Public Accounts Committee on Oct. 5th, 2017

[The Chair, Conservative, Kevin Sorenson]

Good morning, everyone. This is meeting number 69 of the Standing Committee on Public Accounts.

We are continuing our study of “Report 1, Management of Fraud Risk”, from the spring 2017 reports of the Auditor General of Canada.

I'll remind everyone that we began this on Tuesday. We heard from the various different departments and from our Auditor General on Tuesday. They will not be giving another opening statement. We will carry on the meeting from where we are.

We have returning Mr. Michael Ferguson, the Auditor General of Canada; Paul Glover, president of the Canadian Food Inspection Agency; Bill Matthews, comptroller general of Canada, the Treasury Board Secretariat; Simon Kennedy, deputy minister, the Department of Health; Hélène Laurendeau, deputy minister, the Department of Indian Affairs and Northern Development; Ian Shugart, deputy minister, the Department of Foreign Affairs, Trade and Development; and Marie Lemay, Department of Public Works and Government Services.

We will now proceed with questions from the members. So that we can understand the format here, we're going to begin with how we ended. There are two departments still to report in regard to the mandatory training. Then we will go back to the first round of questioning without hearing another witness.

We thank Mr. Kennedy. He answered the question of Mr. Christopherson in regard to mandatory training. Mr. Christopherson asked how we can be certain any training is being adhered to, when we have training that's laid out and only 20% in some departments are taking that training.

We will now move to Mr. Glover.

[Paul Glover, President, Canadian Food Inspection Agency]

Let me begin by saying that we absolutely agree that 34% is not an acceptable number.

As Mr. Kennedy said earlier this week, we take a risk-based approach to these things, so while it is mandatory, we are targeting those we feel need it the most.

With respect to the number, we have a fair number of transients and students, so if we take out those people who are with the agency for less than three months—because we have surge work during the summer, and other things—that number jumps to 59%. That's still not acceptable—we would agree—but it's higher.

With respect to our inspectors, virtually every inspector who has gone through our prep training before heading out into the field—so, 100% of those—have, after graduating probation, gone through values and ethics training, including the issue of fraud.

With respect to our 1,300 delegated managers who are responsible for signing, they have all had to, again, complete the delegation training, which includes a module on values and ethics.

When we look at some of the areas where we feel there is greatest risk, then I have a certain degree of confidence to share with the committee that we have a number significantly above the 34%. Again, as I said in my opening, that's still not acceptable. That's why, at the beginning of this fiscal year, we wrote into all of my executives' management contracts that mandatory means mandatory, and it is part of their performance objectives to make sure we achieve that.

We will be following up. We are approaching the six-month, mid-year review to give them feedback. We have a quarterly report that is shared with us at the management table to ensure that we are actually doing what we said we would do.

The final thing I would share with the committee in terms of confidence is that we take this very seriously, beyond just the mandatory training. Within the Canadian Food Inspection Agency we have an inspector general's office, whose role is to take a look at the work of inspectors to make sure that, when presented with this information, they take the same or consistent action. That's a way for us to see if somebody is taking action that looks a little different from what would be the norm. In the same way we would mine our procurement data for variabilities that would be flags that there is something a bit off, we look at what our inspectors are doing to make sure they are behaving in a consistent manner.

So, I certainly agree that 34% is not where we need to be. We'll be taking action to increase that number. However, we have been focusing on those areas that are at greater risk. We have also made it mandatory in terms of the performance agreements of our executives, and we will be following up with them to make sure this number is moving up significantly and quickly.

[The Chair, Conservative, Kevin Sorenson]

Thank you very much, Mr. Glover.

We'll now move over Ms. Lemay.

[Marie Lemay, Deputy Minister, Department of Public Works and Government Services]

Thank you very much, Mr. Chair.

We too find this unacceptable, the numbers that we see in the report. I have to say I was surprised by what I saw. I didn't think it reflected the way we actually operate at PSPC.

I'd like to tell you a bit about what we do. Maybe that explains the numbers that we have.

The first thing is that in every letter of employment, the employee signs the letter, and agrees that they will abide by the code of values and ethics. They will look at the conflict of interest and let us know, and fill in the forms within 60 days of their appointment. They undertake the obligation to take the course of values and ethics through that. Now, I think part of the issue—and it goes back to data and collection of data—has been that this is how we verify that and collect that information.

The second thing we do is we focus a lot on the high-risk areas. For that, where the sense of reassurance for us is that no one will get their delegated authority without having taken that course. That was a bit of the check for us.

Again, I'm not sure that we have the appropriate tools to report some of this so what we did was launch, in April, a management system to actually track and help managers track that so we can report on the numbers, be able to track them in time, be able to be sure that we do as, Mr. Glover said, what we said we would do.

We've also introduced a new online ethics awareness tool. We've also introduced a new online course to identify and report fraud and wrongdoing. That was launched in May. I have to say that in preparing for this committee...I'm going to go back and see what areas we're actually going to make it mandatory. I think not leaving it as an option for some of the high-risk areas is going to be important. We're going to do that.

We also have conflict of interest training that was updated in the spring. We have introduced a number of measures since the report to build on what we were doing already. I think the tracking and making sure we have the tools to really ensure that we're doing what we said we would do, that we keep managers and executives aware of that, and we give them the tools to track that, is very important. We've put that in place.

[The Chair, Conservative, Kevin Sorenson]

Okay.

Just on that, so we get it right, are you saying that you don't have the capacity to track? You also said the tools to track. I'm just wondering. What are the tools to track? Isn't it just an Excel document?

[Marie Lemay]

The new system that we have in place is called ALTO. It is an online virtual tracking tool that allows us to follow the training of our employees in a virtual environment, which we didn't do before.

A lot of this was left to the managers to track and make sure employees took the training that they had to do. We're moving from that to really making sure that we have a centralized repository of who's doing what and when, so we can actually go in and make sure that people are doing it.

So, now we have the tools and we do have the capacity to do it.

[The Chair, Conservative, Kevin Sorenson]

All right.

We're going to have a fair bit of time on this. I think we'll now go back to the first round of questioning. We'll eventually get back to it. We'll stay on this question, I'm sure.

We'll go to Mr. Arya, please, for seven minutes.

[Chandra Arya, Liberal, Nepean, ON]

Mr. Chair, I represent the riding of Nepean, in Ottawa. I keep hearing a lot of complaints on the three practices that apparently Treasury Board has accepted that could lead to fraud. The first is contract splitting, that is, unnecessarily dividing a requirement into a number of small contracts. The second is inappropriate contract amendments, and an agreed addition to or deletion from a correction or modification of a contract that is inappropriate. The third is inappropriate sole-source contracting.

I keep hearing quite a bit from a lot of contractors, especially the small contractors, that these are quite widespread in several federal departments.

I would like to ask our deputy ministers to comment on how prevalent these practices are in the contracts awarded by the departments. That's the first question.

Also, the Auditor General also found all organizations had controls for procurement. They had systems to protect and detect fraud, but he points out that these controls were not always applied, even when they were mandated. My second question would be, how many cases have you found where the mandatory checklist was not followed? If they were found, what actions were taken against the managers?

I'll start with the deputy minister for Public Works and Government Services, Ms. Marie Lemay.

[Marie Lemay]

Mr. Chair, if you'll allow me to say so, the comments of the honourable member really resonate with me. This is completely unacceptable. We have practices in place. At PSPC we manage more than 50,000 contracts a year. We have to have a rigorous framework and rigorous processes. If you'll allow me, I'd like to give you a sense of the things we have put in place.

There are obviously the codes of conduct. I said in my opening comments that we have codes of conduct not only for employees but for procurement officers. We also have something that I think is fairly unique: a departmental oversight branch. We have put under one branch the investigations, the good practices. We have an investigation capacity at PSPC to make sure that if we hear or receive complaints we have teams who can look into them, make recommendations, and take appropriate measures.

We introduced, as you probably know, an integrity regime back in 2015. We're starting consultation to see whether we can improve it. Also, just recently—in April—we launched a fraud tip line. That was for us a completing of the circle. It's a partnership with the RCMP and the Competition Bureau. If anybody has a complaint and wants to be—

[Chandra Arya, Liberal, Nepean, ON]

I'm sorry. My time is quite limited. In how many cases have you found fraud, and what actions have you taken against the managers?

[Marie Lemay]

Internally, on a weekly basis now, we do the checks. I'll provide you the numbers; they have improved quite a bit since we started doing this on a weekly basis. We've improved the quality of the data, which is something the Auditor General had identified—

[Chandra Arya, Liberal, Nepean, ON]

Please send the data later. Thanks.

[The Chair, Conservative, Kevin Sorenson]

Mr. Arya is right. So that our deputy ministers understand, he is given just a set number of minutes. Try, therefore, to make your answer as concise as possible so that we get to hear from others as well.

[Chandra Arya, Liberal, Nepean, ON]

Let me move to the Department of Indian Affairs.

[Hélène Laurendeau, Deputy Minister, Department of Indian Affairs and Northern Development]

We've put a few measures in place to make sure we can track these things. Some of them were in place, but some of them have been improved since the report from the Auditor General.

We now have a documentation protocol to ensure consistency in contract hard copy files, allowing us to track better whether there are trends that should be preoccupying us.

We also have bolstered our procurement fraud risk sessions and have made sure that all procurement officers will have increased their awareness in order to be able to detect—because we're focusing on detecting—and then correct as needs be.

We also have launched guidelines on quality assurance—

[Chandra Arya, Liberal, Nepean, ON]

Guidelines? As the Auditor General points out, there are controls in place on paper. His point is that they're not being followed. My question, then, is: when you detect breaches, what are you doing about them?

[Hélène Laurendeau]

When we detect them, we either do an audit or we verify or investigate, if we have any suspicion that there could have been fraud associated with them. If need be, we will take measures to ensure that the situation is corrected, if it's a problem of ignorance or lack of awareness. If we have any indication that there is actually mismanagement, we take the disciplinary measures that are required.

[Chandra Arya, Liberal, Nepean, ON]

Before I come to Mr. Paul Glover, I would like to ask Mr. Shugart a question.

In the missions abroad, there is always a risk of corruption and fraud with respect to immigration cases. Do the visa officers posted in missions abroad administratively come under the jurisdiction of the head of the mission, or is it with the immigration department?

[Ian Shugart, Deputy Minister of Foreign Affairs, Department of Foreign Affairs, Trade and Development]

The procedures would be put in place, and the ultimate authority would be with the Department of Immigration. Functionally, however, on a day-to-day basis the head of mission has responsibility.

[Chandra Arya, Liberal, Nepean, ON]

If there is fraud or a corruption allegation, who exactly deals with it?

[Ian Shugart]

In one such case, we were doing a routine inspection of the mission. Misbehaviour was identified in the course of that, and on the spot we interrupted that individual's functional work and then immediately worked closely with IRCC to conduct the investigation and take the remedial action.

[Chandra Arya, Liberal, Nepean, ON]

I'm still confused. If there's a systemic fraud somewhere, is it ultimately the immigration department that actually manages it?

[Ian Shugart]

Not quite. The individual would be the employee of the immigration department, and therefore the ultimate action and so on would be enforced by immigration at headquarters, but in the post, the head of mission would take the appropriate action. The interaction between the two departments would be immediate so that we would be working together on it.

[The Chair, Conservative, Kevin Sorenson]

Thank you very much. We're out of time.

We now go to Mr. Nuttall, please, for seven minutes.

[Alex Nuttall, Conservative, Barrie—Springwater—Oro-Medonte, ON]

Thank you to each of the deputy ministers for joining us today.

I want to follow up on some questioning from Mr. Christopherson last Tuesday.

It says here that the Auditor General could not calculate the percentage of Global Affairs employees who received training because the department did not have the information needed to make the calculation.

To our representative from Global Affairs, I can imagine what it would be like if this were a CRA audit of one of our private businesses. If they don't have the information, we figure out a way to get that information from those individuals.

Why is this information not kept on hand? Was it misplaced?

In every area of the private sector and government in which I have worked, when there has been a previous request for something in the past, especially from the Auditor General, whether in this department or elsewhere, it is incumbent on the individual, the department, or the business to maintain that information and have it readily available at any point for an audit, because you never know when that's coming.

[Ian Shugart]

I agree that is the standard, and that is the practice that should be followed. We have now remedied that with information tools that will track that data so it is retrievable.

We use the Canada School of Public Service for the delivery of our basic core values and ethics training program, and they do have the information base, the data program that allows for that comprehensive tracking. We can download that for each employee as needed through that system. We're confident that in the future that information will be available, as it is now.

[Alex Nuttall, Conservative, Barrie—Springwater—Oro-Medonte, ON]

Thank you.

It's good to hear about that progress and also the progress at Indigenous and Northern Affairs that took place during the carrying out of this audit.

My second question, Mr. Chair, is through you to the Auditor General.

Just below, it says, “ensure that employees are taking mandatory training in a timely manner.” Is there a definition for what a timely manner looks like? Is it based on the start date of new a employee in a position? Is it the date on which we hit 80% or 90% of the employees?

[Michael Ferguson, Auditor General of Canada, Office of the Auditor General]

We didn't specifically define the term “in a timely manner”. Certainly, I think the results that we found indicate that the issue was more than just new hires who hadn't yet gotten around to taking the course.

I think that is always going to be the case. I think it would be very rare that an organization will get to 100%, because there will be new hires.

Again, I think some of the comments we've heard on this issue mean that there does need to be some reflection on the mandatory aspect of this training. We've heard some things like transient employees, student employees, and things like that. The departments have now said that the training is mandatory for everybody. If it doesn't need to apply to students or somebody else for whatever reason, then don't make it mandatory for them. On the other hand, maybe there should be some other type of program for the transient employees and the student employees.

I think the problem we ran into was that the departments had made this mandatory for every employee in the organization, no matter what. What we're hearing is that most of them are saying that they're actually applying it more on a risk basis, which could make someone ask why then it is mandatory for everybody. If it's only the ones who are the riskiest that this really applies to, then make it mandatory for them, and perhaps adopt some other approach for the rest.

We didn't actually determine the timeliness, but I think there are some fundamental changes the departments need to make, to make sure that the people who are getting the training get the training, and that they get it as quickly as they can. I think it will be up to them to define timeliness. In the end, I think it will come down to a judgment on the reasonableness of their definition of timeliness.

[Alex Nuttall, Conservative, Barrie—Springwater—Oro-Medonte, ON]

Thank you, Auditor General.

Through you, Mr. Chair, this is a comment from the Auditor General's findings:

...there were limited proactive prevention and detection activities. For the three selected contracting practices, we found that none of the federal organizations sufficiently and routinely analyzed contracting data to identify trends and signs of fraudulent behaviour or non-compliance and followed up on exceptions.

Auditor General, was that all of the organizations?

[Michael Ferguson]

Mr. Chair, certainly we did find issues in the different practices in all of the organizations. None of them were doing them all 100%.

[Alex Nuttall, Conservative, Barrie—Springwater—Oro-Medonte, ON]

Very quickly, and I will leave this open for all to answer, with regard to analyzing contract data to determine whether the practices are meeting the requirements of what the Treasury has put out, or the internal controls, say, if we're not checking those over on a routine basis, if we're not ensuring an internal audit, then how are we going to know whether frauds are actually taking place?

[The Chair, Conservative, Kevin Sorenson]

Why don't we start with Mr. Matthews, and we can work our way...?

We have a minute left here. My fear here is that there are so many witnesses, we get to six minutes, we ask a question that we want all the witnesses to answer—

[David Christopherson, NDP, Hamilton Centre, ON]

Who would do that?

[Voices]

Oh, oh!

[The Chair, Conservative, Kevin Sorenson]

—and then the next person goes on a different line of attack.

Mr. Matthews, I'm taking up time. Go ahead.

[Bill Matthews, Comptroller General of Canada, Treasury Board Secretariat]

Thank you, Mr. Chair. I'll be very quick.

I have two points on this. I think there's an issue to be pursued here around the quality and sophistication of our data analytics. That's a cross-government issue that was touched upon on Tuesday. As the tools get more sophisticated, our data is not always as relevant or useful as we'd hope, due to inconsistencies. So it may not be inaccurate, but it may not be consistent. There's some sophistication related to our analytics that has to be improved.

The second piece is with regard to internal audits across the board, done by both my organization and the chief audit executives in each department. The most consistent finding in internal audits is poor documentation. There may not be a justification on file, or something may be missing. It doesn't mean the rule was broken; there's just a lack of evidence.

If I could sort of pull one finding that crosses all audits, we keep bumping into that one.

[The Chair, Conservative, Kevin Sorenson]

On that, this is exactly what we hear on every Auditor General's report, on whatever the issue may be. It is exactly as you say, Mr. Matthews. It is data and documentation: how do we analyze all that documentation? I think these are really challenges to every department. They're challenges we need to find some better way of responding to rather than just some interim way and then we forget about it again.

We will move on now to Mr. Christopherson.

You may want to carry on with the same line of attack.

[David Christopherson, NDP, Hamilton Centre, ON]

Thank you, Chair. I do, actually. I will pick up where you left off, and then I want to return to the previous issue.

Mr. Matthews, you touched right on an issue that the Auditor General has raised as an issue. We've adopted that, and for the next year...we've been trying to focus on this. We should do a review. I think it's with somewhat limited success. We kind of hit the surface of it. But it's the first time, I think, anybody has really come forward and, from a macro point of view in government, acknowledged what the Auditor General is saying. The question now is what do we do about it?

We need to develop some kind of measurement—I guess I'm looking to both you and the Auditor General—but at some point we need some ability to measure whether or not we've been effective in effecting change within these departments. If all we're doing is holding hearings and throwing around some words and phrases, with the odd little headline and then it all goes away, what's really changed? What we're supposed to be about is meaningful, substantive change.

At a macro level, the Auditor General, and now confirmed in the very words of the comptroller, has said, look, we have a data problem. And I think we're echoing that; I'm just not yet convinced that we're getting any traction and any change.

In terms of going forward, I would look to you, Mr. Matthews and Auditor General, to give us some advice. What can we do to be more effective in putting the pressure on government to ensure that there's a cultural change as it relates to data, keeping it current, and analyzing it in a proper, useful way? How can we, as a committee, do that, working with the Auditor General and the management team, to bring about that cultural change? How do we do that? Help us.

[Bill Matthews]

Thank you, Mr. Chair. Maybe I'll start, before I turn to Mr. Ferguson to let him finish off.

I don't want to put words in his mouth, but I would tell you, and this is pure opinion, that the data issue is not new. It's coming to the forefront more and more, because the data analytics tools are becoming more sophisticated—we want to make greater use of data. It's thus putting pressure on our data. The people who are collecting the data are often not the people using the data. We have a cultural issue, in the sense that the accuracy and the relevance of our data are becoming more and more important. We need to drive that cultural issue down to make sure we get accurate data.

If I may offer advice to the committee on what to do, it would be to challenge the data that departments are collecting: is it relevant; is it accurate; how are you using it? Those are the three themes that have to come out.

Mr. Ferguson will likely tell you in a moment that we collect all sorts of data. The question is around how we use it and whether it's the right data. We probably collect more data than we need. For me the real issues are around how we use it.

[David Christopherson, NDP, Hamilton Centre, ON]

Mr. Ferguson.

[Michael Ferguson]

I certainly agree with the committee's challenging the department whenever we are bringing forward issues around data and data quality. The way you just posed the question very clearly sends a message. The fact that the committee is very clear that anybody who is going to be appearing here can expect to get questions about data and that you will continue to challenge it is, I think, a strong message. You need to continue to do so and to continue to reiterate this.

As to what needs to be done to actually fix the problem, the way I keep looking at it—and I think I've said this before to this committee—is to determine whether, if I look at any organization preparing a set of financial statements, the data is good enough in quality.

The quality is there such that we can produce an audit opinion on the set of financial statements. That's because the culture and the environment have been built up to put controls in systems to make sure that what's going into the data is properly captured and recorded. It's my opinion that departments don't have that culture necessarily in all of the other program support systems.

Systems that don't feed into preparing a set of financial statements don't produce a lot of financial information, but they are important perhaps for managing who has taken training or for managing how long it took to resolve a declaration.

When you're dealing with those types of program support systems, which are equally important to making sure that people are getting their values and ethics training and so are a very fundamental issue, the same level of controls isn't applied to the data being entered and to making sure that the data can be used.

The system, then, knows how to make sure that quality data gets entered into a system. The system certainly does it to an acceptable degree to produce a set of financial statements, but it doesn't always do it for the other systems. That's what needs to change. The culture needs to broaden that control-of-data mindset from financial systems only to all their other systems.

[Ian Shugart]

Let me just add from the perspective of a department that the Auditor General said has a number of specific data practices on contract management are in the positive ledger.

I would say that program data—and I agree entirely with what Mr. Ferguson just said—has been developed in departments over many years, typically for each program. The kind of culture we've had in the past has neglected to build in the retrospective data analysis that would then allow program managers and auditors to seek what they seek, which is assurance.

It's the assurance, then—how did you know that the right things were happening?—that has been missing in our program data. Program data systems have been designed to run programs effectively but not to do that last piece, of providing auditors and program managers with assurance.

That's one of the things we've done with our new contract data tool, which asks the kinds of questions needed for monitoring on a comprehensive basis. We now have it implemented as of September—last month—to provide assurance. It is, though, an enormous task to go back over all of the program data systems, retool them, and add that last piece.

[The Chair, Conservative, Kevin Sorenson]

I'm just going to go to Ms. Lemay. She signified that she wanted to answer.

[Marie Lemay]

I have just one bit to add.

One thing we've done concretely—we were using analytical tools and seeing that the data was not good quality—is actually provide training to people who enter the data, so that they really understand what it's being used for. We saw a dramatic increase in the quality, and the results, and that the queries were appropriate ones. That's one thing that's been done that we're seeing success with and that we're going to continue.

[The Chair, Conservative, Kevin Sorenson]

Mr. Chen, please.

[Shaun Chen, Liberal, Scarborough North, ON]

I want to thank the Auditor General and I want to thank the departments for their work. We have a number of deputy ministers and staff here. They do incredible work across the board through our federal government.

I want to stress the importance of accountability and transparency. If there's one thing that I hear a lot from constituents and from Canadians who email or call my office or speak to me in person, it's that they want to make sure that our public dollars are being treated with the utmost accountability and transparency. There are some concerns I have, but I want to comment first on some of the issues around data.

When I read things in an Auditor General's report, such as the example of having company names stored differently in a system, that is unacceptable. That is the most basic of checks that your system should be able to perform on a routine basis. That is a quick name search that identifies similar names within a company, that looks at the address, or that is able to use other factors to flag an issue when you have multiple entries for the same company or firm.

Ultimately, this leads to severe inaccuracies. I don't have the facts, but that could potentially mean that there is contract splitting, by using different company names. That is a simple check that should be taken care of. I won't even bother asking the question because it's too simple of a problem, in my mind.

I want to go on to the next piece, which is around allegations of fraud. Allegations of fraud need to be taken with the utmost seriousness. When somebody from within the public service, or even from outside, decides to step up and make that allegation, it needs to be treated properly. Based on what the Auditor General has written, there's a lot of policy in place, but it's not clear if the issue is being dealt with properly through documentation and logs.

What has happened since the Auditor General raised these concerns? I know that a number of departments are working through making changes. Can I get an update? Does the Auditor General have a sense of where one of the departments might be making good progress and about whether that could be an example for others?

[Michael Ferguson]

Thank you, Mr. Chair.

No. We haven't done any follow-up work on this issue since then, so I think you're better off hearing from the deputies about what they've done since the audit came out.

[The Chair, Conservative, Kevin Sorenson]

How about we begin with Ms. Laurendeau?

[Hélène Laurendeau]

I have a couple of thoughts on that. I think that the committee is raising a very important point. One of the things that we're seized with in our department is the fact that if we want to have continuity in being able to check whether or not things are being complied with, we need to work at the front end. We need to work on how data is tracked, and we also need to do after-the-fact checking.

To be specific about the tracking of allegations, since the report of the Auditor General, we have modified our allegation logs to make sure that we standardize how we capture the information. This is so that we can do the proper follow-up, to see and track some of the measures that we have put in place. If we have started an audit, a forensic audit, or an investigation of some sort, we can actually track until completion what happened to that allegation. They are recorded in the database, and we are capable of asking, on any given day, where we are on all the allegations that we have received.

We have now also included the status of any recommendation that may be coming out of those various ways of investigating those allegations. I'm also very seized with the fact that whatever comes out of these, even if they're unfounded, sometimes they can reveal the fact that some of our employees may not be properly trained.

We don't stop at saying that the allegation was founded or unfounded. We push it a little further and ask ourselves what we have learned from this. We want to know if there is an awareness that we need to extract in order to feed it back into the front end so that people understand, or so that we can actually correct whatever we see. Even if there is no mismanagement or reason for disciplinary measures, we try to extract the learning from every allegation. We do this to address the issue of transparency but also to correct the training that we're providing so that we mitigate errors as much as possible.

[Shaun Chen, Liberal, Scarborough North, ON]

Thank you.

To Global Affairs, I know that to detect potential fraud you have looked at automated tools to look through your procurement data. What progress have you made in that effort?

[Ian Shugart]

On some aspects of the procurement data, the Auditor General said that we were adopting a good practice. On the issue of the allegations of fraud, we have put in place a new case management tool that would satisfy the observation and the recommendation of the Auditor General, including migrating files that were not in that system into the system. Some of that work is completed and the rest of it is on track for completion by the end of the fiscal year.

[The Chair, Conservative, Kevin Sorenson]

You still have 30 seconds, Shaun.

[Shaun Chen, Liberal, Scarborough North, ON]

Very quickly then, once you have investigated an allegation and you have come to some conclusion—and we don't need to talk about specific cases—has there been any broad learning coming out of this? Have there been systemic changes with respect to policy and practices? What has actually come out? To me, there's the investigation and holding people to account, but then there is the question of what we as a department can learn from this and implement, so that we can prevent this from happening ever again.

[Ian Shugart]

I could both answer succinctly and go on at great length on this topic. I'm happy to do that with the committee if there's another round or colleagues want to pursue that further. There have been cases, and we've learned a lot.

[The Chair, Conservative, Kevin Sorenson]

I think we're going to come back to that question again. I'll leave it up to the members.

Welcome, Ms. Boucher, to our committee. It's good to have you here.

You have five minutes.

[Sylvie Boucher, Conservative, Beauport—Côte-de-Beaupré—Île d’Orléans—Charlevoix, QC]

Thank you very much, Mr. Chair. I'm very pleased.

I will split my time with my friend, Alexander Nuttall.

I'm going to put my question in French; I am new at this committee. I'm replacing another member.

Ms. Lemay, you say you have employees in high-risk areas. The people we hire to work in these areas and collect data must have security ratings. If there an allegation of fraud against an employee who has a security rating is borne out, is there some mechanism that will prevent that employee from going to work for another department?

[Marie Lemay]

Thank you for the question.

In our case this would mostly concern procurement, since that is the high-risk sector; employees must of course have a security rating, but we must also provide training so that employees have adequate guidance and have all of the tools they need to do their work.

If fraud is alleged, there is a mechanism that triggers an investigation. Depending on the allegation, an employee can be moved quickly. There are all sorts of consequences of that sort. You can be certain of one thing, and that is that we would never let an employee who has been accused of fraud work on anything having to do with procurement.

What's interesting is that only 4% of complaints having to do with procurement turn out to have a basis in fact, but 30 % of complaints trigger recommendations from our investigation sector. We are improving things in this regard, and we are taking advantage of the opportunity to improve our processes.

[Sylvie Boucher, Conservative, Beauport—Côte-de-Beaupré—Île d’Orléans—Charlevoix, QC]

Thank you.

[The Chair, Conservative, Kevin Sorenson]

Mr. Nuttall.

[Alex Nuttall, Conservative, Barrie—Springwater—Oro-Medonte, ON]

Thank you, Mr. Chair, and thank you to Ms. Boucher.

I come from the finance sector. To sign a contract or to fulfill a contract in the finance sector when I was financing a project, information would be provided to me; I would audit, for lack of a better word, that information; I would then proceed with the contract and fulfill the contract.

It would be audited by somebody above me, and then at the end of the year we would have an audit of all of the deals we had done within our branch of service. Then all of that information would be given to the government to audit, and they would pick a certain number of files.

The culture that exists in the private sector is something we call CYA—“cover your asterisk” is the best way to describe it. Does that culture exist within your departments, or is the culture that exists right now more a case of “do this because you have to” rather than a case that “we need to ensure the quality of the information through the quality of the audit to ensure that our jobs are being done and therefore that we still have them”?

[Bill Matthews]

Maybe I'll start, Mr. Chair, and others obviously may wish to chime in.

The way the government works, there is a policy in procurement that outlines the rules—a Treasury Board policy. PSPC would then have additional guidance that impacts contracting roles.

As a manager, if you wish to put a contract in place, you are typically dealing with a contracting expert. They're the people who would ensure that the policies are complied with, etc. You then have internal audit, who can take a look at whatever contract they like, and the same goes for the Office of the Auditor General: they are free to pick whatever they want to pick to do audits.

The additional piece that you'll see in the public sector is transparency. There is a great deal of disclosure that goes around our contracts. You will thus see sole-source contracts, etc., disclosed on a quarterly basis. My experience is that this transparency piece is as effective a control as all the others put together, because realizing that this is going to be public makes people stop and think.

Don't, therefore, lose sight of that transparency piece. I would tell you that it's probably the biggest difference between the government and the private sector.

[Alex Nuttall, Conservative, Barrie—Springwater—Oro-Medonte, ON]

When you find issues, what percentage of them are due to somebody's coming forward and whistle-blowing, for lack of a better word, or perhaps identifying that the individual doesn't know what the correct procedures are, as opposed to being due to auditing and finding issues within departments?

[Bill Matthews]

I'll start on the audit piece and maybe let Deputy Lemay talk about the whistle-blowing piece.

In my experience under audits, I would say that 99.9% is lack of awareness and improper documentation, sloppy paperwork. Rarely do we bump into fraud issues on the contracting piece.

That, however, is just routine audit. On the whistle-blowing front....

[Marie Lemay]

I could add that of the complaints we get—this is what I was saying earlier—4% to 5% are founded complaints, but again, 30% we learn from.

[The Chair, Conservative, Kevin Sorenson]

Just before we go to Mr. Lefebvre, I want to follow up a little bit on this. We have another committee here on the Hill that is making recommendations to:

Expand the Auditor General of Canada’s mandate to receive disclosures of wrongdoing from the public and reprisal complaints concerning the Office of the Public Sector Integrity Commissioner, with all the related powers and duties of the Public Sector Integrity Commissioner....

and to

Provide the Office of the Public Sector Integrity Commissioner and the Office of the Auditor General of Canada, in the course of an investigation, additional investigative powers, including the authority to demand and use evidence obtained outside the public sector, that are enforceable through a Federal Court order

What that committee, OGGO, is recommending is fairly serious concerning some of this whistle-blower legislation, as I would call it. It's almost giving more powers to the Auditor General's office or to other bodies that would have the ability to be involved.

What do you feel about a recommendation, Mr. Ferguson?

[Michael Ferguson]

I just want to clarify what our role is. When there are those types of allegations, people can bring them to the the Integrity Commissioner, PSIC. They can bring those forward. Our role is to investigate when people have complaints about how PSIC handled one of the allegations. If somebody brings an allegation forward to the Public Sector Integrity Commissioner and feels that organization didn't handle the allegation the right way, they can come to us, and then we can look at how PSIC did it.

Right now, we can't investigate if there's a member of the public saying that PSIC didn't handle an investigation the right way, and we can't investigate certain cases of reprisal within PSIC, so it does not give us a broader mandate in terms of all government departments. It gives us a broader mandate in terms of our role to investigate PSIC if there are complaints about PSIC.

Certainly, it is expanding PSIC's role in terms of investigations.

[The Chair, Conservative, Kevin Sorenson]

I guess the question coming from the table here would be what if individuals bring general information to the Office of the Auditor General.

[Michael Ferguson]

We get cards and letters all the time about issues within government, and we always take those into account in our planning for the types of programs we want to audit.

We don't have any obligation to investigate each and every one of those. We just take that as information to use in our audit planning, so if there are complaints about how government departments are operating, that tends to go through.... People can do that. There are a lot of ways they can do it. They can do it within the departments themselves, or they can avail themselves of the legislation that allows them to go through the Integrity Commissioner.

[The Chair, Conservative, Kevin Sorenson]

If you get a card or a letter with a certain suggestion, what is your response to that? Do you go to that department? Do you relay that information to that department?

[Michael Ferguson]

What we do with all of them is to look into them to gather enough information for us to understand whether it's something for which we already have an audit plan—so we could include that—whether we feel it is something that is telling us there is an area we should audit, or whether it is telling us there is something we should pass on to the internal audit group of the department.

We look at every one of those to determine what the appropriate course of action is, which could be that we decide to do an audit on the program that the individual has complained about.

[The Chair, Conservative, Kevin Sorenson]

I see, thank you.

Mr. Lefebvre, you have five minutes.

[Paul Lefebvre, Liberal, Sudbury, ON]

I still have my five minutes? You didn't use it up?

Thank you, Mr. Chair.

I also thank the witnesses for being here this morning.

I'd like to ask you a few questions regarding the recommendations that were made, and your replies. In fact, I'd like to ask you about your replies, in order to know what you intend to do with the information you will be receiving.

In recommendation 1.39, the auditor general asks you to “[...] identify operational areas at higher risk of fraud and develop targeted training for employees in these areas [...]”.

Ms. Laurendeau, in the reply from Indigenous and Northern Affairs Canada, it says that you will identify areas at high risk of fraud, continue providing targeted fraud training to employees, and ensure that mandatory values and ethics training is completed as required, before September 1, 2017; that date is now past.

How did you in fact determine what constitutes a high fraud risk? Did you also determine the nature of those risks, and measures to mitigate them? It is all well and good to say that you are going to study something and provide training, but I am not reassured about whether or not there will be a follow-up here. It is good to identify the sectors concerned and train people, but afterwards, how are you going to use the data? That is what we are talking about. We obtain the information, we identify the sectors, but what about following up? That remains a constant problem.

Your department said that it would study the issue before September 1, 2017. I'm repeating myself, but how are you going to determine where the high risks of fraud are? How will you do that? What is the nature of the risks, and what measures can you take to mitigate those risks?

[Hélène Laurendeau]

Thank you very much for your question.

In 2014 we conducted a risk assessment of the entire department, and we update that on a continuous basis. This was done in 2016, and the data we collect by consulting all of our employees help us to determine in which sectors there is a greater risk of fraud.

[Paul Lefebvre, Liberal, Sudbury, ON]

Is this done through a meeting, or several meetings? What measures are taken internally?

[Hélène Laurendeau]

We do this in partnership with a private firm that helps us. In 2014, for instance, we hired Deloitte, who helped us to conduct not a survey, but meetings with our employees.

[Paul Lefebvre, Liberal, Sudbury, ON]

Fine.

[Hélène Laurendeau]

That allowed us to collect all of the information and to establish that from one region to the next, including our headquarters, it was this or that type of situation that constituted the greatest risk for the department. During the last update after the 2016 budget, we saw that it was important to take a look at construction contracts, because there had been large investments in infrastructure. We then systematically and proactively identified all of the employees who worked in that area and provided them with specific training on fraud in construction. After preparing a training program, we added a part to our mandatory training so that it covered that aspect as well.

And so our objective is to proactively identify, together with our internal audit committee, which sectors need particular attention with regard to ...

[Paul Lefebvre, Liberal, Sudbury, ON]

Excellent. I really appreciate your answer.

In addition, do you have someone who is responsible for these internal follow-ups? Otherwise, this is done on an ad hoc basis, once a year for instance?

[Hélène Laurendeau]

No. We do it systematically, and regularly. We are about to do a complete update and redo the evaluation conducted in 2014. In 2016, we only did an update.

We are currently in the planning phase to redo that risk assessment, and we intend to make this cyclical, that is to say to do it every two or three years, precisely in order to ensure that we identify the risks and respond. We don't stop there, but we redo assessments in order to see whether new fraud risks emerge so that we can deal with them proactively.

[Paul Lefebvre, Liberal, Sudbury, ON]

Thank you very much.

Mr. Shugart, I'd like to follow up briefly on my colleague's question about lessons learned.

Regarding internal audits, you said that you had taken certain measures and learned lessons from them. Could you briefly explain what you meant by that?

[Ian Shugart]

Recently, as deputy minister, with my more experienced colleagues, I designed a fraud management action plan. It rests on three pillars: first, prevention through training. We already discussed that here.

The second is monitoring and detection.

Finally, we adopted a more coherent approach within the department as to corrective measures, and the disciplinary measures to be taken when necessary.

This is comprehensive. It has involved all of the relevant organizations within the ministry, including our inspectorate general, our internal audit, finance, and human resources, which are the main delivery points we have.

[Paul Lefebvre, Liberal, Sudbury, ON]

I will put the same question to you as to Ms. Laurendeau. Is that approach systematic?

[Ian Shugart]

Yes, it is, absolutely. From the first day, I personally conveyed our concern regarding fraud prevention to our chefs de mission, before they deployed.

Sometimes the involvement of the heads of mission...some of these practices, I think are almost at the level of human judgment and intuition, which even the Auditor General and his team, with respect, are probably not able to detect. They are things like the heads of mission knowing where the storage room is in the mission and what's inside, as opposed to thinking that is the responsibility of somebody else. Also, just being aware of the behaviours of locally engaged staff, so they notice when someone's lifestyle is inconsistent with their income from the mission. Then working with the management and consular officer to keep an eye on the areas of greatest risk and when there is doubt, they call home. I've been explicit with them to call home, call finance, call HR, ask for help, and not just try to figure it out on their own.

[The Chair, Conservative, Kevin Sorenson]

I'll let Mr. Glover answer. He had signified that he wanted to make a very brief comment.

[Paul Glover]

In response to some lessons learned, and trying to knit together some of the other questions, for the part of it around data, we realized we needed to centralize the controls. We had too many systems. We now have one system for procurement. We have a vice-president of the corporate management branch, who looks at all contracts, and a procurement person to see if they're splitting. You talked about the company name. We've moved to a business number that's across all governments, so we're taking steps like that to be able to do it.

With respect to our front-line staff, people will recall Sheila Weatherill's report. With regard to regulatory capture, our inspectors in high-risk locations are now rotated. They don't say there for extended periods of time. So there are a number of very specific lessons learned that have driven real changes in what we do and how we do it, and in our policies.

[The Chair, Conservative, Kevin Sorenson]

Thank you, Mr. Glover.

We'll now move to Ms. Boucher, please.

[Sylvie Boucher, Conservative, Beauport—Côte-de-Beaupré—Île d’Orléans—Charlevoix, QC]

Thank you.

What you are saying seems very interesting. A lot of questions come to mind, but one in particular stays with me.

We all follow the news and read the papers, and we are all aware that certain countries are the victims of cyberfraud. Within the departments you represent, how do you ensure that Canadian data is completely protected? Cyberfraud is not a marginal concern.

I heard all of the witnesses, but no one spoke to this. And so I am raising the question, because this worries me considerably. We hear more and more about cyberfraud, in news reports on television. I would like to know how you make sure that our Canadian data is entirely secure? Are there any mechanisms in place to prevent that kind of fraud?

[The Chair, Conservative, Kevin Sorenson]

We figured it out, sorry.

[Sylvie Boucher, Conservative, Beauport—Côte-de-Beaupré—Île d’Orléans—Charlevoix, QC]

I will put the question to everyone. Does each department have mechanisms in place to protect us against cyberfraud? It is understood that the risk exists.

[The Chair, Conservative, Kevin Sorenson]

Mr. Matthews.

[Bill Matthews]

Thank you for your question.

There are two parts to my answer.

First, certain organizations are responsible for helping the departments protect Canadians' data.

They're not at this table, so I don't want to answer on their behalf in terms of the protocol to properly protect data and systems. The more relevant piece for me is this.

We carried out an internal audit.

This was related to IT security, and it was across government. We had some findings that we have shared with departments and the other organizations to really reinforce best practices about patching your software and things like that. Those were the key findings of the audit—across government and best practices in terms of protecting data. That has been shared with all departments. That's really all I can add on this question for now.

[The Chair, Conservative, Kevin Sorenson]

Was there anyone else on cyber?

Mr. Kennedy.

[Simon Kennedy, Deputy Minister, Department of Health]

We have a plan in place regarding cybersecurity in our department. I can give you an example.

It's popular now to use USB keys on computers to share files. We insist that that type of technology be encrypted, which makes it impossible to use without a code. Now it is practically impossible for anyone to share files without a very secure system. We put this type of measure in place, and we will be bringing in other measures over the next few months.

[Sylvie Boucher, Conservative, Beauport—Côte-de-Beaupré—Île d’Orléans—Charlevoix, QC]

Thank you.

[The Chair, Conservative, Kevin Sorenson]

Mr. Shugart.

[Ian Shugart]

I would simply add that we co-operate with Shared Services Canada, where they have protocols, which allowed us to greatly improve our internal practices and security.

[Sylvie Boucher, Conservative, Beauport—Côte-de-Beaupré—Île d’Orléans—Charlevoix, QC]

Okay.

Thank you very much.

[The Chair, Conservative, Kevin Sorenson]

Thank you. You have another minute if you want it.

[Sylvie Boucher, Conservative, Beauport—Côte-de-Beaupré—Île d’Orléans—Charlevoix, QC]

No thank you.

[The Chair, Conservative, Kevin Sorenson]

Mr. Massé.

[Rémi Massé, Liberal, Avignon—La Mitis—Matane—Matapédia, QC]

Thank you, Mr. Chair.

I thank all of you for being here. I know that appearing before the Standing Committee on Public Accounts requires a certain time to prepare, and I know that your teams provide exceptional support to you. Once again, I thank you for having come here.

The Government of Canada is the largest Canadian employer; it has some 300,000 employees. Of course the fraud risks are significant.

While preparing for this week's meeting, I attempted to find out the number of frauds committed within government in order to see if this is an issue.

I thought I might find a government site, perhaps the Secretariat of the Treasury Board site, where these data might be grouped together, but I did not find any. Perhaps it exists somewhere. So I went to consult every department's website. Frankly, I had to stop after about 20 or 25 minutes, because I was running put of time to do this.

And so I will put the question to the Auditor General.

Following the audit you conducted, can we consider that the scope of fraud makes it an issue? Were you able to compare this year's results with those of previous years? Was the implementation of all of the measures followed by an improvement, the status quo, or did the situation worsen?

[Michael Ferguson]

Thank you for your question.

In paragraph 1.3 of the audit report, we mention that “there is no reliable estimate of the monetary effect of fraud on the Government of Canada”.

We simply presented the issues that are in the report, those that existed at the time the report was prepared. And so it is impossible for me to tell you if the situation has changed.

[Rémi Massé, Liberal, Avignon—La Mitis—Matane—Matapédia, QC]

I will now put a question to Mr. Matthews. His answer will probably be yes, but I'll ask the question anyway.

Given what the Auditor General has just said, and what he mentions in his report, is there any way to centralize this type of information? In this way Canadians and members of Parliament could have a better idea of the situation, know whether the important mechanisms that were put in place did or did not have a significant impact, and determine if the proper measures were taken.

In fact, I am trying to find out whether it would be possible to get a better overall picture of the situation, given that the Government of Canada is the biggest employer in the country.

[Bill Matthews]

Thank you for your question.

As the member said, given the size of the Government of Canada, there will certainly be fraud.

That said, the third volume of the Public Accounts of Canada contains information on the loss of public funds.

That table is the losses that we are aware of. The bigger question is whether there are losses that we're not aware of. That's an impossible question to answer.

What I would tell you is that over the years we have shifted the balance between prevention and detection. In the past, we spent a lot more time auditing, detecting fraud after the fact. We have shifted with a new policy on internal control; I'm going to say it was about five years ago. Departments have to do an ongoing assessment of their internal controls, which includes risk of fraud.

I think one of the questions in this audit is whether that link to fraud and internal controls is explicit enough, or do we have more to do from a policy perspective? That's one of the questions that this audit has us thinking about.

[The Chair, Conservative, Kevin Sorenson]

To quickly interrupt—and then I'll let you go back to that, Mr. Matthews—when you say “we” have this responsibility, are you speaking specifically of Treasury Board?

[Bill Matthews]

No, it's actually a policy that Treasury Board issues. It tasks each department with doing an annual assessment of their internal control environment, on an ongoing basis.

They have to disclose what they've done to monitor the internal control environment. That includes audits, but more importantly preventative measures. They're on the hook, then, to also take action on any known weaknesses. There are known weaknesses. The internal control environment is not perfect.

That, to me, is the biggest shift we've seen, that disclosure and that focus on internal controls.

The take-away for me on this is whether we have done enough to ensure that in that internal control assessment we've put enough emphasis on fraud as being part of it.

[The Chair, Conservative, Kevin Sorenson]

Go ahead, Mr. Massé.

[Rémi Massé, Liberal, Avignon—La Mitis—Matane—Matapédia, QC]

Thank you, Mr. Matthews.

You see my brain has now shifted to English, so I'll shift back to French.

As I was saying earlier, it is important that members and Canadians assess the situation correctly and be able to know if other measures need to be taken. It's important to keep that in mind.

I have another question with regard to the Auditor General's examination. I am staying with the same theme, that is to say the management of fraud allegations.

You say that the Canadian Food Inspection Agency has to keep a complete and exhaustive log to follow up on allegations and the implementation of corrective measures. That recommendation was made because there was no adequate system to manage fraud allegations. The agency said that the corrective measures would be put in place by the end of March 2018.

Mr. Glover, where are we at, six or seven months after the Auditor General's report? I would like to have an update on the actions you have taken.

[Paul Glover]

Thank you for your question.

I am happy to inform you that we are going to put in place the necessary system to collect all of the data to ensure that all of our measures are up to date and coordinated. We increased the number of people who manage the allegations in order to be able to give an answer faster. The turnaround to provide an answer is about 40 days, which is shorter than in the past.

We are confident. There is a continuous improvement process. We are putting the system in place and making sure that it functions as expected and that we have the necessary human resources to manage the fraud allegations.

[The Chair, Conservative, Kevin Sorenson]

Thank you very much. We're two minutes over, actually, Mr. Massé.

[Rémi Massé, Liberal, Avignon—La Mitis—Matane—Matapédia, QC]

You took four minutes of my time.

[The Chair, Conservative, Kevin Sorenson]

Mr. Christopherson, please.

[David Christopherson, NDP, Hamilton Centre, ON]

Thank you, Chair.

I just want to say at the outset of my remarks that this has been a good hearing. I know we were concerned about the number of deputies we were bringing in and trying to fit into our usual time frame. When we do that, we end up so bunched up and squished that we kind of just skate over everything.

I really enjoyed the fact that we had that extra seven-minute round on something this complex, with this many witnesses to really give us the chance to kind of flesh things out. I find that it has been a very good hearing.

I want to thank Mr. Nuttall in particular for picking up where I was, because now I have only a couple minutes left that I want to use to close the issue, at least for me, of the mandatory training, Chair.

I seek some guidance from you. I know that we have an hour. We didn't say what we were going to do with it. We have it for this. I know we also have in camera business.

[The Chair, Conservative, Kevin Sorenson]

Yes, we have about 10 minutes at the end. We'll leave five to 10 minutes for that, so we have lots of time.

[David Christopherson, NDP, Hamilton Centre, ON]

Excellent, that's great.

If I can get the assurance—and it sounds like I have it from you—that I can come back to my two or three minutes on the mandatory training, what I would like to do now, Chair, with your permission, is to throw my formal time that's left in this five-minute slot to Mr. Lefebvre so that he may pick up on where he was because I really thought he was starting to get some traction there.

I think it's in our interest to see that continue.

[The Chair, Conservative, Kevin Sorenson]

We'll throw the schedule away and go back to Mr. Lefebvre with the condition that I allow Mr. Christopherson to come back, maybe on a Liberal timeslot.

Go ahead, Mr. Lefebvre.

[Paul Lefebvre, Liberal, Sudbury, ON]

Thank you, Mr. Christopherson, for that.

I am going to follow in the same vein regarding internal monitoring. Mr. Matthews just talked about this in reply to Mr. Massé's questions.

I would like to go back to examples you provided in your replies, because one thing concerns me. It is all well and good to say that we are going to do internal audits, but how will you do that? I know that those details are determined internally, but we the members of the committee do not have those details. That is the issue. Often if follow-up is not done properly internally, that is where things go wrong.

Ms. Lemay, I know that you have been wanting to say something for a while. Just before, I simply want to give you some idea of where I am going with this.

In a reply regarding employee training and the management of conflicts of interest, you said that in January 2017 another column would be added to declare any conflicts of interest, and that people can choose between “none”, “real”, “potential”, or “apparent”. That was the only answer you gave us.

That worries me a bit. I would like to hear about the follow-up. As you said, you award 50,000 contracts a year. There have to be impeccable internal controls and that is what concerns me.

I know you wanted to speak. I will give you a minute and then I will take back the floor.

[Marie Lemay]

I no longer know which point I wanted to speak to.

Let's talk about conflicts of interest, since that is the topic of your question.

In his report, the Auditor General indicated that Public Services and Procurement Canada had good measures to deal with conflicts of interest. In the letter we give to employees, we ask them to complete a form within 60 days. Afterwards, we assess the conflict, we return the letter to the employee, and we send a copy to the manager.

However, one thing was missing in our system. We had all of the information, but we did not record the decision we made. We shared the decision with the employee and the manager, but it was not entered in our log. So we added that column to make sure that we closed the loop.

There are two other points I'd like to go back to.

First, you asked a question about the internal process. One very important thing changed and that is how we determine the risk profile. It often used to be done according to an ascending process from bottom to top. We changed our approach and now things come from upper management and the employees. As you can see in our risk profile this year, fraud was detected. This is very interesting for us.

There is one last thing I wanted to say. Indeed, internal controls are very important. However, as deputy minister, I believe it is really very important that we give as many opportunities as possible to employees so that they can let us know if something is not right. Consequently, it is very important to create a culture where people and entrepreneurs will feel that they can disclose things and know that we will follow up.

And so we have a multitude of possible entry points. The challenge is that if we do our work well, our numbers are going to increase.

[Paul Lefebvre, Liberal, Sudbury, ON]

That is clear. And that is what we want; it means it's a success.

I want to go back to the risk issue. You are trying to identify all significant fraud risks, naturally. But how do you assess the nature of those risks? And then what measures do you put in place to mitigate those risks? That is what is important.

[Marie Lemay]

Regarding procurement, for instance, we went into further detail. At each step of the process, we have different groups and committees that identify the risks, determine what we are going to do, and what measures we will put in place.

[Paul Lefebvre, Liberal, Sudbury, ON]

And are there people responsible for that at every step along the way?

[Marie Lemay]

Absolutely.

[Paul Lefebvre, Liberal, Sudbury, ON]

We talked about the human aspect and its deficiencies. The Auditor General and Mr. Matthews mentioned this as well. Sometimes, someone may not fill out the questionnaire properly. Nevertheless, we have to have checks and balances and follow-ups. Are you still working to put that in place?

[Marie Lemay]

Absolutely. However, as several of my colleagues said, we are all very aware of the need to deliver the message continually. We don't just do it once, twice, or three times; we do it constantly.

[Paul Lefebvre, Liberal, Sudbury, ON]

This takes us back to the example my colleague just mentioned, that is to say an incorrectly entered address or a mistake in the name of a company. There have to be follow-ups. I think that was not done in the past. Once the entry was made, there was no follow-up.

What mechanisms do you need internally to ensure that best practices are put in place?

[Marie Lemay]

I can give you the example of the integrity regime. We improved it, in fact. Now we have all of the versions of company names in our data base.

We are learning and we will continue to learn. Audits like the Auditor General's help us to do that.

[The Chair, Conservative, Kevin Sorenson]

I have two or three other deputies who would like to answer this.

I have Ms. Laurendeau and then Mr. Matthews

[Paul Lefebvre, Liberal, Sudbury, ON]

Yes.

[Hélène Laurendeau]

I would add a brief comment to what my colleague just said. We cannot neglect our internal audit structure either.

Given our large contributions program and the fact that we have a series of partners with whom we transfer a lot of money, the audit process is very systematic. Every year, our audit plan includes one component from our internal control mechanisms, which is audited by our internal audit committee. We make corrections on the basis of the results.

As for fraud allegations, we put in place an audit list. When our auditors start an audit, one element leads them to auditing that aspect as well. I don't want you to get the impression that we work in a strictly linear way, as systematic work also goes on under the radar.

I can tell you quite honestly that my internal audit committee is top-notch. I take their recommendations into account very seriously. The dialogue is very intense, but since these people come from outside, they can help us to see things we can't see from the inside.

I wanted to give you that assurance.

[Paul Lefebvre, Liberal, Sudbury, ON]

Thank you very much.

Mr. Matthews, do you have any comments to add?

[The Chair, Conservative, Kevin Sorenson]

Just as we introduce Mr. Matthews again, let me say that in some sense much of this comes back to Treasury Board, because in the very conclusion of his report, the Auditor General said:

...the Treasury Board...developed guidance for departments and agencies to help them assess and manage overall departmental risks. However, the Secretariat did not provide specific guidance on fraud risk management or monitor how departments and agencies managed their risk of fraud.

Is that part of the role of the Treasury Board now? We've heard from all these departments on how they're going to roll out their measures to fight fraud, The secretariat really has the role of guidance, but also follow-up.

We'll go to Mr. Matthews, in response to Mr. Lefebvre's question.

[Bill Matthews]

There are two things on this.

The first point, concerning the role of Treasury Board, is that it's first of all a policy function. I think you have been given a sense of the varying risks that each deputy's department faces in terms of fraud. Mr. Shugart's risks are very different from the ones faced by Marie Lemay, if you compare a foreign consulate to procurement. When you're looking at policy, you're doing things that are government-wide.

Personally, I think we have the right policy. The question I have in my own head is, have we done enough to ensure that departments' chief financial officers are aware of all the tools out there to help them in assessing fraud risk? What's great about fraud is that it's not unique to the public sector. There is all sorts of guidance out there already on how to do fraud risk assessment.

We'll wait for the committee's report, but one of the questions for us—we're raising awareness now—is whether there is more we can do to formalize some of the tools and practices that are out there.

The other point I would make, in terms of follow-ups—and Madame Laurendeau touched on it—is that internal audit work in this area is important. In addition to the work the AG has done, over the past four years there have been about eight internal audits that have looked at fraud in one capacity or another—either risk management, conflict of interest, or specific to fraud. Every internal audit department in the Government of Canada does follow-ups on the recommendations, so they know the status. Just as the AG follows up on their recommendations and this committee does as well, internal auditors do the same thing. That's an important mechanism, in terms of tracking any previous recommendations.

[The Chair, Conservative, Kevin Sorenson]

Thank you, Mr. Matthews.

Mr. Shugart, did you—?

[Ian Shugart]

I was just expressing sympathy with your task, Chair; I wasn't asking to speak.

[Voices]

Oh, oh!

[The Chair, Conservative, Kevin Sorenson]

Well, thank you. I'm glad there is one person who realizes the heavy burden I bear.

Thank you, Mr. Lefebvre, for continuing on that very good line of questioning.

Mr. Christopherson.

[David Christopherson, NDP, Hamilton Centre, ON]

Thank you, Chair. Is that deputy in the right spot, or what?

Mr. Chair, I appreciate your indulgence. If I could have just a little more, I'd like to come back to the issue of mandatory training. It was an excellent discussion. I'm probably going to be looking to the Auditor General and Mr. Matthews in particular, but I'm open to comments from others.

It would seem that we have a systemic issue facing us at the public accounts committee. Right now, wherever there is a definition of mandatory, to quote Mr. Glover from the beginning of the meeting, “mandatory means mandatory.” As much as we're hard-fisted around here regarding certain things, we try to be fair-minded. I know some people are saying, “Oh, really?”, but we do try to be fair-minded.

I was listening very intently to the responses from the deputies on mandatory training for risk assessment, and I thought there was a lot of logic to them. They made sense.

When the Auditor General had the floor, Chair, he was also being somewhat sympathetic to the idea that 100% isn't necessarily what it takes to be sure that everybody...because you're going to have some people who are transiting; you're going to have people who are changing. There are legitimate reasons. I liked it when I heard that those who are in decision-making positions prioritize what has the greatest impact.

These were, then, good answers from deputies. I want you to know that we do listen. Here, though, is our issue, the problem that we still have systemically, all of us.

First, I'm not sure who makes the decision on what is mandatory in training per se, but the Auditor General has indicated that there's certainly room in his thinking for mandatory to not necessarily mean everybody.

For the purpose of accountability, how do we go about separating, by way of measuring, what really is mandatory from what is not? When you only get 40%, you can't make the argument that systemically something doesn't work because of this, that, and the other; that's all gone. If we separate it out, then we can hold you to account—you, the deputy—in the areas in which you legitimately should be held to account, and we get these other things out of the system.

After all, the numbers would have been different; 59% is only good when you look at it compared with 24%, but 59% is still a better starting point, and it's more accurate.

Chair, I pose to anyone who can help—and I see the Auditor General raising his hand ever so helpfully—the question of how we go about systemically separating out things that really are mandatory, so that when mandatory things are mandatory and are not being done, we're going to be on the case and you're going to be answering why.

Separate out, however, things that legitimately may be.... Mandatory may not be the right word, but to end where I began, I agree with Mr. Glover: if it's mandatory, it means mandatory, but if it's not necessarily mandatory, then let's not measure it that way.

Auditor General, can you help us, sir?

[Michael Ferguson]

I think it is very much definitional. It's a matter of deciding what is mandatory, and then mandatory is mandatory. If a department says that something is mandatory, that's going to attract auditors. We take their word that it's something that has to be in place.

If there is an area in which something doesn't need to be mandatory, then just say it isn't mandatory; don't make it mandatory in that part of the organization.

Probably in this case, if we accept that there's always going to be turnover and ask how we get to 100%, the question can be better dealt with by a clear definition. For instance, a definition could require that within so many days of being hired, it is mandatory for a person in a given position to take a certain type of course.

The problem we have right now and when we do the audit is that when we see that something is mandatory, we go in at a point in time. If somebody has just been hired the day before, it's probably not reasonable to expect that they will have followed their values and ethics training by that day. When we do the audit, we pick a point in time, and there is no definition, really, of what “mandatory” means.

I think that if there is a clear message that a given type of training is mandatory for people in given positions and that mandatory means mandatory within a certain time frame—you have to follow the training in x number of days—then you have something for which the expectation is clear, reasonable, and measurable.

[David Christopherson, NDP, Hamilton Centre, ON]

Mr. Chair, do we have time to go to Mr. Matthews?

[The Chair, Conservative, Kevin Sorenson]

Yes, we do.

We have Mr. Glover first, then Mr. Matthews, and then Ms. Laurendeau.

[Paul Glover]

I would just say that frankly we do this to ourselves as deputy heads—we set the policies for our own organizations. One thing we've realized is that we have to be smarter in our way of delivering our mandatory training. At CFIA, we have about eight modules that are all mandatory. Rather than run eight different courses, we're looking at how we do orientations for new employees, and we put all of those eight modules into one learning so that we can do it all at once.

The same is true when we promote somebody to the managerial level: there are a number of mandatory courses there. Rather than deal with them as separate courses, we're trying to put them together—working with the Canada School, as Deputy Shugart said—to be smarter about the way we deliver them.

With respect to the risk-based comment that I made, I want to underscore that we do that when we're trying to catch up. Rather than “blunt force” treat everybody as equal, when we realize we haven't been where we need to be we prioritize who is trained first.

I would say that we would look at some of those transient workers and say that there probably is a risk and that they should have training around fraud. It's just that when we look at whether we want to spend some time, while we're catching up, training somebody who is only going to be with us a few months rather than an employee who is indeterminate and there for the long term, we choose.

Once we're caught up, we will behave far more rationally. Mandatory will be mandatory, moving forward.

[The Chair, Conservative, Kevin Sorenson]

Thank you, Mr. Glover.

Mr. Matthews.

[Bill Matthews]

Along the same lines, Mr. Chair, I think we are a little blunt when we say mandatory. The mandatory training, government-wide, comes from Treasury Board policies typically. Maybe we need to look at some of the wording when we say mandatory—make it within a certain timeline, as the Auditor General suggested, or maybe just make it a little less blunt.

Within each department, if a deputy decides that something is mandatory for their department, that's their decision. But when you're bumping into the issues government-wide, it's typically a Treasury Board policy.

[The Chair, Conservative, Kevin Sorenson]

Thank you.

Ms. Laurendeau.

[Hélène Laurendeau]

I'll be very brief. The only thing I would add is that in our case, what we are making sure is that when we learn from things that come from audit or a fraud investigation we target the people who absolutely need to have the most detailed knowledge. We do the mandatory training for everybody, because everybody should have a basis, but there are some common job categories for which we really target. That's what we did with the construction fraud. We wanted to make sure we were avoiding the risk of finding out at the end that people didn't know what they should be watching for.

That's all I wish to offer.

[The Chair, Conservative, Kevin Sorenson]

Thank you.

I have Ms. Shanahan down as the next speaker.

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

How many minutes is it for, and are you going to be joining with me?

[Voices]

Oh, oh!

[The Chair, Conservative, Kevin Sorenson]

I may be.

Go ahead. Your time is ticking away.

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

Thank you, Chair.

Thank you, everyone, for being here today. I echo Mr. Christopherson's remarks that this is a rare and very satisfying opportunity for us to be able not only to treat a subject over a couple of meetings but also to have all of you here before us.

I just want to point out for the record that the reason the five agencies are here is that the Auditor General.... Maybe you could comment, Mr. Ferguson, on why you made this choice, but if I look at your report, it's because you were looking for organizations based on their different sizes and types of operations.

Do you want to make a comment on that?

[Michael Ferguson]

Yes, it was simply that fraud risk is something that every organization faces, whether it's in the federal government, other governments, or in the private sector. When we did this, we wanted to see what a diverse group of organizations were doing, because they all face the same risk. Even though their businesses are different and even though the types of risks they face may be different, they all should be very aware of what their fraud risks are. We wanted to make sure we weren't looking at a bunch of departments that were all the same.

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

Thank you very much, Mr. Ferguson.

I take it that for Treasury Board that's also a consideration. You deal with the whole range of government departments and agencies. Is this something you take into consideration when you're developing your policy?

[Bill Matthews]

That's exactly the issue. When we do a policy, it has to be at a government-wide level.

One thing we'll wrestle with when this committee produces its report and makes its recommendations is what we need to do, if anything, to adjust our guidance. I would tell you that my instinct right now is that the policy is probably at the right level, because of various risks that are so different from department to department. There may, however, be some things we can do from a guidance perspective to help out deputies, chief financial officers, and internal auditors in properly framing the risks related to fraud as they fit underneath our internal control policy.

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

Thank you, Mr. Matthews. That's what we're here for also as a public accounts committee: to help move the process forward, improving it.

The first thing I want to tackle is the action plans. I was glad to have the time to look at everyone's action plans.

The first thing I have to say, and I hate to pick on you, Madame Lemay, is that we have a standard format for the action plan.

Am I right, Mr. Chair and analysts?

[The Chair, Conservative, Kevin Sorenson]

Yes, we do.

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

It may seem picky, but that includes having the number of the recommendation beside the recommendation. Also, there's a final column that is the indicator, for the committee's use, of whether it has been achieved or not. There's a reason for that standard format. We look at a lot of action plans and need to be able to identify quickly where we are. I had the opportunity this morning, because I had five action plans in front of me, to see how people were completing them.

Just one other little thing—because, yes, I am being picky—is this. In recommendation 1.39, the auditor's recommendation is to identify “operational areas”, not “occupational areas”. This is something that happens with our computers' fast programs today, which populate our spelling and so on: sometimes words inadvertently are interchanged. It may seem like a small thing, but it could be a big thing. An expression that I developed when I worked with students is that in university “spellcheck is not brain check”. It's always good to have somebody relooking at something; fresh eyes make a big difference.

Moving on from there, I made an ad hoc table. I took three of the recommendations and each of your organizations, and I looked at the deadlines and at whether you had completed them or not. I'm sure the analyst is going to do a much better job than I have of doing the final table.

What I was looking at was these three recommendations: recommendation 1.54, which is about self-declared conflict of interest; recommendation 1.55, which is the identification of conflict of interest in operational areas of risk; then the data analytics, recommendation 1.71.

What I want to bring attention to is that everybody has a different timeline, and that's entirely appropriate, because while we're looking at the same type of risk, everybody has different challenges in addressing it.

May I ask, Mr. Glover, how things are going with recommendation 1.54? Have you completed it or not? It was listed for April 30, 2017.

[Paul Glover]

Thank you, Mr. Chair, for the member's question.

We have completed it. Compared with the previous 185 days, as the Auditor General found, we're now operating at just 41 days. The system is in place, and we've seen a marked improvement. We'll continue to make efforts to further improve that response time.

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

Excellent.

Mr. Shugart, your completion target is March 2018. Are you still in process. How's it going?

[Ian Shugart]

We have completed part of it. The migration of the case files is complete, and the rest is on track, in our opinion.

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

Good.

You see what I'm doing here. It's not for us to identify the fraud risk in your organizations. We want to make sure that each one of you is doing it and that you're on track.

Madame Lemay, for you the date was January 31, 2017.

[Marie Lemay]

Yes. It is completed.

I want to take the opportunity to thank you for pointing these things out. I apologize for not giving it in the right format. We'll do better next time.

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

Thanks. Sometimes, I think, it's a printing thing, but I checked online, and it was the same issue.

Recommendation 1.55 is the identification of conflict of interest in operational areas of risk. I liked the self-declared; now, how is management identifying operational areas?

Mr. Glover, it is March 31, 2018.

[Paul Glover]

We believe we are well on track to be doing this. We are working very closely with our bargaining agents.

I will say that as a regulatory agency too, we are using this opportunity not just to look at our own internal risk of fraud; a lot of the work that our inspectors do is to find inappropriate behaviour on the regulated parties. We are working collaboratively to deal with both of those issues.

We feel we are well on track to be reviewing our suite of training and to be able to deliver it as per the work plan.

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

Excellent.

Mr. Shugart, you're at January 2018.

[Ian Shugart]

We believe that with respect to those recommendations and actions we're on track.

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

Excellent.

The others were either non-applicable—Department of Health and Department of Public Works, kudos to you—or already in place as they were for Madam Laurendeau and her department.

I have a last question on data analytics, because I know it's been covered elsewhere. What other measures do you have in place to capture instances of inappropriate contracting? I'm going to leave that for my next colleague.

[The Chair, Conservative, Kevin Sorenson]

I don't know if I have anyone else on the speakers list.

Mrs. Shanahan?

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

We know data analytics are important because it's essential to identify where the anomalies are. When I was in banking, one of my old mentors used to tell me not to look for what appears to be good but to look for the error, for what is strange, for what jumps out at you. Don't try to see that everything's fine. If something jumps out at you, that's great. Do data analytics capture everything? I think we know that there are other methods of capturing inappropriate contracting—whistle-blowers, employees.

I was on that study for OGGO, and sometimes it's not like some horrible, fraudulent thing is happening and it's very obvious. Sometimes employees are observing something and they're just not sure about the right way to handle it—whether they should talk about what they see, who they can talk to. There's a legitimate fear of talking about something they see that's not quite kosher, because their own job could be on the line. That's why I like Mr. Shugart's reference to management by walking around, actually going and checking out that storage room and seeing what's in there and having your eyes on what the operations are. I guess I'm looking for those external measures.

Madam Lemay?

[Marie Lemay]

In response to the audit, we are now doing our monitoring every week. As we're getting the analytics better, we realize how important the data quality really is. You can get a lot of small inaccuracies, but then people are not focusing their time on the really important issues that are surfacing. Providing training to people who are actually entering data into those databases reduced the number of false positives. This has been helpful because it allows people to focus on the real things and single out what doesn't look good and then put it through the system for verification and identification.

[The Chair, Conservative, Kevin Sorenson]

Ms. Laurendeau.

[Hélène Laurendeau]

I'm glad to have the opportunity to talk about this, because this is an area where we felt we made some significant progress. From our perspective, we thought that we needed to look at it from different entry points as opposed to being completely linear. We increased the training, but we also did a lot of heavy lifting to make sure that our files were recorded in a standardized way. Through that standardization, we can all capture the same data and compare what we see. We can extract data and examine any funny trends coming out of that. We've done a lot of work in cleaning up our files and training employees to maintain the filing system the same way from coast to coast to coast so that we can do a proper analysis. That was a big piece of work.

The second piece of work was our tracking form, our audit standpoint. People go and check similar things so that we can pick up the things that are not adequate.

The last thing we're working on—and it's not quite completed—is using software analytics to help us speed up and find anomalies in our electronic file. This will allow us to recognize these anomalies, delve a little deeper, find the problems, and spot the trends. I'm confident that we're going to progress significantly in this area in the coming months.

Thank you for the opportunity to mention what we've done.

[The Chair, Conservative, Kevin Sorenson]

Mr. Kennedy.

[Simon Kennedy]

To answer this question, maybe I could harken back to comments from the Auditor General and those of my colleague, Ian Shugart, around the culture and financial reporting, and the way that program managers can be oriented. That's very relevant for my organization.

Health Canada has far-flung operations, including very small operations in northern Ontario and northern Manitoba, and all over the country. Historically, when it came to procurement, it was a much more decentralized model. You had procurement for various kinds of goods and services taking place at different locations across the country.

The impression I have as deputy minister is that when you look at the needs in the delivery of health care services, for example, they're very different depending on the region. Medical transport procurement and the needs are going to look a lot different in northern Ontario and northern Manitoba than they would, say, in a more developed area like maybe outside of Halifax, Nova Scotia. It's not really surprising in some respects, when you hear some of the concerns around how come the names of companies differ slightly and so on. Well, it's because a lot of this is being done by local people using local systems. It all kind of gets rolled up, and when you roll it up you may not get the consistency you want.

In the last two to three years, we have transitioned to a different procurement system. We basically have a single kind of backbone that handles IT and the management of the contracts. It's much more centralized, so it's going through a single pipe. It's all on a single system, and it's much easier, as a result of that, to do data analytics than it was in the old days when we were having to roll up spreadsheets and so on from all across the country.

If I could take the example that the Auditor General gave of accounting, I think a very big difference, culturally, is that with the people we have doing financial management across the country, their primary purpose is to actually give a picture of the financial situation in the department. They're all working off SAP, a common IT backbone. They're all working to very, very standardized rules. As a result, it's a lot easier to get a very good picture of what's going on and to analyze it. I don't think historically that has been the case.

On program delivery, where the people are more focused on delivering the program, the data is important—I wouldn't suggest it's not—but it wasn't really the business that they were in. They were in the business of delivering medical care to people.

I think one of the good things about IT—it has its challenges—is that with the systems we have now, at least in procurement, it's going to be a lot easier for us to do data mining and look for things like contract splitting. Only in the last two to three years, have we had that capability.

[The Chair, Conservative, Kevin Sorenson]

I think out of what you just stated, here could be another area of concern.

A national department on procurement, where you have procurement in British Columbia and Alberta...I don't know if the answer is bringing it all to Ottawa or to a centralized position.

Do directives sometimes battle against each other? For some departments, maybe they would want to decentralize procurement. They want to give other people the opportunities in other parts of the country. I get that, as a member of Parliament. In my constituency, I have people ask, why is it only in Ontario, or why is this procurement only in the Ottawa area ? Why can't the little businesses provide procurement?

If there is a risk of fraud in some of those other areas, you have one battling against another.

[Simon Kennedy]

Mr. Chair, maybe this is bumping up against the one that's in my technical understanding. I think, for us, it's less that it's all being bought in Ottawa—and I'm not quite sure that's the case—but it's more that the change we've made has forced a measure of standardization. It's a common process.

We still have people who are identifying needs and making procurement decisions for the west or for the east—

[The Chair, Conservative, Kevin Sorenson]

But it's centralized—

[Simon Kennedy]

It's kind of centralized. The forms they're using, the fields, and the system and kinds of the process they follow are the same.

I don't want to give the impression that we're all running it out of—

[The Chair, Conservative, Kevin Sorenson]

Good, perfect. Thank you.

Mr. Glover.

[Paul Glover]

Very briefly, Mr. Chair, in response to the questions, as my colleagues have said, we've put a lot of emphasis on prevention, on training, to make sure that people understand their responsibilities.

As Deputy Kennedy said, we've gone to one system. We realized that there were too many, so we have one system. We have a centre of expertise that looks at this to make sure the fields are populated correctly. If we feel there's contract splitting, they don't allow the procurement person to go to that next step.

The oversight is centralized. What's decentralized is that managers are encouraged to manage, to make their own procurement needs. But we've standardized the system. We have a central sort of challenge function that is helping us make sure the data is there that we need, that it's standardized. Then they're the ones who are tasked with doing the data mining to make sure things are working the way they should.

We're also borrowing, as the auditor said, from the financial sector, to look at control frameworks, the stress test, how we do our data mining, what we should be looking for, and working with our departmental audit committee in that same respect.

[The Chair, Conservative, Kevin Sorenson]

Thank you.

Mr. Shugart.

[Ian Shugart]

Risk management is the management of uncertainty. That's what risk is. The member is absolutely right; things will happen. You look for the anomalies. These standardized systems—the use of dashboards in, say, project management—are becoming more pervasive in departments. They are very useful tools; they flag things that seem wrong.

I agree with you entirely, that's what you watch for. It's certainly how I spend a lot of my time.

[The Chair, Conservative, Kevin Sorenson]

Thank you, Mr. Shugart.

Finally, Mr. Matthews.

[Bill Matthews]

Thank you, Mr. Chair.

Maybe we'll just take a glimpse into the future of audit. We've been doing some work over the years with standard audit language, to highlight anomalies that are worth looking into. This is an area that is exploding from an artificial intelligence perspective. Frankly, if you look five years out, you will see this type of analytics applied to almost every transaction, to highlight the risky ones.

We are doing a pilot. We have one brave chief audit executive who has agreed to do a pilot using one of these more advanced artificial intelligence tools on their organization, to be able to say how it works. It is going to change the nature of how we audit. Some of the lessons we learn can, I think, be applied to looking at program data as well.

[The Chair, Conservative, Kevin Sorenson]

Thank you very much.

We are pretty well out of time.

First of all I should say to Mr. Matthews, congratulations. I don't know how many years you have been in Treasury Board, but—

[David Christopherson, NDP, Hamilton Centre, ON]

Thirteen.

[The Chair, Conservative, Kevin Sorenson]

—many, many years. Mr. Matthews will become senior associate deputy minister for the Department of National Defence, as of October 23. Congratulations on that.

[Bill Matthews]

Thank you.

[The Chair, Conservative, Kevin Sorenson]

Maybe there are others of you who are off. I'm not aware. I apologize if there are.

Thank you for appearing before us today.

To the public who might be watching on television today, I just want to conclude by saying that generally speaking, Canadians should rightfully be concerned when they hear of risks of fraud. Compared to many other countries, Canada is a gold standard. Part of the reason we are is the exercise that you have watched today on television or you've been here to see today. We have an Auditor General who has gone through and offered a report on managing the risk of fraud. You've seen five deputy ministers in charge of their departments, here today explaining their action plan, how to manage it and fight the potential fraud, whether it's in immigration, or procurement, or indigenous affairs, or wherever.

Now the public accounts committee has taken the Auditor's General report and asked for the action plan, and is following up on the action plan that Canadians really expect their government to do. I want to thank you for being a part of the formula of making some headway here.

To the committee, I will underscore what Mr. Christopherson, Mr. Nuttall, Ms. Shanahan, and others have said: it's been a good two days here on this issue, Tuesday and today.

Thank you very much for doing it.

To the committee, thank you for your very good work.

We're suspended. We're going to go in camera.

[Proceedings continue in camera]