Observations and Recommendations

Management Controls

Audit expectations were:

• That management had an appropriate framework in place to set program direction, precedents, procedures, program objectives and priorities;
• That a contribution agreement setting out the terms and conditions of the project existed;
• That a sound project assessment review framework with decision sign-off stages was in place and well understood by project officers;
• That eligibility of projects, graduates and documentation was communicated and appropriately applied throughout the project cycle;
• That authorities and limitations were structured, clarified and communicated;
• That management compared results achieved against expectations on a periodic basis; and
• That program evaluation activities were used to identify program strengths, weaknesses and impacts as well as alternative ways of program delivery.

Management Framework

The ITPP program was well managed. There were appropriate controls for screening and approving projects. While procedural memos, precedents and instructions existed in various forms in the regions and headquarters between 1995 and 2002, key uniform strategic directives were initiated March 2002 onwards by the Deputy Minister and the program-operations directorate to guide the renewal and administration of the ITPP program until its elimination in 2005. Implementation, administration, eligibility, cut-off dates, promotion and procedural rules were streamlined and clarified in ensuing memos. Such documentation provided the authoritative design and reference sources for staff to effectively and consistently deliver the program.

Projects examined were appropriately approved within the time limitations and within the dollar limits set. Projects and graduates were found to be eligible and met the program criteria. Corporate registry searches were done where warranted. Clarifications were sought where needed. In some cases, the facts were noted on file, while other times there was only a diary that client was spoken to without further details.

A formative evaluation of ITPP was done in 2004. The evaluation concluded that the program was relevant, making impacts and contributing to success for small and medium enterprises. There were differing views on whether the program should be delivered by WD or by a third party.

Documentation for more than twenty audit program points that were tested was generally strong. However, 10 of the 41 sample projects files had at least one issue associated with the examination against the various audit program points reviewed for each file.

Table 1 summarizes the main points from the audit verification results of the sample files examined:

Description	Total	Percentage
Number of active projects in audit period	176
Number of sample projects examined	41
Percentage of sample size to population files		23%
Project Files examined by audit	41	100%
Project Assessment Review Risk Ranking of sample
Low	40	98%
Medium	1	2%
High	0	0%
Audit Exception Summary:
Files with exceptions to the file review criteria established	10	24%

The challenge was that over 98% of the projects examined were rated as low risk. It was apparent from the files reviewed that the risk assessment completed was weighted heavily on the fact that the maximum contribution of $20,000 was deemed as being of low significance compared to the higher contribution amounts regularly funded under other WD programs. None of the projects were assessed as high risk, and only 2% were rated as medium risk.

For independent audit analysis purposes, the majority of the clientele served by the program were small and medium enterprises, which often have limited resources to apply to the administration of government programs. That factor in itself becomes an inherent risk of high or moderate concern for any direct government assistance program. There have been examples in the past where other government departments have not adequately mitigated these risks.

Internal Audit considered that the 98% rate of low risk ranking across the population sampled was likely far too high considering all the available risk indicators. The low dollar value may have weighed too heavily in the risk assessment. For example, 75% of the projects examined were related to market research and international initiatives in their infancy, making them vulnerable to moderate and unknown risks.

In addition, WD could have tightened up its due diligence and monitoring processes to ensure that unusual circumstances encountered during the life of the project were fully documented and the risk ranking reassessed from that assigned at project approval.

Overall, the opportunities for improvement were assessed as low risk given consideration to significance, the program's elimination in 2005, and potential impact given that WD currently does not deliver and similar programs. Continuous improvement efforts have already taken place based on recommendations from recent around the overall management and administration of grants and contribution programs.

Recommendation #1:
If and when WD establishes similar programs in the future, project specific risk should be reassessed periodically. Risk is not static and needs to be reassessed throughout the life cycle of the project.

Monitoring and Results

Audit expectations were:

• That external and internal environments were monitored to obtain information that may signal a need to re-evaluate risks and WD's objectives;
• That appropriate and timely progress reports and claim documentation was communicated;
• That financial and non-financial reporting was reviewed and approved;
• That the rigour and evidence of monitoring was commensurate with risk level;
• That processes were in place to monitor financial and operational performance on an ongoing basis; and
• That adequate and appropriate documentation supported claims.

There were appropriate controls for disbursing payments to recipients. Pay stubs, T4s and payroll registers were used to validate salaries as appropriate. Progress reports were requested from recipients and received. Prior to payments, progress reports were required and were received. Payments made were within the limits indicated in the project approval records. Where funds were not entirely spent, they were de-committed. Companies met their obligations under the WD terms and conditions.

There were notes on file about consultations with supervisors and reasons for decisions made. In a few instances though, rationale for disposal of unusual situations could have been better documented and these conditions are discussed in more detail below.

In more than 15% of the samples tested, claims were not filed quarterly, but rather at the end of the project where the entire qualifying amount was then being claimed. A number of the graduate employees had already left the company before the claims were submitted. This would have hindered any opportunity for WD to interview the graduates to confirm that the program objectives were still being met.

There was little documentation on file to confirm that alternate procedures, such as site visits or interviewing graduates, had been done to minimize the risk of misrepresentations in the progress reports. There was little verification done by WD to confirm that the employee's claims represented what the employee was actually doing and was still eligible for funding. WD relied heavily on the companies receiving the money to accurately state the duties of the person being hired and the international impact the project made. The audit found that WD tended to rely on the information provided by the recipient and beneficiary of the funding.

For the one project ranked as medium risk in the sample tested, there was no documentation on the file to suggest that the processes adopted were any different from the 40 low risk files sampled. The same standardized claims review method applied to all files, regardless of their risk ranking. Despite the fact that some applicants were first-timers and others were repeat applicants, there was nothing on the files to indicate any more or less rigour of monitoring tailored to the circumstances of the recipient and its application. Internal Audit found that there was no requirement for final project reports to analyze and demonstrate accomplishments to ensure linkages to program objectives and results.

Recommendation #2:
WD should tailor its due diligence and monitoring processes to be commensurate with the level of risk assessed.

Conclusion

In summary, the controls established for the ITPP program by management were effective in design and operated satisfactorily. Based on internal audit standards and criteria selected, sufficient audit work has been completed and analyzed to support the conclusion that the management control framework for which WD management is responsible was appropriate for the size and risks of the ITPP program.

In accordance with the Government of Canada internal auditing standards, a reasonable assurance is provided that relevant and reliable management controls existed for the delivery of the ITPP program from 2002 through to 2005 when the program ceased.

In addition, opportunities for improvement have been identified in this report where controls can be strengthened for future programs of similar design and delivery.