Audit of compensation processes and controls: Appendix A
About the audit
Audit objectives and scope
This Audit of Compensation Processes and Controls was approved by the Agency's Audit Committee as part of the Risk-Based Audit Plan 2019–2020 to 2023–2024.
The audit objective was to assess the adequacy and effectiveness of the governance and controls over the HR-to-Pay process, as well as to assess whether stakeholders have access to training and support to effectively execute the HR-to-Pay process.
The audit scope covered the CBSA's HR-to-Pay process between and . However, for the purpose of controls testing, the scope focussed on fiscal year 2019–2020. Specifically, this audit examined:
- processes and internal control framework for the HR-to-Pay lifecycle, including the timeliness and accuracy of pay actions
- financial reporting of the Agency's payroll expense
- pay system controls
- governance and oversight of HR-to-Pay function
- communication and training
This audit did not include the following:
- elements of processes and systems that are outside of the control of the CBSA
- information management practices over employee personal information
- employee benefits and insurance
- payroll taxes and deductions administered by PSPC
Due to limitations surrounding the COVID-19 pandemic, there was no travel during this audit; however, all regions were included and some were contacted for interviews, survey and/or documentation requests.
Risk assessment
A preliminary risk assessment was conducted during the audit planning phase to identify potential areas of risk as well as audit priorities. The methodology used to develop the risk assessment included interviews with stakeholders involved in the HR-to-Pay process, reviews of relevant documentation and preliminary analysis of available reports. As a result of this assessment, the following key risks related to the HR-to-Pay process were identified and assisted with the development of the audit objective, scope and criteria:
- the agency's HR-to-Pay processes and controls may not be designed and operating effectively to facilitate accurate and prompt payment to employees
- communication may not occur promptly and transparently with internal stakeholders, including the sharing of sufficient information with senior management to facilitate strategic decision-making
- employees may be unclear or unaware of their roles and responsibilities and may receive insufficient training leading to errors or inefficiencies in the execution of the HR-to-Pay processes
- agency may not be able to recruit and retain qualified Compensation Advisors leading to untimely processing of pay actions or errors in the execution of the HR-to-Pay processes
- errors in the payroll expenditure data may impact the accuracy of the Agency's Financial Statements; the agency may be relying on third party stakeholders for ongoing support and maintenance without having sufficient assurance or oversight over critical compensation systems
Approach and methodology
The examination phase of this audit was performed using the following approach:
- interviews with various individuals involved in the HR-to-Pay process in headquarters and the regions
- survey was sent to 870 internal HR-to-Pay stakeholders; we received responses from 287 stakeholders, which resulted in a 33% response rate
- review of documentation related to the HR-to-Pay processes
- walkthroughs of compensation systems and sub-processes
- review and analysis of data from various sources including the Corporate Administrative System (CAS), EIC and Phoenix
- review of a sample of pay transactions to assess process compliance and internal controls
Audit criteria
Given the preliminary findings from the planning phase, the following criteria were chosen:
Line of enquiry 1: Accountability, governance and communication
Audit criteria:
- 1.1 Roles, responsibilities and accountabilities related to the Agency's HR-to-Pay activities are clearly defined and communicated to the relevant stakeholders.
- 1.2 Relevant information is collected and communicated in a timely manner to stakeholders through formal governance forums and other channels, both internally (communication between branches, communication with impacted employees) and externally (communication with other government departments).
Line of enquiry 2: Recruitment, training, guidance and retention
Audit criteria:
- 2.1 Employees receive guidance, training and support to perform their duties, both internally by the Agency and externally by PSPC, where applicable, in order to effectively execute their responsibilities.
- 2.2 Mechanisms are in place to recruit and retain Compensation Advisors.
Line of enquiry 3: HR-to-Pay controls and systems
Audit criteria:
- 3.1 Key HR-to-Pay internal controls are operating effectively to ensure that pay transactions are valid and accurate for processing of pay-related actions, as well as the reporting of payroll expense in the Agency's financial statements.
- 3.2 IT systems that support the HR-to-Pay process meet user needs and accurately process transactions.
- Date modified: