The first thing I would say is that we have to look at the two or three lines of defence.
The first line of defence is based within the information, science and technology branch. It was responsible for the ArriveCAN app, for the development and operation of that application. We have over 1,600 delegated financial officers within the agency, and about 900 of those are based at headquarters. Quite a large number of those individuals are based in the border technologies innovation directorate, which was directly responsible for the development of the app and also for the contracting functions, working with PSPC.
What we were doing there was looking at the failures of the first line of defence. We have no doubt that there were failures in the first line of defence in terms of governance, oversight and record-keeping, and all of those things are lessons we have learned. They're also, potentially, subject to investigation to look at whether there was any wrongdoing in some of those failures. We recognize that there were failures, but we're not entirely sure of the exact reasons for those failures—whether they were from the stress of the pandemic or whether there was any wrongdoing included with that. We should wait for the investigations to conclude on that matter.
The second line of defence is where the comptrollership branch is involved. Every year, we take a sample of about 5,000 non-pay transactions to see if they are being properly processed. On average, we find about 9% to 10% have errors. That is not satisfactory to us; our target is less than 5%. We were very disappointed to see the Auditor General's report, which identified that 18% have those errors. We are looking into the reasons for that, and one of those reasons is that there wasn't a separate cost centre code. There was an administrative error in that the individual invoices were not being coded to the right account because we didn't have a separate code.
Those were really the basic functions of the first and second lines of defence.