Issue notes: Standing Committee on Public Accounts—Report 1, ArriveCAN (May 14, 2024)

Summary of Recommendations

• a) Ensuring procurement files contain all documentation of business value
• b) Obtaining greater assurance that Section 34 for contracts is appropriately carried out by managers
• c) Increasing management's awareness surrounding contracting rules
• d) Increasing oversight of the use of Standing Offers and Supply Arrangements in a risk-based manner

Summary of CBSA Management Response and Action Plan

• All delegated managers / Cost Centre Managers (CCMs) are required to inform FCMB Procurement of any contracts or call-ups requested directly from PSPC, in order to maintain a central record of all CBSA contracts. (Completed)
• A revised contract documents checklist was distributed to all procurement staff and remind them of the requirements to complete and retain the necessary records (for example, conflict of interest declarations, bid evaluations, etc.). (Completed)
• Available procurement training products (PSPC, CSPS, etc.) were reviewed to assess whether additional training is required for delegated managers through supplemental guidance or training materials. (Completed)
• Quality assurance reviews were performed on a risk-based sample of procurement files to ensure proper retention of necessary documentation to support S41 of the FAA. (Completed)
• Additional guidance was distributed to all delegated managers on their roles and responsibilities regarding S34 authorization to clarify the importance of ensuring deliverables/services have been received prior to the approval of payment release and that all relevant deliverables are retained. (Completed)
• A Quality Assurance (QA) framework was developed related to section 34 delegated authorities, outlining roles and responsibilities and methodology for verifying accounts, to ensure expenditures are made in accordance with delegated authorities' responsibilities and comply with CBSA and Treasury Board policies, guidelines and directives. (Completed)
• Guidance to cost centre managers (CCMs) was provided on the key requirements for initiation and administrating contracts. (Completed)
• All Delegated Managers / CCMs were reminded of the importance of ensuring the Procurement Team is involved in any contracts or call-ups requested directly from PSPC, in order to maintain a central record of all contracts. (Completed)
• The Terms of Reference of the Contract Review Board were reviewed to provide oversight on contracts issued using certain PSPC Standing Offers and Supply Arrangements. (Completed)
• The risk-based methodology was reviewed to assess which contracts will be reviewed by the Contract Review Board (for example, task authorizations or call-ups for professional services and contract amendments greater than a specific threshold)

Outstanding action items:

• FCMB Agency Comptroller (AC) will continue to deliver information sessions to CCMs to provide an overview of the Agency's instrument of delegation of spending and financial authorities. These sessions will be repeated on an annual basis for newly appointed CCMs. (Due Date: Ongoing)
• FCMB will review its Section 34 non-compliance process and request a FIMC decision on whether it should be further strengthened (First error identified results in a written warning to the delegated manager; Second error results in a compliance notice to the VP/RDG; Third error results in the withdrawal of their Delegation combined with a suitable development plan). (Due Date: July 2023)

Summary of Recommendations

1. Accurately coding and allocating expenses to projects to ensure proper financial records.

2. Documenting interactions with potential contractors and rationales for non-competitive procurement processes.

3. Having the CBSA's Procurement Directorate review all contracts and task authorizations for compliance with policies.

4. Ensuring that potential bidders are not involved in preparing requests for proposals.

5. Ensuring that contracts and task authorizations specify the required experience and qualifications for resources.

6. Ensuring that tasks and deliverables are clearly defined in contracts and related task authorizations.

7. Ensuring that all resources under contract have valid security clearance on file before starting any work and that prior to payment, supporting evidence is maintained on file to validate the work performed.

8. Carrying out and documenting testing prior to releasing an application or update, as well as obtaining release approval.

Summary of CBSA Management Response and Action Plan

• The CBSA's Procurement function was centralized and regrouped under one organization
• Launched a comprehensive improvement plan to further strengthen management controls at all levels
• Require contractors to clearly identify the relevant financial codes on their invoices by March 31, 2024
• Develop and implement procedures to ensure the financial coding is consistently being applied across all areas of the Agency by March 31, 2024
• Established a new Contract Review Board to review and approve contracts and task authorizations.
  • responsible for approving contracts and task authorizations at each stage, covering procurement strategy, project initiation, and at contract award, which will include assurance that the tasks and deliverables are clearly defined in the contracts. (Completed)
• Implement a requirement for staff to report interactions with potential vendors by March 31, 2024
• The Procurement Directorate will act as the single window for interactions with vendors in the context of the procurement process.
  • It will also monitor compliance by developing regular risk-based reviews of contracting files
  • The new Assurance Program in 2024 to 2025 will ensure the consistent application of the new guidance by reviewing the documentation held in the procurement files
• All headquarters staff with procurement responsibilities have completed four training courses
• Employees with procurement responsibilities will be required to attend a Code of Conduct and Values and Ethics awareness session to ensure a clear understanding of expectations to minimize potential apparent and real conflicts of interest
• A procedure for streamlined testing documentation will be developed and implemented that will increase agility in emergency situations while at the same time ensuring sufficient controls are in place to document testing results prior to release to production
• In addition, the Information, Science and Technology Branch will review and update existing testing procedures to ensure control steps are introduced and documentation is complete before any system or application is released to production

Summary of Recommendations

4. CBSA should establish a quality control process to ensure mandatory criteria are not overly restrictive and do not undermine the fairness and openness of the bid solicitation process.

5. PSPC and CBSA should ensure adequate procedures are in place for sharing contract information with the Contract Security Program. These procedures should be communicated with all procurement personnel and monitored for compliance.

7. CBSA should ensure the qualifications and experience of all resources proposed in response to a TA request are consistently assessed against the requirements for the applicable category and level as set out in the contract and document results of the assessment in the file.

10. CBSA should not authorize any TAs without first confirming resource(s) named in the TA meet(s) all security requirements and retaining the confirmation in the contract file.

13. CBSA should ensure the completeness and accuracy of proactively published contract information as required under the Directive for the Management of Procurement.

Summary of CBSA Management Response and Action Plan

• The Agency has created a new Executive Contract Review Board, which is responsible for ensuring that mandatory criteria are not overly restrictive for all contracts above $40,000
• In addition, contracts above $1 million are approved by the CBSA's Executive Committee to ensure they do not undermine the fairness and openness of the bid solicitation process. (Completed)
• The CBSA's new Procurement Directorate has prepared and communicated guidance (including a checklist) to help ensure that each step is completed, including the need to share contract information with the Contract Security Program. (Completed)
• The CBSA's new Procurement Directorate has prepared and communicated guidance to ensure that each step is complied with, including the need to consistently assess qualifications and experience and document the results of the review are recorded in the contract file. In addition, all managers in headquarters, with procurement responsibilities, were required to undertake mandatory training in 2023. (Completed)
• The CBSA's new Procurement Directorate has prepared and communicated guidance to ensure that each step is complied with, including the need to confirm that resources meet the security requirements and the results of the review are recorded in the contract file. (Completed)
  • The consistent application of the new Standard Operating Procedures will be assessed as part of the regular Assurance Reviews. (April 1, 2024)
• The CBSA's new Procurement Directorate has performed a review of proactive disclosure to ensure the transparency over external reporting and ensure full compliance with the proactive disclosure requirements. Since mid-2023, monthly data validation takes place to support the completeness and accuracy of proactively published contract information. (Completed)
• To provide further assurance that the CBSA meets its legislative requirements, regarding proactive disclosure, the CBSA will develop new reporting capabilities in the Agency's Financial System to ensure the completeness and accuracy of proactively published contract information. (April 1, 2025)

Summary of Recommendations

1. CBSA and ISED should implement procedural controls to ensure procurement strategies are centered on satisfying operational requirements rather than engaging specific suppliers.

Summary of CBSA Management Response and Action Plan

The following management action plan has been implemented:

• As part of the recommendations of its internal audit of consulting contracts awarded to McKinsey & Company, the CBSA has strengthened its controls over the management of procurement:
  • Increased management awareness of contracting rules and requirements by mandating training, refreshing guidance and ensuring procurement officer involvement in all contracting
  • Increased oversight of the use of standing offers and supply arrangements in a risk-based manner
  • The CBSA's improved governance over procurement includes a new Procurement Review Committee to review and approve contracts and task authorizations
    • The new governance structure provides additional oversight on all contracting activities, focusing on delivering value for money and alignment with procurement and project management policies
    • The new Executive Procurement Review Committee and its sub-committee, the Contract Review Committee, are responsible for approving all contracts and task authorizations above $40,000 at each stage of the procurement process, covering the procurement strategy, project initiation, and at contract award, which includes a review of the professional services experience and qualifications requirements
    • This new governance structure ensures that procurement strategies are centred on satisfying operational requirements rather than engaging specific suppliers

Summary of Recommendations

1. Procurement Planning by ensuring that branches and regions identify all relevant procurement requests in the procurement planning process and the volume of unplanned requests is better understood. Additionally, developing service standards and ensuring that workplace heath and employee retention is addressed will help ensure the Agency's future procurement requirements can continue to be met.

2. Contract Management by reinforcing expectations, verifying expectations and implementing corrective measures if needed.

3. Corporate Culture and Proactive Monitoring by demonstrating the actions management has taken to address behaviour that does not align with CBSA values, and shifting from being reactive to proactive in terms of fraud management.

4. Segregation of Duties by validating the definition of conflicting roles, minimizing the approval of and cleaning up existing incompatible roles and monitoring those whose conflicting access is required for their day-to-day responsibilities.

Summary of CBSA Management Response and Action Plan

• The CBSA's improved governance over procurement will review and approve Branch Procurement Plans, to be included in each Branch Integrated Business Plan. (September 2024)
• The Procurement and Contracting Directorate will develop a presentation on workplace health to be built using the Public Service Employee Survey and presented to the new Procurement Review Committee. (April 2025)
• The CBSA's Procurement and Contracting Directorate has launched a comprehensive improvement plan to further strengthen management controls at all levels across the Agency and it has already improved governance across the procurement functions. The Directorate has also updated and communicated a Guide to the Management of Contracting intended for Cost Centre Managers (CCM). Future actions include:
  • The CBSA will update its guidance and establish clear responsibilities for cost centre managers and procurement officers on the use of a centralized storage solution in Apollo for all contract management documentation. (December 2024)
  • The CBSA will monitor contract management activities through regular quality assurance reviews to assess the adequacy of documentation and compliance with procurement processes. (July 2024)
• The CBSA will continue ongoing efforts to reduce the risk of procurement fraud and determine what more can be done to prevent the occurrence of fraud and to mitigate fraud. (September 2024)
• The CBSA will develop business processes to assign, manage and review the Segregation of Duties related to roles management. This will provide reasonable assurance to ensure access privileges are well managed and that mitigation strategies exist for granted exceptions to minimize the risk of fraud. The Agency will also be moving to SAP4/ HANA which will allow a more efficient way to manage system accesses in the long run. (December 2024)