Special Examination of PPP Canada

Report Summary

Under section 138 of the Financial Administration Act (FAA), federal Crown corporations are subject to a special examination once every 10 years.

Special examinations answer the question: Do the Corporation’s systems and practices provide reasonable assurance that assets are safeguarded and controlled, resources are managed economically and efficiently, and operations are carried out effectively?

In the opinion of the auditors, there were no significant deficiencies in PPP Canada’s systems and practices that were selected for examination.  The complete opinion for this special examination is found on page 1 of this report [PDF, 1 MB].

 

Recommendation

Response

Corporate governance

The Corporation should:

• clarify the roles of the Board and its committees regarding monitoring of corporate values and ethics;

• enable the Board to exercise its responsibilities by ensuring that management submits all key corporate policies to the Board for its approval; and

• report to the Board in the areas of values and ethics, and compliance with authorities, annually at a minimum, or as required. 


The Corporation’s response. Agreed.

• The Corporation will ensure that the reporting responsibilities within the employees’ Values and Ethics Code align with the terms of reference of Board committees.

• The Board reviewed, discussed, and endorsed the Corporation’s Values and Ethics Code and Human Resources Strategy but did not formally resolve on them. The Corporation will present these and future key corporate policies to the Board for approval.

• The Corporation will report annually to the Board on values and ethics, and at least annually on compliance with authorities.
Strategic planning, risk management, and performance measurement and reporting

The Corporation should expand its performance reporting framework to demonstrate how its activities contribute to achieving strategic objectives and corporate outcomes.
The Corporation’s response. Agreed.

The Corporation’s performance reporting framework is founded on clearly defined strategic objectives. They are:

• increased investment in public infrastructure Canadians need;

• increased value and reduced reliance on taxes through the effective use of public-private partnerships (P3s);

• demonstrating success in inexperienced jurisdictions, different sectors and new models; and

• increased knowledge development and sharing of best practices and market intelligence.

In the future, the Corporation will improve performance reporting to consistently and completely report results against strategic objectives in all publicly available reports.

Project selection and management

The Corporation should ensure that project status monitoring and follow-up activities are formally and consistently documented and reported to the Investment Committee. 

The Corporation’s response. Agreed.

The Corporation has established formal systems and processes to ensure that project status monitoring is regularly and consistently documented and reported. In the future, the Corporation will improve documentation on reporting follow-up actions to the Investment Committee.

Stakeholder relations and outreach

The Corporation should:

• complete the development and implementation of a corporate-wide communications and outreach strategy;

• define performance measures to gauge the utilization and impact of the knowledge products it has developed; and

• report more formally and consistently to federal clients on the status of projects.
The Corporation’s response. Agreed.

• The Corporation has developed a public relations and outreach strategy, currently in draft form. The Corporation will complete and implement its Public Relations and Outreach Strategy.

• In 2010, the Corporation developed a robust performance measurement system that is aligned to federal government best practices for Enterprise Performance Measurement in order to facilitate a consistent approach to systematically collecting, analyzing, utilizing, and reporting on the performance of the Corporation’s programs and activities.

The Corporation will update its existing Enterprise Performance Measurement System to include defined performance measures to gauge the utilization and impact of knowledge products.

• In the future, the Corporation will introduce improved formal reporting to federal clients after significant milestones.
Safeguarding of information

The Corporation should:

• define its objectives for information technology security in its security policies, as well as its password standards, and the related roles and responsibilities of employees and contractors, and should regularly monitor and resolve issues identified in external security assessments;

• ensure that it is covered by a disaster recovery plan; and

• improve its monitoring of its private-sector service provider by obtaining, documenting its review of, and following up on results from yearly reports on the effectiveness of controls at the service provider.
The Corporation’s response. Agreed.

• In 2014, the Corporation conducted an internal threat and risk assessment and external vulnerability assessment, which identified these and other opportunities for improvement. The Corporation is in the process of implementing an action plan to respond to recommendations made in the reports.

• The Corporation has confirmed that it is covered under the Canadian Commercial Corporation’s disaster recovery plan through its memorandum of understanding with that body. In the future, the Corporation will develop its own disaster recovery plan and have the Canadian Commercial Corporation take responsibility for implementing the plan through the memorandum of understanding.

• The Corporation will institute a process to improve monitoring of its private-sector service provider on an annual basis. This will involve reviewing the audit reports of the service provider for deviations, reviewing internal user control considerations, and requesting additional reports.
Investment management

The Corporation should update its investment policy in order to include the investment objectives, a reference to concentration risk, and guidelines for reinvesting interest.

 The Corporation’s response. Agreed.

The Corporation will update its investment policy in order to improve documentation, as recommended.