legislative and policy framework. TB Contracting Policy supports the objective of acquiring goods and services and carrying out construction in a manner that enhances access, competition and fairness, and results in the best value or, if appropriate, the optimal balance of overall benefits to the Crown and the Canadian people.

In February 2013, a new service delivery model for contracting and procurement was introduced as part of the Shared Services Portfolio objective of harmonizing procurement operations into a single, national, standardized approach to procurement and contracting. Procurement and contracting activities at the Department and the Agency are now managed centrally by the Materiel and Assets Management Division (MAMD), under the Shared Services Partnership (SSP), with regional clients served out of two hubs. The first hub is based in Winnipeg to serve clients in Manitoba and to the west, and the second hub is based in the National Capital Region (NCR), serving clients in Ontario and to the east. MAMD plays an integral role in the monitoring, control and reporting of procurement and contracting processes and activities. Refer to Appendix D for the process flow of procurement transactions centrally managed by MAMD.

At the beginning of the audit, two program areas managed select procurements and contracts internally within their branches: the Contracting Management Unit within the Internal Client Services and Transition Directorate (ICST) in the First Nations and Inuit Health Branch (FNIHB) at the Department (for non-IT NCR procurements, which represent about 10% of the branch's total); and the Winnipeg Common Services Centre (WCSC) within the Infectious Disease Prevention and Control Branch (IDPCB) at the Agency (for goods and temporary help services below certain thresholds for the National Microbiology Laboratory). However, in August 2014, the Chief Financial Officer Branch (CFOB) and FNIHB reached an agreement for the transfer of the limited FNIHB contracting capacity to CFOB-MAMD, as a mean of supporting the consolidated model.

The Procure-to-Pay (P2P) platform within the departmental financial management system was simultaneously rolled out to all employees in the two organizations, to provide an end-to-end solution for the electronic approvals of procurement transactions and invoices

2. Audit objective

The objective of the audit was to assess the adequacy of the management control framework that supports the procurement and contracting practices at the Department and the Agency. Specifically, it determined whether procurement is being managed in an effective and efficient manner and in compliance with the relevant policies and regulations.

3. Audit scope

The audit focused on the management control framework in place for procurement and contracting at the Department and the Agency for the period from January 1 to December 31, 2013. Full implementation of the transformation agenda for procurement and contracting was to be completed by March 31, 2014. The audit examined key activities and processes, including the following.

• A strategic approach to procurement is used, which promotes fairness, competition, openness and transparency.
• Organizational procurement plans are established, based on operational requirements and priorities.
• The new Procurement Service Delivery Model has been implemented.
• P2P technology key controls are operating as intended.
• Sufficient unencumbered funds, the appropriate contracting vehicle and the required level of approvals are obtained prior to entering into a contract (or an amendment).
• The challenge function for contractual proposals uses a risk-based approach.
• Appropriate documentation is retained to support contractual arrangements.
• Analysis and management reporting of contracting activity are carried out.
• A risk-based approach is taken to procurement.
• Non-compliance with relevant government-wide contracting policies and regulations is monitored.

The audit also included a review of the contracting and procurement practices within FNIHB-ICST at Health Canada and IDPCB-WCSC at the Public Health Agency of Canada. Each provides procurement and contracting functional support for select goods and services. MAMD centrally manages all other procurement and contracting activities for both organizations.

The audit excluded the contract management process (Financial Administration Act Section 34 approval), since this area is examined as part of the annual audit of key financial controls.

4. Audit approach

The audit methodology included a review of the governance and relevant frameworks, organizational policies, directives and guidelines; the testing of transactions; analysis and inquiry; and examination of evidence supporting governance, risk management and internal controls. The audit also comprised interviews and walkthroughs with relevant personnel, to support that the system controls in place are operating as intended.

The audit criteria outlined in Appendix A were developed using the Office of the Comptroller General, Internal Audit Sector's Audit Criteria Related to the Management Accountability Framework: A Tool for Internal Auditors and the TB Contracting Policy and Guide for Managers and Internal Audit: Monitoring Procurement and Contracting.

5. Statement of conformance

In the professional judgment of the Chief Audit Executive, sufficient and appropriate procedures were performed and evidence gathered to support the accuracy of the audit conclusion. The audit findings and conclusion are based on a comparison of the conditions that existed as of the date of the audit, against established criteria that were agreed upon with management. Further, the evidence was gathered in accordance with the Internal Auditing Standards for the Government of Canada and the International Standards for the Professional Practice of Internal Auditing. The audit conforms to the Internal Auditing Standards for the Government of Canada, as supported by the results of the quality assurance and improvement program.

B - Findings, recommendations and management responses

1. Governance

1.1 Governance structure

Audit criterion: A governance framework is in place to provide oversight of the Department's and the Agency's procurement plan and contracting practices and activities, as well as the high-risk and/or complex procurement of goods and services.

Based on the Treasury Board (TB) Policy on Financial Management Governance, Article 5.1.5, "Establishing a sound financial management governance structure [...] fosters prudent stewardship of public resources in the delivery of the mandate of the organization."

Health Canada (the Department) and the Public Health Agency of Canada (the Agency) implemented a joint governance model designed to coordinate activities in support of planning and priorities, while complementing their existing executive committee structures. Central to this structure is the Partnership Executive Committee (PEC), which is responsible for direction-setting and oversight of items pertaining to the Shared Services Partnership (SSP), including procurement and contracting.

The PEC Financial Operations Co-management Table supports PEC by being called upon on an ad-hoc basis to discuss items such as accounting operations and procurement as it pertains to the SSP. The Co-management Table is co-chaired by the Chief Financial Officers of the Department and the Agency and is expected to consider financial operational activities that are horizontal in nature, such as common policy instruments, procurement service standards and performance metrics. The Co-Management Table serves as a joint forum to guide the current and future operations and priorities of Materiel and Assets Management Division (MAMD), as well as providing an important validation function for issues being referred to and by PEC. As appropriate, these items would also be tabled at the Department's Executive Subcommittee on Planning and Accountability (EC-PAC) and the Agency's Tier I - Executive Committee on Management and Operations or its Tier II - Science, Policy and Management Subcommittee. While draft terms of reference for the Co-Management Table were developed on January 14, 2014, management indicated that to date, only informal meetings have been held and as such, agendas, meeting minutes or records of decisions have not been maintained.

A two-tier governance framework for procurement and contracting was established to provide organizational oversight for the Department and the Agency. The governance framework includes the following: Tier I - four Contract and Review Committees (CRC), each chaired by a procurement specialist manager; and Tier II - Shared Services Portfolio Contract Review Committee (SSP-CRC), co-chaired by the Chief Financial Officers of the two organizations.  The inaugural meeting of the SSP-CRC took place in late March 2014. An overview of procurement and contracting governance for calendar year 2013 is presented in Appendix C.

There are four CRC (Tier I committees), one each for the regulatory programs, program branches, internal services organizations and the regions. The CRC structure is embedded in MAMD and supports the SSP-CRC. The CRC is responsible for ensuring compliance with contracting policies, guidelines and protocols governing the way in which the Government of Canada is to acquire goods and services.

The March 25, 2014 Contracting Guide for Cost Centre Managers and Cost Centre Administrators states that the SSP-CRC (Tier II committee) has a mandate to review and recommend for approval any contract that is particularly complex or deviates from policies and regulations; to consider trend analyses prepared by CRC and MAMD; to recommend remedial measures for non-compliant behaviours and contract disputes; and to review any contract issues or concerns raised by the Director of MAMD. The audit noted that the roles and responsibilities of the SSP-CRC set out in the June 23, 2014 terms of reference are not aligned with the Contracting Guide. Moreover, the terms of reference do not establish the accountability and reporting relationship with PEC.

At the time of the audit, two program areas managed select procurements and contracts internally within their branches: the Contracting Management Unit within the Internal Client Services and Transition Directorate (ICST) in the First Nations and Inuit Health Branch (FNIHB) at the Department (for non-IT NCR procurements, which represent about 10% of the branch's total); and the Winnipeg Common Services Centre (WCSC) within the Infectious Disease Prevention and Control Branch (IDPCB) at the Agency (for goods and temporary help services below certain thresholds for the National Microbiology Laboratory). These two functional groups relied on their respective senior management for oversight over internally processed procurements and contracts. This is discussed in Section 1.2.

However, in August 2014, the Chief Financial Officer Branch (CFOB) and FNIHB reached an agreement for the transfer of the limited FNIHB contracting capacity to CFOB-MAMD, as a means of supporting the consolidated model.

In conclusion, a governance framework for procurement and contracting has been established to provide oversight of the Department's and Agency's procurement plans and contracting practices and activities, as well as the high-risk and/or complex procurement of goods and services.  The SSP-CRC terms of reference are not aligned with the Contracting Guide and do not establish the accountability and reporting relationship with PEC.

Recommendation 1

It is recommended that the Chief Financial Officers of Health Canada and the Public Health Agency of Canada revise the terms of reference of the Shared Services Portfolio Contract Review Committee to align with the Contracting Guide and to establish the accountability and reporting relationship to the Partnership Executive Committee.

Management response

1.2 Authority, roles and responsibilities

Audit criterion: Authority, roles and responsibilities for procurement and contracting are clearly documented and communicated.

The roles and responsibilities for procurement and contracting need to be clarified in the organization, so that senior managers can duly exercise stewardship, management and oversight of public resources in the delivery of departmental and agency programs and services.

Authority

Based on the Department's and the Agency's Delegation of Financial Signing Authorities Matrix, dated October 2013 and December 2013 respectively, the Financial Administration Act (FAA) Section 41 authorities (contracting authority) reside with the responsibility centre's manager and procurement officer. In certifying FAA Section 41, the delegated authority confirms the terms and conditions of the contract, as well as their authority to sign the contract for the provision of goods and services. The contracting authorities are also responsible for being aware of statutes, regulations, agreements, policies, directives, procedures and guidelines that impact procurement activities, to ensure transparency, fairness and value for the Crown.

Effective April 1, 2014, FAA Section 41 is exercised by procurement officers for all contracts except for low-dollar transactions of up to $10,000 (PS2 short form contracts, 942 call-ups, purchase orders and local purchase orders for services), Temporary Help Services standing offers of up to $400,000 and memorandums of agreement and interdepartmental letters of agreement. A sub-matrix has been developed to include the different levels in the Purchasing Group classification, from PG-01 to PG-06, as well as the Director of MAMD. The delegation of financial limits is the same for both organizations.

At the time of the audit, while the procurement specialists are generally centralized within MAMD, two branches employed procurement specialists to process contractual proposals: FNIHB-ICST at the Department and IDPCB-WCSC at the Agency. As indicated earlier, the procurement specialists under FNIHB were transferred to MAMD in August 2014.

Overall, approximately 80% of the value of all procurements for both organizations (or 98% by volume) is internally processed. A breakdown of the contracts processed by Public Works and Government Services Canada (PWGSC), MAMD, FNIHB-ICST and IDPCB-WCSC for calendar year 2013 is set out in Table 2.

As part of the Economic Action Plan savings strategy, National Microbiology Laboratory procurement was identified by the Agency's senior management as a local requirement (that is, self-contained to serve a specific type of key function). This procurement activity is internally processed by IDPCB-WCSC under the national procurement service delivery model. Over 95% of contractual proposals processed by IDPCB-WCSC relate to the acquisition of goods totalling $9.3 million and individually valued at less than $25,000, with a majority procured under a standing offer. Higher complexity and larger value contractual proposals are processed by senior procurement specialists at MAMD (service-related contracts) and by PWGSC. During the 2013 calendar year, 15 procurements for the National Microbiology Laboratory were processed by MAMD, totalling $1 million, while 35 procurements were processed by PWGSC, totalling $5 million.

In terms of procurements for the FNIHB, ICST processes all contractual proposals for headquarters, except for IT-related acquisitions. About 85% of contracting proposals were processed by branch internal procurement specialists for headquarters, with  the acquisition of services totalling $4.6 million, of which 15% were procured under a standing offer and/or supply arrangement. IT-related contractual proposals, as well as all branch procurements in the regions, are processed by MAMD and represent 96% of all FNIHB procurements for calendar year 2013.

Roles and responsibilities

The roles and responsibilities of cost centre administrators, cost centre managers, Tier I - CRCs and the Tier II - SSP-CRC are set out in A Contracting Guide for Cost Centre Managers and Cost Centre Administrators in Health Canada and the Public Health Agency of Canada, dated March 25, 2014. SSP-CRC's roles and responsibilities are also set out in a terms of reference, dated June 23, 2014. In the case of procurement specialists, their roles and responsibilities are separately documented in the Reference Guide to Procurement and Contracting in Health Canada for Contract Specialists, dated October 2011. Most Purchasing Group (PG) work descriptions across the procurement functional groups are outdated. IDPCB-WCSC updated its work descriptions, including some contextual information related to the national procurement service delivery model. A classification exercise is currently underway to standardize the work descriptions for the procurement specialists in the two organizations.

Overall, the authority, roles and responsibilities for key positions related to procurement and contracting are documented and communicated. However, the SSP-CRC terms of reference are not aligned with the Contracting Guide and do not establish the accountability and reporting relationship with PEC (see Recommendation 1).

2. Risk management

2.1 Management of procurement and contracting risks

Audit criterion: Mechanisms are in place to identify and manage risks related to non-compliant procurement and contracting practices.

Integrated risk management is defined by TBS as a continuous, proactive and systematic process to understand, manage and communicate risk from an organization-wide perspective. Proper management of procurement and contracting risks will foster strategic decisions that contribute to the achievement of an organization's overall corporate objectives with respect to culture, framework, practices and business processes.

Through the review of organizational documents, some procurement and contracting risks were observed. There were five risk areas identified during the business transformation process initiated in September 2012: a standardized process that is unresponsive to the organization's needs; compliance to Central Agency policies and regulations; procurement specialist capacity building and loss of corporate knowledge and expertise during the transition; technology that is not supportive of the new procurement service delivery model; and cost centre administrator/cost centre manager readiness in accepting new procurement responsibilities. The related mitigation strategies included stakeholder consultations, development of a new governance framework and enhancement of the departmental financial management system to improve internal controls and a training strategy.

An annual contract verification exercise, on a sampled basis, is performed by MAMD to assess and report on the state of procurement and contracting compliance with relevant government policies and regulations. Some key non-compliance risks identified include the occurrence of pre-contractual work, contracting "after the fact" and contract splitting; mandatory standing offers or supply arrangements not being applied; approval of contracts without sufficient funds or by the proper delegated authority; and the required documents not being properly recorded and retained in all contract files. This annual contract verification exercise is conducted for the Department only. However, it is expected that this mechanism for monitoring and reporting contracting compliance will be expanded to include both organizations through the use of the newly developed draft Procurement Performance Measurement Framework.

The key mitigating mechanism to address some of these non-compliance issues was the implementation of the Procure-to-Pay (P2P) platform. Some established, specific, information technology driven controls include the mapping of material group codes to mandatory standing offers and supply arrangements; the systematic routing of procurement transactions for electronic approval aligned with the delegated financial authority matrix and specimen signature cards; and a centralized repository of required documents for contract files. Real-time updates in the departmental financial management system further assist with the procurement and contracting process in the two organizations, as does invoice validation with contracts to facilitate the payment process.

Other risks observed in the Procurement Compliance and Consequences Framework included increased Crown liability and vulnerability to litigation; potential loss of organizational delegated procurement authorities; inquiries from the Canadian Internal Trade Tribunal and the Office of the Procurement Ombudsman; and unfavourable media attention and public scrutiny. The related mitigation mechanisms were a strengthened governance framework for procurement and contracting and the introduction of a national service delivery model.

The establishment of a dedicated two-tier governance framework for procurement and contracting helps to ensure a consistent process to address and recommend consequences on matters of non-compliance and unacceptable procurement behaviours within the two organizations. Further, the creation of a national standardized approach for procurement and contracting, whereby almost all related activities are centrally managed by MAMD, fosters a consistent application of policies and procedures, with improved operational oversight to monitor non-compliant contracting practices across the two organizations. In their current risk management approach, low-complexity transactions are reviewed by procurement specialists and high-complexity transactions are processed by senior procurement specialists.

The Procurement Compliance and Consequences Framework was presented to senior management at the Department, as well as its Departmental Audit Committee (DAC). Information related to Health Canada's non-compliance and confirming orders for fiscal year 2013-14 were observed in the presentation deck. At the writing of this report, a separate presentation deck has been drafted for the Agency, but the framework has not been shared with senior management. It is important that senior management in both organizations be regularly informed of risk management mitigation strategies pertaining to procurement and contracting.

In November 2013, the first meeting of the Inclusive Contracting Community took place with procurement specialists and management from three procurement functional groups. The purpose of the meetings was to discuss policy clarifications and share operational updates and challenges, including compliance risks, issues and mitigating mechanisms such as planned changes to the approval process for FAA Section 41. One other meeting was held in late February 2014. Moving forward, it is anticipated that Inclusive Contracting Community meetings will take place on a quarterly basis, for information sharing purposes. However, no meeting had occurred since February 2014.

Overall, mechanisms are in place to identify and manage risks. However, both organizations would benefit from MAMD enhancing its risk profile for procurement and contracting, in order to formalize and monitor its risks and mitigation strategies using a systematic approach. This risk analysis exercise could be incorporated as part of MAMD's annual operational planning process (see Recommendation 3).

3. Internal controls

3.1 Guidance and tools

Audit criterion: Managers with delegated procurement authorities and procurement functional specialists are provided with the necessary training, tools, resources and information needed to foster compliance with relevant policies and regulations.

MAMD is responsible for communicating new processes and procedures under the national standardized service delivery model, providing updates on the roles and responsibilities of cost centre administrators and cost centre managers and delivering training and tools to support the Department and the Agency.

In terms of organization-specific policies and guidelines, MAMD has posted A Contracting Guide for Cost Centre Managers and Cost Centre Administrators in Health Canada and the Public Health Agency of Canada (dated March 31, 2014) on the intranet to support employees in both organizations regarding their compliance responsibilities pertaining to government contracting policies and regulations. More specifically, this document identifies some questionable and forbidden practices related to conflict of interest, contract tailoring, contract splitting, payrolling, retroactive contracting, sole-sourcing and trade references. For procurement specialists, there is the Reference Guide to Procurement and Contracting in Health Canada for Contract Specialists, dated October 2011.

Another key tool utilized by cost centre administrators and cost centre managers is the P2P platform. It operates as the workflow process for all procurement actions and is a repository of mandatory documents for contract files. During the 2013 calendar year, a number of messages were communicated by the Financial Operations Directorate (FOD), SSP, during the three phases of the P2P Project: Phase I - Invoices and Payments; Phase II - Procurement; and Phase III - Specimen Signature Card. Key information was shared on the new service delivery model and process changes, the P2P platform, the schedules of activity roll-outs, related training and other relevant topics. These communications were found to be informative and timely.

The mySOURCE intranet site also offers a variety of useful material to cost centre administrators and cost centre managers. The information is aligned with TB Contracting Policy and includes links to PWGSC mandatory standing offers and supply arrangements, as well as Department-specific and Agency-specific standing offers and supply arrangements; quick reference guides to using the P2P platform; and client completion guidelines and checklists for preparing call-ups against a standing offer (942), purchase orders, short-form contracts (PS2) and purchase requisitions. In addition, procurement specialists are available to provide advice and guidance to employees throughout the contracting process.

In June 2013, the process for the creation, approval and quality assurance of specimen signature cards (SSC) was transitioned from Lotus Notes to P2P. The hard copy SSCs are verified by the editors to ensure that the information reflects what was submitted in P2P and that individuals have completed all the mandatory training for their delegated financial authority. However, in addition to the government-wide mandatory delegated financial authority training delivered by the Canada School of Public Service, Department employees are also required to complete a four-part online Financial Signing Authority mandatory course and evaluation that include the Orientation for the Acquisition of Goods and Services.

There are six information sessions and training courses related to procurement and contracting currently available to employees in both organizations, namely one mandatory course for Department employees and five non-mandatory courses. The three sessions/courses delivered by MAMD focus on the national standardized service delivery model and processes, roles and responsibilities, navigating the P2P platform and contract preparation (Introduction to SAP Material Management Module and the P2P Environment, Procurement 101 and Changes to Section 41 of the Financial Administration Act). These sessions/courses are made available to more than 800 employees during the calendar year. Generally, the targeted audiences are cost centre administrators and cost centre managers. However, two online courses are designed for procurement specialists (Aboriginal Considerations in Procurement and Green Procurement). As part of MAMD's Training Strategy for 2013-14, P2P training and new service delivery model information sessions were given to all procurement specialists. In addition, MAMD plans to promote and manage the mandatory training and/or certification of its staff as federal specialists in procurement through the Canada School of Public Service. This is particularly important because the exercise was delegated to procurement specialists in early April 2014.

In conclusion, managers with delegated procurement authorities and procurement specialists are provided with the applicable guidance, tools and training to foster compliance with relevant government contracting policies and regulations. These managers and their administrators also have access to procurement specialists throughout the contracting process.

3.2 Procurement and contracting compliance

Audit criterion: The standardized approach to procurement and contracting has effective controls in place to comply with applicable contracting policies and regulations. A formal challenge mechanism is established for all contractual proposals.

Under the standardized approach, there are two key internal controls to foster compliance with government contracting policies and regulations. They are the Procure-to-Pay platform (P2P) information technology system controls and the review and challenge function performed by procurement specialists.

Procure-to-Pay

The key functionalities covered by P2P include the financial system validation of sufficient available funds; the non-processing of transactions without the attachment of mandatory procurement documents in the approval of contractual proposals; the facilitation of FAA Section 32 and 41 approvals for all procurement actions; and the required acceptance of proposals by procurement specialists prior to the signing of contracts.

A critical step before procurement specialist acceptance in P2P is the automated verification that sufficient funds are available, as well the expenditure type or vote, to cover the estimated contract value. This confirmation is conducted at the departmental financial management system (SAP) Funds Management configuration, which is one level below the branch budget allocations. As a result, the onus remains on the responsibility centre managers in the lower tiers, or their delegates, to manually review the budgets in the SAP-controlling configuration prior to approving FAA Section 32. The risk remains that some managers may not have the necessary available funds to cover the cost of goods and/or services at the time of contracting. IDPCB-WCSC performs an independent review of available funds in the responsibility centre manager's budget as part of its procurement process.

The audit examined a representative sample of procurement actions in P2P in both organizations, to verify that key internal controls were operating as intended; that the funds commitment and contract approval were authorized by the appropriate delegated authority prior to the contract start date; that the required documents for specific contract types supported best value, competition and fairness; and that the corresponding procurement specialist performing the review and challenge function was at the appropriate level established by MAMD.

Automated routing of procurement actions for FAA Sections 32 and 41 approvals is based on the organization's financial delegated authority matrix and specimen signature cards. Some exceptions observed in the sampled contract files included:

• Cost centre administrators who exercised FAA Section 32 on nine contracts: Cost centre administrators are not authorized to exercise FAA Section 32, as per both organizations' Delegated Financial Signing Authority matrices. This P2P routing error was resolved as of June 11, 2013.
• The absence of specimen signature cards with physical signatures in SAP for nine instances of FAA Section 32 and 41 approvals at the Department: According to the business process for specimen signatures, the card is terminated if the original signed specimen signature card is not received within two weeks of activation.

It is important that business processes be respected and that due diligence be properly exercised by individuals with delegated financial signing authorities.

Depending on the selected type of contract, different mandatory documents are required for upload into P2P. The system cannot confirm whether the appended document is indeed the identified document, but this technological control serves as a prompt. Users can delete and replace original mandatory attachments after acceptance/release by the purchasing group and FAA Section 41 approval. All procurement actions require at a minimum a statement of work and/or a proposal and signed contract, with additional documents needed as the contracting complexity increases.

Some exceptions observed in the sampled contract files included the following.

• Six procurements did not contain the required mandatory documents in SAP.
• For the Department, there were 18 instances in which the signed contract was not filed in SAP.
• For the Agency, there were seven instances in which the signed contract was not filed in SAP.

It may be that further guidance needs to be developed by MAMD and communicated to cost centre administrators and cost centre managers, to clarify which substitutions may be acceptable, based on certain conditions, for not attaching the P2P-specified mandatory documents.

In addition to the system routing to cost centre administrators for approval of FAA Section 32, the Department and the Agency had sought and were granted a short-term exemption by PWGSC from using mandatory procurement vehicles for requirements under $10,000, from the date of P2P implementation to March 31, 2013.

The implementation of P2P as the central repository was expected to ensure an audit trail in the approval of the contact proposal and to demonstrate that management was provided with sufficient information to make an informed decision, as well as to demonstrate best value, competition, fairness and transparency in the procurement process. However, based on the sampled contract files, most non-compliance issues uncovered relate to improper contracting documentation in SAP. It is important that all stakeholders participate in ensuring that all required information is placed in the contract file, as specified in TB Contracting Policy, for inclusion in P2P. Such elements include a proposal, cost information, selection of contractors, technical evaluation, negotiated prices, hierarchy of approvals, contracts and amendments, method and basis of payment, terms of reference and advance payments, as well as key remarks such as sole-source and amendment justifications and the involvement of a procurement review committee and its recommendation.

Formal review and challenge by procurement specialists

As noted in Section 2.1, MAMD has established a risk-based contracting proposal review and challenge process for functional oversight and quality assurance of the procurement process. All contractual proposals for the procurement of goods and services are prepared and reviewed by procurement specialists, as well as being reviewed by the two-tier governance committees, as appropriate. Under this approach, cost centre administrators and cost centre managers are responsible for the processing of temporary help services up to $400,000, under a standing offer. This threshold is considerably greater than the $10,000 limit established for other types of contracts. In order to exercise this specific method of supply, users are required to take a mandatory training course delivered by PWGSC before obtaining access to its temporary help services tool with a $400,000 maximum allowable limit. Further, this standing offer process is on a first right of refusal basis and those documents are subject to the review process by MAMD's procurement specialists to ensure compliance. For calendar year 2013, temporary help services procured by the Department and the Agency were for $19 million (529 contracts) and $4 million (90 contracts), respectively.

Higher complexity transactions, such as sensitive purchases, PS1 long-form contracts over North American Free Trade Agreement (NAFTA) thresholds and 9200 Purchase Requisitions, are processed by senior procurement specialists (PG-03s or higher) and PWGSC to reduce the risk of potential non-compliance with government contracting policies and regulations.

Checklists have been developed by MAMD to guide procurement specialists in their compliance review and processing of various types of contracts. These checklists address key elements such as required documents, sole-source justification, the adequacy of the statement of work, the appropriateness of the evaluation criteria and the selection methodology. Based on walkthroughs with procurement specialists in all three functional groups, it was acknowledged that these individuals do not use the checklists. It is important that procurement specialists complete the checklists or other templates and attach them in P2P, to be able to identify situations where potential non-compliance was observed and handled. It would also facilitate the escalation of situations that warrant the review, decisions and recommendations of the CRC, as well as maintain a documented record.

Enhancement of the internal controls for procurement and contracting was observed through the implementation of P2P and the review and challenge function performed by procurement specialists. However, improvements are required to ensure that all required documents are maintained in the central repository (SAP) and that there is an audit trail in the contract approval process to demonstrate best value, competition, fairness and transparency.

Recommendation 2

It is recommended that the Chief Financial Officers of Health Canada and the Public Health Agency of Canada strengthen procurement and contracting documentation to ensure that all required documents are maintained in the central repository and that there is an audit trail in the contract approval process to demonstrate best value, competition, fairness and transparency.

Management response

3.3 Monitoring and reporting activities

Audit criterion: Procurement and contracting practices and controls are regularly monitored and reported to provide management with reliable information, in order to manage risks and operational requirements effectively.

MAMD is responsible for the ongoing monitoring of the effectiveness of procurement and contracting activities. This practice serves as an early warning, to enable timely decision-making and corrective actions, and provides a basis for continuous improvement to the related processes, systems and controls in place. The establishment of a defined and consistent monitoring and reporting process for procurement and contracting will act to mitigate the risks related to non-compliance, increased public scrutiny and litigation.

The key monitoring and reporting activities performed by MAMD to manage risks and operational requirements effectively are the quarterly contracting activity report analysis, the ongoing monitoring of non-compliance situations and confirming orders tracking and quarterly proactive disclosure reporting.

Contracting activity report analysis

The contracting activity report analysis provides senior management with statistics and identifies trends in procurement and contracting activity at the departmental level. It also includes monitoring and reporting against branch procurement plans and linkages to the departmental Investment Plan. MAMD prepares this analysis as part of the monthly Health Canada Departmental Dashboard and reports quarterly at the branch level.

For the Agency, this analysis is presented to senior management on a quarterly basis and does not include branch level statistics and trends. It should be noted that while MAMD is integrated in the Department's annual operational planning process, the same is not true for the Agency's annual operational planning process. As a consequence, the quarterly reports for the Agency do not include monitoring and reporting against branch procurement plans and linkages to the Agency's Investment Plan.

The spirit behind sharing branch-specific information with the planners, branch senior financial officers, strategic human resources directors and investment planning colleagues is to inform the Management Variance Reporting challenge function and quarterly monitoring of planning activities. It was observed that there are significant discrepancies in actual branch contracting activities relative to their procurement plans. Discussions have taken place between MAMD and the Integrated Planning and Performance Reporting System team at the Department to explore ways to provide branches with quarterly or mid-year opportunities to adjust their original procurement plans to reflect any significant change in strategy or circumstance. As a result, the use of current procurement forecasts will provide more meaningful information for financial resource management purposes and assist MAMD in capacity planning for anticipated procurement service demands.

Non-compliance situations and confirming orders tracking

An important role that MAMD plays is to monitor acquisition processes on an ongoing basis, to ensure that those involved are fulfilling their responsibilities consistently, regularly and appropriately and to ensure compliance with policies and regulations governing federal government contracting. The scope of MAMD's compliance monitoring includes procurement actions processed by FNIHB-ICST at the Department and IDPCB-WCSC at the Agency. It is anticipated that compliance monitoring will be performed on a monthly basis, with results presented quarterly to management for more timely action, when required.

The MAMD Compliance and Consequences Log for 2013-14 was maintained to capture situations of non-compliance. Similar information for prior periods was not tracked because it was previously not under the direct purview of MAMD. To address recurring issues, procurement strategies were developed to assist with business demands such as the establishment of longer-term nursing contracts and standing offers for medical supplies. No case file closing dates were identified to assess the efficiency in dealing with non-compliance situations in the two organizations. A gap was observed in the business process to capture confirming orders in the P2P platform, so that they can be monitored and proactively disclosed. MAMD is working on this gap. Forty-two confirming orders totalling $913,000 at the Department and three confirming orders totalling $12,000 for the Agency were recorded in MAMD's Compliance and Consequences Log for 2013-14, but were not found in P2P.

Proactive disclosure

Proactive disclosure reporting is facilitated by the departmental financial management system. There is a checkbox for employees in the Purchasing Group classification to manually exclude transactions when they meet certain criteria such as being deemed "an impairment to national security" and/or valued at less than $10,000.

MAMD monitors and reports on contracting activities and non-compliant risks and occurrences. The level of detailed financial information and the frequency of presentations to senior management vary at the Department and the Agency.

Recommendation 3

It is recommended that the Chief Financial Officers of Health Canada and the Public Health Agency of Canada ensure that the current monitoring and reporting regime, including monitoring of risks and mitigation strategies for both organizations, are endorsed by the Partnership Executive Committee, to ensure that the regime responds to the information needs of both organizations.

Management response

3.4 Performance measurement framework

Audit criterion: A defined framework is in place to identify, measure and evaluate the effectiveness and efficiency of the Department's and Agency's procurement and contracting practices. Procurement and contracting activities are conducted within established service standards.

Performance measurement is the process of aligning financial resources, information systems and employees to achieve strategic objectives and priorities in an effective manner. It is important that organizations have a performance measurement strategy and framework to set critical success factors and identify the key performance indicators and expected results used to evaluate the effectiveness and efficiency of their internal services.

In September 2013, MAMD developed the draft Procurement Performance Measurement Framework to facilitate the establishment and implementation of a meaningful, evidence-informed assessment of the efficiency and effectiveness of its service delivery through relevant, achievable and sustainable performance indicators. Some key performance areas identified are timeliness, cost effectiveness, procurement and contracting compliance, collaborations with business partners and value-added strategic direction. The draft Procurement Performance Measurement Framework and Acquisition Service Program Logic Model incorporate some preliminary TB performance measurements developed to assist departments and agencies with their related initiatives. There are a total of nineteen performance indicators related to MAMD's acquisition services. For the purposes of the audit, the two key performance indicators of greatest importance and relevance are the percentage of selected procurement actions that, upon review, were considered to be fully compliant and the percentage of times that service standards were met.

Procurement and contracting compliance

The performance indicator on compliance is intended to monitor the acquisitions process on an ongoing basis, to ensure that those involved are fulfilling their responsibilities consistently, regularly and appropriately. This monitoring is intended to fulfill the following objectives:

• Ensure compliance with policies and regulations governing federal government contracting;
• Assess the integrity of the procurement process;
• Determine the reliability of information for reporting and monitoring purposes;
• Assess the effectiveness of the Contract Review Committee (CRC); and
• Ascertain the improvements that can be made in the service contracting process.

Based on the draft MAMD Performance Report 2013-14 for the Department and the Agency, dated February 19, 2014, the current design for evaluating the proposed performance indicator would not allow MAMD to provide a comprehensive compliance assessment or to draw a conclusion regarding the percentage of selected procurement actions that, upon review, were considered to be fully compliant. It would be beneficial if senior management of the two organizations could be provided with an overall assessment of their procurement and contracting compliance with government contracting policies and regulations, in order to facilitate the necessary remedial action and decision-making.

Service standards

MAMD has established and publicized service standards for the procurement process for various types of contracts, from beginning to end. These service standards allow MAMD to measure its performance while shaping client expectations of service delivery times in processing their procurement needs. P2P was expected to capture the actual processing times and to benchmark them against the established service standards. There are currently no departmental financial management system (SAP) reports that can be generated to obtain detailed service standards information. SAP-reported actual service times are based on an average of all procurement transactions in P2P. For example, the average processing time for procurement actions was about one day and 10 hours for the period from April 1 to December 31, 2013. The Framework for the Integrated Resource Management System team is assisting MAMD with IT reporting enhancements, to segregate service standard metrics by organization, branch, contract type and queue times.

At the time of the audit, the monthly service standards reports prepared by MAMD tracked only the time spent by procurement specialists in processing contract proposals.  Since the reported results include only MAMD's level of effort and exclude any backlog or wait time in the queue for MAMD processing, the reporting service standards are not comparable to the publicized metrics. Based on MAMD metrics, procurement specialists met their service standards 80% of the time for the Department and 84% of the time for the Agency, for calendar year 2013, when excluding memorandums of understanding/agreements and interdepartmental letters of agreement. These results indicate some inefficiency in the procurement process that may warrant further examination.

While the current approach provides direct performance information on the combined functional groups providing the service delivery, it limits the perspective of how each organization may be impacted. As a result, it is more difficult to diagnose bottlenecks, to identify synergies and opportunities for efficiency across contract administration activities and to communicate to all stakeholders the significance of working together in the best interest of the organization. It is important that service standards consider the start-to-end processing activities, to assess the organization's overall procurement efficiency.

It should be noted that IDPCB-WCSC has established its own set of service delivery standards. The existence of different service standards in processing procurement actions would suggest that clients within the Department and the Agency may be serviced within different expected durations, which is not consistent with a national standardized approach for procurement and contracting.

Other performance measures

With respect to client satisfaction, MAMD has developed a client survey questionnaire to capture the views and opinions of its clients on the degree to which it has provided the information, knowledge and other support they need to execute their procurement and material management roles, responsibilities and obligations. MAMD launched the survey in May 2014 and may consider leveraging the survey results from the recent P2P post-mortem exercise conducted by FNIHB-ICST for its branch. Other performance indicators include information on the planned training of clients and the refreshing of policies, guidelines and tools used by staff and clients.

In conclusion, MAMD has developed a draft Procurement Performance Measurement Framework for procurement and contracting that includes relevant performance indicators. Updates are needed to ensure a comprehensive assessment of compliance and procurement service delivery at an organization level, in order to identify areas for risk mitigation or enhancements to guidance, tools and/or processes.

Recommendation 4

It is recommended that the Chief Financial Officers of Health Canada and the Public Health Agency of Canada implement a performance measurement framework for procurement and contracting that:

• Ensures that the reporting of procurement and contracting service standards is comparable, comprehensive and reflects actual total processing times; and
• Incorporates remedial actions to address unmet performance measures that have a risk impact.

Management response

C - Conclusion

The audit concluded that the management control framework in place to support the procurement and contracting practices in the Department and the Agency needs moderate improvement.

The audit found that a governance framework was in place to provide oversight of the Department's and Agency's procurement plans and contracting practices and activities, as well as the high-risk and/or complex procurement of goods and services. Authority, roles and responsibilities for key positions related to procurement and contracting were documented and communicated. However, the Shared Services Portfolio Contract Review Committee's terms of reference should be revised to align with the Contracting Guide and to establish the accountability and reporting relationship with the Partnership Executive Committee (PEC). Overall, mechanisms were in place to identify and manage risks related to non-compliant procurement and contracting practices.

Managers with delegated procurement authorities and procurement specialists were provided with the appropriate guidance, tools and training needed to foster compliance with relevant government contracting policies and regulations.

Enhancement to the internal controls for procurement and contracting was observed through the implementation of the Procure-to-Pay (P2P) platform and the review and challenge function performed by procurement specialists. However, improvements are required to ensure that all required documents are maintained in the central repository (SAP) and that there is an audit trail in the contract approval process, so as to demonstrate best value, competition, fairness and transparency.

The existing monitoring and reporting regime should be endorsed by PEC to ensure that it appropriately reflects the risk management and operational needs of each organization. The draft procurement performance measurement framework used to evaluate the effectiveness and efficiency of procurement and contracting practices needs to be updated to ensure that there is a comprehensive assessment of compliance and procurement service delivery at an organizational level and that it identifies areas for risk mitigation and operational enhancement.

The areas for improvement that have been noted will collectively strengthen the management control framework, to better support procurement and contracting at the Department and the Agency.

Appendix A - Specific lines of enquiry and criteria

Appendix B - Scorecard

Appendix C - Procurement and contracting governance

Description - Appendix C

Enlarge Appendix C

Appendix D - Process flow of procurement transactions centrally managed by the Materiel and Assets Management Division

Description - Appendix D

Enlarge Appendix D

Reference: A Contracting Guide for Cost Centre Managers and Administrators in Health Canada and the Public Health Agency of Canada, 2014

Appendix E - Summary of contracts processed by type of goods and services

Note: The category "Other Services" includes cleaning services, collection agency fees, etc.