Audit of Employee Expense Reimbursement and Acquisition Card Management - Management Action Plan

Publication type
Audit
Recommendation Planned Actions to Support the Recommendation Target Milestone Completion Accountability Target Overall Completion

Recommendation 1
(High Risk):

Finance should establish a standardized approach for documenting and maintaining Section 32 authorizations, ensure OSFI-wide understanding of the requirements, and monitor for cost centre adherence.

Milestone 1

The Finance team will update written procedures for the processing of payment requisitions (i.e. expense reimbursements) prior to the Finance team exercising payment authority (re. Section33). Delegated managers and administrative co-ordinator will be required to provide Section 32 pre-authorization. The Finance team will communicate (e.g., intranet posting, information sessions) its revised requirements to delegated managers and administrative co-ordinators, reinforcing their roles, responsibilities and accountabilities for spending authorities. There will be ongoing follow-up with delegated managers and administrative co-ordinators (as required), to ensure compliance.

Milestone 2

Acquisition card management will be addressed on a separate track given that the process differs from expense reimbursements and that there is limited number of stakeholders who use or manage these cards. The Finance team will hold an information session with acquisition cardholders and delegated managers to provide a refresher on their roles and responsibilities under OSFI’s current acquisition card directive, including the requirement to provide Section 32 pre-authorization documentation for all card transactions.

This is a short-term action, with a more fulsome training and awareness session to be undertaken by March 31, 2022, following a full review of OSFI’s acquisition card directive in fiscal year 2021-22, as outlined in the management action plan outlined in Recommendation 2, Milestone 2.

Q1 2021-22 Q4 2020-21 Chief Financial Officer (CFO) Q1 2021-22

Recommendation 2
(Medium Risk):

Finance should update the Directive in consideration of relevant government guidance and current business practices, and ensure cardholders and applicable cost centre managers understand the requirements of the Directive.

Milestone 1

The Finance team will undertake a full review of OSFI’s Acquisition Card Directive. The review will duly consider government guidance (e.g., Directive on Payments) and include consultations with key stakeholders within OSFI (e.g., Procurement Services, Facilities Services). The Assistant Superintendent, Corporate Services, will approve the updated OSFI Acquisition Card directive.

Milestone 2

To raise awareness of key changes to the Directive, the Finance team will develop communications material, followed by an offering of training sessions for acquisition cardholders and delegated managers who use or manage OSFI acquisition cards. This work complements the management action plan outlined in Recommendation 1, Milestone 2.

Q3 2021-22 Q4 2021-22 CFO Q4 2021-22

Recommendation 3
(Medium Risk):

Finance should validate cardholder training records and signed declarations prior to the issuance of acquisition cards, and perform annual monitoring to ensure the continued need for existing cards.

Milestone 1

In February 2021, the Finance team updated its internal written procedures, which now stipulate that training requirements (re. with OSFI and with TBS) and the OSFI Cardholder Acknowledgement of Responsibilities and Obligations Form are duly completed, by both the acquisition cardholder and the delegated manager, prior to the issuance of acquisition cards.

Milestone 2

The Finance team has begun the process of reconfirming existing cardholder training records and updating signed declarations (as necessary). It has also started developing a tracking system that will formally record and monitor the status of these documents.

Milestone 3

The Finance team will implement a formal annual monitoring process to confirm the continued business requirement of each acquisition card with all cardholders and their delegated managers.

Q4 2020-21 Q1 2021-22 Q1 2021-22 CFO Q1 2021-22

Recommendation 4
(Medium Risk):

Finance should establish documented validation procedures, including controls over duplicate employee reimbursements, and establish reporting on the measures to senior management for effective oversight.

Milestone 1

The Finance team implemented a monthly monitoring process, which will serve to identify and correct any duplicate payments. The results of this review, supporting backup, and corrective measures (as necessary) are communicated via email to the Director Finance.

Milestone 2

The Finance team will document its validation procedures for employee expense reimbursements and acquisition card management (e.g., payment verification checklist). These will include an escalation process to address non-compliance issues (e.g., timeliness of receiving acquisition card registers). The Chief Financial Officer will approve these procedures.

Q4 2020-21
Q1 2021-22
CFO Q1 2021-22

Recommendation 5
(Low Risk):

Finance should establish clear guidance for what types of events and related hospitality expense transactions require executive disclosures, and monitor for completeness and consistency.

Milestone 1

The Finance team will review and update current guidelines to ensure that the types of events and related hospitality expenses that require proactive disclosure are clear and well understood.

Milestone 2

In the interim, to ensure completeness and consistency in its monthly disclosure, the Finance team has expanded its extract of hospitality expenditures to include all cost centres and will follow-up with delegated managers and administrative co-ordinators (as required), to properly record and report executive hospitality expenditures.

Q1 2021-22
Q4 2020-21
CFO Q1 2021-22