Current Reports

2003-733 Audit of a selected Payment Issue Product - NCA Priority Print Sites Operated by BCMS, ABCB, Final Report

October 27, 2005

Executive Summary
1 Introduction
2 Findings and Conclusion
- 2.1 Management Control Framework (MCF) over the processing and delivery of priority payments
- 2.2 Compliance with Directives & Procedures for the processing of priority payments

Executive Summary

The objective of the audit was to assess the adequacy of management and operating controls for cheque payment services provided from priority print sites operated by the Banking and Cash Management Sector (BCMS), Accounting, Banking and Compensation Branch (ABCB), to ensure compliance with directives and procedures, while enabling timely, accurate, and complete payment processing.

The audit scope consisted of a review of the Management Control Framework (MCF) elements, an assessment of the compliance with the Receiver General Directive (RGD) 1999-8R1 (Revision #1 dated April 1, 2001) entitled "Printing Priority Receiver General Cheques at Departmental Sites - Procedures for Financial Information Strategy (FIS) Compliant Departments", as well as a review of the implementation status of action plan initiatives to address prior Audit and Ethics Branch audit and Consulting and Audit Canada (CAC) management review recommendations for Priority Print Sites.

The period of coverage for this audit was for cheques produced from April 1, 2003 to March 31, 2004. The audit examination was performed between July 2004 and January 2005. Validation of corrective actions taken by the Payment, Products and Services Directorate (PPSD) in response to audit findings was conducted in April, May and June 2005. The audit report presents the situation at the time the audit work was completed on June 30, 2005.

The Standard Payment System (SPS) issues payments on behalf of all federal departments and agencies from the Consolidated Revenue Fund. Upon receipt and approval of clients payment requisitions, the SPS processes the transaction either by an electronic payment or Receiver General cheque. The SPS integrates the entire payment process from issue to redemption. The SPS facilitates the printing of individual priority Receiver General cheques using Priority Print Sites located in specific Public Works and Government Services Canada (PWGSC) and client department operated sites, including the Priority Print Sites operated by PPSD in the National Capital Area (NCA). PPSD operations unit is comprised of approximately eight full-time equivalent (FTEs) and printed the Receiver General cheques of behalf of Other Government Departments.

Conclusion

Overall, the MCF for the processing and delivery of priority cheques was adequate and, with a few exceptions outlined in the report, PPSD management and staff are compliant with the directives for the production of priority cheques and control of designated assets (i.e. cheque forms and signature stamps). In response to the initial findings, PPSD management implemented corrective actions to improve the management control and ensure compliance.

1 Introduction

1.1 Authority for the Project

This internal audit was approved by the Audit and Ethics Committee (AEC) as a carry forward project from 2003-2004 within the Internal Audit Services Directorate (IASD) Plan for 2004-2005.

1.2 Objective

To assess the adequacy of management and operating controls for cheque payment services provided from priority print sites operated by BMCS to ensure compliance with directives and procedures, while enabling timely, accurate, and complete payment processing.

1.3 Scope

The audit was conducted in the NCA within BCMS, ABCB, as follows:

the PPSD, including their two Priority Print Sites located at Place du Portage Phase III, 10 A1 and at the MacDonald Cartier Data Centre; and
the Payment Standards Division (PSD).

The audit was also conducted in the NCA within the Mail Management Services, Corporate Services, Human Resources and Communication Branch.

The period of coverage for this audit was for cheques produced from April 1, 2003 to March 31, 2004. The audit examination was performed between July 2004 and January 2005. Validation of corrective actions taken by PPSD in response to audit findings was conducted in April, May and June 2005. The audit report presents the situation at the time the audit work was completed on June 30, 2005.

The scope of the audit consisted of a review of management controls over operations; the identification, assessment, and management of risks; and the adequacy, integrity, timeliness and relevance of information for decision making and reporting.

This included an examination of the following:

Controls for the processing of priority payments, cheque inventory and stock, and signature stamps;
Priority Payments issued via the NCA Priority Print Sites operated by PPSD, as per RGD 1999-8R1 (Revision #1 dated April 1, 2001) entitled "Printing Priority Receiver General Cheques at Departmental Sites - Procedures for Financial Information Strategy (FIS) Compliant Departments"; and
The implementation status of action plan initiatives to address prior internal audit and CAC management review recommendations for Priority Print Sites.

The IASD conducted the examination phase of this audit during the Fiscal Year (FY) 2004-2005. However, this audit project was interrupted several times and for prolonged periods of time, due to the reassignment of the project leader to other Branch priorities. In April and June 2005, PPSD provided a detailed management response to the IASD audit findings issued in February 2005 which showed that corrective actions had been taken or initiated on all findings. To provide the Audit, Assurance and Ethics Committee with timely, current audit assurance information, IASD performed additional work in April, May and June 2005 to validate the implementation of the PPSD correctives actions.

The issues presented below were improved by management in response to the initial findings.

Management control

The officer-in-charge ensured keeping an "arms length" oversight control, e.g., by not participating in the receipt and quarterly stocktaking of cheque form and signature stamp inventories.
Management has strengthened control over access to the back up combinations for the safes containing the signature stamp and the blank cheque forms by storing them in separate envelopes within a safe located in the PWGSC Security Branch. In addition, only four authorized members of the PPSD management team have the authority to request the release of these back up combinations. These individuals do not have access to the keys required to open the room where the safes are secured.
Records, provided by PPSD to the mailroom, of couriers authorized to pick up priority cheques are being updated to ensure that they consistently contain critical information, such as the badge numbers and signatures of authorized courier company staff.
Management has strengthened control over access to the MacDonald-Cartier contingency print site safe combinations for the signature stamp and the blank cheque forms by storing them in two separate envelopes which were only provided to the respective authorized custodians.

Compliance

The officer-in-charge ensured that all changes to custodial responsibilities were communicated to PSD on a timely basis to ensure reliability of their records.
The Cheque Inventory Control Register and the Cheque Form Destruction Certificates were being stored in a separate location from the Cheque Form Inventory.
At the MacDonald-Cartier contingency print site, the signature stamp was being stored in a separate Royal Canadian Mounted Police (RCMP) compliant safe.

Prior CAC management review

Of the recommendations outlined in the CAC report entitled "Management Review of the Production of Priority Payments" (March 2003), senior management implemented 17 of 18 of these recommendations. The recommendation regarding the separate storage of the inventory control register and the destruction certificates was subsequently actioned.

The report presents the situation after management improvements were taken.

1.4 Background

The Assistant Deputy Minister, ABC Branch is accountable for the Receiver General Business Line (RGBL), including issuing approximately 222 million payments a year on behalf of the Receiver General for Canada.

The SPS issues payments on behalf of all federal departments and agencies from the Consolidated Revenue Fund. Upon receipt and approval of clients payment requisitions, the SPS processes the transaction either by an electronic payment or Receiver General cheque. The SPS integrates the entire payment process from issue to redemption. The SPS facilitates the printing of individual priority Receiver General cheques using Priority Print Sites located in specific PWGSC and client department operated sites, including the Priority Print Sites operated by PPSD in the NCA. PPSD operations unit is comprised of approximately eight FTEs and printed the Receiver General cheques of behalf of Other Government Departments.

In March 2003, CAC completed a Management Review of the Production of Priority Payments on behalf of BCMS. This Review made recommendations on improving controls which were subsequently implemented in a BCMS action plan.

2 Findings and Conclusion

2.1 Management Control Framework (MCF) over the processing and delivery of priority payments

The MCF elements for Governance, Operational Capability, Operational Delivery and the Performance Management Capacity were generally adequate for the processing and delivery of priority cheques.

Senior management implemented significant corrective actions to greatly improve the MCF, following an independent review conducted by CAC in March 2003 and the current IASD internal audit.

2.2 Compliance with Directives & Procedures for the processing of priority payments

Our examination of management and operational practices in PPSD Site 0027, including a review of 39 priority payment transactions in FY 2003 / 2004, revealed a high level of compliance with the RGD 1999-8R1. The high level of compliance can be attributed to management leadership, knowledgeable and trained staff, and the provision of supplemental desk procedures. Some issues of non-compliance were corrected prior to the finalization of the audit.