Public Accounts Committee on April 4th, 2024

[John Nater, Conservative, Perth—Wellington, ON]

I want to quickly address the issue of the cybersecurity work that you undertook.

The Auditor General noted some concerns with cybersecurity work in general, wherein reliability security status was not held by those who undertook the work. Was your firm fully qualified and fully cleared in terms of reliability security clearance?

[Hartaj Nijjar]

Thank you for the question.

Absolutely.

[The Chair, Conservative, John Williamson]

Thank you, Mr. Nater. That is your time.

I'll turn now to Mrs. Shanahan, who is joining us virtually.

You have the floor for five minutes, Mrs. Shanahan.

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

Thank you very much, Chair.

I too want to thank the witnesses for being with us here today. It is unusual for the public accounts committee to hear from witnesses outside the Government of Canada, but given that your firm also audits the House of Commons, you're certainly not unfamiliar with the way we work, and I think you are providing some very interesting insights here today as to how consultants work with the government.

I want to reiterate the words of one of my colleagues earlier about the importance of the Government of Canada being able to contract for the kind of expertise that your firm represents, as was done under the former Harper government. In the words of the late Jim Flaherty, for whom I had great respect, private sector advice is critical to helping the government conduct its work. In that case, it was a $90,000-a-day contract to cut public sector workers, which in hindsight, I think we need to review.

That said, certainly in the time of the pandemic and the emergency situation crisis, no one knew what was going on. It was all hands on deck with the public sector and the private sector and across the board, wasn't it? I think, as you mentioned in your opening remarks, the global network that KPMG had was certainly very instrumental.

My first question is this: Why do you think PHAC thought that KPMG was the best fit to complete the work that you were contracted for?

[Lydia Lee]

I think there were a number of factors that we understood played into the evaluation through the CEPS vehicle—the COVID emergency professional services—to begin with, and then the subsequent awarding of the TA to KPMG.

As I did mention, I have over 25 years of very in-depth direct experience in working with the health system in Canada in bringing that expertise forward and in particular in working with public health agencies around the country to help respond to the very critical role that the Public Health Agency was playing at that time, not only to monitor the COVID pandemic but also to put interventions in place to limit and contain the spread of the COVID virus, particularly focused on the important disease factor, which was, at that time, international travellers.

Because KPMG has such an extensive international network of colleagues around the world in similar federal government, provincial government, municipal government and health systems and public health roles, we were able to contact our colleagues around the world in a manner that I think the Public Health Agency just simply wasn't able to do as fast as we could.

I will add, further to the member's question, that we have tremendous respect for all the employees we worked with at the Public Health Agency. As you said, it was an incredibly stressful time for everybody, and I think we all felt extremely proud. Our team in particular felt extremely proud to be able to support the government and Canadians during this incredibly difficult time.

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

Ms. Lee, I want you to describe further what it was like working at that time and the experience you had in this specific area.

Do you feel that you were able to bring added value that was appropriate? Is this kind of expertise that you brought something that we should have full time and permanently in the public sector?

[Hartaj Nijjar]

I'm sorry. Was that regarding the cybersecurity work?

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

It's regarding Ms. Lee's work for the public sector. I will have further questions on the cybersecurity aspect, but is this expertise that we should have already had in-house in the public sector, or was there value added in bringing in KPMG?

[Lydia Lee]

I think that we did bring in unique and specialized expertise at that time to the Public Health Agency.

As I said, among the key factors the Public Health Agency was looking at were the compliance and enforcement requirements that it and other government departments would need in order to monitor the policies that were being put in place under the Quarantine Act.

However, we also took the view that it would be important to consider the actual international traveller's experience with respect to these policies. We imagined people coming in from other countries, either Canadians returning to their families and loved ones or people visiting for either business or personal reasons, being exposed to all of these new policies and procedures upon arrival in the country or even before boarding a plane that was coming to Canada. We were bringing very specific human-centred design expertise, for instance, to help the government identify the specific experience. We developed journey maps and detailed process design maps to help them think through all of the operational impacts that these new policies and evolving policies under the Quarantine Act would have, not just on government operations and the air travel industry, but also, more importantly, on international travellers, especially on Canadians returning to the country.

[The Chair, Conservative, John Williamson]

Thank you. That is the time.

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

Thank you.

[The Chair, Conservative, John Williamson]

We'll begin our third round.

Mr. Viersen is joining us virtually. You have the floor for five minutes, please.

[Arnold Viersen, Conservative, Peace River—Westlock, AB]

Thank you, Mr. Chair.

I want to thank the witnesses for being here today.

We understand that the RCMP is investigating the ArriveCAN scandal. Has KPMG been contacted by the RCMP with regard to this?

[Lydia Lee]

The RCMP has not contacted KPMG.

[Arnold Viersen, Conservative, Peace River—Westlock, AB]

Okay.

We know the procurement ombudsman has said that 76% of subcontractors did no actual work. How would you respond to that, given that you're one of these subcontractors?

[Lydia Lee]

I can't comment on all of the other subcontractors that have worked with the government. I'll turn it over to Mr. Nijjar again to comment specifically on the cybersecurity work that we did.

[Hartaj Nijjar]

We performed the cybersecurity work, as I mentioned earlier, over a period of around six months. There was a large body of work that was performed across five different streams that required very specialized expertise and—

[Arnold Viersen, Conservative, Peace River—Westlock, AB]

Can you be a little more specific? “A large body of work across five streams” doesn't tell me a lot.

[Hartaj Nijjar]

Again, there were five streams of work, as I mentioned earlier, that were related to vulnerability management, privacy, the cloud, incident response and secure development practices, and each of those—

[Arnold Viersen, Conservative, Peace River—Westlock, AB]

What does that mean for me, tangibly? If I'm using this app, are you maintaining the security of my data, my name, my address and that sort of thing?

[Hartaj Nijjar]

We were asked to perform an assessment of the security and privacy of the application and how it protected the information of citizens and other parameters around cybersecurity, and that's what we executed.

[Arnold Viersen, Conservative, Peace River—Westlock, AB]

Okay.

Going back to the suggestion that you dealt with GC Strategies, we heard on February 27 that it was suggested to GC Strategies that they should approach you for this expertise. Separate from this, had you bid on development of the application and lost?

[Hartaj Nijjar]

No, we did not bid on any application development work, as far as I'm aware.

[Arnold Viersen, Conservative, Peace River—Westlock, AB]

Do you have any idea why your company would have been suggested to GC Strategies? Do you have a long-standing relationship with the government on this kind of stuff?

[Hartaj Nijjar]

We had no prior relationship with GC Strategies.

KPMG is known in the industry, within Canada and beyond, as a firm that has very specialized expertise in the area of cybersecurity, with a huge amount of depth and breadth in those five specific areas and beyond. My understanding is that we were approached based on our expertise in these areas and on our experience in being able to deliver on that work.