Industry Canada
Information and Privacy Rights Administration
Final Report
February 2003
Executive Summary
The audit of Information and Privacy Rights Administration (IPRA) was carried out in accordance with the Audit and Evaluation Branch’s approved Internal Audit and Evaluation Plan for 2002-2003. The audit was conducted in accordance with generally accepted auditing standards and included such tests as were considered necessary in the circumstances.
The objectives of the audit were to assess the design and operation of the framework to administer the provisions
of Access to Information and Privacy legislation, the efficiency and effectiveness of associated administrative processes and the extent of compliance with legislative requirements. The audit was carried out from June to September of 2002.
During 2000-01, Industry Canada processed over 560 requests for information through the provisions of Access to Information and Privacy (ATIP) acts. Approximately 80 percent of all requests were Access to Information related, with consultation requests accounting for a further 16 percent of all requests. Since 1998-99, the number of ATI requests has almost doubled, from 230 to 450 requests in 2000-01. Of the 64 departments and agencies with ATIP groups, Industry Canada ranks 10th in workload volume.
The audit found the existence of a well designed framework to administer the provisions of Access to Information and Privacy acts and promote compliance with legislative requirements. Roles, responsibilities and authorities are generally well understood, and are supported by central agency and departmental policies. ATIP activities are administered by experienced, knowledgeable and dedicated staff. Program operations are supported by automated workflow processes which generate efficiencies, ensure security of information and promote performance measurement and reporting. Appropriate internal and external reporting mechanisms are in place. However, workload constraints have resulted in formal training not being offered to departmental employees, which could increase the risk of non-compliance to ATIP requirements.
However, there are opportunities to enhance the effectiveness of ATIP operations. Performance in the ATIP community is measured by the percentage of requests processed within the 30 day deadline. For 2000-2001, Industry Canada’s compliance rate was determined to be less than the standard set by the Office of the Information Commissioner. In our opinion, existing resource levels within the IPRA unit are constraining its ability to consistently meet established deadlines. While workload volume has increased considerably, IPRA resources have not followed suit. A workload comparison found the IPRA workload to be almost double that of the other departments considered. Further, a function time analysis assessment determined that, on average, only 25 percent of the total time available to process a request was allotted to the responding organizational unit, and is attributed to the existing resource constraints in the IPRA unit. Workload constraints are further exacerbated by vacancies in the unit. The inability of the unit to provide training to departmental staff is recognized and may further contribute to processing delays at the sector level. We understand that the Office of the Information Commissioner has recently raised the compliance standard to 95 percent. The Department will therefore be at an increased risk of non-compliance with the 30-day deadline if measures are not taken to address the existing resource constraint issue.
The Office of the Information Commissioner of Canada has previously expressed concerns about the poor state of records management in many departments, citing unreliability of departmental registries and difficulties associated with ever increasing use of electronic records, as contributing factors in hindering the completeness of departmental record search efforts. Electronic records continue to increase as a percentage of the overall records of the department, and may have not yet had the attention as given to organizing paper records. The departmental records management policy reflects the need for a new model in which records management is imbedded in the business process and which recognizes the increasing shift to managing electronic records. Efforts are underway on a pilot basis to implement an
electronic records management regime in the department. There are obvious linkages between the ATIP and records management activities. As such, it is felt that a closer working partnership between the two functions could promote awareness of the importance of information management as well as increase compliance with reporting deadlines.
The audit found that the Department is in compliance with ATIP legislation and practices. There is sufficient information on file to assess the entire ATIP process from initiation through finalization. All processes were duly documented and in accordance with relevant signing authorities, and exclusions and exemptions taken were appropriately justified. We found evidence of good operational stewardship being exercised by Industry Canada in the administration of its ATIP responsibilities. Where complaints were registered with the Office of the Information Commissioner, the reasons for the complaints were legitimate and were generally due to late responses (the legislation demands a response no later than 30 days from the request).
Adobe Acrobat Version (PDF, 167KB, 23 pages)
Note: to read the PDF version, you need Adobe Acrobat Reader on your system. If the Adobe download site is not accessible to you, you can download Acrobat Reader from an accessible page. If the accessibility of PDF is a concern, you can have the file converted to HTML or ASCII text by using one of the access services provide by Adobe.