Public Accounts Committee on May 14th, 2019

[Sylvain Ricard]

Yes. On page 11 of the Departmental Plan, you can see that the spending total went from $82 million in 2017-2018 to $88 million in 2018-2019.

[René Arseneault, Liberal, Madawaska—Restigouche, NB]

Okay.

[Sylvain Ricard]

That rise is due to economic increases established for the entire government to account for inflation related to salaries. That is what I was referring to earlier. In the requested additional amount, $3.5 million represents economic increases that have been established by the central agency, the Treasury Board Secretariat, for all government employees. To that I add—

[René Arseneault, Liberal, Madawaska—Restigouche, NB]

For the 580 employees?

[Sylvain Ricard]

Yes, approximately.

[René Arseneault, Liberal, Madawaska—Restigouche, NB]

You are talking about just over $3 million for one year?

[Sylvain Ricard]

We have to take into account retroactivity, which goes back to 2014 or 2015, unless I am mistaken. It covers three or four years. Once again, we have applied the rates established by the central agency, as is being done across government. That equals $3.5 million. There is also an amount of $1.4 million intended for computer security.

[René Arseneault, Liberal, Madawaska—Restigouche, NB]

Okay.

Do I have any time left?

[The Chair, Conservative, Kevin Sorenson]

You have one minute.

[René Arseneault, Liberal, Madawaska—Restigouche, NB]

Is it possible to explain the fact that you were unable to submit all the audit reports you would have wanted to submit? Is that solely a matter of financial resources or could it also have to do with the rate of absenteeism, the anticipated retirements or employee illness, for example? Do other factors explain that situation?

[Sylvain Ricard]

We apologize for repeating this so often, but funding is really the issue here. We have seen this coming for a few years. It is a reality. There have been new mandates, computer systems had to be replaced, and so on. As I was saying earlier, the auditor general—

[René Arseneault, Liberal, Madawaska—Restigouche, NB]

Sorry to interrupt, but I have only 20 seconds left and I have a quick question about those computer systems.

Mr. Ricard, reassure me about the security of your computer systems. You were saying that, by 2020-2021 or 2021-2022, you may not have what is needed to ensure the protection of your computer systems. What does that mean?

[Sylvain Ricard]

Like all other organizations, the office must deal with the need to modernize its computer systems, as they are aging and presenting increased risks to computer security. We have identified the most urgent risks, which will be addressed in the next six months. So we have done some of the work, but we have more to do. As long as we have not replaced our aging systems, computer security issues will remain because suppliers no longer fix those systems. All that creates a dynamic where one issue leads to another.

[The Chair, Conservative, Kevin Sorenson]

Thank you, Monsieur Ricard.

We'll now move back to Mr. Kelly, please, for five minutes.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Thank you.

I agree completely with Mr. Christopherson on the importance of the work and the essence of this committee. Some of the answers that we've had to the questions today are somewhat troubling.

I want to go back to your answer to Mr. Davidson's question about the five cancelled...or what were described as either the least important.... I can't remember the other characterization that you used. Every report that I've heard at this committee since I got to this committee was extremely relevant and important to an operation of a department of government and revealed deficiency that was very important for any concerned Canadian who wants to see a service delivered by their government.

If we were at the point where we were receiving reports that seemed somewhat trivial, reports that didn't really have any major concerns in them, I might accept that you have reports that could be cut without harming your overall mandate. However, I have to assume that, with any report that you decided not to write or any audit that you decided not to perform, we've now lost an important piece of accountability.

The Office of the Auditor General is no different from any other department. You have to be accountable for the money that you expend, and we have a responsibility at this committee to hold you accountable for your spending. That was a troubling answer to the question we had before, and it's not one that we're going to be able to solve at this committee.

Can you elaborate at all on what you didn't audit as a result of capacity shortfalls?

[Sylvain Ricard]

As Monsieur Bergin mentioned when he answered the question, he said, “the least important, if I can say it that way,” or along those lines.

Obviously, any audit that we plan is an audit that we believe is of importance. Then we have to make difficult choices. There were combatting cybercrime, protecting Canada's north, heritage services to Canadians, training and learning to deliver services to Canadians, and shared travel solutions within the Government of Canada.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Sorry, what was that last one? Say that again.

[Sylvain Ricard]

It's the travel system, the application that is there for civil servants who make all the travelling arrangements.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Okay. I would have liked to have received all of those reports because I suspect there would be important information any one of them might contain.

If I have a minute left, I want to go back then to the deferred support services.

Are you in any way captive to how other departments deal with these issues? We've heard at this committee about shortcomings or issues with Shared Services Canada. Do other departments, and your interaction with Shared Services, for example, affect your ability to update your software? Are these shortcomings within your control, other than a shortfall in funds, or are you partially held captive by the decisions in other departments?

[Sylvain Ricard]

There's probably a mix, but my initial answer will be that we have control over most of it. If we had the capacity, we would indeed turn to them and fix most of them and be in a better place. We do business through Shared Services Canada for some elements of Internet access and the infrastructure—getting out of the office, if I can put it that way—but the vast majority of what came out of our assessment of where we are on the IT front concerned things we would fix, if we could. We simply don't have the capacity.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Thank you.

[The Chair, Conservative, Kevin Sorenson]

We'll go to Mr. Sarai and then to Mr. Christopherson.

[Randeep Sarai, Liberal, Surrey Centre, BC]

I'm going to ask about the IT systems, which have been asked about quite a bit. I think this issue brings concern in an age of cyber-espionage and cybersecurity. Which IT systems will be at the end of their supported lives? Is it the software you use to actually do the audits, or to store the audits, or...? Can you elaborate on that?

[Sylvain Ricard]

First of all it's a mix. There's a bit of both. Some has to do with replacing them; some has to do with acquiring them.

I'll start with that last part by way of example. For data-analytic types of software, it's having enough people to fully run them. This is directly for audit operations, even though we have also used it internally to do good management analysis of our own spending, let's say, and things such as that, but it's mainly for audit operations. We have some software that has to do with learning and development, such as training in the office. Again, most of our staff are in audit operations, so we're talking about impact on audit operations.

When we do business with an audited entity, we need to exchange information—get information from them and capture it in an automated way to bring it into the audit tool and make it more efficient and simpler for everybody. It's being able to directly, electronically draw from them rather than do paper analysis.

Those are a few examples.

[Randeep Sarai, Liberal, Surrey Centre, BC]

Would you say that the IT software you have is currently not comparable to what is being used in the private sector, such that when you extract that data, the softwares do not interface? Is that the challenge?