8020 Recommendations and Entity Responses

Jul-2020

What the CSAE 3001 means for recommendations and entity responses

The CSAE 3001 cited above notes that audit reports may include, in some cases, recommendations. OAG policy goes beyond this by requiring that, as appropriate, audit reports should contain recommendations and entity responses.

It is important for the team to consider objectively the impact of the recommendation on the entity. Recommendations should encourage the appropriate action needed to correct the underlying causes of problems or improve operations, without being overly prescriptive.

Finally, the standards indicate that recommendations should be clearly separated from the conclusion.

Developing recommendations

Recommendations address areas where there are significant risks to the entity if deficiencies remain uncorrected. Audits include recommendations where the findings demonstrate the potential for significant improvement in performance. Recommendations address serious weaknesses, and they should be fully supported by and flow from the findings (OAG Audit 7021 Evaluate the sufficiency and appropriateness of audit evidence). Not every finding warrants a recommendation—only the ones with serious weaknesses. Each recommendation is written in a separate, stand-alone paragraph located in the section of the audit report where the related finding is discussed.

Recommendations guide the actions needed to correct the problems identified in the findings, but it is up to the entity to decide what these actions should be. Recommendations are

• thought out during the examination phase;

• entity-specific, even in government-wide and sectoral audits;

• focused on areas of significant risk;

• fully supported by the audit findings and conclusions;

• consistent within the audit report and mindful of recommendations made in previous audit reports, where applicable;

• positive in tone and content;

• clear on the desired final outcome;

• succinct but detailed enough to stand alone;

• aimed at correcting the underlying causes of the weakness;

• results-oriented, giving an indication of the intended outcome;

• practical, such that the entity, taking into account legal and cost constraints, can implement them in a reasonable time frame; and

• specific enough to allow for monitoring and assessing progress made in implementing them—but not overly prescriptive.

Below are some examples of sound recommendations:

• Recommendation. National Defence should refine its estimates for complete costs related to the full life cycle of the F-35 capability, and provide complete estimated costs and the supporting assumptions as soon as possible. Furthermore, National Defence should regularly provide the actual complete costs incurred throughout the full life cycle of the F-35 capability.

• Recommendation. Transport Canada should clarify what information on industry and aviation companies should be used in making risk-based decisions, collect that information, assess its completeness and reliability, and develop risk profiles when preparing annual surveillance plans in the regions.

• Recommendation. National Defence should review and apply the lessons learned with these helicopter acquisitions to ensure that, for future major capital equipment acquisitions, the degree of modifications and/or development involved is fully reflected in approval documents—in the assessment of risk, project timelines, and costs—and that procurement strategies are tailored to the complexity of the equipment being acquired.

For sectoral and government-wide audits, the engagement leader discusses recommendations made to entities other than those in his or her usual portfolio with the appropriate principal responsible for that entity.

Findings that point to making a recommendation for changes to legislation are highly sensitive and need to be discussed with Legal Services with special approval from the Auditor General.

To enable the development of clearly stated and action-oriented recommendations and to provide the audited entity with the time required to prepare responses and develop an action plan, the audit team seeks the views of entity officials as early as possible, normally close to the end of the examination phase when drafting the audit report. The PX draft includes draft recommendations.

Discussions between the engagement leader and the entity’s senior management at this stage include the suitability and practicality of the draft recommendations and the entity’s likely responses to them (OAG Audit 8019 Submitting the principal’s (PX) draft and transmission draft).

Entity responses to recommendations

The audit team begins drafting recommendations in preparation for the principal’s (PX) draft, and discusses responses with the entity as early as possible. By the time the transmission draft is issued, the entity responses to recommendations must be included in it. Publishing an audited entity’s response to a recommendation gives the entity the opportunity to indicate whether it agrees or disagrees with the recommendation, and what actions it intends to take and when. The response also provides a starting point for following up on the audit.

The OAG has established limits on the content and publication of entity responses and will not normally publish

• general responses to audit reports;
• entity responses where no recommendations have been made; or
• entity responses where, in the case of a follow-up on a previous audit, no new recommendations have been made.

It is not appropriate for entities to use responses to refute audit findings. Every effort is made to resolve disputes about the validity and completeness of audit findings during earlier discussions (OAG Audit 8019 Submitting the principal’s (PX) draft and transmission draft). Because the OAG is associated with everything it publishes and because it must follow professional standards, it will not publish anything that it believes is false or misleading. Responses are located right after the related recommendations.

Entity responses are required to clearly indicate if the entity agrees or disagrees with the recommendation. All responses must be kept to a maximum of 200 words, and should include actions that the entity’s senior management intends to take to respond to the recommendation. If the entity does not agree with the recommendation, the response must state the reason. This reason is also included in the audit report.

The response narrative must be consistent with the “Agreed” or “Disagreed” statement. It should also include actions, timelines, and clear accountability, all of which provide a basis for a potential future follow-up. The OAG determines whether the response wording is appropriate and sufficient. If agreement is conditional or partial, as a last resort only, the audit team, in consultation with the assistant auditor general, can consider changing the response to “Partially agreed” and communicate this to the entity. This option is available to the audit team but is not given to the entities and should only be used in exceptional circumstances.

The OAG encourages the audit committee to play an active role in reviewing and assessing the adequacy of the entity’s responses to the recommendations. When more than one entity has been audited, a joint response or multiple responses from each entity is acceptable. The audit team will inform the audited entity of any significant editorial changes to their final responses.

Below are some examples or responses that are not adequate:

In this first example, the response indicates that the Department disagrees with the finding (i.e., it is already doing what is recommended).

In this second example, the response indicates that the Department believes that it is already doing what is recommended, and that the ability to implement the recommendation depends on Government of Canada policies.

Follow-up audit work for performance audits

The follow-up audit work aims to assess progress made by entities to either implement recommendations from a previous performance audit or resolve the issues that the recommendations addressed. All reports that include a critical mass of follow-up audit work rate, according to the OAG’s criteria, whether progress has been satisfactory. Overall progress will be unsatisfactory if the entity has not fully implemented the more significant recommendations.

The follow-up audit portions of reports do not normally repeat recommendations from the previous report. Also, if there are findings and conclusions on new issues, the audit team may make “new” recommendations to address them. Recommendations resulting from follow-up audit work should be separate from recommendations that came out of new” audit work. The standards, policies, and guidelines for making recommendations are the same and, likewise, the entity’s responses are included in the final report.

Other issues for the attention of entity management

Sometimes the audit team identifies issues that are important enough to be brought to the attention of entity management but not necessarily to the attention of Parliament or the board of directors, or the issues may be outside the scope of the audit. For example, during an audit, an audit team may identify opportunities for entity management to improve procedures. In such instances, the audit team advises the entity (usually within one month of tabling/transmitting to the board the related report). The team communicates its findings to the deputy head, the chief executive officer or the head of the entity’s internal audit function, as appropriate. The preferred way to communicate audit findings is through a meeting with entity management. This may also be done through a management letter, in which case the Auditor General should be made aware of it. If the OAG issues a management letter, it may request a written response that includes proposed actions and target completion dates. The OAG may also choose to follow up on the issues at a later date.

Public Accounts Committee and action plans related to performance audit reports

Since October 2011, entities included in a performance audit report must provide the Public Accounts Committee with an action plan to be published on the Public Accounts Committee’s website. The plan must include specific actions, timelines for their completion, and responsible individuals—to the Public Accounts Committee and the Office of the Auditor General within six months of the audit being tabled, or prior to the Public Accounts Committee hearing. Performance audit reports tabled by the Commissioner of Environment and Sustainable Development are not referred to the Public Accounts Committee so there is no requirement for action plans from entities connected to CESD reports.