Corporate Audit Plan
The purpose of internal auditing is to provide independent assurance and consulting services. This improves Niagara Region's operations and brings a disciplined approach to the evaluation of:
- Risk management activities
- Internal controls
- Governance processes
The Internal Controls and Organizational Performance division has a professional obligation to develop a comprehensive risk-based annual audit plan. This is consistent with recommendations by professional associations, including the Institute of Internal Auditors and the Chartered Professional Accountants of Canada.
The 2018 Internal Audit Plan was developed based on the following sources:
- Consultation meetings with members of the Audit Committee
- Consultation meetings with members of the Corporate Leadership Team
- A comprehensive risk assessment of processes, programs and functions across the organization
- A jurisdictional scan of hot topics, emerging risks and auditable areas in other local comparable organizations
Internal Audit Projects
The following projects have been approved by Regional Council as the 2018 Internal Audit Plan.
-
Procurement: Bidding / Tendering Process
Scope: The audit will include the procurement process of evaluating and awarding contracts and review for compliance to Corporate policies and procedures as well as Niagara Region's procurement by-law.
Rationale: Procurement by its very nature is complex, high profile, has a low degree of automation, and a history of procurement issues noted in previous value-for-money audits.
Risks: Non-compliance to procurement policies, procedures and by-law which may lead to financial or legal implications.
-
Procurement: Sole / Single Sourced
Scope: This audit will evaluate the process specifically for sole-sourced procurements. The scope will include a review of the rationale, requirement and approvals around sole-sourced procurements.
Rationale: This audit will have a targeted focus on sole-sourced procurements which tend to be high profile, particularly in the public sector.
Risks: Non-compliance to procurement policies, procedures and by-law may lead to financial or legal implications.
-
Accounts Payable
Scope: To assess internal controls over the creation of vendor accounts, vendor payments and other processes related to Accounts Payable. The audit will complete the full procure-to-pay cycle for Niagara Region.
Rationale: A new electronic financial management system was introduced in 2016 to manage Accounts Payable transactions which involved a significant re-design of the applicable controls.
Risks: Incorrect payments to vendors; fictitious, fraudulent, unapproved or non-timely payments may also occur.
-
Payroll Phase 1: Timekeeping
Scope: First phase of the audit will include the time keeping process captured in the Kronos system. The objective of this review is to ensure that payable time is captured accurately, completely and is approved by the appropriate supervisor/manager. Time exceptions including statutory holidays, overtime, vacation etc. will be captured in this portion of the audit.
Rationale: Compensation is the largest expense in the organization ($356M for 3644 permanent full time employees in 2017). Time keeping process is complex as it includes multiple unions with unique premiums, pay grades, etc. Time-keeping system (Kronos) is also used by City of St. Catharines and Niagara Regional Police Service with a shared services agreement.
Risks: Inaccurate or incomplete time keeping will directly affect the accurate processing of payroll thereby leading to payroll errors.
-
Payroll Phase 2: Payroll processing
Scope: The second phase of the audit includes the actual processing of the weekly or bi-weekly payroll. The principle objective of this review is to ensure that the amounts remitted to each employee are accurate, complete and remitted on a timely basis. This phase will also include a review of corporate and employee deductions, payroll accounting and government remittances, T4's and Records of Employment.
Rationale: Compensation is the largest expense in the organization ($356M for 3644 permanent full time employees in 2017). This complex process is performed partially in-house and partially outsourced to third-party vendor.
Risks: Inaccurate payroll processing may result under (or over) payments to employees thereby affecting employee engagement or morale. Inaccurate government remittances may result in financial or legal implications.
-
Employee Benefits Claims
Scope: To evaluate the internal controls around health, dental and other extended benefits provided to Niagara Region employees and to ensure that financial transactions are being remitted and recorded according to policies and procedures. The agreement with the service provider and contract management will also be reviewed.
Rationale: Recent frauds detected in other comparable organizations.
Risks: Inaccurate processing of employee health, dental or other extended medical benefits resulting in over-payments by Niagara Region.
-
Planning and Development Grants and Incentives
Scope: This project will be performed in two phases:
- A process and controls review over the administration of applications and cheques for specific grants and incentives paid by Niagara Region;
- A value-for-money audit to ensure that grants and incentives align with current Regional priorities, reflect the current economic climate and growth management goals, promote economic prosperity, generate meaningful return on investment, and embody transparency, accountability and efficiency.
Rationale: Requested by Management.
Risks: A portfolio of grants and incentives that may lack alignment with Regional Council's strategic direction. Secondly, a lack of measurement of performance to determine the efficacy of the grants and incentives programs.
-
Controlled Medication Inventory
Scope: To ensure that narcotics and controlled substances are appropriately managed. Medication inventory will be reviewed to ensure that it is appropriately stored and tracked, including reconciliations and physical security/access, and that there is compliance with corporate policies, procedures and applicable laws and regulations.
Rationale: Relatively small financial impact to the organization ($222K in 2016 in Emergency Management Services). However, the risk of a missing/stolen controlled substance may expose the organization to a legal and/or reputational risk. The on-going opioid crisis in North America has also affected Niagara; therefore evaluating controls particularly over controlled substances like morphine and midazolam will provide assurance to the Audit Committee and Senior Management that the usage and physical security controls are operating effectively.
Risks: Missing/stolen controlled substances.
-
IT General Controls
Scope: This audit will evaluate the IT general controls within the electronic financial management system, payroll system and computerized maintenance management system. At a high level, the IT general controls environment includes: access security, computer operations, change management, and program development. Internal Controls and Organizational Performance will engage a third-party IT audit firm with subject matter expertise in this area.
Rationale: Niagara Region transitioned to a new electronic financial management system in 2016 which increases the risk of control gaps, inadequate design or segregation of duty issues. The third party IT audit firm will provide assurance that the controls are designed appropriately and operating effectively.
Risks: Control gaps, inadequate design or segregation of duty issues.
-
Chippawa Combined Sewer Overflow Audit
Scope: To perform a value-for-money review of the Chippawa Combined Sewer Overflow capital construction project.
Rationale: Directed by Audit Committee in 2016.
Risks: Various including project management, procurement, and contract management.
-
Contract Compliance - Waste and Recycling Drop-off Depot Agreement
Scope: Perform a brief financial and contract compliance review of the Waste and Recycling Drop-off Depot Agreement to validate the accuracy, completeness and timeliness of tipping fee remittances to Niagara Region and to ensure that the vendor is adhering to the terms and conditions of the Agreement.
Rationale: Requested by Management.
Risks: The vendor may not be in compliance with the Agreement or the vendor may over/under reporting the remittances to Niagara Region.
-
Children's Services Risk Assessment
Scope: A risk assessment of child care services (including Children's Operations and Fee Subsidy) to determine if current processes adequately identify risks and opportunities, and that there are appropriate action plans to manage and mitigate these risks. Internal Controls and Organizational Performance will perform a detailed analysis of the Ministry of Education's inspection, reporting and auditing protocols to identify whether additional in-house assurance or advisory work is required.
Rationale: Through a comprehensive risk assessment, this was identified as one of the top risks in the organization.
Risks: A significant injury or death to a child under the care of Niagara Region would be a major risk event with financial, legal, regulatory and political implications.
-
Long Term Care Homes Risk Assessment
Scope: A risk assessment of senior services (including long-term care home operations and resident fee collection) to determine if current processes adequately identifies risks and opportunities, and that there are appropriate action plans to manage and mitigate these risks. Internal Controls and Organizational Performance will perform a detailed analysis of the Ministry of Health and long-term care's inspections and Accreditation Canada's reviews to identify whether additional in-house assurance or advisory work is required.
Rationale: Through a comprehensive risk assessment, this was identified as one of the top risks in the organization.
Risks: A significant injury or death to a long-term care home resident under the care of Niagara Region would be a major risk event with financial, legal, regulatory and political implications.
-
Water Treatment Operations Risk Assessment
Scope: A risk assessment of Water Operations (including the Quality Management System) to determine if current processes adequately identify risks and opportunities, and ensure that there are appropriate action plans to manage and mitigate these risks. Internal Controls and Organizational Performance will perform a detailed analysis of the Ministry of Environment and Climate Change inspections and the Region's responses to identify whether additional in-house assurance or advisory work is required.
Rationale: Through a comprehensive risk assessment, this was identified as one of the top risks in the organization.
Risks: A major disruption or contamination of Niagara Region's clean drinking water would have severe financial, legal, regulatory and political implications.