Public Accounts Committee on May 13th, 2015

[The Chair, NDP, David Christopherson]

I call this 59th meeting of the Standing Committee on Public Accounts to order.

Colleagues, I have no particular business to bring to your attention before we move to the matter at hand, other than to confirm that on Monday, May 25, we have been able to secure our witnesses for the study of chapter 3 on tax-based expenditures. I can also confirm a hearing on the 27th on chapter 5, as directed and requested by the committee.

Today, we will be studying chapter 2, required reporting by federal organizations of the 2015 report of the Auditor General of Canada, referred to this committee on Tuesday, April 28, 2015.

I note that Ms. Cheng is here with us today in the capacity as the acting Auditor General.

Ms. Cheng, please introduce your delegation and give us your opening remarks.

[Nancy Cheng, Assistant Auditor General, Office of the Auditor General of Canada]

Thank you, Mr. Chair.

Thank you for this opportunity to discuss “Report 2, Required Reporting by Federal Organizations” of the Spring 2015 Reports of the Auditor General of Canada.

Joining me at the table are John Affleck, principal, and Colin Meredith, director, who were responsible for the audit.

This audit focused on recurring reporting requirements set out by the Treasury Board, by the Public Service Commission of Canada, and by statute. We undertook this audit to respond to long-standing concerns about the burden these reporting requirements create for federal departments, federal agencies, and crown corporations.

The overall objective of the audit was to determine whether selected reporting requirements for federal organizations efficiently support accountability and transparency, and generate information used for decision making in policy development and program management. Overall, we found that reporting intended to support accountability and transparency was serving its intended purposes.

We also found that clear purposes and timelines had been established for the selected reporting requirements, and that central agencies had provided guidance and support to help federal organizations meet them.

However, with respect to the efficiency of required reporting, we found that neither the Treasury Board of Canada Secretariat nor the Public Service Commission of Canada had determined the level of effort or costs involved in meeting the requirements we examined. ln our view, determining level of effort and costs would lead to a greater understanding of the resource implications of these requirements, and would allow them to be adjusted accordingly.

Furthermore, we found that the secretariat has not maintained a comprehensive inventory and schedule of the 60 recurring reporting requirements stemming from its policies, directives, and standards. Such a tool would both help the secretariat address the burden of Treasury Board reporting requirements and help reporting organizations efficiently prepare the required reports.

The secretariat made some accommodations for the sizes and mandates of reporting organizations when reporting requirements were first established and during subsequent reviews. However, we found that most Treasury Board reporting requirements applied equally to all organizations regardless of their size or mandate. For example, the Canadian Polar Commission, a small organization with 11 staff members, was required to prepare 25 annual or quarterly reports.

We noted that the efficiency and value of quarterly financial reports could be improved to better support accountability to Parliament. We identified only one routine use of the information in quarterly financial reports. The Office of the Parliamentary Budget Officer used the information in preparing assessments of in-year spending for parliamentarians.

Six of the eight reports that we examined were intended to support accountability and transparency. We observed that federal organizations were preparing these six reports. However, they were not meeting the remaining two reporting requirements, which were intended to support their internal decision-making.

We noted that 20% of departmental investment plans had not been completed as required. We also found that about half of the departmental security plans that were due by June 2012 had not been finalized at the time of our audit. A departmental security plan is intended to support internal decision-making by providing an integrated view of an organization's security requirements.

In addition, we found that the secretariat did not take full advantage of the opportunity to use the information in the departmental security plans. For example, although the secretariat reviewed the plans it received and used them to support its policy review, it did not use the information to identify broader government security issues.

In the report, we made six recommendations aimed at improving the efficiency and usefulness of required reporting. The secretariat and the commission have agreed with our recommendations.

Mr. Chair, this concludes my opening remarks. We would be pleased to answer questions that this committee may have.

Thank you.

[The Chair, NDP, David Christopherson]

Very good, as always. Thank you so much.

We move now to Madam Donoghue, who is the acting president of the Public Service Commission of Canada.

Welcome. Please introduce your delegation and provide your opening remarks.

[Christine Donoghue, Acting President, Public Service Commission of Canada]

Thank you, Mr. Chair.

I would like to introduce Mr. Michael West, our director general for delegation and accountability, who is with me today.

We are very pleased to be here and to have the opportunity to participate in the work of the committee with respect to chapter 2 of the report of the Auditor General.

As the report notes, the Public Service Commission is responsible for promoting and safeguarding the merit-based appointment system and ensuring that it is free from political influence and, in collaboration with other stakeholders, is responsible for protecting the non-partisan nature of the public service.

The PSC is accountable to Parliament for safeguarding the integrity of staffing in the public service and the political impartiality of public servants. We report independently to Parliament on these matters.

The Public Service Employment Act, as amended in 2005, sets out a staffing system based on values, in which deputy heads have greater responsibilities. The PSC fulfills its mandate by delegating staffing to deputy heads and providing overall policy guidance and tools to assist them in exercising their delegated authorities. We have delegation agreements with 80 departments.

Since 2005, the staffing management accountability framework has set out the PSC's expectation for a well-managed appointment system and has provided a framework for monitoring staffing performance. The PSC has been overseeing the staffing system through regular monitoring and through conducting audits and investigations when needed.

Deputy heads have been submitting self-assessments in the form of departmental staffing accountability reports in which they report on their organization's performance. These provide the commission with the opportunity to assess organizational performance against the staffing management accountability framework and to provide annual feedback to deputy heads.

Based on the overall performance of the staffing system, we have been aiming for continuous improvement and lessening the reporting burden on departments and agencies. A mature staffing system has allowed us to move towards a more effective and efficient model of accountability.

Our efforts to streamline the PSC's reporting requirements have been acknowledged by the Auditor General in the report. We developed a framework in consultation with internal and external stakeholders, including deputy heads. We made it simpler and more focused, with 12 indicators in 2013-14 as compared to 29 in previous years.

A shorter, more concise report makes for a more effective and useful management tool for deputy heads as well as the PSC. Reducing our reporting footprint will allow organizations to put their efforts on addressing their own specific risks that reflect their operational realities and staffing challenges.

Mr. Chair, we have nearly 10 years of experience with a fully delegated system. Our staffing system is maturing and is working well.

Organizations are building their internal capacities to monitor their own staffing processes, and we are confident that this will lead to improved effectiveness and efficiencies. The Public Service Commission is ready and able to assist organizations in further developing these capacities, which would be more targeted to their needs. At the same time, we have invested considerable efforts in developing our own capacity to better utilize the staffing data collected by the commission, which further alleviates the reporting burden while ensuring the overall accountability of the system.

As I mentioned earlier, our audits and investigations also provide important staffing information. ln addition, we have a survey conducted by Statistics Canada that gathers feedback from hiring managers as well as applicants on their experience within the staffing system. Instead of getting their staffing statistics from the Public Service Commission as part of the annual reporting cycle, organizations can now access the latest staffing data through an online portal.

Where we find problems, we work with organizations to resolve them in real time, as quickly as possible. We are therefore moving more and more towards an approach based on identifying horizontal systemic issues.

ln all of our activities, from outreach to oversight, we look for lessons learned, to identify areas for improvement and to take concrete actions. We share good practices to foster continuous improvement. We are also continuing to adapt our requirements, consistent with the recommendations of the Auditor General.

For instance, this year, we asked organizations to focus their reporting on only three key indicators, in areas of particular relevance, based our integrated information. These are official languages qualifications in staffing, areas for ongoing improvements identified in our audits, and priority entitlements.

As you may know, the Public Service Commission is responsible for administering priority entitlements, and we work closely with departments and agencies to ensure that the rights of priority persons are respected. This collaboration will be critical for the implementation of the Veterans Hiring Act, which will provide medically released veterans with greater access to public service jobs.

Let me now turn to the Auditor General's recommendation to systematically adjust required reporting on the basis of its effort, cost and value. PSC is reviewing our policy and oversight frameworks. Our consultations with federal departments and agencies are now underway.

We would like to simplify our policies to remove duplication and minimize overlap while upholding the fundamental principles of the Public Service Employment Act. We also want to more fully integrate all of our staffing information to help organizations and the PSC identify areas where we can improve staffing management and performance.

We will also be looking to remove any unnecessary requirements and to make sure that any reporting considers effort, cost and value. We expect centralized reporting requirements to be reduced, which will reduce the efforts and costs to organizations. With the more fully integrated staffing system we have available, it will be of more value to organizations. We are still at an early stage but we expect that a more integrated approach to the delivery of our policies and oversight functions will provide further opportunities for increased effectiveness and efficiencies.

ln closing, Mr. Chair, we will be working closely with departments and agencies to help them build a stronger culture of prevention while we continue to deliver our fundamental responsibility to provide independent oversight to Parliament on the integrity of the merit-based staffing system and non-partisanship of the public service.

I would be pleased to respond to your questions.

Thank you.

[The Chair, NDP, David Christopherson]

Very good. Thank you.

Now moving over to Treasury Board Secretariat, I see that Mr. Roger Scott-Douglas, assistant secretary, priorities and planning, is to lead off.

I would ask you also to introduce your delegation and then read your opening remarks, sir. You now have the floor.

[Roger Scott-Douglas, Assistant Secretary, Priorities and Planning, Treasury Board Secretariat]

Thank you very much, Mr. Chair. We too are delighted to be here and to help the committee in any way we can with its important work. I'm particularly pleased to be here to speak to the Auditor General's recently tabled report on required reporting by federal organizations.

I'm joined by Bill Matthews, the comptroller general of Canada, and Rita Whittle who is the executive director of security and identity management in our office of the chief information officer branch at the Treasury Board Secretariat.

First, I would like to thank the Office of the Auditor General for their report and recommendations. The issues they examined are extremely important. Reporting is the cornerstone of accountability, transparency and openness.

The Treasury Board is responsible for establishing the rules and the requirements for financial, personnel, and administrative management across government.

As the administrative arm of the Treasury Board, the secretariat supports deputy heads as accounting officers to implement and ensure compliance with Treasury Board policy requirements within their respective departments and agencies. The secretariat in that context requests and collects certain information from departments, as required by Treasury Board policies, to demonstrate compliance and the presence of expected management practices.

The secretariat also collects information in support of legislative and parliamentary requirements. One example is the data for the Main Estimates. Although the secretariat works with departments and agencies to reduce the burden of providing the base information, the requirements for these reports are beyond our control and were appropriately excluded from this audit.

The secretariat is conscious of the fact that preparing and providing reports can place a burden on departments. In recognition of this, the Treasury Board has given the secretariat formal direction on reporting through the foundation framework, which is at the very heart of the Treasury Board policy suite. The framework includes a set of smart reporting principles which state that reporting requirements should respect the oversight responsibilities and accountabilities of deputy heads, have a clear purpose, seek timely information to meet that purpose, and be efficient. That is to say that the cost to create and submit information should be minimal, leverage existing data sources, and not duplicate other requirements.

As an example of the secretariat's commitment to these principles, although it will take some time to put these in place, instead of having to ask departments to report, we are assessing the potential for systems that already have the base information that can be extracted to prepare a report.

As demonstrated by the Office of the Auditor General's report and recommendations, we recognize that there is room for improvement and that there are some more immediate steps that we can take. To this end, the secretariat is committed to the ongoing refinement of the policy suite and finding the right balance between the burden of reporting and the utility of the reports.

As part of our path forward, the secretariat has prepared a management action plan that has been shared with the Auditor General and with this committee.

I would like to conclude by briefly taking the opportunity to provide you with some of the highlights.

The secretariat is updating our guidance to ensure that not only the effort, cost, and value of a report but also the size and mandate of reporting organizations are considered when designing a reporting requirement.

The secretariat is also making a schedule of all reporting requirements publicly available.

The secretariat is reviewing the departmental security plan guidelines to provide effective support to departments in their development, maintenance, and reporting of their plans.

Finally, the secretariat is assessing the feasibility of new reporting mechanisms to more efficiently meet quarterly financial reporting requirements.

Thank you for your time, Mr. Chair. My colleagues and I would be pleased to answer any questions from the committee that we can.

[The Chair, NDP, David Christopherson]

That's very good. Thank you.

Without any further delay we'll begin the usual rotation. We'll kick things off with Mr. Woodworth. You have the floor now, sir.

[Stephen Woodworth, Conservative, Kitchener Centre, ON]

My thanks as always to the Auditor General, the assistant auditor general and staff, and also the departmental officials.

I wish to ask some questions with respect to the departmental security plans. Forgive me for being a little naive, but I notice, Ms. Whittle, your title has the word “security” in it. Does that mean I should direct questions about these departmental security plans to you or to some other group?

[Roger Scott-Douglas]

All of us will do all we can to answer your questions, Mr. Woodworth.

[Stephen Woodworth, Conservative, Kitchener Centre, ON]

In that case, I'll start with you, Mr. Scott-Douglas.

Can you tell me the purpose of the departmental security plans?

[Roger Scott-Douglas]

Yes. It is important that all departments and agencies have a clear sense of the overall risks that their departments are meeting, that they are ensuring that actions against those risks align with the priorities of their departments.

They ensure that they have the appropriate internal governance and overall planning and processes within their departments to do what's needed to ensure the security, to ensure such things as information is properly secured, to ensure they have such things as the appropriate business continuity plans, and the right kind of physical security and cybersecurity. All these important elements are brought together in an integrated plan, which the department security plan is aimed at ensuring.

[Stephen Woodworth, Conservative, Kitchener Centre, ON]

Are department security plans required on an annual basis?

[Roger Scott-Douglas]

They're an evergreen document I think is the best way to put this. It's important always in all areas of management, but most particularly in areas of security, that you keep up to date with those issues before you. It's best to describe them as an ongoing evergreen document.

Deputy heads have responsibility within their organizations to ensure that the planning under the policy on government security is undertaken and that those plans are kept up to date.

[Stephen Woodworth, Conservative, Kitchener Centre, ON]

When the Auditor General tells us that about half the departmental security plans that were due by June 2012 had not been finalized at the time of the audit, does that mean there are no departmental security plans for half the departments?

[Roger Scott-Douglas]

No, it doesn't mean that. At that particular time the approval by deputy heads against their departmental plans was found to exist in about 50% of the departments covered.

Currently, much closer to 80% of departments have their plans either approved or in a state of maturity within their departments, and fully 64% of deputies have signed off on them.

In the case of large departments and agencies where there might be some particular concern, we can tell you that all departments and agencies now have their departmental security plans with their deputies and almost 80% have signed off on them.

[Stephen Woodworth, Conservative, Kitchener Centre, ON]

Does the physical and/or the cybersecurity of a department depend entirely on the contents of the departmental security plan?

[Roger Scott-Douglas]

It's a very important part of it, but it's certainly not the entirety. I think it's important to note that the Auditor General did not audit departmental security practices. They didn't audit the specific actions being taken to ensure that security in all those important areas that I mentioned are being done.

The degree to which those departmental plans had been signed off by their deputy heads was audited.

A great deal of important practices are ongoing every day to ensure that the security of departments in all those important areas is under way.

[Stephen Woodworth, Conservative, Kitchener Centre, ON]

Ms. Cheng, is it correct that the Auditor General did not audit the actual security practices in any given department?

[Nancy Cheng]

That is correct, Mr. Chair. We did not audit the security practices. The audit focus is on the reporting requirement and whether those departmental security plans were formally approved. At the time of the audit, about half of them did not have an approved departmental security plan.

[Stephen Woodworth, Conservative, Kitchener Centre, ON]

That does not equate to saying that half of them have any significant gaps in their security, though, does it? I want to be clear about that.

[Nancy Cheng]

We would not be in a position to comment, because we did not look at those practices.

[Stephen Woodworth, Conservative, Kitchener Centre, ON]

Very good. Thank you very much.

And—

[The Chair, NDP, David Christopherson]

Sorry, Mr. Woodworth, that's time, sir.

Mr. Allen, you now have the floor, sir.

[Malcolm Allen, NDP, Welland, ON]

Thank you to all the witnesses for coming.

Mr. Scott-Douglas, I'd like to keep on the theme that my colleague Mr. Woodworth talked about, and that's the issue of security—albeit, as Ms. Cheng has pointed out, it's really about the auditor looking at the processes and plans; it's not the implementation thereof, but whether there's some structured plan to be secure. I wrote down quickly what I thought I heard you say. Albeit the Auditor General was looking to see that everything would be updated by 2012, you're saying now that 80% are approved and 64% are signed off by deputy heads. Is that correct?

[Roger Scott-Douglas]

Of those departments covered by the Government of Canada's security policy, that's correct.