Internal Audit Report - Post-Award Administration Function for Research Personnel Awards Programs

Table of contents

1.0 Executive Summary
1.1 Conclusions and Key Findings
1.1.1 Compliance with Relevant Policies and Legislation
1.1.2 Efficiency and Effectiveness of PAA Processes and Procedures
2.0 Background
3.0 Key Risk Factors
4.0 Objectives, Scope, Approach and Criteria
4.1 Objectives
4.2 Scope
4.3 Audit Approach
4.4 Audit Criteria
5.0 Audit Findings
5.1 Assessment of Compliance of CIHR's Post-Award Administration Practices with Relevant Policies and Legislation
5.2 Assessment of the Efficiency and Effectiveness of Post-Award Administration Processes and Procedures
Appendix A - Management's Response
Appendix B - List of Individuals Interviewed
Appendix C - Audit Criteria

1.0 Executive Summary

KPMG LLP has been contracted by the Canadian Institutes of Health Research ("CIHR") to conduct an audit of the Post-Award Administration ("PAA") Function. The objectives of the audit were to provide an independent and objective assessment of the level of compliance of CIHR's PAA practices with relevant legislation and policies, including Treasury Board's Policy on Transfer Payments and CIHR's approved Terms and Conditions, as well as an assessment of the effectiveness and efficiency with which the CIHR's PAA function is delivered. Specific audit criteria were developed with reference to Treasury Board's Audit Guide on Grants, Contributions and Other Transfer Payments, the Office of the Auditor General's Audits of Grant or Contribution Programs, and CIHR's Grants and Awards Guide. The audit was conducted between December 2004 and January 2005.

The audit was conducted in accordance with the Institute of Internal Auditors' Standards of the Professional Practice of Internal Auditing and Treasury Board's Policy on Internal Audit.

The results of the audit are intended to be used by CIHR management to improve existing management practices, controls, processes and procedures in its administration of funded awards programs.

1.1 Conclusions and Key Findings

Overall, we found the management of the Post-Award Administration function to be consistent with established procedures, and that controls are in place to ensure compliance with the Treasury Board Secretariat's Policy on Transfer Payments. CIHR has adopted a number of sound management practices, including the adoption of a Tri-Agency approach to monitoring that contributes to the efficiency and effectiveness of PAA activities. CIHR has undergone significant change and growth since its inception in 2000 which has resulted in the adoption of roles and responsibilities and creation of semi-formal processes and procedures on an as needed basis to manage its PAA activities. Through the course of our audit, we identified potential opportunities for further improvement that have been summarized below by audit objective.

1.1.1 Compliance with Relevant Policies and Legislation

CIHR requires an annual certification from direct award holders and from the host institutions under the Memorandum of Understanding to confirm the award holder's ongoing eligibility and has strengthened its efforts to ensure that all award holders and institutions administering CIHR funds are aware of their responsibilities for monitoring and reporting on changes in ongoing eligibility.

1.1.2 Efficiency and Effectiveness of PAA Processes and Procedures

CIHR staff in the Research Portfolio and the Financial Administration units may benefit from more clearly defined roles and responsibilities for PAA activities to improve the efficiency and effectiveness with which recipient awards are monitored. CIHR would also benefit from a more formal system to code and log incoming queries.

In establishing its PAA monitoring activities, CIHR has relied upon procedures developed and successfully utilized by its Tri-Agency counterparts - the National Science and Engineering Research Council (NSERC) and the Social Science and Humanities Research Council (SSHRC). At present, the PAA monitoring activities is a joint process between CIHR and the two other agencies. It would be beneficial for CIHR to more formally document its PAA processes and procedures to enable staff training, continuity and consistency in PAA activities. Consideration should be given to more formally assessing and documenting risks and the consideration of risks in the monitoring process and to improving documentation of the assessment of management controls during monitoring visits. CIHR should also examine methods to more effectively and efficiently analyze and communicate key issues identified through monitoring visits both internally and to host institutions and develop a formal internal reporting schedule.

2.0 Background

The Canadian Institutes of Health Research ("CIHR") is the major federal agency responsible for funding health research in Canada. The mandated objective of CIHR is: " To excel, according to internationally accepted standards of scientific excellence, in the creation of new knowledge and its translation into improved health for Canadians, more effective health services and products and a strengthened Canadian health care system^1".

The Canadian Institutes of Health Research (CIHR) was created under The CIHR Act that came into force on June 7, 2000, replacing the Medical Research Council of Canada which conducted similar funding activities in the areas of health and medical-based research. CIHR's grant and awards activities support more than 9,000² health researchers and researchers in training in universities, teaching hospitals and other health organizations, research centres and government laboratories across the country. The scope of health research includes current high need areas such as cancer research, and in emerging research areas such as genetics, impacting the diverse socio-cultural and environmental landscape in Canada.


CIHR's strategic objectives are partially achieved through the provision of Research Personnel Awards under a variety of specific programs, including the following:

Doctoral Research Awards - intended to provide special recognition and support to students who are pursuing a doctoral degree in a health related field in Canada or abroad. These candidates are expected to have an exceptionally high potential for future research achievement and productivity.

Fellowships - Fellowships provide support for highly qualified candidates at the postdoctoral (post-PhD) or post health professional degree stages to add to their experience by engaging in health research either in Canada or abroad.

Canada Graduate Scholarships Doctoral Awards - intended to provide special recognition and support to students who are pursuing a doctoral degree in a health related field in Canada. These candidates are expected to have an exceptionally high potential for future research achievement and productivity. This funding program will be administered through the CIHR Doctoral Research Award competition, with the top candidates meeting the eligibility criteria receiving a CGS award.

MD/PhD Program Studentships - Studentships are offered to students who are registered in a combined MD/PhD program at Canadian institutions that offer such a program. A maximum of 15 Studentships are allocated to the program each year.

Clinician Scientists - offered to highly qualified and motivated clinicians who have been identified by a Canadian medical or dental school as having strong potential to become clinician scientists.

New Investigators - intended to provide the opportunity for new investigators to develop and demonstrate their independence in initiating and conducting health research.

The general guidelines for awards are defined in CIHR's Program Descriptions and Grants and Awards Guide. The administration of the awards, once they are allocated, is performed through the CIHR's Research and Service and Operations Portfolios. The administrative responsibilities under the Research Portfolio are carried out through the Research Capacity Development and Research Translation Programs Branches. Research Capacity Development administers the bulk of CIHR's awards that support trainees and independent investigators, and has the lead in developing and interpreting related policies for CIHR. It also assists researchers applying to CIHR, and those holding a grant or award, by managing an information service and by coordinating grants-craft sessions. Research Translation Programs administer a smaller, but significant, number of awards that have industry funding partners.

Research Portfolio staff make final decisions and have signing authority on any issues related to individual grants and awards. The Research Portfolio unit responsible for a program's delivery is intended to be the main point of contact for researchers from pre-application through to post-award administration. These are the people most knowledgeable in the design and delivery of the program and the history of files as they move through the different stages of the process.

The administrative responsibilities allocated to the Service and Operations Portfolio are carried out through the Financial and Planning Advisory Services Unit and the Financial Administration, Grants and Awards Unit. The Financial and Planning Advisory Services unit ensures sound financial management by providing financial reports, advice, guidance and training to CIHR management and staff in the administration of Operating and Grants and Awards budgets. The Financial Administration, Grants and Awards unit is responsible for issuing grants and awards payments, receiving and reviewing grants financial reports and overseeing the compliance and reviews of CIHR's grants and awards accounts within the recipient organizations. The unit provides support and advice to CIHR staff, recipient administrators and direct funding recipients, in addition to undertaking financial monitoring visits to ensure the proper management and use of CIHR funds.

Payment of awards generally falls into one of two categories:1) A common account where funding is provided to a specific institution, such as a university or hospital, that distributes awards to end recipients on CIHR's behalf; and 2) A direct payment where funding of awards is made directly from CIHR to recipients outside of Canada. The administration and monitoring of payments to award recipients varies depending upon whether the award is a common account or direct payment.

3.0 Key Risk Factors

CIHR has experienced rapid growth since its inception in 2000. Over the last four years, grants and awards budget has increased from $275 million in 1999/2000 to $580 million in 2003/2004. This rapid pace of growth and change has led to potential risks that may impact CIHR's Post-Award Administration function including:

• Lack of sufficient resources (human and financial) to support the various required post-award administration functions, including monitoring activities.
• Risk that award recipients do not maintain their eligibility in accordance with CIHR's Grants and Awards Guide and/or instances of non-compliance are not detected by CIHR in a timely manner.
• Risk that PAA roles and responsibilities are not well defined and/or understood, leading to potential inefficiencies and duplication of effort.
• Risk that PAA processes and procedures are not formally defined, which may lead to inconsistent practices and/or inefficiencies.
• Risk that recipient organization's management controls are not in compliance with CIHR policies over award administration and/or that deficiencies in recipient management controls are not detected and resolved on a timely basis.

In addition, there are a number of risks that are common to public sector award programs. Although these factors are considered by CIHR management to be of low risk to the PAA function, such generic risks include the following:

• Post-award administration practices may not be in compliance with approved terms and conditions and/or Treasury Board's Policy on Transfer Payments.
• Risk that payments are made for non-eligible expenditures.
• Lack of reliable and timely cash flow projections to meet award commitments.

It is important to note that the risks listed above represent potential risks associated with the achievement of CIHR's Post-Award Administration function objectives that may currently be mitigated by existing controls, such as the Memorandum of Understanding agreements between CIHR and recipient organizations. Further discussion on the current state of existing controls is discussed throughout the body of the Observations and Recommendations section of this report.

4.0 Objectives, Scope, Approach And Criteria

4.1 Objectives

The objectives of the audit of the Post-Award Administration function were to provide an independent and objective assessment of:

1. the compliance of CIHR's post-award administration practices with relevant policies and legislation including:
   • the specific provisions of the approved Terms and Conditions;
   • relevant requirements under the Treasury Board's Policy on Transfer Payments; and
   • compliance with sections 33 and 34 of the Financial Administration Act.
2. the efficiency and effectiveness of post-award administration processes and practices including:
   • the adequacy of management controls over payment and monitoring of recipient activity;
   • the extent to which risks are considered in payment and monitoring controls and activities;
   • mechanisms in place to identify and resolve process inefficiencies; and
   • the sufficiency and appropriateness of information for decision making.

4.2 Scope

The scope of this audit was limited to research personnel awards programs delivered by the Research Capacity Development Branch including only awards that have been approved subsequent to January 1, 2003. This included awards under the following programs: Health Research Partnership Fund, Health Professional Student Research Awards, Canada Graduate Scholarships Doctoral Awards, Doctoral Research Awards, MD/PhD Program Studentships, Clinician Scientists, New Investigators and the Michael Smith Awards for Research in Schizophrenia.

The audit was also limited to CIHR Post-Award Administration processes - covering the initial payment of awards to recipients subsequent to the approval process, through ongoing monitoring that funding is being used for intended purposes. Processes and practices related to the assessment of whether funding has achieved intended results is beyond the scope of this audit.

4.3 Audit Approach

The audit was conducted in accordance with the approach detailed in the internal audit plan finalized on December 13^th, 2004.

The audit approach included a review of documentation related to the Post-Award Administration function and consultations with representatives of CIHR's Research Portfolio and Financial Administration, Grants and Awards Branch as well as representatives from CIHR's tri-agency counterparts, the National Science, Engineering and Research Council ("NSERC") and the Social Sciences and Humanities Research Council ("SSHRC"). A listing of interviewees included in our consultation process is provided in Appendix B.

In addition to consultations and documentation review, a sample of CIHR awards was selected for examination on a judgemental basis, based on the materiality of the funding provided and to ensure an appropriate representation from across the CIHR Award portfolio. This resulted in a sample size of 60 files out of a total population of 745 holders awarded CIHR funding since January 1^st, 2003, or 8% of the total recipients funded over this period.

This sample covered approximately 14% of total funding disbursed on awards since January 1^st, 2003. Included in our sample of 60 files were 8 of the 10 highest award recipient files based on the value of the award.

In addition, we conducted a review of four monitoring visit files to examine the existing processes and procedures used by CIHR in its financial monitoring activities.

4.4 Audit Criteria

The audit plan finalized in December 2004 describes the criteria that were examined through the audit. The audit criteria define the standards of performance and control against which CIHR's Post-Award Administration practices, processes and procedures were assessed. They are expressed in terms of reasonable expectations for these processes and practices to achieve expected results and objectives. The criteria were selected based on our knowledge and experience in auditing grant and contribution programs and with reference to CIHR's Grants and Awards Guide and Program Descriptions, Treasury Board's Audit Guide: Grants, Contributions and Other Transfers and Alternative Service Delivery Internal Audit Guide, and the Office of the Auditor General's Audit of Grant and Contribution Programs.

The audit criteria are presented in Appendix C of this report. Each of the criteria was examined through our consultations with selected representatives of CIHR, our review of a sample of recipient files and PAA process documentation, and with reference to leading practices in transfer payment program delivery and alternative service delivery arrangements.

5.0 Audit Findings

In accordance with the December 13^th, 2004 internal audit plan, management practices and procedures within the CIHR Post-Award Administration function were examined against each of the criteria listed in Appendix C. Through the course of the audit, a number of sound management practices were identified which are discussed in each of our observations. However, a number of findings were identified that are worthy of management's attention and represent areas where further improvements in efficiency and/or effectiveness may be gained.

Our findings, categorized by each audit objective to which they relate, are provided below.

5.1 Assessment of Compliance of CIHR's Post-Award Administration Practices with Relevant Policies and Legislation.

Observation 5.1.1: The current process to determine an award holder's ongoing eligibility is reasonably effective.

CIHR conducts an annual certification from direct award holders and from the host institution to confirm the award holder's ongoing eligibility and funding is suspended until such confirmation is received. In addition to the annual certification, it is primarily the responsibility of the award holder to inform CIHR and/or the host institution of changes to their eligibility. CIHR has made this clear in Schedule 10 of the draft Memorandum of Understanding. Furthermore, as per the CIHR Grants and Awards Guide: "the institution must contact the Agency's Finance Division as soon as an award holder's eligibility changes during the tenure of the award".³ Should CIHR discover a change in status during its annual certification process or as advised on an ongoing basis, that requires repayment, the recipient organization is responsible to recover any funds owing.

As the primary responsibility to communicate ongoing changes in eligibility is that of the award holder, CIHR continues to be at risk of untimely or inaccurate communication. However, the current process to determine an award holder's ongoing eligibility, as identified above, is reasonably effective.

5.2 Assessment of the Efficiency and Effectiveness of Post-Award Administration Processes and Procedures.

Observation 5.2.1: Internal roles and responsibilities are not currently clearly defined for all PAA activities.

The existing PAA structure provides for appropriate segregation of duties between those who approve applications (Governing Council or Institutes), those who manage the peer review process, implement funding decisions and have post-award decision-making authority on individual award issues (Research Portfolio units) and those who process payments and ensure authorization and use of funding complies with CIHR's Terms and Conditions (Financial Administration units). However, some aspects of the post-awards administration function are currently shared between the Research Portfolio and the Financial Administration, Grants and Awards units. While generic roles and responsibilities for all staff have been developed, formal roles and responsibilities have not been clearly defined for all PAA activities.

Under the current structure, Information Officers are intended to be a key point of contact for recipients and in this capacity, they log incoming telephone and e-mail communications. As the initial point of contact, it is the expectation that Information Officers have a thorough knowledge of the CIHR Grant and Award programs and portfolios and policies to properly respond to routine queries. In order to be able to provide more authoritative responses to award holder' queries, the Research Capacity Development Branch provides a point of contact within the most appropriate program delivery unit to handle all queries from pre-application through post-award administration.

As a result of CIHR's rapid growth rate, turnover among staff and previous contact with recipients, an increasing amount of recipient queries are being received outside of the Information Officer and the Research Portfolio unit's key points of contact. Based on consultations with Financial Administration staff, for example, it was estimated that 15% to 20% of Financial Officers' time is spent responding to recipient queries on various issues, including policy interpretations. In addition, it was identified that the Financial Administrative unit requests updates to contact information when sending the annual request for ongoing eligibility. This information requires updating in approximately 25% to 30% of total awards and is usually the responsibility of the Research Portfolio unit. In other cases, financial queries are received in the Research Portfolio units that require consultation with Financial Administration staff before a response can be provided.

In addition, while contact lists have been developed to assist CIHR staff in ensuring recipient queries are forwarded to the appropriate individual, some individuals are not aware of these lists and/or the responsibilities of each function/unit which may result in an inconsistent or inappropriate routing and handling of recipient requests and inconsistencies in interpretations of existing CIHR policies and guidelines. Also, because an increasing number of recipient queries are being received outside of the Research Portfolio, some individuals are relying on ad hoc and self-made tools to log these communications, leading to inconsistencies in the tracking of recipient queries and creating difficulties in analyzing the nature of communications received.

CIHR would benefit from a more formal system to code and log incoming queries, such as a database through which the nature of calls could be coded according to type. In addition, roles and related procedures should clearly define responsibilities for logging award holder queries and their resolution and for disseminating this information to all relevant CIHR parties. This database of information would enable an appropriate analysis of the nature of calls received that may indicate the need to modify existing policies, processes and/or communications to reduce the volume of queries made on similar issues.

Although consistency in CIHR contacts and responses to recipients could have more significant impacts for larger programs, such as operating grants, that require many program delivery units, recent personnel changes in the Research Portfolio and Financial Administration units reinforce the need to better clarify and define specific PAA roles and responsibilities within CIHR to ease transition periods and enable continuity in the level of service provided during such times.

Recommendation 5.2.1: It is recommended that CIHR better define PAA roles and responsibilities across the organization, develop more formalized tools to log and respond to queries, and provide any additional training/communication for all relevant individuals involved in Post-Award Administration activities. In addition, communications to recipients should formally identify the key points of contact for their various query types.

It is our understanding that CIHR Financial Administration staff, in consultation with Research Portfolio staff, was recently mandated to develop a framework that would more clearly outline potential roles and responsibilities as they relate to the Post-Award Administration function. Consideration should be given to the points identified above in defining these roles and responsibilities. Improvements in training, logging of calls and dissemination of information throughout CIHR will likely require additional resources.

Observation 5.2.2: The criteria/risk basis for the selection of review visits is not well documented.

CIHR participates in two types of monitoring visits to funded award holder institutions: Tri-Agency review visits and visits to institutions funded solely by CIHR. Currently, CIHR follows the same procedures as its Tri-Agency partners - NSERC and SSHRC - most specifically the "Monitoring Approach for a Financial Review Visit", "Review - Issues and Questions" and "Federal Agencies' Grant and Award Management Questionnaire". The Tri-Agency approach is likely more efficient for the Agencies and less onerous on award holders and their host institutions organizations who receive one combined and coordinated monitoring visit rather than three distinct visits examining similar types of information.

One of the key strengths in existing CIHR practices is the clear definitions of roles and responsibilities between recipient organizations and CIHR through Memorandums of Understanding ("MOUs"). The MOUs allow for monitoring procedures to gather relevant information to identify circumstances where gaps in controls or instances of non-compliance occur within recipients to enable appropriate action to be taken to mitigate the magnitude and impact of these events. The strength of the MOU will become even more critical as more organizations become eligible to act as host institutions.

Monitoring visits involve consultations with various stakeholders across the host institution to provide a balanced and comprehensive picture of the current state of understanding and awareness of CIHR guidelines as well as existing controls in place to ensure compliance. CIHR representatives deliver information sessions to representatives of host institutions that describe roles and responsibilities; eligibility of expenses and related guidelines; need for controls within host institutions to ensure compliance with CIHR guidelines; and common challenges that need to be addressed. This is an excellent means of educating award holders about their expected roles and responsibilities.

CIHR follows a common monitoring schedule developed jointly with NSERC and SSHRC based on a 5-year cycle and taking into account the host institutions that receive a material amount of funding from CIHR. Monitoring of other institutions not currently funded by NSERC and SSHRC is completed as resources are available after considering Tri-Agency visits scheduled in the year. In 2004, the CIHR monitoring team conducted a total of 3 visits (2 Tri-Agency and 1 non Tri-Agency). During the last year, significant monitoring team visits were allocated to 3 CIHR relocation reviews.⁴ CIHR participates in an average of 4 to 6 Tri-Agency/non-Tri-Agency monitoring visits per year.

There is a risk herein is that while focusing mainly on materiality (size of institution, amount of total funding to a particular institution), CIHR may have missed those smaller institutions where the risk of an ineffective control framework may be higher. While smaller in terms of size and total funding received by CIHR, significant audit issues related to internal controls and compliance may be present and more pervasive at smaller institutions that when taken as a whole, may result in significant errors or misuse of CIHR funds. This may impact management's ability to effectively monitor compliance and may lessen the ability of management to proactively identify issues as they arise.

The extent and timing of review visits can be a challenge, given CIHR's limited resources combined with the fact that it has many programs funding a large number of relatively low value awards. Effective risk identification and analysis can help to define the extent, timing, and frequency of monitoring or review activities in these circumstances. While it is our understanding that CIHR does consider risk in terms of the size of the Institution and number of Agency grants and awards to justify on-site reviews, the rationale behind such decisions is not currently formally documented.

Recommendation 5.2.2: It is recommended that the CIHR formally document and communicate its PAA processes and procedures.

It is our understanding that CIHR is currently in the process of reviewing a number of practices and processes pertaining to the CIHR and the Tri-agency monitoring approach in order to improve processes and practices. Such a review should consider incorporating the principles described in the observation above.

Observation 5.2.3: Support for monitoring visit findings is not clearly referenced and findings are not consistently categorized.

Currently, information on the host institution's management controls, including financial and monitoring policies, is gathered through site visits in a number of forms: host institutions initially provide information through their responses to questions on the "Review - Issues and Controls" and "Federal Agencies' Grant and Award Management Questionnaire". The responses collected through these documents are further corroborated and investigated during interviews and documentation review performed during the review visit.

However, CIHR's documentation in support of individual monitoring visit findings is not currently categorized and supporting documentation is not clearly referenced or indexed. This may lead to inefficiencies in following-up on host institution's remediation efforts, may reduce CIHR's ability to effectively identify trends or common deficiencies and gaps in controls across host institutions, and may reduce the timeliness with which key control gaps are improved.

Consideration should be given to referring to existing and recognized models of control, such as the COCO or COSO control framework, in developing the criteria for the assessment of a PAA function and to categorize relevant findings on the overall effectiveness of these controls. A summary of key control strengths and weaknesses against standard criteria will also facilitate the identification, consolidation and monitoring of issues and lessons learned.

Recommendation 5.2.3: It is recommended that an assessment of the host institution's management controls against a group of high-level criteria be summarized, communicated and concluded upon in the monitoring files.

Observation 5.2.4: Internal reporting and analysis of issues identified through monitoring visits is untimely.

Based on the results of our file review process, it was noted that many of the same issues were identified between the various host institutions. For example, CIHR and Tri-Agency monitoring visits have identified recurring instances through which host institutions use research allowances for ineligible costs or transfer unexpended balances which are not in compliance with CIHR guidelines. We also found that the identification of ineligible expenditures through monitoring visits was generally not indicative of significant control problems within the host institution, but rather inconsistent interpretations of CIHR guidelines.

Such instances of non-compliance may only have been detected through the monitoring visit itself. Although many issues identified through monitoring visits are recurring in nature, there is currently no formal means in place through which common findings are communicated, consolidated and analyzed to identify areas of mitigation, such as the implementation of changes within CIHR's own policies, processes and guidelines, which may reduce the future incidence of such common issues. Although action has been taken to improve existing policies on an ad hoc basis, such as the clean up of research allowance balances for terminated awards that commenced on January 1, 2005, the lack of a formal mechanism to gather and analyze issues identified may prolong the period until corrective action is taken.

In addition, the internal distribution of review reports is not formally defined and the results of monitoring visits are not currently disseminated consistently throughout CIHR. Consideration should be given to clearly defining the intended distribution of monitoring visit results at various levels of the organization, including distribution of the reports to relevant representatives of the Financial Administration unit and Research Portfolio and a quarterly summary of consolidated issues and resulting corrective actions taken by CIHR to the Executive Management Committee. Further, recommendations and issues identified through site visits could be formally summarized and tracked by a member of the monitoring team to ensure that common issues and themes are addressed among all institutions. Specific responsibility for tracking and reporting on issues identified and their resolution should be formally assigned, along with the requirement to share issues and lessons learned with representatives from Research Portfolio areas where such information may drive the need to change existing policies and guidelines.

Recommendation 5.2.4: It is recommended that the CIHR develop procedures requiring a formal analysis, communication and consolidation of key issues identified through monitoring visits and develop a formal internal reporting standard and schedule to communicate findings.

Observation 5.2.5: Reporting of monitoring visit findings to recipients was untimely.

Through our review of monitoring visit files, it was identified that in many circumstances a significant amount of time elapsed between the conduct of the site visit and the issuance of the draft and final reports. In one instance, the draft report was not issued until 8 months after the site visit. This is in part due to resource constraints within CIHR, the length of time required to draft reports that are acceptable to all Tri-Agency partners involved in the monitoring visit as well as delays that may have been experienced in obtaining time from the host institution to properly debrief the findings and prepare their responses to issues identified. Delays in issuing reports of findings may lead to delays in improving controls within host institutions, and may also result in known errors continuing for longer periods of time. In addition, the sense of urgency or importance attached to review findings may diminish as time goes on.

Recommendation 5.2.5: It is recommended that the CIHR and Tri-Agency monitoring teams develop formal standards specifying timelines for issuing draft and final reports to the host institutions.

Observation 5.2.6: There is no formal mechanism to ensure timely follow up on issues identified through monitoring visits and other monitoring activities.

There is currently no formal policy or related procedures regarding CIHR's follow up of issues identified through review visits. Findings are currently debriefed with the host institution and the host institution is expected to implement an action plan to address deficiencies identified. CIHR does schedule follow up visits within a few years of the issuance of the report through which the host institution's progress in correcting issues identified is assessed. However, a more timely approach to following up on issues identified where warranted, may provide CIHR with greater comfort that the host institution's controls have been strengthened and may reduce the potential for future errors.

To help ensure that the host institution is committed to taking appropriate remedial action, the consequences of not addressing issues identified needs to be defined. For example, lack of appropriate corrective action to issues identified may result in a reduction in future funding or may result in additional monitoring activities of specific award accounts. Consideration should be given to developing a follow up schedule that is reflective of the risks involved that could be tied to ratings based on the results of the visit. For example, organizations that have demonstrated non-compliance with CIHR terms and conditions may receive a high rating requiring rigorous follow up activities such as an additional site visit in 6 months. Issues that relate more to administrative efficiencies may be less risky in nature and correspond to a lower rating that involves a verbal follow up and review of new policies or procedures implemented in response to the issues identified. The implementation of more formal and risk-based policies and procedures for follow-up activities may provide greater comfort to CIHR that weakness in recipient's management controls are being effectively resolved on a timely basis and may provide a stronger incentive for recipient organizations to address issues raised.

Recommendation 5.2.6: It is recommended that standards be developed and enforced that specify required timelines for follow up activities and ties specific follow up activities to the relative risk of the issues identified.

Such standards should specify the general time frame for issuing draft and final reports as well as the general timeframe and method for following up on recommendations for improvement.

Appendix A - Management's Response

CIHR management's formal response to each of the recommendations identified through the audit are provided below, along with management's intended course of action to implement recommendations.

Summary of Recommendations and Management Action Plan

Appendix B - List Of Individuals Interviewed

Appendix C - Audit Criteria

Objective 1: Assessment of Compliance of CIHR's Post-Award Administration Practices with Relevant Policies and Legislation.

A) Compliance with Terms and Conditions

• Processes exist to ensure payments are made based on approved terms and conditions.
• Payments are based on eligible expenditures as defined in the terms and conditions.
• Mechanisms exist to ensure that payments do not exceed the total budget authorized by the award.
• A mechanism is in place to verify recipient's ongoing eligibility for awards prior to payments being made.

B) Compliance with Policy on Transfer Payments

• Awards are managed in keeping with Cash Management Policy (e.g. fiscal year requirements are complied with, exceptions are handled appropriately).
• Mechanisms are in place to ensure funding is used for intended purposes.
• Mechanisms are in place to ensure money owed to CIHR due to lapsing of eligibility or other circumstances is collected on a timely basis.
• All payments require certification that the payee is eligible or entitled to the payment by a person with proper delegated authority.
• An agreement is in place with initial recipients based on the approved terms and conditions for the award program and is consistent with Treasury Board Policy on Transfer Payments.
• Written agreements are signed by all parties before the stated start date and before eligible expenses are incurred.
• Any overpayments in the custody of the initial recipient at year-end or program-end are accounted for and refunded if necessary.

C) Compliance with Financial Administration Act

• Proper financial controls have been designed and implemented to ensure that payments are subject to commitment control, account verification and payment requirements under Sections 33 and 34 of the Financial Administration Act as evidenced by the following:
  • Section 34 - there is proof that performance conditions of the agreement were met before each payment was made
  • Section 33 - proof that finance officer signing was assured that Section 34 was met prior to payment authorization.

Objective 2: Assessment of the Efficiency and Effectiveness of Post-Award Administration Processes and Procedures.

A) General Management Controls:

• Roles and responsibilities for managing and delivering the post-award administration activities are well defined and communicated.
• An appropriate segregation of duties between those who review and approve applications and those who approve payments exists.
• Memorandums of Understanding meet effective accountability requirements including:
  • Statement of objectives;
  • Clear understanding between parties on required outcomes or expected results before funding begins;
  • Monitoring provisions based on assessment of risk; and
  • Conditions that must be met to receive payments.
• Award files are well documented and current, containing evidence to support appropriate due diligence and decision making in the post-award administration process.
• Processes and procedures are in place to monitor the performance of the initial recipient (third party) and assess the effectiveness of controls in place within the recipient's organization that are related to the disbursement of CIHR funding.
• Mechanisms are in place to ensure appropriate remedial action is taken by recipients in response to monitoring activities.
• Access to financial systems is restricted to staff that require such access to conduct legitimate roles and responsibilities in keeping with their organizational position.

B) Risk-Related Controls

• Processes and procedures over the payment, monitoring and reporting on awards are reflective of program and recipient risk factors.
• A mechanism exists to systematically identify, assess, monitor and report on risks facing the awards program.

C) Mechanisms to Identify and Resolve Process Inefficiencies

• Mechanisms are in place to identify lessons learned and make related changes to processes and procedures to foster continuous improvement in the post-award administration function.
• Mechanisms are in place that require accounting by recipients that minimizes the administrative costs of both CIHR and the recipient, taking into account appropriate risk factors.

D) Information for Decision-Making

• Timely accounting and reporting is received from recipients.
• CIHR award and recipient reporting and information is distributed to appropriate individuals (i.e. information and reporting received relates to specific roles and responsibilities and is provided to authorized individuals).
• A mechanism exists to respond to ad hoc requests for reports and analysis of CIHR recipient and/or award information on a timely basis.

³ CIHR Grants and Awards Guide, Section 5-E6
⁴ Consultation with Finance Officer, January 14^th, 2005