Public Accounts Committee on Oct. 5th, 2017

[Ian Shugart]

On some aspects of the procurement data, the Auditor General said that we were adopting a good practice. On the issue of the allegations of fraud, we have put in place a new case management tool that would satisfy the observation and the recommendation of the Auditor General, including migrating files that were not in that system into the system. Some of that work is completed and the rest of it is on track for completion by the end of the fiscal year.

[The Chair, Conservative, Kevin Sorenson]

You still have 30 seconds, Shaun.

[Shaun Chen, Liberal, Scarborough North, ON]

Very quickly then, once you have investigated an allegation and you have come to some conclusion—and we don't need to talk about specific cases—has there been any broad learning coming out of this? Have there been systemic changes with respect to policy and practices? What has actually come out? To me, there's the investigation and holding people to account, but then there is the question of what we as a department can learn from this and implement, so that we can prevent this from happening ever again.

[Ian Shugart]

I could both answer succinctly and go on at great length on this topic. I'm happy to do that with the committee if there's another round or colleagues want to pursue that further. There have been cases, and we've learned a lot.

[The Chair, Conservative, Kevin Sorenson]

I think we're going to come back to that question again. I'll leave it up to the members.

Welcome, Ms. Boucher, to our committee. It's good to have you here.

You have five minutes.

[Sylvie Boucher, Conservative, Beauport—Côte-de-Beaupré—Île d’Orléans—Charlevoix, QC]

Thank you very much, Mr. Chair. I'm very pleased.

I will split my time with my friend, Alexander Nuttall.

I'm going to put my question in French; I am new at this committee. I'm replacing another member.

Ms. Lemay, you say you have employees in high-risk areas. The people we hire to work in these areas and collect data must have security ratings. If there an allegation of fraud against an employee who has a security rating is borne out, is there some mechanism that will prevent that employee from going to work for another department?

[Marie Lemay]

Thank you for the question.

In our case this would mostly concern procurement, since that is the high-risk sector; employees must of course have a security rating, but we must also provide training so that employees have adequate guidance and have all of the tools they need to do their work.

If fraud is alleged, there is a mechanism that triggers an investigation. Depending on the allegation, an employee can be moved quickly. There are all sorts of consequences of that sort. You can be certain of one thing, and that is that we would never let an employee who has been accused of fraud work on anything having to do with procurement.

What's interesting is that only 4% of complaints having to do with procurement turn out to have a basis in fact, but 30 % of complaints trigger recommendations from our investigation sector. We are improving things in this regard, and we are taking advantage of the opportunity to improve our processes.

[Sylvie Boucher, Conservative, Beauport—Côte-de-Beaupré—Île d’Orléans—Charlevoix, QC]

Thank you.

[The Chair, Conservative, Kevin Sorenson]

Mr. Nuttall.

[Alex Nuttall, Conservative, Barrie—Springwater—Oro-Medonte, ON]

Thank you, Mr. Chair, and thank you to Ms. Boucher.

I come from the finance sector. To sign a contract or to fulfill a contract in the finance sector when I was financing a project, information would be provided to me; I would audit, for lack of a better word, that information; I would then proceed with the contract and fulfill the contract.

It would be audited by somebody above me, and then at the end of the year we would have an audit of all of the deals we had done within our branch of service. Then all of that information would be given to the government to audit, and they would pick a certain number of files.

The culture that exists in the private sector is something we call CYA—“cover your asterisk” is the best way to describe it. Does that culture exist within your departments, or is the culture that exists right now more a case of “do this because you have to” rather than a case that “we need to ensure the quality of the information through the quality of the audit to ensure that our jobs are being done and therefore that we still have them”?

[Bill Matthews]

Maybe I'll start, Mr. Chair, and others obviously may wish to chime in.

The way the government works, there is a policy in procurement that outlines the rules—a Treasury Board policy. PSPC would then have additional guidance that impacts contracting roles.

As a manager, if you wish to put a contract in place, you are typically dealing with a contracting expert. They're the people who would ensure that the policies are complied with, etc. You then have internal audit, who can take a look at whatever contract they like, and the same goes for the Office of the Auditor General: they are free to pick whatever they want to pick to do audits.

The additional piece that you'll see in the public sector is transparency. There is a great deal of disclosure that goes around our contracts. You will thus see sole-source contracts, etc., disclosed on a quarterly basis. My experience is that this transparency piece is as effective a control as all the others put together, because realizing that this is going to be public makes people stop and think.

Don't, therefore, lose sight of that transparency piece. I would tell you that it's probably the biggest difference between the government and the private sector.

[Alex Nuttall, Conservative, Barrie—Springwater—Oro-Medonte, ON]

When you find issues, what percentage of them are due to somebody's coming forward and whistle-blowing, for lack of a better word, or perhaps identifying that the individual doesn't know what the correct procedures are, as opposed to being due to auditing and finding issues within departments?

[Bill Matthews]

I'll start on the audit piece and maybe let Deputy Lemay talk about the whistle-blowing piece.

In my experience under audits, I would say that 99.9% is lack of awareness and improper documentation, sloppy paperwork. Rarely do we bump into fraud issues on the contracting piece.

That, however, is just routine audit. On the whistle-blowing front....

[Marie Lemay]

I could add that of the complaints we get—this is what I was saying earlier—4% to 5% are founded complaints, but again, 30% we learn from.

[The Chair, Conservative, Kevin Sorenson]

Just before we go to Mr. Lefebvre, I want to follow up a little bit on this. We have another committee here on the Hill that is making recommendations to:

Expand the Auditor General of Canada’s mandate to receive disclosures of wrongdoing from the public and reprisal complaints concerning the Office of the Public Sector Integrity Commissioner, with all the related powers and duties of the Public Sector Integrity Commissioner....

and to

Provide the Office of the Public Sector Integrity Commissioner and the Office of the Auditor General of Canada, in the course of an investigation, additional investigative powers, including the authority to demand and use evidence obtained outside the public sector, that are enforceable through a Federal Court order

What that committee, OGGO, is recommending is fairly serious concerning some of this whistle-blower legislation, as I would call it. It's almost giving more powers to the Auditor General's office or to other bodies that would have the ability to be involved.

What do you feel about a recommendation, Mr. Ferguson?

[Michael Ferguson]

I just want to clarify what our role is. When there are those types of allegations, people can bring them to the the Integrity Commissioner, PSIC. They can bring those forward. Our role is to investigate when people have complaints about how PSIC handled one of the allegations. If somebody brings an allegation forward to the Public Sector Integrity Commissioner and feels that organization didn't handle the allegation the right way, they can come to us, and then we can look at how PSIC did it.

Right now, we can't investigate if there's a member of the public saying that PSIC didn't handle an investigation the right way, and we can't investigate certain cases of reprisal within PSIC, so it does not give us a broader mandate in terms of all government departments. It gives us a broader mandate in terms of our role to investigate PSIC if there are complaints about PSIC.

Certainly, it is expanding PSIC's role in terms of investigations.

[The Chair, Conservative, Kevin Sorenson]

I guess the question coming from the table here would be what if individuals bring general information to the Office of the Auditor General.

[Michael Ferguson]

We get cards and letters all the time about issues within government, and we always take those into account in our planning for the types of programs we want to audit.

We don't have any obligation to investigate each and every one of those. We just take that as information to use in our audit planning, so if there are complaints about how government departments are operating, that tends to go through.... People can do that. There are a lot of ways they can do it. They can do it within the departments themselves, or they can avail themselves of the legislation that allows them to go through the Integrity Commissioner.

[The Chair, Conservative, Kevin Sorenson]

If you get a card or a letter with a certain suggestion, what is your response to that? Do you go to that department? Do you relay that information to that department?

[Michael Ferguson]

What we do with all of them is to look into them to gather enough information for us to understand whether it's something for which we already have an audit plan—so we could include that—whether we feel it is something that is telling us there is an area we should audit, or whether it is telling us there is something we should pass on to the internal audit group of the department.

We look at every one of those to determine what the appropriate course of action is, which could be that we decide to do an audit on the program that the individual has complained about.

[The Chair, Conservative, Kevin Sorenson]

I see, thank you.

Mr. Lefebvre, you have five minutes.

[Paul Lefebvre, Liberal, Sudbury, ON]

I still have my five minutes? You didn't use it up?

Thank you, Mr. Chair.

I also thank the witnesses for being here this morning.

I'd like to ask you a few questions regarding the recommendations that were made, and your replies. In fact, I'd like to ask you about your replies, in order to know what you intend to do with the information you will be receiving.

In recommendation 1.39, the auditor general asks you to “[...] identify operational areas at higher risk of fraud and develop targeted training for employees in these areas [...]”.

Ms. Laurendeau, in the reply from Indigenous and Northern Affairs Canada, it says that you will identify areas at high risk of fraud, continue providing targeted fraud training to employees, and ensure that mandatory values and ethics training is completed as required, before September 1, 2017; that date is now past.

How did you in fact determine what constitutes a high fraud risk? Did you also determine the nature of those risks, and measures to mitigate them? It is all well and good to say that you are going to study something and provide training, but I am not reassured about whether or not there will be a follow-up here. It is good to identify the sectors concerned and train people, but afterwards, how are you going to use the data? That is what we are talking about. We obtain the information, we identify the sectors, but what about following up? That remains a constant problem.

Your department said that it would study the issue before September 1, 2017. I'm repeating myself, but how are you going to determine where the high risks of fraud are? How will you do that? What is the nature of the risks, and what measures can you take to mitigate those risks?

[Hélène Laurendeau]

Thank you very much for your question.

In 2014 we conducted a risk assessment of the entire department, and we update that on a continuous basis. This was done in 2016, and the data we collect by consulting all of our employees help us to determine in which sectors there is a greater risk of fraud.

[Paul Lefebvre, Liberal, Sudbury, ON]

Is this done through a meeting, or several meetings? What measures are taken internally?

[Hélène Laurendeau]

We do this in partnership with a private firm that helps us. In 2014, for instance, we hired Deloitte, who helped us to conduct not a survey, but meetings with our employees.