Introduction

Background

4.1 Global Affairs Canada operates 175 diplomatic and consular missions in 110 countries. Security events, such as terrorist attacks in Europe, Africa, and Asia, as well as ongoing instability and armed conflict in the Middle East, mean that the security environment in which these missions operate is evolving and dynamic. Mission staff members abroad, as well as buildings and other assets, are exposed to a range of security threats, including politically motivated violence, general crime, civil disorder, and espionage (Exhibit 4.1). The level and type of threat can vary across missions and may shift suddenly and significantly.

4.2 In its operations abroad, Global Affairs Canada is responsible for the safety and security of its Canadian employees, their dependents, locally engaged staff members (while they are on duty), and visitors and invitees to Canadian missions. More than 7,800 staff members work at missions abroad. Most mission staff members are foreign nationals hired locally, and almost one quarter are Canadian. In November 2017, more than half of the Department’s staff members worked in locations where unpredictable political situations or civil unrest put their safety and security at risk, and where protective risk-reduction measures were therefore required.

4.3 Physical security measures, such as the placement of fences or gates around a mission, are meant to protect staff and assets by preventing or significantly delaying unauthorized access or attempts to cause harm. Operational security measures, such as guards, provide another layer of protection. Effective protection never depends on one safeguard alone. Information about potential threats that could affect the local staff, assets, and operations is assessed on an ongoing basis to determine whether any additional safeguards are needed. Global Affairs Canada may temporarily close a mission, or order Canadian staff to leave that location, if its evaluation of threat information indicates that the level of risk to staff and assets can no longer be tolerated.

4.4 The Department oversees more than 2,229 Crown-owned and leased properties in its missions around the world. The properties have a total estimated replacement value of over $3 billion. They are geographically distributed across regions, with 13% located in Sub-Saharan Africa; 26% in Asia-Pacific; 36% in Europe, the Middle East, and Maghreb; and 25% in the Americas.

4.5 Over the past decade, Global Affairs Canada received $652 million for initiatives to improve the safety and security of staff and assets at missions abroad. In October 2017, the federal government committed a further $1.8 billion in new funding over 10 years to bolster the security of Canada’s missions abroad. Potential projects would include infrastructure upgrades and enhanced protection and surveillance measures.

Focus of the audit

4.6 This audit focused on whether Global Affairs Canada met its physical security needs at missions abroad to protect its staff and assets.

4.7 This audit is important because missions are exposed to a range of security threats. The safety and security of those working in and visiting missions abroad depends on accurate and timely assessments of threats and risks, the physical and operational measures in place to mitigate risks, and the awareness and proper training of staff members.

4.8 We did not examine information security; operational security, such as pass control; information technology security; or the recruitment and training of specialized security personnel at missions.

4.9 More details about the audit objective, scope, approach, and criteria are in About the Audit at the end of this report.

Findings, Recommendations, and Responses

Overall message

4.10 Overall, Global Affairs Canada had not taken all measures needed to keep pace with evolving security threats at its missions abroad. The Department had identified security deficiencies that needed immediate attention at many of its missions. Many of these deficiencies were significant. Several had been identified years ago, yet not all of the recommended measures to address these security deficiencies were in place. These measures included improved video surveillance, alarms, and installation of vehicle barriers at entrances.

4.11 We found that most of the Department’s capital projects to upgrade security were at least three years behind schedule, usually because of weaknesses in the Department’s project management and oversight.

4.12 Because security assessments were missing or incomplete for many missions, Global Affairs Canada did not have the information it needed to prioritize investments on the basis of where they were most needed. Setbacks in resolving physical security vulnerabilities at Canadian missions delay the effective protection of staff members and assets abroad.

Adequacy of physical security at missions

4.13 To ensure the safety of staff members and visitors at Canada’s missions abroad, Global Affairs Canada has developed guidance on which physical security measures should be in place (Exhibit 4.2). These security measures should address the threat and risk environment in which each mission operates.

4.14 Global Affairs Canada uses threat and vulnerability assessments to determine whether the security at its missions is adequate:

• A threat assessment evaluates the potential risks to a mission according to its location and operating environment. For example, a threat assessment would consider the security threats posed by criminality or political instability.
• A vulnerability assessment evaluates a mission’s physical and operational security in relation to the overall risk and recommends measures to reduce the impact of such risk. For example, a vulnerability assessment may recommend the installation of bollards at a mission’s entrance to avert the risk of vehicle attacks.

The findings and recommendations from both of these assessments help determine the measures needed to reduce security threats to acceptable levels.

4.15 Federal policy requires departments to consider security when they plan, select, design, modify, build, implement, operate, and maintain facilities and equipment. Each Head of Mission has a duty of care for all staff members at a mission and is accountable for the day-to-day security operations. The Departmental Security Officer is responsible for developing and implementing security policies, procedures, and standards, and for ensuring that measures are in place to reduce vulnerabilities to acceptable levels.

Selected missions had significant physical security vulnerabilities

4.16 We found that many physical security protections were not fully operating as intended at missions abroad. We found significant security vulnerabilities at all six missions we examined. Several had been identified years ago by the Department, yet not all of the recommended measures to address these vulnerabilities were in place. Global Affairs Canada did not have a plan to ensure that the critical security measures recommended by its own vulnerability assessments would be implemented quickly at affected missions.

4.17 Our analysis supporting this finding presents what we examined and discusses the following topics:

• Addressing physical security vulnerabilities
• Tracking the implementation of security measures

4.18 This finding matters because physical security vulnerabilities must be resolved in a timely manner for the effective protection of staff and assets at missions abroad.

4.19 Our recommendation in this area of examination appears at paragraph 4.26.

4.20 What we examined. We reviewed the physical security measures in place at six missions in medium- and high-threat environments to determine if they were functioning as intended. We visited two of the six sites and relied on observations from Global Affairs Canada’s internal auditors for the other four.

4.21 Addressing physical security vulnerabilities. We examined physical security at six missions and observed several security deficiencies, ranging from minor to serious. We found that a number of upgrades to physical security were made at each mission over the past decade, such as measures to improve access control or blast protection. However, we found significant vulnerabilities in perimeter security at all sites, and not all of the security measures the Department had recommended to address these vulnerabilities had been implemented.

4.22 Many of the measures to reduce vulnerabilities in perimeter security had either not been implemented or were not functioning as intended. For example, we found that

• video surveillance was often inadequate;
• vehicle barriers at entrances, such as specialized bollards, had not always been installed as recommended; and
• some interior and exterior door alarms did not always operate properly.

We noted that operational security measures, such as increased guard patrols of the perimeter, were being used to help reduce vulnerabilities.

4.23 The physical security measures at each mission did not always match its threat level. For example, one mission in a high-threat environment had no X-ray machine for visitor screening, yet missions in lower-threat environments did. None of the six missions had a preventive maintenance schedule to ensure that security equipment continued to work properly.

4.24 Tracking the implementation of security measures. Many upgrades had been made to the physical security of all six missions selected in our sample. However, the security measures recommended for implementation at each of the six missions had not been tracked or prioritized for action. For example, at one mission, the perimeter was identified in 2011 as a critical vulnerability requiring very urgent attention. But during our site visit in 2018, we found that this issue had not yet been resolved, and not all recommended short-term security measures had been implemented.

4.25 Global Affairs Canada did not have a plan to ensure that the critical security measures recommended by its own vulnerability assessments would be implemented quickly. In particular, we found insufficient tracking of the security measures needed to resolve identified weaknesses. Security officials at some missions and headquarters were unclear about the status of many physical security projects, and about what measures were needed in the interim to mitigate identified security risks.

4.26 Recommendation. Global Affairs Canada should formally document the physical security measures needed at each of its missions abroad, including those needed in the short term, to ensure that security risks are mitigated appropriately and resolved quickly. Senior officials’ responsibility and accountability for ensuring that the mission’s physical security measures are appropriate to its threat environment should be clearly established.

The Department’s response. Agreed. Global Affairs Canada provides sound stewardship for its international security needs, as it is critical to the delivery of the Government of Canada’s programs abroad. In 2017, the Department secured $1.8 billion to invest over 10 years to improve the security of its missions to ensure that the government is fulfilling its duty-of-care obligation. The Department has recently used some of this funding to acquire and implement an enhanced Security Information Management System, which is being used to document and track security requirements by mission to ensure that they are effectively and efficiently addressed. Accountability for physical security measures is shared between the Departmental Security Officer and Assistant Deputy Minister, International Platform Branch. These shared roles and responsibilities will be further clarified and formally documented. The actions associated with this recommendation will be completed by December 2018.

Some security assessments were out of date, incomplete, or non-existent

4.27 We found that Global Affairs Canada did not have current and consistent assessments of its missions’ vulnerabilities to security threats. Until 2017, it did not have a central register to prioritize and track the implementation of security measures it had recommended for each mission.

4.28 Our analysis supporting this finding presents what we examined and discusses the following topics:

• Physical security standards
• Threat assessments
• Vulnerability assessments
• Priorities for recommended security measures

4.29 This finding matters because Global Affairs Canada needs quality assessments to understand its physical security risks and how to reduce them.

4.30 Our recommendation in this area of examination appears at paragraph 4.41.

4.31 What we examined. We examined whether Global Affairs Canada had up-to-date and adequate physical security standards, threat assessments, and vulnerability assessments. We examined a targeted sample of vulnerability assessments completed for 20 missions operating in low-, medium-, and high-threat environments.

4.32 Physical security standards. To ensure that risks to staff members and assets are mitigated to the greatest possible extent, baseline standards are needed to guide the design, deployment, and upgrading of physical security safeguards at missions abroad. In 2016, Global Affairs Canada updated its security standards to specify the safeguards it needed to protect missions against direct physical attacks. At the time of our audit, we found that these standards were again under revision to clarify how they would be applied and rolled out.

4.33 Until baseline physical security standards are consistently applied across all missions, Global Affairs Canada cannot comprehensively assess and prioritize the security measures needed for the effective protection of staff and assets at missions.

4.34 Threat assessments. To evaluate the overall risk to a mission given its location and operating environment, Global Affairs Canada conducts a threat assessment for its 175 missions every one to four years, with more frequent assessments in higher-threat locations. We found that more than one third of missions had an out-of-date threat assessment. Many of these missions were in high- and critical-threat locations, and the assessment had not been updated for several years. At four missions, we found that no threat assessment had been completed at all, contrary to recommended practice.

4.35 In the 2017–18 fiscal year, only 22 of the 57 scheduled threat assessments were completed. We note that in April 2018, Global Affairs Canada approved a plan to hire additional staff to update these assessments more quickly.

4.36 Vulnerability assessments. To evaluate its missions’ physical and operational security requirements in relation to overall risk, Global Affairs Canada conducts vulnerability assessments for each mission. We reviewed a selection of vulnerability assessments for 20 missions abroad and found that none consistently assessed the mission’s vulnerability against the set of physical security standards in effect at the time. As a result, Global Affairs Canada could not be sure that its missions had security measures in place that were appropriate for the local threat environment.

4.37 In addition, we found that the quality and format of vulnerability assessments varied. Many assessments were missing key information that the Department needed to make decisions about the significance of the vulnerabilities identified. For example, one assessment did not refer to the underlying threat assessment, while others did not always recommend safeguards to reduce the physical security vulnerabilities identified.

4.38 Many vulnerability assessments were dated: most were almost four years old. Global Affairs Canada did not have a plan to ensure that required vulnerability assessments would be current, in keeping with the local threat environment.

4.39 Global Affairs Canada did not have a formal training or certification process to ensure that staff members who conducted vulnerability assessments had the required knowledge and skills.

4.40 Priorities for recommended security measures. In 2017, Global Affairs Canada began to catalogue and prioritize the physical security improvements recommended for its missions. At the time of our audit, 875 measures were listed, of which one third were prioritized as either “high” or “critical” for the protection of staff and assets. Many of these recommended measures were for missions operating in dangerous locations. However, we found that because of weaknesses in its threat and vulnerability assessments, the Department did not have the information needed to prioritize the physical security measures to implement across its missions.

4.41 Recommendation. Global Affairs Canada should further develop and implement physical security standards for its missions abroad. It should ensure that threat and vulnerability assessments are current for the local risk environment and conducted with reference to its security standards in order to prioritize the implementation of security measures across its missions. It should also ensure that staff members who conduct the vulnerability assessments have the required knowledge and skills.

The Department’s response. Agreed. Global Affairs Canada is updating and enhancing its physical security standards, taking into consideration security risks, to further strengthen real property infrastructure abroad. The Department will continue its renewal of threat and vulnerability assessments, using a risk-based approach. This includes the development of timely and iterative approaches to assessments of risk at missions. The Department will ensure that threat and vulnerability assessments are current to the risk environment and prioritized accordingly. Vulnerability assessments will continue to be conducted based on departmental security standards and will be undertaken by employees with the requisite knowledge and skills acquired through a new security practitioner training program. The actions associated with this recommendation will be completed between December 2018 and December 2020.

Physical security upgrades at missions

4.42 Global Affairs Canada currently manages 78 major capital projects at its missions abroad. About half of these projects are in the planning phase while the other half are being implemented. Most projects are security-focused or have a security element to them. These highly specialized physical security projects are in some of the world’s most difficult, risky environments, which pose significant technical, logistical, and security challenges.

4.43 In recognition of the need to improve the physical security of its missions abroad, in 2007 and 2010, Global Affairs Canada received $652 million for new and upgraded security projects. In October 2017, the federal government announced a further $1.8 billion over 10 years to bolster the security of Canada’s missions, including through infrastructure upgrades and enhanced protection and surveillance measures.

Three missions received most of the physical security upgrades

4.44 Over the past decade, Global Affairs Canada prioritized its physical security upgrades to three missions located in high- or critical-threat areas. However, we found that the rationale behind funding decisions was not properly documented to ensure that the most urgent security needs would be met. Funding decisions for major physical security upgrades included in the capital projects were based on insufficient information. Moreover, the Department’s head of security was not involved in selecting which capital projects would be funded for implementation, even though most of these projects were related to physical security.

4.45 Our analysis supporting this finding presents what we examined and discusses the following topic:

• Selecting projects

4.46 This finding matters because rigorous analysis can help ensure that the Department invests its funds in the most urgent projects. Such analysis requires accurate, complete, timely, and relevant information. In addition, the Department needs to ensure that security projects progress in a timely manner in order to resolve security vulnerabilities.

4.47 Our recommendation in this area of examination appears at paragraph 4.53.

4.48 What we examined. We examined whether Global Affairs Canada funded physical security projects based on those it identified as having the greatest need.

4.49 Selecting projects. Over the past decade, Global Affairs Canada prioritized specialized funding to bolster security to its high- and critical-threat missions. We found that three missions accounted for approximately half of the funding allocated to the 25 physical security projects under way in 2017. We found limited documentation to demonstrate how physical security projects were prioritized among the higher-threat missions to ensure that the most urgent needs would be met. Because funding was directed only to higher-risk missions, security projects at lower-risk missions were not undertaken.

4.50 In 2017, Global Affairs Canada developed the Global Security Framework, which calls for the security branch to prioritize security measures needed on an ongoing basis across its missions. This will establish an annual exercise to track and rank the physical security measures needed for all missions, according to the ongoing assessments of local security threats and vulnerabilities. This exercise will guide the selection of major security projects recommended for funding and implementation at each mission.

4.51 Although the physical security needs are to be identified and prioritized across missions by the security branch, the major capital projects necessary to implement these measures are undertaken by a different branch. In determining the list of major capital projects to be funded each year, the Department’s real property branch balances security needs against others, such as a building’s age or diplomatic priorities that may require the relocation of a mission. We found insufficient information on how the real property branch selected major capital projects for funding, including how security needs were considered.

4.52 We also found that for the past two years, the list of major capital projects to be funded was not approved by senior Department officials. Moreover, the Departmental Security Officer was not a member of the committee that approved this list of capital projects to ensure that the most imperative security needs were addressed. We note that toward the end of our audit, in July 2018, the Departmental Security Officer was made a member of this committee.

4.53 Recommendation. Global Affairs Canada should formalize its process for identifying, prioritizing, and approving physical security projects at its missions to ensure that funds are appropriately allocated across missions. It should ensure that senior officials, including the Departmental Security Officer, approve the list of security projects to be implemented.

The Department’s response. Agreed. Global Affairs Canada has developed and formalized a risk-based approach to security investment planning, including for physical security projects, through its Global Security Framework. The purpose of the Global Security Framework is to establish a departmental structure for effective and integrated security risk management that enables strategic priority setting and resource allocation. For instance, the Platform Project Oversight Committee, chaired at the Assistant Deputy Minister level, was created to provide a forum for senior management’s review and approval for the allocation of resources to all major capital projects. The Terms of Reference for this Committee have been updated to formally include the Departmental Security Officer as a member. Security planning and processes specific to real property projects are being reviewed to ensure appropriate senior-level approvals. The actions associated with this recommendation will be completed in December 2018.

Major physical security projects were significantly delayed, mostly because of poor project planning

4.54 We found that most of Global Affairs Canada’s major physical security projects were significantly delayed, largely because of poor project planning and oversight.

4.55 Our analysis supporting this finding presents what we examined and discusses the following topics:

• Timeliness of physical security projects
• Capacity for project management
• Monitoring and oversight

4.56 This finding matters because many of Global Affairs Canada’s capital projects are meant to reduce important physical security vulnerabilities at its missions. The timely completion of security projects is important for the effective protection of staff and assets at missions abroad.

4.57 Our recommendation in this area of examination appears at paragraph 4.66.

4.58 What we examined. We examined whether Global Affairs Canada managed its physical security projects adequately.

4.59 Timeliness of physical security projects. Of the $652 million in funding provided to Global Affairs Canada over the past decade to upgrade physical security at missions, about $425 million was slated for capital projects. Although these projects were to be completed within 10 years, by 2017, about one quarter of the funding—$103 million—had still not been spent. The Department had to obtain special permission to retain $82 million of the $103 million in order to complete the security projects.

4.60 We found that 22 of the 25 security projects under way in Global Affairs Canada’s most recent investment plan were started late or were delayed during implementation. Some were years behind schedule. Most were large and complex projects that were expected to take years to complete. Despite ongoing project delays, the Department had not conducted lessons learned studies or analysis for all its projects to identify the root causes and common patterns of delays.

4.61 We reviewed 13 physical security projects that were started between 2010 and 2015 and were delayed. Nine of these projects were an average of three years behind schedule as of August 2018 and were taking almost twice as long to complete as originally planned (Exhibit 4.3). We found that these delays were caused by weaknesses in the Department’s project management and oversight. For example, project and risk plans often lacked rigour and did not sufficiently assess the risks unique to the host country, such as the need for additional time to obtain permits. Most risk plans failed to specify how risks could affect cost, scope, or schedule. The remaining 4 of the 13 projects were delayed or cancelled because of extraordinary or unforeseeable events in the host country.

4.62 Capacity for project management. We found that the Department’s capacity to deliver its security projects was limited. Many positions in the Department’s real property branch, which manages capital projects at missions abroad, were vacant. Its project management software was inadequate to manage large projects or to monitor their progress. As a result, Global Affairs Canada did not have the specialized staff or tools needed for effective project management. During the course of our audit, the real property branch was reviewing the roles and responsibilities of its staff to ensure that it had appropriate capacity.

4.63 Other federal entities that deliver security projects internationally have knowledge and experience that, in our view, could benefit Global Affairs Canada. For example, Defence Construction Canada runs construction and engineering projects internationally, many with unique security requirements. It delivers most of its projects for National Defence, but it also provides services to other government entities, such as Communications Security Establishment Canada. In our 2017 special examination, we found that Defence Construction Canada did a good job of managing construction projects and contracts. For example, it carried out contracts according to the client’s requirements, and it met deadlines and budgets.

4.64 Monitoring and oversight. We found that in managing its past investment plans, Global Affairs Canada did not have a senior-level oversight committee to challenge planned investments and processes or to monitor how projects progressed. Furthermore, it did not assign project sponsors or senior authority sign-off for each project. The security branch was not told which security projects were delayed or the reasons for the delays.

4.65 In November 2017, Global Affairs Canada created a senior-level committee, chaired by an Assistant Deputy Minister, to oversee major infrastructure projects. In March 2018, the Department introduced a second senior-level advisory committee, chaired by a Deputy Minister, to oversee capital and operating funds at missions and to ensure that they meet the greatest need.

4.66 Recommendation. Global Affairs Canada should strengthen project management and oversight of its real property projects, including those related to physical security, to improve their timely and effective delivery. In doing so, it should identify the root causes of project delays for correction and consider partnering with other federal entities, such as Defence Construction Canada, to provide infrastructure advice and support for its real property projects.

The Department’s response. Agreed. Global Affairs Canada has recently implemented several actions to enhance the existing project management governance, such as the Platform Project Oversight Committee, which is chaired at the Assistant Deputy Minister level and includes the Departmental Security Officer as a full member. The Department also recently created a Project Management Office to strengthen existing project practices, delivery, and reporting. Additionally, an external and independent review is being conducted to formally determine the root causes of project timeline delays. Finally, the Department is working with other foreign ministries and other government departments, including Defence Construction Canada, to identify best practices in support of timely, effective project delivery. The actions associated with this recommendation will be completed by November 2019.

Security awareness training for mission staff

Many mission staff members working in dangerous locations had not taken mandatory training

4.67 We found that Global Affairs Canada did not ensure that all staff members working in dangerous locations had taken mandatory security awareness training. We conducted our own examination of training records and found that many staff members posted at high-threat missions had not completed the mandatory training needed for their personal protection.

4.68 Our analysis supporting this finding presents what we examined and discusses the following topics:

• Training for Canadian staff members posted to missions operating in high-threat environments
• Training for locally engaged staff members

4.69 This finding matters because Global Affairs Canada must ensure the safety and security of its staff members. An important part of this responsibility is to ensure that staff members receive the training they need for their protection.

4.70 Global Affairs Canada has developed two mandatory security awareness training courses for the Canadian staff working at its missions abroad:

• Personal Security Seminar is a two-day training seminar for Canadian staff members and their families posted to high-threat missions. The seminar provides an overview of threats to safety and security in high-risk situations, along with various management strategies.
• Hazardous Environment Training is a five-day course held in Kingston, Ontario, for the Canadian staff posted to its highest-risk missions. The training covers topics such as first aid and explosive threat awareness.

4.71 Security awareness training is mandatory for Canadian staff members who travel and work in areas with high threat levels. It gives these employees and their dependents information and skills to help them avoid, mitigate, and cope with the dangerous situations they may face when working outside Canada. It is an effective measure to build a security culture and to ensure that all personnel take security seriously.

4.72 Our recommendation in this area of examination appears at paragraph 4.77.

4.73 What we examined. We examined whether Canadian staff members working in high-threat locations had completed mandatory security awareness training. We also examined whether awareness training was provided to locally engaged staff members.

4.74 Training for Canadian staff members posted to missions operating in high-threat environments. Global Affairs Canada did not ensure that all Canada-based staff members located at its high-threat missions abroad had completed the two mandatory security courses. In recognition of the importance of security awareness training for staff safety, Global Affairs Canada policy stipulates that its senior officials, including the Head of Mission, are responsible for ensuring that staff members and their dependents complete mandatory security awareness training. However, we found that training was not tracked to ensure that staff members had the appropriate level of security awareness for their effective protection.

4.75 We conducted our own examination of training records for security awareness training for employees working in a selection of missions in high-threat locations. We found that

• 41% of staff members had not completed the mandatory Personal Security Seminar, and
• 35% of staff members had not completed the mandatory Hazardous Environment Training course.

These rates are in violation of the Department’s security policy. Mandatory security awareness training is important to prepare staff members for their work in dangerous locations. We note that Global Affairs Canada received funding in 2017 to provide security training to its staff.

4.76 Training for locally engaged staff members. We found that Global Affairs Canada offered security awareness training for locally engaged staff members but did not normally provide enhanced security awareness training at its higher-threat missions. Staff members working at these missions are exposed to a range of security risks. Those who had taken this training at selected missions told us that they found it beneficial to their personal safety.

4.77 Recommendation. Global Affairs Canada should ensure that Canadian staff members working in dangerous locations successfully complete mandatory security awareness training. It should also establish mandatory security training for locally engaged staff members, according to the threat environment.

The Department’s response. Agreed. Mandatory training for staff being posted abroad, especially to designated high- and critical-threat missions, is a key element of Global Affairs pre-posting practices. As part of the duty-of-care envelope and with the aim of enhancing mission readiness, the Department will increase its training capacity and will implement a tracking solution to document training completed by Global Affairs Canada employees as well as staff from other government departments and dependents of Canada-based staff. The Department will also reassess the current mandatory security training for locally engaged staff and will expand the training, as required, to ensure that it continues to be appropriate to the threat environment. The actions associated with this recommendation will be completed between March 2019 and December 2020.

Conclusion

4.78 We concluded that Global Affairs Canada did not fully meet its physical security needs at missions abroad to protect its staff and assets. The Department had identified critical security measures needed at its missions, but it had not yet established detailed timelines for their implementation. Major construction projects under way to address security vulnerabilities at various missions were significantly delayed. In most cases, these delays were due to poor project management and oversight by Global Affairs Canada. Finally, not all staff members working at higher-threat missions had taken the mandatory security awareness training needed for their protection.