Internal Audit and Program Evaluation Directorate
Audit of the Commercial Program in the Marine Mode
December 4, 2018

1.0 Introduction

Note: [*] An asterisk appears where sensitive information has been removed in accordance with the Access to Information Act and the Privacy Act.

1. The Canada Border Services Agency (CBSA or Agency) Commercial Program in the marine mode (hereinafter Commercial Marine Program^{Footnote 1}) aims to facilitate the flow of legitimate goods while identifying and intercepting inadmissible goods from entering Canada at marine ports of entry and ensuring commercial clients are compliant with legislative and regulatory requirements. The Customs Act authorizes CBSA border services officers (BSOs) to examine imported goods, including shipping containers or any conveyances used in importation.

2. The CBSA National Targeting Centre (NTC) uses advance information submitted by carriers, ship’s agents or other relevant trade chain partners to target high-risk commercial import shipments, commercial vessels and crew for examination. Marine container examinations are conducted either at the pier or at a container examination facility. The location of the examination depends on the type of examination to be performed, which is based on risk factors, the type of detection technology available, the type of commodity and whether the container needs to be emptied in order to examine the goods.

3. To assist officers in their examinations, detection tools such as large-scale imaging systems, X-rays, and other technology is used. The examination of commercial vessels may include searches of cabins and crew, deep rummaging, or the use of Remote Operating Vehicles to detect parasitic attachments that may have been affixed to the hull of the vessel to smuggle contraband. In major ports, imported marine containers are also scanned for the presence of radiological material using radiation detection portals. Violations of legislation and/or regulations may result in administrative monetary penalties, seized goods, or the denial of entry into Canada (re-exportation of the goods).

4. The CBSA has 211 commercial vessel reporting sites, which include five major container ports.^{Footnote 2} The highest volume commercial marine ports, located in Vancouver, Prince Rupert, Montréal, and Halifax, process 98% of marine commercial volumes.

5. With the recent re-structuring of the CBSA functional direction, management and administration of the Commercial Program is now the responsibility the Commercial and Trade Branch. At the time of the audit, these functions were performed by the former Programs Branch, Commercial Directorates, and Commercial Operations Division of the former Operations Branch of national headquarters. The Programs Branch was responsible for managing program policy and transformation, compliance and outreach, and for monitoring and reporting on program performance. The Operations Branch provided advice, support and operational guidance to the regions and senior management on the operational delivery of the commercial program. The CBSA regions conduct examinations of commercial shipments and vessels.

6. An Audit of Border Controls at Marine Ports of Entry was conducted in 2012. This audit follows-up on the 2012 audit and was approved as part of the CBSA 2017 Risk-Based Audit and Evaluation Plan.

Changes since 2012

7. Between fiscal years 2012-2013 and 2015-2016, the Commercial Marine Program was being delivered with [*]

8. A significant change since the 2012 audit is the centralization of targeting, which was previously conducted using a tiered approach with both national and regional targeting. Replacement of the commercial targeting system (TITAN) through the deployment of the eManifest Commercial Threat Assessment System (CTAS), has experienced significant delays and TITAN requires many system enhancements that have not been made since the system is due to be replaced. In addition, technical issues have prevented the CBSA from being able to fully implement the Bay Plan Initiative. Marine bay plan information includes the numbered position of all cargo bays on the vessel and details the exact location of each container being transported on board the vessel.^{Footnote 4} This information is useful for risk assessing the shipments, identifying undeclared shipments, and for conducting radiation portal usage compliance by comparing the container numbers listed on the bay plan with those that went through the portals.

9. The Agency is investing in the improvement of its examination process and capacity through the construction of two new Marine Container Examination Facilities in the Pacific Region: one at Roberts Bank and the other at Burrard Inlet.^{Footnote 5}

2.0 Significance of the audit

10. This audit is of interest to management due to the program’s highly complex, dynamic and costly operating context.

11. The audit objective was to provide assurance that Agency responsibilities for the Commercial Marine Program are appropriately carried out and managed. The audit scope focused on program management and monitoring and included follow-up on key recommendations from the 2012 Audit of Border Controls at Marine Ports of Entry over the period of April 2014 to March 2017. The audit methodology and criteria are described in Appendix A.

3.0 Statement of conformance

12. The audit conforms to the Mandatory Procedures for Internal Auditing in the Government of Canada, as supported by the results of the quality assurance and improvement program. The audit approach and methodology followed the International Standards for the Professional Practice of Internal Auditing as defined by the Institute of Internal Auditors and the Mandatory Procedures for Internal Auditing in the Government of Canada, as required by the Treasury Board’s Directive on Internal Audit.

4.0 Audit opinion

13. The Agency faces considerable challenges in the commercial marine mode, including [*] and a heavy reliance on third party service providers. The different types of commercial marine examinations require various types of sophisticated detection technology and must be conducted in a way that minimizes health and safety risks. The Agency faces constraints in its capacity to manage the growing volumes of commercial marine shipments. New marine container examination facilities in the Pacific region should help, but the Agency also needs to address information system limitations and non-compliance in order to ensure the achievement of program objectives.

5.0 Key findings

14. Various areas of the Agency are working on several initiatives that will have an important impact to the Agency’s success in the commercial marine mode. These include new marine container examination facilities, implementation of Customs Controlled Areas in the marine mode, and implementation of the Commercial Threat Assessment System. Further opportunities for improvement have been identified through recent reviews of physical security and operational program delivery.

15. The audit found that performance information has not been measured consistently and is not aligned across key documents to enable tracking against performance targets and/or expectations. An analysis of performance reports found inconsistencies in the marine commercial examination results between what was reported in the Commercial and the Enforcement and Intelligence (i.e. targeting) Agency Performance Summary reports. In addition, results of vessel examinations are not currently reported. Consequently, there is limited utility of the performance information for senior management decision-making.

16. Due to the considerable time and effort involved, the Commercial program has experienced challenges in conducting ongoing compliance monitoring of the recording of examination results and radiation portal usage.

17. The electronic transmission of vessel bay or stow plan data by marine carriers under the Reporting of Imported Goods Regulations became a requirement in November 2015, but the Agency has delayed enforcing the requirement due to technical problems in receiving the bay plan data. System changes are needed to resolve CBSA system compatibility issues. The Agency currently relies on terminal operators to share hard copies upon request. Despite the delays and technical difficulties in implementing the Bay Plan Initiative, the Agency has yet to establish a plan or alternative approach going forward.

18. The Agency has faced limitations in enforcing compliance with various requirements in the commercial marine mode, including requirements for the provision of adequate examination facilities, the requirement for goods to be presented in a timely manner for examination, and in enforcing the need to provide sufficient advance commercial information to enable the pre-arrival risk assessment of the commercial shipments.

6.0 Summary of recommendations

19. The audit makes the following six recommendations:

• finalize a performance measurement framework for the commercial marine program that includes all relevant and practical performance metrics for commercial marine activities and establish regular monitoring and reporting of performance results;
• explore ways to increase the efficiency and regional frequency of radiation portal usage monitoring;
• restore monitoring of closing the loop to ensure that examination results are accurately and consistently recorded, and use the results to make program improvements;
• prioritize the development of systems, processes, and regulations that will enable more effective and efficient risk assessment of marine shipments, vessels, and crew;
• strengthen efforts to address security and organized crime risks at marine ports. This should include reviewing the results of the physical security and operational marine program delivery reviews and presenting the findings and supporting action plans to the appropriate governance committee(s); and
• develop and implement a commercial compliance strategy that addresses the Agency’s need for the timely presentation of goods for examination and enhances the monitoring and enforcement of ACI compliance.

7.0 Management response

8.0 Audit findings

8.1 Program Planning and Risk Management

20. Program planning is an essential process that supports the achievement of program objectives. A program plan or strategy should be documented and communicated, as well as be supported by a robust risk management process that proactively identifies and manages risks to achieving those objectives.^{Footnote 6}

Program Planning

21. In 2015, the Agency established a “Beyond 2020 Commercial Vision and Strategy”. The latest Commercial Integrated Business Plan for 2017 continues to outline the implementation of the commercial vision and modernization of the marine examination process, as well as enhanced stakeholder consultations by introducing a new Commercial Advisory Committee and Border Commercial Consultative Committees (BCCC) Maritime Working Group.

22. However, key planning documents that were to be produced as part of the commercial strategy timelines, including a staffing and resource allocation plan and an options paper for delivering on the commercial transformation, have not yet been developed.^{Footnote 7} The existing vision, strategy, and integrated business plan are for the overall Commercial Program (i.e. for all modes of transportation). Some of the key marine-specific initiatives are outlined in these documents (e.g., new marine container examination facilities, implementation of Custom Controlled Areas, Bay Plan Initiative, and Commercial Threat Assessment System). Many different areas of the Agency are involved in marine related activities; for example, the Information Science and Technology Branch is responsible for systems development and maintenance and for the research and development of detection technology; the Finance and Corporate Management Branch is responsible for real property and physical security; and the Travellers Program Directorate is the lead for the implementation of Customs Controlled Areas. Given the number of areas and activities involved, coordinated planning and governance is important for ensuring that key initiatives remain a priority and progress as planned.

Risk Management

23. Commercial marine risks have been identified through various reviews and assessments, including NTC issue sheets, commercial risk one-pagers, an Operations Branch marine operational review, and physical security reviews conducted by Finance and Corporate Management Branch, among others. The program area has not, however, established a formal approach to risk management that ensures key risks are addressed and monitored on an ongoing basis. This gap in the Agency’s risk management approach is highlighted by the limited progress that has been made in implementing key risk mitigation initiatives stemming from a 2011 marine container risk assessment produced for the former Commercial Border Programs Division (e.g., implementing the Bay Plan Initiative and advance commercial information (ACI) penalties).

24. The audit found that certain policies, procedures and directives have been implemented to avoid health and safety risks related to large scale imaging, fumigants, and patrolling, [*]. Also, for a variety of reasons, including the presence of harmful fumigants in containers, the Agency now rarely uses detector dogs in the commercial marine mode, however regions indicated that for certain purposes such as vessel rummaging, the use of detector dogs would enable much more efficient and effective examinations. The audit also noted boarding at sea^{Footnote 8} practices differ across regions and that additional guidance, namely a policy or directive, is needed for boarding at sea to ensure the inherent operational risks associated with this examination activity are appropriately and consistently managed.

25. In the absence of an effective risk management approach, identified risks may materialize, and the Agency may adopt less efficient and effective workarounds for program delivery. This may result in diminished capacity or the inability to achieve desired results/objectives. Further, materialized risks may be harmful to the health and safety of Canadians and Agency staff, as well as damage the Agency’s reputation with stakeholders.

8.2  Program Monitoring

26. Senior management and oversight bodies need sufficient, relevant, and timely information to support effective decision-making for allocating resources and managing risks to the achievement of program objectives.^{Footnote 9}

Performance Monitoring

27. The Commercial Program Management Table (CPMT) was established to monitor commercial program performance on a regular basis. The CPMT is expected to meet every six weeks as per the terms of reference. In reviewing the Records of Decision, the frequency of the meetings has reduced to on average every 11.5 weeks since April 2016, when previously it was held every 6-7 weeks between January 2015 and April 2016. The committee met only once between September 2017 and June 2018, due to a transition in governance associated with CBSA Renewal. Although the records of decision showed that the CPMT discussed the draft performance management framework and draft logic model for the commercial program on a couple of occasions, these have yet to be finalized and/or approved.

28. Performance information related to the commercial program is readily available through the bi-annual Agency Performance Summaries (APS), annual commercial dashboards, and annual Departmental Results Report.

29. The audit found that performance information has not been measured consistently and is not aligned across key documents to enable tracking against performance targets and/or expectations. An analysis of APS reports showed inconsistencies in the marine commercial examination results between what was reported in the Commercial and the Enforcement and Intelligence (i.e. targeting) APS reports. For example, the Commercial APS reported marine resultant rates of 1.7% in 2015-2016, 1.4% in 2016-2017 and 2.64% in 2017-2018 while the Enforcement and Intelligence APS reported the marine resultant rates of 2.1%, 1.9% and 1.7% respectively. Consequently, there is limited utility of the performance information for senior management decision-making. Further, flaws exist with the established performance targets set out in the Departmental Plan for 2018-2019. For example, a performance target maximum of 1% is set for random commercial examination results. However, the Agency should not be setting a performance goal for the number of random examination results, since the objective of random examinations is to gather baseline compliance information. In addition, a performance target maximum of 1.5% is set for resultant commercial examinations when this should be a minimum given that most examinations (with the exception of random examinations) should be risk-based and more resultant than random examinations.

30. Each year, the Agency examines approximately [*] containers and [*] commercial vessels.^{Footnote 10} The Agency does not currently report on the number or results of the vessel examinations conducted. The resultant rate for marine container examinations ranges from 1.4% to 2.6%. While this may seem low in comparison to examinations in other modes, the results typically yield a significantly higher return on investment.^{Footnote 11} One contraband seizure in the marine mode is typically larger than multiple seizures made in other modes.

31. The commercial marine examination resultant rate could be improved by addressing deficiencies with the advance commercial information provided, reducing delays in receiving containers for examination from marine terminal operators (as delays give opportunity for contraband to be removed prior to examination), and implementing overdue enhancements [*] (e.g. [*]

32. The audit also found that the availability and utilization of detection technology is being monitored but there is no reporting on the effectiveness of the various detection tools to assess if the technology is meeting Agency needs and generating a return on investment. The Agency is not currently measuring the results, effectiveness or efficiency of vessel examinations.

Radiation Detection Portal (RadNet) Usage Compliance

33. Radiation detection portals are installed at major marine ports. When a container is taken off a vessel, it is placed onto a transport vehicle that drives through one of the portals to determine if radiation is present. The information is transmitted to the CBSA Science and Engineering and the NTC, which monitor the portals 24 hours a day. In the Report on Plans and Priorities from 2014-2015 to 2016-2017, the Agency stated that 100% of marine containers are scanned through the RadNet portals. A Radiation Portal Usage Ongoing Monitoring Plan was developed by the Programs Branch in 2014-2015 to formalize the requirement for annual compliance monitoring to ensure this expectation is being met. Compliance monitoring reports conducted in 2014-2015 and 2017-2018 indicated [*] portal usage, while monitoring was incomplete for 2015-2016 and not conducted in 2016-2017.

34. The Ongoing Monitoring Plan outlines a sampling methodology that is statistically representative of the total population of containers. [*]

35. [*] The compliance monitoring reports for 2014-2015 and 2017-2018 both include the statement that “In addition to this [*] but there has been no progress in this regard.

Closing the Loop on Examination Results

36. A marine container or vessel may be referred by the NTC for examination. Most referrals are “targets” that are issued based on risk indicators or to negate instances of unknown risk. A low percentage of examinations are random referrals.^{Footnote 12} Regions may also elect to conduct a selective examination, stemming from dock inspections of offloads, walk-around checks in bonded warehouses, operational blitzes, etc.^{Footnote 13}

37. Upon completion of an examination, Officers record the examination results to indicate how and when the examination was performed, what tools were used, and whether anything was found (e.g. contraband or goods that are non-compliant with health, food, plant, or animal regulations). Recording the examination results “closes the loop” on the referrals and enables the Agency to report on and improve performance of future targets and examinations.

38. In response to a recommendation in the 2012 Audit of Border Controls at Marine Ports of Entry, a process was implemented to monitor the accuracy and consistency of examination results recorded in TITAN.^{Footnote 14} The Enforcement Manual provides guidelines and expectations around closing the loop and documenting quality commercial examination results. Senior management established performance standards of 80% for both narrative quality and proper use of the resultant field.^{Footnote 15} Monitoring by the Commercial Program indicated that performance against these standards is falling:

39. At the time of the audit, a TITAN Marine Examination monitoring report had not been produced for 2017-2018. The NTC performs follow-up on the results of their targets, with the number of examination results entered being tracked in the Monthly Targeting Reporting Suite. The NTC Monthly Targeting Report Suite shows that between March 2014 and August 2017, 72% of examination results were recorded in TITAN. Regions explained that sometimes there are delays in completing examination reports pending outstanding laboratory results or information from other government departments.

40. The audit also noted that regions may not always record their own selective examinations in TITAN, particularly for non-resultant cases, and that vessel rummage examination results were recorded in VATS for only 60% of the [*] high-risk targets issued in 2017-2018. Medium risk vessel referrals are also issued in VATS but the results need to be recorded outside of VATS due to system limitations. The Programs Branch does not monitor the closing of the loop for vessel and crew examinations.

41. Insufficient performance information impedes the Agency’s ability to make informed decisions about program priorities and resources, while inappropriate performance targets prevents the Agency from effectively monitoring progress against program objectives. Further, the Agency does not have an efficient way of monitoring radiation portal usage, and while the likelihood that containers with high-levels of radiation will enter Canada undetected may be low, the impact could be significant. Lastly, if examination results are not entered into systems or narratives are of low quality, the ability to perform data analysis is compromised, including identifying key trends, new indicators of high-risk shipments, and assessing the relative effectiveness of the different referral types.

8.3 Controls

42. The establishment and maintenance of robust controls supports the effective and efficient day-to-day execution of program activities, as well as ensures risks to program delivery (e.g., physical security) are appropriately managed. Further, the monitoring of controls enables the Agency to act upon cases of commercial non-compliance.^{Footnote 16}

Negating Unknown Risk from Incomplete or Missing Pre-Arrival Information

43. The NTC receives and risk assesses pre-arrival information on commercial shipments and vessels. Often times, the required information is missing or incomplete. When this occurs, the NTC will submit a request for information (RFI) to the marine carrier.^{Footnote 17} Between April 2014 and April 2018, a RFI was requested for approximately [*] containers per year (about [*] per day). This is significant because targeting officers have to re-visit each request, often multiple times, to determine if supplementary information was received from the carrier/importer that can be used in negating risk. The NTC was able to negate the risk of incomplete ACI for [*] of [*]containers. The remaining containers (over [*] per year) needed to be referred for examination on the basis of insufficient information.

44. The NTC executes activities to identify “ghost” containers^{Footnote 18}, including, for example, [*] TITAN. As part of a project from October to December 2015, the NTC identified 64 ghost containers in the Pacific Region. The audit was provided with examples of emails dated in March and April of 2018 from the NTC to the Quebec and Pacific Regions that provided lists of 8-10 ghost containers for follow-up and examination. Notably, “ghost” containers do not appear in TITAN given they are undeclared and the Agency has yet to develop an alternative process to record examinations results for these containers.

45. The 2012 audit included a recommendation that the Agency put a plan in place to ensure the benefits realization from the implementation of the Bay Plan Initiative. Bay plan information can be used to support the identification of “ghost” containers, enhanced risking of containers accessible for contraband based on stowage location, and for reconciliation against radiation portal usage to assess compliance. The requirement for marine carriers to electronically transmit vessel bay or stow plan data under the Reporting of Imported Goods Regulations came into effect in November 2015.^{Footnote 19} The Agency has not been enforcing the requirement due to software incompatibility issues that are restricting the Agency’s ability to receive the electronic bay plans. The Agency has been relying on terminal operators to share hard copies upon request. This problem has persisted since 2015, and the Agency has yet to establish a plan or alternative approach going forward.

46. [*] The Agency also does not reconcile vessel post-arrival data in ACROSS with advanced information that has been received through TITAN, PANS, and other information sources^{Footnote 20} to proactively identify non-compliance with reporting requirements. [*]

47. The Agency’s strategic framework has objectives for working smarter and for making better use of data, intelligence, and results, to improve targeting and to increase the resilience and efficiency of information technology. In order to do so, the Agency needs to take steps to ensure that required data is received in a timely and useful format, and that planned systems enhancements are implemented.

Secure Handling and Storage of Marine Containers

48. Port authorities are required under section 6 of the Customs Act to provide and maintain adequate buildings, accommodation or other facilities for the proper storage and examination of imported goods.^{Footnote 21} Marine terminal operators are licensed by the Agency under the Customs Sufferance Warehouses Regulations and are obligated to provide secure storage of goods. They may also be members of the Partners in Protection Program which enlists the cooperation of the trade chain community to enhance border security, combat organized crime and help detect and prevent contraband smuggling. Program members agree to implement and adhere to high security standards while the Agency agrees to assess their security measures and provide information sessions. Any industry organization that is involved in the international movement of goods as an authorized economic operator must comply with World Customs Organization or equivalent supply chain security standards.

49. The Agency has established policies, standards, procedures, and directives regarding the secure handling and storage of marine containers (e.g., physical security standards, escorting of high-risk containers to the container examination facility). Despite these policies and procedures, there remains an opportunity for containers to be tampered with or moved without authorization prior to an examination. [*] At the time of the audit, the CBSA was engaged in discussions with industry partners in the Atlantic region for a new marine container examination facility. The CBSA is currently working to develop a section 6 policy framework which is expected to clarify the requirements for an owner/operator to provide adequate, functional facilities, that meet Government of Canada security standards as well as a provide a framework for addressing compliance issues.

50. The audit found that the Agency is working to address risks associated with organized crime at marine ports of entry through the Enforcement and Intelligence Operations Directorate’s ongoing work with Transport Canada and through the implementation of Customs Controlled Areas in the commercial marine mode. The Agency is also working to develop a policy and procedures to standardize the use and management of CBSA container security seals, which are used to seal shipping containers.

51. The 2012 internal audit recommended a review of the security surrounding the handling and storage of marine containers, and taking action to strengthen security. While the audit did not find evidence that the management action plan had been implemented, there have been recent efforts as noted in the previous paragraphs. In addition, CBSA Physical Security is currently conducting Marine Operational Site Reviews and the Operations Branch completed a National Marine Program Delivery Review in July 2018. These reviews highlight additional measures that can be taken to improve security and operational delivery of the program. With the upcoming renewal of Agency governance and organizational structures, it will be critical for management to address the findings of these reviews under the new model.

Administrative Monetary Penalties

52. Administrative Monetary Penalties are one of several mechanisms the Agency can leverage to address non-compliance with requirements related to the reporting and movement of commercial goods. Other mechanisms include outreach, the issuance of warnings/letters, carrier registration (bonded carriers), trusted trader programs, prosecutions, seizing or holding goods, the issuance of do not load or unload orders, and returning (i.e., re-exporting) the shipment. BSOs have access to online training, policies and procedures, and operational bulletins related to the application of administrative monetary penalties. A quality assurance process is in place to assess the soundness and quality of the Notices of Penalty Assessment and to detect challenges and inconsistencies, identify areas for improvement, and propose amendments in the application of penalties across regions.

53. In the commercial marine mode, there is a heavy reliance on marine port authorities and service providers such as terminal and container examination facility operators for the security, delivery, and off- and re-loading of shipments. While the Agency can issue a penalty when goods are not presented for examination, there is no mechanism to ensure that goods are presented for examination in a timely manner. What is considered “timely” is not explicitly defined in legislation, Agency policies, or in service level agreements with marine terminal operators. The Agency must effectively balance maintaining a collaborative working relationship with these service providers while enforcing CBSA requirements and penalizing non-compliance. Between 2014 and 2017, only 66 penalties were issued to major marine terminal operators. Of these, 53% were issued in the Atlantic region and the majority of the penalties were for moving/removing goods that were not released from a sufferance warehouse or failing to report the receipt of goods.

54. For several reasons, the Agency has not been actively using penalties to enforce compliance with marine Advance Commercial Information (ACI). With the 2015 implementation of bay plan requirements, the Agency initiated a period of informed compliance (i.e. a leniency period) as per World Customs Organization ACI implementation guidelines.^{Footnote 22} Secondly, following complaints from industry consortium in 2016, the issuance of ACI penalties were put on hold pending clarification of operator liability for providing the ACI. In September 2017, the Agency issued a Customs Notice to clarify the responsibility of cargo carriers and conveyance operating carriers in providing the ACI.^{Footnote 23} As such, only 261 marine ACI-related penalties have been issued since 2015, despite the significant number of carriers providing CBSA with insufficient advance information to perform a pre-arrival risk assessment, as previously noted in paragraph 43. Of the 261 ACI penalties issued, the majority of penalties (77%) were for failure to provide a “conveyance arrival certification message” to confirm the arrival of the vessel. The following table provides additional detail:

55. In the absence of complete and timely ACI, bay plan, and crew information, the Agency is limited in its ability to facilitate low-risk shipments or [*] this may result in undue safety and security risks to Canada. The Agency and importers may also be exposed to unnecessary time and costs associated with conducting exams without a process to reconcile pre- and post-arrival information to negate risk. Further, in the absence of robust security requirements throughout the complete import to examination process, marine cargo may be tampered with, stolen, or moved prior to examination and this increases health, safety, and security risks of Canadians and Agency staff.

Appendix A – About the audit

Audit objective and scope

The objective of this audit was to provide assurance that Agency responsibilities for the Commercial Marine Program are appropriately carried out and managed. This audit also followed up on key findings and recommendations of past audits. Specifically, the objectives of the audit were to assess whether:

• Program management effectively monitors program risks and performance and develops plans and strategies as necessary to adapt to a changing environment;
• Efforts are made to resolve discrepancies in the reporting of commercial information to negate unknown risk and focus on high-risk shipments and vessels;
• Examinations of marine cargo and vessels are properly documented and used to inform decision-making for subsequent targeting, examinations and adequacy of detection tools and technology;
• Commercial marine compliance and physical security controls are functioning as intended.

The audit focused on program management and monitoring, and followed-up on recommendations from the 2012 Audit of Border Controls at Marine Ports of Entry related to radiation portals, bay plan, examination results, penalties and physical security. The audit scope covered the period from April 2014 to March 2017.

The audit included commercial marine cargo and conveyances but excluded traveller processing, private, scientific and military vessels and cruise ships.

The audit did not examine the quality of ACI because a current audit of ACI in the air mode is expected to highlight overall issues the Agency faces with commercial ACI. However, the audit examined the extent to which efforts are made to request additional information as required for informing targeting decisions as well as the Agency’s efforts to reconcile and use bay plan information.

The audit scope excluded the TITAN risk scoring system^{Footnote 25}, Vessel Analysis Targeting System (VATS), random referrals process, and lookouts (as a follow-up audit of lookouts is planned for 2018-2019). The audit also excluded marine container examination facility project management and implementation, the exports program, and post-border examinations related to trade/commercial import compliance.

An audit of the Marine Commercial Program was approved by the Agency’s Audit Committee as part of the Risk-Based Audit Plan 2017-2022.

Risk Assessment

A preliminary risk assessment was conducted during the audit planning phase and identified the following key risks:

1. The program may not be able to adapt effectively or efficiently to emerging risks/changing needs (e.g. new concealment methods, rising volumes included arctic shipping, risks associated with outdated and inadequate IT systems and capital infrastructure).
2. The Agency may not be able to meet public and stakeholder expectations (e.g. complaints from industry on the delays and cost of examinations).
3. Business processes may be inadequate for effectively identifying and intercepting illicit goods [*]).
4. Performance monitoring and performance information may not effectively support decision-making and continuous improvement (e.g. closing the loop on examinations, meeting of service standards, and effectiveness of detection technology).
5. [*]
6. Penalties may not be applied or may not be effective for enforcing compliance.

Approach and Methodology

The audit was conducted in accordance with the Government of Canada's Policy on Internal Audit and the Internal Auditing Standards for the Government of Canada. The examination phase of this audit included the following methodologies:

• Interviewing stakeholders, specifically staff in the Programs, Operations, Finance and Corporate Management, and Information, Science and Technology branches, and external stakeholders such as Port Authorities;
• Reviewing and analyzing information from various sources, such as, but not limited to, legislation, policies, procedures, and reports;
• Conducting site visits to observe and discuss processes, procedures and controls; and
• Data analysis of targeting referrals, the recording of examination/rummaging results, and the application of penalties.

The audit team visited the Atlantic Region (Halifax) during the planning phase and Pacific Region (Vancouver) and Quebec Region (Montréal) during the examination phase.

Audit criteria

The following audit lines of enquiry and criteria were selected:

Appendix B – List of acronyms

ACI

Advance Commercial Information

ACROSS

Accelerated Commerce Release Operations Support System

AMP

Administrative Monetary Penalty

AMPS

Administrative Monetary Penalty System

APS

Agency Performance Summary

BSO

Border services officer

CBSA

Canada Border Services Agency

CPMT

Commercial Program Management Table

CTAS

Commercial Threat Assessment System

NTC

National Targeting Centre

PANS

Pre-arrival Notification System

RadNet

Radiation Detection Network

RFI

Request for Information

ROV

Remote Operating Vehicle

TITAN

Commercial Targeting System

VATS

Vessel Analysis and Targeting System

Date modified:

2019-05-16