Results of the Planning Phase – CNSC 2017 Audit of Revenue Management and Cost Recovery

Office of Audit and Ethics

Approved on April 27, 2018

Purpose

The purpose of this planning document is:

• to present options for auditing revenue management and cost recovery to the Canadian Nuclear Safety Commission (CNSC) Departmental Audit Committee (DAC) for consideration
• to recommend an option to DAC members for their review and recommendation for approval by the President

Background

The Audit of Revenue Management and Cost Recovery was included in the CNSC Risk- Based Audit Plan for 2017–18 to 2019–20.

Revenue management and cost recovery activities are essential to support the CNSC in achieving its objectives. These activities are subject to scrutiny across the federal government and by the Canadian public. The CNSC is designated as a departmental corporation for the purposes of the Financial Administration Act,^{Footnote 1} and therefore must carry out cost recovery activities according to government regulations, central agency policies and directives, and applicable trade agreements.

The CNSC, with the approval of the Governor in Council pursuant to subsection 44(1) of the Nuclear Safety and Control Act, issued the Canadian Nuclear Safety Commission Cost Recovery Fees Regulations, which establish the basis for all licensing fees.

The Nuclear Safety and Control Act, in conjunction with the Canadian Nuclear Safety Commission Cost Recovery Fees Regulations, defines and establishes the CNSC’s cost recovery approach, the majority of which (over 85% in each of the four years ending March 31, 2017) is recovered from Regulatory Activity Plan (RAP) licensees. The end-to-end revenue management and cost recovery business cycle for RAP licensees starts in the regulatory activity planning phase, as a significant portion of fees charged to individual RAP licensees is based on an estimate of regulatory activities. The Canadian Nuclear Safety Commission Cost Recovery Fees Regulations requires a post year-end adjustment for RAP licensee fees, performed on a fixed proportion model, which allocates the final audited expenditures proportionately (based on planning phase estimates and any in-year applicable adjustments) across all RAP licensees.

The end-to-end revenue management and cost recovery business cycle consists of three distinct phases:

1. Planning phase: The majority of effort in the planning phase is associated with RAP licensees, starting at the end of the second quarter (year 0) with a target completion in February (year 0) for the forthcoming year.
2. In-year: RAP and other licensees are notified of fees, invoiced and fees collected, effectively starting April 1 and ending March 31 (year 1) – revenues and expenditures comprise amounts that appear on the CNSC’s audited financial statements.
3. Post year-end adjustment: The post-year adjustment relates to RAP licensees, where actual fees for individual licensees are calculated based on the audited financial statements (year 1), invoiced and collected; the process is completed in the second quarter of the following year (year 2) once the audited financial statements have been approved by management and DAC.

Preliminary audit objective and scope

The preliminary objective of the audit was to provide reasonable assurance that risk management, governance and controls over the revenue management processes were in place and functioning as intended.

The preliminary audit scope included all elements of the revenue management and cost recovery business cycle.

Planning phase

The audit planning phase consisted of:

• interviews with CNSC managers and staff responsible and involved in revenue management and cost recovery activities; appendix A provides a list of the interviewees
• a review of the relevant documentation, referenced in appendix B
• an analysis of information gathered

The audit team conducted a risk and fraud assessment to identify potential areas of risk in the CNSC’s governance, risk management, and internal controls over revenue management and cost recovery business processes.

The following assurance work was considered in the audit planning phase:

• Recent audits that were conducted by the Office of Audit and Ethics (OAE) related to revenue management, including the 2012 Audit of Regulatory Activity Planning Processes and the 2016 Audit of the Operations Annual Planning Process.
• 2016 Fall Reports of the Commissioner of the Environment and Sustainable Development Report 1—Inspection of Nuclear Power Plants
• Recent external audits conducted by the Office of the Auditor General of Canada.
• Findings and recommendations from the CNSC’s Internal Controls and Policy Section related to revenue management and cost recovery activities.

Audit planning risk overview

The audit planning phase identified three potential risk areas that were assessed as medium or higher.^{Footnote 2} Additional assurance work would be required for the OAE to make observations and develop conclusions on these identified risks. The risk and supporting information related to the risk are as follows:

1. There is a risk that the Corporate Planning and Management Reporting System (CPMRS) tool re-design will not calculate RAP licensee fees accurately. For the purposes of audit planning, the potential for error was assessed as medium.^{Footnote 3}
   • The CPMRS tool re-design has been reported to Management Committee with a medium project risk (high impact, low probability).
   • The project was reported over-budget by >20% (variance of $208k on budget of $960k).
   • The original timeline for completion was 17 months, which was extended to 26 months (May 31, 2018).
   • The potential impact on 2018–19 operational planning was not evident and there was no information provided during the audit planning phase to clarify how much longer the existing COGNOS tool will be supported.
   • There was no evidence provided of the potential impact of the Financial Management System Replacement Project (also known as the SAP project, which is the vendor software) on the current or re-designed CPMRS tool.

   CSB may wish to consider the risks associated with delays in the CPMRS tool re- design on:

   • the 2017–18 and 2018–19 operational planning process
   • an unsupported existing COGNOS tool
   • the Financial Management System Replacement Project (SAP) on the current and re-designed CPMRS tool

   The Corporate Services Branch (CSB) management should share its perspective on these risks with Management Committee.

2. Section 6(1)(a) of the Canadian Nuclear Safety Commission Cost Recovery Fees Regulations establishes a cost recovery approach whereby the CNSC adjusts estimated RAP fees for each facility or activity based on the actual full cost. There is a risk that the CNSC’s use of a methodology to recover costs on a basis other than actual full cost is not permissible, as defined in the Canadian Nuclear Safety Commission Cost Recovery Fees Regulations. For the purposes of audit planning, the risk of error was assessed as significant.^{Footnote 4}

   The CNSC uses a fixed proportion model to adjust final RAP fees, whereby costs are fixed as a percentage of the initial cost allocation. The initial RAP fee estimate is adjusted by an amount equivalent to the difference between the initial CNSC RAP fee estimates and the actual cost of operations as per the CNSC’s audited financial statements, times the percentage of initial cost allocation the licence fee represents. The CNSC adjusts the initial cost allocation with any in-year adjustments, such as in cases where a licence is revoked, or a new licence application is received. The variance between planned and actual efforts does not directly impact the fee for individual licensees; therefore, the fee for each facility or activity has not been adjusted to the actual full cost.

   There was no evidence provided during the audit planning phase of an Order in Council that provides the CNSC with the authority to interpret the cost recovery methodology (i.e., the fixed proportion model).

   There was an indication this risk was mitigated through disclosures in the Canada Gazette – Part I – Ottawa, Saturday, February 1, 2003 – Canadian Nuclear Safety Commission Cost Recovery Fees Regulations, resulting in approval by the Governor in Council of the current Canadian Nuclear Safety Commission Cost Recovery Fees Regulations.^{Footnote 5} The Canada Gazette article contemplates recoverable activities as including the RAP licensees “proportionate shares of applicable regulatory policies, standards, guides, and procedures”. The context of this comment appears to apply to the allocation of indirect costs rather than to the proportional sharing of costs across all RAP licensees.

   Management obtained formal internal approval from Management Committee to prescribe fees for regulatory activities and adopt the fixed proportion model. The CNSC provided assurance to the Cost Recovery Advisory Group (CRAG) that the CNSC has legal authority to apply the fixed proportion model. There was no specific concern regarding fees raised by CRAG members.

   CSB, in consultation with Legal Services, may wish to consider the risk that the fixed proportion model would not achieve actual full cost recovery for each facility or activity as defined under the Canadian Nuclear Safety Commission Cost Recovery Fees Regulations. CSB management should share its perspective on this risk with Management Committee.

3. There is a risk that the CNSC’s use of a fixed proportion model would not achieve a reasonable estimate of the cost of regulatory activities for RAP licences, as defined in the Canadian Nuclear Safety Commission Cost Recovery Fees Regulations. Section 44(3) of the Nuclear Safety and Control Act requires the CNSC to ensure that the fee for a licence or class of licence may not exceed a reasonable estimate of the cost of the Commission’s regulatory activities related to that licence or class of licence. There was no preliminary evidence provided during the audit planning phase that the CNSC compared the final RAP fees using the fixed proportion model to the actual cost by individual RAP licensee to determine whether the fixed proportion model provides a reasonable estimate of the cost of regulatory activities. The audit planning process assessed the risk of error as medium.^{Footnote 6}

   The impetus for the 2003 change to the Canadian Nuclear Safety Commission Cost Recovery Fees Regulations was predicated on the need for greater equity^{Footnote 7} for individual RAP licensees. Actual costs by RAP licensee were calculated after the Canadian Nuclear Safety Commission Cost Recovery Fees Regulations was established. Subsequently, the fixed proportion model was adopted, with the objective to “increase the predictability of fees and sources of funds, clarity, transparency, fairness/equity and minimise operational and corporate burden”.^{Footnote 8}

   There was an indication this risk was mitigated through the scope and findings of the 2016 Audit of the Operations Annual Planning Process. There was no preliminary evidence provided during the audit planning phase that external members of CRAG challenged the equity of the CNSC’s cost control efforts. An analysis of 2014–15 and 2015–16 RAP fees indicates that the fixed proportion model was applied consistent with the documented process. Year-end RAP fee adjustments have been downward by ~3% for each of 2014–15 and 2015–16.

   Management may wish to consider whether the method for cost recovery ensures a reasonable estimate of the cost of regulatory activities for RAP fees by licence or class of licence, pursuant to section 44(3) of the Nuclear Safety and Control Act. CSB management should share its perspective on this risk with Management Committee.

   This will help clarify any issues that might be raised in the future regarding the use of the fixed proportion model.

The risk assessment also considered potential for fraud, which was assessed as being controlled to a reasonably low level.

Options for consideration by DAC

The audit planning phase typically culminates in a refined audit objective, scope, and approach based on the results of the risk assessment. In the context of the three potential risk areas identified in the audit planning risk overview section, the following are alternatives to the audit approach:

Option A – Full audit:

The OAE could conduct a full audit of key operational controls in the end-to-end revenue management and cost recovery business cycle. A full audit would provide an increased level of assurance that risk management, governance and controls over the revenue management processes were in place and functioning as intended. However, the risk and fraud assessment does not support this alternative, based on the recent assurance work that was completed related to revenue management and the management controls in place. The overall risk was mitigated to an acceptably low level.

Option B – Focused audit:

The OAE could conduct a focused audit of potential risks that were assessed as medium or higher. The scope of a focused audit would include key controls related to the three risk areas in the audit planning risk overview section above. This alternative would provide authoritative observations and recommendations against which management would be held to account, helping ensure action is taken to address any significant risks and opportunities. However, the pending implementation of the Financial Management System Replacement Project (SAP) will have a significant impact on revenue management and cost recovery processes and controls. Audit observations on current and historic business processes and any recommendations will have limited usefulness with the implementation of SAP and the new business processes.

Option C – Delay/ Postpone/ Re-assess:

The OAE will re-assess risks and potential indicators of fraud related to the end-to-end revenue management and cost-recovery business cycle during the annual preparation of the CNSC’s Risk-Based Audit Plan. The forthcoming SAP implementation, the CPMRS tool re- design and any policy and regulatory reset will result in changes in end-to-end business process risk management, governance and controls. These changes will be taken into consideration when reassessing risks and priorities in the Risk-Based Audit Plan to establish when an audit would be required or viable.

Recommendation

It is recommended that Option C be reviewed by DAC and recommended for approval to the President.

Auditee management

The OAE discussed the results of the audit planning phase with Finance and Administration Directorate (FAD) management. The OAE and FAD management team recognize the impact of the SAP implementation, and that there is likely limited value-add in additional audit work at this time, on the risks identified. Postponing/delaying the audit to the future would provide FAD management with an opportunity to consider the risks identified in this report while preparing for the SAP implementation and subsequent audit of revenue management and cost recovery.

Audit team members

This audit planning phase was conducted by the following OAE team members:

• Joe Anton, Chief Audit Executive
• Rolf Krantz, Audit Team Lead
• Daniel Murphy, Internal Auditor Project Leader
• Ron Chuchryk, Senior Internal Auditor
• Jack Nesbitt, Co-op Student

Acknowledgement

The OAE would like to acknowledge and thank management and staff for their support during the planning phase of the audit.

Conformance with professional standards

The planning phase of the audit conforms to the Internal Auditing Standards for the Government of Canada, as supported by the results of the OAE’s quality assurance and improvement program.

Appendix A: Audit planning interviews

The following is a list of individuals interviewed during the audit planning phase:

• Director, Financial Resource Management and Systems Division, Finance and Administration Directorate
• Director General, Directorate of Nuclear Substance Regulation
• Director General, Directorate of Regulatory Improvement and Major Projects Management
• Director General, Financial and Administration Directorate
• Chief, Estimates and Supply, Financial Resources Management and Systems Division, Finance and Administration Directorate
• Senior Financial Advisor, Estimates and Supply, Financial Resources Management and Systems Division, Finance and Administration Directorate
• Financial Advisor, Revenue Management, Financial Resources Management and Systems Division, Finance and Administration Directorate
• Chief, Financial Management, Financial Resources Management and Systems Division, Finance and Administration Directorate
• Chief, Financial Systems, Financial Resources Management and Systems Division
• Director, CNSC Audit, Office of the Auditor General of Canada

Appendix B: Document reference

The following is a list of significant documents considered in the audit planning phase:

• Canadian Nuclear Safety Commission Cost Recovery Fees Regulations
• Policy on Service Standards for External Fees
• Nuclear Safety and Control Act
• Order In Council PC Number: 2003-0869
• Canada Gazette - Part I - OTTAWA, SATURDAY, FEBRUARY 1, 2003 - Canadian Nuclear Safety Commission Cost Recovery Fees Regulations
• 2016 Fall Reports of the Commissioner of the Environment and Sustainable Development Report 1—Inspection of Nuclear Power Plants—Canadian Nuclear Safety Commission
• Management Discussion and Analysis - Financial Statements for the Year Ending March 31, 2017
• Canadian Nuclear Safety Commission 2015–16 and 2014–15 annual reports
• Audit of the Operations Annual Planning Process (2016)
• Audit of Regulatory Activity Planning Processes (2012)
• Operations Work Plan Steering Committee (OWPSC) Terms of Reference
• Cost Recovery Advisory Group Terms of Reference
• Cost Recovery Advisory Group meeting minutes
• Harmonized Plan Update to Management Committee
• Design and operating effectiveness reports 2014–15
• Management Committee Meeting Minutes
• Financial Management System Replacement Project Presentation
• Revenue Management Model Initiative (Presentation to Operations Management Committee)
• CPMRS Project Management Plan
• Review of the Revenue Management Model Standardization of Costing Formula Fees
• RAP Fee Revenue Management Process
• Revenue Business Process Workflow Description
• CNSC Cost Allocation Methodology
• Cost Recovery Fees Schedule Formula 2016–17
• CNSC Cost Recovery Program Description
• RAP Fee Estimates Notification 2014–15 and 2015–16
• Initial RAP Fee Notification to Hydro-Québec
• Revised RAP Fee Notification to Hydro-Québec and Approval
• Cost Recovery Governance Review
• Guidance on Regulatory Framework - Planning and Time Recording by Type Phase
• CNSC Time Reporting Guide
• Chart of Accounts Modifications Procedures
• Cost Code and Type Phase Code Change Procedure