What did we achieve?

For our team, the biggest achievements of our value-added project for ECCC were as follows:

• Reaching the ongoing monitoring status on the pay administration process at ECCC. This implies more efficiency in detecting key risks and changes in the pay administration process control environment. It also improves the confidence in and the understanding of the information provided to management to support decision-making.
• Better understanding by stakeholders of their responsibilities, as the well-documented business process informed the development of training materials for employees.
• Strong commitment at all levels to address pay-related issues, as the renewed process increased staff awareness of the objectives and the importance of following controls.
• A stronger Internal Control team due to the experience gained on a complex and sensitive project.
• Enhancement of the culture of innovation at ECCC.
• Contribution to productive reallocation of resources. A member of the Internal Control team was trained to test the controls and was deployed to an operational role at the end of the project.

In addition, in terms of methodology, the ECCC Internal Control team gained a new approach to testing by systematically using data analytics to examine ECCC key internal controls whenever the available information allows this approach. Data analytics allowed data to be captured, processed, and organized to reveal issues to be addressed by actionable management plans for the pay administration process. The Internal Control team established the best way to present this data, in order to lead to immediate improvements instead of a debate on the extent of the issues.

What were our critical success factors?

Our assertive approach was ultimately successful because of the commitment of the project team and management, and the buy-in from our stakeholders. The speed of transformation in the department required quick, agile, and timely assurance work. A traditional assurance model would not have been as effective.

Strong leadership, embracing change, and a commitment to continuous improvement were crucial for our Internal Control team in delivering successfully on this agenda and on providing additional assurance on the accuracy of salary expenditures.

Multiple factors contributed to the success of our new assurance approach. The most important was the tone from the top, as the engagement from ECCC senior management and timely briefing up at all levels provided the required momentum for the redesign of the pay administration process. In addition, the Internal Control team played a leadership role in risk management by identifying blind spots, and played a catalyst role through experimenting with new controls. This incubation was done by training staff on these new controls and relaying the controls back to the business process owners to apply them on an ongoing basis. This was also the trigger for the business process owners to consult the Internal Control team on an ongoing basis on controls.

Other factors contributed to the success of our new assurance approach, including:

• Strong knowledge of the Government of Canada’s pay management framework
• Ongoing consultation at all levels, including internal and external stakeholders
• Effective use of existing tools and access (PSPC Internal Audit business role within the Phoenix pay system)
• Personal implication of the executive level during the field work – both from the Internal Control team and the client organizations
• Clear and transparent follow-up on all issues identified
• Provision of an award to recognize the role of employees involved

How can you apply a similar methodology in your organization?

Whether providing consulting or assurance services, auditors may decide to use the described approach alone or in coordination with their organization’s internal control team. The methodology followed is composed of rigorous and comprehensive processes, continuous supervision, and testing of internal controls. Due consideration and thorough discussion of several factors related to independence and objectivity should happen when preparing the internal audit program, a part of which may include reliance on the work of the internal control team.

To determine whether they can adopt this approach, internal controllers or auditors should ask themselves the following questions:

• Are there highly visible, large, and rapid-paced projects going on in your organization?
• Are you ready, willing, and able to concede temporarily some of your inherent independence in order to provide a more timely assurance to senior management that a key process is working as intended?
• Do you have access to the necessary expertise and resources, both financial and human, and are your executives ready to invest their own time in a demanding project in order to enhance the business process?
• Do you have explicit support from senior management?

Working with your professional practices group to adapt tools, and communicating expectations and results at all levels on an ongoing basis will also help you achieve your objectives.

Conclusion

By reaching the ongoing monitoring status on the pay administration process, ECCC demonstrates its commitment to address potential issues around the implementation of the Phoenix pay system.

Auditors and internal controls specialists, using data analytics and agile methods, can play a key role in enhancing the pay administration process by providing valuable assurance and advice.

References

Office of the Auditor General of Canada (2018). Spring Reports – Report 1 – Building and Implementing the Phoenix Pay System

Office of the Auditor General of Canada (2017). Fall Reports – Report 1 — Phoenix Pay Problems

Public Services and Procurement Canada (2018). Update on Progress: Government Actions to Stabilize the Public Service Pay System

Treasury Board of Canada Secretariat (2017). Guideline on Financial Management of Pay Administration