Audit of compensation processes and controls: Appendix A

Audit objectives and scope

This Audit of Compensation Processes and Controls was approved by the Agency's Audit Committee as part of the Risk-Based Audit Plan 2019–2020 to 2023–2024.

The audit objective was to assess the adequacy and effectiveness of the governance and controls over the HR-to-Pay process, as well as to assess whether stakeholders have access to training and support to effectively execute the HR-to-Pay process.

The audit scope covered the CBSA's HR-to-Pay process between July 1, 2018 and June 30, 2020. However, for the purpose of controls testing, the scope focussed on fiscal year 2019–2020. Specifically, this audit examined:

• processes and internal control framework for the HR-to-Pay lifecycle, including the timeliness and accuracy of pay actions
• financial reporting of the Agency's payroll expense
• pay system controls
• governance and oversight of HR-to-Pay function
• communication and training

This audit did not include the following:

• elements of processes and systems that are outside of the control of the CBSA
• information management practices over employee personal information
• employee benefits and insurance
• payroll taxes and deductions administered by PSPC

Due to limitations surrounding the COVID-19 pandemic, there was no travel during this audit; however, all regions were included and some were contacted for interviews, survey and/or documentation requests.

Risk assessment

A preliminary risk assessment was conducted during the audit planning phase to identify potential areas of risk as well as audit priorities. The methodology used to develop the risk assessment included interviews with stakeholders involved in the HR-to-Pay process, reviews of relevant documentation and preliminary analysis of available reports. As a result of this assessment, the following key risks related to the HR-to-Pay process were identified and assisted with the development of the audit objective, scope and criteria:

• the agency's HR-to-Pay processes and controls may not be designed and operating effectively to facilitate accurate and prompt payment to employees
• communication may not occur promptly and transparently with internal stakeholders, including the sharing of sufficient information with senior management to facilitate strategic decision-making
• employees may be unclear or unaware of their roles and responsibilities and may receive insufficient training leading to errors or inefficiencies in the execution of the HR-to-Pay processes
• agency may not be able to recruit and retain qualified Compensation Advisors leading to untimely processing of pay actions or errors in the execution of the HR-to-Pay processes
• errors in the payroll expenditure data may impact the accuracy of the Agency's Financial Statements; the agency may be relying on third party stakeholders for ongoing support and maintenance without having sufficient assurance or oversight over critical compensation systems

Approach and methodology

The examination phase of this audit was performed using the following approach:

• interviews with various individuals involved in the HR-to-Pay process in headquarters and the regions
• survey was sent to 870 internal HR-to-Pay stakeholders; we received responses from 287 stakeholders, which resulted in a 33% response rate
• review of documentation related to the HR-to-Pay processes
• walkthroughs of compensation systems and sub-processes
• review and analysis of data from various sources including the Corporate Administrative System (CAS), EIC and Phoenix
• review of a sample of pay transactions to assess process compliance and internal controls

Audit criteria

Given the preliminary findings from the planning phase, the following criteria were chosen: