Public Accounts Committee on Oct. 5th, 2017

[Michael Ferguson]

Yes, it was simply that fraud risk is something that every organization faces, whether it's in the federal government, other governments, or in the private sector. When we did this, we wanted to see what a diverse group of organizations were doing, because they all face the same risk. Even though their businesses are different and even though the types of risks they face may be different, they all should be very aware of what their fraud risks are. We wanted to make sure we weren't looking at a bunch of departments that were all the same.

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

Thank you very much, Mr. Ferguson.

I take it that for Treasury Board that's also a consideration. You deal with the whole range of government departments and agencies. Is this something you take into consideration when you're developing your policy?

[Bill Matthews]

That's exactly the issue. When we do a policy, it has to be at a government-wide level.

One thing we'll wrestle with when this committee produces its report and makes its recommendations is what we need to do, if anything, to adjust our guidance. I would tell you that my instinct right now is that the policy is probably at the right level, because of various risks that are so different from department to department. There may, however, be some things we can do from a guidance perspective to help out deputies, chief financial officers, and internal auditors in properly framing the risks related to fraud as they fit underneath our internal control policy.

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

Thank you, Mr. Matthews. That's what we're here for also as a public accounts committee: to help move the process forward, improving it.

The first thing I want to tackle is the action plans. I was glad to have the time to look at everyone's action plans.

The first thing I have to say, and I hate to pick on you, Madame Lemay, is that we have a standard format for the action plan.

Am I right, Mr. Chair and analysts?

[The Chair, Conservative, Kevin Sorenson]

Yes, we do.

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

It may seem picky, but that includes having the number of the recommendation beside the recommendation. Also, there's a final column that is the indicator, for the committee's use, of whether it has been achieved or not. There's a reason for that standard format. We look at a lot of action plans and need to be able to identify quickly where we are. I had the opportunity this morning, because I had five action plans in front of me, to see how people were completing them.

Just one other little thing—because, yes, I am being picky—is this. In recommendation 1.39, the auditor's recommendation is to identify “operational areas”, not “occupational areas”. This is something that happens with our computers' fast programs today, which populate our spelling and so on: sometimes words inadvertently are interchanged. It may seem like a small thing, but it could be a big thing. An expression that I developed when I worked with students is that in university “spellcheck is not brain check”. It's always good to have somebody relooking at something; fresh eyes make a big difference.

Moving on from there, I made an ad hoc table. I took three of the recommendations and each of your organizations, and I looked at the deadlines and at whether you had completed them or not. I'm sure the analyst is going to do a much better job than I have of doing the final table.

What I was looking at was these three recommendations: recommendation 1.54, which is about self-declared conflict of interest; recommendation 1.55, which is the identification of conflict of interest in operational areas of risk; then the data analytics, recommendation 1.71.

What I want to bring attention to is that everybody has a different timeline, and that's entirely appropriate, because while we're looking at the same type of risk, everybody has different challenges in addressing it.

May I ask, Mr. Glover, how things are going with recommendation 1.54? Have you completed it or not? It was listed for April 30, 2017.

[Paul Glover]

Thank you, Mr. Chair, for the member's question.

We have completed it. Compared with the previous 185 days, as the Auditor General found, we're now operating at just 41 days. The system is in place, and we've seen a marked improvement. We'll continue to make efforts to further improve that response time.

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

Excellent.

Mr. Shugart, your completion target is March 2018. Are you still in process. How's it going?

[Ian Shugart]

We have completed part of it. The migration of the case files is complete, and the rest is on track, in our opinion.

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

Good.

You see what I'm doing here. It's not for us to identify the fraud risk in your organizations. We want to make sure that each one of you is doing it and that you're on track.

Madame Lemay, for you the date was January 31, 2017.

[Marie Lemay]

Yes. It is completed.

I want to take the opportunity to thank you for pointing these things out. I apologize for not giving it in the right format. We'll do better next time.

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

Thanks. Sometimes, I think, it's a printing thing, but I checked online, and it was the same issue.

Recommendation 1.55 is the identification of conflict of interest in operational areas of risk. I liked the self-declared; now, how is management identifying operational areas?

Mr. Glover, it is March 31, 2018.

[Paul Glover]

We believe we are well on track to be doing this. We are working very closely with our bargaining agents.

I will say that as a regulatory agency too, we are using this opportunity not just to look at our own internal risk of fraud; a lot of the work that our inspectors do is to find inappropriate behaviour on the regulated parties. We are working collaboratively to deal with both of those issues.

We feel we are well on track to be reviewing our suite of training and to be able to deliver it as per the work plan.

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

Excellent.

Mr. Shugart, you're at January 2018.

[Ian Shugart]

We believe that with respect to those recommendations and actions we're on track.

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

Excellent.

The others were either non-applicable—Department of Health and Department of Public Works, kudos to you—or already in place as they were for Madam Laurendeau and her department.

I have a last question on data analytics, because I know it's been covered elsewhere. What other measures do you have in place to capture instances of inappropriate contracting? I'm going to leave that for my next colleague.

[The Chair, Conservative, Kevin Sorenson]

I don't know if I have anyone else on the speakers list.

Mrs. Shanahan?

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

We know data analytics are important because it's essential to identify where the anomalies are. When I was in banking, one of my old mentors used to tell me not to look for what appears to be good but to look for the error, for what is strange, for what jumps out at you. Don't try to see that everything's fine. If something jumps out at you, that's great. Do data analytics capture everything? I think we know that there are other methods of capturing inappropriate contracting—whistle-blowers, employees.

I was on that study for OGGO, and sometimes it's not like some horrible, fraudulent thing is happening and it's very obvious. Sometimes employees are observing something and they're just not sure about the right way to handle it—whether they should talk about what they see, who they can talk to. There's a legitimate fear of talking about something they see that's not quite kosher, because their own job could be on the line. That's why I like Mr. Shugart's reference to management by walking around, actually going and checking out that storage room and seeing what's in there and having your eyes on what the operations are. I guess I'm looking for those external measures.

Madam Lemay?

[Marie Lemay]

In response to the audit, we are now doing our monitoring every week. As we're getting the analytics better, we realize how important the data quality really is. You can get a lot of small inaccuracies, but then people are not focusing their time on the really important issues that are surfacing. Providing training to people who are actually entering data into those databases reduced the number of false positives. This has been helpful because it allows people to focus on the real things and single out what doesn't look good and then put it through the system for verification and identification.

[The Chair, Conservative, Kevin Sorenson]

Ms. Laurendeau.

[Hélène Laurendeau]

I'm glad to have the opportunity to talk about this, because this is an area where we felt we made some significant progress. From our perspective, we thought that we needed to look at it from different entry points as opposed to being completely linear. We increased the training, but we also did a lot of heavy lifting to make sure that our files were recorded in a standardized way. Through that standardization, we can all capture the same data and compare what we see. We can extract data and examine any funny trends coming out of that. We've done a lot of work in cleaning up our files and training employees to maintain the filing system the same way from coast to coast to coast so that we can do a proper analysis. That was a big piece of work.

The second piece of work was our tracking form, our audit standpoint. People go and check similar things so that we can pick up the things that are not adequate.

The last thing we're working on—and it's not quite completed—is using software analytics to help us speed up and find anomalies in our electronic file. This will allow us to recognize these anomalies, delve a little deeper, find the problems, and spot the trends. I'm confident that we're going to progress significantly in this area in the coming months.

Thank you for the opportunity to mention what we've done.

[The Chair, Conservative, Kevin Sorenson]

Mr. Kennedy.

[Simon Kennedy]

To answer this question, maybe I could harken back to comments from the Auditor General and those of my colleague, Ian Shugart, around the culture and financial reporting, and the way that program managers can be oriented. That's very relevant for my organization.

Health Canada has far-flung operations, including very small operations in northern Ontario and northern Manitoba, and all over the country. Historically, when it came to procurement, it was a much more decentralized model. You had procurement for various kinds of goods and services taking place at different locations across the country.

The impression I have as deputy minister is that when you look at the needs in the delivery of health care services, for example, they're very different depending on the region. Medical transport procurement and the needs are going to look a lot different in northern Ontario and northern Manitoba than they would, say, in a more developed area like maybe outside of Halifax, Nova Scotia. It's not really surprising in some respects, when you hear some of the concerns around how come the names of companies differ slightly and so on. Well, it's because a lot of this is being done by local people using local systems. It all kind of gets rolled up, and when you roll it up you may not get the consistency you want.

In the last two to three years, we have transitioned to a different procurement system. We basically have a single kind of backbone that handles IT and the management of the contracts. It's much more centralized, so it's going through a single pipe. It's all on a single system, and it's much easier, as a result of that, to do data analytics than it was in the old days when we were having to roll up spreadsheets and so on from all across the country.

If I could take the example that the Auditor General gave of accounting, I think a very big difference, culturally, is that with the people we have doing financial management across the country, their primary purpose is to actually give a picture of the financial situation in the department. They're all working off SAP, a common IT backbone. They're all working to very, very standardized rules. As a result, it's a lot easier to get a very good picture of what's going on and to analyze it. I don't think historically that has been the case.

On program delivery, where the people are more focused on delivering the program, the data is important—I wouldn't suggest it's not—but it wasn't really the business that they were in. They were in the business of delivering medical care to people.

I think one of the good things about IT—it has its challenges—is that with the systems we have now, at least in procurement, it's going to be a lot easier for us to do data mining and look for things like contract splitting. Only in the last two to three years, have we had that capability.

[The Chair, Conservative, Kevin Sorenson]

I think out of what you just stated, here could be another area of concern.

A national department on procurement, where you have procurement in British Columbia and Alberta...I don't know if the answer is bringing it all to Ottawa or to a centralized position.

Do directives sometimes battle against each other? For some departments, maybe they would want to decentralize procurement. They want to give other people the opportunities in other parts of the country. I get that, as a member of Parliament. In my constituency, I have people ask, why is it only in Ontario, or why is this procurement only in the Ottawa area ? Why can't the little businesses provide procurement?

If there is a risk of fraud in some of those other areas, you have one battling against another.

[Simon Kennedy]

Mr. Chair, maybe this is bumping up against the one that's in my technical understanding. I think, for us, it's less that it's all being bought in Ottawa—and I'm not quite sure that's the case—but it's more that the change we've made has forced a measure of standardization. It's a common process.

We still have people who are identifying needs and making procurement decisions for the west or for the east—