THE STANDING COMMITTEE ON AUDIT AND OVERSIGHT
EVIDENCE
OTTAWA, Tuesday, February 15, 2022
The Standing Committee on Audit and Oversight met with videoconference this day at 1 p.m. [ET] to supervise and report on the Senate’s internal and external audits and related matters; and, in camera, to supervise and report on the Senate’s internal and external audits and related matters.
Senator Marty Klyne (Chair) in the chair.
(The committee continued in camera.)
(The committee resumed in public.)
The Chair: Welcome to this meeting. I am Marty Klyne from Saskatchewan, chair of the Standing Committee on Audit and Oversight. I am joined today by other committee members: Senators Renée Dupuis, deputy chair from Quebec; David Wells, deputy chair from Newfoundland and Labrador; Percy Downe from Prince Edward Island; Madam Hélène F. Fortin, external member from Quebec; and Mr. Robert Plamondon, external member from Ontario.
For this portion of the meeting, we are welcoming the Senate’s external auditors from Ernst & Young, Suzanne Gignac, Partner, Assurance; and Niguel Givogue, Senior Manager, Assurance Services.
Thank you for accepting the committee’s invitation. We are looking forward to working with you and having the opportunity today to discuss the audit plan for the fiscal year 2021-22.
We have set aside an hour to meet with the external auditors, and we will suspend at 3 p.m. We will begin with our guests’ opening remarks. We will then move to questions and answers with members of the committee.
Ms. Gignac, the floor is yours.
Suzanne Gignac, Partner, Assurance, Ernst & Young LLP: Thank you. I am happy to be here with all of you. We will provide a brief summary of our 2022 audit plan, and then we will be happy to answer any questions you may have or any comments you would like to bring to our attention.
As mentioned, my name is Suzanne Gignac. I am the partner on the Senate audit engagement. I am here with Niguel Givogue, who is the senior manager on the audit. Niguel is available to answer any questions as well.
Each year we present our audit plans to provide those charged with governance the required information with respect to our audit and to answer any questions. We will walk through our executive summary, which you will find on page 3 of our audit plan in both the English and the French versions. Here we will summarize key areas of our audit, including our 2022 EY services; key aspects of our audit plan, including our planning materiality, our audit approach, areas of audit emphasis and significant risk, as well as our team, our fees and our timelines.
In the body of our report, you will find more detailed audit procedures performed in specific areas. In the appendices, we have included our engagement letter, some thought leadership and a list of items we are required to communicate to you at the planning stage of the audit.
Going through to page 3, on the left you have the purpose of our EY audit services. At the end of the audit, we plan to express an opinion on the financial statements of the Senate, as to whether they are fairly presented in all material respects in accordance with the Canadian Public Sector Accounting Standards.
We will also issue a communication to this committee summarizing the results of the audit. If we identify any significant deficiencies in controls, we will bring those to your attention in the report. We may also issue a management letter to management if we identify any controls or processes in areas of improvement which we feel could help in conducting the day‑to‑day activities of the Senate if any are identified.
In the middle of the summary page, we start with our planning materiality. At the start of each audit, we determine planning materiality. This is the level at which an error or an omission in the financial statements would be expected to influence the economic decisions of a user of those statements.
The audit industry has some general guidelines, as does EY’s audit methodology for planning materiality. Based on those guidelines, we have determined expenses to be an appropriate basis for materiality. The allowable range is 0.5% to 3%, and we have chosen 2.5%, or $2.6 million. We do work at levels much lower than this, and our testing includes random testing as well as dollar threshold driven sampling.
Moving down to our audit approach. We will be taking a substantive audit approach. This means that we will be doing detailed testing. We will be performing analytics and doing confirmations to support the audit. As noted, when we are doing detailed testing, the samples will be chosen both on a random and on a size basis. We will also gain an understanding and perform walk-throughs of key processes to understand the processes and risks associated with the audit.
We have identified areas of emphasis for focus through the audit. These include areas where there is more subjectivity or complexity. These would be areas such as accrued liabilities, vacation pay and compensatory leave, as well as significant expenses such as salaries and benefits and administrative expenses.
We are required to consider fraud as part of our audit as well. At this time, we have not identified any specific risk of fraud. However, as required by audit standards, we will perform procedures to cover the presumed risk of management override of controls as part of our audit. To cover this, we will leverage our GL Analyzer tool and perform detailed journal entry testing over transactions entered during the year.
A few other items to note in our executive summary include that the fee in our plan is in line with our fee proposed through the RFP process. Our team includes resources with prior-year experience working on the Senate audit. We plan to conduct the audit in June 2022 and report back to you in the fall.
That is all I wanted to highlight from our plan. We would be happy to answer any questions at this time.
The Chair: Thank you for that.
Senator Downe: I want to thank the auditors for being here today. As you know, the audit is a very important function in the Senate, indeed in all parliaments. To that end, as you prepare to perform your audit, do you do any overview or analysis of what other parliaments in the Westminster system are doing when they do their audits?
Ms. Gignac: Thank you for the question. We have a general global audit methodology at Ernst & Young, and so we leverage that to determine how we will actually do the audit. It’s governed by Canadian auditing standards as well. Generally, we make sure that our audit methodology follows the Canadian auditing standards and that we are meeting all of the requirements.
Other entities may have different auditing standards they are following. Ours is in accordance with the Canadian auditing standards.
Senator Downe: To that end, do you look at what is being done in the audits of the House of Commons or any of the provincial parliaments to see if there is anything that we may not be considering or that we should be looking at or something we are spending too much time on as things evolved?
Ms. Gignac: Thank you again. The details of how audits are conducted are not generally available to external auditors, but we do audits of many other entities such as the House of Commons. All of the audits within Canada would be following the same auditing standards. We are leveraging the same standards as those that are being used for all of the other entities, such as the House of Commons, in Canada.
Senator Downe: I note your audits have been, in my opinion, very well done over the last number of years, but given the problems particularly in the Senate over the last number of years, we have to be beyond reproach. I am sure you read the newspapers and watch the news as well, so you would know the problems we have had in the Senate in the past. That’s why the high quality of the audits and the fact that there have been no significant problems that I have noted, or, indeed, you have noted, in the last number of years is very significant. Obviously, we want to continue that high standard. That’s why I was curious as to what standards are being used in the House of Commons and across Canada. I’m sure you are on top of that, as you say, by the Canadian standards.
[Translation]
Senator Dupuis: Ms. Gignac, in your audit plan for the current year, could you tell me the information you have received to date about this new committee of ours, the Standing Committee on Audit and Oversight? Now that the committee exists, what does it change in your way of conducting the external audit?
Ms. Gignac: Thank you for the question.
[English]
I don’t believe it will change the way in which we will actually do the audit. We will report to you as opposed to a different committee, but what we will actually do from an audit perspective does not change.
[Translation]
Hélène F. Fortin, external committee member: Ms. Gignac, I was wondering whether the fact that you have not sent a letter to management… I will continue in English because I am more familiar with the terms in English.
[English]
I understand that in the past you have not issued to management, or those charged with governance, a communication with respect to significant deficiencies related to internal controls or any other deficiencies identified during the course of your audit. I was wondering if you might have identified deficiencies that are not necessarily significant or significant enough to be worthy of being communicated to management.
On another topic which may be related, I also see that your audit approach is a substantive one as opposed to relying on internal controls. Is it because the internal controls were not complete enough for you to rely on, and are there any chances that you may consider using the internal controls going forward — not for this year’s audit, it’s very clear, but going forward?
Ms. Gignac: As you mentioned, we have not issued a management letter in the years that we have been the auditor. We have not identified things that we felt needed to come to that level of attention with management.
We may have had some discussions with management over the years about minor things we have noted. I don’t have those at the tip of my hand, and they wouldn’t be significant or something that would need to be raised at another level. But we do sometimes have discussions about how things are progressing within our entities.
As far as controls, we take a substantive-based approach primarily because it is most efficient from an audit perspective. It is not because we have necessarily determined the controls are not sufficient or anything to that effect. It’s simply that it is more efficient to take an audit approach that is substantive in this instance.
Ms. H. Fortin: Thank you.
Robert Plamondon, external committee member: I appreciate the reasons for taking a substantive approach, because it is most economical to do so. But in the course of doing your substantive audit in areas where you find an issue or concern or problem, would you then look beneath that issue to determine whether the appropriate internal control framework was in place? In other words, that one error might indicate a weakness in internal controls that should be addressed, so the substantive findings might lead to that. Is this approach any different from the approach that you took last year? You have been through one audit cycle under COVID. Is this a different approach? In prior years, did you routinely meet with the committee of the Senate without management present?
Ms. Gignac: Thank you. Yes, if we did identify an issue, of course, we would have discussions with management about what the underlying cause of that might have been and whether there is some way to prevent it from happening in the future. So we would have those discussions with management if issues are noted.
There is no change to our approach from prior years. We are doing some things virtually as a result of COVID, which we have been doing for a couple of years now, and we have processes we follow to make sure we are comfortable from a virtual audit perspective. We have routinely met with the committee without management present.
Mr. Plamondon: Thank you.
[Translation]
Senator Dupuis: I would like to follow up on one of Mr. Plamondon’s questions.
As a result of your examination of the situation and of the effects of the pandemic on the Senate’s processes, controls, even its very activities, would you like to share any observations with us?
Because we know — at least in terms of the operations — that COVID-19 forced the Senate to adapt: We worked in a hybrid format, not only for the sittings of the Senate, but also for committee meetings.
It also means that witnesses called before the committees are no longer travelling to Ottawa. We hear from them in a hybrid format, generally virtually. It also means that the technology costs us more, but the transportation costs us less.
Can you tell us about the observations you made, especially with regard to the Senate’s activities?
[English]
Ms. Gignac: Thank you for the question. We focus primarily on how we will conduct our audit from a virtual perspective and if there are impacts to our audit from that perspective. As I mentioned, we have done the audits virtually in the last number of years, and that has meant that we meet with management on a virtual basis. Similar to how committees are having to meet on a hybrid basis, we meet with management on a virtual basis; we have regular interactions with them on a virtual basis. We do audit work where we are essentially doing walk-throughs or looking at documentation. We’ll do that also sometimes on Teams. We are leveraging all the technologies that exist to conduct the audits in a way we think is reasonable and in a way that we can get the audit evidence so that we are comfortable with the end results of the audit so that we can provide our opinion.
As a result, if we identify changes in processes from a Senate perspective as a result of being virtual as well, then when we do the walk-throughs we will make sure we are comfortable those process changes are understood and take into consideration whether they have any impact on our audit from that perspective as well.
So Ernst & Young has done a lot of work behind the scenes to make sure that we conduct our audit and complete things on a virtual basis, and we are quite comfortable that we can get the evidence we need from an audit perspective and understand management’s processes based on virtual auditing as well.
Hopefully, that answers your question.
[Translation]
Senator Dupuis: I understand that, in the relations you as the external auditor have with the Senate, the pandemic had direct effects on the way in which you deal with the people in the Senate administration.
My question was more about the effects on the Senate operations that you had to audit, and on the risks associated with the Senate. On the basis of the work you did before the pandemic as compared to the work you have done in recent years, after the pandemic, I wanted to know whether you have observed any risks that are particular or specific to the Senate.
[English]
Ms. Gignac: We have not identified new specific risks associated with the Senate, of course, because everything is virtual. The process has been changed slightly, so we have to understand the processes. As mentioned, we do a substantive audit, so we are looking at transactional-based work. Once we have an understanding of any changes in the process, any virtual work that we are doing, then we align that with how we are actually doing our audit work to make sure we are covering all of our risks from an audit perspective.
[Translation]
Senator Dupuis: I am trying to form a judgment on the Senate’s basic operations. I understand completely that a whole other part applies to the process, but I’m talking about the basics.
I assume that you are in a position to explain to us the risks inherent to an institution like the Senate. Of course, those risks must be different from those for any other organization that is not a legislative body within a federal Parliament. Can you lay out for us what you consider to be the risks specific to the Senate?
[English]
Ms. Gignac: If we are talking about changes as a result of COVID, we have seen changes to certain expenses. We align what we expect to see have changed to what we actually see in the financial statements. We consider what has happened from a COVID perspective, what we expect to happen from the financial statements. If we don’t, then we would identify that as being something we need to follow up on or a risk that we would look at. So it could be issues such as we would expect your IT expenses to be higher, your travel expenses to be lower. We look at those types of things from a change perspective and we expect to see certain things and we would ask questions if things were not as such.
We do know there is remote work. We consider this is not really different from other enterprises. Most enterprises are dealing with remote work now, so we align with being able to understand how the organization is managing the risk associated with remote work. We look from that perspective as well, as to whether there is more risk from our audit whether we need to do more work from that perspective as well.
We would also consider areas such as — and I think I mentioned in the audit plan — accruals, vacation and compensatory leave, salaries and expenses. Those are the areas where we focus because those are where there are higher-dollar-value items, more transaction and more estimates or complexities. From a financial reporting risk perspective, which is really where we are focused on the financial statement audit, those are the types of risks we are focused on, those are the types of risks we see from a Senate perspective and those are the types of things we focus our audit efforts on.
[Translation]
Senator Dupuis: Thank you.
[English]
Mr. Plamondon: A question and to add context to your work, Ms. Gignac. When I look at the level of materiality that is set for this audit engagement at $2.6 million, which is following generally accepted auditing standards and practices that you would expect to see in other external audits, where you are presenting an opinion on the financial statements as to our position and results of operation, at that level of $2.6 million that falls well above a figure that would represent a reputational risk to the Senate, that there could be items that are of much lower amounts than that, that could cause, if you are looking at users of financial statements for them to alter their opinion or decision or assessment of the Senate.
I’m doing this as a preamble because I think you are doing exactly what your mandate is. You don’t detect fraud unless it would otherwise be uncovered in the course of following generally accepted auditing standards. You didn’t list in the areas of review, for example, travel and hospitality expenses other than perhaps in another category or doing an analytical review, which, for the benefit of committee members, you are looking at variances or any amount that appears to be unusual or inconsistent with your level of expectation.
So while you are adding credibility and providing a very important role and function that the Senate counts on, when we look at the issue of internal controls and reputational risks that might involve amounts that are well below the level of materiality that you have set, that this is very much within the purview of our own work and the work of the internal auditor or our chief audit executive where they identify risks and undertake a risk-based internal audit plan. Do you have any comments on what I have said? Is that consistent with your thinking or are there any points that you would like to make in response to my observations?
Ms. Gignac: Thank you for the comments. Yes, I think your observations are very much in line. I think internal audit would have a role in determining whether there are specific areas where you want to investigate more specifically, such as travel and hospitality. We are looking at it from a financial-statement‑as‑a‑whole perspective and whether the financial statements are fairly stated in all material respects, which is in line, as you mentioned, with the Canadian Auditing Standards. We would do some work on travel and hospitality to the extent we are doing work on operating expenses, but we wouldn’t necessarily go to the level you might like to see if you were doing a specific, very targeted review of travel and hospitality expenses or specific items within that. So yes, I would agree.
Mr. Plamondon: I make those comments to show what the value added of the audit is and the limitations of the audit at the same point in time. I appreciate your comments there. Thank you very much.
Ms. H. Fortin: Pursuant to the topic of value added and specific areas being audited, yes, and this is a conversation we can definitely pursue later, i.e. the integration of internal audit work and external audit work and how both these functions can very efficiently design their own plans. Mind you, I’m conscious of the fact that the audit risks, per se, with the view of issuing a report on the financial statements are very different than the business risks, of course, but nevertheless we can achieve a very well-integrated overall audit plan including internal functions, internal and external audits. Thank you for your response. I’m sure the value added that we expect from an external auditor’s report will definitely be the one we are anticipating for this year’s audit, as well. So, thank you.
The initial question I would have asked — I was just wondering if in your planning methodology and executing all of your tests, Ms. Gignac — will you be doing more of those analytics as you go forward? Especially this year, because we all know now this type of technique that has been incorporated in recent years does add to the quality of the audit evidence, because now instead of being purely on a sample basis, we can evaluate the whole population in certain areas. So I would like to hear from you what the plan is, if any, for this year’s audit.
Ms. Gignac: Thank you for the question. We do intend to leverage our data analytic tools. The firm has some very specific data analytic tools. As you mention, for the exact reason that you mentioned, we are able to extract 100% of the data and perform some analysis on the data as to whether there are unusual transactions, anomalies, differences. That is the work we will be doing from a journal-entry perspective. That way we can target our questions. Not only are there random and dollar-based samples, but there is also very specific testing we can target if we identify unusual transactions or transactions entered by someone we wouldn’t have expected to enter a transaction. We can be very targeted in what we’re asking about, which tends to be a better audit and also result in better questions to management and doesn’t end up having management spend their time going after random invoices but actually ones that are targeted where we would like to understand why things changed.
Senator Wells: Thank you, Ms. Gignac, for helping us out on this. I have a question about the depth of the audit that you undertake. It seems to me that the price that you’ve given the Senate, at about $27,000, is very low. I don’t want to equate that at all with the quality of the work, but what’s the depth of the auditing that you do? For instance, in purchasing goods or services, do you see if the Senate gets three bids from vendors, do you look at the conditions around a standing offer for goods or services, or do you just look to see if there was an invoice and a payment? How deep does that go?
Ms. Gignac: Thank you for the question. I think the fee is fair for the audit that we’re conducting, and I think it’s probably in line with what has been charged by other firms in previous years. It’s very reasonable, in my view.
As far as the depth of the audit, we would want to understand, first of all, the process that the Senate undertakes from a procurement perspective, if we’re talking about the example that you provided. We would do a walk-through of the purchases-payables-payments cycle so we can understand what process they go through. When we’re doing individual testing, we would likely only be going to the payment and the invoice to ensure that what was incurred was actually in line with what was paid, but we would first want to understand the process and make sure there’s a process in place to appropriately procure.
Senator Wells: Thank you. That can sometimes be the problem, there may be a process in place, but has that process been practised? Do you go that deep? How does that work in the work that you do?
Ms. Gignac: Not necessarily, because we’re not conducting controls audits. We’re not necessarily looking at all of the controls in place to actually procure something. We’re doing a substantive audit — was it procured and was it actually paid for accordingly? That’s why we understand the process behind the scenes. If there were a specific, detailed piece of audit work that was wanted to be done on the procurement process, that would probably be done separately as an internal-type piece of work.
Senator Wells: Okay, thanks very much.
Senator Downe: I think we all have to keep in mind that with the public expenditure of funds on the Senate we obviously want to have high standards, but we have to balance that against a crazy expenditure of funds that we had when the Auditor General audited the Senate and spent — I’m sorry, I’m at home. If I were in my office I’d have the exact figure, but I know it was between $23.6 million and $26 million at the end of the day to locate $600,000. Six hundred thousand dollars is a significant amount of money, but to spend the large amount that the Auditor General spent to find that amount of money was, in my opinion, an abuse of taxpayers’ money equal to any abuse performed by senators.
It’s hard to explain to Canadians the vast amount of funds spent. That’s why I think we have hit the right balance here. We have a professional auditing firm and professionally trained individuals who come in. If they see an area that they are concerned about, they can report it or pursue it with some vigour. If they need additional funds to do that, whether it’s trailable hospitality, which is the usual suspect, some other area — contracts, procurement, Senate-wide, not only individual senators — they can highlight that. Funds will be made available to pursue that if there is a significant problem identified, and we’ll get to the bottom of it. But I think the accountability works both ways, and we don’t want to spend millions and millions of dollars of taxpayers’ money pursuing dead ends.
The Auditor General’s office, for example, spent over a thousand hours on each senator. Senator Klyne, you weren’t here at the time, but those of us who were — and I was with the vast majority of senators who were not named in the report. I still found it shocking because the $26 million the Auditor General spent did not incorporate the time of the Senate staff, many of whom spent hours and hours responding to requests for documents, or the personal staff of senators who spent hours and hours looking for car rental contracts or flight information that had to be duplicated.
I think we have a good balance here. I think Senator Wells is quite correct, it’s a modest amount, in my opinion, for Ernst & Young, but we’re getting high-quality professionals keeping an eye on our transactions, and I think that’s real value for money. Thank you.
[Translation]
Senator Dupuis: I would just like to add a comment to Senator Downe’s.
The Auditor General of Canada had carte blanche for his work. That is to say, he received no particular instructions about the environment, the Senate’s special status as an institution, or what is involved in the work of a senator. So we let him in and told him: just assess things as you would for any other organization, which he was quick to do.
I was not here at the time, but I remember clearly that, when it was discussed afterwards, we wanted to ensure that, in the event of any future audits — as there will be, such as at this committee that now exists — those working in the area would have a good understanding, not only of the institution of the Senate and the way in which it operates, but also of the work of a senator.
So, on travel, for example, there is a difference between return trips between the Senate and our homes, the trips we take for official committee meetings all across Canada, the trips we may make as members of parliamentary associations, and the trips on which we may be invited and which are sponsored and paid for either by other countries or by foreign organizations, with all that involves in terms of risk management. So I feel we want to make sure of that as well. [Technical difficulties] we therefore appreciate these external audit services, but we are certainly going to insist that they be set in the context of the particular reality of the risks we face in the Senate.
[English]
The Chair: Any response? Okay. Any further questions for our auditors? Seeing none, I want to thank the Ernst & Young external auditors for coming and making your presentation on your work plan, and we look forward to working with you in our next meetings. Thank you.
Mr. Givogue: Thank you.
Ms. Gignac: Thank you.
The Chair: Having already dealt with some of the other business, unless someone has other business they would like to bring to our attention — yes, Ms. Fortin.
Ms. H. Fortin: Yes, thank you. I have one follow-up comment. I think we can all appreciate the value that the Senate will derive from having an integrated internal audit function, the objective of which will be to look at the various controls that are important to mitigate the risks that we consider the most predominant and important.
A lot of the questions that were raised today, rightfully, with respect to controls, deficiencies, communications, et cetera, will be answered with integrating this internal audit function with the external audit function.
I concur with the comment by Senator Wells about the fee. I was also surprised when I saw that. I said, okay. But they certainly do not have the mandate to go very deep in evaluating the internal controls. They just look at the controls that they need, which mostly, by design, would be the internal controls over financial reporting, because ultimately they do have to issue an opinion on the financial statements, whereas the internal audit function will shed light on various other types of controls. Also, some will definitely be over financial reporting, others more operational, but will definitely provide great comfort in respect of the policies, the compliance to all the things that we will judge important in the whole overall global equation.
So thank you. This was just a comment.
The Chair: Thank you. We’re going to suspend the in-public portion, and we’ll go in camera to adjourn the meeting.
(The committee continued in camera.)