What we examined (see Focus of the audit)

This audit examined whether the systems and practices we selected for examination at PPP Canada Inc. (the Corporation) were providing it with reasonable assurance that its assets were safeguarded and controlled, its resources were managed economically and efficiently, and its operations were carried out effectively. We selected systems and practices based on our assessment of risks in the following areas:

• corporate governance;
• strategic planning, risk management, and performance measurement and reporting;
• human resource management;
• project selection and management;
• stakeholder relations and outreach;
• safeguarding of information; and
• investment management.

What we concluded

We concluded that, based on the criteria established, there is reasonable assurance that during the period covered by the examination there were no significant deficiencies in PPP Canada Inc.’s systems and practices that we selected for examination. The Corporation has maintained these systems and practices in a manner that provides it with reasonable assurance that its assets are safeguarded and controlled, its resources are managed economically and efficiently, and its operations are carried out effectively.

What we found

Corporate governance

Overall, we found that the Corporation had in place the elements of good governance. However, some improvements were needed in the areas of clarifying roles, ensuring that the Board of Directors could exercise its responsibilities, and providing information to the Board for decision making.

This is important because clearly defined roles and responsibilities facilitate the relationship between the Board and the Corporation’s management, and enhance accountability. The Board is responsible for approving and monitoring key policies that govern the Corporation’s operations and its allocation of resources. Appropriate information enables the Board to exercise oversight and monitor the Corporation’s performance.

• Elements of good governance were in place, but there were weaknesses in the areas of clarifying roles, exercising responsibilities, and reporting

  Recommendation. The Corporation should:

  • clarify the roles of the Board and its committees regarding monitoring of corporate values and ethics;
  • enable the Board to exercise its responsibilities by ensuring that management submits all key corporate policies to the Board for its approval; and
  • report to the Board in the areas of values and ethics, and compliance with authorities, annually at a minimum, or as required.

Strategic planning, risk management, and performance measurement and reporting

Overall, we found that the Corporation had systems and practices in place that clearly defined and guided its operational activities. We also found that it had in place key elements for risk management. However, the Corporation’s strategic objectives were not clearly reported, and the Corporation’s performance reporting did not clearly demonstrate how its activities contributed toward achievement of the key corporate outcomes.

This is important because establishing clear strategic objectives allows the Corporation to determine how best to allocate resources in support of the achievement of its mandate. A lack of clearly reported strategic objectives makes it difficult to see how business line achievements facilitate progress toward outcomes. Risk management supports the achievement of strategic objectives.

This finding is also important because performance reporting supports effective management and accountability. It is particularly important in the context of the public-private partnership (P3) approach promoted by the Corporation for infrastructure projects. Performance reporting supports decision making.

• The Corporation’s operational planning and risk management processes worked well, but there were weaknesses in performance reporting

  Recommendation. The Corporation should expand its performance reporting framework to demonstrate how its activities contribute to achieving strategic objectives and corporate outcomes.

Human resource management

Overall, we found that the Corporation had the systems and practices for managing human resources in a manner that provided it with the human resource capacity for achieving corporate objectives.

This is important because an effective human resource framework aligns planning, training and development, compensation, performance management, and health and safety with long-term direction. The Corporation’s success in achieving its mandate depends largely on having the right people with the right specialized competencies required to deliver high-quality public-private partnership projects.

• Human resource management supported the Corporation’s needs

  Recommendation. We made no recommendation in this area of examination.

Project selection and management

Overall, we found that the Corporation had systems and practices in place for approving project applications, establishing contracts, disbursing funds, and monitoring approved projects. However, there were opportunities to further strengthen reporting on approved projects.

This is important because formal monitoring of a project’s status and documentation helps to ensure that risks related to the project’s success are identified and mitigated in a timely manner.

• The Corporation had sound processes in place for selecting and managing projects, but there was potential for further improvements in project reporting

  Recommendation. The Corporation should ensure that project status monitoring and follow-up activities are formally and consistently documented and reported to the Investment Committee.

Stakeholder relations and outreach

Overall, we found that the Corporation had systems and practices in place for regularly engaging and communicating with stakeholders, with the purpose of increasing awareness of the use of public-private partnerships (P3s) and building stakeholder capacity to work within a P3 project model. Further, in instances where the Corporation provided advisory services for projects undertaken by federal clients, we found that systems and practices were in place for defining and overseeing those projects. However, there were some weaknesses:

• lack of a complete and implemented corporate-wide communications and outreach strategy,
• lack of a more regular and consistent approach to measuring the effectiveness of knowledge products, and
• limited project management mechanisms to permit more formal and sound reporting to federal clients on the status of projects.

This is important because a corporate communications and outreach strategy is a critical mechanism for management. Such a strategy facilitates strategic targeting of stakeholder groups, including segments within each stakeholder group. It helps management develop appropriate messaging, communications, and knowledge products. It also helps management prioritize outreach activities for each target group.

• The Corporation promoted stakeholders’ awareness and capacity for public-private partnerships, but there were weaknesses in outreach planning, measurement of effectiveness, and reporting

  Recommendation. The Corporation should:

  • complete the development and implementation of a corporate-wide communications and outreach strategy,
  • define performance measures to gauge the utilization and impact of the knowledge products it has developed, and
  • report more formally and consistently to federal clients on the status of projects.

Safeguarding of information

Overall, we found that the Corporation had systems and practices in place to safeguard the security of its information technology applications protecting client data. However, some weaknesses were identified in the areas of policy, external assessments, disaster recovery planning, and monitoring of service providers.

This is important because the Corporation receives and retains information from applicants and funding recipients (clients), including information of a confidential nature. The Corporation has a responsibility to ensure that its information is protected.

• Key elements of information security practices were in place, with some weaknesses in policy, external assessments, disaster recovery planning, and monitoring of service providers

  Recommendation. The Corporation should:

  • define its objectives for information technology security in its security policies, as well as its password standards, and the related roles and responsibilities of employees and contractors, and should regularly monitor and resolve issues identified in external security assessments;
  • ensure that it is covered by a disaster recovery plan; and
  • improve its monitoring of its private-sector service provider by obtaining, documenting its review of, and following up on results from yearly reports on the effectiveness of controls at the service provider.

Investment management

Overall, we found that the Corporation had the systems and practices required for sound management of public-private partnership (P3) funding received in advance of disbursements. However, the investment policy was missing some key elements, such as investment objectives, a reference to concentration risk, and guidelines for reinvesting interest.

This is important because the Corporation receives funding from Parliament for the P3 Canada Fund in advance of the dates on which it must make disbursements. As of 31 March 2015, the Fund had a balance of $1.4 billion that had not yet been disbursed for P3 projects. The balance is currently growing and clear investment guidelines would help in managing the funds.

• The Corporation had an investment policy in place, but it was missing elements such as objectives, risk identification, and reinvestment guidelines

  Recommendation. The Corporation should update its investment policy in order to include the investment objectives, a reference to concentration risk, and guidelines for reinvesting interest.

Recommendations

The audited entity agrees with our recommendations, and has responded (see List of Recommendations).

Related Information

Report of the	Auditor General of Canada
Type of product	Special Examination
Topics	Crown Corporations Financial Management and Government Spending Information Management
Audited entities	PPP Canada Inc.
Completion date	12 August 2015
Tabling date	14 September 2015
Related audits	Chapter 10—Advance Funding—P3 Canada Fund, 2013 Spring Report of the Auditor General of Canada

For more information

Media Relations
Tel.: 1-888-761-5953
E-mail: infomedia@oag-bvg.gc.ca

Twitter: OAG_BVG