Mr. Chair, this is very unusual in the stable of organizations that we support. We would either be working directly with a Crown agency, such as the Space Agency or Statistics Canada—there are a number of these in our portfolio—or we would be engaging with a third party that would be an agent to deliver against a very specific set of criteria in terms of what we're asking them to do.
This is a very different circumstance. This is an independent organization. They are flowed money through our contribution agreement, but many of the choices and decisions about how they structure their programming, about how they govern themselves and their various processes, are with the board and the management team. That doesn't remove the obligation on ISED to be carefully monitoring and overseeing the contribution agreement, but the design is such that a lot of the day-to-day aspects of how the business is done is entirely the responsibility of the board.
The lesson here is that even with a board of private sector experts brought in to provide oversight, the kinds of activities we undertook to ensure the contribution agreement was being followed—reviewing minutes, doing regular evaluations, even sitting in on meetings—wasn't sufficient to identify these problems and correct them.
I would make the following analogy. If you're a large bank, a private sector organization, you have a board. The board is composed of people who are experts and are well regarded. They actually have the responsibility for the oversight of the bank. However, when it comes to things like finances or certain kinds of issues, like cybersecurity, they have a third party, like an accounting firm, that comes in and audits the books and independently verifies that the bank is doing what it's supposed to do.
We did not have the kinds of control frameworks that might have actually caught these kinds of issues. There was too much reliance on what I might call more informal processes, like reviewing the minutes. The Auditor General has noted that the minutes occasionally didn't include the kind of information you would need. Even if you were reviewing the minutes, if the minutes aren't complete, you're not going to catch the issues.
What I can assure the committee, in terms of the fallout from this episode, is that under the action plan, we're replacing these measures with much more formal control processes, requiring sign-off by a senior official, requiring regular auditing, requiring third-party validation. The checking of the homework of the board is going to be much more diligent and much more rigorous.
The observation I would make is that if there's a lesson here, it's that even for an organization with a well-regarded board, there needs to be additional infrastructure to closely verify whether a board is following its own rules.