Public Accounts Committee on Dec. 2nd, 2025

[Harpreet S. Kochhar]

Sure. What was asked of us was to actually clarify what tangible things we were looking for in that. There were questions asked about clarity on what we were requiring. We actually did answer those questions. We also shared those answers with all the people who were bidding for that one.

[Kristina Tesser Derksen, Liberal, Milton East—Halton Hills South, ON]

I'm going to follow up with one more.

I believe the Auditor General did have a concern about some of the data tracking or collection with one set of.... I don't have it right in front of me, but there was one contractor or one bidder where there didn't seem to be a lot of data about their concerns or the responses that IRCC gave.

Are you familiar with that particular case?

[Harpreet S. Kochhar]

I'll have to turn to my colleagues, because that might help.

[Jason Choueiri, Senior Assistant Deputy Minister and Chief Digital Officer, Client Service, Innovation, Department of Citizenship and Immigration]

Thank you.

There were questions around the requirement for the level of expertise and the proof of having done similar kinds of work at the scale that we were asking for. There was a request for us to change some of the criteria. We did not accept that. That's where that question came and that was follow-up on that.

The OAG's point was that we did not document, necessarily, all the details of the rationale. We now require, as part of all our processes, a detailed rationale. We have a disposition log for all our processes today.

[Kristina Tesser Derksen, Liberal, Milton East—Halton Hills South, ON]

Out of the report and out of that recommendation, you've already addressed how you're going to correct that in the future going forward.

Have you seen any actual, tangible positive results from implementing that new policy?

[Jason Choueiri]

We have implemented it with several of our recent competitive processes. We've engaged very collaboratively with industry. This has created a much richer kind of experience and a better set of bids at the end of the process. Yes, we've seen positive aspects of this.

[The Chair, Conservative, John Williamson]

Thank you.

I'm afraid that is the time. I'm sure we'll come back and pick this up.

Mr. Lemire, you have the floor for six minutes.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Thank you Mr. Chair.

Thank you to all the witnesses for being here.

My first few questions will be for Mr. Kochhar.

The Century Initiative, a group created by McKinsey's top boss, Dominic Barton, has had a huge impact on the policies of Immigration, Refugees and Citizenship Canada, or IRCC. Even today, we live in a world where the intake capacity of both Canada and Quebec is feeling the consequences.

However, IRCC officials had warned you. In 2022, in a report entitled “Population Growth and Housing Supply”, Matthew Saayman, an IRCC policy analyst, wrote that policy‑makers, in their role as immigration managers, must be aware of the misalignment between population growth and housing supply, as well as how permanent and temporary immigration affects population growth.

Why did you listen to a private management firm and pay it millions of dollars when your own officials already had the expertise and skills to develop your immigration policies?

[Harpreet S. Kochhar]

The immigration levels we submit every year to Parliament are presented based on a lot of consultation with different stakeholders. That is how they are presented. They are not based on any specific individual or entity's ideas on how to grow the population.

In this specific case, if I am understanding the question correctly, it is about us trying to actually get information from different sources. For example, when we presented the immigration level plan this year, we consulted over 1,200 stakeholders, which included different chambers of commerce, different academics and so on, so it was a part of that.

While our internal policy people also gave us advice, we actually put it all together to see what would be the best outcome. This year, for example, in 2025, which was presented in 2024, we changed course and reduced the number of permanent residents. That was the first time in the last 12 years that we have gone down rather than going up. This is, again, a testament to our assessment, which is based on public opinion research, what our policy folks are saying and what we are hearing from our stakeholders.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

McKinsey was hired to develop and implement various transformation strategies. Its mission was to review, develop and implement digital tools, processes and services. That is what Christiane Fox, who now works at the Privy Council Office, pointed out before a parliamentary committee in November 2023 when she was deputy minister at IRCC.

If McKinsey was supposed to provide you with incredible expertise, how is it that wait times skyrocketed in Canada?

[Harpreet S. Kochhar]

In terms of the ability for any consulting firms to actually look at our systems that deal with immigration.... For example, we use a global case management system, which is the backbone IT system for any case processing. It is imperative that we continue to do the current work, so we can then actually also apply transformation. We cannot just stop the work we are doing, which is our core business. The visas have to be issued while we are building a new system. It does take time before we can transform from what is a legacy system to the new system, which is the digital platform modernization. That is what it's going to take for us to get to that point.

However, we've succeeded in actually increasing access to the client experience by.... We have started the journey into the digital world of passports. We have rolled out passports for adults online. We have also done much more work in terms of people applying for temporary residence online, so this is part of that continuum.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

It always seems ironic to me that, even though the different departments have their own experts, including people with IT expertise, somehow we imagine that private firms will be able to deliver so many magic solutions. Unfortunately, it's costing taxpayers in Quebec and in Canada millions, if not billions, of dollars to use these firms. I get the impression that this is one more sign of broken trust in public servants. I find it extremely hard to accept that private companies are more highly valued.

Do you still have contracts with McKinsey?

[Harpreet S. Kochhar]

We don't have any more contracts with McKinsey, but we also want to mention in that context that we very much rely on our in-house expertise. Since January 2024, when I joined the department, we have looked at our strategy to reduce the IRCC's reliance on consultants. We have reduced over 127 consultants who had been there for a period of time. We have a target, which we will achieve by the end of 2027, to reduce it to merely 50.

I have to mention that we have a legacy backbone of IT, and that kind of expertise does not exist in-house. Sometimes we do have to hire those.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

In 2021, you used subcontractors because you didn't have certified expertise within the department. That was according to the Professional Institute of the Public Service of Canada.

My time is up, so I'll come back to that in the second round of questions.

[The Chair, Conservative, John Williamson]

Thank you very much.

We are in our second round, which will consist of five members with various times.

Mr. Kuruc, you'll lead us off for five minutes, please.

[Ned Kuruc, Conservative, Hamilton East—Stoney Creek, ON]

Thank you.

Thank you to all the witnesses for coming today and making themselves available.

Often we're here in public accounts talking about value for money, but I'd like to touch on a possible breach of sensitive data.

My line of questioning will start with Mr. Hayes.

How serious is it that IRCC allowed McKinsey consultants to access its network without proper security clearance? This hasn't been a one-off problem. There's been a clear trend across government contracting, including the arrive scam scandal. Does this show that there's been a breakdown in safeguarding sensitive government systems and citizens' data?

[Andrew Hayes, Deputy Auditor General, Office of the Auditor General]

From our perspective as Auditor General, we want to see the rules followed in every case. One of the fundamental controls, in terms of both security of government information and protection of confidential information and privacy, is to have security clearance in place before access is given to government servers, networks, etc.

In this case, we identified that there were five individuals who had access to IRCC's network without a valid security clearance. I will say that, when IRCC became aware of that, they stopped the access right away, but that should be something that is identified up front and controlled up front.

[Ned Kuruc, Conservative, Hamilton East—Stoney Creek, ON]

Thank you.

I do agree with you. That's why it's very concerning for someone like me who's new in Parliament. The general public would assume that these procedures are in place to safeguard people's data, not only when alarm bells start ringing. Thank you for your answer.

My next question would be for Mr. Kochhar.

The report found that five McKinsey consultants were granted access to IRCC networks without valid security clearances. Who approved this access, and what systems or data were exposed?

[Harpreet S. Kochhar]

To my knowledge, there was a situation where their security clearances were pending, and they were given access, but they received the security clearance. In between, in the time when they did not have that security clearance, they did have access to the data. None of the data is shared or is in any other McKinsey kind of domain. It always remains on our network. They can have access, but they cannot copy it or transfer it anywhere. That might be—

[Ned Kuruc, Conservative, Hamilton East—Stoney Creek, ON]

I understand. Thank you for that answer.

Now I have another question. What you've said is that they had applied for security clearance, were okayed to start working without a clearance and then got their clearance. Now, I understand that all the systems stay on your system, but you had five people from McKinsey with access to sensitive data who weren't cleared yet. It's more concerning that protocol broke down, because they applied for it and nobody could wait until they got it for them to start working, based on your answer.

Again, my question is, who approved the access and what systems and data were exposed? Now, if there's something you can't say in public on what was exposed because it's sensitive, I do understand that, but what could be exposed?

[Harpreet S. Kochhar]

I would be guessing what would be exposed from that because I wasn't really.... I'm not sure what they were, but to my knowledge, it was about the work we were doing, allowing them insight into how we do our processing, getting them to understand our way of processing the applications, from which they could find efficiencies by leaning the process or by using digital tools.

[Ned Kuruc, Conservative, Hamilton East—Stoney Creek, ON]

If you allowed five people.... Not you personally, sir, but if the IRCC allowed five people to access that type of data in the processing of immigration, I view that as highly sensitive data. That means that data could have gone out and people could be jigging the system to get into Canada.

Am I correct in saying that?

[Harpreet S. Kochhar]

Mr. Chair, I think that is a little bit of an extrapolation. What I am trying to say is that what we actually do in processing is sometimes to give them an idea.... For example, for training purposes, we would have trainees come in and look at some of the applications that we have already processed, just in that case.

I am not privy to the details, but I do believe that it wasn't a case of something where data was taken away. It stayed on our system.

[Ned Kuruc, Conservative, Hamilton East—Stoney Creek, ON]

You can't guarantee that, though. Is that correct, sir?

[Harpreet S. Kochhar]

I cannot speak about that.