2016 Spring Reports of the Auditor General of Canada PPP Canada Inc.—Special Examination Report—2015
2016 Spring Reports of the Auditor General of Canada PPP Canada Inc.—Special Examination Report—2015
Table of Contents
- Special Examination Opinion
- Introduction
- Findings, Recommendations, and Responses
- Conclusion
- About the Audit
- List of Recommendations
- Exhibits:
- 1—Corporate governance—strengths and weaknesses
- 2—Organizational planning levels
- 3—Strategic planning, risk management, and performance measurement and reporting—strengths and weaknesses
- 4—Human resource management—strengths and weaknesses
- 5—Project selection and management—strengths and weaknesses
- 6—Stakeholder relations and outreach—strengths and weaknesses
- 7—Safeguarding of information—strengths and weaknesses
- 8—Investment management—strengths and weaknesses
This report reproduces the special examination report issued to PPP Canada Inc. on 14 September 2015. No follow-up audit work has been performed on the matters raised in this reproduced report.
Special Examination Opinion
To the Board of Directors of PPP Canada Inc.:
1. In our opinion, based on the criteria established, there is reasonable assurance that during the period covered by the examination there were no significant deficiencies in PPP Canada’s systems and practices that we selected for examination. PPP Canada Inc. (the Corporation) has maintained these systems and practices in a manner that provides it with reasonable assurance that its assets are safeguarded and controlled, its resources are managed economically and efficiently, and its operations are carried out effectively.
2. Corporate governance. Overall, we found that the Corporation had in place the elements of good governance. However, some improvements were needed in the areas of clarifying roles, ensuring that the Board of Directors could exercise its responsibilities, and providing information to the Board for decision making.
3. Strategic planning, risk management, and performance measurement and reporting. Overall, we found that the Corporation had systems and practices in place that clearly defined and guided its operational activities. We also found that it had in place key elements for risk management. However, the Corporation’s strategic objectives were not clearly reported, and the Corporation’s performance reporting did not clearly demonstrate how its activities contributed toward achievement of the key corporate outcomes.
4. Human resource management. Overall, we found that the Corporation had the systems and practices for managing human resources in a manner that provided it with the human resource capacity for achieving corporate objectives.
5. Project selection and management. Overall, we found that the Corporation had systems and practices in place for approving project applications, establishing contracts, disbursing funds, and monitoring approved projects. However, there were opportunities to further strengthen reporting on approved projects.
6. Stakeholder relations and outreach. Overall, we found that the Corporation had systems and practices in place for regularly engaging and communicating with stakeholders, with the purpose of increasing awareness of the use of public-private partnerships (P3s) and building stakeholder capacity to work within a P3 project model. Further, in instances where the Corporation provided advisory services for projects undertaken by federal clients, we found that systems and practices were in place for defining and overseeing those projects. However, there were some weaknesses:
- lack of a complete and implemented corporate-wide communications and outreach strategy,
- lack of a more regular and consistent approach to measuring the effectiveness of knowledge products, and
- limited project management mechanisms to permit more formal and sound reporting to federal clients on the status of projects.
7. Safeguarding of information. Overall, we found that the Corporation had systems and practices in place to safeguard the security of its information technology applications protecting client data. However, some weaknesses were identified in the areas of policy, external assessments, disaster recovery planning, and monitoring of service providers.
8. Investment management. Overall, we found that the Corporation had the systems and practices required for sound management of public-private partnership (P3) funding received in advance of disbursements. However, the investment policy was missing some key elements, such as investment objectives, a reference to concentration risk, and guidelines for reinvesting interest.
9. The rest of the report provides an overview of the Corporation and more detailed information on our findings and recommendations. The Corporation agrees with all of the recommendations. Its detailed responses follow the recommendations throughout the report.
10. Under section 131 of the Financial Administration Act (FAA), PPP Canada Inc. is required to maintain financial and management control and information systems and management practices that provide reasonable assurance that its assets are safeguarded and controlled; its financial, human, and physical resources are managed economically and efficiently; and its operations are carried out effectively.
11. Section 138 of the FAA also requires the Corporation to have a special examination of these systems and practices carried out at least once every 10 years.
12. Our responsibility is to express an opinion on whether there is reasonable assurance that during the period covered by the examination—from August 2014 to May 2015—there were no significant deficiencies in the Corporation’s systems and practices that we selected for examination.
[Original signed by]
Marise Bédard, CPA, CA
Principal
for the Auditor General of Canada
[Original signed by]
KPMG LLP
Chartered Professional
Accountants
Licensed Public Accountants
12 August 2015
Ottawa, Canada
Introduction
Background
13. PPP Canada Inc. is a Crown corporation established in 2008, pursuant to the provisions of the Canada Business Corporations Act. It reports to Parliament through the Minister of Finance. Its mandate is to improve the delivery of public infrastructure by achieving better value, timeliness, and accountability to taxpayers through public-private partnerships (P3s).
14. PPP Canada fulfills its mandate through three lines of business:
- P3 Knowledge Development and Sharing: The Corporation serves as a source of expertise and advice on public-private partnership matters.
- Advancing Federal P3s: The Corporation acts as the lead on federal P3 matters, with a mandate to assess federal P3 opportunities. It also advises on the execution of federal P3 projects.
- Advancing Provincial, Territorial, Municipal and First Nations P3s: The Corporation assesses and enhances the viability of P3 projects for which provincial, territorial, municipal, and First Nations governments seek funding from the P3 Canada Fund and the New Building Canada Fund.
15. Public-private partnerships are contractual agreements between government and the private sector. In this model, private-sector businesses provide assets and deliver services, and the various partners share the responsibilities and business risks. Under such an agreement, the private-sector partner may perform tasks such as designing, building, operating, maintaining, and financing a portion of infrastructure or services. P3s are designed to transfer a major share of the risks associated with infrastructure development to the private-sector partner in return for payment of a premium. Risks include the costs associated with overruns, schedule delays, unexpected maintenance, and/or latent defects in the assets.
16. In 2009, the Government of Canada contributed $1.2 billion to the P3 Canada Fund to provide incentives for the use of P3 procurement in delivering public infrastructure projects. In 2014, the government provided an additional $1.2 billion over five years. To date, PPP Canada has committed $1.3 billion in investments to P3 projects across the country. The Corporation is using the new funding to give priority to public infrastructure projects in the areas of transportation, water and wastewater, and solid waste disposal.
17. PPP Canada started its operations in 2009. In the following six years, it has worked with federal, provincial, territorial, municipal, and First Nations levels of government, as well as the private sector. With these stakeholders, it has brought a mix of large, medium, and small P3 projects to the Canadian market. Projects currently under way include
- Iqaluit International Airport Improvement,
- Regina Wastewater Treatment Plant, and
- Saskatoon North Commuter Parkway.
18. PPP Canada has also developed specialized advisory services oriented toward federal departments and agencies. It is developing P3 business cases for a number of federal clients. In addition, the Corporation helps to evaluate applications for the New Building Canada Fund, administered by Infrastructure Canada. If an application concerns a provincial or municipal project estimated to cost in excess of $100 million, PPP Canada screens the project for P3 suitability.
Focus of the audit
19. Our objective for this audit was to determine whether the systems and practices we selected for examination at PPP Canada Inc. (the Corporation) were providing it with reasonable assurance that its assets were safeguarded and controlled, its resources were managed economically and efficiently, and its operations were carried out effectively. We selected systems and practices based on our assessment of risks in the following areas:
- corporate governance;
- strategic planning, risk management, and performance measurement and reporting;
- human resource management;
- project selection and management;
- stakeholder relations and outreach;
- safeguarding of information; and
- investment management.
20. More details about the audit objective, scope, approach, systems and practices examined, and criteria are in About the Audit at the end of this report.
Findings, Recommendations, and Responses
Corporate governance
Elements of good governance were in place, but there were weaknesses in the areas of clarifying roles, exercising responsibilities, and reporting
21. Overall, we found that the Corporation had in place the elements of good governance. However, some improvements were needed in the areas of clarifying roles, ensuring that the Board of Directors could exercise its responsibilities, and providing information to the Board for decision making.
22. This is important because clearly defined roles and responsibilities facilitate the relationship between the Board and the Corporation’s management, and enhance accountability. The Board is responsible for approving and monitoring key policies that govern the Corporation’s operations and its allocation of resources. Appropriate information enables the Board to exercise oversight and monitor the Corporation’s performance.
23. Our analysis supporting this finding discusses
24. PPP Canada is governed by a Board of Directors drawn from the private sector. There are eight members, including a Chief Executive Officer (CEO) appointed by the Governor in Council. Three committees report to the Board: the Audit Committee, the Governance and Human Resources Committee, and the Investment Committee.
25. The Board of Directors is expected to have extensive knowledge and experience in the areas of public-private partnership (P3) contracting and finance structuring, engineering, and construction. In allocating funds, the Board is expected to conduct itself ethically and efficiently, and to closely monitor the performance of the Corporation.
26. Our recommendation in this area of examination appears at paragraph 28.
27. Corporate governance. While the Corporation had in place the elements of good governance, we found room for improvement in some areas (Exhibit 1).
Exhibit 1—Corporate governance—strengths and weaknesses
| Elements | Findings |
|---|---|
|
Board of Directors structure |
Strengths The Board structure (including committees) reflected the nature and complexity of the Corporation’s business and responsibilities. The Board regularly assessed its performance and that of its committees. A transparent mechanism was used to report the assessment results. |
|
Roles and responsibilities |
Strength Roles and responsibilities were clearly defined in the Board’s charter and the terms of reference of its committees. Weaknesses The Board’s charter required it to approve the Corporation’s Values and Ethics Code, as well as the Corporate Risk Profile and the human resources strategic plan. Although the Board reviewed the documents, we found no indication that it had approved them. In the case of the Values and Ethics Code, two committees were given responsibility for monitoring it, which seemed to be a duplication of roles. |
|
Independence |
Strengths The Board had the independence to perform its duties and responsibilities, and held regular meetings without management in attendance. |
|
Competencies |
Strengths Skills and expertise needed by an individual to be a director of the Corporation were established. Board members had the appropriate skills and expertise for their roles and responsibilities. Board members had access to ongoing training, if needed. |
|
Oversight |
Strengths The corporate plan reflected the Corporation’s legislative and public policy mandate. The Board set the strategic direction. The CEO’s performance objectives were aligned with the strategic direction. The Board was active in setting up annual objectives for the CEO and conducting an annual performance evaluation. The information provided to the Board supported decision making. Board members challenged management in the decision-making process, as evidenced in minutes of the Board or its committees. Both external and internal auditors reported to the Audit Committee, and were independent of management. Management had provided annual reports to the Board on corporate risk management. In fall 2014, it planned to shift to semi-annual reporting. Weaknesses Reporting to the Board was not sufficient in two areas:
|
|
Values and ethics |
Strengths As Governor-in-Council appointees, Board members were informed of the Conflict of Interest Act and were required to comply with it. Board members proactively disclosed potential conflicts of interest. In September 2014, the Corporation issued its Values and Ethics Code, which applied to its employees. The code included a mechanism for reporting on implementation. A good practice would be to implement a Values and Ethics Code for Board members, clarifying circumstances and relationships that could lead to potential conflicts of interest. Weaknesses During the period of the audit, management did not report on potential issues related to the Values and Ethics Code for employees. Although the employees’ code established a mechanism for monitoring and reporting, it did not specify a fixed time frame for these activities. |
|
Communication |
Strength The Board communicated effectively with the responsible Minister, the CEO, senior managers, and the public. |
28. Recommendation. The Corporation should
- clarify the roles of the Board and its committees regarding monitoring of corporate values and ethics;
- enable the Board to exercise its responsibilities by ensuring that management submits all key corporate policies to the Board for its approval; and
- report to the Board in the areas of values and ethics, and compliance with authorities, annually at a minimum, or as required.
The Corporation’s response. Agreed.
- The Corporation will ensure that the reporting responsibilities within the employees’ Values and Ethics Code align with the terms of reference of Board committees.
- The Board reviewed, discussed, and endorsed the Corporation’s Values and Ethics Code and Human Resources Strategy but did not formally resolve on them. The Corporation will present these and future key corporate policies to the Board for approval.
- The Corporation will report annually to the Board on values and ethics, and at least annually on compliance with authorities.
Strategic planning, risk management, and performance measurement and reporting
The Corporation’s operational planning and risk management processes worked well, but there were weaknesses in performance reporting
29. Overall, we found that the Corporation had systems and practices in place that clearly defined and guided its operational activities. We also found that it had in place key elements for risk management. However, the Corporation’s strategic objectives were not clearly reported, and the Corporation’s performance reporting did not clearly demonstrate how its activities contributed toward achievement of the key corporate outcomes.
30. This is important because establishing clear strategic objectives allows the Corporation to determine how best to allocate resources in support of the achievement of its mandate. A lack of clearly reported strategic objectives makes it difficult to see how business line achievements facilitate progress toward outcomes (Exhibit 2). Risk management supports the achievement of strategic objectives.
Exhibit 2—Organizational planning levels
Operational activities need to support strategic objectives, which need to support outcomes.
Exhibit 2—text version
Diagram describing organizational planning levels. The diagram shows three items on the topic of organizational planning levels: operational activities, strategic objectives, and outcomes.
Operational activities are actions planned by an organization to produce results over the short term. For example: Deliver training sessions.
Strategic objectives are results expected to occur after one or more activities have been achieved. These activities are usually intermediate in timing. For example: Improve employees’ awareness and skill sets.
Outcomes are the highest-level, long-term results. For example: Foster a knowledgeable workforce.
To summarize: Operational activities need to support strategic objectives, which need to support outcomes.
31. This finding is also important because performance reporting supports effective management and accountability. It is particularly important in the context of the public-private partnership (P3) approach promoted by the Corporation for infrastructure projects. Performance reporting supports decision making.
32. Our analysis supporting this finding discusses
33. Strategic planning is essential for setting long- and short-term objectives, and for identifying indicators of the results achieved. This is especially important in the case of PPP Canada since the Corporation was created relatively recently, and its roles and responsibilities in relation to stakeholders are still evolving.
34. The Corporation’s corporate risk profile identifies strategic areas that deserve management attention over the short and medium term, and also sets out the broad elements of an action plan for addressing them. Strategic and operational planning and reporting are based on the corporate risks and associated mitigation strategies. Risk management is key to the organization’s success.
35. Measuring and reporting on the Corporation’s performance helps to demonstrate the extent to which the expected results of the Corporation have been achieved. A sound performance measurement and reporting system would support decision making, transparency, and accountability in the use of public funding. It would also assist in determining how well the Corporation is doing in achieving its outcomes.
36. Our recommendation in this area of examination appears at paragraph 38.
37. Strategic planning, risk management, and performance measurement and reporting. We found that the Corporation’s strategic objectives were not clearly reported and reporting did not fully demonstrate how the Corporation’s activities contributed toward achieving key outcomes. Nevertheless, the Corporation had in place systems and practices that guided its operational activities. We also found that key elements for risk management were in place (Exhibit 3).
Exhibit 3—Strategic planning, risk management, and performance measurement and reporting—strengths and weaknesses
| Elements | Findings |
|---|---|
|
Strategic and operational planning |
Strengths The corporate plan set out the Corporation’s mandate. The Corporation analyzed the internal and external environment. The Corporation communicated its operational direction to employees and stakeholders. From December 2014, the Corporation began reporting to the Board on implementation of the corporate plan. The business unit plans were consistent with the business priorities and were sufficiently detailed to guide management actions. The plans were communicated throughout the Corporation. An accountability process was in place to monitor implementation of the business unit plans. The business unit plans had priorities against which to manage performance. Weakness Strategic objectives were not completely and consistently stated in key corporate documents. |
|
Risk management |
Strengths The Corporate Risk Profile identified the key corporate risks and the related mitigation measures. The Profile prioritized risks and assessed them according to their potential impact and likelihood. The Board and management formally monitored project risks. |
|
Performance reporting |
Strengths The Corporation established outcomes. The annual report presented credible and balanced performance information related to activities. Weaknesses Even though PPP Canada’s reporting framework is in its early years, it did not demonstrate how the Corporation’s activities contributed to the overall achievement of its corporate outcomes. Further, the Corporation’s public documents made no reference to corporate outcomes. |
38. Recommendation. The Corporation should expand its performance reporting framework to demonstrate how its activities contribute to achieving strategic objectives and corporate outcomes.
The Corporation’s response. Agreed. The Corporation’s performance reporting framework is founded on clearly defined strategic objectives. They are
- increased investment in public infrastructure Canadians need;
- increased value and reduced reliance on taxes through the effective use of public-private partnerships (P3s);
- demonstrating success in inexperienced jurisdictions, different sectors and new models; and
- increased knowledge development and sharing of best practices and market intelligence.
In the future, the Corporation will improve performance reporting to consistently and completely report results against strategic objectives in all publicly available reports.
Human resource management
Human resource management supported the Corporation’s needs
39. Overall, we found that the Corporation had the systems and practices for managing human resources in a manner that provided it with the human resource capacity for achieving corporate objectives.
40. This is important because an effective human resource framework aligns planning, training and development, compensation, performance management, and health and safety with long-term direction. The Corporation’s success in achieving its mandate depends largely on having the right people with the right specialized competencies required to deliver high-quality public-private partnership projects.
41. Our analysis supporting this finding discusses
42. The Corporation needs strategies for attracting, developing, and retaining talented and highly educated employees with specific expertise, mainly in procurement. PPP Canada is a small organization with approximately 50 full-time equivalent employees. It therefore also relies on having succession planning in place for senior management to avoid the loss of corporate memory.
43. We made no recommendation in this area of examination.
44. Human resource management. We found that the Corporation’s human resource management supported its needs (Exhibit 4).
Exhibit 4—Human resource management—strengths and weaknesses
| Elements | Findings |
|---|---|
|
Planning |
Strengths The Corporation’s Human Resources Strategy identified human resource objectives and specified actions to be taken—for example, focusing on continuous learning; attracting and retaining high-performing employees; and managing performance and developing leadership. The strategy included mechanisms for monitoring implementation. The three business unit plans identified human resource needs. The Corporation had staffing procedures in place to meet its needs. The Corporation developed a succession plan for senior management positions. |
|
Competencies and compensation |
Strengths The Corporation had a performance management policy and program in place for employees and executives. The Corporation’s compensation policy for employees and executives supported its strategic direction. The performance compensation for senior management was properly documented and in alignment with results achieved (performance ratings). Employees took both internal and external training courses. |
Project selection and management
The Corporation had sound processes in place for selecting and managing projects, but there was potential for further improvements in project reporting
45. Overall, we found that the Corporation had systems and practices in place for approving project applications, establishing contracts, disbursing funds, and monitoring approved projects. However, there were opportunities to further strengthen reporting on approved projects.
46. This is important because formal monitoring of a project’s status and documentation helps to ensure that risks related to the project’s success are identified and mitigated in a timely manner.
47. Our analysis supporting this finding discusses
48. The P3 Canada Fund is a merit-based program, which annually issues calls for funding applications. The Corporation’s management assesses the applications it receives based on eligibility and merit criteria. Management then reviews each qualifying applicant’s business case to assess the public benefit, procurement structure, value for money, project risks, and readiness of the project. Based on this assessment, management makes funding recommendations to the Board.
49. Since the inception of the Fund, five rounds of applications have been completed. Of the 296 applications received, the Corporation invested in a national portfolio of 24 public-private partnership (P3) projects, fully committing the initial $1.2 billion in the Fund. Originally, the focus was on provincial projects, which were mostly hospitals and schools. In recent years, municipal participation in P3 projects has increased. The result has been a demand for a wider range of assets, including wastewater treatment facilities, public transit infrastructure, and solid waste management.
50. Our recommendation in this area of examination appears at paragraph 52.
51. Project selection and management. We found that the Corporation had systems and practices in place for reviewing and approving applications, establishing contracts, disbursing funds, and monitoring approved projects. However, there were weaknesses in the area of reporting on approved projects (Exhibit 5).
Exhibit 5—Project selection and management—strengths and weaknesses
| Elements | Findings |
|---|---|
|
Approval process |
Strengths The Corporation had clear policies and procedures for screening, selection, and approval. It updated documents regularly, and made them readily available to internal staff and external stakeholders. PPP Canada implemented a two-stage screening process, assessing applications first for eligibility and then by merit. The selection process was objective and consensus-based. Applicants that were selected were required to complete a P3 business case. Each business case underwent a comprehensive assessment, considering the public benefit, procurement structure, value for money, project risks, and readiness. The Investment Committee reviewed each comprehensive assessment and decided by consensus whether to recommend a project to the Board. The Board recommended projects to the Minister of Finance for approval. The Corporation was proactive in obtaining independent assessments of its processes at all stages of the project life cycle to identify areas for improvement and take the appropriate action. The Corporation had implemented an annual conflict-of-interest attestation by employees. A good practice would be to supplement this conflict-of-interest process with individual employee assessment and disclosure of conflicts of interest for each P3 project assessed and/or funded by the Corporation. |
|
Establishment of contracts |
Strengths For successful applicants, the Corporation provided a term sheet that listed conditions to be met before signing of the financial agreement. Before negotiating and executing the financial agreement, the Corporation performed due diligence, including re-evaluation of value for money, to verify that the conditions specified in the term sheet were fulfilled or were included in the agreement terms. A third party reviewed each project’s procurement and contracting process for transparency and fairness. Financial agreements included standard clauses to address common risks and conditions, such as environmental assessments, procurement and contracting policies, and the right to audit. |
|
Disbursements |
Strengths Payments were made for eligible costs on substantial completion of each project and on presentation of supporting documentation. Management reviewed payment claims for eligibility of items claimed and compliance with the financial agreement terms. Delegations of signing authority were clear and documented. A third party performed a final compliance audit within a year of final payment. |
|
Monitoring |
Strengths A project management committee monitored the implementation of the P3 agreement, as well as the progress of each project. The Investment Committee reported regularly to the Board and provided updates on each project. Management started reporting to the Board on project risks in September 2014, providing an overview of the current status and risk rating of each project. Weaknesses Reporting to the Investment Committee did not consistently document whether previously identified issues had been resolved, what follow-up action had been required, and what was the status of follow-up activities. The reports did not consistently provide information on each project’s previous status, including changes in project risks from previous reporting periods. |
52. Recommendation. The Corporation should ensure that project status monitoring and follow-up activities are formally and consistently documented and reported to the Investment Committee.
The Corporation’s response. Agreed. The Corporation has established formal systems and processes to ensure that project status monitoring is regularly and consistently documented and reported. In the future, the Corporation will improve documentation on reporting follow-up actions to the Investment Committee.
Stakeholder relations and outreach
The Corporation promoted stakeholders’ awareness and capacity for public-private partnerships, but there were weaknesses in outreach planning, measurement of effectiveness, and reporting
53. Overall, we found that the Corporation had systems and practices in place for regularly engaging and communicating with stakeholders, with the purpose of increasing awareness of the use of public-private partnerships (P3s) and building stakeholder capacity to work within a P3 project model. Further, in instances where the Corporation provided advisory services for projects undertaken by federal clients, we found that systems and practices were in place for defining and overseeing those projects. However, there were some weaknesses:
- lack of a complete and implemented corporate-wide communications and outreach strategy,
- lack of a more regular and consistent approach to measuring the effectiveness of knowledge products, and
- limited project management mechanisms to permit more formal and sound reporting to federal clients on the status of projects.
54. This is important because a corporate communications and outreach strategy is a critical mechanism for management. Such a strategy facilitates strategic targeting of stakeholder groups, including segments within each stakeholder group. It helps management develop appropriate messaging, communications, and knowledge products. It also helps management prioritize outreach activities for each target group.
55. Formal performance measures and supporting processes help the Corporation to regularly assess the effectiveness of the knowledge products it distributes. This includes outcomes-based measures to assess the effectiveness of the knowledge products, and to guide decisions about their development and use.
56. In the Corporation’s advisory role for federal clients, project reporting processes are intended to facilitate the assessment and monitoring of project risks, milestones, and outcomes against what was planned. The processes are meant to enable the Corporation to report to federal clients, managing their expectations and demonstrating accountability.
57. Our analysis supporting this finding discusses
58. The Corporation’s stakeholders are federal, provincial, territorial, municipal, and First Nations levels of government, as well as the private sector. One of the Corporation’s goals is to serve as a source of expertise and advice for stakeholders on public-private partnership matters. Its stakeholder engagement and outreach activities increase awareness of the value and benefits of P3s, and also increase the capacity of new entrants to the market.
59. In addition, the Corporation plays an advisory role for federal clients. For example, federal departments and agencies may hire PPP Canada to assist with the determination and planning of a potential P3 project.
60. The Corporation plays a role in screening applicants for the New Building Canada Fund, administered by Infrastructure Canada. If estimated costs are in excess of $100 million, PPP Canada screens the project for P3 suitability.
61. Our recommendation in this area of examination appears at paragraph 63.
62. Stakeholder relations and outreach. We found that the Corporation engaged with stakeholders, but some improvements were needed in outreach planning, measuring the effectiveness of products, and formalizing project status reporting with federal clients (Exhibit 6).
Exhibit 6—Stakeholder relations and outreach—strengths and weaknesses
| Elements | Findings |
|---|---|
|
Awareness and capacity building |
Strengths At a yearly planning session, stakeholder needs were identified on the basis of the Corporation’s experience and the results of interactions and communications with PPP Canada’s management and staff. The Corporation partnered with other agencies and organizations to promote awareness of P3s through publications, teaching modules, and other products. To evaluate stakeholder satisfaction with outreach event activities, the Corporation conducted feedback surveys. The Corporation targeted stakeholders with less experience and designed knowledge products to meet their needs. Knowledge products included case studies, sector studies, tools, and guidelines. Processes were in place for developing, reviewing, approving, and distributing the products. The Corporation developed and regularly updated guidelines to support stakeholders throughout the application and project life cycle. The Corporation tracked visits to its website and reviewed the percentage of recipients who opened emails sent by PPP Canada. Weaknesses The Corporation did not have in place a corporate-wide communications and outreach strategy. A public relations and outreach strategy for the 2015–16 fiscal year was in the draft stage during our audit. The Corporation had no process for regularly measuring the effectiveness, utilization, or impact of knowledge products after they had been distributed. |
|
Federal advisory projects |
Strengths Federal advisory projects were clearly defined and managed at appropriate levels. The Corporation effectively engaged the federal government through a number of channels, and it delivered guidance and information targeting this stakeholder group. For example, it held awareness presentations, provided guidance material, and posted information on its website. The Corporation’s responsibilities in support of the federal government’s New Building Canada Fund were clear, and the Corporation met stakeholder expectations. The Corporation had formal processes that provided senior management and the Board with information to support effective oversight of federal advisory projects. Weaknesses The Corporation had limited project monitoring mechanisms and did not have clearly defined project status reporting requirements in its memoranda of understanding, resulting in limited formal and consistent reporting of project status and results to federal clients. |
63. Recommendation. The Corporation should
- complete the development and implementation of a corporate-wide communications and outreach strategy,
- define performance measures to gauge the utilization and impact of the knowledge products it has developed, and
- report more formally and consistently to federal clients on the status of projects.
The Corporation’s response. Agreed.
- The Corporation has developed a public relations and outreach strategy, currently in draft form. The Corporation will complete and implement its Public Relations and Outreach Strategy.
- In 2010, the Corporation developed a robust performance measurement system that is aligned to federal government best practices for Enterprise Performance Measurement in order to facilitate a consistent approach to systematically collecting, analyzing, utilizing, and reporting on the performance of the Corporation’s programs and activities.
The Corporation will update its existing Enterprise Performance Measurement System to include defined performance measures to gauge the utilization and impact of knowledge products.
- In the future, the Corporation will introduce improved formal reporting to federal clients after significant milestones.
Safeguarding of information
Key elements of information security practices were in place, with some weaknesses in policy, external assessments, disaster recovery planning, and monitoring of service providers
64. Overall, we found that the Corporation had systems and practices in place to safeguard the security of its information technology applications protecting client data. However, some weaknesses were identified in the areas of policy, external assessments, disaster recovery planning, and monitoring of service providers.
65. This is important because the Corporation receives and retains information from applicants and funding recipients (clients), including information of a confidential nature. The Corporation has a responsibility to ensure that its information is protected.
66. Our analysis supporting this finding discusses
67. The Corporation uses both an internal system and an externally hosted system for storing and processing client and project information.
68. The Corporation has a memorandum of understanding with the Canadian Commercial Corporation for its internal network and applications. It also has a contract with a private-sector service provider for information processed and stored in an external system.
69. Our recommendation in this area of examination appears at paragraph 71.
70. Safeguarding of information. The Corporation had systems and practices in place to safeguard the security of its information technology applications protecting client data, but there were opportunities for improvement in some areas (Exhibit 7).
Exhibit 7—Safeguarding of information—strengths and weaknesses
| Elements | Findings |
|---|---|
|
Security and availability |
Strengths The Corporation had controls in place to safeguard its access to its information technology systems. These included
Weaknesses The Corporation’s security policies did not include an overall information technology security policy statement setting out the importance of security to the organization. Also missing was a formally defined password standard. Passwords were in place but were inconsistent across applications. The Corporation had defined but not yet implemented remedial actions in response to the recommendations from external security assessments that were performed in 2014. The Corporation did not have a documented and tailored disaster recovery plan. While PPP Canada would be covered by the plan of the Canadian Commercial Corporation, this is not specifically stated in PPP Canada’s agreement with that body. |
|
Service providers |
Strengths A memorandum of understanding with the Canadian Commercial Corporation defined the services to be provided; service levels, roles, and responsibilities; and timely monitoring procedures to assess supplier performance. For the private-sector service provider, a contract was in place that included some sound governance elements. PPP Canada annually obtained an independent report on controls, prepared by an external firm. Weaknesses The Corporation received reports on the effectiveness of controls in place at its private-sector service provider as of a specific date, but had not historically requested reports covering the effectiveness of these controls throughout the year, nor information on controls at the sub-service provider hosting the infrastructure. However, these weaknesses affected only one project, which ultimately did not receive funding. The Corporation intended to make greater use of the service provider’s system in future. The Corporation did not formally document its review of control reports or its assessment of the controls for which it remained responsible. |
71. Recommendation. The Corporation should
- define its objectives for information technology security in its security policies, as well as its password standards, and the related roles and responsibilities of employees and contractors, and should regularly monitor and resolve issues identified in external security assessments;
- ensure that it is covered by a disaster recovery plan; and
- improve its monitoring of its private-sector service provider by obtaining, documenting its review of, and following up on results from yearly reports on the effectiveness of controls at the service provider.
The Corporation’s response. Agreed.
- In 2014, the Corporation conducted an internal threat and risk assessment and external vulnerability assessment, which identified these and other opportunities for improvement. The Corporation is in the process of implementing an action plan to respond to recommendations made in the reports.
- The Corporation has confirmed that it is covered under the Canadian Commercial Corporation’s disaster recovery plan through its memorandum of understanding with that body. In the future, the Corporation will develop its own disaster recovery plan and have the Canadian Commercial Corporation take responsibility for implementing the plan through the memorandum of understanding.
- The Corporation will institute a process to improve monitoring of its private-sector service provider on an annual basis. This will involve reviewing the audit reports of the service provider for deviations, reviewing internal user control considerations, and requesting additional reports.
Investment management
The Corporation had an investment policy in place, but it was missing elements such as objectives, risk identification, and reinvestment guidelines
72. Overall, we found that the Corporation had the systems and practices required for sound management of public-private partnership (P3) funding received in advance of disbursements. However, the investment policy was missing some key elements, such as investment objectives, a reference to concentration risk, and guidelines for reinvesting interest.
73. This is important because the Corporation receives funding from Parliament for the P3 Canada Fund in advance of the dates on which it must make disbursements. As of 31 March 2015, the Fund had a balance of $1.4 billion that had not yet been disbursed for P3 projects. The balance is currently growing and clear investment guidelines would help in managing the funds.
74. Our analysis supporting this finding discusses
75. PPP Canada manages the P3 Canada Fund, which provides funding to eligible infrastructure projects procured by other levels of government through public-private partnerships. The Fund had a balance of $1.2 billion as of 31 March 2014. In fall 2014, the federal government allocated a further $1.2 billion to the P3 Canada Fund to develop additional projects over the next five years.
76. Our recommendation in this area of examination appears at paragraph 78.
77. Investment management. The Corporation had an investment policy in place but it was missing key elements, such as investment objectives, a reference to concentration risk, and guidelines for reinvesting interest (Exhibit 8).
Exhibit 8—Investment management—strengths and weaknesses
| Elements | Findings |
|---|---|
|
Investment policy |
Strengths The Corporation developed and implemented a Treasury Risk Management Policy and Investment Strategy (the investment policy). The Corporation had processes for monitoring and reporting on its investment policy. The investment policy identified some financial risks, such as credit risk, liquidity risk, and market risk. The Corporation regularly reviewed the investment policy and updated it as needed. The Corporation’s investment strategies complied with the conditions established by the Treasury Board of Canada. Weaknesses The investment policy did not include certain key elements, although they were mentioned in other documents of the Corporation:
|
78. Recommendation. The Corporation should update its investment policy in order to include the investment objectives, a reference to concentration risk, and guidelines for reinvesting interest.
The Corporation’s response. Agreed. The Corporation will update its investment policy in order to improve documentation, as recommended.
Conclusion
79. We concluded that, based on the criteria established, there is reasonable assurance that during the period covered by the examination there were no significant deficiencies in PPP Canada Inc.’s systems and practices that we selected for examination. The Corporation has maintained these systems and practices in a manner that provides it with reasonable assurance that its assets are safeguarded and controlled, its resources are managed economically and efficiently, and its operations are carried out effectively.
About the Audit
All of the audit work in this report was conducted in accordance with the standards for assurance engagements set out by the Chartered Professional Accountants of Canada (CPA) in the CPA Canada Handbook—Assurance. While the Office adopts these standards as the minimum requirement for our audits, we also draw upon the standards and practices of other disciplines.
As part of our regular audit process, we obtained management’s confirmation that the findings in this report are factually based.
Objective
Under section 138 of the Financial Administration Act (FAA), federal Crown corporations are subject to a special examination once every 10 years. Special examinations of Crown corporations are a form of performance audit where the scope is set by the FAA.
The auditors provide an opinion on the corporation’s systems and practices examined. Special examinations answer the question: Do the Corporation’s systems and practices provide reasonable assurance that assets are safeguarded and controlled, resources are managed economically and efficiently, and operations are carried out effectively?
A significant deficiency is reported when there is a major weakness in the Corporation’s key systems and practices that could prevent it from having reasonable assurance that its assets are safeguarded and controlled, its resources are managed economically and efficiently, and its operations are carried out effectively.
Scope and approach
The scope of our audit was PPP Canada Inc., a federal Crown corporation. In performing our work, we reviewed documents and interviewed members of the Board of Directors, senior management, employees of the Corporation, and stakeholders. Using our judgment, we selected a sample of 10 funded public-private partnership (P3) projects at different stages of completion to perform our review related to project selection and management. The audit work did not include projects related to the new Public Transit Fund, announced in the 2015 federal budget.
Systems and practices examined and criteria
At the start of this special examination, we presented the Corporation’s audit committee with an audit plan that identified the systems and practices, and related criteria, that we considered essential to providing the Corporation with reasonable assurance that its assets are safeguarded and controlled, its resources managed economically and efficiently, and its operations carried out effectively. These are the systems and practices and criteria that we used for our special examination.
These criteria were selected for this examination in consultation with the Corporation. They were based on our experience with performance auditing—in particular, with our special examinations of Crown corporations—and on our knowledge of the subject matter. Management reviewed and accepted the suitability of the criteria used in the special examination.
| Systems and practices examined | Criteria |
|---|---|
|
Corporate governance
|
To maximize the Corporation’s effectiveness, the Corporation should have a well-performing corporate governance framework that meets the expectations of best practices in Board stewardship, shareholder relations, and communication with the public. |
|
Strategic planning, risk management, and performance measurement and reporting
|
The Corporation has clearly defined strategic direction, and specific and measurable goals and objectives, to achieve its legislative and public policy mandate. Its strategic direction and goals take into account government priorities, identified risks, and the need to control and protect the Corporation’s assets and manage its resources economically and efficiently. The Corporation has identified performance indicators to measure the achievement of its mandate and statutory objectives. It also has reports that provide complete, timely, and balanced information for decision making and accountability reporting. |
|
Human resource management
|
Human resources are managed in a manner that provides the Corporation with the human resource capacity and the work environment it needs to achieve its goals and objectives. |
|
Project selection and management
|
The Corporation has plans, systems, and practices for reviewing and approving applications for funding, as well as for disbursing funding and monitoring approved projects to support the achievement of its mandate. |
|
Stakeholder relations and outreach
|
The Corporation has plans, systems, and processes to identify, analyze, and respond to stakeholder needs in an effective and efficient manner, and to support its mandate through the development and communication of leading practices in public-private partnerships, for the purpose of increasing awareness and building capacity among its stakeholders. |
|
Safeguarding of information
|
The Corporation has information systems that are available and usable when required, and are designed appropriately to resist attacks and recover from failures. The IM/IT activities provide high-quality customer service while ensuring the efficiency and effectiveness of processes and operations. |
|
Investment management
|
The Corporation has treasury and investment strategies, policies, systems, and practices in place that comply with legal provisions and investment policies, and that support sound investment decisions. |
Period covered by the audit
The special examination covered the systems and practices that were in place between August 2014 and May 2015. However, to gain a more complete understanding of the significant systems and practices, we also examined certain matters that preceded the starting date of the special examination.
Internal audit
In carrying out the special examination, we did not rely on any internal audits.
Audit team
Office of the Auditor General of Canada
Assistant Auditor General: Marian McMahon
Principal: Marise Bédard
Director: Patrick Polan
KPMG
Partner: Nancy Chase
Senior Manager: Jules Beaudet
Senior Manager: Cindy McCarthy
Manager: Karen Croteau
List of Recommendations
The following is a list of recommendations found in this report. The number in front of the recommendation indicates the paragraph where it appears in the report. The numbers in parentheses indicate the paragraphs where the topic is discussed.
Corporate governance
| Recommendation | Response |
|---|---|
|
28. The Corporation should
|
The Corporation’s response. Agreed.
|
Strategic planning, risk management, and performance measurement and reporting
| Recommendation | Response |
|---|---|
|
38. The Corporation should expand its performance reporting framework to demonstrate how its activities contribute to achieving strategic objectives and corporate outcomes. (29–37) |
The Corporation’s response. Agreed. The Corporation’s performance reporting framework is founded on clearly defined strategic objectives. They are
In the future, the Corporation will improve performance reporting to consistently and completely report results against strategic objectives in all publicly available reports. |
Project selection and management
| Recommendation | Response |
|---|---|
|
52. The Corporation should ensure that project status monitoring and follow-up activities are formally and consistently documented and reported to the Investment Committee. (45–51) |
The Corporation’s response. Agreed. The Corporation has established formal systems and processes to ensure that project status monitoring is regularly and consistently documented and reported. In the future, the Corporation will improve documentation on reporting follow-up actions to the Investment Committee. |
Stakeholder relations and outreach
| Recommendation | Response |
|---|---|
|
63. The Corporation should
|
The Corporation’s response. Agreed.
|
Safeguarding of information
| Recommendation | Response |
|---|---|
|
71. The Corporation should
|
The Corporation’s response. Agreed.
|
Investment management
| Recommendation | Response |
|---|---|
|
78. The Corporation should update its investment policy in order to include the investment objectives, a reference to concentration risk, and guidelines for reinvesting interest. (72–77) |
The Corporation’s response. Agreed. The Corporation will update its investment policy in order to improve documentation, as recommended. |
PDF Versions
To access the Portable Document Format (PDF) version you must have a PDF reader installed. If you do not already have such a reader, there are numerous PDF readers available for free download or for purchase on the Internet: