accountability in the pub sect annual conf aug 2006

8/9/2019 Accountability in the Pub Sect Annual Conf Aug 2006

1/37

August 28, 2006

Accountability in the PublicAccountability in the PublicSectorSectorSOx Implementation at the CBCSOx Implementation at the CBC

Annual IPAC ConferenceAnnual IPAC ConferenceCharlottetown, PEICharlottetown, PEI

Richard Harris, FCA(416) 777-3367

[email protected]

Stphane Rivest(613) 288-6095

[email protected]

Mark MacDonald, Ph.D.(416) 777-8290

[email protected]

Richard Harris, FCA(416) 777-3367

[email protected]

Stphane Rivest(613) 288-6095

[email protected]

Mark MacDonald, Ph.D.(416) 777-8290

[email protected]

PRESENTATION


2/37

2PRESENTATION

OutlineOutline

I.I. Performance and AccountabilityPerformance and Accountability Managing for ResultsManaging for Results

II.II. CanadaCanada USA ComparisonUSA Comparison

III.III. What is SOx?What is SOx?

IVIV Elements of ICOFRElements of ICOFR

Control frameworksControl frameworks

A typical projectA typical project

V.V. Case StudyCase Study SOx Implementation at the CBCSOx Implementation at the CBC

VI.VI. Questions and DiscussionQuestions and Discussion


3/37

PRESENTATION 3

I. Performance and

Accountability Managing for Results

I. Performance and

Accountability Managing for Results


4/37

4PRESENTATION

Managing Risk & Enhancing ValueManag

ing Risk & Enhancing Value

Why implement performance and accountability measures?Why implement performance and accountability measures?

To more effectively define and understand policy and program objectivesTo more effectively define and understand policy and program objectives

To more effectively allocate resourcesTo more effectively allocate resources

To more effectively manage for resultsTo more effectively manage for results

To meet new accountability expectationsTo meet new accountability expectations

Performance and accountability are inextricably linkedPerformance and accountability are inextricably linked

For public managers, the overarching objective is to:For public managers, the overarching objective is to:

Manage risksManage risks

Enhance valueEnhance value


5/37

5PRESENTATION

Why new accountability expectations?Why

new accountability expectations?

To satisfy a knowledgeable and skeptical publicTo satisfy a knowledgeable and skeptical public

To find out about results, as linked to public spending/activityTo find out about results, as linked to public spending/activity

To find out about the complete range of management responsibilitiesTo find out about the complete range of management responsibilities

FinancialFinancialValueValue--forfor--moneymoney

Delivery of resultsDelivery of results

To secure the trust and confidence of the publicTo secure the trust and confidence of the public

To satisfy democratic requirementsTo satisfy democratic requirements


6/37

6PRESENTATION

Why manage for results?Why

manage for results?

Respond to fiscal pressureRespond to fiscal pressure

Improve effectiveness/efficiencyImprove effectiveness/efficiency

Do the right thingsDo the right things

Do them in the right wayDo them in the right way

Meet new accountability expectationsMeet new accountability expectations

Improve public policy decisionImprove public policy decision--makingmaking

Deliver better results for citizens and taxpayersDeliver better results for citizens and taxpayers


7/37

7PRESENTATION

What changes when you manage for results?What changes when you manage for results?

Achieve clarity about public and organizational objectivesAchieve clarity about public and organizational objectives

Establish a new management cultureEstablish a new management culture

Focus on risk managementFocus on risk management

Establish new/different control systemsEstablish new/different control systems

Measure performance (results)Measure performance (results)

ResultsResults--based budgetingbased budgeting


8/37

8PRESENTATION

What happens when managing for results is

adopted?

What happens when managing for results is

adopted?

Renew focus on core servicesRenew focus on core services

Achieves greater clarity about core objectivesAchieves greater clarity about core objectives

Identifies opportunities for alternative service deliveryIdentifies opportunities for alternative service delivery

Enhances utilization of shared servicesEnhances utilization of shared services

Enhances budgetary and performance managementEnhances budgetary and performance management

Enhances public accountabilityEnhances public accountability


9/37

PRESENTATION 9

II. Canada USA Comparison


10/37

10PRESENTATION

U.S. EnvironmentU.S. Environment

Wave of corporate financial scandals in the United States including:Wave of corporate financial scandals in the United States including:

EnronEnron

TycoTyco

WorldcomWorldcom

AldelphiaAldelphia

Caused by:Caused by:

Improper activity, including misrepresentation and fraudImproper activity, including misrepresentation and fraud

Off balance sheet activity, coupled with inadequate disclosure for theOff balance sheet activity, coupled with inadequate disclosure for theaverage investoraverage investor

Resulting in:Resulting in:Erosion of public trust in corporations and capital markets in the UnitedErosion of public trust in corporations and capital markets in the UnitedStatesStates

Introduction of SarbanesIntroduction of Sarbanes--Oxley Act (2002)Oxley Act (2002)


11/37

11PRESENTATION

Impact on Public CompaniesImpact on Public Companies

Internal Control Over Financial Reporting (ICOFR)Internal Control Over Financial Reporting (ICOFR)

documentdocument

testtest

identify and correct deficienciesidentify and correct deficiencies

report/certifyreport/certify

audit/attestaudit/attest

Compliance Requires a Significant UndertakingCompliance Requires a Significant Undertaking

timetime

moneymoney

focusfocus

Affect on publicAffect on public--sector?sector?

What is good for the regulated, is good for the regulatorWhat is good for the regulated, is good for the regulator


12/37

12PRESENTATION

United States GovernmentUnited States Government

What is driving the push toward SOx in U.S. government?What is driving the push toward SOx in U.S. government?Certain state governments have had a standard agency internalCertain state governments have had a standard agency internalcontrol certification requirement in place for a long timecontrol certification requirement in place for a long time

This standard was not very rigorousThis standard was not very rigorous unlike SOx, it does not followunlike SOx, it does not followthe COSO framework, little documentation or testing is requiredthe COSO framework, little documentation or testing is required

New York State law now requires public authorities to adopt internalNew York State law now requires public authorities to adopt internalcontrol certification. However, an audit opinion is not requiredcontrol certification. However, an audit opinion is not required

In addition, at least 13 states are considering laws applying SOx-type regulations to NFPs. California has already enacted its ownversion of the corporate governance law for non-profits, theNonprofit Integrity Act, which went into effect in January, 2005

Members of congress and representatives of federal governmentMembers of congress and representatives of federal governmentagencies started discussions in 2003 that have led the Office ofagencies started discussions in 2003 that have led the Office ofManagement and Budget to establish a SOxManagement and Budget to establish a SOx--like requirement forlike requirement for20062006 management certification, but no external audit opinion.management certification, but no external audit opinion.


13/37

13PRESENTATION


Early Implementation of SOxEarly Implementation of SOxFederal Agencies

US Postal ServiceUS Postal Service

Pension Benefit Guaranty Corp.Pension Benefit Guaranty Corp.

Homeland SecurityHomeland Security

State AgenciesState AgenciesNY State Public AuthoritiesNY State Public Authorities

Pension PlansPension Plans

Enterprise Funds/Component UnitsEnterprise Funds/Component Units

NotNot--ForFor--Profit SectorProfit Sector Significant Voluntary AdoptionSignificant Voluntary Adoption


14/37

14PRESENTATION

Canadian EnvironmentCanadian Environment

Spending ScandalsSpending Scandals

Sponsorship, HRDC, departmental expendituresSponsorship, HRDC, departmental expenditures

Trend Toward Special ExaminationsTrend Toward Special Examinations

Value for money, program evaluationsValue for money, program evaluations

Public InquiriesPublic Inquiries

Gomery Commission, Krever Commission, Ipperwash InquiryGomery Commission, Krever Commission, Ipperwash Inquiry

Federal Government AgendaFederal Government Agenda

Management Accountability FrameworkManagement Accountability Framework

Federal Accountability ActFederal Accountability Act


15/37

15PRESENTATION

Federal Accountability Act (2006)Federal Accountability Act (2006)

Electoral financing reformElectoral financing reform

Ethics and lobbyingEthics and lobbying

Truth in BudgetingTruth in Budgeting Parliamentary Budget AuthorityParliamentary Budget Authority

Procurement and government contractingProcurement and government contracting

Real protection for whistleblowersReal protection for whistleblowers

Strengthening the power of the Auditor GeneralStrengthening the power of the Auditor General

Strengthening auditing and accountability within departmentsStrengthening auditing and accountability within departments


16/37

16PRESENTATION

Accountable, Responsive and Innovative

Government

Accountable, Responsive and Innovative

Government

Management Accountability FrameworkManagement Accountability Framework

Comptroller General of CanadaComptroller General of Canada

ReRe--establishmentestablishment

New Internal Audit PolicyNew Internal Audit Policy

April 1, 2006April 1, 2006Includes:Includes:

Baseline Qualifications for CAE (Chief Audit Executive)Baseline Qualifications for CAE (Chief Audit Executive)

Adoption of International Standards from the Institute of InternalAdoption of International Standards from the Institute of InternalAuditorsAuditors

Mandatory QAR (Quality Assessment Review)Mandatory QAR (Quality Assessment Review)

Annual assurance statement on governance, risk management andAnnual assurance statement on governance, risk management andcontrolcontrol

Evidence that Canadian Federal Government is moving towards aEvidence that Canadian Federal Government is moving towards astrong accountability regime, including SOxstrong accountability regime, including SOx--like measureslike measures


17/37

PRESENTATION 17

III. What is SOx?III. What is SOx?


18/37

18PRESENTATION

SOx in the Public SectorSOx in the Public Sector

The Public Company Accounting Reform and Investor Protection Act of2002 (Sarbanes-Oxley Act), signed into law on July 30, 2002, requires:

Section 302Section 302 management to prepare a certification statement thatmanagement to prepare a certification statement thataccompanies the financial statementsaccompanies the financial statements

Section 404Section 404 every annual report of public companies to include an internalevery annual report of public companies to include an internalcontrol report from managementcontrol report from management

In CanadaBill 198 (Ontario)Bill 198 (Ontario)

Multilateral Instrument 52Multilateral Instrument 52--109109 Canadian Securities AdministratorsCanadian Securities Administrators

No audit requirementNo audit requirement

The two Sarbanes-Oxley sections that would be most relevant to the

public sector are Sections 302: Corporate Responsibility for Financial

Reports and Section 404: Management Assessment of Internal Controls

John Radford, State Controller (Oregon)


19/37

19PRESENTATION

SOx in the Public SectorSOx in the Public Sector

Some jurisdictions are starting to introduce mandatory requirements andSome jurisdictions are starting to introduce mandatory requirements andothers are adopting SOx or SOxothers are adopting SOx or SOx--like initiatives on a voluntary basislike initiatives on a voluntary basis

Trends in other jurisdictions could motivate similar action in CanadaTrends in other jurisdictions could motivate similar action in Canada

Applying the rigor of SarbanesApplying the rigor of Sarbanes--Oxley like provisions could require someOxley like provisions could require somesignificant enhancement or remediation in controls that support externalsignificant enhancement or remediation in controls that support external

reportingreporting including performance measurement reportingincluding performance measurement reporting


20/37

20PRESENTATION


Regulatory FrameworkRegulatory Framework

The Federal Managers Financial Integrity Act of 1982 (FMFIA) requires theThe Federal Managers Financial Integrity Act of 1982 (FMFIA) requires theheads of the 23 CFO Act agencies to annually evaluate and report on theheads of the 23 CFO Act agencies to annually evaluate and report on theagencys systems of internal accounting and administrative controlagencys systems of internal accounting and administrative control

FMFIA directs the Office of Management and Budget (OMB) to establishFMFIA directs the Office of Management and Budget (OMB) to establishguidelines for the evaluation by agencies of their systems of internalguidelines for the evaluation by agencies of their systems of internalaccounting and administrative controlaccounting and administrative control

Those guidelines are now set forth in OMB Circular AThose guidelines are now set forth in OMB Circular A--123,123, ManagementManagementAccountability and ControlAccountability and Control, which define internal control using components, which define internal control using componentscontained in the COSO guidance, which is the internal control frameworkcontained in the COSO guidance, which is the internal control frameworkused most often by public companies that are subject to SOx section 404used most often by public companies that are subject to SOx section 404(management assessment of internal controls)(management assessment of internal controls)


21/37

21PRESENTATION


Fiscal Year 2XXXFiscal Year 2XXX

Annual Assurance Statement on Internal Control over Financial ReportingAnnual Assurance Statement on Internal Control over Financial Reporting

The [Agencys] management is responsible for establishing and maintaining effective internalThe [Agencys] management is responsible for establishing and maintaining effective internal

control over financial reporting, which includes safeguarding of assets and compliance withcontrol over financial reporting, which includes safeguarding of assets and compliance withapplicable laws and regulations. The [Agency] conducted its assessment of theapplicable laws and regulations. The [Agency] conducted its assessment of theeffectiveness of the [Agencys] internal control over financial reporting in accordance witheffectiveness of the [Agencys] internal control over financial reporting in accordance withOMB Circular AOMB Circular A--123, Managements Responsibility for Internal Control. Based on the results123, Managements Responsibility for Internal Control. Based on the resultsof this evaluation, the [Agency[ can provide reasonable assurance that the internal controlof this evaluation, the [Agency[ can provide reasonable assurance that the internal controlover financial reporting as of June 30, 2XXX was operating effectively and no materialover financial reporting as of June 30, 2XXX was operating effectively and no materialweaknesses were found in the design or operation of the internal controls over financialweaknesses were found in the design or operation of the internal controls over financial

reporting.reporting.

______________________________________________________

Head of AgencyHead of Agency

Internal Control CertificationInternal Control CertificationRevise O ARevise O A--123: Sample Assurance Statement?123: Sample Assurance Statement?


22/37


23/37

23PRESENTATION

Cons ofadoptingSOx-li emeasures in t ePSCons ofadoptingSOx-li emeasures in t ePS

Cost benefit isnt provenCost benefit isnt proven spendingdollars to c asedimesspendingdollars to c asedimes

Let t e commercial worldshakeout theproblemsLet the commercial worldshakeout theproblems there ispushthere ispush--backbackin theprivatesectorin theprivatesector

Increase inmaterial weaknesses, requiring remediationIncrease inmaterial weaknesses, requiring remediation

Must allow plenty of time formanagement to completean internalMust allow plenty of time formanagement to completean internal--selfselfreview, beforesubjecting toauditreview, beforesubjecting toaudit

Risksandobjectivesofagovernment entity differ from thoseofaRisksandobjectivesofagovernment entity differ from thoseofacommercial enterprisecommercial enterprise


24/37

PRESENTATION 24

IV. Elements of ICOFR Control frameworks

A typical project


25/37

25PRESENTATION

Control rameworksControl rameworks

C

onsiderationofalternate control frameworks, not justC

OSO:C

onsiderationofalternate control frameworks, not justC

OSO:Nothing specific is dictated, in terms of acceptable frameworksNothing specific is dictated, in terms of acceptable frameworks

COSO is the most elaborative internal control framework, and the choice ofCOSO is the most elaborative internal control framework, and the choice ofthe private sector in the USAthe private sector in the USA

Others:Others: Financial capability model (AG model) Capacity check (TB) Cadbury

COCO (CICA) GAO Green Book (USA) OMB A-123 (USA COBIT


26/37

26PRESENTATION

Control rameworksControl rameworks

Evaluationmust be based ona recognized control frameworkEvaluationmust be based ona recognized control framework

COSO is thede facto standardCOSO is thede facto standard

Virtually all organizations seeking to comply with SOx are using itVirtually all organizations seeking to comply with SOx are using it

More detailed than a standard like COCOMore detailed than a standard like COCO

Firms like KPMG are integrating our methodology around COSOFirms like KPMG are integrating our methodology around COSO

Conclusion: use COSOConclusion: use COSO, or be prepared to demonstrate that the frameworkused reasonably aligns with COSO (N.B. Some public sector organizations thathave embraced control risk self assessment may be using COCO and it may beeasier to continue to use this framework)


27/37

27PRESENTATION

COSO FrameworkCOSO Framework

All five components must be in place for a control to be effective

1. Control Environment - The controlenvironment sets the tone of anorganization, influencing the controlconsciousness of its people

2. Risk Assessment Every entity faces a

variety of risks from external and internalsources that must be assessed both at theentity and the activity level

3. Control Activities The policies andprocedures that help ensure managementdirectives are carried out

4. Information and Communication

Pertinent information must be identified,captured and communicated in a form andtimeframe that supports all other controlcomponents

5. Monitoring Internal control systemsneed to be monitored a process thatassesses the quality of the systemsperformance over time

Overview of COSO FrameworkOverview of COSO Framework


28/37

28PRESENTATION

A Typical projectA Typical project

1

2

3

4

5

Plan and Scopethe Evaluation

Document Controls

Evaluate Design &OperatingEffectiveness

Identify & CorrectDeficiencies

Report on InternalControl

Develop and communicate a comprehensive plan which clearly outlinesthe project scope, approach, milestones and resource needs will serveas the foundation for a successful initiative.

Document the design of significant internal controls for processes.

Evaluate design and operating effectiveness of internal control overfinancial reporting and document results of evaluation.

Identify, accumulate, and evaluate design and operating controldeficiencies; communicate findings and correct deficiencies.

Prepare managements written assertion on the effectiveness of internalcontrol over financial reporting.

6 Audit of InternalControl

Prepare for the auditor to conduct the internal control audit


29/37

PRESENTATION 29

V. Case Study - CBC


30/37

30PRESENTATION

Visionof theProjectVisionof theProject

Demonstrate that CBC/Radio-Canada is a well managed company by being

proactive in the area of internal controls

Develop control framework, inorder toevaluate theeffectivenessof

internal controls as well as to document internal controls

Give Senior Management adequate tools inorder to attest oneffectiveness

of internal control over financial statements


31/37

31PRESENTATION

Scopeof theProjectScopeof theProject

The internal controls project includes

Documentation and evaluation of financial processes and internal controlsover financial statements

Documentation and evaluation of financial processes and internal controlsover financial statements impacted by the Vision project

Documentation of Information Technology (IT) general controls


32/37

32PRESENTATION

CBCsapproachCBCsapproach

Plan and scopePlan and scope

Engaged KPMG as Subject Matter Advisors to provide expert advice andEngaged KPMG as Subject Matter Advisors to provide expert advice andassistance to the projectassistance to the project

Utilized the basis of KPMGs methodology and adapted it to CBCsUtilized the basis of KPMGs methodology and adapted it to CBCsrequirementsrequirements

Through a risk and significance ($) assessment, identified processes andThrough a risk and significance ($) assessment, identified processes andbusiness locations to be included in the projectbusiness locations to be included in the project

DocumentDocument

Opted for narrative process documentation with control matrices (no flowOpted for narrative process documentation with control matrices (no flowcharts)charts)

Review of control matrices to retain only key controlsReview of control matrices to retain only key controls


33/37

33PRESENTATION

CBCs pproachCBCs pproach

Evaluate and correctEvaluate and correct

Review process documentation and control matrices to identify gaps andReview process documentation and control matrices to identify gaps andremediation requirements and to plan control testingremediation requirements and to plan control testing

Correct deficienciesCorrect deficiencies

Test controlsTest controls

Correct gaps identified in testingCorrect gaps identified in testing

ReportReport

Report on effectiveness of Internal ControlsReport on effectiveness of Internal Controls


34/37

34PRESENTATION

Critical Success actorsCritical Success actors

Active involvement ofasteering committeeand seniorexecutives tosetActive involvement ofasteering committeeand seniorexecutives tosetthe toneand critical importanceof the Project, necessary toobtainthe toneand critical importanceof the Project, necessary toobtaincommitment throughout theorganizationcommitment throughout theorganization

Establishment ofa dedicated, adequately resourced project team, led by aEstablishment ofa dedicated, adequately resourced project team, led by aseniorexecutive throughout the duration of the Project, with adequateseniorexecutive throughout the duration of the Project, with adequateskills, controlsexperienceand clearly defined rolesskills, controlsexperienceand clearly defined roles

Early communicationsof Project objectives, scope, approach andEarly communicationsof Project objectives, scope, approach andresponsibilities for delivery ofall aspectsof the projectresponsibilities for delivery ofall aspectsof the project and inand inparticular, theoverriding responsibility of the individual businessareas toparticular, theoverriding responsibility of the individual businessareas toachievecompliance with the new control requirementsachievecompliance with the new control requirements

Selection and tailoring ofan appropriate methodology, automated toolsSelection and tailoring ofan appropriate methodology, automated toolsand training programs toensurea high level of quality and consistencyand training programs toensurea high level of quality and consistencyacrossall businessareasacrossall businessareas

Establishment ofadequate processes to track and manage issues, risksEstablishment ofadequate processes to track and manage issues, risksand changes, as well as maintaining ongoing documentation of benefitsand changes, as well as maintaining ongoing documentation of benefits

Ability of the Project approach and work plan toadapt as requiredAbility of the Project approach and work plan toadapt as requiredocusof project effortson those businessareasand processes that haveocusof project effortson those businessareasand processes that have

the potential of large financial risk to theorganizationthe potential of large financial risk to theorganization


35/37

35PRESENTATION

Statusand Next StepsStatusand Next Steps

StatusStatus

Completed documentation and assessmentCompleted documentation and assessment

Next stepsNext steps

Complete documentation of Vision project ICFRComplete documentation of Vision project ICFR

Create testing and remediation plan (onCreate testing and remediation plan (on--going)going)

Test and remediate (SeptTest and remediate (Sept--Feb)Feb)

Report (FebReport (Feb--Mar)Mar)

Create sustainment plan (SeptCreate sustainment plan (Sept--Oct)Oct)


36/37

36PRESENTATION

ChallengesChallenges

Resource contentionResource contention

New projectsNew projects

Other project changesand delaysOther project changesand delays

Sustainment activitiesSustainment activities


37/37

PRESENTATION 37

VI. Questions and DiscussionVI. Questions and Discussion

accountability in the pub sect annual conf aug 2006

Documents