Public Accounts Committee on Sept. 21st, 2010

[Brandon Jarrett]

The next one is in relation to the use of electronic audit working papers. One of the challenges all audit practices face in the preparation and use of basically electronic systems is the timely review of working papers and the consistency of their use. We've suggested to the OAG that all reviews should be done within the system so that it's self-contained, there is a complete record, and it can be archived as a complete record.

I'll get Deb Jackson to talk about the other two that relate more to her area of expertise than mine.

[Deborah Jackson]

Thank you.

I'll try to be brief. The first one is around continuous improvement. We recognize that the OAG does capture lessons learned from both their audits and also stakeholder feedback and practice reviews in several different ways, but we found that there wasn't necessarily a systemic approach to capturing those lessons learned and ensuring that they're actually fed back into learning and development programs and things like their RAM project, for example. In their action plan they have mentioned they are addressing that and they've put in place a more systematic approach.

The other area was in relation to performance audits and special examination reports. The footnotes, of course, we have touched on. The other is just providing a little bit more context in performance audits and special examination reports, and also particularly in special examination reports, making it a bit more clear what they are addressing in those reports, what systems and practices are being examined and what those findings and conclusions subsequently mean, and putting context for the reader to understand those recommendations. So it's the readability of those reports at the end of the day.

[The Chair, Liberal, Shawn Murphy]

Okay. Thank you very much.

We're now going to move to Madame Faille.

Ms. Faille, you have five minutes.

[Meili Faille, Bloc, Vaudreuil—Soulanges, QC]

Thank you. I will share my time with Mr. Nadeau, who did not get to ask all of his questions earlier.

[Richard Nadeau, Bloc, Gatineau, QC]

Thank you very much, Mr. Chair.

We talked earlier about the fraud risk issue. The whole question was examined, and things were explained. Now, we are talking about sufficient documentation. Following the recommendations made, where exactly do things stand on this matter?

[Sheila Fraser]

We mentioned to our staff and even stressed the importance of documenting decisions properly. Our internal practice reviews seem to indicate improvement in that area, but I have to admit that it will always remain a challenge. Often, people don't take the time to properly document why they did certain work, what their conclusions are, what their reasoning is. I think that we will always have to remind people to take the time to properly document everything they do. Owing to the new international standards, we are requiring that employees provide more documentation to explain their actions.

[Richard Nadeau, Bloc, Gatineau, QC]

Is this odd situation also due to the fact that the task must be performed quickly? If employees have to move on to the next step, they may neglect to document their work to some extent in order to focus on the big picture. Is this oversight due to a lack of time or staff, or is this the way things have always been done?

[Sheila Fraser]

Perhaps the issue partly stems from a lack of time. Our employees often have to rush to complete cases. I also think that human nature factors into the equation. We do our work and think that what was done is clear, but when someone else sees the work done, it is perhaps not so clear, especially when it comes to the underlying reasoning. Employees do the work required, but they do not provide sufficient documentation to support their reasoning, for instance, justifications for choosing a particular method and arriving at a specific conclusion.

[Richard Nadeau, Bloc, Gatineau, QC]

Another issue is the retention of electronic documents. Is that a relatively new procedure? We know that it has been around for a while now, but it is still new. Should we be rethinking that aspect? I know that, in this field, technology changes rather quickly. Is that fact taken into consideration? At a given time, electronic documents were being retained in a certain format. Today, that particular format is obsolete, it no longer exists. We are not even sure whether we can find equipment that allows us to read older documents. Is that taken into consideration?

[Sheila Fraser]

In that case, the issue was more about the use of computer tools for performance audits. When it comes to financial attest audits, we have been using an electronic tool that was designed for that specific purpose for about a dozen years now. People are more familiar with it.

For performance audits, we had to adapt a tool to meet our needs, as it was not as user-friendly as it could have been. We made other changes to it. Now, the policy requires everyone to use it. We are currently working on that.

I think that it is also a question of human nature. People who, like myself, have been working in this field for a long time are much more used to turning pages or going through a paper file than to reviewing an electronic record.

However, I am noticing changes in the practices. In our internal reviews, we ensure that electronic files are being created and that the use of paper is eliminated as much as possible.

[Richard Nadeau, Bloc, Gatineau, QC]

Does having a new medium, new electronic hardware, make it necessary to review the ways to further the search process every five, three or two years? Will we not constantly have to ensure that, technologically speaking, we are not slightly behind the times?

[Sheila Fraser]

Our software is used globally and is well known in the audit world. In addition, the software is constantly updated. So, we can perform updates as needed. There are also user forums and conferences we participate in, as well as North American accounting and legislative audit offices. We keep up with the changes that take place. An ongoing dilemma is whether it is worth our while to make a change in order to adopt the latest version or whether it would be better to wait a little while and make the change later.

We are aware of the changes. The main modification we had to make this year was incorporating all the audit standards and the procedures we must use into the software. Because of the modifications to the standards, tremendous efforts were invested into bringing everything up to date and making things as easy as possible for the auditors.

[Richard Nadeau, Bloc, Gatineau, QC]

Thank you for the clarifications.

[The Chair, Liberal, Shawn Murphy]

Merci, monsieur Nadeau.

Mr. Shipley, you have five minutes.

[Bev Shipley, Conservative, Lambton—Kent—Middlesex, ON]

Thank you, Mr. Chairman, and thank you, Mr. McPhee, for being part of this great day in Canada as we do the report on your peer review.

I would say to the Auditor General that it reads very much like many of her reports that come forward. I have to say to the Auditor General and the peer review team that, from our perspective here, we're very fortunate in Canada to have many ministries, agencies, departments, and crown corporations that actually come with very good reports. I guess because we're human there are always a few things to make us better, and that is driven, in large part, by the very strong and successful Auditor General's office we have here.

I want to congratulate you, Mr. McPhee, for chairing the peer review, and with that, I would ask the first question to you.

I understand that the peer review follows international guidelines and practices around the world. Just for our information, could you tell us a little bit about how the countries that have been involved in the peer review--there are four or five of you--implement the standards required by the countries and where they are in terms of the implementation of these practices and standards?

[Ian McPhee]

First, thank you for your kind comments about the review and the review team.

Second, the countries we were involved with in undertaking the review are all members of the International Organization of Supreme Audit Institutions, and they are collectively moving to adopt international auditing standards. But I have to say, some of those audit offices have not yet fully adopted the standards. I believe the countries we work with are adopting the auditing standards themselves, but I can't entirely assure you of that.

I can tell you that certainly Australia has adopted the same sorts of standards that Canada has--and there's no doubt these are standards that today are produced by the International Auditing and Assurance Standards Board--which apply in both the private sector and the public sector equally. That's very important. So the standards that both Canada and Australia are using in our audits are right up there in terms of quality.

The other thing that's important to say is that all audit offices do have issues with reinforcing the importance of training and adherence to the standards. In particular, I would reinforce what Sheila Fraser mentioned about documentation. It is an issue that features in many reviews of many audit practices in both the private sector and the public sector.

I can tell you that not all audit offices around the world adopt international auditing standards at this time, but certainly the leading audit offices do. Australia and Canada do, and I would say with some confidence--but without the evidence--that our colleagues on the peer review would be in a position similar to that of Australia.

[Bev Shipley, Conservative, Lambton—Kent—Middlesex, ON]

My next question is to the Auditor General. It comes from a comment made by Mr. Jarrett regarding reporting to management and the issue of senior management involvement.

In your report I read that that was completed, I believe, in 2010. It would just seem to me--and if I'm missing something, please tell me--that such a management practice should certainly have been in place. When we have had other agencies, often--I remember back--we have talked about the management control, the communication gaps, how we're going to make and infiltrate into our technology...and all the communication strategies that we have. I'm pleased to see that it's completed. I'm just wondering why it's now completed and it wasn't sooner.

[Sheila Fraser]

This refers to senior management of the office and their involvement in the audits. Moving to the risk-based approach to audit requires more senior management involvement than may have been the case in the past--in particular, the involvement of our assistant auditors general.

I think we had perhaps placed too much reliance on other members of our management category. We have three levels in that management category, so the principals and the directors were really viewed as being the ones who led the audits. We've now clarified that the assistant auditors general really need to be involved certainly for the higher-risk audits and they have to be involved in the determination of which ones are higher risk. They need to be involved right up front in the planning in ensuring that the risks are properly identified and that the audit procedures being planned will adequately address those risks.

Some did it. Some did it very well, others less well. It was really a question of clarifying the expectation that they should be involved. Again, we will be looking at our internal practice reviews to make sure it is happening as expected.

[Bev Shipley, Conservative, Lambton—Kent—Middlesex, ON]

Thank you, Mr. McPhee and Auditor General.

[The Chair, Liberal, Shawn Murphy]

Thank you, Mr. Shipley.

Now we're going to go to Mr. Christopherson for five minutes.

[David Christopherson, NDP, Hamilton Centre, ON]

Thank you, Mr. Chair.

Mr. McPhee, I was just curious, were there any practices that you saw here in Canada in our Auditor General's shop that you'd look at incorporating in Australia?

[Ian McPhee]

Thank you, Vice-Chair.

Yes, there certainly were. We actually make reference to some of these in the report, on page 17 of the English version.

Certainly, we think the way your committee and your Auditor General work together is a very high-level model and we are most interested in the strong and active relationship between the OAG and your committee. We have observed that already.

We like the clarity of the messages in the OAG reports. I think one of the challenges we auditors do have from time to time is that we perhaps use language that some others don't always understand. Clarity of message and clarity of communication are important. We think the reports that the OAG does are very good from that point of view, so we've taken on board that particular approach.

In regard to some of the collaborative audits the OAG does with other organizations, we found those very interesting. We in Australia have not worked collaboratively with other organizations in undertaking audits, but we do produce what we call here “better practice guides”, which basically seek to draw from the information we've learned from audits to articulate what is better practice, be it in grants, administration, or contingency planning, or even in how to prepare a set of financial statements; we have a series of better practice guides. In some cases we work collaboratively with other agencies to produce those better practice guides, so we're interested in those matters.

I think the last one was the area of the criteria for special examinations. We're interested in that.

I think it's like any other area of activity, in that we learn so much from international experiences, that is, speaking from here in Australia. In Canada, as has been mentioned by various committee members, the OAG is a great asset to your country. It's highly regarded. We learn a lot by just being in touch with the OAG. In this case, the whole review team flagged these four or five areas as areas where we could learn.

As Sheila Fraser mentioned, we do meet at international gatherings. We do contribute and learn from each other and share experiences. I, for instance, without taking much of the committee's time, am very focused on audit quality: trying forever to improve the quality of the products we produce, particularly the reports we produce. We have to do it in a fairly efficient manner because of resource considerations, but we are working very hard, particularly in our performance audits, to invest in quality in the early stage of the audits so that we're all aligned, and so that when it comes to producing the final report, we have a clear understanding of what the messages are likely to be and we are comfortable with how they're being produced.

I think every audit office is interested in improving the quality of its work. I think the positive thing, from the point of view of the OAG, is that the investment the office has in the quality management systems is a very good basis for producing quality work. The OAG faces the same issues that other audit offices do: it's about how to make sure the implementation of audits actually follows the management systems, the policies, and the procedures that the OAG has articulated.

The other final comment I'd make while I'm speaking is that there's no doubt that auditing these days does require a higher level of involvement. The risk-based approach does require mature consideration of risks to misreporting or to misperformance, and it does require a high level of senior management involvement, particularly in the planning and in the reporting phases and the review phases.

So it's gone from being.... In the old days, I used to send people out with lists of things to “tick and flick”, as we used to say, to check things off. Young auditors would be doing things, but they never understood exactly why they were doing them; a senior had told them to go do that. That's what you did, and you reported back, whereas what we're trying to do now is to make sure the whole audit team understands the risks there are to misreporting and to make sure the audit covers off those risks.

It requires a very thinking approach, a very intellectual approach, today, so I fully endorse what Sheila was saying about the importance of having more senior involvement in our audit teams, particularly in key stages.

[David Christopherson, NDP, Hamilton Centre, ON]

Briefly, Mr. Chair? Okay.

Thank you very much.

Then I'll take an opportunity just for a clarification, really. It came up in an earlier question. On page 3 of your spreadsheet there was a recommendation. I won't get into it because I think I just need a quick clarification. You agreed with it. You said:

Our own internal practice reviews have also identified the need for improvements in our audit documentation. The Office's Executive Committee will take the necessary steps....

My question was going to be that if you'd already identified it in your own audit, why did you wait till this audit identified it to take steps? But I believe that in an answer to a question from either Mr. Kramp or Mr. Saxton you mentioned that you were already on it, so this probably should read that you've already started the steps and you'll continue. Am I correct in that clarification?

[Sheila Fraser]

Yes.

[David Christopherson, NDP, Hamilton Centre, ON]

Very good. Thank you very much.

Mr. McPhee, thank you again very much. On behalf of the Canadian people and certainly the people I represent, thank you for your efforts. We do take accountability, as you do in Australia, very seriously. It's at the core of our democracy. This office has to work. We're not always going to have the benefit of Sheila Fraser to be here, so if we can leave this office as strong as possible going into that transition, it is such a help to us in our democratic system.

Thank you again, and thank the people of Australia for offering you up to do these services.