ARCHIVED - MAF Assessment: Canadian Security Intelligence Service - 2008

1.1 Leadership: Strong

• This section is based on the assessment submitted by this separate employer to TBP.
• Executive leaders engage employees and stakeholders on an ongoing basis in ethical discussions and openly address organizational ethical issues through public statements and internal messaging.

1.2 Infrastructure: Strong

• This section is based on the assessment submitted by this separate employer to TBP.
• Managers are trained in and apply risk management concepts, techniques and tools.
• Organization monitors risks in regard to possible breaches of public service values and ethics, and risk management is integrated into decision making.
• Values and ethics plans or strategies are tailored to an organization's work, span several years, and measure results and are used to inform senior management on the state of the organization's values and ethics.

1.3 Culture: Acceptable

• This section is based on the assessment submitted by this separate employer to TBP.
• Managers and staff are encouraged to engage in values and ethics dialogue.
• Organization has a good understanding of the current state of public service values and ethics as evidenced by qualitative or quantitative information.
• Public service values and ethics are generally understood.
• Values and ethics principles are reflected in communications.

2.1 PAA Consistency: Acceptable

• The Strategic Outcome(s) reflects the departmental area of influence and is/are adequately aligned with the organization’s mandate.

2.2 Measurability: Acceptable

• All elements of the Program Activity Architecture are in alignment with the Strategic Outcome(s).

2.3 Quality:

• Expected results are not clear and distinct, and are not appropriate to their respective program descriptions.
• The performance indicators are not clear and cannot be used for data collection to provide reliable insight into program effectiveness.

3.1 Business Plan: Acceptable

• Organization's corporate business plan is well aligned to corporate priorities.
• Sector or branch business plans are generally aligned with the corporate business plan.

3.2 Governance Structure: Acceptable

• Adequate management oversight of the organization's program activities and underlying programs is evident.
• Management decisions and interventions are generally proactive and timely.
• Organization's corporate governance structure is fully aligned to the organization's PAA.
• Recordkeeping is complete and timely. It clearly outlines accountabilities for follow-up action.
• Resource reallocation is generally proactive when or where required.
• Senior corporate management structure (e.g., committees) interacts with and provides oversight to the supporting governance structure.
• Senior corporate management structure or subordinate governance structure (e.g., committees) meet regularly.

3.1 - CSIS’ Corporate business plan needs to better integrate human resources, IM/IT, communications and other key corporate plans.

4.2 Participation in Priority Initiatives: Acceptable

• The organization contributes effectively to priority interdepartmental initiatives.
• The organization provides regular performance and risk information to the lead.
• The organization's commitments are clear and are consistent with its role.
• Senior management has made some efforts to engage employees with regards to Public Service Renewal.

CSIS has been assessed for its participation in the following initiatives: Web of Rules (Opportunity for Improvement); Public Service Renewal (Opportunity for Improvement), and Afghanistan (Strong).

5.1 Supporting Information: Strong

• Detail is robust.
• Explanation for the level of resources requested is fulsome.
• Response to TBS comments is excellent.
• Supporting information in TB submissions is always very accurate, reliable and complete.
• The organization is highly responsive to TBS feedback.

5.2 Analysis: Acceptable

• Appropriate and complete links to MRRS, strategic objectives, etc., are used.
• Appropriate consideration is given to a range of issues, such as gender-based analysis and sustainable development implications.
• Established capacity for analysis on implementation is evident.
• Established capacity for options analysis is demonstrated.
• Established capacity in the understanding of external pressures exists.
• Established capacity to analyze value for money, effectiveness and efficiency is evident.

5.3 Consultations: Strong

• Consultations are always on time (6 weeks or earlier before TB meetings).
• Consultations with central agencies are planned and conducted in a timely manner with sufficient lead time.
• Organization is always, or virtually always, able to avoid lateness by predicting and planning for uncontrollable factors.

5.4 Quality control: Strong

• A highly rigorous and effective quality control process is followed for all TB submissions.
• All important information is usually included in the first draft.
• Clarity and consistency of language are good.
• Description of resource requirements is clear.
• Submissions always have SFO or Head of Evaluation sign offs when appropriate.
• TBS feedback is always fully addressed.
• Very good writing and translation standard has been demonstrated.

8.1 Change plan: Strong

• Established and robust capacity is in place to evaluate whether or not change is required.
• The organization has the capacity to evaluate whether or not change is required.

8.2 Engagement: Strong

• A learning culture exists within the organization.
• Comprehensive change management related training programs are available throughout the organization.
• Employees and stakeholders are actively engaged at all phases and are committed to advancing strategies and initiatives.

8.3 Assessment: Strong

• Assessment plans exist and are comprehensive in scope and detail.
• Change plans and strategies are included in Performance Management Agreements of Senior Executives.
• Course adjustments and improvements to strategies are made regularly.

• *

10.1 Fair: Strong

• This section is based on the assessment submitted by this separate employer to TBP.
• Evidence shows that labour relation matters are proactively and innovatively managed/addressed.

10.2 Enabling: Strong

• The Official Languages portion of this evaluation has been made by CPSA.
• This section is based on the assessment submitted by this separate employer to TBP.
• Organization demonstrates the necessary linguistic capacity to provide personal and central services and supervision in both official languages.
• Organization is representative of all four employment equity designated groups.
• Work instruments, electronic systems and communications with employees are always or nearly always available in both official languages.

10.3 Healthy and safe: Strong

• This section is based on the assessment submitted by this separate employer to TBP
• Evidence shows that the organization has in place a well-managed program to protect employees' occupational health and safety which follows or establishes best practices in occupational health and safety.
• The majority of employees feel recognized for positive performance.

11.1 Productive: Strong

• This section is based on the assessment submitted by this separate employer to TBP.
• A significant number of employees indicate their organization supports their career development and learning needs.

11.2 Principled: Strong

• The Official Languages portion of this evaluation has been made by CPSA.
• Communications with and services to the public in both official languages are always or nearly always available.
• Employees consider that they always or nearly always can communicate in the official language of their choice within their organization and work instruments, electronic systems and communications in both official languages are always or nearly always available.
• Necessary linguistic capacity is in place as is shown by the vast majority of incumbents of bilingual positions who meet the language requirements of their position.
• Organization is representative of all four employment equity designated groups.

11.3 Sustainable: Acceptable

• This section is based on the assessment submitted by this separate employer to TBP.
• Evidence indicates human resources planning integrated with business planning is generally in place and governance/organizational infrastructure generally exists to support it.

11.4 Adaptable: Acceptable

• This section is based on the assessment submitted by this separate employer to TBP.
• A sufficient number of employees indicate their organization encourages continuous learning, improvement and innovation.

12.1 Governance: Strong

• IM requirements are fully integrated as a part of the approval, development, implementation, evaluation, and reporting of departmental policies, programs, services, and projects and mechanism are in place to continuously evaluate and modify the requirements.
• IM is fully represented in the corporate-wide governance structure and in the corporate-wide governance or approval committee(s).
• Responsibilities are identified for IM policy development and implementation is wholly consistent with the GC IM Strategy and policy instruments.

12.2 Strategy: Acceptable

• An approved and resourced IM strategy identifies support to business priorities and operations, information needs and accountabilities, IM policy considerations and is integrated with corporate strategies, plans, and planning cycles.
• An IM strategy implementation plan, including some timelines and resources, is underway and some achievements to date are identified.
• IM awareness activities are underway in the department to help staff and executives understand their IM roles, responsibilities and accountabilities.

12.3 Privacy Act: Acceptable

• Organization submitted an Annual Report to Parliament but did not address all of the mandatory reporting requirements.
• Most of the organization’s collections of personal information are described in registered Personal Information Banks and/or Classes of Personal Information in accordance with the requirements of the Privacy Act.

12.4 Access to Information Act: Opportunity for Improvement

• Organization submitted an Annual Report to Parliament but did not address all of the mandatory reporting requirements.
• A significant number of institution-specific Classes of Records do not meet Treasury Board Secretariat requirements.
• Although the organization has made several improvements to its 2008 Chapter of Info Source: Sources of Federal Government Information, revisions are still necessary to meet all Treasury Board Secretariat requirements.

Although the overall rating for CSIS is Acceptable, the Service has not met several of the assessed statutory requirements of the Access to Information Act.

13.1 Leadership: Acceptable

• The senior official has responsibility and accountability for the full scope of information technology responsibilities and ensures that information technology supports organizational outcomes.
• Adequate participation in setting government-wide directions for information technology is evident.

13.2 Planning: Strong

• A comprehensive information technology plan is in place and it aligns with the government-wide directions for information technology and with departmental business needs.
• Information technology management position is held by a highly engaged senior official designated within the corporate governance structure and related planning processes.

13.3 Value: Strong

• Organization analyzes and plans for the appropriate use of information technology shared services to an optimal extent.
• Organization demonstrates management commitment to service costing, asset management, performance measurement and reporting to ensure value delivery.

14.1 Investment Planning: Acceptable

• The organization’s investment planning documents do not cover all asset classes.
• The organization’s investment planning process considers investments over multiple years.
• The organization has a planning document that ranks priority investments.
• Organizational priorities and areas of highest risk are identified and guide investment decisions.

14.2 Real Property Management: Acceptable

• All elements of a real property management framework are implemented.
• Governance structures, approval processes and authority limits are documented and disseminated.
• Comprehensive internal policies are documented and disseminated.
• Reliable and integrated information systems are in place.
• Indicators of real property performance are monitored and performance measurement is ongoing.
• Certification of information in the DFRP is received and accepted.

14.3 Materiel Management: Acceptable

• All elements of a materiel management framework are evident.
• Governance structures, approval processes and authority limits are documented and disseminated.
• Comprehensive internal policies are documented and disseminated.
• Reliable and sufficiently integrated information systems are in place.
• Some indicators of materiel performance are monitored.

15.1 Governance and Oversight: Acceptable

• Business cases, which define expected outcomes, are required to support proposals for major projects.
• There is evidence of formal project governance and oversight mechanisms and that approved projects are generally linked with the strategic plans and priorities of the organization through established organization-wide procedures. Approval and corrective action decisions are documented.
• There is no evidence that the organization has exceeded Treasury Board approval limits.

15.2 Effective Management of Project Resources: Acceptable

• Adequate processes/procedures exist to ensure that planned projects have the required resources to achieve expected outcomes.
• The funding models used for projects support the achievement of expected project outcomes and cost estimates are generated at the work package level and consider historical data and/or industry benchmarks.
• There is no evidence that the organization has failed to meet TB conditions regarding projects.
• While there is evidence that some managers prepare a staffing plan, it is not required prior to project execution.

15.3 Effective Management of Project Results: Acceptable

• The organization requires that project milestones, deliverables and outcomes are documented for major projects.
• There is evidence of organization-wide procedures and processes which communicate project monitoring and performance information to project managers and project oversight mechanisms.
• There is evidence that the organization monitors project performance and uses this information to support corrective action.

16.1 Governance and Oversight: Acceptable

• Clear links have been established between procurement activities and the organization-wide program plans, priorities and long-term investments.
• Effective and accountable procurement management processes and controls are in place (e.g., contract review mechanisms, documented decision making, guidance documents, appropriate delegation instruments or proper use of delegated authorities).

16.2 Meeting Operational Requirements: Acceptable

• Efficient and integrated procurement information systems and processes are in place.
• Mandatory training underway.
• Procurement processes that contribute to cost savings and value for money are in use.
• Qualified procurement human resources exist.
• Results and reviews are used to continuously adjust current procurement management activities and future procurement plans.
• Some staff enrolled in the Professional Development and Certification program.
• Timely and accurate procurement financial and non-financial reports have been submitted.

17.1 Authorities and Policies: Acceptable

• Audit report results show evidence of deficiencies that are of some concern.
• Departmental procedures, tools, training and support for those individuals delegated with Section 34 authority show evidence of solid financial management practices.
• Departmental processes for classification of moneys, internal controls for receiving and recording money and depositing money show evidence of solid financial management practices.
• Departmental processes for informing those delegated with Section 33 authority of their responsibilities and dealing with requests for payments that are problematic show evidence of solid financial management practices.
• Departmental processes to provide individuals delegated Section 33 authority with the information necessary to assess and approve specific transactions and to assess the adequacy of Section 34 account verification show evidence of solid financial management practices.

17.2 Public Accounts Reporting: Strong

• Greater than 97% (Grade A) of Public Accounts plates completed on time.
• Minimal Central Financial Management Reporting System (CFMRS) coding errors.

17.5 Internal Reporting: Acceptable

• The internal financial reporting package is accompanied by a good discussion and analysis.
• The internal financial reporting package is presented to senior management eight to nine times per year.
• The internal financial reporting package is presented to senior management less than one month after period end.
• The process for reviewing information before it is presented to senior management to ensure no material errors or omissions is well established.
• The scope of the internal financial reporting package is comprehensive.

17.6 Other Initiatives: Acceptable

• Evidence of some initial measures taken towards implementing the Guide to Costing.

The Service's rating has decreased from a Strong to Acceptable.  Given the sensitive nature of the Service's operations, the two areas that need to be highlighted are the stability of the financial management organization and internal controls over financial reporting.

18.1 Internal Audit governance: Acceptable

• There is an approved Internal Audit Charter in line with the 2006 Policy on Internal Audit.
• The Implementation Plan covers all of the required policy elements.
• Ongoing monitoring of, and progress in implementing, key elements of the plan are on track with planned timelines.
• Chief Audit Executive reports solely and exclusively to the Deputy Head.
• An independent Departmental Audit Committee has either recently been established or is scheduled to be in place and is on track with planned timelines.
• There is an approved Departmental Audit Committee Charter in line with the 2006 Policy on Internal Audit.
• There is an approved Departmental Audit Committee Annual Plan for fiscal year 2008-2009.
• There is a written statement indicating that a Departmental Audit Committee Annual Report will be produced for fiscal year 2008-2009 and future years.

18.2 Internal Audit Professional Practices: Acceptable

• The Risk-Based Audit Plan was approved by the Deputy Head and sent to the Office of the Comptroller General in a timely manner.
• Annual Risk-Based Audit Plan methodology is evident and applied.
• There is evidence of preparation to provide for holistic assurance.
• Majority of planned work is on audit assurance versus other types of activities.
• There is limited identification of post-engagement follow-up activities.
• Approved assurance products are consistent with policy and internal audit standards requirements.
• High completion rate of assurance products (number of assurance audit reports) against 2007-2008 Risk-Based Audit Plan.
• Internal Quality Assurance and Improvement Program is well documented and in place.
• Assurance products (reports) are produced in a very timely manner.
• Post-engagement follow-up process is well documented, and recommendations are followed up using a risk-based approach.
• The department or agency provides notification to the Treasury Board Secretariat on issues of importance on an ad hoc basis or is aware of this requirement.

18.3 Administration of the Internal Audit Function: Strong

• Recruitment and external resourcing activities are guided by a documented Human Resources Plan.
• Investment in Certified Internal Auditor certification, learning and training exceeds 10% of FTE salaries.
• Planned FTEs dedicated to internal audit have been maintained comparatively to 2007-2008. They meet the resource level identified in the planned internal audit function’s budget for 2008-2009.
• Planned spending, *, was given to the Office of the Comptroller General. When comparing current spending of 2008-2009 with planned financial resources of 2007-2008, resource levels identified exceeds the resource level identified in 2007.

18.4 Internal Audit Performance: Acceptable

• A Chief Audit Executive Annual Report for 2007-2008 was presented to the Departmental Audit Committee and the Deputy Head and submitted to the Office of the Comptroller General.
• Extensive periodic reporting on the follow-up of Management Action Plans is evident.

The Service has made progress in the areas of Internal Audit Governance, Professional Practices, and Management of the IA Function.

19.1 Departmental Security Program: Strong

• Organization's security program is fully developed and sustainable, and comprises all key policy elements.
• Organization demonstrates leadership and contributes to the government-wide security program.
• Organization's security strategy is completely aligned and integrated with its corporate priorities and business plan.

19.2 Management of IT Security (MITS): Acceptable

• Organization has achieved the three priority objectives that form the foundation for Management of Information Technology Security (MITS) and complies with most MITS requirements.
• No significant deficiencies in meeting key MITS requirements.

19.3 Business Continuity Planning (BCP): Opportunity for Improvement

• *
• Some deficiencies in meeting key BCP program requirements.
• Business Continuity Planning (BCP) program governance has not been fully established.
• Business Impact Analysis (BIA) has been completed to identify and prioritize the organization's critical services and assets.
• *
• Maintenance cycle has been put in place to review, test and audit business continuity plans.

20.1 Management Engagement – Service and CLF: Acceptable

• There are clear expectations set by senior management for an institutional focus on meeting the needs of clients, specifically with respect to service standards and client satisfaction measurement.
• There is a committee at the institutional level, composed of senior management accountable for service, which has a documented and communicated responsibility for making decisions about the overall management of service.
• There is monitoring by senior management to ensure that the requirements of CLF 2.0 are being met institution-wide; this information is generally used to make timely and proactive decisions and course correction.
• There is systematic and frequent monitoring of progress by senior management towards the achievement of the institution-wide goals for service, with timely course correction if necessary.

20.3 Official Languages: Strong

• Analysis of the Annual Review on OL shows the institution is fully meeting its obligations.
• In general, the institution has adequate resources to serve the public in both OL.
• No complaint or minimal number of founded complaints exits.

For Line of Evidence 20.1, CSIS provided a self-assessment for Questions 1-3. TBS assessed CSIS with regard to Question 4 and Line of Evidence 20.3.