Review of TC's governance and key processes during COVID-19 pandemic

Internal audit report outlining results of the assessment of the review of TC's governance and key processes during COVID-19 at Transport Canada.

On this page

Chapter 1 – Governance

Purpose

The objective of this chapter is:

To summarize the findings from the Internal Audit survey and interviews with TC executives on their opinions on how well TC's senior governance committees have adapted to the virtual working environment.

Background

In order to establish an early baseline on how TC's governance has been functioning after the department's rapid switch to a virtual working environment, Internal Audit (IA) conducted a survey in June 2020 with senior executives who participate in seven senior governance committees: TC's Executive Management Committee (TMX), Investment Review Board (IMB), Resource Management Board (RMC), Assistant Deputy Minister Policy Committee (ADM Policy), Assistant Deputy Minister Transformation Committee (ADM Transformation), Senior Procurement Review Committee (SPRC) and Director General Horizontal Committee (DG Horizontal).

The purpose of the survey was to seek feedback on committee performance during the pandemic, as well as identify lessons learned, good practices, and any emerging risks to the department as a result of the pandemic.

In addition to the survey, IA also conducted follow-up interviews with TMX members and a number of other executives for more in-depth discussions.

The information on emerging risks has also been shared with Corporate Planning and Reporting and Financial Monitoring and Quality Control, to facilitate their work on the Integrated Risk Profile and the financial controls attestation.

Conclusion

IA has gathered information to provide an early baseline on how TC's governance, which is a key element of a management framework, has adjusted during the pandemic. The results demonstrate that there is no real concerns with governance moving to the virtual environment. The review also provides an opportunity to identify emerging risks to the department, lessons learned, and good practices that can be adopted in the "new normal". As the digital processes mature, it is important for IA to repeat this exercise to determine if changes have occurred.

This relevant and timely information will help inform the strategic discussions, at TMX and at DAC, on how the department has adapted to the virtual working environment, and more importantly, on how to continue the momentum on Transformation and Making It Stick.

Chapter 2 – Key horizontal processes

Purpose

The objective of this chapter is:

  • To provide an overview of the changes, highlights, challenges and risks in the key departmental processes during COVID-19:
    • Access to Information and Privacy (ATIP)             
    • Pay and compensation
    • Tracking of Information Technology (IT) equipment
    • Expenditures
    • Employee leave (e.g. Code 699)
  • To provide early indications on how key processes have adapted to the virtual working environment. It is important to establish this baseline to monitor and assess impacts of changes on an on-going basis as Transport Canada (TC) transitions into the "new normal" state. 

Background

COVID-19 has had a significant impact on TC's operations. Although TC never activated its Business Continuity Plan and was able to continue its operations with the majority of its workforce working from home, some key departmental processes had to change in order to better serve the new virtual working environment.

The review focused on changes in two types of processes:

  • Processes that needed to transition from paper-based to electronic (ATIP, pay and compensation) – to assess their ability to continue operating effectively
  • Processes to track and monitor departmental resources impacted by COVID-19 (expenditures, employee leave and tracking of IT equipment) – to assess their ability to continue operating and manage the perceived heightened risks due to COVID-19

In order to understand the COVID-19 related process changes and identify their associated risks, a combination of interviews and document reviews were performed to understand the evolving situation between February to August 2020.

The following slides provide a summary of views and information provided by functional authorities responsible for the selected processes. This review will help Internal Audit (IA) determine future potential areas of control testing.

Observations

Processes that transitioned from paper to digital – ATIP

1. Changes to roles and responsibilities / organizational structure:

  • No change to roles and responsibilities at the senior level or to the organizational structure
  • Positions at the junior level adjusted to align with new digital processes, e.g. moving from manually processing mail to digitally accessing most files submitted by OPIs

2. Key changes from manual to digital processes:

  • Electronic submissions by OPIs.
  • Digital signatures for all approvals
  • Electronic responses to requesters through email or Epost.
  • MS Teams for communications with employees and OPIs.

3. Highlights:

  • Since April 1, ATIP requests closed with a compliance rate of 72%, compared to some departments that were not able to complete any ATIP requests due to inability to work remotely, while several others were below 50%. 
  • Pilot digital initiatives since summer 2019 (telework, digital signatures, Epost) allowed ATIP Office to be ready for the transition to remote work.
  • Procedures for submitting electronic documents implemented within two weeks of working remotely, revised in September in consultation with OPIs.
  • Early and frequent communication with staff and OPIs.
  • Officer onsite full time since July 27 to receive deliveries by OPIs and retrieve mail.

4. Challenges:

  • Lack of remote access to secret documents or documents in file cabinets, which requires physical presence at Tower C. This reduces TC's ability to be compliant to legislative deadlines.
  • Limited onsite capacity to process secret records due to social distancing (only two workstations).
  • Difficulty obtaining secret or paper records from OPIs due to OPI physical presence required to respect security requirements.
  • Network speed (bandwidth) limits the speed for processing large electronic files. Solution being implemented in September.

5. Remaining risks:

  • Risk of non-compliance to legislated timelines for ATIP requests and risk of increased complaints.
  • Delays in responding to the Office of Information Commissioner's requests for information for complaint investigations and meeting commitments.

Processes that transitioned from paper to digital - Pay

1. Changes to roles and responsibilities / organizational structure:

  • No change to staff roles and responsibilities or organizational structure.

2. Key changes from manual to digital process:

  • Continuing the same business process as prior to the pandemic, with the help of digital tools, e.g. peer review verification processes where the senior staff review the files completed by junior staff.
  • Use of digital signatures for approvals and letters of offer.
  • Utilizing MS Teams for communications.

3. Highlights:

  • Able to work just as effectively during COVID-19 - completed 4700 pay transactions in Apr 2020, which was more than Apr 2019. On average, completed 3200 files a month.
  • Teleworking has been working well and it is a means of employee retention.
  • Digital signature is an example of one of the many factors that led to a smooth transition to working virtually, e.g. digital signature for letter of offer etc.

4. Challenges:

  • The portability of paper file – Government-wide dependencies on other paper-based processes (e.g. employees changing departments) that require a change in government policies.
  • The lack of remote access to paper-based historical files (protected A & B) – the need for staff to be in the office to make copies or scan.
  • Network storage capacity – shared drive is full.

5. Remaining risks:

  • Risk of information security has increased in the virtual working environment - Management has communicated expectations on the sharing of sensitive information on MS Teams.

Processes to track departmental resources impacted by COVID-19 – Expenditures

1. Process:

  • The key process for expenditure management in TC remained the same during the pandemic.
  • Two new project codes were introduced to track COVID-19 related expenditures.
  • FMAs within the Financial Management group provided advice and work with OPIs on the use of COVID related project codes.
  • Financial Controls and Accounting Services monthly reporting to OCG
  • Dashboard created to track COVID-19 expenditures

2. Training and guidance:

  • Guidelines on COVID-19 project codes communicated to TMX members and to OPIs.
  • Guidelines for equipment for employees who work from home during the COVID-19 restrictions, including the requirements to code these expenditures to the COVID-19 project code, were communicated to management and staff.

3. Monitoring:

  • Financial Controls and Accounting Services aggregated and reported COVID-19 related expenditures monthly to OCG based on the templates and guidance material provided.
  • A dashboard has also been created to provide up to date information on forecasted and actual COVID-19 related expenditures

4. Highlights:

  • As per interviews with Financial Controls and Accounting Services and Financial Management, the process for tracking of COVID-19 related expenditures has been working well.
  • As per interviews with Financial Controls and Accounting Services and Financial Management, there were challenges early on when the project codes were first introduced but they have now been resolved.

5. Remaining risks and challenges:

  • None identified during interviews.

Processes to track departmental resources impacted by COVID-19 – Employee leave

1. Process:

  • The key processes for submitting and approving employee leave remained the same during the pandemic.  It is primarily the responsibility of managers and/or directors.
  • Code 699 has always existed for leave granted on an exceptional basis.
  • In the context of COVID-19, Central Agencies have granted permission for the use of code 699 for leave taken as a result of the impact of COVID-19, e.g. school closures, care of elderly.

2. Training and guidance:

  • Instructions have been provided to complete the text field to explain the reason when code 699 is used. 
  • Regular communications during the pandemic to provide guidance on the use of code 699 e.g. weekly newsletters, TC's all staff meeting, and TC's manager's meetings.

3. Monitoring:

  • Since March, HR has been running reports on the usage of code 699, through a portal.
  • A dashboard has also been created to provide access to TMX members on the use of code 699. 
  • Regular reporting to TMX members.
  • Based on interviews, HR monitors the use of text fields when a code 699 leave request is approved.

4. Highlights:

  • The process for tracking code 699 has been working well.
  • TC employees were able to process leave electronically right from the beginning, whereas some federal departments were not able to record leave until recently, which reduces the accuracy of the information.
  • Comparison with other departments' usage of code 699 shows that TC is below the average.

5. Remaining risks and challenges

  • None identified during interviews.

Processes to track departmental resources impacted by COVID-19 – Tracking of IT equipment

1. Process:

  • Key processes for tracking IT equipment remained the same, e.g. use of ITSM, verifying asset number, Departure Form, and Equipment Off Premise Form. 
  • Rules were streamlined to allow TC employees to begin working from home immediately. As such, the Equipment Off Premise Form was not required for the first 3-4 weeks in Mar/Apr.
  • Since April, for any visible equipment being removed, security staff follows existing process to verify signatures, and match the asset numbers referenced in the form to the equipment being removed.

2. Training and guidance:

  • Guidance instructions are available on the Equipment Off Premise Form regarding the process and approvals needed to remove IT equipment from the office.

3. Monitoring:

  • Existing monitoring processes continued to be in effect during the pandemic.
  • IT continues to track when employees receive and return IT equipment.
  • For any visible equipment being removed, security staff verify signatures and asset number.
  • Security cameras are also in use.

4. Highlights:

  • Based on interviews with IT and the departmental security office, process for tracking of IT equipment has been working well.
  • Considering the risks, TC streamlined the rules in the beginning to allow the department to continue operations unhindered. This has been successful as TC operated without invoking the Business Continuity Plan.

5. Remaining risks and challenges:

  • There is a challenge going forward on how to ensure information security and how to ensure employees understand their roles and responsibilities regarding government assets.
  • (ATIP redacted)
  • While not related to the tracking of IT equipment, a risk mentioned is the potential of needing extra funding should employees need to maintain 2 offices (home and office building).

Conclusion

  • The horizontal processes, e.g. Pay and ATIP, have gone through early transformation prior to the pandemic, which enabled them to adapt well to the virtual working environment. Both offices continued to operate almost as effectively as prior to the pandemic, with the recognition of challenges related to 1) limited network capacity and 2) the lack of remote access to classified documents.
  • The department relies on both existing and new processes to track and monitor departmental resources impacted by the pandemic, in the areas of expenditures, employee leave and IT equipment. No concerns have been raised by the offices responsible for these processes.