Public Accounts Committee on Oct. 5th, 2017

[Marie Lemay]

I can give you the example of the integrity regime. We improved it, in fact. Now we have all of the versions of company names in our data base.

We are learning and we will continue to learn. Audits like the Auditor General's help us to do that.

[The Chair, Conservative, Kevin Sorenson]

I have two or three other deputies who would like to answer this.

I have Ms. Laurendeau and then Mr. Matthews

[Paul Lefebvre, Liberal, Sudbury, ON]

Yes.

[Hélène Laurendeau]

I would add a brief comment to what my colleague just said. We cannot neglect our internal audit structure either.

Given our large contributions program and the fact that we have a series of partners with whom we transfer a lot of money, the audit process is very systematic. Every year, our audit plan includes one component from our internal control mechanisms, which is audited by our internal audit committee. We make corrections on the basis of the results.

As for fraud allegations, we put in place an audit list. When our auditors start an audit, one element leads them to auditing that aspect as well. I don't want you to get the impression that we work in a strictly linear way, as systematic work also goes on under the radar.

I can tell you quite honestly that my internal audit committee is top-notch. I take their recommendations into account very seriously. The dialogue is very intense, but since these people come from outside, they can help us to see things we can't see from the inside.

I wanted to give you that assurance.

[Paul Lefebvre, Liberal, Sudbury, ON]

Thank you very much.

Mr. Matthews, do you have any comments to add?

[The Chair, Conservative, Kevin Sorenson]

Just as we introduce Mr. Matthews again, let me say that in some sense much of this comes back to Treasury Board, because in the very conclusion of his report, the Auditor General said:

...the Treasury Board...developed guidance for departments and agencies to help them assess and manage overall departmental risks. However, the Secretariat did not provide specific guidance on fraud risk management or monitor how departments and agencies managed their risk of fraud.

Is that part of the role of the Treasury Board now? We've heard from all these departments on how they're going to roll out their measures to fight fraud, The secretariat really has the role of guidance, but also follow-up.

We'll go to Mr. Matthews, in response to Mr. Lefebvre's question.

[Bill Matthews]

There are two things on this.

The first point, concerning the role of Treasury Board, is that it's first of all a policy function. I think you have been given a sense of the varying risks that each deputy's department faces in terms of fraud. Mr. Shugart's risks are very different from the ones faced by Marie Lemay, if you compare a foreign consulate to procurement. When you're looking at policy, you're doing things that are government-wide.

Personally, I think we have the right policy. The question I have in my own head is, have we done enough to ensure that departments' chief financial officers are aware of all the tools out there to help them in assessing fraud risk? What's great about fraud is that it's not unique to the public sector. There is all sorts of guidance out there already on how to do fraud risk assessment.

We'll wait for the committee's report, but one of the questions for us—we're raising awareness now—is whether there is more we can do to formalize some of the tools and practices that are out there.

The other point I would make, in terms of follow-ups—and Madame Laurendeau touched on it—is that internal audit work in this area is important. In addition to the work the AG has done, over the past four years there have been about eight internal audits that have looked at fraud in one capacity or another—either risk management, conflict of interest, or specific to fraud. Every internal audit department in the Government of Canada does follow-ups on the recommendations, so they know the status. Just as the AG follows up on their recommendations and this committee does as well, internal auditors do the same thing. That's an important mechanism, in terms of tracking any previous recommendations.

[The Chair, Conservative, Kevin Sorenson]

Thank you, Mr. Matthews.

Mr. Shugart, did you—?

[Ian Shugart]

I was just expressing sympathy with your task, Chair; I wasn't asking to speak.

[Voices]

Oh, oh!

[The Chair, Conservative, Kevin Sorenson]

Well, thank you. I'm glad there is one person who realizes the heavy burden I bear.

Thank you, Mr. Lefebvre, for continuing on that very good line of questioning.

Mr. Christopherson.

[David Christopherson, NDP, Hamilton Centre, ON]

Thank you, Chair. Is that deputy in the right spot, or what?

Mr. Chair, I appreciate your indulgence. If I could have just a little more, I'd like to come back to the issue of mandatory training. It was an excellent discussion. I'm probably going to be looking to the Auditor General and Mr. Matthews in particular, but I'm open to comments from others.

It would seem that we have a systemic issue facing us at the public accounts committee. Right now, wherever there is a definition of mandatory, to quote Mr. Glover from the beginning of the meeting, “mandatory means mandatory.” As much as we're hard-fisted around here regarding certain things, we try to be fair-minded. I know some people are saying, “Oh, really?”, but we do try to be fair-minded.

I was listening very intently to the responses from the deputies on mandatory training for risk assessment, and I thought there was a lot of logic to them. They made sense.

When the Auditor General had the floor, Chair, he was also being somewhat sympathetic to the idea that 100% isn't necessarily what it takes to be sure that everybody...because you're going to have some people who are transiting; you're going to have people who are changing. There are legitimate reasons. I liked it when I heard that those who are in decision-making positions prioritize what has the greatest impact.

These were, then, good answers from deputies. I want you to know that we do listen. Here, though, is our issue, the problem that we still have systemically, all of us.

First, I'm not sure who makes the decision on what is mandatory in training per se, but the Auditor General has indicated that there's certainly room in his thinking for mandatory to not necessarily mean everybody.

For the purpose of accountability, how do we go about separating, by way of measuring, what really is mandatory from what is not? When you only get 40%, you can't make the argument that systemically something doesn't work because of this, that, and the other; that's all gone. If we separate it out, then we can hold you to account—you, the deputy—in the areas in which you legitimately should be held to account, and we get these other things out of the system.

After all, the numbers would have been different; 59% is only good when you look at it compared with 24%, but 59% is still a better starting point, and it's more accurate.

Chair, I pose to anyone who can help—and I see the Auditor General raising his hand ever so helpfully—the question of how we go about systemically separating out things that really are mandatory, so that when mandatory things are mandatory and are not being done, we're going to be on the case and you're going to be answering why.

Separate out, however, things that legitimately may be.... Mandatory may not be the right word, but to end where I began, I agree with Mr. Glover: if it's mandatory, it means mandatory, but if it's not necessarily mandatory, then let's not measure it that way.

Auditor General, can you help us, sir?

[Michael Ferguson]

I think it is very much definitional. It's a matter of deciding what is mandatory, and then mandatory is mandatory. If a department says that something is mandatory, that's going to attract auditors. We take their word that it's something that has to be in place.

If there is an area in which something doesn't need to be mandatory, then just say it isn't mandatory; don't make it mandatory in that part of the organization.

Probably in this case, if we accept that there's always going to be turnover and ask how we get to 100%, the question can be better dealt with by a clear definition. For instance, a definition could require that within so many days of being hired, it is mandatory for a person in a given position to take a certain type of course.

The problem we have right now and when we do the audit is that when we see that something is mandatory, we go in at a point in time. If somebody has just been hired the day before, it's probably not reasonable to expect that they will have followed their values and ethics training by that day. When we do the audit, we pick a point in time, and there is no definition, really, of what “mandatory” means.

I think that if there is a clear message that a given type of training is mandatory for people in given positions and that mandatory means mandatory within a certain time frame—you have to follow the training in x number of days—then you have something for which the expectation is clear, reasonable, and measurable.

[David Christopherson, NDP, Hamilton Centre, ON]

Mr. Chair, do we have time to go to Mr. Matthews?

[The Chair, Conservative, Kevin Sorenson]

Yes, we do.

We have Mr. Glover first, then Mr. Matthews, and then Ms. Laurendeau.

[Paul Glover]

I would just say that frankly we do this to ourselves as deputy heads—we set the policies for our own organizations. One thing we've realized is that we have to be smarter in our way of delivering our mandatory training. At CFIA, we have about eight modules that are all mandatory. Rather than run eight different courses, we're looking at how we do orientations for new employees, and we put all of those eight modules into one learning so that we can do it all at once.

The same is true when we promote somebody to the managerial level: there are a number of mandatory courses there. Rather than deal with them as separate courses, we're trying to put them together—working with the Canada School, as Deputy Shugart said—to be smarter about the way we deliver them.

With respect to the risk-based comment that I made, I want to underscore that we do that when we're trying to catch up. Rather than “blunt force” treat everybody as equal, when we realize we haven't been where we need to be we prioritize who is trained first.

I would say that we would look at some of those transient workers and say that there probably is a risk and that they should have training around fraud. It's just that when we look at whether we want to spend some time, while we're catching up, training somebody who is only going to be with us a few months rather than an employee who is indeterminate and there for the long term, we choose.

Once we're caught up, we will behave far more rationally. Mandatory will be mandatory, moving forward.

[The Chair, Conservative, Kevin Sorenson]

Thank you, Mr. Glover.

Mr. Matthews.

[Bill Matthews]

Along the same lines, Mr. Chair, I think we are a little blunt when we say mandatory. The mandatory training, government-wide, comes from Treasury Board policies typically. Maybe we need to look at some of the wording when we say mandatory—make it within a certain timeline, as the Auditor General suggested, or maybe just make it a little less blunt.

Within each department, if a deputy decides that something is mandatory for their department, that's their decision. But when you're bumping into the issues government-wide, it's typically a Treasury Board policy.

[The Chair, Conservative, Kevin Sorenson]

Thank you.

Ms. Laurendeau.

[Hélène Laurendeau]

I'll be very brief. The only thing I would add is that in our case, what we are making sure is that when we learn from things that come from audit or a fraud investigation we target the people who absolutely need to have the most detailed knowledge. We do the mandatory training for everybody, because everybody should have a basis, but there are some common job categories for which we really target. That's what we did with the construction fraud. We wanted to make sure we were avoiding the risk of finding out at the end that people didn't know what they should be watching for.

That's all I wish to offer.

[The Chair, Conservative, Kevin Sorenson]

Thank you.

I have Ms. Shanahan down as the next speaker.

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

How many minutes is it for, and are you going to be joining with me?

[Voices]

Oh, oh!

[The Chair, Conservative, Kevin Sorenson]

I may be.

Go ahead. Your time is ticking away.

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

Thank you, Chair.

Thank you, everyone, for being here today. I echo Mr. Christopherson's remarks that this is a rare and very satisfying opportunity for us to be able not only to treat a subject over a couple of meetings but also to have all of you here before us.

I just want to point out for the record that the reason the five agencies are here is that the Auditor General.... Maybe you could comment, Mr. Ferguson, on why you made this choice, but if I look at your report, it's because you were looking for organizations based on their different sizes and types of operations.

Do you want to make a comment on that?