|
Review of Priority Cheque Printing Facility
File number: 1577-04-011
| Print Version |
Purpose
By email dated June 21, 2004, you requested Audit and Advisory Services (ARA)
to review the printing of priority Receiver General Cheques at Transport Canada’s
Priority Cheque Printing Facility to ensure compliance as indicated in the Receiver
General Directive 1999-8R1 (RGD 1999-8R1).
Background
The department signed a Letter of Compliance with Government
Operational Service for the operation of a Priority Cheque Printing Facility
on November 20, 2000. The Letter of Compliance defined one control over the
Standard Payment System (SPS) workstation and eight controls over cheque forms
and signature stamps. In addition, RGD 1999-8R1 dictates the standards, procedures
and minimum controls that must also apply to Transport Canada’s Priority
Cheque Printing Facility.
The review of the Priority Cheque Printing Facility, together with interviews with staff and management, was conducted on July 20, 2004. By memo dated August 26, 2004, we advised you of the following observations detailing those areas where processes or controls did not comply with either the RGD 1999-8R1 and/or the November 20, 2000 letter of compliance. To finalize this file, this memo details the original observations together with your completed management action plans.
Observation #1
The Letter of Compliance requires sufficient controls to be in place to ensure
the workstation for the printing of cheques can only be used for the Standard
Payment System (SPS). In addition, the Internet browser cannot access any other
Internet sites except the SPS site.
The review found that the workstation was a normal workstation used for both SPS and non-SPS work. The workstation and browser has access to the Internet in general and is not restricted to the SPS site.
Recommendation |
Completed Management Action Plan |
Recommendation #1
It is recommended that the Director of Accounting Operations have the required changes made to the workstation to bring it into compliance with the Letter of Compliance. Alternatively, it is suggested that the Director of Accounting Operations enter into negotiations with Public Works and Government Services Canada (PWGSC) to enter into a new Letter of Compliance that properly reflects the existing controls and procedures that are in place regarding the cheque writing workstation. |
Accounting Operations contacted the informatics group and the workstation can only access the SPS site now. |
Observation #2
Section 9.1.4 of the RGD 1999-8R1 recommends that site inspections be conducted
annually by Internal Audit and Departmental Security to ensure adherence to
both security and internal control policies.
The review found that while ARA had been invited to perform an audit of the facility, no such invitation had been made regarding the physical security of the site (Corporate Security) or the workstation (IM/IT Security).
Recommendation |
Completed Management Action Plan |
Recommendation #2:
It is recommended that the Director of Accounting Operations annually request a security audit of the physical site and the computer workstation from Corporate Security and IM/IT Security respectively. |
Both audits have been performed. Corporate Security was concerned about the location of the safes because they were not in a secure environment after working hours. Now they are in two separate lock offices.
IM/IT fixed the workstation as mentioned above and they did not have any other comments . |
Observation #3
Section 9.2 of the RGD 1999-8R1 deals with separation of duties and requires
that separate individuals be assigned the cheque and signature stamp custodian
responsibilities. Section 9.3.4 specifically states that these are the only
individuals to have access to the blank cheques or the signature stamps. In
addition, none of these individuals are to have any payment authority (Section
34 of the FAA), spending authority (Section 33 of the FAA) or any other involvement
in the cheque requisitioning process. Finally, sections 9.4.2 and 9.4.3 clearly
state that “At no time, is any individual to have concurrent access to
both the blank cheque stock and the signature stamps.”
The review found that the Director of Accounting Operations and the two employees in Corporate Security have the combinations to both safes that hold the blank cheques and signature stamps. As such, these individuals have total and unrestricted access to both the blank cheques and the signature stamps. In addition, The Director of Accounting Operations also has Section 33 and 34 signing authorities and is involved in other cheque requisitioning processes.
Recommendation |
Completed Management Action Plan |
Recommendation #3a:
The Director of Accounting Operations should take immediate steps to divest himself of the combinations to the blank cheques and signature stamps. Alternatively, the Director of Accounting Operations should advise PWGSC immediately that he has both combinations as well as Section 33 and 34 signing authorities and to seek their approval of retaining concurrent access to both the blank cheques and the signature stamps. |
Corporate Security got the combination of both safe changed and now the Director of Accounting Operations does not have them because he is entitle to sign section 33.
|
Recommendation #3b:
The Director of Accounting Operations should advise PWGSC immediately that Corporate Security, in their normal business function of having the combinations to all security locks and safes within Transport Canada, has both combinations to the safes that hold the blank cheques and the signature stamps. The Director of Accounting Operations should request PWGSC to confirm that this is an acceptable exception to the controls stated in RGD 1999-8R1. |
Accounting Operations e-mailed and called PWGSC.
PWGSC (Lorraine Jones) confirms in a voice mail in April, 2005 the following:
La personne autorisée à changer les combinaisons des coffres-forts n'a pas besoin d'être inscrite dans la liste de personne ayant des fonctions dans l'impression des chèques prioritaires, incluant accès aux coffres-forts, car elle n'a pas accès au système financier afin d'imprimer ces chèques.
Nous n'avons pas à nous inquiéter car c'est la même chose pour tous les ministères |
Observation #4
Section 9.4.2 and 9.4.3 require that cheques be printed and signed in “an
area restricted to authorized personnel”.
The review found that cheques are not printed and signed in an area restricted to authorized personnel. Rather, the area is a normal office environment open to anyone with a building pass. In addition, Corporate Security confirmed that the area is not identified as requiring any extra security measures in off-hours.
Recommendation |
Completed Management Action Plan |
Recommendation #4:
It is recommended that the Director of Accounting Operations have a restricted area created for the printing and signing of cheques as required in RGD 1999-8R1. Alternatively, it is suggested that the Director of Accounting Operations should confirm with PWGSC that they are in agreement with Transport Canada printing and signing Receiver General cheques in a non-secure area. |
We worked with our Corporate Security and now the safes are in two different locked offices. |
Observation #5
Section 9.4.3 identifies specific responsibilities of the Signature Stamp Custodian
before each cheque is signed.
The review noted that the normal process was to apply the signature stamp without conducting any of the verification steps necessary to ensure the cheque has been properly prepared.
Recommendation |
Completed Management Action Plan |
Recommendation #5:
The Director of Accounting Operations should ensure that the Signature Stamp Custodian fulfill their responsibilities as outlined in section 9.4.3 of RGD 1999-8R1 before the signature stamp is applied. |
The employees that have any responsibilities with the priority cheques received the procedures again and discussion and training have been taken place.
All employees are now leaving traces or evidences of their verification. |
Conclusion
The review has identified five instances where Transport Canada’s Priority
Cheque Printing Facility does not comply with RGD 1999-8R1 or the Letter of
Compliance. Recognizing that new or alternate controls may supersede existing
controls, some of the recommendations have been worded to allow for clarification
from or renegotiations with PWGSC. The result however should be that Transport
Canada’s Priority Cheque Printing Facility complies with the RGD 1999-8R1
and the Letter of Compliance or that PWGSC is both aware of and provides formal
acceptance to Transport Canada’s existing practices.
Management Action Plans
After reviewing the auditor’s findings and recommendations, you provided
us with your Management Action Plans which have now been completed for each
of the six recommendations.
|
