Fiscal year 2021-2022 - Annex to the Statement of Management Responsibility Including Internal Control over Financial Reporting - Unaudited

2.1 Internal control management

The CSA has a well-established governance and accountability structure to support departmental assessment efforts and oversight of its system of internal control.

A departmental internal control management framework, approved by the deputy head, is in place and comprises:

• Organizational accountability structures as they relate to internal control management to support sound financial management, including the roles and responsibilities of senior departmental managers for control management in their areas of responsibility;
• Values and ethics;
• Ongoing communication and training on statutory requirements, and policies and procedures for sound financial management and control;
• Risk-based monitoring and regular updates on internal controls, with an approved annual evaluation plan, results communicated to senior departmental management and an action plan required to address highlighted weaknesses. The Departmental Audit Committee receives a summary of findings and action plans twice a year.

The Departmental Audit Committee provides advice to the deputy head on the adequacy and functioning of the department's risk management, control and governance frameworks and processes.

2.2 Service arrangements relevant to financial statements

The CSA relies on other organizations to process and capture certain transactions recorded in its financial statements, as follow:

3.1 New or significantly amended key controls

In the current fiscal year, there were no significant changes in existing business processes requiring a reassessment of key controls. The future of work at CSA will be hybrid of working from home and office. We continue to encourage electronic documentation of controls to facilitate access and review when possible.

3.2 Ongoing monitoring program

As part of its rotational ongoing monitoring plan, CSA completed its reassessment of internal controls over financial reporting and internal controls over financial management embedded within the following business processes:

• Planning and budgeting
• Procurement to Payment
• Payroll
• SAP Access controls.

Overall, key controls are functioning as designed in preventing significant misstatements in financial reporting and in ensuring prudent use of public resources. Weaknesses highlighted were mainly due to

• Inappropriate documentation of the executed controls
• Minor instances of non compliance with delegated authority
• Timeliness in the execution of controls (pre-payroll and post payroll verifications)
• Untimely deactivation of access rights to the financial management systems
• Immaterial salary overpayments
• Minor errors in proactive disclosure of contracts.

Remediation actions implemented for identified weaknesses were:

• Formal reminder in meetings of the importance of executing and documenting controls in a timely manner
• Frequent periodic review of SAP accesses awarded and segregation of roles
• Recovery of identified overpaid salary amounts
• Sampling contracts from proactive disclosure reports to ensure accuracy.