Internal Audit and Program Evaluation Directorate
Audit of Revenue Collected by the CBSA
March 2019

1.0 Introduction

1. The Canada Border Services Agency (CBSA or the Agency) ensures Canada’s security and prosperity by facilitating and overseeing international travel and trade across Canada’s border. The Agency’s legislative, regulatory and partnership responsibilities include the collection of applicable duties and taxes on imported goods. In addition to duties and taxes, the Agency also collects other fees and penalties as well as revenue on behalf of other government departments.

2. Revenue is collected in both the traveller and commercial streams. While payment of customs duties is payable at the time of importation into Canada, the CBSA has established programs for low-risk, pre-approved commercial importers which simplifies many of the import border requirements so that low-risk shipments can be processed more quickly and efficiently. Eligible importers and customs brokers are able to make monthly payments on account rather than paying when the goods are released. In 2017, the CBSA centralized the collection of commercial accounts receivable to Headquarters (HQ) at the National Payment Processing Centre. Those who make monthly account payments are required to send a cheque to the National Payment Processing Centre or pay via online banking or electronic data interchange. Revenue from the commercial stream was approximately $32 billion in 2017–2018 (Figure 1).

3. Revenue from the travellers stream was approximately $88 million in 2017–2018 (Figure 1), which is less than 1% of the Agency’s total revenue. However, the CBSA processes over 90 million travellers a year, many of whom will self-declare or will need to be risk-assessed to determine if a payment on imported goods is required.

4. When payment is collected, the initial revenue entry is made in either the Accounts Receivable Ledger (ARL) system or the Travellers Entry Processing System (TEPS). ARL is the system of record for commercial accounting and payment at the CBSA. It was developed as phase one of the CBSA Assessment and Revenue Management (CARM) project. There are 21 ports of entry (POEs) designated as ARL Payment Processing Sites that are able to process payment through ARL in addition to the National Payment Processing Centre at HQ. TEPS is installed at approximately 230 POEs across the country and is used to process traveller transactions as well as commercial payments at non-ARL processing sites. If commercial revenue is recorded in TEPS, the transaction is later reconciled and cleared through ARL. TEPS was built in the 1990s and was designed to automate many of the tasks involved in the processing of travellers’ casual goods, primarily collecting revenue. Approximately 98% of traveller revenue is collected through TEPS. In 2016–2017, TEPS processed over 900,000 transactions and was used to collect over $100M in duties and taxes (traveller and commercial).^{Footnote 1}

5. There have been many changes with regards to revenue collection over the last decade. In-person transactions have transitioned from paid by cash to predominantly credit or debit, and payments on account are made either by cheque or electronic deposit. A reduction in the collection of cash decreases the risk of lost or stolen money as the collection and retention of cash poses the greatest risk of misappropriation.

6. In addition to changes in the method of payment, several other factors have impacted revenue trends over the past several years, including an increase to the personal exemption limits in 2012, the weakening of the Canadian dollar, changing free trade agreements, and a shift towards online as opposed to in-person purchasing.

7. During the audit, the team visited 15 POEs as well as the HQ National Payment Processing Centre. These visits allowed the audit team to meet with the employees involved in the revenue collection process, view facilities where revenue is collected and stored, and observe the collection of revenue. The sites selected as well as the factors considered in selection are listed in Appendix A.

2.0 Significance of the audit

8. This audit is of interest to management due to the Agency’s role in collecting, storing, and depositing revenue on behalf of the Receiver General of Canada as well as the inherent risks associated with handling money. It is imperative that internal controls are in place and functioning as intended in order to properly safeguard and account for revenue collected by the CBSA. Adequate guidance, processes and systems are required to support the Agency’s revenue collection activities in order to mitigate the risk for lost or misappropriated revenue.

9. The audit objective was to assess the management control framework and systems in place for the collection of revenue to ensure sound revenue collection practices.

10. The scope of the audit covered the collection process in the commercial and traveller stream from the receipt of payment at the POE or HQ until the monies were recorded and sent to the bank for deposit. The revenue considered as part of the scope included cash, cheque, debit or credit card payments made for either direct payment or payment against accounts receivable. Electronic banking and direct deposits were excluded from the scope as CBSA employees are not involved in the processing of these payment types. The audit also excluded the project management and implementation of ARL and CARM, as well as the reporting of revenue in the Agency’s financial systems as this part of the process is audited by the annual audit of public accounts conducted by the Office of the Auditor General of Canada. Refunds, adjustments, and money seized from enforcement actions were not included in the scope.

11. The detailed audit scope and criteria can be found in Appendix B.

3.0 Statement of conformance

12. This audit was conducted in conformance with the Treasury Board Policy and Directive on Internal Audit and the Institute of Internal Auditors’ International Professional Practices Framework. Sufficient and appropriate evidence was gathered through various procedures to provide an audit level of assurance. The Agency’s internal audit function is independent and internal auditors performed their work with objectivity as defined by the Institute of Internal Auditors’ International Standards for the Processional Practice of Internal Auditing.

4.0 Audit opinion

13. The Agency has established key controls to collect, store, and deposit money. Revenue processes are established and include appropriate access controls to safeguard money collected. Audit testing demonstrated that all revenue amounts reconciled with supporting documentation and bank deposits. Opportunities exist to identify and document key controls, streamline processes and better manage access to systems which support the Agency’s collection of revenue. Improvements in these areas will ensure that revenue collected by the CBSA continues to be handled and safeguarded in an appropriate manner. The Agency can also further build on ongoing transformation initiatives to modernize the way the CBSA collects revenue.

5.0 Key findings

14. Processes for the collection of revenue were in place but varied from site to site in order to accommodate differences in operational realities. Despite the variations, key controls were in place to ensure that revenue was collected, stored, and deposited effectively at all sites visited during the audit.

15. The policies, procedures and guidelines for the collection of revenue are outlined in the CBSA’s Comptrollership Manual: Finance Volume. However, this document is outdated and not commonly referenced. Individuals involved in the revenue collection process take guidance from on-the-job training and locally developed standard operating procedures. Centralized policy and guidance could be updated to better reflect the current operating environment, as well as to communicate key controls and streamlined document requirements.

16. The Agency uses two IT systems for the collection of revenue: TEPS and ARL. Improvements to the management of user access are required to ensure that access is aligned with users’ responsibilities as well as to ensure sufficient segregation of duties. Additionally, TEPS is a legacy IT system, which necessitates manual transfer of revenue data to the CBSA’s revenue ledger, and is no longer supported by the software provider. Until a replacement system or an alternate solution is implemented, the Agency is left vulnerable to increased maintenance requirements and costs resulting from system failure and obsolescence.

17. Data collection and retention could be improved. The lack of integration between systems, as well as reporting functionality issues in TEPS and ARL, resulted in difficulty obtaining data which would assist stakeholders with strategic decision making.

18. The CBSA has recently taken measures to modernize the collection of commercial revenue through a requirement for electronic payment as well as the development and implementation of new IT systems, ARL and CARM. A strategic plan for the future of the revenue collection function for revenue unaddressed by CARM is needed.

6.0 Summary of recommendations

19. The audit makes three recommendations relating to:

• Updating policies and guidance, including identifying key controls and documentation requirements, as well as developing a risk-based approach to oversight;
• Performing periodic review of the user access for revenue collection systems, TEPS and ARL, to ensure appropriate user access and adequate segregation of duties; and
• Identifying risks and developing a plan for the future of revenue collection in the travellers stream and the decommissioning of TEPS.

7.0 Management response

8.0 Audit findings

8.1 Revenue Collection Process and Internal Controls

Policies, procedures, and guidance

20. Policies, procedures and guidance should be identified and provided to personnel involved in the revenue collection process in order for them to properly perform their duties. Inadequate guidance can lead to inconsistent application or limited knowledge of processes and controls.

21. The Comptrollership Manual: Finance Volume is the Agency’s central resource for policies, procedures, and guidance on revenue collection. The various sections within the Finance Volume that relate to revenue collection were most recently updated anywhere from 2006 to 2016. The full volume was officially archived on the Agency’s intranet on May 24, 2017 for reference, research or recordkeeping purposes. The information in the Finance Volume has not been updated to reflect changes to the current environment, such as the need for penny-rounding or the implementation of ARL. In addition, there are instances where sections of the Finance Volume provide duplicate information, such as multiple ways to approach completing the daily revenue packages and the Customs Revenue Report (K10), as well as the treatment of overages/shortages, and deposits. Despite the fact that the information in the finance volume is outdated, there was limited impact on the execution of the revenue collection process.

22. CBSA employees involved in the revenue process (at the clerk, border services officer, or supervisor/superintendent level) indicated that they were comfortable with performing their duties. The majority indicated that they learned processes and responsibilities related to revenue collection via on-the-job training. In most cases, they were not aware of, or did not refer to, standard guidance such as the Finance Volume. The majority of the knowledge related to the process was developed over time with experience and on-the-job support. In addition to on-the-job training, sites have developed their own standard operating procedures for specific parts of the revenue process.

23. Standardized guidance, such as the Finance Volume, would help reduce inconsistent application of processes and strengthen the delivery of key concepts.

Revenue collection processes

24. To mitigate the risk of error and fraud, sufficient processes, internal controls, and oversight ought to be in place and operating as intended to ensure revenue is collected and safeguarded. The key controls assessed included the proper physical security of revenue (including restricted access and secure storage), adequate approval, review and oversight of revenue collection activities, reconciliation of amounts, and adequate segregation of duties at various stages of the process.

25. In the regions, processes are adapted and modified to address the operational realities of the different locations. For example, the process at larger ports was typically more formal than the process at small and seasonal ports. These process variations were found to be reasonable so long as key controls were in place. We observed modification to key controls in order to address distinct operational needs. Since smaller ports had limited resources (including reduced staff and restrictive infrastructure), controls were adapted to address site-specific needs.

26. Key controls should be standardized in policy and procedures, and communicated to staff. The failure to do so can result in controls being skipped or missed when processes are modified and adapted. Policy and guidelines set the foundation for identifying the key controls that are required as well as the process for approving compensating controls. In instances where controls need to be adapted or compensating controls established, justification should be documented and approved at an appropriate level.

Physical Access

27. Physical access is an important control in the revenue collection process, as excessive access to secure areas increases the risk of asset misappropriation. At all sites visited during the audit, areas where cash is managed was not accessible to the public. At most sites, while access was not explicitly restricted to those employees with revenue collection duties, not all CBSA employees had access to the safes or cash drawers. Additionally, most sites had security cameras situated in places around where cash was handled.

28. Electronic means of access management (such as swipe card or key fob) provide greater control over access – such as ease of modification of access (adding or removing employee access) and oversight (tracking employee use at each entry point). However, most sites maintain access through traditional means such as keys or number pads. Variations in the physical layout and design of sites impacted the consistency of the key physical controls. Additionally, for the majority of sites visited, the audit team had difficulty obtaining employee access lists, due to the fact that lists were either not maintained or not readily available for many sites. Management at each site could be more proactive in the restriction of access and the maintenance of access lists.

Review, Oversight, and Approval

29. Oversight of the revenue collection process is an essential control that assists with detecting and reducing errors in the revenue collection process. Local oversight is conducted as part of the review of daily packages. Prior to 2015–2016, the Revenue Accounting and Reporting Division (RARD) in HQ conducted centralized oversight of the revenue process referred to as Revenue Management Reviews (RMRs). The decision to stop was impacted by several factors, including the historical demonstration of high compliance, the implementation of ARL, and the centralization of commercial payments to HQ. The creation of a centralized processing centre in HQ as well as the acceptance of e-payments have contributed to a significant reduction in the volume and value of payments that are handled by the POEs. As centralized payment and e-payment at HQ continue to grow in volume and dollar amount, RARD is concentrating its efforts on the oversight of the HQ National Payment Processing Centre. As a result, there is limited oversight of the revenue collection process in the regions.

Revenue documentation

30. In order to verify, reconcile and record the amount of revenue collected, daily revenue packages are prepared and retained by all sites. Revenue documentation must be complete and reconcilable to systems of record. A sample of 20 daily revenue packages was tested at each of the 16 sites visited.^{Footnote 2} Testing of the revenue packages included the review of end-of-shift and end-of-day reports for TEPS and ARL, signatures acknowledging review, and evidence of distinct preparers and reviewers (segregation of duties). Reconciliation between the amounts collected, the amounts sent to the bank for deposit, and the amounts recorded in the revenue system was performed.

31. Testing of the revenue packages identified that key controls were in place, packages included all expected documentation, and revenue amounts reconciled. While all packages were complete and reconcilable, there are opportunities to streamline the process. Without a clear process, unnecessary or inefficient tasks are being performed at some sites.

32. Some of the inefficiencies observed included the significance and placement of signatures (e.g., when and where they are required), the frequency and source for the preparation of the K10 (e.g., daily or weekly preparation and K10s being either combined or prepared for each individual payment type), and the use of the F88 form for overages/shortages (e.g., penny rounding, foreign exchanges gains or losses, immaterial variances). Additionally, end-of-shift record keeping was different at each site for documenting accountability. A streamlined process would ensure that all sites continue to meet requirements and that the administrative burden is reduced for those who currently perform additional steps in the process.

33. Overall, controls are in place to ensure revenue is collected, safeguarded, and deposited appropriately; however, additional attention could be given to determining and communicating key controls, including physical access controls and oversight.

Revenue systems (TEPS and ARL)

34. TEPS and ARL are the two CBSA applications that are used to record revenue collected. In order for these systems to effectively support the revenue collection process, system controls and processes should be in place to ensure that user access is appropriately managed and that adequate segregation of duties have been established and enforced. System controls and user access were assessed for both ARL and TEPS as part of the audit.

ARL

35. ARL is the official system of record for commercial accounting and payment at the CBSA. ARL is used to process commercial payments at the National Payment Processing Centre as well as 21 regional POEs across Canada. Information captured in ARL feeds other CBSA systems, including the revenue ledger.

36. There are three key roles in ARL related to revenue collection: cashier, deposit clerk, and supervisor. There are a total of 527 unique users CBSA-wide with at least one of these roles. Of the full population of ARL users in the three key revenue roles, five users were found to have duplicate user IDs. Three users had incompatible roles, which permits them to perform the duties of a deposit clerk or cashier, such a recording the payment, as well as supervisor duties such a voiding/reversing payments. Additionally, there were 106 user IDs that were not linked to active employees.

37. The audit team selected a judgemental sample of 90 ARL users to assess whether their access was aligned with their duties. Excessive access was identified for 15 of the 90 users (e.g., currently employed at non-ARL sites, level of access was excessive for current role, or had never worked in ARL).

38. Overall, the cashier, deposit clerk, and supervisor roles in ARL are held by some employees who should not have had this access at the time of the test, suggesting that access was inappropriately granted and/or maintained.

TEPS

39. TEPS is the system used for the processing of travellers’ goods, including assessment of amount owing, collection of payment, and issuance of receipts. Commercial revenue is also collected through TEPS where commercial clients are not established on account and where the POE is not designated as an ARL payment processing site. TEPS is installed locally at each site and is not integrated with any other revenue systems.

40. Testing of TEPS user access and segregation of duties was conducted on users at ports visited during the audit. There was a total of 2,763 TEPS users at the 15 sites visited during the audit (HQ Central Processing Centre is ARL-only). TEPS user access is managed individually at each site since it is a local system.

41. A judgemental sample of users at each POE visited was selected to assess user access and segregation of duties. Of note, one of the POEs visited had three users with excessive administrative access to alter user permissions within TEPS. Additionally, there were 219 users across three POEs that had excessive administrative access to purge data, which could result in a loss of data prior to recording or back-up.

42. Across all POEs visited, there were approximately 632 users that had access to incompatible tasks (cashier and void functions). This figure excludes allowances made for reasonableness at smaller ports to address operational realities (e.g., the necessity of a supervisor having cashier and void functions).

43. To determine the reasonability of user access, testing was performed to determine if the user’s access was aligned with their current role and if the user was still actively employed at the POE.

44. We identified access issues at nine POEs, where a total of 48 users were identified as having excessive access or as being no longer employed at that site. As this test was not based on the full population, it is very likely that there are additional users across the country with excessive access to TEPS.

45. Periodic review and increased controls around the management of user access and improved segregation of duties for ARL and TEPS would address some of the issues that were identified in our testing. While managers are responsible for reviewing and managing their employees’ user access to ARL through the Access Review and Certification (ARC) web application launched in 2018, there still remain a large number of users with inappropriate access. The ARC also does not include TEPS user access, which must be managed site-by-site. Failure to prevent access to incompatible tasks within systems used for revenue collection can facilitate asset misappropriation. A lack of proper controls over the management of user access increases the risk of inappropriate use of Agency systems, including intentional or accidental modification of data.

8.2  Information for Decision-Making

46. Sufficient and reliable revenue-related data can support strategic planning and monitoring activities such as resource allocation. The audit assessed whether relevant information related to revenue collection is received, communicated, and reported on in a timely manner to stakeholders.

47. In trying to obtain data throughout the audit, it was noted that the lack of integration between systems, as well as the reporting limitations in TEPS and ARL, resulted in difficulty obtaining certain data, including: concrete figures demonstrating the amounts collected at POEs vs HQ, the volume of revenue transactions, and an overall summary of payment by type (e.g., cash, cheque, POS, electronic etc.) from both systems. This data would have provided the audit team with additional context and assisted in identifying areas of risk.

48. So far, stakeholders have not had the need for this type of data. Those requiring information related to revenue felt that they obtain all the information that they need. Nevertheless, a lack of relevant and sufficiently granular data can prevent stakeholders from making informed decisions related to strategic planning and monitoring.

8.3 Future Vision for Revenue Collection

49. The CBSA is undergoing a period of transformation, with renewal initiatives aimed to modernize all areas of the Agency. As part of the CBSA’s mandate, it is important that revenue collection is considered and modernized along with other aspects of the Agency. Delays in modernizing the CBSA’s revenue collection processes will continue to impact operational resources and the CBSA’s ability to address clients’ evolving expectations.

50. Transformation of the collection of revenue in the commercial stream started in 2017, including initiatives such as the implementation of ARL, the centralization of commercial payments to HQ, and the requirement for electronic payment on amounts exceeding $50,000. There has been an increase in the volume and value of revenue collected electronically due to the D-memorandum issued in October 2017 (D17-5-1) requiring electronic payment on imported commercial goods for customs account holders with monthly account balances exceeding $50,000. Additionally, commercial revenue collection will be further modernized through CARM.

51. However, while commercial revenue accounts for the largest dollar value of revenue collected, it is important that the Agency also focus on developing a concrete vision for the future of revenue collected at the POEs, which includes revenue from the traveller stream.

52. While ARL is integrated with other CBSA systems to allow the flow of revenue data to the Agency’s financial reporting systems, TEPS is a stand-alone system requiring a manual transfer of data to Customs Commercial System’s G11 program. This lack of integration increases the risk of entry errors feeding the CBSA’s financial statements. TEPS is an aging application and is no longer supported by the software manufacturer. Additionally, there are limited CBSA resources available with knowledge of the TEPS platform. The obsolescence of TEPS may result in irreparable system failure, which would impact the ability to collect duties and taxes at the border and have a negative impact on the Canadian economy. The CBSA’s IT Plan highlights the preliminary progress towards the retirement and replacement of the system to ensure sustainability and program integrity.

53. In the regions, revenue collection is resource intensive, more cash-based, subject to high transaction volume and occurring daily. As CARM will not impact this segment, a modernized vision for the collection of revenue in the travellers stream, such as app-based payment, would contribute to addressing these risks.

Appendix A – Audit sample (Revenue sites)

The following sites were visited as part of the audit.

Several factors were considered when selecting the sample ports of entry:

• Resource limitations and practicality (i.e. remote ports of entry were excluded for this reason)
• Coverage of ports with both high and low volumes of travellers and commercial goods
• Coverage of modes (land, air)
• Coverage of regions based on volumes and materiality
• Coverage of ARL-enabled and non-ARL-enabled sites
• Results of control testing by Revenue Management Review (RMR) in prior years
• Past coverage of ports in RMR and other internal control testing
• Based on interviews and document review at the planning stage, key controls should be similar at each port

Appendix B – About the audit

Audit objective and scope

The objective of this audit was to assess the management control framework and systems in place for the collection of revenue to ensure sound revenue collection practices.

The scope of the audit included the collection of revenue at HQ and at POEs occurring between April 1, 2017 and September 30, 2018.

Revenue in scope may:

• be received via cash, cheque, debit or credit card
• represent either a direct payment or a payment against an account receivable
• originate from either the traveller or commercial stream
• be allocated to a variety of accounts, such as duties, taxes, fees, penalties, and services
• represent revenue to the Agency or be collected on behalf of third parties.

The audit covered the collection process from the receipt of payment at the POE/HQ until the monies are recorded and sent to the bank for deposit.

The audit scope specifically excluded the following:

• Project management and implementation of ARL and CARM;
• Reporting of revenue in the Agency’s financial statements;
• Refunds and adjustments;
• Money seized from enforcement actions;
• Assessment of amounts owing from clients;
• Allocation of cash received to the proper general ledger account;
• CBSA transfers of revenue collected on behalf of third parties; and
• Revenue transfers collected by third parties on behalf of the CBSA.

Risk assessment

A preliminary risk assessment was conducted during the audit planning phase to identify potential areas of risk as well as audit priorities. The methodology used to develop the risk assessment included interviews with stakeholders involved in the revenue collection process, reviews of relevant documentation and preliminary analysis of available data. As a result of this assessment, the following key risks related to the collection of revenue were identified:

• The potential for the loss or theft of revenue collected, including the risk of fraud, may not be mitigated;
• Risks to the revenue collection process may not be identified, documented, and monitored;
• Controls may not be in place to ensure the security of revenue collected;
• Processes may not be established to support revenue collection activities;
• System access may not be managed to ensure appropriate access; and
• Monitoring and oversight of the revenue collection process may not be occurring.

Approach and methodology

The audit was conducted in accordance with the Internal Auditing Standards for the Government of Canada and the Institute of Internal Auditors Standards for the Professional Practice of Internal Auditing.

The following methodologies and techniques were used during audit:

• Interviews with key stakeholders across the Agency (including FCMB, Regional Operations, and ISTB).
• Review of documentation related to the revenue collection process.
• Site visits to various regions to observe the revenue collection processes.
• Review and analysis of data from various sources, such as, but not limited to, the Consolidated Management Reporting System (CMRS), the Accounts Receivable Ledger (ARL), the Customs Commercial System and the Travellers Entry Processing System (TEPS).

Audit criteria

The audit criteria are aligned with the Government’s Management Accountability Framework, the framework of Core Management Controls and Audit Criteria established by the Office of the Comptroller General and the Committee of Sponsoring Organizations of the Treadway Commission Principles of Effective Internal Control.

Given the preliminary findings from the planning phase, the following criteria were chosen:

Appendix C – List of acronyms

ARC

Access Review and Certification web application

ARL

Accounts Receivable Ledger

CARM

CBSA Assessment and Revenue Management

CBSA

Canada Border Services Agency

FCMB

Finance and Corporate Management Branch

F88

Cashier’s Shortage / Overage Report

HQ

Headquarters

ISTB

Information, Science and Technology Branch

K10

Customs Revenue Report

POE

Port of entry

POS

Port of sale

RARD

Revenue Accounting and Reporting Division

SOP

Standard Operating Procedures

TEPS

Travellers Entry Processing System

Date modified:

2019-07-29