February 22, 2024
February 22, 2024
9:30 a.m. to noon.
Virtual Meeting
Members:
Janine Sherman, External member – Chair
André Grondines, External member
Caroline Maynard, Information Commissioner
Secretary to the Committee:
Michael Walsh, Financial Management Advisor
Regular attendees:
France Labine, Deputy Commissioner, Corporate Services, Strategic Planning and Transformation Services, Chief Financial Officer (CFO) and Chief Audit Executive (CAE)
Senior Management Committee:
Layla Michaud, Deputy Commissioner, Investigations and Governance
Natacha Bernier, Acting Deputy Commissioner, Legal Services and Public Affairs
Guests:
James Ellard, Senior Director, Public Affairs
Catherine Lapalme, Principal, Office of the Auditor General of Canada
Sébastien Lafond, Senior Director, Finance, Procurement, Administration and Security and Deputy Chief Financial Officer (DCFO)
Dominic St-Jean, Manager, Operations and IT Infrastructure
Meeting Summary
Approval of Agenda and Record of Decisions from the November 23rd, 2023, meeting
Update on Management Action Plan
Presentation on the Cyber Security Self-Assessment
Presentation on the AEC Self Assessment Results & the External Assessment of Internal Audit
Presentation of OAG audit plan
Updates from Corporates Services, Investigations, Legal Services, and Public Affairs
1. Welcome and Opening Remarks
Caroline and France welcomed everyone to the meeting, and the Chair formally opened the meeting. There were no proposed changes to the agenda.
2. Minutes and Action Items from previous Meeting
The chair noted small editorial comments on the September 20th, 2023 posted on the OIC website to be corrected which she will be forwarded after the meeting.
There were no comments on the meeting minutes for the November 23rd, 2023 meeting.
There was a discussion of the Forward Agenda. It was agreed that the proposed date for the next scheduled meeting on June 12th would me moved to June 13th to avoid a scheduling conflict.
Action items:
- Minor corrections will be made to the English minutes of the September 20th, 2023 posted on the OIC website
- Minutes of November 23rd, 2023 meeting will be posted online
- Date of next meeting will be moved to June 13th, 2024 by the CAE.
3. Management Action Plan – Follow-up
Michael presented an update on work taken on action items since the last update. He indicated that an updated HR Delegation document has been implemented. He also indicated that before the end of this fiscal year OIC plans to update policies and tools to ensure consistent application of language and security requirements. Furthermore, he explained that a new process to approve overtime transactions in Phoenix will be rolled-out across OIC before the end of the year.
Action item:
- Small editorial comments on documents will be corrected.
4. Update on the Cyber Maturity Self-Assessment
Dominic explained that as part of the Departmental Security Plan and Risk Based Audit and Evaluation Plan, OIC is performing a self-evaluation of its cyber security process using the TBS Cyber Maturity Self-Assessment tool. OIC has also hired an external consultant to evaluate OIC’s self assessment. He explained that the assessment will be completed before March 31st. The IT team will start working on 3-year action plan to address the findings. The final report and the management action plan will be presented to OIC Senior Management and Audit & Evaluation Committee.
Mr. Grondines asked if there were any significant concerns around cyber security. Dominic explained that OIC has invested significantly over the last few years to upgrade technology and tools. Most issues found have been related to documentation and not related to missing controls or vulnerabilities.
Action item:
- Final evaluation and management action plan will be presented at a later meeting
5. AEC Self Assessment Results & the External Assessment of Internal Audit.
Sébastien presented the results of questionnaire sent to members which indicated that members believe they have the information, tools and knowledge required for their roles. There was also a discussion of the requirement for an external assessment of the internal audit function every five years or so. Sébastien proposed that based on the return on investment and the current policy framework being followed by the OIC (such as Audit Committee establishment, OAG Audited financial statements positive results, contracting out audit and program evaluations); and the benchmarking exercise conducted with other Agents of Parliament (OAG, EC, etc) to explore the possibility of them conducting the external evaluation, but unfortunately, they did not have the resources to do this work in 2024-25 and the low risk as almost 85% of OIC expenditures are in salary, we would not conduct and contract out such an assessment with an external firm to carry out the evaluation, but he does not believe that the work will not generate an added value especially with the very tight budget. Mrs. Sherman and Mr. Grondines (i.e. both external members) did support this recommendation and they are satisfied with all the work completed on the key internal controls, quality assurance, audits and evaluation programs. The situation should still be reassessed in the future.
Action item:
- These minutes will serve as the formal resolution approved by the Committee not to pursue with an external third-party self-assessment validation process.
6. OAG - Annual Audit Plan for the year ending March 31, 2024
Catherine presented the audit plan for the March 31, 2024 financial statement audit. She indicated that there were no significant changes planned from the prior year audit. She confirmed that the OAG audit team is independent from OIC and that there are no changes in the risks this year. She highlighted that there is a small increase in materiality for the audit and that the audit work will be performed earlier than the last couple of years.
Action item:
- No action required.
7. Corporate Services Update
France presented highlights and summarized the financial position for 2023-24 and a preliminary overview of the 2024-25 budget. She also indicated that no instances of fraud, wrong-doing, or harassment have been reported to her or are pending.
Action item:
No action required.
8. Investigations Update
Layla indicated that OIC has set ambitious targets for this year and the entire organization is working together working to meet them. She indicated that she is very proud of the efforts taken to make investigations more efficient and work done to give investigators tools and training to develop their knowledge and skills. She also indicated that OIC has hired an external consultant to meet with complainants to get their feedback on the complaint process.
Action item:
No action required.
9. Legal Services Update
Natacha informed the members that there has been a significant increase in litigation due to new powers granted to the Commissioner in 2019 and that the Legal Services team has adapted the composition of the team to deal with the increase. She provided a brief summary of the cases that OIC is involved in.
Action item:
No action required.
10. Public Affairs Update
James informed members that there has been an increase in the number of meetings with parliamentary and stakeholders this year. There has also been an increase in media coverage of access to information related matters. These are seen as indicators that efforts taken by OIC are having an impact.
Action item:
No action required.
In Camera Session
The session was performed.
Next Meeting
The next meeting is scheduled for June 13th, 2024.