2018 Fall Reports of the Auditor General of Canada to the Parliament of Canada Independent Auditors’ ReportReport of the Joint Auditors to the Board of Directors of Canada Mortgage and Housing Corporation—Special Examination—2018
2018 Fall Reports of the Auditor General of Canada to the Parliament of CanadaReport of the Joint Auditors to the Board of Directors of Canada Mortgage and Housing Corporation—Special Examination—2018
Independent Auditors’ Report
Table of Contents
- Introduction
- Findings, Recommendations, and Responses
- Conclusion
- About the Audit
- List of Recommendations
- Exhibits:
- 1—Canada Mortgage and Housing Corporation’s business activities and financial results
- 2—Corporate governance—key findings and assessment
- 3—Strategic planning, performance measurement, and reporting—key findings and assessment
- 4—Corporate risk management—key findings and assessment
- 5—Capital management—key findings
- 6—Management of mortgage loan insurance, securitization, and assisted housing—key findings and assessment
- 7—Organizational transformation initiatives—key findings and assessment
This report reproduces the special examination report that the joint auditors issued to Canada Mortgage and Housing Corporation on 10 May 2018. The Office has not performed follow-up audit work on the matters raised in this reproduced report.
Introduction
Background
1. The Canada Mortgage and Housing Corporation was established in 1946 to help Canadians meet their housing needs. As Canada’s authority on housing, it contributes to the stability of the housing market by insuring residential mortgage loans and helping lenders convert their mortgage loan portfolios into marketable securities. It also supports affordable housing programs for Canadians and offers housing research and advice to Canadian governments, consumers, and the housing industry. Finally, it provides advice to the Department of Finance on developing policies for promoting access, competition, and stability in the housing market.
2. The Corporation reports to the Minister of Families, Children and Social Development. Its objects and powers are established by the Canada Mortgage and Housing Corporation Act in conjunction with the National Housing Act.
3. The Canada Mortgage and Housing Corporation has approximately 1,900 employees and delivers on its mandate through four business activities:
- mortgage loan insurance, which helps borrowers with low down payments purchase homes by compensating lenders for losses in the event that borrowers default on their mortgages;
- securitization, which helps lenders access funds for mortgage lending by converting eligible mortgages into marketable securities, with the payment of interest and principal guaranteed by the Corporation;
- market analysis and research, which provides objective information and advice on the housing market to the public and other stakeholders; and
- assisted housing, which provides access to affordable housing to Canadians, including those on First Nations reserves.
Exhibit 1 provides some details about the Corporation's business activities and financial results.
Exhibit 1—Canada Mortgage and Housing Corporation’s business activities and financial results
| Activity or result (in $ millions unless otherwise indicated) | 2014 | 2015 | 2016 |
|---|---|---|---|
| Total assets | 248,490 | 252,107 | 259,532 |
| Total liabilities | 230,308 | 232,468 | 238,542 |
| Total revenues | 6,199 | 4,636 | 4,693 |
| Total expenses | 3,574 | 3,148 | 3,315 |
| Insurance-in-force (in $ billions)Note 1 | 543 | 526 | 512 |
| Guarantees-in-force (in $ billions)Note 2 | 422 | 431 | 452 |
| Parliamentary funding for housing programs expenses | 2,010 | 2,049 | 2,153 |
Source: Adapted from the Canada Mortgage and Housing Corporation’s 2016 annual report
4. Aside from the funding it receives from Parliament to support housing programs and some policy and research activities, the Corporation is financially self-sustaining. To achieve its commercial objectives, it must price its products and services appropriately, manage its risks, and have the right people in place, while balancing its non-commercial objective of promoting housing affordability.
5. Since January 2009, when we issued our last special examination report, Canada experienced a financial recession, which followed the 2008 global financial crisis. This crisis was triggered when credit losses in the United StatesUS mortgage market rose after years of high-risk mortgage lending practices. In response, the Canadian government implemented initiatives to mitigate the economic impact of the recession. For example, it launched the Insured Mortgage Purchase Program through the Corporation and used the Corporation’s assisted housing program as a fiscal stimulus tool. As a result of this increased activity, the Corporation’s assets grew significantly.
6. In 2012, the government requested that a review of the Corporation’s operations be carried out, to be overseen by the Office of the Superintendent of Financial Institutions (OSFI). One outcome of this review was that the Corporation was placed under the OSFI’s oversight. In this oversight role, the OSFI regularly reviewed the Corporation’s practices and assessed them against its guidelines and the practices of other financial institutions. The Corporation is expected to align its practices with the OSFI’s regulatory framework, which is designed to manage risk to promote public confidence in the Canadian financial system. The framework establishes minimum capital requirements and sound risk management practices for financial institutions.
7. Another outcome of the review involved a significant change to the composition of the Corporation’s Board. Vacant and expiring positions would be filled according to a new skills profile, and federal government representation would be added through the appointment of two deputy ministers.
8. In 2014, the Corporation embarked on a multi-year program of change, called CMHC in Motion. Through this program, the Corporation restructured the organization, updated its risk management program, hired new talent, and introduced a new performance management framework and compensation system. It also partnered with an information technology (IT) service provider to implement a major IT transformation, and it outsourced part of its IT operations. In addition, as part of CMHC in Motion, the Corporation had significant transformation initiatives under way to modernize its technology infrastructure and better manage its business lines.
9. More recently, in November 2017, the Prime Minister announced the National Housing Strategy, a 10-year, $40 billion program. The Corporation is expected to take the lead role in carrying out the strategy’s initiatives.
Focus of the audit
10. Our objective for this audit was to determine whether the systems and practices we selected for examination at the Canada Mortgage and Housing Corporation were providing it with reasonable assurance that its assets were safeguarded and controlled, its resources were managed economically and efficiently, and its operations were carried out effectively as required by section 138 of the Financial Administration Act.
11. In addition, section 139 of the Financial Administration Act requires that we state an opinion, with respect to the criteria established, as to whether there was reasonable assurance that there were no significant deficiencies in the systems and practices examined. A significant deficiency is reported when the systems and practices examined did not meet the criteria established, resulting in a finding that the Corporation could be prevented from having reasonable assurance that its assets are safeguarded and controlled, its resources are managed economically and efficiently, and its operations are carried out effectively.
12. Based on our assessment of risks, we selected systems and practices in the following areas:
- corporate management practices;
- management of mortgage loan insurance, securitization, and assisted housing; and
- management of organizational transformation initiatives.
The selected systems and practices and the criteria used to assess them are found in the exhibits throughout the report.
13. Although the Corporation had a legislated mandate to conduct research on housing conditions, we did not examine this area outside of the Corporation’s corporate management systems and practices, given the relative size of this area of activity and our understanding of the risks. We also did not examine the National Housing Strategy and the Corporation’s plans and systems to implement it, given the timing of the announcement (end of the period covered by the audit) and the lack of practices to examine at that time.
14. More details about the audit objective, scope, approach, and sources of criteria are in About the Audit at the end of this report.
Findings, Recommendations, and Responses
Corporate management practices
Except for a significant deficiency in corporate governance, the Corporation had in place good corporate management practices
Overall message
15. Overall, we found that except for a significant deficiency in corporate governance, the Corporation had good corporate management practices in place. The significant deficiency was related to the combined weaknesses in Board appointments and their related impacts on Board oversight and competencies. During the period covered by our audit, 4 of the 12 Board positions were vacant. These vacancies left gaps in the competencies and diversity of the Board and hindered the effectiveness of its oversight. We found that the Corporation had good corporate management practices in place in other areas, with opportunities for improvement in capital management.
16. The appointment of directors to the Board was the responsibility of the Governor in Council and was thus outside the Corporation’s control.
17. This finding matters because effective governance is essential to the Corporation’s ability to carry out its mandate. An insufficient number of members and limited competencies could reduce the effectiveness of the Board’s oversight activities. Also, having strong capital management processes in place is important to the Corporation’s ability to remain financially self-sustaining and to contribute to the stability of Canada’s housing market.
18. Our analysis supporting this finding discusses the following topics:
- Corporate governance
- Strategic planning, performance measurement, and reporting
- Risk management (corporate risk management and capital management)
19. The Canada Mortgage and Housing Act provides for a Board of 12 directors, consisting of the chair, the president, 2 deputy ministers, and 8 other directors. It gives each director one vote in the transaction of the business. The Board has formed the following committees:
- the Audit Committee,
- the Risk Management Committee,
- the Corporate Governance and Nominating Committee,
- the Human Resources Committee, and
- the Assisted Housing Committee (recently formed and not sitting yet during the period covered by our audit).
20. The Corporation is exposed to significant risk through its mortgage insurance and securitization activities. This includes the risk of holding inadequate levels of capital to meet regulatory requirements or to survive financial crises. As such, sound corporate risk and capital management practices are critical to ensuring that the Corporation can respond to business and operational risks, and that it holds sufficient capital to remain financially sustainable in the event of an increase in mortgage losses.
21. Our recommendations in this area of examination appear at paragraphs 25 to 28, 34, and 39.
22. Analysis. We found weaknesses in Board appointments, and related weaknesses in Board oversight and competencies. Combined, these weaknesses amounted to a significant deficiency (Exhibit 2).
Exhibit 2—Corporate governance—key findings and assessment
| Systems and practices | Criteria used | Key findings | Assessment against the criteria |
|---|---|---|---|
|
Legend—Assessment against the criteria 
Met the criteria 
Met the criteria, with improvement needed 
Did not meet the criteria |
|||
|
Board independence |
The Board functioned independently. |
The Corporation had a Board of Directors charter, a conflict of interest policy, and a code of ethics and business conduct. These items required directors to be independent of management (with the exception of the President and Chief Executive Officer) and to declare conflicts of interest. Conflicts of interest were declared at Board meetings and through annual declarations. The Board held regular in camera meetings without the presence of management. |
 |
|
Providing strategic direction |
The Board provided strategic direction. |
The Board approved the Corporation’s strategic direction at the beginning of the corporate planning cycle and approved its corporate plan. The Board was involved in setting objectives for the President and Chief Executive Officer that were aligned with the Corporation’s strategic direction. It was also involved in assessing the Chief Executive Officer’s performance against those objectives. |
|
|
Board oversight |
The Board carried out its oversight role over the Corporation. |
The Corporation’s Internal Audit group conducted regular audits, including audits related to the IT transformation. The Vice-President, Audit; Chief Financial Officer; and external auditors met in camera with the Audit Committee regularly. The Chief Risk Officer met in camera with the Risk Management Committee regularly. Weaknesses The Board did not adequately oversee the Corporation’s transformation initiatives. The Board received limited information and provided limited direction on the assisted housing business line. |
 |
|
Board appointments and competencies |
The Board collectively had capacity and competencies to discharge its responsibilities. |
The Board communicated with the Minister of Families, Children and Social Development about Board appointments, renewals, and vacancies. Weaknesses Four Board positions were vacant in 2017. The Audit Committee did not include a Chartered Professional Accountant. The Board had gaps in its assisted housing competency and limited breadth or depth of the following competencies: IT, financial reporting, and internal controls. The Board did not seek additional training or use outside expertise to fill gaps in its competencies—for example, in the area of IT for the IT transformation. |
|
23. Significant deficiency—Corporate governance. We found weaknesses in Board appointments and related weaknesses in Board oversight and competencies. We concluded that these combined weaknesses amounted to a significant deficiency in corporate governance.
-
Board oversight role. The Board did not receive the comprehensive reporting it required to adequately fulfill its oversight role. For example, it did not receive enough information on all the transformation initiatives under way to properly oversee and monitor them. While it received regular updates on the IT transformation, it did not receive adequate information on the other transformation initiatives. Further, the Board did not receive information on the performance of the outsourcing activities related to ongoing IT operations. These gaps suggest that the Board was not fully carrying out its oversight and challenge responsibilities in these areas.
-
Board oversight of assisted housing. The Board did not receive regular reporting on the Corporation’s performance in its assisted housing business line. We found that the corporate performance report that management presented quarterly to the Board provided little information on this business line. By comparison, management reported to the Board in more detail on performance of the commercial business lines and submitted progress reports on several indicators from the corporate plan. We also found that the Board’s involvement in setting the Corporation’s strategic direction was aimed mainly at mortgage insurance and securitization. Although the Board had recently created an Assisted Housing Committee to assist it in overseeing this area, it had not yet appointed members to this committee during the period covered by our audit.
-
Board appointments. In 2017, there were vacancies in 4 of 12 Board positions; in 2016, there had been 3 vacancies. The Corporation had identified expiration dates of the Board members’ terms, along with the competencies needed to fill these positions, and communicated this information to its Minister. However, its actions did not result in timely new appointments to the Board. Because the Governor in Council makes these appointments, filling these positions was beyond the Corporation’s control. On 19 December 2017, the Minister of Families, Children and Social Development announced 6 appointments and 1 reappointment to the Board, thereby addressing the 4 vacancies and 2 positions that were about to expire.
As a safeguard against conflicts of interest, Section 8 of the Canada Mortgage and Housing Act precludes anyone who is a director, officer, or employee of a lending institution from being appointed to the Corporation’s Board. Further, anyone appointed as a director or president is required to divest themselves of any shares of lending institutions within three months of their appointment. These restrictions constrain appointments to the Board by limiting the pool of eligible candidates.
-
Board competencies. We noted gaps in Board competencies related to assisted housing, and limited breadth or depth of competency in IT, financial reporting, and internal controls. We also noted that the Board’s only Chartered Professional Accountant at the time was not a member of the Audit Committee. While some Board members had some competency in these areas, greater breadth and depth of these competencies were noted at comparable Crown corporations. Having a Chartered Professional Accountant on the Audit Committee is a standard practice to ensure sufficient depth of competency in overseeing financial reporting and internal controls. Although the Corporation allows Board members to enhance their competencies by seeking external training and outside expertise, none of them did this during the period covered by the audit.
24. This deficiency matters because an incomplete Board with competency gaps could compromise the Board’s ability to effectively oversee the Corporation. Given the complexity of the transformations under way and their significance to the Corporation’s operations, adequate oversight and competencies were critical.
25. Recommendation. The Canada Mortgage and Housing Corporation should continue to engage with its Minister to ensure that directors appointed to the Board have the critical and desirable competencies as provided in the Board’s competency matrix.
The Corporation’s response. Agreed. The Canada Mortgage and Housing Corporation will continue to offer advice and support to the Minister on Board appointments by identifying competency and experience gaps and by working to ensure that future Board appointments address outstanding needs. The new Governor in Council appointment process guides appointments to the Corporation’s Board of Directors. The process is standardized across all government and Crown corporations, and allows for limited involvement from the organization. The selection approach is designed to identify qualified and diverse candidates. A selection committee, of which the Chair of the Board is the Corporation’s only representative, provides a list of recommended candidates to the Minister, who then recommends appointments to the Governor in Council. In December 2017, a number of appointments were announced to the Corporation’s Board, which will enhance the breadth and depth of knowledge on the Board.
26. Recommendation. The Canada Mortgage and Housing Corporation should ensure that the Board of Directors seek additional training or external expertise in areas where gaps in competencies and knowledge are identified, particularly in IT, where a significant transformation is taking place and a significant part of the operations is being outsourced to a service provider.
The Corporation’s response. Agreed. The Canada Mortgage and Housing Corporation will continue to provide new Board members with relevant training information. All members have been provided with suggestions of appropriate courses designed to enhance competencies with respect to fulfilling their responsibilities on specific Board committees. The Corporation will further enhance its existing Board training menu and regularly identify suggested seminars and courses related to specific functional areas, hot topics, corporate priorities, and activities.
27. Recommendation. The Board of Directors should play a more active role in setting the Canada Mortgage and Housing Corporation’s strategic direction and monitoring performance in the area of assisted housing.
The Corporation’s response. Agreed. The Canada Mortgage and Housing Corporation will assist the Board in fulfilling its responsibilities related to oversight and monitoring of performance with respect to the effective implementation and application of assisted housing policies, programs, and initiatives, including the National Housing Strategy. It will do this through its newly formed Assisted Housing Committee and through the new, qualified Board members appointed by the Minister in late 2017. The Corporation will provide regular related updates to the committee, including both reports to the federal government and a quarterly Assisted Housing Business Supplement that was introduced in the third quarter of 2017. The Corporation will also provide regular updates on activities for First Nations housing, including its support of initiatives being led by the Department of Indigenous Services Canada.
28. Recommendation. The Board of Directors should ensure that it receives regular and comprehensive information on all aspects of the Corporation’s mandate as well as on all significant initiatives under way.
The Corporation’s response. Agreed. The Canada Mortgage and Housing Corporation will continue to assist the Board with its corporate governance responsibilities by ensuring that it receives comprehensive, relevant progress reports, including opportunities and issues, on key initiatives and other significant activities, on a regular basis. The Corporation will also continue to ensure that the Board is satisfied with the information provided to do its work.
29. Analysis. The Corporation had good processes for strategic planning, performance measurement, and performance monitoring and reporting (Exhibit 3).
Exhibit 3—Strategic planning, performance measurement, and reporting—key findings and assessment
| Systems and practices | Criteria used | Key findings | Assessment against the criteria |
|---|---|---|---|
|
Legend—Assessment against the criteria
Met the criteria
Met the criteria, with improvement needed
Did not meet the criteria |
|||
|
Strategic planning processes |
The Corporation had a framework to define its strategic plan and objectives. |
The Corporation had systematic strategic planning processes in place. The Corporation considered its internal and external environments, and its competitive strengths, weaknesses, threats, and opportunities. The Corporation established measurable strategic objectives. The corporate plan was well communicated throughout the organization. |
|
|
Performance measurement |
The Corporation established performance measures in support of achieving strategic objectives. |
The 2017–2021 strategic plan had objectives for measuring performance that were aligned with the Corporation’s strategic direction. |
|
|
Performance monitoring and reporting |
The Corporation monitored and reported on progress in achieving its strategic objectives. |
The Corporation reported performance results quarterly to senior management and the Board of Directors. The Corporation’s 2016 annual report included results on its performance measures. |
|
30. Analysis. The Corporation had the tools to identify, mitigate, and report on the risks to achieving its strategic objectives (Exhibit 4). The Corporation manages the significant insurance and guarantee risk it faces through its capital management systems and practices. However, we found opportunities for improvement in its capital management practices (Exhibit 5).
Exhibit 4—Corporate risk management—key findings and assessment
| Systems and practices | Criteria used | Key findings | Assessment against the criteria |
|---|---|---|---|
|
Legend—Assessment against the criteria
Met the criteria
Met the criteria, with improvement needed
Did not meet the criteria |
|||
|
Risk identification and assessment |
The Corporation identified and assessed risks to achieving strategic objectives. |
The Corporation developed a risk management framework and a suite of policies to help it identify and assess risks. The Corporation defined risk management roles and responsibilities that were aligned with its governance model. The Corporation identified and assessed its main risks, including strategic, reputational, operational, insurance, credit, market, and liquidity risks. The Corporation produced an annual Own Risk and Solvency Assessment report, which summarized its risk management and capital management practices. The Corporation recently updated its risk appetite framework to better align with its corporate strategy. The Corporation identified operational risks through risk and control self-assessments and other risk management tools. |
|
|
Risk mitigation |
The Corporation defined and implemented risk responses. |
The Corporation developed mitigation action plans and identified owners to respond to its business and operational area risks. |
|
|
Risk monitoring and reporting |
The Corporation monitored and reported on the implementation of risk mitigation measures. |
The Corporation reported on risk management activities through detailed quarterly reports to the Board. These included a description of the top risks it faced, new and emerging issues, and significant risk events. Quarterly reports included a risk register that provided a rating and trend in seven risk categories, and various performance metrics. |
|
Exhibit 5—Capital management—key findings
| Systems and practices | Criteria used | Key findings | Assessment against the criteria |
|---|---|---|---|
|
Legend—Assessment against the criteria
Met the criteria
Met the criteria, with improvement needed
Did not meet the criteria |
|||
|
Capital management |
The Corporation managed its capital to mitigate the risks it faced as a result of its loan insurance and securitization business lines. |
The Corporation had in place a capital management policy, a dividend framework, a risk appetite framework, and a stress testing program to ensure sound and prudent management of its capital. The Corporation had a process for quantifying its capital needs related to significant risks. Weakness The Corporation did not quantify the impact that all material risks could have on its capital needs. For example, it assessed strategic and reputational risks as material risks but did not quantify any related capital needs. |
|
|
Stress testing |
The Corporation used stress testing to assess and mitigate risks to its loan insurance and securitization business lines. |
The Corporation put in place a stress testing policy and framework that defined the process and governance of the stress testing program. The Corporation used the stress testing results to confirm that it had adequate capital, and to inform its business strategy, risk appetite, risk management, and capital management decisions. Weakness The Corporation did not perform additional ad hoc stress tests to further explore its main vulnerabilities, to better understand its risk profile in the event of extreme crisis, and to ensure that management actions could be deployed to proactively respond to such scenarios. |
|
|
Model risk management |
The Corporation managed the risk in its modelling to ensure that stress testing produced reliable data. |
The Corporation had in place a well-defined framework for model risk management. It included a model risk policy, model risk policy guideline, model validation procedure, and model inventory. The Corporation validated a large number of models included in the model inventory. |
|
31. Weakness—Capital management. The Office of the Superintendent of Financial Institutions expects a mortgage insurer such as the Canada Mortgage and Housing Corporation to have risk and capital management processes that define its risk profile, strategy, and potential stress scenario outcomes. These processes help insurers determine how much capital to set aside to withstand significant losses in case certain risks are realized.
32. While we found strengths in the Corporation’s evolving capital management practices and economic capital models, we noted that the Corporation did not quantify how much internal capital it should set aside in case reputational and strategic risks were realized. For example, it could quantify reputational risk by developing scenarios detailing the potential impacts of business volume loss due to a reputational issue, and the costs for repairing the damaged reputation.
33. This weakness matters because determining the level of capital the Corporation needs to address all significant risks helps mitigate financial risks to the Government of Canada and to the Canadian taxpayer.
34. Recommendation. The Canada Mortgage and Housing Corporation should enhance its assessment and documentation with respect to the capital it requires to cover all material risks, including its reputational and strategic risks.
The Corporation’s response. Agreed. The Canada Mortgage and Housing Corporation will continue to enhance its Own Risk and Solvency Assessment documentation to include its assessment of capital requirements for reputational and strategic risks. This work will be completed for inclusion in its 2018 Own Risk and Solvency Assessment report, which will be finalized by the end of the fourth quarter of 2018.
35. Weakness—Stress testing. Stress testing is a risk management tool that involves searching out “what if” scenarios that have varying probabilities of occurring, and assessing their impact on levels of capital. Senior management uses this tool in making risk management and capital management decisions.
36. In 2017, the Corporation assessed various stress scenarios, such as a steep increase in the price of oil and a severe earthquake. It estimated their impacts over time on variables such as housing prices, unemployment rates, gross domestic product growth rate, and interest rate levels. The stress testing results showed that the Corporation’s capital was adequate and remained above its minimum threshold throughout all of the stress scenarios.
37. However, the Corporation did not perform additional ad hoc stress tests to further explore its main vulnerabilities, better understand its risk profile in the event of extreme crisis, and ensure that management actions could be deployed to respond proactively to such extreme scenarios.
38. This weakness matters because without this additional stress testing, the Corporation could not explore its hidden vulnerabilities and inform senior management and the Board about the type of scenarios that would be potentially harmful.
39. Recommendation. The Canada Mortgage and Housing Corporation should define additional ad hoc stress tests to further explore its main vulnerabilities, better understand its risk profile in the event of extreme crisis, and ensure that management actions could be deployed to respond proactively to such extreme scenarios.
The Corporation’s response. Agreed. The Canada Mortgage and Housing Corporation will continue the work that is already under way to enhance its stress testing capabilities to support additional ad hoc stress tests. As part of this work, the Corporation will continue to strengthen its documentation with respect to management actions and readiness plans to respond proactively to extreme scenarios. This work will be completed by the end of the fourth quarter of 2018.
Management of mortgage loan insurance, securitization, and assisted housing
The Corporation was managing its mortgage loan insurance, securitization, and assisted housing business lines well
Overall message
40. Overall, we found that the Canada Mortgage and Housing Corporation had in place good operational planning practices for managing its mortgage loan insurance, securitization, and assisted housing business lines.
41. This finding matters because the Corporation is expected to operate its mortgage loan insurance and securitization activities in a financially self-sustaining manner while improving the access to and stability of the housing market. Further, it must effectively monitor and report on the performance of its assisted housing business so that it can support affordable housing programs for Canadians in need.
42. Our analysis supporting this finding discusses the following topic:
43. In Canada, mortgage loan insurance is available from the Canada Mortgage and Housing Corporation and from private mortgage loan insurers. Mortgage loan insurance helps borrowers with low down payments purchase homes by compensating lenders for losses in the event that borrowers default on their mortgages.
44. The Corporation mitigates insurance risk by limiting its total amount of insurance-in-force to $600 billion, which is the amount legislated by the National Housing Act. It also mitigates risk through its underwritingDefinition i, pricing, stress testing, and economic capital modelling practices.
45. Another way the Corporation mitigates its insurance risk is by ensuring that the lenders offering its mortgage loan insurance adhere to the underwriting guidelines defined by the Office of the Superintendent of Financial Institutions. It also conducts rotational and risk-based quality assurance reviews of lenders. These reviews involve selecting a sample of loan files and ensuring that the documentation is complete and that the underwriting decisions are supported.
46. The Corporation’s securitization guarantee programs enable lenders to convert eligible mortgages into marketable securities that are guaranteed by the Corporation. This process also provides lenders with funds for lending. The Corporation mitigates risk on these guarantees by limiting the amount of guarantees-in-force to $600 billion, which is the amount legislated by the National Housing Act. The Corporation also sets eligibility requirements for approved lenders and for securitization of mortgages, and it establishes triggers for taking additional risk mitigation actions if the credit quality of an issuer deteriorates.
47. The Corporation supports housing programs by using funds from Parliament. Funding reaches Canadians in need through agreements with other levels of government and First Nations, and through programs that the Corporation manages directly. The Corporation’s objective for its assisted housing programs is to maximize the effectiveness of this funding to create affordable housing solutions. The Corporation also delivers on the initiatives in federal budget pronouncements, which typically cover multi-year periods.
48. In November 2017, the federal government announced its $40 billion long-term National Housing Strategy. The strategy includes funding from the federal government through existing programs and new commitments, and cost matching by provinces and territories. The Corporation is expected to play a lead role in delivering the strategy’s initiatives, beginning in 2018.
49. We made no recommendations in this area of examination.
50. Analysis. The Corporation had good operational planning practices for its mortgage loan insurance, securitization, and assisted housing business lines (Exhibit 6).
Exhibit 6—Management of mortgage loan insurance, securitization, and assisted housing—key findings and assessment
Planning
| Systems and practices | Criteria used | Key findings | Assessment against the criteria |
|---|---|---|---|
|
Legend—Assessment against the criteria
Met the criteria
Met the criteria, with improvement needed
Did not meet the criteria |
|||
|
Operational planning |
The Corporation defined operational plans for its mortgage loan insurance, securitization, and assisted housing business lines that were aligned with its strategic plans and mandate to deliver expected results. |
The Corporation’s operational plan for each business line was aligned with its strategic plan. Plans were sufficiently detailed to guide management actions. The Corporation’s operational plans included thorough business-level risk assessments, which fed into the corporate planning process. The Corporation had comprehensive budgets and established performance measures in its operational plans. The Corporation had accountability processes in place to monitor the implementation of the operational plans. The Corporation’s operational plans were formally communicated to employees and integrated into employee performance appraisals. |
|
Implementing
| Systems and practices | Criteria used | Key findings | Assessment against the criteria |
|---|---|---|---|
|
Legend—Assessment against the criteria
Met the criteria
Met the criteria, with improvement needed
Did not meet the criteria |
|||
|
Operational plan implementation |
Management implemented the mortgage loan insurance, securitization, and assisted housing operational plans to deliver results in accordance with the expected output of the business line. |
The Corporation implemented its operational plans in order to achieve expected performance targets. The Corporation communicated its progress against its performance objectives quarterly. It held individual managers accountable for results. The Corporation tracked whether it was achieving the operational performance objectives tied to its 2017–2021 Corporate Plan. |
|
Monitoring and reporting
| Systems and practices | Criteria used | Key findings | Assessment against the criteria |
|---|---|---|---|
|
Legend—Assessment against the criteria
Met the criteria
Met the criteria, with improvement needed
Did not meet the criteria |
|||
|
Performance monitoring and reporting |
The Corporation monitored and reported on its mortgage loan insurance, securitization, and assisted housing operational results. |
The Corporation reported to the Executive Committee at least quarterly on its key operational results. Management was informed of the operational performance of each business unit in a timely manner. The Corporation periodically assessed the relevance of its results through internal audits, program reviews conducted by external parties, and surveys. |
|
|
Lender quality assurance framework—Insurance |
The Corporation monitored lenders’ underwriting practices. |
The Corporation had a well-established process to assess the quality of mortgage lenders. The Corporation documented its assessments of lenders. The assessments included all regulatory requirements. The Corporation provided executive summary reports to management about the results of lender assessments. Senior management was informed of results by exception, according to defined parameters. The Corporation worked closely with lenders to address observations identified in lender reviews. |
|
Management of organizational transformation initiatives
The Corporation had good systems and practices to manage its organizational transformation initiatives, but some improvements were needed
Overall message
51. Overall, we found that the Canada Mortgage and Housing Corporation had good systems and practices to manage its organizational transformation initiatives. However, we found that improvements were needed in integrating the information technology (IT) and non-IT transformation initiatives, and in identifying outcomes for individual projects.
52. This finding matters because the transformation initiatives taking place, including significant technology changes, were having a pervasive and significant impact on business delivery. If unsuccessful, the initiatives could result in financial losses and threaten the Corporation’s ability to deliver its mandate.
53. Our analysis supporting this finding discusses the following topic:
54. The Corporation had significant transformation initiatives under way to modernize its technology infrastructure and better manage its business lines. The technology transformation included more than 30 projects, including updating IT architecture and software, and implementing new resource planning and customer relationship management systems. Non-IT projects included process improvements and other changes to improve program delivery.
55. As part of the technology transformation, the Corporation entered into a 10-year contract with an IT service provider, whose role was to support the delivery of technology transformation projects planned for the first three years of the contract. The IT service provider would also operate technology services across the Corporation for the duration of the contract.
56. Our recommendations in this area of examination appear at paragraphs 60 and 63.
57. Analysis. Overall, we found that the Corporation had implemented systems and practices to manage its organizational transformation initiatives. However, we also found that improvements were needed in integrating the IT and non-IT transformation initiatives, and in identifying outcomes for individual projects (Exhibit 7).
Exhibit 7—Organizational transformation initiatives—key findings and assessment
| Systems and practices | Criteria used | Key findings | Assessment against the criteria |
|---|---|---|---|
|
Legend—Assessment against the criteria
Met the criteria
Met the criteria, with improvement needed
Did not meet the criteria |
|||
|
Transformation program and project oversight |
The Corporation had the program and project management structure necessary to oversee, monitor, and report on multiple transformation projects. |
The Corporation prepared a business case for its technology transformation initiatives that was approved by the Board of Directors. The Corporation had an IT Transformation Office, which managed technology transformation projects. The Executive Committee and the Board of Directors monitored these projects. The Corporation had a process in place to assess resource requirements and assign resources according to the risk and complexity of the transformation projects. Weaknesses The Corporation did not manage the transformation initiatives in an integrated way. It managed the IT and non-IT projects independently, using different oversight structures. The Board’s oversight focused on technology transformation projects. Management provided no information to the Board on the overall state of the transformation initiatives. |
|
|
Program and project management |
The Corporation had a project management framework to plan, implement, and monitor transformation programs and projects in place. |
The Corporation, supported by its IT service provider, implemented project management methodologies and activities to manage its transformation initiatives. Weaknesses The Corporation delivered the transformation initiatives through a series of individual projects. It did not document specific outcomes and corresponding performance metrics at an individual project level that would determine the success of the project once implemented. |
|
|
Change management |
The Corporation had change management methodology, systems, and practices necessary to evolve the organization and its people. |
The transformation projects received change management leadership from the Corporation’s Change Management Office. The technology projects received change management support from the IT service provider. |
|
|
IT security and business continuity / recovery planning in the context of the transformation |
The Corporation had systems and practices in place to ensure the availability and accessibility of information systems when needed, and to ensure the resistance of attacks and recovery from failures. |
The Corporation identified a full inventory of information systems that were affected by the technology transformation, which included the current state of the systems and the proposed future state of the systems. The Corporation performed a current-state assessment of its IT security and developed an IT security framework. The Corporation also initiated an update of its disaster recovery plan to consider the future impact of its transformation initiatives. |
|
|
IT outsourcing risk management |
The Corporation managed the IT outsourcing risks to ensure that service delivery met its expectations. |
The Corporation assessed the risks associated with its IT outsourcing arrangement and implemented mitigation measures to address them. |
|
58. Weaknesses—Transformation program and project oversight. We found that the Corporation did not manage its transformation initiatives in an integrated way. It used different governance and oversight approaches for the technology and non-technology transformation initiatives. In addition, there was no reporting to the Board on the overall state of these initiatives.
59. This weakness matters because for a large-scale, complex transformation program, managing all transformation initiatives together ensures proper integration of project interdependencies and facilitates change management and risk management.
60. Recommendation. The Canada Mortgage and Housing Corporation should manage its transformation initiatives in an integrated way, have a project management team to oversee overall transformation project and change management activities, and report to the Board on the overall state of transformation initiatives.
The Corporation’s response. Agreed. The Canada Mortgage and Housing Corporation will leverage its existing enterprise portfolio management and organizational change management functions, both of which reside in the newly formed Strategy and Organizational Excellence Division, to provide project and change management oversight and facilitate reporting to senior management and the Board on the transformation projects, as identified by the Corporation’s Executive Committee. The new Strategy and Organizational Excellence Division will act as a conduit for all applicable business transformation offices (for example, the IT Transformation Office) to facilitate comprehensive transformation reporting.
61. Weaknesses—Program and project management. We found that the Corporation did not clearly define and document the objectives, outcomes, performance metrics, and expected benefits associated with each of the transformation projects.
62. This weakness matters because without these items being clearly defined, the Corporation may not have been able to assess whether the expected benefits were achieved once the projects were completed.
63. Recommendation. The Canada Mortgage and Housing Corporation should clearly define objectives, outcomes, performance measures, and expected benefits for each of its transformation projects and regularly report on its achievements.
The Corporation’s response. Agreed. The Canada Mortgage and Housing Corporation will include critical and high-complexity transformation projects as part of its initiative prioritization and assessment process, commencing in the first quarter of 2018. This process documents project objectives and expected outcomes for all major business projects. It also requires the development and approval of a full business case, including the identification of the anticipated project value and benefits. As these projects progress, project value realization will be regularly reported to senior management and the Board, as appropriate.
Conclusion
64. In our opinion, based on the criteria established, there was a significant deficiency in the Canada Mortgage and Housing Corporation’s corporate governance systems and practices, but there was reasonable assurance that there were no significant deficiencies in the other systems and practices that we examined. We concluded that except for this significant deficiency, the Corporation maintained its systems and practices during the period covered by the audit in a manner that provided the reasonable assurance required under section 138 of the Financial Administration Act.
About the Audit
This joint independent assurance report was prepared by the Office of the Auditor General of Canada and Ernst & Young limited liability partnershipLLP on the Canada Mortgage and Housing Corporation. Our responsibility was to express
- an opinion on whether there is reasonable assurance that during the period covered by the audit, there were no significant deficiencies in the Corporation’s systems and practices that we selected for examination; and
- a conclusion about whether the Corporation complied in all significant respects with the applicable criteria.
Under section 131 of the Financial Administration Act (FAA), the Canada Mortgage and Housing Corporation is required to maintain financial and management control and information systems and management practices that provide reasonable assurance that
- its assets are safeguarded and controlled;
- its financial, human, and physical resources are managed economically and efficiently; and
- its operations are carried out effectively.
In addition, section 138 of the FAA requires the Corporation to have a special examination of these systems and practices carried out at least once every 10 years.
All work in this audit was performed to a reasonable level of assurance in accordance with the Canadian Standard for Assurance Engagements (CSAE) 3001—Direct Engagements set out by the Chartered Professional Accountants of Canada (CPA Canada) in the CPA Canada Handbook—Assurance.
The auditors apply Canadian Standard on Quality Control 1 and, accordingly, maintain a comprehensive system of quality control, including documented policies and procedures regarding compliance with ethical requirements, professional standards, and applicable legal and regulatory requirements.
In conducting the audit work, we have complied with the independence and other ethical requirements of the relevant rules of professional conduct applicable to the practice of public accounting in Canada, which are founded on fundamental principles of integrity, objectivity, professional competence and due care, confidentiality, and professional behaviour.
In accordance with our regular audit process, we obtained the following from the Corporation’s management:
- confirmation of management’s responsibility for the subject under audit;
- acknowledgement of the suitability of the criteria used in the audit;
- confirmation that all known information that has been requested, or that could affect the findings or audit conclusion, has been provided; and
- confirmation that the audit report is factually accurate.
Audit objective
The objective of this audit was to determine whether the systems and practices we selected for examination at the Canada Mortgage and Housing Corporation were providing it with reasonable assurance that its assets were safeguarded and controlled, its resources were managed economically and efficiently, and its operations were carried out effectively as required by section 138 of the Financial Administration Act.
Scope and approach
Our audit work examined the Canada Mortgage and Housing Corporation. The scope of the special examination was based on our assessment of the risks the Corporation faces that could affect its ability to meet the requirements set out by the Financial Administration Act.
As part of our examination, we interviewed Board members, senior management, and other individuals throughout the Corporation to gain insights into its systems and practices. We selected and tested samples of items, such as transactions, process control activities, risk mitigation strategies, projects, and reporting, to determine whether systems and practices were in place and functioned as intended.
The systems and practices selected for examination for each area of the audit are found in the exhibits throughout the report.
In carrying out the special examination, we did not rely on any internal audits. We also did not rely on the reviews conducted by the Office of the Superintendent of Financial Institutions from 2012 to 2017.
Sources of criteria
The criteria used to assess the systems and practices selected for examination are found in the exhibits throughout the report.
Corporate governance
Corporate Governance Guideline, Office of the Superintendent of Financial Institutions, 2013
Organisation for Economic Co-operation and DevelopmentOECD Guidelines on Corporate Governance of State-Owned Enterprises, Organisation for Economic Co-operation and Development, 2015
20 Questions Directors Should Ask about Risk, Canadian Institute of Chartered Accountants, 2006
Meeting the Expectations of Canadians: Review of the Governance Framework for Canada’s Crown Corporations, Treasury Board Secretariat, 2005
Internal Control—Integrated Framework, Committee of Sponsoring Organizations of the Treadway Commission, 2013
Corporate Governance in Crown Corporations and Other Public Enterprises—Guidelines, Department of Finance and Treasury Board, 1996
Practice Guide: Assessing Organizational Governance in the Private Sector, The Institute of Internal Auditors, 2012
Practice Guide: Assessing Organizational Governance in the Public Sector, The Institute of Internal Auditors, 2014
Strategic planning, performance measurement, and reporting
OECD Guidelines on Corporate Governance of State-Owned Enterprises, Organisation for Economic Co-operation and Development, 2015
Meeting the Expectations of Canadians: Review of the Governance Framework for Canada’s Crown Corporations, Treasury Board Secretariat, 2005
Guidelines for the Preparation of Corporate Plans, Treasury Board Secretariat, 1996
Recommended Practice Guideline 3, Reporting Service Performance Information, International Public Sector Accounting Standards Board, 2015
20 Questions Directors Should Ask about Risk, Canadian Institute of Chartered Accountants, 2006
Risk management
20 Questions Directors Should Ask about Risk, Canadian Institute of Chartered Accountants, 2006
Meeting the Expectations of Canadians: Review of the Governance Framework for Canada’s Crown Corporations, Treasury Board Secretariat, 2005
20 Questions Directors Should Ask about Strategy, 3rd edition, Canadian Institute of Chartered Accountants, 2012 (reissued by Chartered Professional Accountants of Canada)
Corporate Governance Guideline, Office of the Superintendent of Financial Institutions, 2013
Guideline E-21—Operational Risk Management, Office of the Superintendent of Financial Institutions, 2016
Internal Control—Integrated Framework, Committee of Sponsoring Organizations of the Treadway Commission, 2013
Framework for the Management of Risk, Treasury Board Secretariat, 2010
Enterprise Risk Management—Integrated Framework, Committee of Sponsoring Organizations of the Treadway Commission, 2004
Capital management
Minimum Capital Test Guideline, Office of the Superintendent of Financial Institutions, 2016
Guideline E-19—Own Risk and Solvency Assessment, Office of the Superintendent of Financial Institutions, 2015
Guideline E-18—Stress Testing, Office of the Superintendent of Financial Institutions, 2009
Standards of Practice for Dynamic Capital Adequacy Testing, Canadian Institute of Actuaries, 1998
Dynamic Capital Adequacy Testing, Revised Educational Note, Canadian Institute of Actuaries, 2013
Guideline E-23 (draft)—Enterprise-Wide Model Risk Management for Deposit-Taking Institutions, Office of the Superintendent of Financial Institutions, 2016
Management of mortgage loan insurance, securitization, and assisted housing
Guidelines for the Preparation of Corporate Plans, Treasury Board Secretariat, 1996
Plan-Do-Check-Act management model adapted from the Deming Cycle
Internal Control—Integrated Framework, Committee of Sponsoring Organizations of the Treadway Commission, 2013
Guideline B-21—Residential Mortgage Insurance Underwriting Practices and Procedures, Office of the Superintendent of Financial Institutions, 2014
Guideline E-21—Operational Risk Management, Office of the Superintendent of Financial Institutions, 2016
Organizational transformation
A Guide to the Project Management Body of Knowledge (PMBOK Guide), 4th edition, Project Management Institute, 2008
Policy on the Management of Projects, Treasury Board, 2013
Standard for Project Complexity and Risk, Treasury Board, 2010
8-Step Process for Leading Change, John P. Kotter, 2012
Global Technology Audit Guide 12: Auditing IT Projects, Institute of Internal Auditors, 2009
Control Objectives for Information and related TechnologyCOBIT 5 Framework, Information Systems Audit and Control AssociationISACA
Global Technology Audit Guide: Assessing Cybersecurity Risk—Roles of the Three Lines of Defense, Institute of Internal Auditors, 2016
Cyber Security Self-Assessment Guidance, Office of the Superintendent of Financial Institutions, 2013
Guideline B-10—Outsourcing of Business Activities, Functions and Processes, Office of the Superintendent of Financial Institutions, 2009
Global Technology Audit Guide (GTAG) 7: Information Technology Outsourcing, 2nd edition, Institute of Internal Auditors, 2012
Period covered by the audit
The special examination covered the period between 1 March 2017 and 29 December 2017. This is the period to which the audit conclusion applies. However, to gain a more complete understanding of the significant systems and practices, we also examined certain matters that preceded the starting date of this period.
Date of the report
We obtained sufficient and appropriate audit evidence on which to base our conclusion on 14 March 2018, in Ottawa, Canada.
Audit team
Office of the Auditor General of Canada:
Principal: Lissa Lamarche
Directors: Firyal Awada and Ewa Jarzyna
Audit Project Leader: Sebastien Defoy
Ernst & Young LLP:
Partners: Michel Bergeron and Pierre Lanctot
Senior managers: Mita Meyers and Hakim Nouira
Senior staff: Sarah Salame
List of Recommendations
The following table lists the recommendations and responses found in this report. The paragraph number preceding the recommendation indicates the location of the recommendation in the report, and the numbers in parentheses indicate the location of the related discussion.
Corporate management practices
| Recommendation | Response |
|---|---|
|
25. The Canada Mortgage and Housing Corporation should continue to engage with its Minister to ensure that directors appointed to the Board have the critical and desirable competencies as provided in the Board’s competency matrix. (22 to 24) |
The Corporation’s response. Agreed. The Canada Mortgage and Housing Corporation will continue to offer advice and support to the Minister on Board appointments by identifying competency and experience gaps and by working to ensure that future Board appointments address outstanding needs. The new Governor in Council appointment process guides appointments to the Corporation’s Board of Directors. The process is standardized across all government and Crown corporations, and allows for limited involvement from the organization. The selection approach is designed to identify qualified and diverse candidates. A selection committee, of which the Chair of the Board is the Corporation’s only representative, provides a list of recommended candidates to the Minister, who then recommends appointments to the Governor in Council. In December 2017, a number of appointments were announced to the Corporation’s Board, which will enhance the breadth and depth of knowledge on the Board. |
|
26. The Canada Mortgage and Housing Corporation should ensure that the Board of Directors seek additional training or external expertise in areas where gaps in competencies and knowledge are identified, particularly in IT, where a significant transformation is taking place and a significant part of the operations is being outsourced to a service provider. (22 to 24) |
The Corporation’s response. Agreed. The Canada Mortgage and Housing Corporation will continue to provide new Board members with relevant training information. All members have been provided with suggestions of appropriate courses designed to enhance competencies with respect to fulfilling their responsibilities on specific Board committees. The Corporation will further enhance its existing Board training menu and regularly identify suggested seminars and courses related to specific functional areas, hot topics, corporate priorities, and activities. |
|
27. The Board of Directors should play a more active role in setting the Canada Mortgage and Housing Corporation’s strategic direction and monitoring performance in the area of assisted housing. (22 to 24) |
The Corporation’s response. Agreed. The Canada Mortgage and Housing Corporation will assist the Board in fulfilling its responsibilities related to oversight and monitoring of performance with respect to the effective implementation and application of assisted housing policies, programs, and initiatives, including the National Housing Strategy. It will do this through its newly formed Assisted Housing Committee and through the new, qualified Board members appointed by the Minister in late 2017. The Corporation will provide regular related updates to the committee, including both reports to the federal government and a quarterly Assisted Housing Business Supplement that was introduced in the third quarter of 2017. The Corporation will also provide regular updates on activities for First Nations housing, including its support of initiatives being led by the Department of Indigenous Services Canada. |
|
28. The Board of Directors should ensure that it receives regular and comprehensive information on all aspects of the Corporation’s mandate as well as on all significant initiatives under way. (22 to 24) |
The Corporation’s response. Agreed. The Canada Mortgage and Housing Corporation will continue to assist the Board with its corporate governance responsibilities by ensuring that it receives comprehensive, relevant progress reports, including opportunities and issues, on key initiatives and other significant activities, on a regular basis. The Corporation will also continue to ensure that the Board is satisfied with the information provided to do its work. |
|
34. The Canada Mortgage and Housing Corporation should enhance its assessment and documentation with respect to the capital it requires to cover all material risks, including its reputational and strategic risks. (30 to 33) |
The Corporation’s response. Agreed. The Canada Mortgage and Housing Corporation will continue to enhance its Own Risk and Solvency Assessment documentation to include its assessment of capital requirements for reputational and strategic risks. This work will be completed for inclusion in its 2018 Own Risk and Solvency Assessment report, which will be finalized by the end of the fourth quarter of 2018. |
|
39. The Canada Mortgage and Housing Corporation should define additional ad hoc stress tests to further explore its main vulnerabilities, better understand its risk profile in the event of extreme crisis, and ensure that management actions could be deployed to respond proactively to such extreme scenarios. (30, 35 to 38) |
The Corporation’s response. Agreed. The Canada Mortgage and Housing Corporation will continue the work that is already under way to enhance its stress testing capabilities to support additional ad hoc stress tests. As part of this work, the Corporation will continue to strengthen its documentation with respect to management actions and readiness plans to respond proactively to extreme scenarios. This work will be completed by the end of the fourth quarter of 2018. |
Management of organizational transformation initiatives
| Recommendation | Response |
|---|---|
|
60. The Canada Mortgage and Housing Corporation should manage its transformation initiatives in an integrated way, have a project management team to oversee overall transformation project and change management activities, and report to the Board on the overall state of transformation initiatives. (57 to 59) |
The Corporation’s response. Agreed. The Canada Mortgage and Housing Corporation will leverage its existing enterprise portfolio management and organizational change management functions, both of which reside in the newly formed Strategy and Organizational Excellence Division, to provide project and change management oversight and facilitate reporting to senior management and the Board on the transformation projects, as identified by the Corporation’s Executive Committee. The new Strategy and Organizational Excellence Division will act as a conduit for all applicable business transformation offices (for example, the IT Transformation Office) to facilitate comprehensive transformation reporting. |
|
63. The Canada Mortgage and Housing Corporation should clearly define objectives, outcomes, performance measures, and expected benefits for each of its transformation projects and regularly report on its achievements. (57, 61 to 62) |
The Corporation’s response. Agreed. The Canada Mortgage and Housing Corporation will include critical and high-complexity transformation projects as part of its initiative prioritization and assessment process, commencing in the first quarter of 2018. This process documents project objectives and expected outcomes for all major business projects. It also requires the development and approval of a full business case, including the identification of the anticipated project value and benefits. As these projects progress, project value realization will be regularly reported to senior management and the Board, as appropriate. |