The Internal Audit and Evaluation Committee of the Canada Border Services Agency (CBSA) approved the Internal Audit Plan, which included the Audit of Cash Management, on October 6, 2005. This audit is a component of the Audit Plan addressing Stewardship ‑ Compliance with Authorities.
As a payment for various services, taxes or fees collected by the CBSA (such as excise tax and duties, the goods and services tax, provincial taxes and other fees), cash is received, controlled and deposited by CBSA employees in various ports of entry across Canada. Cash is defined as any payment made in liquid cash, by debit or credit cards and cheques.
This audit was conducted between January and June 2006.
The objective of the audit was to provide assurance to senior management that cash is controlled, accounted for and deposited in a timely manner and in accordance with the authorities and applicable regulations. The audit was limited to assessing compliance with policies, procedures, directives and guidelines related to the handling of cash, from the time it is collected to the time it is deposited in a financial institution and recorded. The audit scope did not include a determination of the financial impact of non-compliance.
The audit covered the period from April 1, 2004, to March 31, 2005. To ensure sufficient and representative audit coverage, six regions with nine work location sites (offices) that had different operating environments were selected.
Overall, the examination disclosed that compliance with the laws, regulations, policies and procedures governing the control of cash needed some improvement.
The audit found that there is a control framework in place for the management of cash made up of a series of policies, procedures, directives and guidelines. As required by policy, payments were deposited within 24 hours and recorded within four working days; customs revenue reports (K10 worksheets) were prepared for all bank deposits; financial institutions were chosen based on their proximity to the work location; and, with the exception of one office, deposit slips were stamped by the financial institution and returned to the CBSA office on the following working day.
The audit also found that there was a lack of compliance with policies and procedures, weaknesses regarding supervision, segregation of duties and safeguarding of monetary assets. Policies and procedures were not up to date and were not consolidated for easy reference. Management did not always review operations regularly to ensure that control deficiencies were detected and corrected. As well, management at headquarters did not communicate monitoring expectations and some offices conducting quarterly reviews did not know where to send their reports.
Agency management should:
| Management Action Plan | Completion Date |
|---|---|
Management agrees with the key recommendations of the report and has undertaken appropriate actions to correct the situation. More specifically: |
|
A review of cash management procedures and controls has been initiated to identify and incorporate best practices in our daily operations. This review includes an examination of accountabilities in relation to cash management to define roles and responsibilities clearly. |
Underway March 2007 |
| The monitoring framework has been implemented to ensure compliance with pertinent policy, procedures, directives and guidelines and to ensure that all the necessary controls are in place. | Completed |
| Cash management monitoring and reporting requirements, procedures and policies have been updated and issued to operational areas and regions. It includes a control checklist and an application guide. | Completed |
In addition to the above action plan, Management indicated that immediate action was required to complement the findings of this audit with respect to determining the financial impact. An external audit firm was engaged to review all transactions identified in the Internal Audit samples as non‑compliant or unable to assess. The firm was able to reconcile all deposit amounts to the related receipts and to trace all missing documents of the selected sample. Consequently, the firm advised that all funds were accounted for and deposited and that there was no loss to the Crown in regard to the sample. |
Completed |
| Finally, the Agency has initiated a project to examine the redesign of the business processes and develop new systems that will integrate financial controls and reporting requirements over cash and revenues collected at the ports of entry (CBSA Assessment and Revenue Management). Discussions to secure a source of funds have been initiated. | Underway |
The Internal Audit and Evaluation Committee approved the Audit of Cash Management on October 6, 2005. This audit is a component of the Audit Plan addressing Stewardship ‑ Compliance with Authorities and is one of the cyclical examinations that the Internal Audit Directorate (IAD) will conduct each year.
In the conduct of its operations, the Canada Border Services Agency (CBSA) collects revenues from three major revenue-generating programs in both commercial and traveller operations: excise tax and duties, goods and services tax, provincial taxes and non-tax revenue such as agricultural fees. Cash is received, controlled and deposited by CBSA employees in various ports of entry (POE) across Canada. Cash is defined as any payment made in liquid cash, by debit or credit cards and cheques.
The objective of the audit was to provide assurance to senior management that cash is controlled, accounted for and deposited in a timely manner and in accordance with authorities and applicable regulations.
The audit period covered the fiscal year ending March 31, 2005.
The audit was limited to assessing compliance with policies, procedures, directives and guidelines related to the handling of cash, from the time it is collected to the time it is deposited in a financial institution and recorded. The audit scope did not include a determination of the financial impact of non-compliance.
Receipts from postal imports were excluded from this audit because they are a one-source payment from the Canada Post Corporation. Also excluded were the receipts generated under the Customs Self-Assessment (CSA) program because the various CBSA offices do not collect these payments.
The approach used in carrying out this audit included the following:
The conduct of this audit followed the Treasury Board’s Policy on Internal Audit.
The control framework in place to manage cash payments at the CBSA is made up of a series of policies, procedures, directives and guidelines issued by various branches of the Agency and by the Treasury Board. Refer to Appendix 1 for a complete list. The Treasury Board’s Policy on Deposits and Policy on Recording Receipts of Money instruct departments how money should be deposited in a banking institution.
The CBSA policies and procedures for the management of cash include Chapter 10, Section 8 (K10, Customs Revenue Report) and Chapter 13 (Banking Facilities) of the Finance and Administration Manual (FAM). Bulletin F-94-5, entitled Security and Control of Public Money and Monetary Assets, deals with physical security measures that should be followed to protect assets from loss or theft. Memorandum R17-1-5 (Employee’s Guide to Memorandum D17-1-5, Importing Commercial Goods) provides employees and management with detailed instructions on how to treat various types of payments as they are collected by the CBSA in its various lines of activities.
Comptrollership, Admissibility and Operations branches share the ownership of this control framework. Roles and responsibilities are defined in the FAM. Comptrollership Branch is responsible for developing and communicating policies and procedures related to the receipt, control, recording, safeguarding, deposit and reporting of cash. Admissibility Branch is responsible for the development of programs, policies and activities that regulate the movement of goods and travellers into and out of Canada. Operations Branch provides support for the consistent and effective delivery of operations.
Two revenue streams exist at CBSA: traveller and commercial. When payments are processed at POEs, a series of procedures need to be followed to ensure adequate control over the receipt, recording and deposit of all payments, regardless of the mode of payment. When a payment is made, a receipt is issued to the client, either manually or by means of an automated system, such as the Travellers Entry Processing System (TEPS). This receipt can be a K21 (Cash Receipt) or a B15 (Casual Goods Accounting Document). In the case of commercial operations, the K84 (Account Statement) can serve as a receipt. During the day, cashiers record all payments in a cash book (T6 or T11). The payments are closed and totalled at the end of each day. Cash books are reconciled to payments received and cash on hand. A K10 worksheet is prepared for each deposit and reviewed and approved by a supervisor. The bank deposit is prepared, reconciled to the K10 and to payments received and cash on hand. The supervisor approves the deposit and supervises the sealing of the deposit pouch. The following day, the bank returns a stamped deposit slip, confirming the amount deposited. The K10 information is then entered in the G11 screen of the Customs Commercial System (CCS). Comptrollership Branch receives a copy of the CCS download, providing information on all K10 entered, while the Receiver General receives a download of all bank deposits, directly from all financial institutions.
For the handling of cash payments, the FAM and other applicable memoranda require the following key controls to ensure the proper safeguarding of monetary assets and the protection of employees. These are:
Automated and manual systems are used for the recording and control of cash that is collected. All K10 are entered into CCS, including payments made directly to financial institutions. Some, but not all, offices use TEPS. Those who do not have TEPS issue manual B15 or K21 to clients. There is no integration between CCS, TEPS and the Revenue Ledger – the CBSA’s financial reporting system. For example, the Commercial Cash Entry Processing System (CCEPS) is used by small commercial importers to generate the Canada Customs Coding Form (B3). The system calculates appropriate duties and taxes owed. The B3 is then manually entered into the CCS for validation and cash collection. The CCEPS is not integrated with CCS or ACROSS (Accelerated Commercial Release Operations Support System). Similarly, TEPS is not integrated with CCS.
Please refer to Appendix 2 for a list of some of the key documents and systems referred to in this section.
Overall, our examination disclosed that compliance with the laws, regulations, policies and procedures governing the control of cash needed some improvement.
The audit found that there was little monitoring at either the regional or headquarters levels. As well, policies and procedures should be consolidated and updated where applicable.
It should be noted that the control framework was working effectively in some areas. For instance, our tests indicated that payments received were deposited within 24 hours and recorded in the CCS within four working days. The K10 worksheets were prepared for all bank deposits, as required by the FAM. When feasible and within reasonable limits, financial institutions were chosen according to policy, i.e., near the work location. Armoured couriers were being used in offices with a large number of transactions, where deposits were made every day, and, in general, deposit slips were stamped by the financial institution and returned to the CBSA office the next working day.
The following sections provide details of audit findings relating to the control framework in place.
Policies and procedures are a key part of a management control framework. They outline senior management’s expectations of how the organization should manage its operations, including the roles and responsibilities of the different parts of the organization. These policies and procedures need to be consistent with Treasury Board policy and directives and must be communicated and easily accessible to the organization.
In the management of cash at the CBSA, a summary of the control framework and cash management process is provided in Section 4.1 and 4.2 of this report. Policy and procedures consist of the FAM and Memorandum R17-1-5. The FAM is under the care of the Comptrollership Branch; the Admissibility Branch issued Memorandum R17-1-5; and the Operations Branch is responsible for implementing both. Besides the policy and procedures, directives and guidelines have also been issued from time to time (see Appendix 1 for complete list).
However, the audit found that the key policies, procedures, directives and guidelines are not consolidated to provide managers and employees with one source of guidance for the management of cash. Employees and managers are forced to refer to a number of documents to find the information they need to ensure compliance. In addition, there is no identified lead in CBSA for the consolidation and harmonization of these policies, procedures, directives and guidelines, resulting in the duplication of directives from various sources. Interviews with users highlighted the fact that this situation makes it complicated for them to find a quick reference for applicable policies, procedures, directives and guidelines to deal with specific issues relating to the management of cash. This increases the risk of non-compliance with policies and procedures.
It was also noted that key policies and procedures for cash management are outdated as all applicable policies and procedures date back to the time when CBSA was part of the former Canada Customs and Revenue Agency (CCRA) and have not been updated since. These documents provide key contacts for users that are now either with the Canada Revenue Agency or are non-existent. This increases the risk that employees or managers may not be able to find the support they need to comply with policy.
Agency management should:
| Management Action Plan | Completion Date |
|---|---|
| Management has taken action to ensure that the policies and procedures on the management of cash such as the documentation on security and control of cash are comprehensive, up to date and easily accessible for quick reference. The documentation has been distributed to the regions. | Completed |
| The documentation will be posted on the intranet. | December 2006 |
| The review of the Agency’s cash management accountability framework has been initiated. A departmental memorandum of understanding reflecting the roles and responsibilities specific to each area of activities will be developed and implemented before the end of the fiscal year. | March 2007 |
For a control framework to be effective, managers and employees must abide by the policies and procedures outlined by senior management. Each employee must fulfill his or her role and carry out his or her responsibilities as described in the policies and procedures. In this audit, compliance with policies, procedures, directives and guidelines was found to be deficient and management and staff need to improve the process that they follow in managing cash. Deficiencies included supervision, segregation of duties, signatures on key documents and actions to safeguard monetary assets.
Chapter 10, Section 8, of the FAM clearly states that cash books, K10 worksheets and bank deposit slips must be reviewed and signed by a supervisor. In seven offices visited, superintendents did not supervise cash-handling operations and did not sign key documents, such as cash books (T6 or T11) or bank deposit slips. Employees in these offices prepared the K10 worksheet and reconciled payments received with cash books without having a supervisor review their work and approve their report. Similarly, bank deposits were prepared without any supervision or recounting of the sums deposited. Lack of supervisory review is an area of non‑compliance.
Chapter 10, Section 8, of the FAM and Bulletin F-94-5 both state that receipt of payments, bank deposits, verification of K10 worksheets and input into the G11 screen of the CCS are functions that must be performed by different employees for better financial control. The audit found that there was lack of segregation of duties in three offices that had a significantly high volume of transactions. In two offices, the same employee had been performing the cashier function for several years. In the other office, the same employee performed the recording of cash payments in cash books, prepared the bank deposits and recorded the deposit in the CCS, with no supervision. Segregation of duties is an important preventive measure to reduce the opportunity for intentional wrongdoing and to protect the organization and employees against perceptions of misconduct.
Bulletin F-94-5 states that cash and cheques are to be kept in a safe during and after operating hours, that only two employees a shift should have access to the safe and that the safe combination should be changed at least once a year or whenever there is a staff change. Chapter 10, Section 8, of the FAM states that a transfer control sheet must be filled and signed by a supervisor when cash is physically transferred between two employees. A safeguard of monetary assets measures was not always followed. In two offices, the safe combination had not been changed for over two years. In two other offices, all employees had access to the safe and made cash deposits in the safe during the day without counting the money or without any supervision. Only one out of nine offices visited used the transfer control sheets when transferring cash from one cashier to the other.
Memorandum R17-1-5 requires that the Cashier’s Shortage/Overage Report (Form F88) be completed where payment received is less than the amounts owed (shortages) or where payment received is in excess of the invoice amount (overages), and Chapter 10, Section 8, of the FAM states that a supervisor must sign all completed F88 forms. In three offices, Form F88 was either not signed by a supervisor or not prepared at all whenever there was a shortage or an overage that needed to be reported. Lack of compliance with procedures for transfer control sheets and shortage/overage reports are examples where monetary assets are not being properly safeguarded against loss or theft.
Chapter 10, Section 8, of the FAM, states that a receipt must be issued to the client for all payments. As part of our audit test, a sample of 440 source documents (B3, B15, K21) were selected to verify that receipts were deposited and recorded. The auditors were able to confirm that all receipts except for three were deposited and recorded. Of the three, two receipts were missing in one office. On further investigation, the auditors noted 244 missing receipts that were recorded in TEPS but could not be traced to a corresponding K10. Similarly, in another office, a missing receipt led to another six missing receipts that could not be traced to a corresponding K10. The auditors were, therefore, unable to confirm whether or not these payments, for which receipts were issued, were recorded and deposited. This issue was brought to management’s attention and managers have taken action to investigate this matter.
In offices without TEPS, such receipts (B15 or K21) are issued manually, using carbon copied, pre-numbered forms. Policy states that receipt books must be controlled and entered in a log. Also, Chapter 1 of the FAM states that all copies of voided cash receipts must be kept on file. The auditors examined how manual receipt books were managed and, in two of the five offices without TEPS, they found that they were not controlled properly. The issuance of manual receipt books to employees was not recorded in a logbook and supervised by management. Regarding B15, some receipt books had no accounting document numbers as required by the Employee’s Guide to Importing Commercial Goods (Memorandum R17-1-5). Hence, the control over receipt books is inadequate in these two offices.
Chapter 10, Section 8, of the FAM policy requires a complete audit trail for all revenue transactions to permit the tracking of all customs deposits from the inception of the revenue generating transaction to the creation of the K10, Customs Revenue Report. Separate K10 are prepared for (a) point of sale (POS) and (b) cheques and cash bank deposits. From the K10 sample, the audit found that K10 reports for POS and cheques and cash bank deposits are entered in the same cash book. As related K10 packages were not filed together or cross‑referenced, this audit trail was not easily achieved. In eight offices visited, reconciliation of some deposits required several K10 packages. It was, therefore, necessary to pull out more than one K10 package to reconcile deposits with cash books and K10 worksheets.
Agency management should ensure that all border services offices:
| Management Action Plan | Completion Date |
|---|---|
Management has followed up on regional non-compliance with policies and procedures identified in this audit and managers have implemented a framework to monitor the ongoing compliance. More specifically: |
Completed |
|
Completed |
|
Completed |
|
Completed |
|
Completed |
|
Completed |
|
Completed |
| Furthermore, an external audit firm was engaged to review all transactions identified in the Internal Audit samples as non-compliant or unable to assess. The firm was able to reconcile all deposit amounts to the related receipts and to trace all missing documents of the selected sample. Consequently, the firm advised that all funds were accounted for, deposited and that there was no loss to the Crown in regard to the sample. | Completed |
Monitoring is a key control for management. It is important that monitoring takes place and that the results are reported to senior management so they are aware of whether policies and programs are working effectively. With respect to the management of cash, the policy states that managers/supervisors in offices should conduct regular and periodic reviews to ensure compliance with policies and procedures, as part of the Operational Compliance Check System (OCCS) review. The detailed guidelines are provided in Memorandum R1‑11‑1 (Operational Compliance Check System) and supplemented by a communiqué from the former “Operational Policy and Coordination Directorate of Canada Customs and Revenue Agency” (2002), for conducting and reporting mandatory quarterly OCCS reviews. Section 7 of the Memorandum R17-1-5 states that the purpose of the OCCS is to provide local and HQ management with a monitoring mechanism to ensure that standard policies and procedures are observed, proper controls are in place and employees are protected.
However, the audit found that little monitoring was conducted in the POE and that no monitoring was conducted by either Comptrollership or Admissibility branches with regard to compliance with their policy, procedures, directives and guidelines. Audit tests indicated that reviews were not performed in seven of the nine offices. One office conducted reviews on an ad hoc basis. The supervisors in two offices conducting quarterly reviews did not know where in Ottawa to send these reports. There was no guidance from HQ with respect to these monitoring reviews. The audit did not find any evidence of follow-ups by the Operations Branch or any consequence for not providing any. Without proper monitoring, there is a risk that issues of non-compliance with policy will go undetected.
Agency management should enforce and communicate clear and specific monitoring expectations and accountabilities of operational areas involved in cash processing.
| Management Action Plan | Completion Date |
|---|---|
| Cash management monitoring and reporting requirements, procedures and policies have been updated and issued to operational areas and regions. It includes a control checklist and an application guide. | Completed |
| The documentation will be posted on the intranet. | December 2006 |
In order to reinforce their responsibility and accountability for cash management procedures implementation, Regional Directors General must confirm, annually and in writing, their commitment to ensuring compliance with cash management policies. |
Completed |
| A workshop for financial and operational representatives was held to assist in the implementation of the monitoring framework and ensure national consistency in the application of cash management policies and procedures (November 2006). | Completed |