Government Operations committee  Of course.

Government Operations committee  The report itself is a point-in-time document, so—

Government Operations committee  They were.

Government Operations committee  I'm not going to speak as to—

Government Operations committee  Perhaps I could add a point of clarification there. The report was a point-in-time assessment of the evidence on December 19—

Government Operations committee  There are allegations that—

Government Operations committee  They are not.

Government Operations committee  Yes. The policy on government security's directive on security management, at paragraph 4.1.7, requires us to report any suspicions of criminality to the law enforcement of jurisdiction. When that does occur, we would typically first reach out to the RCMP and have a preliminary discussion to confirm whether our understanding of what occurred may be criminality.

Government Operations committee  I can't speak to any specifics of the allegations, but what I can say is that any time there is an exchange of money between the government and other parties, there is a potential risk of fraud. People may want to circumvent internal controls to try to get something out of the system.

Government Operations committee  I can. There have been numerous cases, sadly, in the past around false invoicing, with either completely false businesses invoicing the government or maybe an employee circumventing internal controls to sign both sides of a transaction. That would be clear fraud. From a vendor's perspective, submitting fraudulent documents could be considered fraud.

Government Operations committee  It's within the scope of my duties. I have another function within my team that aims to identify potential fraud, corruption or misuse, using the agency's data through proactive data analytics. As we get into a file like this and we see evidence of potential fraud, we would report that to law enforcement.

Government Operations committee  I'm not familiar with the documents they would have provided to committee.

Government Operations committee  I can speak generally. Again, it's not my area of expertise, but I have some exposure to it as a security practitioner. When we're talking about document safeguarding, it means that the vendor may be required to hold protected information within their physical premises or within their IT systems, which would be different from if they were working solely within a CBSA space where they may have access to systems of ours.

Government Operations committee  My role is to provide an investigation function which is indeed independent. I do not work for management as such. I would say that we are working for the agency when we conduct investigations. That is how I explain it to my team. A completely independent function would certainly add a degree of assurance, but I am very comfortable with our approach.

Government Operations committee  Let me clarify something: we do not make any recommendations in our reports. We establish the facts of the matter and draw conclusions as to whether or not the allegations are founded. Once we have completed our report, it is sent to management. It is up to them to decide, depending on the circumstances involved, whether disciplinary action is warranted.