Evidence of meeting #112 for Public Accounts in the 44th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was kpmg.

A video is available from Parliament.

On the agenda

MPs speaking

Also speaking

Lydia Lee  Partner and National Leader, Digital Health Transformation Practice, KPMG
Hartaj Nijjar  Partner and National Leader, Cybersecurity, KPMG
Clerk of the Committee  Ms. Hilary Smyth

10:05 a.m.

Conservative

The Chair Conservative John Williamson

Good morning, everyone. I'm going to open the session.

Witnesses, I believe you've been instructed on the earpieces. Channel 01 is the English channel. There will be some comments right away en français, so you're welcome to test it out.

Welcome to meeting number 112 of the House of Commons Standing Committee on Public Accounts.

Today's meeting is taking place in a hybrid format. Pursuant to the Standing Orders, members are attending in person in the room and remotely using the Zoom application.

I remind everyone that all comments should be addressed through the chair.

Pursuant to Standing Order 108(3)(g), the committee is resuming consideration of Report 1, 2024 from the Auditor General of Canada, entitled “COVID-19 Pandemic: ArriveCAN”, referred to the Committee on Monday, February 12, 2024.

I'd like to welcome our witnesses from KPMG: Lydia Lee, partner and national leader, digital health transformation practice; and Hartaj Nijjar, partner and national service line leader, cybersecurity.

Ms. Lee, I understand you're going to give an opening statement of five minutes.

I'm going to make a quick comment about today's witnesses, just to set things up for members.

I invited KPMG to come in today. As many of you know, they were not subject to the audit. That is why the Auditor General is not here. The auditor has no authority to audit a private company such as this.

That being said, as you'll recall from the Auditor General's testimony, there were so few documents within the federal government that, as chair, I thought it would be worth having them talk to us about the practices and some of the contact with government.

I expect the questions you're going to get today are going to be along those lines. If you're able to be as forthcoming as possible, the committee would appreciate it.

Without any further ado, Ms. Lee, I'd ask you for your opening statement. You have five minutes. Go ahead, please.

Thank you.

10:05 a.m.

Lydia Lee Partner and National Leader, Digital Health Transformation Practice, KPMG

Thank you, Mr. Chair.

Thank you to the members of the committee for inviting us to contribute to this important conversation about our work with the government during the COVID-19 pandemic. We’re looking forward to answering your questions.

My name is Lydia Lee, and I am a partner and national leader for digital health transformation at KPMG in Canada. I have more than 25 years of experience in the health care sector, including more than 14 years as a senior leader at a hospital prior to joining KPMG. For much of my career, I have focused on health care transformation, and I am very passionate about helping improve the health and lives of Canadians.

I’m joined today by Hartaj Nijjar, a KPMG partner and national leader for cybersecurity. Hartaj has more than two decades of experience assisting some of the world’s largest organizations in matters relating to cybersecurity.

Together, we are here to represent KPMG Canada, which employs more than 10,000 people across the country. KPMG in Canada is fully owned and operated by Canadians. We have been serving Canadian businesses, organizations and communities across the country for over 150 years. Nearly 80% of our clients are small and medium-sized businesses, which are the backbone of our economy.

Our role is to assist our clients, including governments at the federal, provincial and municipal levels, in identifying and closing strategic and operational gaps by providing specialized knowledge and services in areas where support is required. We consider our services to be an important part of our contribution to Canadian society.

We are known for our tax, advisory and auditing services, and, as you know, we are the auditor for the House of Commons. We also provide a comprehensive range of services that help Canadian businesses address many of the most pressing economic and social challenges we face as a country. Notably, these include public health and cybersecurity, which is why we are here to talk to you today.

At the onset of the COVID-19 pandemic, the government urgently looked for outside expertise and invited vendors to respond to a public request for proposals. KPMG responded by competing in this procurement process and was selected as one of six vendors under the COVID emergency professional services, or CEPS, contracting vehicle. This competitive process and the resulting contract provided government departments and agencies with the ability to engage firms like KPMG for specialized global expertise.

Our engagement with the government during the pandemic included work related to the ArriveCAN program, which fell into two streams. The first, which I led, was for the Public Health Agency of Canada. As we are one of Canada’s largest health care advisory firms, the agency looked to us as it dealt with an unprecedented and rapidly evolving pandemic. In particular, we were asked to provide in-depth subject matter expertise and global knowledge to assist in developing policies and procedures for the implementation of the ArriveCAN program. We analyzed how travellers and government operations would be impacted by the evolving policies, supported extensive stakeholder engagement to solicit feedback on emerging issues, and applied international leading practices to help limit the transmission of COVID-19 to Canadians from international travel at air, land and sea border crossings.

Put simply, when the government decided to make the ArriveCAN application mandatory, we identified and helped address the significant implications of that decision for all Canadians, including travellers, government operations officials and those in the travel industry. All of the services we provided were part of the public procurement process.

The second stream was cybersecurity work, conducted by Mr. Nijjar’s team and subcontracted through GC Strategies on behalf of the CBSA. KPMG is known in the field for having strong expertise in cybersecurity. Between October 2021 and March 2022, KPMG provided an independent cybersecurity assessment of the ArriveCAN application. This assessment included a review of practices, procedures and configurations related to the ArriveCAN mobile app, web portals and cloud hosting environment. Our work was completed on time and on budget and was reviewed and approved by the CBSA.

We are very proud of the services that KPMG provided to assist the government during the pandemic. We delivered highly specialized expertise in a time of unprecedented uncertainty for Canadians and the world. We recognize the importance of the committee’s efforts to review this work and to ensure value for money for Canadians. In each case, we delivered our work on time and on budget using the contracting vehicle identified and directed by the government.

Thank you. We’d be happy to take your questions

10:10 a.m.

Conservative

The Chair Conservative John Williamson

Thank you very much.

We'll begin our first round. Each of the four members will have six minutes.

Mr. Barrett, I understand you're up first for the official opposition. It's over to you, please, for six minutes.

10:10 a.m.

Conservative

Michael Barrett Conservative Leeds—Grenville—Thousand Islands and Rideau Lakes, ON

KPMG is one of the biggest accounting firms in the world. How many offices do you have in Canada?

10:10 a.m.

Partner and National Leader, Digital Health Transformation Practice, KPMG

Lydia Lee

I don't actually know the answer off the top of my head, but I would be happy to respond to that question immediately after.

10:10 a.m.

Conservative

Michael Barrett Conservative Leeds—Grenville—Thousand Islands and Rideau Lakes, ON

Do you know how many staff KPMG has in Canada?

10:10 a.m.

Partner and National Leader, Digital Health Transformation Practice, KPMG

Lydia Lee

I'll also try to answer that question. I know that we have about 800 partners. In terms of the total number of staff, again, I would have to get back to you with that answer.

10:10 a.m.

Conservative

Michael Barrett Conservative Leeds—Grenville—Thousand Islands and Rideau Lakes, ON

You said in your opening statement that KPMG was subcontracted by GC Strategies.

Off the top of your head—and it's fair enough that you're not sure, as there are a lot of KPMG offices and hundreds of staff—does KPMG operate any of its offices out of the basements of suburban Ottawa residences?

10:10 a.m.

Partner and National Leader, Digital Health Transformation Practice, KPMG

Lydia Lee

We do not have any businesses run out of basements that we're aware of.

10:10 a.m.

Conservative

Michael Barrett Conservative Leeds—Grenville—Thousand Islands and Rideau Lakes, ON

That's right, so I find it incredible that KPMG, this massive accounting firm, with hundreds and hundreds of staff and dozens and dozens of offices, ends up as a subcontractor for two dudes working out of a basement in suburban Ottawa. How much were you, KPMG, paid by GC Strategies for your work in ArriveCAN?

10:10 a.m.

Hartaj Nijjar Partner and National Leader, Cybersecurity, KPMG

I can take that one, as it relates to the cybersecurity piece of work. We charged GC Strategies $400,000 for the cybersecurity piece of work that we performed for the ArriveCAN app.

10:10 a.m.

Conservative

Michael Barrett Conservative Leeds—Grenville—Thousand Islands and Rideau Lakes, ON

It was cybersecurity work.

10:10 a.m.

Partner and National Leader, Cybersecurity, KPMG

Hartaj Nijjar

Exactly, yes.

10:10 a.m.

Conservative

Michael Barrett Conservative Leeds—Grenville—Thousand Islands and Rideau Lakes, ON

Could ArriveCAN have gotten off the ground without KPMG's contributions?

10:10 a.m.

Partner and National Leader, Cybersecurity, KPMG

Hartaj Nijjar

With respect to the ArriveCAN app, KPMG was not involved in the development of the ArriveCAN app. We were involved in the assessment of the security of the ArriveCAN app, and it was already off the ground when we were assessing it.

10:10 a.m.

Conservative

Michael Barrett Conservative Leeds—Grenville—Thousand Islands and Rideau Lakes, ON

Did KPMG contact the Government of Canada regarding work on ArriveCAN first, or did the Government of Canada contact KPMG first?

10:10 a.m.

Partner and National Leader, Digital Health Transformation Practice, KPMG

Lydia Lee

KPMG initially participated in the CEPS agreement that I mentioned in our opening remarks. We were awarded a spot on that vendor-of-record contracting vehicle in July 2020, and our work was subsequently contracted off that vehicle.

10:10 a.m.

Conservative

Michael Barrett Conservative Leeds—Grenville—Thousand Islands and Rideau Lakes, ON

How many non-competitive contracts related to ArriveCAN was KPMG awarded?

10:10 a.m.

Partner and National Leader, Digital Health Transformation Practice, KPMG

Lydia Lee

What I'd like to say is, first of all, that all of our work was contracted through the government's procurement vehicles that were directed to us—

10:10 a.m.

Conservative

Michael Barrett Conservative Leeds—Grenville—Thousand Islands and Rideau Lakes, ON

That's understood. Just give us the number of non-competitive contracts, please.

10:10 a.m.

Partner and National Leader, Digital Health Transformation Practice, KPMG

Lydia Lee

On the contracts that were directed to KPMG, and I'm talking about the Public Health Agency work at this point, we had a TA that was directed to us through the CEPS vehicle, and then there were two subsequent contracts that were directed to us through the Public Health Agency.

10:10 a.m.

Conservative

Michael Barrett Conservative Leeds—Grenville—Thousand Islands and Rideau Lakes, ON

The number is three.

10:10 a.m.

Partner and National Leader, Digital Health Transformation Practice, KPMG

Lydia Lee

That's for the Public Health Agency-related work.

10:10 a.m.

Conservative

Michael Barrett Conservative Leeds—Grenville—Thousand Islands and Rideau Lakes, ON

Those non-competitive contracts were amended multiple times: yes or no, please.

10:10 a.m.

Partner and National Leader, Digital Health Transformation Practice, KPMG

Lydia Lee

I just want to confirm that the initial TA was through the competitive CEPS vehicle, so that was competitively awarded and then subsequently directed to us.

I'm sorry. Could you repeat the second question, please?