Guide on Managing Fraud Risks at the Office of the Auditor General of Canada

Introduction

Fraud can happen in any organization. Fraud in a federal government organization can cause the loss of public money or property, hurt employee morale, and undermine Canadians’ confidence in public services. Therefore, federal organizations must manage their fraud risks.

A proactive approach to managing fraud risk is one of the best steps organizations can take to mitigate exposure to fraudulent activities. Although it is most likely not possible or economical to completely eliminate all fraud risk, organizations can take proactive and constructive steps to reduce their exposure. The combination of effective fraud risk governance, a thorough fraud risk assessment, and strong fraud prevention and detection measures, along with coordinated and timely investigations and corrective actions, can significantly mitigate fraud risks.

The Office of the Auditor General (OAG) developed a comprehensive Fraud Risk Management Framework inspired by Managing the Business Risk of Fraud: A Practical Guide, issued by the Institute of Internal Auditors, the American Institute of Certified Public Accountants, and the Association of Certified Fraud Examiners. This Framework guides the OAG in implementing best practices to identify, address, and manage its fraud risks.

This guide clarifies how the different components and key players contribute, directly or indirectly, to the fraud risk management of the OAG. Further details are provided in the annexes; for example, roles and responsibilities (Annex A).

Fraud Risk Management Framework at the Office of the Auditor General of Canada

Managing internal and external fraud risks at the OAG

Text version

This chart provides an overview of the Fraud Risk Management Framework at the Office of the Auditor General of Canada. It shows how the Office manages internal and external fraud risks.

The chart first defines fraud risk and fraud and provides examples of fraud. Fraud risk is the risk of various types of fraud an organization could face from internal and/or external sources. Fraud is an intentional act by one or more individuals among employees, management, those charged with governance (internal), or third parties (external) involving the use of deception to obtain an unjust or illegal advantage. The three primary categories of internal fraud are corruption, asset misappropriation, and financial statement fraud. The following are examples of fraud:

• Employees misusing influence in transactions for benefit (internal)
• Vendors billing for goods/services not received (external)
• Employees accepting bribes or benefits to act (internal)
• Employees providing sensitive information to outside parties for gain (internal)

The definitions and examples are the introduction to the Office’s Fraud Risk Management Framework, the first four parts of which are then listed.

The first part of the framework consists of the governance over fraud risks, which involves a governance structure that sends a message that fraud is not tolerated. This part includes the following sections:

• 1.1: Oversight
• 1.2: Internal Specialist, Values and Ethics
• 1.3: Values and ethics code
• 1.4: Conflict of interest and post-employment guidance
• 1.5: Risk-based internal audit plan
• 1.6: Process to investigate fraud allegations
• 1.7: Fraud Prevention Policy

The second part consists of the fraud risk assessment, which is a process to identify and address vulnerabilities to internal/external fraud. This part includes the following sections:

• 2.1: Conduct a Fraud Risk Assessment that includes best practices
• 2.1.1: Identify fraud risks without considering controls (that is, inherent)
• 2.1.2: Assess likelihood and impact of identified fraud risks
• 2.1.3: Map controls that mitigate the identified risks (preventive/detective)
• 2.1.4: Evaluate whether controls are working effectively
• 2.1.5: Evaluate residual fraud risks
• 2.1.6: Considering risk tolerance, respond to residual fraud risks
• 2.1.7: Periodically review the Fraud Risk Assessment

The third part consists of controls to prevent and detect fraud, which involves the design and implementation of processes, procedures, and activities to address identified fraud risks. This part includes the following sections:

• 3.1: Fraud prevention
• 3.1.1: Training on values, ethics, and conflicts of interest, and targeted fraud training, delivered on time
• 3.1.2: Conflict of interest (COI): Mitigate conflicts of interest
• 3.1.2.1: Effective management of the declarations of COI
• 3.1.2.2: Employee declarations done whether or not employees have a conflict of interest
• 3.1.2.3: Service standards to respond to declared conflicts of interest
• 3.1.2.4: Reporting
• 3.1.3: Controls designed to prevent fraudulent activities
• 3.2: Fraud detection
• 3.2.1: Mechanism to report fraud (see Section 4.1)
• 3.2.2: Controls designed to detect fraudulent activities

The fourth part consists of investigations of fraud allegations, which involves a thorough approach to manage fraud allegations and investigations. This part includes the following sections:

• 4.1: Mechanism to report fraud
• 4.2: Formal approach to address allegations of fraud
• 4.2.1: Assessment of the allegations of fraud
• 4.2.2: Investigation of the allegations of fraud
• 4.2.3: Monitoring of the allegations of fraud
• 4.2.4: Corrective actions
• 4.2.5: Reporting on the allegations of fraud

All four parts connect to the fifth, and final, part of the framework, which is the continuous improvement of the Fraud Risk Management Framework.

1. Governance over fraud risks

The Office of the Auditor General of Canada’s (OAG’s) governance over fraud risk management is an important part of the Fraud Risk Management Framework. It provides a message that fraud is not tolerated, through the seven elements described below.

1.1 Oversight

The Executive Committee is involved in key aspects of fraud risk management, such as determining the OAG’s risk tolerance for fraud and discussing fraud risks and related assessment in the context of the annual Fraud Risk Assessment (Section 2). The Executive Committee also receives the following key annual reports:

• Report on values and ethics (Section 1.2)
• Report on Fraud Risk Assessment (Section 2.1)
• Report on mandatory training (Section 3.1.1)
• Report on fraud allegations (Section 4.2.5)
• Report on the adequacy and application of the Fraud Risk Management Framework (Section 5)

The OAG has an independent audit committee. The Audit Committee plays an active role in the oversight of the OAG Fraud Risk Management Framework, including values and ethics, conflicts of interest, assessment of fraud risks and related controls, fraud allegations, and investigations. The Audit Committee receives updates and reports on the same topics as those listed above that are presented to the Executive Committee.

The Audit Committee Charter reflects the responsibilities of the Audit Committee regarding fraud risk management.

1.2 Internal Specialist, Values and Ethics

The OAG’s Internal Specialist, Values and Ethics, is responsible for responding to questions from employees on values and ethics, and conflicts of interest (COI). The Internal Specialist also receives and manages exception reports where threats to independence and objectivity have been identified in the audit-specific Independence Confirmation and reviews matters declared through the OAG’s annual Confidential Declaration process. Each year, the Internal Specialist, Values and Ethics, provides a report to the Executive Committee and to the Audit Committee.

Further details on mitigating conflicts of interest are provided in Section 3.1.2 of this guide.

1.3 Values and ethics code

The OAG has its own Code of Values, Ethics and Professional Conduct. This code sets out expectations with respect to values, ethics, conflicts of interest, and professional conduct for employees, consultants, and contractors. All those who perform work for or on behalf of the Office are required to comply with this code and the Values and Ethics Code for the Public Sector.

The Human Resources group has responsibility for this code and is supported by Legal Services.

1.4 Conflict of interest and post-employment guidance

The OAG’s Code of Values, Ethics and Professional Conduct contains guidance on conflicts of interest and post-employment (see Section 1.3).

1.5 Risk-based internal audit plan

The OAG’s risk-based internal audit plan is developed annually by the Practice Review and Internal Audit (PRIA) group. The plan covers a three-year period. Fraud risks are considered during that process, in accordance with the Institute of Internal Auditors standards. In addition, an assessment of fraud risks is conducted when planning each internal audit engagement.

1.6 Process to investigate fraud allegations

The OAG has established a process to investigate fraud allegations. This process and the key players are detailed in Section 4 of this guide.

1.7 Fraud Prevention Policy

The OAG’s Fraud Prevention Policy can be found in Annex D.

The objectives of this policy include

• improving the knowledge and awareness of all OAG employees to the potential risks of fraud;
• setting out responsibilities regarding the prevention, detection, and investigation of fraud;
• sending a clear message that fraud will not be tolerated; and
• assisting in promoting a climate of openness and a culture where employees feel able to raise concerns without fear of retaliation.

The Chief Financial Officer is responsible for the policy, including assessing the effectiveness and application of the policy, with assistance from the Internal Specialist for Fraud.

2. Fraud Risk Assessment

2.1 Conduct a Fraud Risk Assessment that includes best practices:

The Fraud Risk Assessment (FRA) is a process that allows organizations to identify and address internal and external fraud vulnerabilities. At the Office of the Auditor General of Canada (OAG), the FRA is integrated in the annual corporate risk assessment process, which is a key element of the annual strategic planning exercise. The FRA is the responsibility of the Chief Financial Officer (CFO) and the Internal Specialist for Fraud.

The Internal Specialist for Fraud assists the service and practice leaders in their risk assessments, and reviews the risk assessment of each service and practice to ensure that the key fraud risks have been properly identified, assessed, and addressed when required. The Internal Specialist for Fraud also assesses the OAG’s control environment with regard to fraud risks, using the OAG Fraud Prevention and Detection Scorecard (Annex C.2). As part of those procedures, the Internal Specialist for Fraud reports results and conclusions to the CFO, who certifies the adequacy of the Office’s FRA (Annex C) and reports to the Audit Committee and to the Executive Committee.

The OAG Fraud Risk Assessment approach incorporates the best practices described in sections 2.1.1 to 2.1.7, which is inspired by Managing the Business Risk of Fraud: A Practical Guide (issued by the Institute of Internal Auditors, the American Institute of Certified Public Accountants, and the Association of Certified Fraud Examiners).

2.1.1 Identify fraud risks without considering controls (that is, inherent)

The population of inherent fraud risks that could apply to the OAG is identified. This process includes the explicit consideration of all types of fraud schemes and scenarios; incentives, pressures, and opportunities to commit fraud; and information technologyIT fraud risks specific to the organization.

2.1.2 Assess likelihood and impact of identified fraud risks

The relative likelihood and potential significance of identified fraud risks are assessed based on historical information, known fraud schemes, and discussions with individuals involved in business processes.

2.1.3 Map controls that mitigate the identified risks (preventive/detective)

The fraud risks and schemes are mapped to relevant controls.

2.1.4 Evaluate whether controls are working effectively

The relevant controls identified are evaluated for design effectiveness and tested periodically within a reasonable time frame to validate operating effectiveness, in order to determine if they are reducing the inherent fraud risks.

2.1.5 Evaluate residual fraud risks

The residual risks are identified, after consideration of effective controls.

2.1.6 Considering risk tolerance, respond to residual fraud risks

Taking into consideration the organization’s risk tolerance to fraud, a fraud risk response is developed, usually in the form of an action plan. The response should address the residual fraud risks and would consider the cost versus the benefits of implementing controls or specific fraud detection procedures.

2.1.7 Periodically review the Fraud Risk Assessment

The Fraud Risk Assessment is reviewed annually during the strategic planning exercise and results are reported as part of that process.

3. Controls to prevent and detect fraud

The controls to prevent and detect fraud represent the processes, procedures, and activities addressing identified fraud risks. These controls are designed and implemented to reduce fraud risks.

As part of the Office of the Auditor General of Canada’s (OAG’s) annual Fraud Risk Assessment, specific controls to reduce fraud risk are identified. The design and implementation of those controls are also tested periodically. The identification and testing of controls is a key step to determine whether current controls are sufficient and appropriate to prevent and detect fraud and to take corrective actions, as necessary.

Sections 3.1 and 3.2 highlight some examples of fraud prevention and fraud detection controls.

3.1 Fraud prevention

3.1.1 Training on values, ethics, and conflicts of interest, and targeted fraud training, delivered on time

All employees at the OAG must take training on values, ethics, and conflicts of interest within a specific time frame. This helps to ensure that employees understand the ethical behaviour expected of them, and the potential conflicts of interest and independence threats that they may face. The Code of Values, Ethics and Professional Conduct is a key element of the Fraud Risk Management Framework. Mandatory training on these aspects helps the OAG provide a strong tone from the top. On an ongoing basis, the Office reassesses its need for mandatory training, considering different factors, including risks.

The services and audit practices communicate their training needs to the Internal Specialist for Fraud. Those needs are considered, reassessed, and prioritized as part of the OAG Strategic Plan in Relation to Fraud. The Internal Specialist for Fraud will then communicate those needs to the Professional Development team, who will coordinate the procurement, development and delivery of targeted fraud training.

3.1.2 Conflict of interest: Mitigate conflicts of interest

3.1.2.1 Effective management of the declarations of conflicts of interest

The OAG has a comprehensive process in place to manage declarations of potential and actual conflicts of interest.

Human Resources (HR) is responsible for the annual Confidential Declaration process. HR ensures that employees complete their declaration forms annually.

The Internal Specialist, Values and Ethics, is responsible for assessing matters declared by employees, including potential conflicts of interest or threats to independence, through the annual Confidential Declaration process or the independence confirmation required for each audit assignment.

With respect to the annual Confidential Declaration, the Internal Specialist, Values and Ethics, logs the cases where employees have declared assets, liabilities, or other interests that they believe can give rise to a real or perceived conflict of interest. This log also identifies the cases where, based on risk, a follow-up on the implementation measures was done. The log supports the management of conflicts of interest and threats to independence or objectivity that are declared by OAG staff.

The Internal Specialist, Values and Ethics, reviews, approves, and logs exception reports prepared by audit staff and signed by the engagement leader. The log kept by the Internal Specialist, Values and Ethics, contains key information about each exception declared, including when the matter was declared and when the OAG management and the Internal Specialist, Values and Ethics, agreed to the identified mitigation strategy.

3.1.2.2 Employee declarations done whether or not employees have a conflict of interest

Each employee must complete the annual Confidential Declaration to confirm whether or not the employee has a conflict of interest. HR monitors the timely submission of those declarations and reports results to the Executive Committee and to the Audit Committee. When an employee has declared a real or perceived conflict of interest, HR provides the declaration form to the Internal Specialist, Values and Ethics, for review, further action, and follow-up where appropriate.

In addition, all audit team members must complete an Independence Confirmation form when they begin an audit assignment. If the audit team member identifies a threat to his or her independence or objectivity, an Exception Report must be completed, and mitigation measures must be identified that will reduce the threat to an acceptable level. The effective application of the Independence Confirmation process is monitored through regular practice reviews.

3.1.2.3 Service standards to respond to declared conflicts of interest

The OAG has service standards for the Internal Specialist, Values and Ethics, for responding in a timely manner to declared conflict of interest and exception reports. The performance against these standards is reported to the Executive Committee and to the Audit Committee by the Internal Specialist, Values and Ethics.

3.1.2.4 Reporting

Each year, the Internal Specialist, Values and Ethics, reports to the Executive Committee and to the Audit Committee on conflict-of-interest declarations and on threats to independence or objectivity.

3.1.3 Controls designed to prevent fraudulent activities

Under the responsibility of the Chief Financial Officer and the Comptroller, the OAG maintains a risk-based system of internal controls over financial management. These controls are assessed for design and operating effectiveness on a rotational basis. Control assessment work is performed by various key players, such as the external auditors and the Comptroller’s Group. In addition, the Practice Review and Internal Audit (PRIA) group conducts audits and considers fraud risks as part of its risk-based audit plans.

See Annex C.2 for examples of fraud prevention controls.

3.2 Fraud detection

3.2.1 Mechanism to report fraud

As indicated in the OAG’s Fraud Prevention Policy, the Office has an open-door policy for reporting suspected fraud. Section 4.1 of this guide describes how to report a suspected fraud at the OAG.

3.2.2 Controls designed to detect fraudulent activities

As mentioned in Section 3.1.3, the OAG maintains a risk-based system of internal controls over financial management. As part of this system, the Comptroller’s Group conducts data mining and data analytics activities, in collaboration with the data analytics team.

See Annex C.2 for examples of fraud detection controls.

4. Investigations of fraud allegations

Tips are the most popular fraud detection method, representing close to 40 percent of all fraud detection. Organizations need a thorough approach to manage and investigate fraud allegations, including those received through tips.

At the Office of the Auditor General of Canada (OAG), a mechanism is in place to solicit and receive information on potential fraud, and a formal approach is used to help ensure that potential fraud is addressed appropriately and in a timely manner.

4.1 Mechanism to report fraud

As mentioned in the OAG’s Fraud Prevention Policy, any suspected fraud must be reported immediately. The OAG promotes an open-door policy for reporting suspected fraud and has implemented secure, non-retaliating, and confidential channels for individuals to report suspected fraud. The OAG employees may report suspected fraud to any of the following:

• Departmental Security Officer (DSO)
• Legal Services
• Chief Financial Officer
• Human Resources managers
• Internal Specialist, Values and Ethics
• Chief Audit Executive
• Senior Officer for disclosure
• The Auditor General
• Chair of the Audit Committee

The CFO is responsible for the coordination and the uniform application of the mechanism to report suspected fraud through the open-door approach.

4.2 Formal approach to address allegations of fraud

A formal approach has been established to assess, investigate, monitor, take corrective actions, and report on allegations of fraud.

The CFO manages all fraud allegations and oversees the investigation process, with the support of others, as needed. The CFO consults, as needed, the DSO, Legal Services, Human Resources, the Internal Specialist for Fraud, and the Internal Specialist, Values and Ethics. The CFO monitors compliance with the formal approach.

The approach is intended to provide a prompt, competent, and confidential evaluation, review, investigation (where necessary), and resolution of fraud allegations.

4.2.1 Assessment of the allegations of fraud

Fraud allegations are managed and assessed by the CFO, with the support of others as needed. The allegations are discussed in a manner that protects confidentiality. Depending on the severity of the fraud allegation, other internal services may need to be consulted.

4.2.2 Investigation of the allegations of fraud

Investigations of fraud allegations are conducted, when necessary, following the OAG Policy on Workplace Investigations. The CFO acts as the senior officer for fraud investigations as defined in that policy.

4.2.3 Monitoring of the allegations of fraud

The monitoring of fraud allegations includes maintaining a log of the allegations with sufficient information to track the status and the outcome of allegations. As well, appropriate and sufficient information is kept on file to support the evaluation of unfounded allegations.

4.2.4 Corrective actions

Corrective actions are taken when appropriate, such as disciplinary actions.

As part of the formal approach for addressing fraud allegations, the identification of root causes may identify similar situations that exist elsewhere in the organization. In these cases, the CFO determines whether there is a need to enhance certain internal controls or re-engineer certain business processes to reduce or remove the opportunity for similar incidents in the future.

The CFO considers the potential impact of the corrective actions and the message it may send to the employees, the public, stakeholders, and others.

The CFO monitors the implementation of actions recommended to mitigate future incidents.

4.2.5 Reporting on the allegations of fraud

The CFO reports to the Executive Committee and to the Audit Committee on the management of fraud allegations, including key information such as the status and the outcome of the allegation, the resolution time, and the implementation of corrective actions.

5. Continuous improvement of the Fraud Risk Management Framework

The changing environment in which organizations operate requires an ongoing reassessment of fraud exposures and responses.

The Chief Financial Officer (CFO) is responsible for monitoring the Fraud Risk Management Framework and making improvements where needed. This is done on an ongoing basis (see Annex B).

The CFO is also responsible for assessing whether the Office of the Auditor General of Canada’s (OAG’s) Fraud Risk Management Framework is meeting its objectives and for making changes as necessary. This is done at least every three years.

The results of these assessments are communicated in a report to the Executive Committee and to the Audit Committee.

Fraud Risk Management Tools

The following are the main tools that the Office of the Auditor General of Canada (OAG) uses to manage its fraud risks.

Annex A: Roles and Responsibilities

This table outlines who is accountable as Lead (L) or Support (S) for each key element of the OAG Fraud Risk Management Framework. It does not list all parties who are or could be involved in each key element.

Annex B: Monitoring work plan for the Internal Specialist for Fraud

This document serves as a work plan for the Internal Specialist for Fraud to monitor the proper application of the OAG Fraud Risk Management Framework.

This document shows

• the various steps to fulfill responsibilities related to the framework as detailed in this guide,
• who is responsible for fulfilling those steps, and
• when the Internal Specialist will monitor them.

Annex C: Annual Certification on the Adequacy of the Office’s Fraud Risk Assessment

This certification is completed each year by the Chief Financial Officer (CFO).

Context:

As part of the Office’s annual risk assessment process, each senior manager who is responsible for a function

• certifies that he/she has identified, reviewed, and assessed strategic, compliance, and operational risks (including fraud risks) for his/her functional area;
• establishes risk mitigation strategies for high and very high residual fraud risks; and
• discusses the function’s risk and mitigation strategies with the responsible Assistant Auditor General.

As part of this process, the Internal Specialist for Fraud

• assists the service and practice leaders with the Fraud Risk Assessment process;
• reviews the fraud component of the risk assessment of each service and practice leader to ensure that it follows best practices and that it includes the key elements;
• discusses the fraud risk assessments with the service and practice leaders as necessary; and
• ensures follow-up on the status of the implementation of mitigation strategies.

The Internal Specialist for Fraud also assesses the OAG control environment for fraud risk management, using the Fraud Prevention and Detection Scorecard (Annex C.2).

As part of those procedures, the Internal Specialist for Fraud reports results to the CFO, who certifies the adequacy of the Office’s Fraud Risk Assessment.

Certification:

As the Internal Specialist for Fraud, I confirm that I have reviewed the Risk Assessment of each service and practice leader to ensure that the key fraud risks have been properly identified, assessed, and addressed when required. I have also assessed the control environment for fraud risk management.

As the CFO, I certify the adequacy of the Office’s Fraud Risk Assessment.

Key Observations and Conclusion:

1) Results of Fraud Risk Assessments:

2) Control Environment:

Annex C1: Detailed Cumulative Fraud Risk Assessment

This Detailed Cumulative Fraud Risk Assessment supports the Annual Certification on the Adequacy of the Office’s Fraud Risk Assessment (Annex C).

Text version

This spreadsheet is to be filled out when conducting a detailed cumulative fraud risk assessment. The spreadsheet includes the following categories:

• Risk number
• Scenario number
• Scheme types
• Function
• Main activities/processes
• Business owner
• Original 2017 risk statement
• Link to strategic objectives
• Fraud risk scenario description
• Inherent risk likelihood (low, medium, high, or very high)
• Inherent risk impact (low, medium, high, or very high)
• Inherent risk level (normal to very high)
• Preventive controls
• Detective controls
• Corrective controls
• Control effectiveness assessed
• Residual risk level (normal to very high)
• Rationale for residual risk level
• Residual risk trend from previous year (stable, increasing, decreasing)
• Residual risk response (accept, avoid, reduce, or share)
• Risk response explanation
• Residual risk response strategy—mandatory for high or very high residual risk levels

Text version

This table represents a risk assessment scale to refer to when completing the following four categories of the Detailed Cumulative Fraud Risk Assessment template: inherent risk likelihood, inherent risk impact, inherent risk level, and residual risk level.

The table indicates the following four risk likelihood levels—within the foreseeable future—based on probability or observed frequency:

• Very high (likely or frequent)
• High (probable)
• Medium (possible—could occur occasionally)
• Low (unlikely, though possible)

The table also indicates the following four risk impact levels—as a factor of potential severity, scope, and impacts on the operations of the Office of the Auditor General of Canada:

• Very high
• High
• Medium
• Low

In addition, the table indicates the following six overall risk levels, which are determined by where risk likelihood and risk impact levels intersect:

• Very high—Mitigate and monitor (extensive senior management involvement)
• High—Mitigate and monitor (inform senior management)
• Elevated to high—Mitigate and monitor (inform senior management)
• Elevated—Mitigate and monitor
• Normal to elevated—Monitor, possible mitigation
• Normal—Accept

The following are the overall risk levels for all 16 scenarios:

• When the risk likelihood is low and the risk impact is very high, then the overall risk level is elevated.
• When the risk likelihood is low and the risk impact is high, then the overall risk level is elevated.
• When the risk likelihood is low and the risk impact is medium, then the overall risk level is normal to elevated.
• When the risk likelihood is low and the risk impact is low, then the overall risk level is normal.
• When the risk likelihood is medium and the risk impact is very high, then the overall risk level is high.
• When the risk likelihood is medium and the risk impact is high, then the overall risk level is elevated to high.
• When the risk likelihood is medium and the risk impact is medium, then the overall risk level is elevated.
• When the risk likelihood is medium and the risk impact is low, then the overall risk level is normal to elevated.
• When the risk likelihood is high and the risk impact is very high, then the overall risk level is very high.
• When the risk likelihood is high and the risk impact is high, then the overall risk level is high.
• When the risk likelihood is high and the risk impact is medium, then the overall risk level is elevated to high.
• When the risk likelihood is high and the risk impact is low, then the overall risk level is elevated.
• When the risk likelihood is very high and the risk impact is very high, then the overall risk level is very high.
• When the risk likelihood is very high and the risk impact is high, then the overall risk level is very high.
• When the risk likelihood is very high and the risk impact is medium, then the overall risk level is high.
• When the risk likelihood is very high and the risk impact is low, then the overall risk level is elevated.

Annex C2: Fraud Prevention and Detection Scorecard

Context:

This tool supports the Annual Certification on the Adequacy of the Office’s Fraud Risk Assessment (Annex C).

It is inspired by Managing the Business Risk of Fraud: A Practical Guide (issued by the Institute of Internal Auditors, the American Institute of Certified Public Accountants, and the Association of Certified Fraud Examiners). It is used as a guide to assess the Office’s control environment over fraud risk. It is completed by the Internal Specialist for Fraud in consultation with other stakeholders as part of the annual Fraud Risk Assessment.

To assess the strength of the organization’s fraud prevention system, carefully assess each area below and score the area, factor, or consideration as follows:

Red: indicating that the area, factor, or consideration needs substantial strengthening and improvement to bring fraud risk down to an acceptable level.

Yellow: indicating that the area, factor, or consideration needs some strengthening and improvement to bring fraud risk down to an acceptable level.

Green: indicating that the area, factor, or consideration is strong and fraud risk has been reduced—at least—to a minimally acceptable level.

Each area, factor, or consideration scored either red or yellow should have a note associated with it that describes the action plan for bringing it to green on the next scorecard.

Annex D: Fraud Prevention Policy

1. Effective date

This Policy is effective on 19 April 2018.

2. Application

This Policy applies to any alleged or detected fraud, involving employees of the Office of the Auditor General of Canada (OAG) as well as consultants, vendors, contractors, and outside parties with a business relationship with the OAG. Any investigative activities required will be conducted without regard to the suspected individual’s length of service, position/title, or relationship to the OAG.

Fraud is defined as an intentional act by one or more individuals among employees, management, those charged with governance (internal), or third parties (external) involving the use of deception to obtain an unjust or illegal advantage. The three primary categories of internal fraud are corruption, asset misappropriation, and financial statement fraud.

Examples of fraud include but are not limited to

• misusing influence in transactions for benefit;
• misappropriation of funds, supplies, or other assets;
• impropriety with intent in the handling or reporting of money or financial transactions;
• disclosing confidential and proprietary information to outside parties for benefit;
• accepting or seeking anything of material value from audited entities, contractors, vendors, or persons providing services/materials to the OAG;
• destruction, removal, or inappropriate use of records, furniture, fixtures, and equipment; and/or
• accepting bribes or benefits to act.

3. Policy statement

The OAG is committed to

• establishing a zero-tolerance environment with respect to fraud;
• consistently displaying the appropriate attitude regarding fraud prevention and encouraging free and open communication regarding ethical behaviour; and
• maintaining an open-door approach to reporting suspected fraud.

The OAG has developed a comprehensive Fraud Risk Management Framework that guides the organization in implementing best practices to identify, address, and manage its fraud risks. This policy is part of the Framework under Section 1. Governance over fraud risks.

4. Policy objective

The purpose of this Policy is to

• improve the knowledge and awareness of all OAG employees to the potential risks of fraud;
• set out responsibilities regarding the prevention, detection, and investigation of fraud;
• send a clear message that fraud will not be tolerated; and
• assist in promoting a climate of openness and a culture where employees feel able to raise concerns without fear of retaliation.

5. Roles and responsibilities

Auditor General’s responsibilities:

• Under s.16.4 (1) (b) of the Financial Administration Act, Deputy Heads, in their role as accounting officers, are accountable before committees of Parliament for the measures taken to maintain systems of internal control in their departments.
• The Treasury Board Policy on Financial Management requires Deputy Heads to ensure that a risk-based departmental system of internal control over financial management, which includes managing the risk of fraud, is established, monitored, and maintained.
• Under s.16.1 of the Financial Administration Act, Deputy Heads are responsible for ensuring an internal audit capacity appropriate to the needs of the department. Furthermore, under s.4.1.2 of the Policy on Internal Audit, they are responsible for ensuring that internal audits are carried out in accordance with the Institute of Internal Auditors’ International Professional Practices Framework (IPPF). The IPPF includes specific references in the standards pertaining to internal audit’s role regarding fraud.

Chief Financial Officer’s responsibilities:

• In support of Deputy Heads, the Treasury Board Policy on Financial Management requires that Chief Financial Officers (CFOs):
  • establish, monitor, and maintain a risk-based system of internal control over financial management;
  • provide reasonable assurance that financial resources are safeguarded against material loss; and
  • take prompt corrective action when control weaknesses and material unmitigated risks are identified, including the risk of fraud.
• The CFO, with the assistance of the Internal Specialist for Fraud, is responsible for proper application of the OAG Fraud Prevention Policy.

Chief Audit Executive’s responsibilities:

• Under Section 4.1.1 of the Directive on Internal Audit, chief audit executives are responsible for applying the IPPF in the department, which includes the standards pertaining to fraud management.

Managers’ responsibilities:

• Each manager must be familiar with the types of fraud risks within his or her area of responsibility and be alert for any indication of fraud.

Employees’ responsibilities (including managers):

• Report cases of suspected fraud promptly and appropriately.
• Be familiar with and comply with the OAG’s Code of Values, Ethics and Professional Conduct.
• Act in good faith and on the basis of reasonable belief in reporting alleged fraud activity.

6. Mechanism to report fraud

Any suspected fraud must be reported immediately. The OAG promotes an open-door policy with regard to reporting suspected fraud and has implemented secure, non-retaliating, and confidential channels for individuals to report suspected fraud. OAG employees may report suspected fraud to any of the following:

• Departmental Security Officer (DSO)
• Legal Services
• Chief Financial Officer
• Human Resources managers
• Internal Specialist, Values and Ethics
• Chief Audit Executive
• Senior Officer for disclosure
• The Auditor General
• Chair of the Audit Committee

The CFO manages all fraud allegations and oversees the investigation process (if necessary) with the support of the Internal Specialist for Fraud. The CFO consults when needed with the DSO, Legal Services, Human Resources, and the Internal Specialist, Values and Ethics.

This policy does not preclude an employee to present a complaint to the Senior Integrity Officer in accordance with the Public Servants Disclosure Protection Act.

7. Formal approach to address allegations of fraud

The OAG has established a formal approach to assess, investigate, monitor, take corrective actions, and report on allegations of fraud. (Refer to the Guide on Managing Fraud Risks at the Office of the Auditor General of Canada and the Policy on Workplace Investigations for details.)

Appropriate disciplinary measures, up to termination of employment, will be taken by the OAG as a result of a fraudulent action. As well, a decision regarding referral of the investigation results to the appropriate law enforcement and/or regulatory agencies for independent investigation will be made by the CFO in consultation with Legal Services and senior management and management of the appropriate services, as will final decisions on disposition of the case.

A fraud investigation under this policy does not preclude the OAG Practice Review and Internal Audit function to initiate an audit.

8. Non-retaliation

Employees will not be penalized or disciplined for making a complaint in good faith. Disciplinary action will be taken against anyone who takes any reprisal against a person who reports, in good faith, an incident of alleged or detected fraud.

9. Communication

This policy shall be made available on the OAG Intranet.

10. Policy compliance and review

Adherence of OAG employees to this policy will be monitored by, including but not limited to, investigation, audit, and/or review of records.

The CFO, with the assistance of the Internal Specialist for Fraud, in consultation with stakeholders, will review and update this policy at a minimum every three years, or earlier if needed. Any changes to the policy must be approved by the Executive Committee.

11. Inquiries

Inquiries regarding this policy shall be directed to the CFO or to the Internal Specialist for Fraud.

12. References

Federal Legislation

Criminal Code

Federal Accountability Act

Financial Administration Act

Public Servants Disclosure Protection Act

Treasury Board of Canada Secretariat

Directive on Internal Audit

Directive on Public Money and Receivables

Policy on Financial Management

Policy on Government Security

Values and Ethics Code for the Public Sector

OAG

Code of Values, Ethics and Professional Conduct

Guide on Managing Fraud Risks at the Office of the Auditor General of Canada

Policy on Workplace Investigations (under review)