Internal Audit of the Institute Support Grant

The Institutes are integral to CIHR and several requirements pertaining to them are included in CIHR’s enabling legislation, the CIHR Act. One of these requirements is to reimburse expenses for Institute Advisory Board (IAB) members on a basis fixed by the Governor-in-Council; in other words, in accordance with Government of Canada policies.

Risk and Impact

CIHR is not in compliance with its legislation with respect to the reimbursement of IAB member expenses. While the financial exposure is limited, given that most institution travel policies are less generous than government rates, the greater risk identified is that there is no defined mechanism to verify program policies and processes against the CIHR Act. Non-compliance with legislation could result in reputational damage or additional scrutiny in future years. (Table 1 – Risk 1)

1a) The requirement for host institutions to reimburse IAB members as per Government of Canada policy should be documented and communicated to the Institutes.

1b) A process should be established with defined accountabilities and responsibilities to verify all proposed program changes against legislative requirements and with the proper subject matter experts.

1a) Responsibility

Director, Finance

Action

Agreed – the Finance Branch has recently assumed overall responsibility for the ISG program. As a result, the Finance Branch is currently in the process of developing a clear and comprehensive framework to effectively manage the ISG program. The framework will outline specific responsibilities and accountabilities for management of the ISG program. This framework will include:

• A summary of all key policies and procedures to ensure the program’s adherence to the CIHR Act, (including reimbursement of IAB member expenses), the Federal Policy and Directive on transfer payments, the Terms and Conditions for the ISG program and all other legislative requirements.

1b) Responsibility

Director, Finance

Action

Agreed – Effective immediately, all proposed program changes will be reviewed to ensure legislative requirements are accounted for.

The framework as described in the response to recommendation 1a) will include:

• A documented process for ensuring that any program changes are in adherence with legislative requirements.

Expected Completion:

• June 2015

T&C for transfer payment programs are initially approved by Treasury Board, and authority for approving subsequent changes varies depending on the significance of the change. Ministers are authorized to approve minor amendments and may also delegate this authority to the deputy head of the organization. The ISG Terms and Conditions (T&C) approved in 2008 state that SDs may be appointed for terms up to 7 years. Starting in 2009, SD terms were extended to a total of 8 years. This change was formally approved by GC in April 2011; however, the authority to approve minor changes to the program T&C was not delegated by the Minister.

Risk and impact

Although the change made to the T&C - SD length of appointment term - was minor, it was made without the proper authority or approval. Modification to the T&C without the proper authority puts CIHR and its senior management at risk of non-compliance with TB policy. (Table 1 – Risk 1)

2a) A process should be established with defined accountabilities and responsibilities to verify all proposed program changes against the ISG T&C. The process should include review by the relevant offices of primary interest, including Legal and Finance, to determine the appropriate approval authority in accordance with the Policy on Transfer Payments.

2a) Responsibility

Director, Finance

Action

Agreed – Effective immediately, all proposed program changes will be reviewed to ensure the ISG T&C’s requirements are accounted for.

The framework as described in the response to recommendation 1a) will include:

• Ensuring that a clear process is established for amending the Terms and Conditions of the ISG program as required.

Expected Completion:

• June, 2015.

At the start of each fiscal year, SDs are required to submit an annual budget of planned expenditures for their Institute, categorized by eligible expense type. An annual financial report detailing actual expenditures by eligible category is due to CIHR by June 30 for the preceding fiscal year. The report format and expense categories are prescribed by CIHR. Reports are not always received in a timely manner and the expense categories are not always used consistently. The annual financial reports are recorded by CIHR Finance into a spreadsheet maintained since the start of the program and more recently, forecast and actual expenditures have been combined into one place with the intent to perform variance analysis. However, the information is not reviewed or used to make decisions regarding funding the program or to assess funding needs. A review of the financial information as part of this audit revealed that the program carried an overall unspent balance of between $5.5M and $7.35M over the last six fiscal years ending on March 31, 2014.

Risk and impact

This lack of oversight has resulted in CIHR not complying with the Directive on Transfer Payments' requirements to fund Institutes at the minimum level required to achieve the program goals, and to not pay grant funds in advance of need. As a result, CIHR may have missed opportunities to reallocate and maximize the use of available ISG funds within the existing T&C. (Table 1 – Risk 3,4)

3a) A monitoring regime with defined accountabilities and responsibilities should be established to ensure financial reports are received by CIHR in a timely manner and reviewed as input to program decisions, including the release of future funding.

3b) Institutes should be provided with guidelines regarding the reporting of expenses, to ensure consistency in reporting of expenditures.

3a) Responsibility
Director, Finance

Action

Agreed – the framework as described in the response to recommendation 1a) will include:

• A monitoring regime of planned and actual expenditures to effectively inform program decisions, including the release of future funding.

Expected Completion:

• November, 2015.

3b) Responsibility

Director, Finance

Action

Agreed – the framework as described in the response to recommendation 1a) will include:

• Guidelines for the Institutes regarding the reporting of ISG expenses.

Expected Completion:

• November, 2015.

The program T&C specify that the ISG continues as long as the recipient meets the eligibility requirements. Eligible recipients are defined in the T&C as ‘Canadian institutions that host a CIHR Institute headed by an SD affiliated with them’.  When an Institute transitions to a new host institution, the previous recipient ceases to meet the eligibility requirements. The ISG ends, funded activities cease, and the grant is not eligible for renewal.

The current practice that treats the Institute transition as a renewal of the grant and transfers any unspent ISG balance to the new host institution is contrary to the T&C. The ISG Agreement includes a provision for the recipient to repay the outstanding balance to CIHR at the end of the grant and the Directive on Transfer Payments requires amounts repayable to be recorded as debts to the Crown.

Risk and impact

The current process of continuing the ISG but changing the grant recipient is not in compliance with the program T&C. The practice of transferring unspent balances to the new host institution is not in compliance with the Directive on Transfer Payments. (Table 1 – Risk 1)

4a) Unspent funds at the end of the grant should be returned to CIHR as per the ISG Agreement and managed and accounted for in accordance with the Directive on Transfer Payments.

4b) Alternate approaches should be considered to eliminate large balances at the end of an ISG; for example, reduce the funding to the outgoing institution for the last year of its grant, thus avoiding a large unspent balance when the grant expires.

4a) Responsibility

Director, Finance

Action

Agreed – Effective immediately, all unspent funds at the end of a grant will be returned to CIHR as per the ISG Agreement.

The framework as described in the response to recommendation 1a) will include:

• A clear process in compliance with the Directive on Transfer Payments for what happens to unspent ISG funds at the end of a Scientific Director’s term.

Expected Completion:

• June, 2015.

4b) Responsibility

Director, Finance

Action

Agreed – addressed in the response to recommendation 4a)

Expected Completion:

• June, 2015.

The ISG Agreement formalizes the arrangements between CIHR and the host institution for the hosting of the Institute. While a template for the agreement exists and is consistently used, the agreement does not currently reflect the complete program T&C and the requirements defined by Treasury Board for transfer payment programs. The following items are missing:

• An indemnification clause^{Footnote 1} to the benefit of the Crown as per requirement 8 of the Directive, Appendix F;
• A provision for making information public per requirement 14 of the Directive, Appendix F; and
• A clause regarding Official Languages, as mandated by the T&C and requirement 16) of the Directive, Appendix F.

In addition, the agreement template does not accurately reflect the actual schedule of installment payments.

Risk and impact

Without all of the required elements, the ISG program is not fully compliant with the TBS Directive on Transfer Payments. Required elements for funding agreements are defined to ensure funding agreements minimize risks to CIHR and enable programs to achieve their objectives. Missing elements may result in exposure to CIHR through increased scrutiny or damage to CIHR's reputation among stakeholders. Host institutions may not be aware of all their obligations. (Table 1 – Risk 1)

5a) The ISG Agreement should be reviewed and updated to accurately reflect the T&C of the program and TB requirements.

5a) Responsibility

Director, Finance

Action

Agreed – the framework as described in the response to recommendation 1a) will include:

• An updated template for ISG Agreements to ensure adherence to all key legislative requirements.

Expected Completion:

• November, 2015.

In order to be awarded an ISG, the host institution is required to complete and submit an application for funding. Elements that must be included in the application for the grant are defined by the program T&C. In the case of a grant, the application is the main mechanism to obtain information from the potential recipient regarding their eligibility for the grant and confirm their understanding of the approved uses of the funding.

The template to apply for the ISG does not include the following required elements:

• A description of how SDs will balance the time requirements for a CIHR institute (expected to be 50% of their working hours) with any teaching, research, and administrative requirements of their host institution; and
• Address the requirements for disclosure of COI for host institution staff that will be employed with the Institute.

Risk and impact

As a result of the missing elements in the application for grant, CIHR is not in compliance with TBS Policy on Transfer Payments and may not have the information required to perform the necessary due diligence in reviewing the application. In addition, the host institution may not have a clear understanding of its obligations under the ISG program. (Table 1 – Risk 1)

6a) The application form should be updated to address the missing elements as described in the T&C:

• Instructions and a place for the description of the assignment of the SD to the Institute; and
• Instructions and a place for the Institution to make any additional required COI declarations related to the ISG.

6a) Responsibility

Director, Finance

Action

Agreed – Effective immediately, all new applications will include all elements as described in the T&C

The framework as described in the response to recommendation 1a) will include:

• An updated ISG application form to ensure all key criteria of the Terms and Conditions are addressed, including SD assignment and COI requirements.

Expected Completion:

• June, 2015.

GC has fulfilled its responsibility to establish and maintain the Institutes through the initial creation of the 13 Institutes, the establishment of a support function within CIHR and the appointment of SDs and IAB members. GC has periodically reviewed the mandates and performance of the Institutes through two International Reviews, a mid-term Evaluation of the Institutes and most recently, the Institute Model Review. However, gaps exist in the documentation of processes to ensure the smooth transition of an Institute when a new SD is appointed and the Institute moves to a new host institution (HI). Key areas where processes are lacking include:

• Appointment of new SDs and transition of the Institute to a different host institution;
• Criteria and responsibilities for the review and approval of the application for the ISG received from the host institution;
• Responsibilities and requirements for the development of the ISG funding agreement; and
• Orientation, including training and awareness on responsibilities, for the new SD and host institute staff.

The documentation that exists to support the transition of Institutes and orientation of the SD and host institute staff needs updating. Currently, these activities primarily rely on corporate memory and informal discussions between Ottawa-based Institute Staff (OBIS) members. In addition, as a result of the most recent Institute Model Review, the OBIS role will no longer exist as a distinct entity and the staff and their responsibilities will be reassigned to other Portfolios.

Risk and impact

The lack of documentation coupled with the loss of the dedicated support and corporate memory provided by OBIS staff increases the risk of inconsistency in handling Institute transitions. The SD and Institute staff may not receive all the necessary training and information required to fully understanding and comply with their obligations under the ISG. (Table 1 – Risk 2)

7a) The processes, accountabilities and responsibilities in support of key Institute activities should be documented or updated if documentation currently exists. Areas to be addressed include:

• SD Appointment & Transition ;
• HI Application review;
• Development of the ISG agreement; and
• Orientation of SD and HI staff.

7a) Responsibility

Director, Human Resources

Action

Agreed

The Audit Recommendation for #7a coincides with a key HR deliverable for the 2015-16 fiscal year:

• HR is assuming responsibility for the activities formerly led by Institute Affairs, including the recruitment of SD’s, Offer/Appointment Letters, Renewal Letters, Institute Transitions and Orientation (Finance will be responsible for the ISG agreements).
• As part of assuming these responsibilities, HR will lead process mapping and improvement exercises following Lean Process Improvement Methodologies to ensure all activities are identified, roles are clarified and efficiencies are implemented. Formal documentation, assignment of roles, communication of processes will be a part of the change management plan.

Expected completion

• Expected completion is March 31, 2016, however reviews have already begun as part of the transition between HR and Institute Affairs.

The Institutes manage records that are part of CIHR's information holdings and are subject to the Access to Information and Privacy Acts (ATIP) and Treasury Board policies. Some Institutes have implemented a defined Information Management records structure. The SD is notified of his/her obligations with respect to recordkeeping and ATIP in their letter of offer and in the newly instated performance plan, but beyond that initial discussion there are currently minimal support mechanisms and controls in place to ensure the proper management of CIHR's records. The planned implementation of Infonet and secure access to the CIHR intranet for the Institutes will improve the Institutes’ ability to manage information in accordance with GC requirements.

Risk and impact

Without adequate awareness, training and support regarding their Information Management responsibilities, the Institutes and their SDs may fail to protect CIHR records, corporate memory may be lost, and the private information of Canadian may not be adequately protected or available as required by ATIP, and the TB Policy on Information Management and Directive on Recordkeeping. (Table 1 – Risk 2)

8a) SDs should be made aware of their accountabilities and responsibilities for managing information created by the Institutes.

8b) CIHR's Information Management staff should support the Institutes through adequate procedures, tools and training on their information management responsibilities, including access to information, privacy and security requirements.

8a) Responsibility

Chief Information Officer

Action

Agreed

• Information Management (IM) roles and responsibilities will be addressed with the InfoNet implementation which is scheduled to start in June, 2015.
• IM awareness is part of the InfoNet implementation strategy.

Expected completion

• August 2015.

8b) Responsibility

Chief Information Officer

Action

Agreed

• The IM team is currently updating its IM training and awareness materials. New materials will be posted on the intranet and invitations to training sessions will be sent in the fall.
• The IM team will ensure that the Institutes are part of the communications strategy.

Expected completion

• March 2016.

The Institutes are an extension of CIHR and represent CIHR to the research community and to the Canadian public. As such, there is an obligation for the Institutes to comply with the sections of the Official Languages Act (OLA) relating to service delivery (Part IV of the Act) and the advancement of both official languages (Part VII), including consideration of linguistic minority communities. The responsibilities of the SD in relation to Parts IV and VII of the Act as described above are laid out in the internal CIHR Policy on Official Language.  The OBIS staff members play a key role in ensuring that Institute activities are in compliance with these Official Languages requirements. For examples, when planning a conference, ensuring that all communications and materials are available in both languages. Although this support requirement is well understood among current OBIS staff, it is not documented as a responsibility in the OBIS role profiles, an issue which is exacerbated with the dissolution of the OBIS roles and re-assignment of staff members within CIHR.

Risk and impact

With the dissolution of the OBIS into other portfolios, there is a risk that the Institutes will be unaware of or unable to fulfill their obligations under the OLA. Gaps in this area could diminish CIHR’s ability to engage with its stakeholders, impact CIHR's reputation in the scholarly community and with the public, and could result in an official languages complaint against the agency. (Table 1 – Risk 2)

9a) The responsibilities for supporting the Institutes regarding their OLA responsibilities should be clarified, documented, and assigned to the new parties responsible once the OBIS staff has been moved to their new roles.

9b) SDs should be fully informed of their obligations under the OLA through documentation, awareness and training.

9a) Responsibility

Director, Human Resources

Action

Agreed

• The Director HR (employee focus) co-chairs the Official Languages Sub-Committee with an RKTE Director (external/community focus).
• An updated Official Languages Policy and Action Plan has recently been approved by EEMC/EMC.
• The Official Languages Policy clarifies roles and responsibilities. Formal documentation, assignment of roles, communication of processes will be a part of the change management plan.

Expected completion

• In progress.

9b) Responsibility

Director, Human Resources

Action

Agreed

• The Official Languages Policy and Action Plan have been shared with Scientific Directors at Science Council. New Scientific Directors will receive information about the Official Languages Policy and their role as part of the new integrated onboarding at CIHR.
• The Official Languages Sub-Committee will continue to implement and monitor the Official Languages Action Plan.

Expected completion

• In progress.

Current performance reporting for the Institutes is comprised of the performance measures defined through the Management Results Reporting Structure, and reported in the annual Departmental Performance Report. The two measures include partner investment in Institute-driven research and stakeholder collaboration on Institute-driven research. The Institutes also prepare and submit an annual report to Governing Council. The annual reports are focused on the allocation of the $8.6M research funding that is initiated through the Institutes, as well as partnerships and total CIHR investment in the areas covered by the Institute’s mandate. Institute impacts are reported via case studies. There are neither performance measures nor reporting specific to the outcomes of the ISG funding. While much of the ISG budget is allocated to the costs related to day-to-day functioning of the Institute – salaries, office space, equipment, etc. – funding is also used for Institute development and engagement of the research community. A requirement for SDs to provide a plan of activities to support their annual ISG budget is documented in the letter sent to confirm their appointment. In the past, this requirement was met through the provision of a three-year plan of engagement activities included with the Institute Operational Plan; however, this practice was discontinued.

Risk and impact

Without specific and meaningful performance and reporting measures for the ISG program, CIHR's senior management cannot determine how effectively the Institutes are using their funding to further Institute and CIHR objectives. (Table 1 – Risk 3,4)

10a)  CIHR should include specific and meaningful performance measures for the ISG as part of the regular assessment of Institute performance and relevance. These should be considered in the context of the performance measures established for the overall Institutes and the ISI and performance expectations established for the SDs.

10a) Responsibility

Director, Performance and Accountability

Action

Agreed

• CIHR is currently implementing the recommendations of the GC Institute Model Review. As part of this recommendation, a new framework for evaluating the impact of the Institutes is currently being developed. Based on this work, a performance measurement strategy and logic model will be developed which will ensure performance measures for the ISG are identified and tracked.

Expected completion

• June 2016.

A risk assessment for the ISG program was completed as part of the TBS submission for the amended T&C in 2008. It identified three new risks as a result of the changes made to the T&C, along with compensating controls:

• Risk: Planned outcomes are not achieved
  • Control: On-going monitoring of success
  • Control: Continued efforts at increasing the resource available for health research
  • Control: Increasing public knowledge and awareness of value of health research
  • Control: Program rationalization to focus resources on key priority areas
• Risk: Institute Transitions,
  • Control: Institute Transition Plan
• Risk: Misuse of funds
  • No specific actions; considered low risk due to low amount of money (in relation to all funds managed by host institutions) and experience of host institutions in managing grant funds

There is no ongoing monitoring of these risks to determine if the mitigating actions have been implemented and are successful, or if the risks need to be updated as a result of changes in the environment.

Risk and impact

Without ongoing monitoring of the internal and external environment, it is not known if mitigation actions have been implemented, have achieved the desired results or if the identified risks themselves still apply. (Table 1 – Risk 3,4)

11a) A process should be established to monitor risks to the program on a cyclical basis to determine if:

• Existing risks as defined are still valid;
• There are additional risks that should be assessed; and
• Mitigating actions for defined risks have been implemented and are effective.

11a) Responsibility

Director, Finance

Action

Agreed – the framework as described in the response to recommendation 1a) will include:

• An ongoing risk assessment and monitoring process to ensure all ISG program risks are identified, updated and effectively mitigated.

Expected completion

• November, 2015.

1. The policy for payment of Institute Advisory Board member expenses is not in compliance with the CIHR Act.

2. There is no process to ensure modifications to the ISG program are assessed for compliance with the ISG T&C.

4. Unspent balances returned to CIHR when institutes transition to a new host institution are not handled in accordance with the program T&C and the requirements of the Directive on Transfer Payments.

5. The Institute Support Grant Agreement template is not fully compliant with the requirements in the Amended Terms and Conditions and the requirements defined by Appendix F: Funding Agreement Provisions for Grants of the Directive on Transfer Payments.

6. The application form for an ISG does not contain all the elements as required by the Amended T&C.

Failure to comply with the Treasury Board (TB) policies for Transfer Payment programs, the program Terms and Conditions, and the CIHR Act could result in reduction of funding, increased scrutiny or damage to CIHR's reputation among stakeholders

7. Process documentation when an Institute transitions requires improvement.

8. Responsibilities and accountabilities for the management of CIHR records and information in the custody of the Institutes are not clearly assigned and documented

9. The responsibility and accountability for support to the SDs and Institute Staff for Official Languages is not documented

Lack of documentation and inconsistencies in the application of the current governance structure could result in confusion and inappropriate expenditure of public funds

3. Deficiencies in the reporting and monitoring of planned and actual ISG expenditures have resulted in a failure to manage the release of funds to the Institutes.

10. Specific performance measures are not in place for the Institute Grant Support program.

11. There is no ongoing risk monitoring of the ISG program.

Controls over governance and operations are incommensurate with risks could lead to inappropriate expenditures or wasted resources.

Decision-making and planning may not be based on accurate and/or sufficient information.

1. The Governing Council has:

a. established, determined the mandate of, appointed an SD to, maintained, and terminated the Institutes

2. Documented processes exist to support timely decision-making including the:

a. transparent, fair, independent and structured solicitation, review and selection of Institute SDs

3. The ISG agreement complies with the Amended Terms and Conditions and the requirements defined by Appendix F: Funding Agreement Provisions for Grants of the Directive on Transfer Payments.

Observation#2
Significant improvements required

Observation#5
Moderate Issues

4. CIHR's Management, Resources and Results Structure describe the expected strategic results, outcomes and key activities of the Institutes.

5. Information is not requested from host institutions beyond Institute activity and performance reporting.

6. CIHR's Performance Measurement Framework and Risk-Based Audit and Evaluation Plan reflect the new ISG model.

7. All Institutes that signed an ISG agreement after 2008 used the amended ISG T&C

8. All Institutes are headed by an SD who is employed at a Canadian institution

9. The application to form an Institute describes:

• how the objectives of the ISG program will be satisfied;
• prospective activities;
• a proposed annual budget; and
• the details by which the SD would be assigned by the institution

10. The proposed budget found in the application includes only eligible costs.

11. The amount granted is 100% of the proposed budget, up to a maximum of $1,250,000.

12. The Institute cannot be funded by other Canadian Government Sources. (Stacking Limit at 100%).

13. SD applicants have disclosed their involvement as former public servants under the Conflict of Interest and Post-employment Guidelines.

14. The work environment at the Institutes is conducive to both official languages.

15. CIHR terminates the Institute's grant upon the host institution or SD become ineligible.

16. The President:

a. Ensures the ISG's T&C are relevant and effective in meeting CIHR and government objectives, and are aligned with and support:

• CIHR's Management, Resources and Results Structure; and
• results from periodic spending reviews, such as strategic reviews

• exists;
• is periodically updated;
• supports the evaluation of the program; and
• supports the review of its relevance and effectiveness
• Measures collected as part of the strategy are used in the ongoing monitoring and decision making about of the program

17. Information on the ISG, including a description, application and eligibility requirements, and criteria for assessment, is publicly available and easily accessible to potential recipients.

18. The amount provided to Institutes is the minimum required to achieve the program goals

19. Funding agreements with recipients must ensure that:

a. An agreement exists with the ISG recipient before the first payment is released.

20. Financial signing authorities are exercised and verified as per CIHR’s Delegation of Financial Authority Instrument when:

a. The ISG Grant Agreement is signed (Section 32)

21. Advisory board members:

a. Are not paid a salary

22. Records and information regarding the ISGs are maintained in accordance with laws and regulations.

a. Accounting records and information are maintained in accordance with government laws and regulations.

23. A documented risk assessment has occurred to ensure that the level of monitoring of recipients and the reporting required from recipients, including the degree of certification or audit assurance required from the recipient on any reports, reflects an assessment of the risks specific to the program, the value of the funding in relation to administrative costs, and the risk profile of the recipients.

24. On-going risk management activities are undertaken to ensure residual and exposure risks are minimized.

25. Financial and non-financial reporting is reviewed for completeness, accuracy, relevance, timeliness, appropriateness, and reasonableness and is used for decision making.

26. Reviews of financial reports are conducted to analyze, compare and explain financial variances between actual and plan and spending patterns.

1. The requirement to compare and explain variances is documented.
2. Responsibility to compare and explain variance is known and understood and applied accordingly.
3. Management reviews variance reporting prepared.
4. Management review is on-going and is timely
5. Information is used for decision making