accountability in the pub sect annual conf aug 2006
TRANSCRIPT
-
8/9/2019 Accountability in the Pub Sect Annual Conf Aug 2006
1/37
August 28, 2006
Accountability in the PublicAccountability in the PublicSectorSectorSOx Implementation at the CBCSOx Implementation at the CBC
Annual IPAC ConferenceAnnual IPAC ConferenceCharlottetown, PEICharlottetown, PEI
Richard Harris, FCA(416) 777-3367
Stphane Rivest(613) 288-6095
Mark MacDonald, Ph.D.(416) 777-8290
Richard Harris, FCA(416) 777-3367
Stphane Rivest(613) 288-6095
Mark MacDonald, Ph.D.(416) 777-8290
PRESENTATION
-
8/9/2019 Accountability in the Pub Sect Annual Conf Aug 2006
2/37
2PRESENTATION
OutlineOutline
I.I. Performance and AccountabilityPerformance and Accountability Managing for ResultsManaging for Results
II.II. CanadaCanada USA ComparisonUSA Comparison
III.III. What is SOx?What is SOx?
IVIV Elements of ICOFRElements of ICOFR
Control frameworksControl frameworks
A typical projectA typical project
V.V. Case StudyCase Study SOx Implementation at the CBCSOx Implementation at the CBC
VI.VI. Questions and DiscussionQuestions and Discussion
-
8/9/2019 Accountability in the Pub Sect Annual Conf Aug 2006
3/37
PRESENTATION 3
I. Performance and
Accountability Managing for Results
I. Performance and
Accountability Managing for Results
-
8/9/2019 Accountability in the Pub Sect Annual Conf Aug 2006
4/37
4PRESENTATION
Managing Risk & Enhancing ValueManag
ing Risk & Enhancing Value
Why implement performance and accountability measures?Why implement performance and accountability measures?
To more effectively define and understand policy and program objectivesTo more effectively define and understand policy and program objectives
To more effectively allocate resourcesTo more effectively allocate resources
To more effectively manage for resultsTo more effectively manage for results
To meet new accountability expectationsTo meet new accountability expectations
Performance and accountability are inextricably linkedPerformance and accountability are inextricably linked
For public managers, the overarching objective is to:For public managers, the overarching objective is to:
Manage risksManage risks
Enhance valueEnhance value
-
8/9/2019 Accountability in the Pub Sect Annual Conf Aug 2006
5/37
5PRESENTATION
Why new accountability expectations?Why
new accountability expectations?
To satisfy a knowledgeable and skeptical publicTo satisfy a knowledgeable and skeptical public
To find out about results, as linked to public spending/activityTo find out about results, as linked to public spending/activity
To find out about the complete range of management responsibilitiesTo find out about the complete range of management responsibilities
FinancialFinancialValueValue--forfor--moneymoney
Delivery of resultsDelivery of results
To secure the trust and confidence of the publicTo secure the trust and confidence of the public
To satisfy democratic requirementsTo satisfy democratic requirements
-
8/9/2019 Accountability in the Pub Sect Annual Conf Aug 2006
6/37
6PRESENTATION
Why manage for results?Why
manage for results?
Respond to fiscal pressureRespond to fiscal pressure
Improve effectiveness/efficiencyImprove effectiveness/efficiency
Do the right thingsDo the right things
Do them in the right wayDo them in the right way
Meet new accountability expectationsMeet new accountability expectations
Improve public policy decisionImprove public policy decision--makingmaking
Deliver better results for citizens and taxpayersDeliver better results for citizens and taxpayers
-
8/9/2019 Accountability in the Pub Sect Annual Conf Aug 2006
7/37
7PRESENTATION
What changes when you manage for results?What changes when you manage for results?
Achieve clarity about public and organizational objectivesAchieve clarity about public and organizational objectives
Establish a new management cultureEstablish a new management culture
Focus on risk managementFocus on risk management
Establish new/different control systemsEstablish new/different control systems
Measure performance (results)Measure performance (results)
ResultsResults--based budgetingbased budgeting
-
8/9/2019 Accountability in the Pub Sect Annual Conf Aug 2006
8/37
8PRESENTATION
What happens when managing for results is
adopted?
What happens when managing for results is
adopted?
Renew focus on core servicesRenew focus on core services
Achieves greater clarity about core objectivesAchieves greater clarity about core objectives
Identifies opportunities for alternative service deliveryIdentifies opportunities for alternative service delivery
Enhances utilization of shared servicesEnhances utilization of shared services
Enhances budgetary and performance managementEnhances budgetary and performance management
Enhances public accountabilityEnhances public accountability
-
8/9/2019 Accountability in the Pub Sect Annual Conf Aug 2006
9/37
PRESENTATION 9
II. Canada USA Comparison
-
8/9/2019 Accountability in the Pub Sect Annual Conf Aug 2006
10/37
10PRESENTATION
U.S. EnvironmentU.S. Environment
Wave of corporate financial scandals in the United States including:Wave of corporate financial scandals in the United States including:
EnronEnron
TycoTyco
WorldcomWorldcom
AldelphiaAldelphia
Caused by:Caused by:
Improper activity, including misrepresentation and fraudImproper activity, including misrepresentation and fraud
Off balance sheet activity, coupled with inadequate disclosure for theOff balance sheet activity, coupled with inadequate disclosure for theaverage investoraverage investor
Resulting in:Resulting in:Erosion of public trust in corporations and capital markets in the UnitedErosion of public trust in corporations and capital markets in the UnitedStatesStates
Introduction of SarbanesIntroduction of Sarbanes--Oxley Act (2002)Oxley Act (2002)
-
8/9/2019 Accountability in the Pub Sect Annual Conf Aug 2006
11/37
11PRESENTATION
Impact on Public CompaniesImpact on Public Companies
Internal Control Over Financial Reporting (ICOFR)Internal Control Over Financial Reporting (ICOFR)
documentdocument
testtest
identify and correct deficienciesidentify and correct deficiencies
report/certifyreport/certify
audit/attestaudit/attest
Compliance Requires a Significant UndertakingCompliance Requires a Significant Undertaking
timetime
moneymoney
focusfocus
Affect on publicAffect on public--sector?sector?
What is good for the regulated, is good for the regulatorWhat is good for the regulated, is good for the regulator
-
8/9/2019 Accountability in the Pub Sect Annual Conf Aug 2006
12/37
12PRESENTATION
United States GovernmentUnited States Government
What is driving the push toward SOx in U.S. government?What is driving the push toward SOx in U.S. government?Certain state governments have had a standard agency internalCertain state governments have had a standard agency internalcontrol certification requirement in place for a long timecontrol certification requirement in place for a long time
This standard was not very rigorousThis standard was not very rigorous unlike SOx, it does not followunlike SOx, it does not followthe COSO framework, little documentation or testing is requiredthe COSO framework, little documentation or testing is required
New York State law now requires public authorities to adopt internalNew York State law now requires public authorities to adopt internalcontrol certification. However, an audit opinion is not requiredcontrol certification. However, an audit opinion is not required
In addition, at least 13 states are considering laws applying SOx-type regulations to NFPs. California has already enacted its ownversion of the corporate governance law for non-profits, theNonprofit Integrity Act, which went into effect in January, 2005
Members of congress and representatives of federal governmentMembers of congress and representatives of federal governmentagencies started discussions in 2003 that have led the Office ofagencies started discussions in 2003 that have led the Office ofManagement and Budget to establish a SOxManagement and Budget to establish a SOx--like requirement forlike requirement for20062006 management certification, but no external audit opinion.management certification, but no external audit opinion.
-
8/9/2019 Accountability in the Pub Sect Annual Conf Aug 2006
13/37
13PRESENTATION
United States GovernmentUnited States Government
Early Implementation of SOxEarly Implementation of SOxFederal Agencies
US Postal ServiceUS Postal Service
Pension Benefit Guaranty Corp.Pension Benefit Guaranty Corp.
Homeland SecurityHomeland Security
State AgenciesState AgenciesNY State Public AuthoritiesNY State Public Authorities
Pension PlansPension Plans
Enterprise Funds/Component UnitsEnterprise Funds/Component Units
NotNot--ForFor--Profit SectorProfit Sector Significant Voluntary AdoptionSignificant Voluntary Adoption
-
8/9/2019 Accountability in the Pub Sect Annual Conf Aug 2006
14/37
14PRESENTATION
Canadian EnvironmentCanadian Environment
Spending ScandalsSpending Scandals
Sponsorship, HRDC, departmental expendituresSponsorship, HRDC, departmental expenditures
Trend Toward Special ExaminationsTrend Toward Special Examinations
Value for money, program evaluationsValue for money, program evaluations
Public InquiriesPublic Inquiries
Gomery Commission, Krever Commission, Ipperwash InquiryGomery Commission, Krever Commission, Ipperwash Inquiry
Federal Government AgendaFederal Government Agenda
Management Accountability FrameworkManagement Accountability Framework
Federal Accountability ActFederal Accountability Act
-
8/9/2019 Accountability in the Pub Sect Annual Conf Aug 2006
15/37
15PRESENTATION
Federal Accountability Act (2006)Federal Accountability Act (2006)
Electoral financing reformElectoral financing reform
Ethics and lobbyingEthics and lobbying
Truth in BudgetingTruth in Budgeting Parliamentary Budget AuthorityParliamentary Budget Authority
Procurement and government contractingProcurement and government contracting
Real protection for whistleblowersReal protection for whistleblowers
Strengthening the power of the Auditor GeneralStrengthening the power of the Auditor General
Strengthening auditing and accountability within departmentsStrengthening auditing and accountability within departments
-
8/9/2019 Accountability in the Pub Sect Annual Conf Aug 2006
16/37
16PRESENTATION
Accountable, Responsive and Innovative
Government
Accountable, Responsive and Innovative
Government
Management Accountability FrameworkManagement Accountability Framework
Comptroller General of CanadaComptroller General of Canada
ReRe--establishmentestablishment
New Internal Audit PolicyNew Internal Audit Policy
April 1, 2006April 1, 2006Includes:Includes:
Baseline Qualifications for CAE (Chief Audit Executive)Baseline Qualifications for CAE (Chief Audit Executive)
Adoption of International Standards from the Institute of InternalAdoption of International Standards from the Institute of InternalAuditorsAuditors
Mandatory QAR (Quality Assessment Review)Mandatory QAR (Quality Assessment Review)
Annual assurance statement on governance, risk management andAnnual assurance statement on governance, risk management andcontrolcontrol
Evidence that Canadian Federal Government is moving towards aEvidence that Canadian Federal Government is moving towards astrong accountability regime, including SOxstrong accountability regime, including SOx--like measureslike measures
-
8/9/2019 Accountability in the Pub Sect Annual Conf Aug 2006
17/37
PRESENTATION 17
III. What is SOx?III. What is SOx?
-
8/9/2019 Accountability in the Pub Sect Annual Conf Aug 2006
18/37
18PRESENTATION
SOx in the Public SectorSOx in the Public Sector
The Public Company Accounting Reform and Investor Protection Act of2002 (Sarbanes-Oxley Act), signed into law on July 30, 2002, requires:
Section 302Section 302 management to prepare a certification statement thatmanagement to prepare a certification statement thataccompanies the financial statementsaccompanies the financial statements
Section 404Section 404 every annual report of public companies to include an internalevery annual report of public companies to include an internalcontrol report from managementcontrol report from management
In CanadaBill 198 (Ontario)Bill 198 (Ontario)
Multilateral Instrument 52Multilateral Instrument 52--109109 Canadian Securities AdministratorsCanadian Securities Administrators
No audit requirementNo audit requirement
The two Sarbanes-Oxley sections that would be most relevant to the
public sector are Sections 302: Corporate Responsibility for Financial
Reports and Section 404: Management Assessment of Internal Controls
John Radford, State Controller (Oregon)
-
8/9/2019 Accountability in the Pub Sect Annual Conf Aug 2006
19/37
19PRESENTATION
SOx in the Public SectorSOx in the Public Sector
Some jurisdictions are starting to introduce mandatory requirements andSome jurisdictions are starting to introduce mandatory requirements andothers are adopting SOx or SOxothers are adopting SOx or SOx--like initiatives on a voluntary basislike initiatives on a voluntary basis
Trends in other jurisdictions could motivate similar action in CanadaTrends in other jurisdictions could motivate similar action in Canada
Applying the rigor of SarbanesApplying the rigor of Sarbanes--Oxley like provisions could require someOxley like provisions could require somesignificant enhancement or remediation in controls that support externalsignificant enhancement or remediation in controls that support external
reportingreporting including performance measurement reportingincluding performance measurement reporting
-
8/9/2019 Accountability in the Pub Sect Annual Conf Aug 2006
20/37
20PRESENTATION
United States GovernmentUnited States Government
Regulatory FrameworkRegulatory Framework
The Federal Managers Financial Integrity Act of 1982 (FMFIA) requires theThe Federal Managers Financial Integrity Act of 1982 (FMFIA) requires theheads of the 23 CFO Act agencies to annually evaluate and report on theheads of the 23 CFO Act agencies to annually evaluate and report on theagencys systems of internal accounting and administrative controlagencys systems of internal accounting and administrative control
FMFIA directs the Office of Management and Budget (OMB) to establishFMFIA directs the Office of Management and Budget (OMB) to establishguidelines for the evaluation by agencies of their systems of internalguidelines for the evaluation by agencies of their systems of internalaccounting and administrative controlaccounting and administrative control
Those guidelines are now set forth in OMB Circular AThose guidelines are now set forth in OMB Circular A--123,123, ManagementManagementAccountability and ControlAccountability and Control, which define internal control using components, which define internal control using componentscontained in the COSO guidance, which is the internal control frameworkcontained in the COSO guidance, which is the internal control frameworkused most often by public companies that are subject to SOx section 404used most often by public companies that are subject to SOx section 404(management assessment of internal controls)(management assessment of internal controls)
-
8/9/2019 Accountability in the Pub Sect Annual Conf Aug 2006
21/37
21PRESENTATION
United States GovernmentUnited States Government
Fiscal Year 2XXXFiscal Year 2XXX
Annual Assurance Statement on Internal Control over Financial ReportingAnnual Assurance Statement on Internal Control over Financial Reporting
The [Agencys] management is responsible for establishing and maintaining effective internalThe [Agencys] management is responsible for establishing and maintaining effective internal
control over financial reporting, which includes safeguarding of assets and compliance withcontrol over financial reporting, which includes safeguarding of assets and compliance withapplicable laws and regulations. The [Agency] conducted its assessment of theapplicable laws and regulations. The [Agency] conducted its assessment of theeffectiveness of the [Agencys] internal control over financial reporting in accordance witheffectiveness of the [Agencys] internal control over financial reporting in accordance withOMB Circular AOMB Circular A--123, Managements Responsibility for Internal Control. Based on the results123, Managements Responsibility for Internal Control. Based on the resultsof this evaluation, the [Agency[ can provide reasonable assurance that the internal controlof this evaluation, the [Agency[ can provide reasonable assurance that the internal controlover financial reporting as of June 30, 2XXX was operating effectively and no materialover financial reporting as of June 30, 2XXX was operating effectively and no materialweaknesses were found in the design or operation of the internal controls over financialweaknesses were found in the design or operation of the internal controls over financial
reporting.reporting.
______________________________________________________
Head of AgencyHead of Agency
Internal Control CertificationInternal Control CertificationRevise O ARevise O A--123: Sample Assurance Statement?123: Sample Assurance Statement?
-
8/9/2019 Accountability in the Pub Sect Annual Conf Aug 2006
22/37
-
8/9/2019 Accountability in the Pub Sect Annual Conf Aug 2006
23/37
23PRESENTATION
Cons ofadoptingSOx-li emeasures in t ePSCons ofadoptingSOx-li emeasures in t ePS
Cost benefit isnt provenCost benefit isnt proven spendingdollars to c asedimesspendingdollars to c asedimes
Let t e commercial worldshakeout theproblemsLet the commercial worldshakeout theproblems there ispushthere ispush--backbackin theprivatesectorin theprivatesector
Increase inmaterial weaknesses, requiring remediationIncrease inmaterial weaknesses, requiring remediation
Must allow plenty of time formanagement to completean internalMust allow plenty of time formanagement to completean internal--selfselfreview, beforesubjecting toauditreview, beforesubjecting toaudit
Risksandobjectivesofagovernment entity differ from thoseofaRisksandobjectivesofagovernment entity differ from thoseofacommercial enterprisecommercial enterprise
-
8/9/2019 Accountability in the Pub Sect Annual Conf Aug 2006
24/37
PRESENTATION 24
IV. Elements of ICOFR Control frameworks
A typical project
-
8/9/2019 Accountability in the Pub Sect Annual Conf Aug 2006
25/37
25PRESENTATION
Control rameworksControl rameworks
C
onsiderationofalternate control frameworks, not justC
OSO:C
onsiderationofalternate control frameworks, not justC
OSO:Nothing specific is dictated, in terms of acceptable frameworksNothing specific is dictated, in terms of acceptable frameworks
COSO is the most elaborative internal control framework, and the choice ofCOSO is the most elaborative internal control framework, and the choice ofthe private sector in the USAthe private sector in the USA
Others:Others: Financial capability model (AG model) Capacity check (TB) Cadbury
COCO (CICA) GAO Green Book (USA) OMB A-123 (USA COBIT
-
8/9/2019 Accountability in the Pub Sect Annual Conf Aug 2006
26/37
26PRESENTATION
Control rameworksControl rameworks
Evaluationmust be based ona recognized control frameworkEvaluationmust be based ona recognized control framework
COSO is thede facto standardCOSO is thede facto standard
Virtually all organizations seeking to comply with SOx are using itVirtually all organizations seeking to comply with SOx are using it
More detailed than a standard like COCOMore detailed than a standard like COCO
Firms like KPMG are integrating our methodology around COSOFirms like KPMG are integrating our methodology around COSO
Conclusion: use COSOConclusion: use COSO, or be prepared to demonstrate that the frameworkused reasonably aligns with COSO (N.B. Some public sector organizations thathave embraced control risk self assessment may be using COCO and it may beeasier to continue to use this framework)
-
8/9/2019 Accountability in the Pub Sect Annual Conf Aug 2006
27/37
27PRESENTATION
COSO FrameworkCOSO Framework
All five components must be in place for a control to be effective
1. Control Environment - The controlenvironment sets the tone of anorganization, influencing the controlconsciousness of its people
2. Risk Assessment Every entity faces a
variety of risks from external and internalsources that must be assessed both at theentity and the activity level
3. Control Activities The policies andprocedures that help ensure managementdirectives are carried out
4. Information and Communication
Pertinent information must be identified,captured and communicated in a form andtimeframe that supports all other controlcomponents
5. Monitoring Internal control systemsneed to be monitored a process thatassesses the quality of the systemsperformance over time
Overview of COSO FrameworkOverview of COSO Framework
-
8/9/2019 Accountability in the Pub Sect Annual Conf Aug 2006
28/37
28PRESENTATION
A Typical projectA Typical project
1
2
3
4
5
Plan and Scopethe Evaluation
Document Controls
Evaluate Design &OperatingEffectiveness
Identify & CorrectDeficiencies
Report on InternalControl
Develop and communicate a comprehensive plan which clearly outlinesthe project scope, approach, milestones and resource needs will serveas the foundation for a successful initiative.
Document the design of significant internal controls for processes.
Evaluate design and operating effectiveness of internal control overfinancial reporting and document results of evaluation.
Identify, accumulate, and evaluate design and operating controldeficiencies; communicate findings and correct deficiencies.
Prepare managements written assertion on the effectiveness of internalcontrol over financial reporting.
6 Audit of InternalControl
Prepare for the auditor to conduct the internal control audit
-
8/9/2019 Accountability in the Pub Sect Annual Conf Aug 2006
29/37
PRESENTATION 29
V. Case Study - CBC
-
8/9/2019 Accountability in the Pub Sect Annual Conf Aug 2006
30/37
30PRESENTATION
Visionof theProjectVisionof theProject
Demonstrate that CBC/Radio-Canada is a well managed company by being
proactive in the area of internal controls
Develop control framework, inorder toevaluate theeffectivenessof
internal controls as well as to document internal controls
Give Senior Management adequate tools inorder to attest oneffectiveness
of internal control over financial statements
-
8/9/2019 Accountability in the Pub Sect Annual Conf Aug 2006
31/37
31PRESENTATION
Scopeof theProjectScopeof theProject
The internal controls project includes
Documentation and evaluation of financial processes and internal controlsover financial statements
Documentation and evaluation of financial processes and internal controlsover financial statements impacted by the Vision project
Documentation of Information Technology (IT) general controls
-
8/9/2019 Accountability in the Pub Sect Annual Conf Aug 2006
32/37
32PRESENTATION
CBCsapproachCBCsapproach
Plan and scopePlan and scope
Engaged KPMG as Subject Matter Advisors to provide expert advice andEngaged KPMG as Subject Matter Advisors to provide expert advice andassistance to the projectassistance to the project
Utilized the basis of KPMGs methodology and adapted it to CBCsUtilized the basis of KPMGs methodology and adapted it to CBCsrequirementsrequirements
Through a risk and significance ($) assessment, identified processes andThrough a risk and significance ($) assessment, identified processes andbusiness locations to be included in the projectbusiness locations to be included in the project
DocumentDocument
Opted for narrative process documentation with control matrices (no flowOpted for narrative process documentation with control matrices (no flowcharts)charts)
Review of control matrices to retain only key controlsReview of control matrices to retain only key controls
-
8/9/2019 Accountability in the Pub Sect Annual Conf Aug 2006
33/37
33PRESENTATION
CBCs pproachCBCs pproach
Evaluate and correctEvaluate and correct
Review process documentation and control matrices to identify gaps andReview process documentation and control matrices to identify gaps andremediation requirements and to plan control testingremediation requirements and to plan control testing
Correct deficienciesCorrect deficiencies
Test controlsTest controls
Correct gaps identified in testingCorrect gaps identified in testing
ReportReport
Report on effectiveness of Internal ControlsReport on effectiveness of Internal Controls
-
8/9/2019 Accountability in the Pub Sect Annual Conf Aug 2006
34/37
34PRESENTATION
Critical Success actorsCritical Success actors
Active involvement ofasteering committeeand seniorexecutives tosetActive involvement ofasteering committeeand seniorexecutives tosetthe toneand critical importanceof the Project, necessary toobtainthe toneand critical importanceof the Project, necessary toobtaincommitment throughout theorganizationcommitment throughout theorganization
Establishment ofa dedicated, adequately resourced project team, led by aEstablishment ofa dedicated, adequately resourced project team, led by aseniorexecutive throughout the duration of the Project, with adequateseniorexecutive throughout the duration of the Project, with adequateskills, controlsexperienceand clearly defined rolesskills, controlsexperienceand clearly defined roles
Early communicationsof Project objectives, scope, approach andEarly communicationsof Project objectives, scope, approach andresponsibilities for delivery ofall aspectsof the projectresponsibilities for delivery ofall aspectsof the project and inand inparticular, theoverriding responsibility of the individual businessareas toparticular, theoverriding responsibility of the individual businessareas toachievecompliance with the new control requirementsachievecompliance with the new control requirements
Selection and tailoring ofan appropriate methodology, automated toolsSelection and tailoring ofan appropriate methodology, automated toolsand training programs toensurea high level of quality and consistencyand training programs toensurea high level of quality and consistencyacrossall businessareasacrossall businessareas
Establishment ofadequate processes to track and manage issues, risksEstablishment ofadequate processes to track and manage issues, risksand changes, as well as maintaining ongoing documentation of benefitsand changes, as well as maintaining ongoing documentation of benefits
Ability of the Project approach and work plan toadapt as requiredAbility of the Project approach and work plan toadapt as requiredocusof project effortson those businessareasand processes that haveocusof project effortson those businessareasand processes that have
the potential of large financial risk to theorganizationthe potential of large financial risk to theorganization
-
8/9/2019 Accountability in the Pub Sect Annual Conf Aug 2006
35/37
35PRESENTATION
Statusand Next StepsStatusand Next Steps
StatusStatus
Completed documentation and assessmentCompleted documentation and assessment
Next stepsNext steps
Complete documentation of Vision project ICFRComplete documentation of Vision project ICFR
Create testing and remediation plan (onCreate testing and remediation plan (on--going)going)
Test and remediate (SeptTest and remediate (Sept--Feb)Feb)
Report (FebReport (Feb--Mar)Mar)
Create sustainment plan (SeptCreate sustainment plan (Sept--Oct)Oct)
-
8/9/2019 Accountability in the Pub Sect Annual Conf Aug 2006
36/37
36PRESENTATION
ChallengesChallenges
Resource contentionResource contention
New projectsNew projects
Other project changesand delaysOther project changesand delays
Sustainment activitiesSustainment activities
-
8/9/2019 Accountability in the Pub Sect Annual Conf Aug 2006
37/37
PRESENTATION 37
VI. Questions and DiscussionVI. Questions and Discussion