Introduction

Background

1. The defence of Canada involves military and non-military efforts that require extensive construction and engineering. For example, armouries, shipyards, hangars, and barracks must be built and upgraded to reflect changing requirements. Such projects often have unique requirements, especially for security, which in turn require a specific set of highly trained and qualified people.

2. The mandate of Defence Construction (1951) Limited (the Corporation) is to provide procurement, construction, professional, operational, and maintenance services in support of the defence of Canada. The main beneficiary of these services is the Department of National Defence, but the Corporation also provides services to the Canadian Forces Housing Agency, the Communications Security Establishment Canada, Shared Services Canada, and Public Services and Procurement Canada. The services are generally defined in yearly memorandums of understanding.

3. Essentially, the Corporation is a procurement and contract-management agency that serves as an intermediary between its government clients and the consultants and contractors hired to perform the actual project work. This arrangement allows the Corporation to work at arm’s length from the government while managing the procurement process, from awarding tenders to managing contracts at job sites.

4. Also commonly known as Defence Construction Canada, the Corporation was created in 1951. As a federal Crown corporation, it is accountable to Parliament through the Minister of Public Services and Procurement.

5. To conduct its operations, the Corporation does not receive funding directly from the government. Instead, since 2001, the Corporation has drawn its revenues from fees it charges to its government clients. These fees are for services such as project and contract management, life-cycle management of real property, and helping projects meet environmental targets.

6. Demand for the Corporation’s services varies considerably over time, because defence requirements are subject to external factors, such as government decisions and changing service-level requirements from government clients. Moreover, the types of services needed can change throughout the life cycle of a project, which can be accelerated or delayed—for example, by the need for additional consultations or because of conditions required by an environmental assessment.

7. The Corporation continually adjusts the size of its workforce in response to the demand for infrastructure services (Exhibit 1). Demand is expected to increase in the coming fiscal years, to support the increase in work volume forecast as a result of the Federal Infrastructure Investments Program and the additional funding announced by the government in Budget 2016.

Focus of the audit

8. Our objective for this audit was to determine whether the systems and practices we selected for examination at Defence Construction (1951) Limited were providing it with reasonable assurance that its assets were safeguarded and controlled, its resources were managed economically and efficiently, and its operations were carried out effectively, as required by section 138 of the Financial Administration Act.

9. On the basis of our assessment of risks, we selected systems and practices in the following areas:

• corporate management practices, and
• management of contracts and services.

The selected systems and practices and the criteria used to assess them are found in the exhibits throughout the report.

10. This audit is important because the Corporation’s activities are integral to the ability of National Defence to deliver its own mandate. The total value of the services that the Corporation provided in the 2015–16 fiscal year was $84.9 million. Furthermore, according to the Corporation, these services also involved awarding 2,440 contracts to contractors, consultants, and suppliers.

11. More details about the audit objective, scope, approach, and sources of criteria are in About the Audit at the end of this report.

Findings, Recommendations, and Responses

Corporate management practices

The Corporation had good corporate management practices in place, but some improvements were needed

Overall message

Fraud—An intentional act by one or more individuals among employees, management, those charged with governance, or third parties involving the use of deception to obtain an unjust or illegal advantage.

12. Overall, we found that Defence Construction (1951) Limited (the Corporation) did a good job of managing its corporate governance, strategic planning, risk management, and performance measurement and reporting. However, as a subset of risk management, we found that the Corporation did not consider all aspects related to fraud risks, such as the inability to deal with potential allegations of fraud, corruption, and collusion. The Corporation’s fraud-related systems and practices were limited—which in turn limited the ability of management and the Board to manage the fraud risks strategically. The Corporation needs to address fraud-related risks more proactively.

13. This finding matters because well-designed corporate management practices provide a sound basis for decisions on allocating human and financial resources, especially when the demand for services changes (Exhibit 1). They also promote transparency and accountability, instilling confidence in the Corporation’s ability to manage federal resources responsibly. Analyzing fraud risks at the operational and strategic levels is a prerequisite to addressing fraud risks across the Corporation.

14. Our analysis supporting this finding discusses the following topics:

• corporate governance, and
• strategic planning, risk management, and performance measurement and reporting.

15. The Corporation has a Board of Directors composed of seven members. The Board has formed an Audit Committee and a Governance and Human Resources Committee.

16. Strategic planning and risk management are essential for the Corporation in setting its short- and long-term objectives, and for allocating resources to achieve them. The Corporation is facing strategic challenges, with the planned increase in service revenues, and is planning to build its capacity, in order to meet demand. According to the Corporation’s corporate plan, the Department of National Defence (DND) expects an increase in capital program expenditures of approximately 28 percent from the 2014–15 to 2018–19 fiscal years.

17. Corporate strategic planning also includes assessing and adjusting the Corporation’s direction in response to the risks and challenges in its changing environment. Because the Corporation operates in an industry known for incidents of fraud, risk management that explicitly addresses fraud is critical to its service delivery. It is also vital that the Corporation mitigate high-priority risks in its allocation of resources. Performance reporting enables the Corporation to demonstrate the extent to which it delivers its services.

18. Our recommendation in this area of examination appears at paragraph 27.

19. Corporate governance. We found that the Corporation had in place the elements of good governance (Exhibit 2).

20. Strategic planning, risk management, and performance measurement and reporting. We found that the Corporation had sound systems and practices in strategic planning, risk management, and performance measurement and reporting. However, we noted that the corporate risk register did not take into consideration all aspects of fraud risks, such as the risk that the systems and practices would not prevent or detect fraud. The only fraud-related consideration in the Corporation’s risk register was the inability to deal with potential allegations of fraud, corruption, and collusion (Exhibit 3).

21. Weakness—Risk identification and assessment. The Corporation’s risk register identified and assessed its key corporate and operational business risks. However, the only risk related to fraud, corruption, and collusion (as it applied to employees and contracts) identified in the register was that the Corporation would not appropriately deal with such allegations if they were to arise. The register did not include a risk related to detecting or preventing fraud, collusion, or corruption. This in turn limited the information that senior management and the Board had about fraud, to inform their risk management and decision making.

22. The Corporation had systems and practices for the management of contracts and services (paragraphs 28 to 52). However, the Corporation had rudimentary fraud-detection systems, which were manual and implemented regionally. Management was therefore unable to use the systems to detect and analyze broader trends that might reveal fraud (such as bid-rigging) that could be spread out over time, across regions, or among many suppliers. This kind of fraud, collusion, or corruption could take place even among contracts that, individually, appeared to have been awarded properly. Being able to perform such analysis would allow the Corporation to bring the management of fraud risks to a more strategic level.

23. Moreover, the Corporation did not consistently store contract information in its content-management system (paragraphs 38 to 42). This limited the information that senior management provided to the Board. It also hindered the Corporation’s ability to analyze trends.

24. The Corporation delivered training on fraud to employees, but not systematically. Furthermore, because the Corporation was unable to consistently track the training that its employees received (as discussed in paragraphs 48 to 51), it could not be sure whether that training had been delivered to the right employees. Fraud prevention and detection therefore depended on employees’ individual skills and diligence.

25. Officials told us that the Corporation was putting in place an electronic bidding system that would provide the information management needed to detect trends that could show evidence of possible fraud, collusion, or corruption. Even without such a system, however, it is our view that the Corporation could take some interim measures to improve its fraud detection, such as systematic training of project officers or improving manual tracking of the information. Addressing weaknesses in the Corporation’s storage of contracting documents would also help staff identify contracting irregularities.

26. This weakness matters because no organization that safeguards public resources is immune to fraud risks. If undetected, fraud can divert public funds to unrelated private interests or allow competitions to favour suppliers who provide less value for money. Moreover, a lack of measures to monitor and mitigate fraud systematically can undermine public trust. This is especially true for an organization whose core business is the awarding of contracts, where there is a corresponding risk of contract irregularities.

27. Recommendation. The Corporation should better define fraud risks in its corporate risk register, ensuring that it covers all relevant aspects of these risks, and should put in place the systems and processes needed to assess, monitor, and address them.

The Corporation’s response. Agreed. Defence Construction (1951) Limited takes the risk of fraud very seriously and is further developing its systems and processes, including analysis and training, to allow it to better detect and prevent fraud activities. The Corporation has updated its corporate risk register, reviewed with the Board of Directors on a quarterly basis, to ensure that it covers all relevant aspects of the risk of fraud. Commencing with the 2017–18 fiscal year, the Corporation will improve responses to this risk through enhanced data analysis, allowing the management of fraud to be elevated to a more strategic level, up to the Board.

Management of contracts and services

The Corporation had good management practices in place for its operations, but some improvements were needed

Overall message

28. Overall, we found that the Corporation did a good job of managing contracts and delivering its services. For example, the contracts were carried out according to industry standards and clients’ requirements, and client deadlines and budgets were met. However, we found that they did not manage or store required information in an organized manner, which resulted in incomplete files. Also, despite having an internal verification process, the Corporation did not perform the verification for 2014–15. Furthermore, the Corporation could not know if all of its processes were being applied as intended, and the tracking of employee training was not consistent.

29. These findings matter because good information management is vital to the Corporation’s monitoring to ensure that all processes and procedures have been applied as required. This in turn supports the Corporation’s continuous effort to provide value for its clients, the government, and ultimately the public. The Corporation relies on the expertise of its employees to deliver its services.

30. Our analysis supporting this finding discusses the following topic:

• management of contracts and services.

31. The Corporation provides contracting, construction contract management, infrastructure and environmental services, and life-cycle support for Canada’s defence requirements.

32. When a client decides to initiate a project, it contacts the Corporation to procure and manage the associated project contracts on its behalf. Corporation employees manage the procurement process, from awarding tenders to managing the contracts at the job site. Private-sector contractors and consultants perform the actual work in the execution of the contracts that the Corporation puts in place.

33. The Corporation channels its resources into five service lines:

• Contract Services oversees the procurement of goods and professional, construction, and maintenance services, to fulfill defence infrastructure needs;
• Contract Management Services supports the ongoing work of services that it has already procured, including construction, renovation, and maintenance of facilities for the Department of National Defence’s (DND’s) infrastructure and environmental program;
• Environmental Services helps DND meet environmental performance targets, comply with regulatory requirements, and manage due diligence and risk;
• Project and Program Management Services provides support for matters such as building requirements, program planning, and schedule and document control; and
• Real Property Management Services assists DND in managing its real property assets efficiently throughout their life cycles.

34. The Corporation provides advice through only three of its service lines: Environmental Services, Project and Program Management Services, and Real Property Management Services. The Corporation helps the clients meet their own environmental performance targets, comply with regulatory requirements, and manage their due diligence and risks. As the Corporation operates through service-level agreements in these service lines, all responsibilities remain with that client, rather than the Corporation.

35. For services provided in Contract Services and Contract Management Services, the Corporation takes on these elements on behalf of the clients.

36. Our recommendations in this area of examination appear at paragraphs 43, 47, and 52.

37. Management of contracts and services. We found that the Corporation had in place systems and practices for sound management of contracts and services. However, we found weaknesses in its contract and service management process, internal service-line verification, and tracking of employee training (Exhibit 4).

38. Weakness—Contract and service management processes, including reporting. Throughout the organization, the Corporation did not store information consistently. We found that paper documents and scanned files were often kept within individual regions, making them difficult or slow to obtain elsewhere. Some electronic documents were not stored in Laserfiche, the enterprise content-management system used by the Corporation, but were stored on individual hard drives or email accounts. The availability of such a document might depend on the presence and memory of an individual.

39. Document formats were also inconsistent. While performing our sampling, we found that some key documents had not been digitized; some individual documents had been scanned as several files, while several key paper documents had been scanned as a single file. In one case, the paper file was not found.

40. These inconsistencies limited the Corporation’s ability to ensure completeness of information. The complexity of contracting documents exacerbated this situation. Different types of contracts require different sets of documents, such as environmental assessments, signed service-level agreements, or risk assessments. Because there was no tracking sheet to ensure that every required document had been completed, the Corporation relied on the knowledge of individuals. However, as the Corporation could not know what training the employees had received (as discussed in paragraphs 48 to 51), their knowledge might not reflect the most recent requirements. It should be noted that, through the annual performance assessment process, each supervisor reviewed with each employee their training requirements and resulting plans.

41. According to the government’s Contracting Policy, documents for a given contract must be stored such that they hold all the information required for someone to understand the history of the contract, and must be accessible to more than one person.

42. This weakness matters because without consistent information management and readily accessible documentation, the Corporation could not know whether it had all the documentation it needed. Even if the Corporation had stored all the documentation it required, searching for it would still be inefficient. Furthermore, proper access to key contracting documents by more than one person can reduce fraud risks.

43. Recommendation. The Corporation should ensure that the supporting documentation for each contract is classified efficiently and systematically in its filing software, to ensure that all required documents can be obtained, monitored, and verified as complete.

The Corporation’s response. Agreed. In the 2017–18 fiscal year, Defence Construction (1951) Limited will take the necessary steps to complete its transition to a new electronic document management system. As part of this, the Corporation plans to provide refresher training to all its personnel to ensure that they properly utilize this new system, in order to ensure that documents are classified efficiently and systematically. Thereafter, the Corporation will continue to monitor the use of the new system and take appropriate follow-up action, as required.

44. Weakness—Internal service-line verification process. The Corporation has established a practice of performing an internal review of two of its service lines—Contract Services and Contract Management Services—to provide management with assurance that activities are being carried out with due diligence and in accordance with the Corporation’s policies and procedures. The Corporation aims to perform these reviews each fiscal year, for the previous fiscal year.

45. The Corporation performed no internal verification for 2014–15 on Contract Services in the 2015–16 fiscal year. Corporation officials said that these internal verifications were postponed mainly because of the increase in program activities. Moreover, the Corporation had documented recommendations from previous years’ regional verifications, but follow-up actions on those recommendations were not clearly documented.

46. This weakness matters because the verifications provide the Corporation with the assurance that procurement activities are being carried out with due diligence and in accordance with its contracting policies and procedures and its Integrity Management Framework.

47. Recommendation. The Corporation should regularly perform its internal service-line verifications, and clearly document follow-up on the resulting recommendations, to ensure that procurement activities are being carried out in accordance with established practices.

The Corporation’s response. Agreed. Defence Construction (1951) Limited will perform an internal verification of the Contract Services service line in the 2016–17 fiscal year, including verification of data from the 2014–15 fiscal year. The Corporation will also review how it tracks and maintains records of completed verifications to better capture follow-up activities.

48. Weakness—Training and development. Corporation employees require a diverse set of skills to ensure that they are capable of carrying out their duties and are meeting regulatory requirements. Some of these requirements are general, as is the case for training on values and ethics. Some are specific to job types: Procurement officers have a particular set of training requirements that focus on contracting practices, while those who work on construction sites require regular training on health and safety.

49. The Corporation had identified the specific training that employees had to take; this was reviewed by each employee’s supervisor during the annual performance review process, establishing that employees were taking the required training.

50. The Corporation launched a new tracking and planning tool for training in the 2016–17 fiscal year. We planned to examine a sample of 22 employee files in the tool. We found that the tool did not consistently track the courses taken. For example, training that one individual took five years before was listed as having been taken in 2015–16, while data on more recent training was not available.

51. This weakness matters because the Corporation relies on the expertise of its employees to monitor contracts and deliver services in keeping with industry standards. The industry is in constant evolution, and specific issues that warrant close attention, such as fraud detection, require a proactive approach to preparing employees. It is therefore essential that the competencies of employees be kept current. It is also essential for the Corporation to know what training has been delivered, and where gaps in competencies exist, so that it can address them and demonstrate to its stakeholders and clients that it is meeting its training requirements.

52. Recommendation. The Corporation should ensure that its tracking and planning tool for training records employees’ training consistently and accurately.

The Corporation’s response. Agreed. Defence Construction (1951) Limited is in the process of transitioning to a new electronic training tracker, and this system is planned to be fully implemented by the end of the 2016–17 fiscal year.

Conclusion

53. In our opinion, based on the criteria established, there were no significant deficiencies in Defence Construction (1951) Limited’s systems and practices that we examined for corporate management and management of contracts and services. We concluded that the Corporation maintained these systems and practices during the period covered by the audit in a manner that provided the reasonable assurance required under section 138 of the Financial Administration Act.