ARCHIVED - MAF Assessment: Privy Council Office - 2008

1.1 Leadership: Acceptable

• Executive leadership regularly communicates and encourages ongoing dialogue on public service values and ethics among employees.

1.2 Infrastructure: Acceptable

• Regarding Values and Ethics Plans, the organization is maintaining its Round V (2007-08) assessment of Strong. It has submitted a Management Assertion to CPSA that no significant changes have occurred within the organization to affect this rating.
• Risks in regard to possible breaches in public service values and ethics are regularly assessed, documented and followed up with mitigation plans and action by management.

1.3 Culture: Strong

• Regarding the Current State of Organizational Values and Ethics, the organization is maintaining its Round V (2007-08) assessment of Strong. It has submitted a Management Assertion to CPSA that no significant changes have occurred within the organization to affect this rating.

2.1 PAA Consistency: Acceptable

• The Strategic Outcome statement(s) can be understood within and outside the department as a benefit to Canadians, however its/their clarity should be improved.

2.2 Measurability: Acceptable

• An adequate Program Activity Architecture has been developed with some issues to be resolved.

2.3 Quality:

• The performance indicators are not clear and cannot be used for data collection to provide reliable insight into program effectiveness.

3.2 Governance Structure: Acceptable

• Adequate management oversight of the organization's program activities and underlying programs is evident.
• Organization's corporate governance structure is generally aligned to the organization's PAA.
• Recordkeeping is generally complete and current. (minutes of meetings and records of discussion, decision, and follow-up).
• Senior corporate management structure (e.g., committees) interacts with and provides oversight to the supporting governance structure.
• Senior corporate management structure or subordinate governance structure (e.g., committees) meet regularly.

4.1 Leadership of Priority Initiatives: Acceptable

• The organization is effectively leading its priority interdepartmental initiatives.

4.2 Participation in Priority Initiatives: Acceptable

• The organization's commitments are clear and are consistent with its role.

TBS has assessed PCO with regard to its leadership of the Afghanistan (Acceptable) and Public Service Renewal (Acceptable) initiatives, and its participation in the Web of Rules effort (Acceptable).

5.1 Supporting Information: Acceptable

• Adequate information is submitted for business cases.
• Organization has established a capacity to assemble usually accurate, reliable and complete supporting information in TB submissions.
• Policy and budget authorities are usually identified.
• Response to TBS comments is appropriate.
• Submission contains an adequate level of detail.
• The organization is highly responsive to TBS feedback.

5.2 Analysis: Acceptable

• Established capacity for appropriate responses to TBS comments is acceptable.
• Established capacity in the understanding of external pressures exists.
• Established capacity to analyze value for money, effectiveness and efficiency is evident.
• The correct policy authorities are used.

5.3 Consultations: Acceptable

• Established capacity to initiate consultations with TBS with sufficient lead time is evident.

5.4 Quality control: Acceptable

• All important information is usually included in the first draft.
• Established capacity for consistency of information throughout documents is evident.
• Generally rigorous and effective quality control process is in place and is usually followed for TB submissions.
• Good writing and translation standard have been used.
• TBS feedback is usually fully addressed.

6.1 Quality:

• No evaluation was shared or submitted to TBS for review.

6.3 Coverage:

• No evaluation plan has been developed or shared with TBS.

7.1 MRRS Basis: Acceptable

• If any changes in plans are apparent, the DPR discusses some of them and how they affected performance.
• Some performance is reported against plans and expected results from the RPP.

7.2 Credible information: Acceptable

• DPR generally provides independently verifiable evidence-based performance information. Some information on the validity and credibility of data used is provided.
• DPR is not sufficiently based on the PAA, i.e. performance is not reported consistently by Program Activity (PA) or at the PA level.
• Informative financial tables are included and explained with text, as necessary.

7.3 Context: Acceptable

• Comparisons are generally effectively and consistently used in the DPR.
• DPR is not balanced – a few negative aspects of performance may be reported but insufficient explanation is provided.

8.1 Change plan: Acceptable

• The organization has the capacity to evaluate whether or not change is required.

8.2 Engagement: Acceptable

• Employees are engaged in the strategy development phase.

8.3 Assessment: Acceptable

• Change plans and strategies are included in Performance Management Agreements of Senior Executives.
• Change plans and strategies are priorities across the organization.

9.1 Engagement: Acceptable

• Accountability for key risks appears to be inconsistently assigned to senior management.
• Senior management encourages effective Risk Management and a risk-smart culture.
• Senior management ensures that the organization’s Risk Management approach is tailored to the specific needs of the organization.
• Senior management has reviewed/approved the Corporate Risk Profile within the past year.
• Senior management reviews the organization’s Risk Management approach within the current three-year planning cycle.
• The organization has a common risk assessment approach and it has been approved by senior management.

9.2 Implementation: Acceptable

• Risk Management guidance and tools that enable the organization’s risk management approach are made available to staff.
• The Corporate Risk Profile is systematically (horizontally and vertically) implemented into most operational levels across the organization.
• The organization’s Risk Management approach is inconsistently communicated to staff and stakeholders.

9.3 Integration: Acceptable

• It is not evident that the organization makes course corrections based on Risk Management performance and new information.
• Operational level risks are prioritized into key risks.
• Risk information and Risk Management principles are adequately captured in senior management reporting.
• Risk information and Risk Management principles influence planning and resource allocation decisions.
• Risk information is adequately consulted for senior management decision-making.
• The organization makes adequate course corrections based on Risk Management performance and new information.

9.4 Continuous Improvement: Acceptable

• Corporate risks are inconsistently linked to the organization’s strategic outcomes.
• Key risk information was adequately gathered from internal sources of the organization for preparing the CRP.
• Most relevant external sources are consulted during the development of the organization’s CRP.
• The CRP provides a reliable assessment of the quality of risk information used.
• The organization adequately builds on past experience, better practice, and adjusts to fit any changes in management structures, priorities or strategic direction.
• The organization has implemented most recommendations provided during its last MAF assessment.

The Privy Council Office should be recognized for focusing its risk management efforts over the past year on completing an update of the organization’s Corporate Risk Profile. This iteration of the CRP included consultation with a number of individuals from senior management as well as an assessment of the organization’s risk tolerance in key risk areas.

10.1 Fair: Acceptable

• Organization is undertaking action to improve the classification program in accordance with its level of risk.
• Evidence shows that labour relations matters are consistently and appropriately managed/addressed.
• Evidence shows that the organization exceeds standards of timeliness in payments to employees.
• Evidence shows that the organization is in compliance with Labour Relations and Compensation Operations direction (terms and condition of employment, collective agreements and/or applicable legislation).

10.2 Enabling: Strong

• Organization demonstrates the necessary linguistic capacity to provide personal and central services and supervision in both official languages.
• Organization is representative of all four employment equity designated groups.
• Promotions among employment equity groups are greater than or equal to previous year's performance.
• Separations among employment equity groups are equal or greater than previous year's performance.
• Work instruments, electronic systems and communications with employees are always or nearly always available in both official languages.

10.3 Healthy and safe: Opportunity for Improvement

• Evidence indicates that the organization fails to put in place a managed program to protect employees' occupational health and safety.
• The majority of employees feel recognized for positive performance.

11.1 Productive: Strong

• A significant number of employees indicate their organization supports their career development and learning needs.

11.2 Principled: Acceptable

• Communications with and services to the public in both official languages are always or nearly always available.
• Employees consider that they always or nearly always can communicate in the official language of their choice within their organization and work instruments, electronic systems and communications in both official languages are always or nearly always available.
• Necessary linguistic capacity is in place as is shown by the vast majority of incumbents of bilingual positions who meet the language requirements of their position.
• Progress against the previous year's performance on recruitment, promotion and separation for employment equity groups is less than the organization's average for all employees.
• Promotions among employment equity groups are greater than or equal to representation.

11.3 Sustainable: Acceptable

• Evidence indicates human resources planning integrated with business planning is generally in place and governance/organizational infrastructure generally exists to support it.

11.4 Adaptable: Acceptable

• A sufficient number of employees indicate their organization encourages continuous learning, improvement and innovation.

12.1 Governance: Acceptable

• IM requirements are integrated as a part of the approval, development, implementation, evaluation, and reporting of departmental policies, programs, services, or projects.
• IM is represented in the corporate-wide governance structure and / or in the corporate-wide governance or approval committee(s).
• Responsibilities are identified for IM policy development and implementation consistent with the GC IM Strategy and policy instruments.
• Extensive participation is evident in GC-wide approaches and initiatives related to developing, implementing, sharing, and leveraging IM policies and practices.

12.2 Strategy: Acceptable

• A current and active IM strategy identifies support to business priorities and operations, information needs and accountabilities, IM policy considerations and is partially integrated with other corporate strategies, plans and planning cycles.
• An IM strategy implementation plan, including some timelines and resources, is underway and some achievements to date are identified.
• An IM awareness campaign or strategy is underway and all staff and executives are informed of their IM roles, responsibilities and accountabilities, and most have attended awareness / training sessions.

12.3 Privacy Act: Acceptable

• Organization submitted an Annual Report to Parliament but did not address all of the mandatory reporting requirements.
• Some collections of personal information under the control of the organization have not been appropriately identified or described in accordance with the Privacy Act.

12.4 Access to Information Act: Acceptable

• Most of the organization's functions, programs, activities and related information holdings have been appropriately identified and described in its 2008 Chapter of Info Source: Sources of Federal Government Information.
• Organization submitted an Annual Report to Parliament but did not address all of the mandatory reporting requirements.
• Organization‘s 2008 Chapter in Info Source: Sources of Federal Government Information meets most of Treasury Board Secretariat requirements.

13.1 Leadership: Strong

• The senior official has responsibility and accountability for the full scope of information technology responsibilities and ensures that information technology supports organizational outcomes.
• Organization actively participates and demonstrates leadership in setting government-wide directions for information technology.

13.2 Planning: Acceptable

• Acceptable information technology plan is in place that aligns with the government-wide directions for information technology and departmental business needs.
• Organization has aligned corporate and information technology governance structures and has an integrated planning process.

13.3 Value: Opportunity for Improvement

• Organization is making efforts to appropriately use and plan for further use of information technology shared services.
• Organization devotes adequate management attention to service costing, asset management, performance measurement and reporting to ensure value delivery.

14.1 Investment Planning: Acceptable

• The investment planning process integrates investments decisions across all asset classes.
• The organization’s investment planning document has not been approved by the proper authority.
• The organization’s investment planning process considers investments over multiple years.

14.3 Materiel Management: Acceptable

• All elements of a materiel management framework are evident.
• Comprehensive internal policies are documented and disseminated.
• Governance structures, approval processes and authority limits are documented and disseminated.
• Some indicators of materiel performance are monitored.

14.3 Materiel Management PCO has a reliable materiel management information system. Though not fully integrated, it is appropriate in relation to the size and complexity of the organization.

16.1 Governance and Oversight: Acceptable

• Effective and accountable procurement management processes and controls are in place (e.g., contract review mechanisms, documented decision making, guidance documents, appropriate delegation instruments or proper use of delegated authorities).

16.2 Meeting Operational Requirements: Acceptable

• Informed decision making and oversight exist.
• Results and reviews are used to continuously adjust current procurement management activities and future procurement plans.
• Efficient and integrated procurement information systems and processes are in place.
• Procurement processes that contribute to cost savings and value for money are in use.
• Consistent procurement training is evident.
• Clear links to human resources planning are established (e.g., succession planning and recruitment strategies for procurement staff).
• Qualified procurement human resources exist.
• Some staff enrolled in the Professional Development and Certification program.
• Timely and accurate procurement financial and non-financial reports have been submitted.

During the review period, PCO introduced a number of procurement improvements. It reviewed and renewed its Contract Review Committee, updated its Policy on Service Contracts, posted a new Contracting Guide for Managers on its Intranet site and launched training sessions for operational managers.

17.1 Authorities and Policies: Acceptable

• Audit report results show evidence of good financial management practices.
• Departmental procedures, tools, training and support for those individuals delegated with Section 34 authority show evidence of good financial management practices.
• Departmental processes for classification of moneys, internal controls for receiving and recording money and depositing money show evidence of solid financial management practices.
• Departmental processes for informing those delegated with Section 33 authority of their responsibilities and dealing with requests for payments that are problematic show evidence of deficiencies that are of some concern.
• Departmental processes to provide individuals delegated Section 33 authority with the information necessary to assess and approve transactions and to assess the adequacy of Section 34 account verification show evidence of good financial management practices.
• The reporting of external user fee information shows some omissions in relation to reporting guidelines.

17.2 Public Accounts Reporting: Strong

• Greater than 97% (Grade A) of Public Accounts plates completed on time.
• Several Financial Management Reporting System (CFMRS) coding errors.

17.3 Management Capacity: Strong

• A reasonable proportion of FIs and management team members in the financial management organization have current, approved learning plans.
• A significant amount of training is provided for the financial management organization.
• Many processes in support of a sound succession plan for key positions are in place.
• Positions, the duties of which are being performed by an individual indeterminately appointed to that position, comprise all, or almost all, of the FI segment of the financial management organization.
• Positions, the duties of which are being performed by an individual indeterminately appointed to that position, comprise all, or almost all, of the positions on the management team of the financial management organization.

17.4 Financial Statements: Strong

• The Financial Statements are compliant with Treasury Board Accounting Standard 1.2 – Departmental and Agency Financial Statements and reporting deadlines were met.
• There is no known financial internal control weaknesses.
• Voluntary participation in the audited departmental financial statements initiative as evidenced by a strong departmental commitment and an existing detailed action plan.

17.5 Internal Reporting: Strong

• The internal financial reporting package is accompanied by a comprehensive discussion and analysis.
• The internal financial reporting package is presented to senior management less than 15 calendar days after period end.
• The internal financial reporting package is presented to senior management ten or more times per year.
• The process for reviewing information before it is presented to senior management to ensure no material errors or omissions is weak.
• The scope of the internal financial reporting package is comprehensive.

17.6 Other Initiatives: Acceptable

• The organization has identified financial management initiatives in such areas as policies, reporting, systems and community development.

While the PCO maintained an overall rating of Acceptable it made significant improvements in the quality, timeliness and accuracy of reporting for the Public Accounts and in the strength of its financial management capacity.

18.1 Internal Audit governance: Opportunity for Improvement

• There is an approved Internal Audit Charter in line with the 2006 Policy on Internal Audit.
• The Implementation Plan for the required policy elements does not exist.
• Absence of ongoing monitoring of the Implementation Plan and/or progress is not being achieved.
• Chief Audit Executive reports solely and substantively to the Deputy Head.
• An independent Departmental Audit Committee has either recently been established or is scheduled to be in place and is on track with planned timelines.
• There is a Departmental Audit Committee Charter in line with the 2006 Policy on Internal Audit.

18.2 Internal Audit Professional Practices: Opportunity for Improvement

• The Risk-Based Audit Plan was approved by the Deputy Head and sent to the Office of the Comptroller General in an untimely manner.
• Annual Risk-Based Audit Plan methodology is, for the most part, evident and applied.
• There is evidence of preparation to provide for holistic assurance.
• There is limited information of the planned use of all audit function resources.
• No identification of post-engagement follow-up activities.
• Vast majority of planned work is on audit assurance versus other types of activities.
• No identification of continuity with previous year’s work.
• Approved assurance products are consistent with policy and internal audit standards requirements.
• Reasonable completion rate of assurance products (number of assurance audit reports) against 2007-2008 Risk-Based Audit Plan.
• Internal Quality Assurance and Improvement Program is well documented and in place.
• Assurance products (reports) are produced in a reasonably timely manner.
• Approved assurance products are made accessible to the public in a reasonably timely manner.
• Post-engagement follow-up process is in draft or partially documented, and some recommendations are followed up using a risk-based approach.
• The department or agency provides notification to the Treasury Board Secretariat on issues of importance on an ad hoc basis or is aware of this requirement.
• The department or agency provides sufficient advanced notification to the Treasury Board Secretariat of the posting of reports.

18.3 Administration of the Internal Audit Function: Acceptable

• Some elements of a comprehensive Human Resources Plan have been documented, and evidence of recruitment and external resourcing activity exists.
• Planned spending, * was given to the Office of the Comptroller General. When comparing current spending of 2008-2009 with planned financial resources of 2007-2008, resource levels identified exceeds the resource level identified in 2007.
• Planned FTEs dedicated to internal audit have been maintained comparatively to 2007-2008. They meet the resource level identified in the planned internal audit function’s budget for 2008-2009.

18.4 Internal Audit Performance: Acceptable

• A Chief Audit Executive Annual Report for 2007-2008 was presented to the Departmental Audit Committee and the Deputy Head and submitted to the Office of the Comptroller General.
• Limited periodic reporting on the follow-up of Management Action Plans.

The organization has an approved Internal Audit Charter and the Chief Audit Executive reports solely and substantively to the Deputy Head. Progress is being made on implementing the Departmental Audit Committee and the majority of audits planned in 2007-2008 were completed.

19.1 Departmental Security Program: Acceptable

• Organization has in place a fully developed security program that comprises key policy elements and is administered by an appointed Departmental Security Officer (DSO) who is positioned to provide strategic advice and guidance to senior management.
• No significant deficiencies in meeting key policy requirements for the departmental security program.
• Organization's security strategy is completely aligned and integrated with its corporate priorities and business plan.

19.2 Management of IT Security (MITS): Acceptable

• Organization has achieved the three priority objectives that form the foundation for Management of Information Technology Security (MITS) and complies with most MITS requirements.
• No significant deficiencies in meeting key MITS requirements.

19.3 Business Continuity Planning (BCP): Opportunity for Improvement

• Organization has partially developed measures to provide for the continuity of critical business operations and services.
• Business Continuity Planning (BCP) program governance has been established.
• Business Impact Analysis (BIA) has been completed to identify and prioritize the organization's critical services and assets.
• Significant deficiencies in establishing business continuity plans and arrangements.
• Maintenance cycle has been put in place to review, test and audit business continuity plans.
• Completed and approved plans are in place for Pandemic and Information Management / Information Technology emergency preparedness.

20.1 Management Engagement – Service and CLF: Acceptable

• There are expectations set by senior management for an institutional focus on meeting the needs of clients, specifically with respect to service standards and client satisfaction measurement.
• There are priorities and goals for service, but not always at the institutional level; these limited priorities and goals are set by senior management based on the use of limited performance evidence.
• There is a committee at the institutional level, composed of senior management accountable for service, which has a documented and communicated responsibility for making decisions about the overall management of service.
• There is limited monitoring of progress by senior management towards the achievement of the goals for service, making course correction difficult.
• There is little monitoring by senior management to ensure that the requirements of CLF 2.0 are being met institution-wide; there is limited information on which to make decisions and course correction.

20.2 Public/client views: Acceptable

• Evidence of incorporating feedback in the implementation of its services, programs, policies or initiatives.
• Little evidence of making consultation results available to the public.
• Many tools are used to obtain views from some clients.
• There are plans to obtain views from clients.
• There is a clearly identified target clientele for public consultations.

20.3 Official Languages: Strong

• Analysis of the Annual Review on OL shows the institution is fully meeting its obligations.
• Audits reveal very good performance in active offer and service delivery in both OL.
• No complaint or minimal number of founded complaints exits.
• The institution has the necessary linguistic capacity to serve the public in both OL.