Just-In-Time Audit: Investing in Canada Infrastructure Program: COVID-19 Resilience Infrastructure Stream

Copyright

This publication is available upon request in accessible formats.
Contact:
Communications Branch
Infrastructure Canada
180 Kent Street, Suite 1100
Ottawa, Ontario K1P 0B6

National information line on infrastructure: 613-948-1148
Toll free number: 1-877-250-7154
TTY: 1-800-465-7735
Email: infc.info.infc@infc.gc.ca

This publication is available at: https://www.infrastructure.gc.ca/pd-dp/ia-vi/index-eng.html

Permission to Reproduce
Except as otherwise specifically noted, the information in this publication may be reproduced, in part or in whole and by any means, without charge or further permission from Infrastructure Canada, provided that due diligence is exercised in ensuring the accuracy of the information reproduced; that Infrastructure Canada is identified as the source institution; and that the reproduction is not represented as an official version of the information reproduced, nor as having been made in affiliation with, or with the endorsement of, Infrastructure Canada.

For permission to reproduce the information in this publication for commercial redistribution, please email infc.info.infc@infc.gc.ca.

© His Majesty the King in Right of Canada, as represented by the Minister of the Office of Infrastructure of Canada, 2022.

Cat. No. T94-47/2023E-PDF
ISBN 978-0-660-47926-2

Aussi disponible en français sous le titre : Vérification en temps opportun - Programme d’infrastructure Investir dans le Canada : volet Résilience à la COVID-19

Table of Contents

• Executive Summary
  • Background
  • Objective
  • Key Findings
  • Conclusion
  • Noted Best Practices
• Background
  • Investing in Canada Infrastructure Program
  • Adapting ICIP as a Response to COVID-19
  • COVID-19 Resilient Infrastructure Stream (CVRIS) Funding
  • Ventilation Improvement Funding
• Audit Objective and Scope
  • Objective
  • Sub-Objective
  • Scope
  • Statement of Conformance
• Summary of Key Findings
• Key Findings
  • Key Findings #1
  • Key Findings #2
• Conclusion
• Management Action Plan
• Annex
  • Annex A - Audit Objective and Criteria
  • Annex B - Internal Audit Methodology

---

Executive Summary

Background

The COVID-19 pandemic had a profound impact in communities in Canada and around the world. As part of the Government of Canada’s pandemic response, Infrastructure Canada (INFC) directed new and existing funding towards projects that support communities. This included the introduction of the COVID-19 Resilience Infrastructure Stream (CVRIS), a time-limited, targeted stream under the Investing in Canada Infrastructure Program (ICIP), to build pandemic-resilient infrastructure, and support economic recovery efforts across Canada. The design of the CVRIS included a streamlined project approval process to accelerate access to funds and offer quick financial relief to ultimate recipients.

Objective

The objective of this Just-In-Time Audit of the ICIP-CVRIS was to determine whether efficient and effective processes and internal controls are in place to assess and recommend project submissions for funding approval, and to monitor those projects submitted by recipients in accordance with the terms and conditions under the ICIP and the Integrated Bilateral Agreements (IBAs).

Key Findings

1. Key processes and internal controls for the initial design and delivery of the CVRIS were defined and documented, but were not consistently applied when the CVRIS transitioned from delivery by a dedicated team to regional program delivery teams.
2. Centralized monitoring controls and processes, such as data analytics and dashboards, were established to assist program delivery staff. Gaps exist with respect to documenting risk management practices, as well as the tools and guidance related to these.

 

Conclusion

The audit concluded with reasonable assurance that the governance, risk management and internal control processes established under the CVRIS to assess and recommend project submissions for funding approval were generally efficient and effective to ensure compliance with IBAs, and the ICIP’s terms and conditions. These processes resulted in all sampled projects being eligible according to the established criteria.

In addition, considering the rapid development and implementation of the CVRIS in the context of the pandemic, the audit concluded that INFC designed adequate monitoring controls for managing the CVRIS and project-level risks in accordance with the Treasury Board Policy on Transfer Payments.

Opportunities for improvement that were identified related to:

• Transitioning program delivery, including clarity on roles and responsibilities, updated processes and tools;
• Reassessing program risks, including effective ongoing monitoring controls and quality assurance processes (as required).

Noted Best Practices

INFC’s pandemic response has revealed important insights and lessons learned regarding organizational agility, and ability to adapt quickly under exceptional circumstances. For instance, the audit noted some best practices and program efficiencies, including:

• A new streamlined approach for submitting and reviewing project funding applications;
• The early vetting of project submissions with recipients;
• Combining claim payments and progress reports; and
• The use of surge teams to temporarily increase program capacity.

---

Background

Investing in Canada Infrastructure Program

Figure 1:

 

Under the Investing in Canada Plan, the Government of Canada (GoC) committed over $180 billion in public transit, green, social, trade and transportation, and rural and northern infrastructure (see Figure 1).

As part of Investing in Canada Plan, Infrastructure Canada (INFC) has made available $33 billion in funding initiatives under the Investing in Canada Infrastructure Program (ICIP). This allocation-based program is being delivered through Integrated Bilateral Agreements (IBAs) with Provinces and Territories (P/Ts). The ICIP provides long-term predictable funding and support for provincial, territorial, municipal and Indigenous priorities while remaining focused on the GoC’s objectives of creating long-term growth, improving the resilience of communities, transitioning to a clean growth economy, improving social inclusion, and improving economic outcomes of Canadians.

Adapting the ICIP as a Response to COVID-19

Given the significant health and socio-economic challenges brought on by the pandemic, INFC was charged with adapting its programs to respond. In early 2020, the ICIP was INFC’s flagship program and actively funding infrastructure projects in all P/Ts through the IBAs. The Department used the streamlined approval processes, put in place at the GoC level for pandemic-related initiatives, to quickly seek the necessary policy and financial authorities to adapt the ICIP with a COVID-19 specific response stream.

This time-limited, targeted stream of funding was designed to build pandemic-resilient infrastructure and support economic recovery efforts across Canada. The stream included a simplified project approval process to accelerate P/Ts' access to infrastructure funding who, in turn, can offer quicker financial relief to their communities.

The CVRIS provided P/Ts with the flexibility to fund a range of new project categories, such as retrofits, repairs and upgrades for municipal, territorial, provincial and Indigenous buildings, health infrastructure, and schools. Unlike the outcomes-based approach used for the original four ICIP funding streams, the CVRIS used an asset-based approach for project eligibility and data collection. In addition, the CVRIS provided the option for P/Ts to simultaneously submit a large volume of project applications to INFC to lessen their administrative burden and to help expedite the approval process.

COVID-19 Resilient Infrastructure Stream (CVRIS) Funding

The CVRIS is supported by a transfer of up to 10% of the existing funding allocations under the original four ICIP streams for projects to begin construction prior to September 30, 2023, and to be completed by December 31, 2023 (2024 in the territories and in remote communities).

Potential projects could not exceed $10M in total eligible costs. They allowed for an increased federal cost-share (up to 80% for provinces/100% for territories).

With the $120M in ventilation funding (2020), the $70M ventilation top-up (2021) and transfers requested by P/Ts, a total of $2.02B is available to fund potential CVRIS projects. Over 2,000 projects have been approved with a federal share of up to $1.93 billion.

Figure 2: Funding under the CVRIS supports projects in the following 5 categories

Ventilation Improvement Funding

Following the launch of the CVRIS, recipients identified a specific need related to ventilation projects.

The Fall Economic Statement 2020 announced the Ventilation Improvement Fund to make necessary investments to public buildings in order to improve indoor air quality, which in turn would help reduce the spread of COVID-19. INFC delivers $120 million of that fund through the CVRIS.

Further measures related to clean and healthy indoor air were announced as part of the Economic and Fiscal Update 2021 and included an additional $70 million to support ventilation projects in public and community buildings, such as hospitals, libraries, and community centres. This funding is also provided via the CVRIS.

Project costs for ventilation projects are retroactively eligible for funding for any eligible expenditures incurred after December 31, 2020. This applies to projects approved by March 31, 2022. Projects need to be substantially completed by March 31, 2023 (2024 in the territories and in remote communities). There is no construction start date requirement for ventilation improvement.

---

Audit Objective and Scope

Objective

The audit objective was to provide reasonable assurance on the efficiency and effectiveness of governance, risk management and internal control processes for assessing and recommending projects for funding approval under the CVRIS to ensure compliance with the terms and conditions under the ICIP and IBAs.

Additionally, considering the rapid development and implementation of the CVRIS within the context of the pandemic, the audit assessed whether INFC has designed adequate project monitoring controls under the CVRIS for managing stream- and project-level risks in accordance with the Treasury Board’s Policy on Transfer Payments.

Sub-Objective

Efficient and effective processes and internal controls are in place under the CVRIS stream to assess and recommend project submissions for funding approval and to monitor those projects submitted by P/Ts in accordance with the terms and conditions under the ICIP and IBAs.

Scope

The scope of the audit included all projects submitted and approved under the CVRIS, including the ventilation improvement projects, for the period April 1, 2020, to January 26, 2022.

A sample of 43 CVRIS projects was selected from the 2,013 approved projects as of January 26, 2022.

Statement of Conformance

In accordance with INFC’s approved 2021-22 to 2025-26 Integrated Audit and Evaluation Plan, the Internal Audit Directorate undertook this Just-In-Time Audit of the ICIP-CVRIS.

The internal audit conforms to the Institute of Internal Auditors' International Standards for the Professional Practice of Internal Auditing, as supported by the last results of the Quality Assurance and Improvement Program.

See Annex A for more details on audit criteria and risk ratings and Annex B for the audit methodology.

---

Summary of Key Findings

---

Key Findings

Key Findings #1

Key processes and internal controls for the initial design and delivery of the CVRIS were defined and documented, but were not consistently applied when the delivery of the CVRIS transitioned from a dedicated team to regional program delivery teams.

The CVRIS Delivery Transition, including Shifting Roles and Responsibilities

The Communities and Infrastructure Programs (CIP) Branch facilitates investment in public infrastructure through the design, delivery, and performance measurement of a wide array of programs, including the ICIP. Within the CIP branch, the original four streams of the ICIP are managed by two primary groups:

Program Integration Directorate: responsible for program level design, tools, guidance, and advice to regional teams.

Regional Teams: primary contact with P/Ts, manage project review, approval, and monitoring.

At the onset, a dedicated team was established by using existing resources to quickly implement and oversee the delivery of the CVRIS. Both the federal and provincial governments wanted to approve projects as quickly as possible so that ultimate recipients could fund projects that would help with pandemic response or economic recovery.

In the fall of 2020, the dedicated team began transitioning the CVRIS design and delivery processes to existing CIP Branch resources, with stream responsibilities being split between the regional teams and the Program Integration Directorate.

Project review, approval and monitoring of the CVRIS projects were transferred to the regional teams that were already responsible for projects in the other ICIP streams.

Responsibility for the CVRIS-level processes, tools, and guidance was transferred to the Program Integration Branch that was already responsible for those elements of the other ICIP streams.

The hand-over was completed by the end of January 2021, just as the CVRIS project submissions were reaching a peak.

The following timeline (see Figure 3) shows some key dates for CVRIS related to program management and project submissions, highlighting the often-overlapping work during the first year of the pandemic.

Figure 3: Key Dates in CVRIS Design & Delivery

Text description of image 1

The diagram entitled “Figure 3: Key Dates in CVRIS Design & Delivery” is a flowchart illustrating the timeline of the launch of the COVID-19 Resilience Infrastructure Stream. Each key date is bulleted using one of three colours to categorize each as they relate to either the CVRIS Program (black), Program Management (red) or Project Submissions (grey) program delivery phases. The flowchart reads as follows in sequential order:

• Dedicated CVRIS Team Created in May 2020 – categorized as Program Management.
• CVRIS Announced in August 2020 – categorized as CVRIS Program.
• First CVRIS project submissions received in October 2020 – categorized as Project Submissions.
• Ventilation funding announced in the Fall Economic Statement 2020 in November 2020 - categorized as CVRIS Program.
• Training sessions provided by Dedicated CVRIS Team to the regional teams from November to December 2020 - categorized as Program Management.
• Dedicated CVRIS Team dissolved in January 2021 - categorized as Program Management.
• “Peak Period”: Majority of project submissions received (~1,800 of the ~2,000 total projects were received during this period) from January to April 2021 - categorized as Project Submissions.
• Details of the ventilation funding announced ($120M) (stemming from the Fall Economic Statement 2020) in April 2021 - categorized as CVRIS Program.
• ICIP’s Management Control Framework and guidance / generic training materials updated in July 2021 - categorized as Program Management.
• Top-up in ventilation funding announced ($70M) in December 2021 - categorized as CVRIS Program.

Challenges in the CVRIS Transition

There was misunderstanding from the regional teams around stream-specific expectations related to project review and approval processes. While support for the transition was available through discussions at regular meetings, or through the former members of the CVRIS dedicated team, some staff struggled to obtain the most recent approved guidance materials and templates. Due to the quick implementation of the CVRIS, some guidance materials and templates were not approved at the time of the transition. The final approved versions of these materials were not placed in the centralized repository until six months after the transition was completed. In addition, CVRIS project eligibility questions were not added to the existing eligibility tracking tool, making it difficult for regional program analysts to properly and consistently determine project eligibility.

Analysis of the sample found all core program requirements were met however, the way in which guidance materials and suggested templates were applied was not consistent after the regional teams assumed responsibility. The issues noted above did not impact the determination of eligibility of CVRIS projects, but likely led to some avoidable inefficiencies, especially early in the transition period.

Compensating Practices during Transition

This change consolidated the management of all projects under the ICIP in each jurisdiction, and ultimately offered greater ease-of-use and efficiency for both the regional teams and the P/Ts.

The audit further found that many transition issues were mitigated when former dedicated team members later joined some of the regional teams. This provided those regions with specialized program knowledge, notably in assisting with project eligibility concerns. Further, the Program Integration Secretariat provided additional support and advice to the regional program analysts on stream eligibility questions.

The audit also found that a "surge team" – which consists of additional on-demand capacity created to support the CIP Branch priorities – was used to help address an influx of the ICIP project applications, notably a large volume received from a single province. The use of a surge team is an identified best practice for managing capacity, and its use is encouraged, especially for programs that experience significant short-term increases in volume. While the service standard to approve projects under CVRIS was not always met, INFC made best efforts to maximize the capacity available. The inability to meet the service standard was primarily due to a short period where project volume exceeded capacity, even with the additional support of the surge team.

Key Findings #2

Centralized monitoring controls and processes, such as data analytics and dashboards, were established to help program delivery staff.

Gaps exist with respect to documenting, and the tools and guidance related to risk management practices.

Evolution of the Program and Project Risk Assessments under the ICIP

The risk environment for the ICIP is made up of risks at both the program and project levels. The program-level risk management framework includes controls and measures that have an impact on the program, while the project-level tools include controls and measures that relate to the lifecycle of individual projects.

Program level:

As ICIP was an existing program, there was a program level risk assessment previously conducted, prior to the launch of the CVRIS, which covered the original four streams. During the early design stage of the CVRIS, a program level risk assessment exercise was once again conducted, specifically to address the impacts of the pandemic. In July 2021, as part of the overall ICIP Program Risk Profile update, the CVRIS-specific program level risks and mitigation strategies were added to the Program Risk Profile.

Project level:

Under the other streams of the ICIP, all projects submitted for funding undergo a comprehensive risk assessment as part of INFC’s due diligence review. Given that, by design, the CVRIS favoured low-risk, short term projects, the project review and approval process was further streamlined with the development of a risk screen that would focus primarily on the following three risk factors: 1) project’s ability to meet construction start and end dates aligned with CVRIS timelines; 2) legislative requirements are applicable (i.e. Environmental Impact Assessments/Duty to Consult with Indigenous communities); and 3) other concerns (i.e., complexity, project readiness, and ultimate recipient capacity). The risk screen should determine the risk to fund a given project.

In early guidance documents, the project review and approval process required an initial risk screening of the CVRIS project risks, but did not specify the use of a risk screening tool. Further, the project risk screening process was not required to be formally documented, unless project-specific risks were identified in the previous three areas mentioned above.

The process of “right-sizing” due diligence to focus efforts on areas of higher risk greatly accelerated the speed at which the high volume of projects were approved, which was an important element in providing financial support and budgeting confidence for communities.

Inconsistencies in Documentation of Risk Screenings

The audit found that documentation to support project-level risk screenings was inconsistent between projects. For example, some project documentation clearly indicated that project risk screenings were performed, while other project files used other, less clear means to document the project information and the due diligence performed during project assessment. These inconsistencies were specifically noted during the peak period, and were not unexpected, given the guidance available at that time.

Compensating Practices

In some cases, an early vetting of project submissions was performed by regional program analysts. The practice provided an opportunity to flag potentially higher-risk projects to P/Ts (e.g., those at risk of not meeting construction timelines). As a result, some P/Ts replaced those higher-risk projects with lower-risk projects in their submission. This process resulted in most of the projects formally submitted and approved under the CVRIS being low-risk. It should also be noted that prior to the completion of the audit engagement, CVRIS-specific tools and risk guidance were being revised and updated.

CVRIS Program - and Project-level Monitoring Controls, including Quality Assurance

Project progress reports are one of the key monitoring controls to ensure projects are on track, monitor for delays, or identify other issues.

INFC monitors all approved projects using the data collected through progress reports, claims, and project changes submitted by recipients. A dashboard tool was also created and is updated on a weekly basis to provide key ICIP data, detailing each project’s reporting requirements, and compliance therein, for the current cycle.

Unlike other ICIP streams, claims for the CVRIS payments are integrated with the progress reports. INFC’s project management system includes a control to prevent claims from being paid until the requirements and conditions established at the time of project approval are met.

Lack of Formal Project-Level Risk Reassessment and Quality Assurance Processes

While most projects were initially assessed as low-risk, various events can lead to a change in the risk over time. The audit expected to find, for the CVRIS, a process and criteria for project risk reassessment based on monitoring activities and specific triggers. While there was no formal process established for reassessing the CVRIS project-level risks once they were approved, there were general ICIP monitoring guidance materials which include direction for regional program analysts to determine if a new project risk assessment is required when reviewing progress reports.

It was also noted that due to the different application process used for the CVRIS projects, they were not part of the existing Quality Assurance review of applications used by the other ICIP funding streams. Had the CVRIS projects undergone a Quality Assurance review, some of the inconsistency issues noted during the audit may have been resolved earlier. Having a Quality Assurance function helps ensure that quality and consistency are embedded in activities, operations and methodologies, and generally promotes continuous improvement while considering best practices and due professional care.

Compensating Practices

Due to the low-risk, short-term nature of the CVRIS projects, the audit found the impact of the lack of project-level risk screening reassessment to be low. The greatest CVRIS project-level risks relate to project timelines and the forecasted construction end dates, and those elements are monitored regularly by regional program analysts through project progress reports.

Prior to the conclusion of the audit, guidance, training materials and templates related to the project-level risk screening process (initial and reassessments) were being updated to address the gaps in the process noted during the audit.

 

Conclusion

The audit found that the governance and internal control processes established under the CVRIS to assess and recommend project submissions for funding approval were generally efficient and effective. All sampled projects that were reviewed during the audit were found to be eligible according to the established criteria. Finally, some best practices and process efficiencies were noted during the audit, including a new streamlined approach for submitting and reviewing project funding applications, the early vetting of project submissions with recipients, combining claim payments and progress reports, and the use of surge teams to temporarily increase program capacity.

INFC has designed adequate monitoring controls for managing the CVRIS and project-level risks in accordance with the Policy on Transfer Payments, and to ensure compliance with the terms and conditions under IBAs and the ICIP.

Opportunities for improvement that were identified related to:

• Transitioning program delivery, including clarity on roles and responsibilities, updated processes and tools;
• Reassessing program risks, including effective ongoing monitoring controls and quality assurance processes (as required).

---

Management action plan

	Recommendation	Management Action Plan	Deliverables	OPI, Due Date
1	It is recommended that the CIP Branch update the latest ICIP Program Risk Profile and Management Control Framework, in order to re-evaluate the program-level risks and include the following key elements specific to the CVRIS: Clearly defined and communicated roles and responsibilities; Risk management that includes senior management’s risk tolerance and mitigation measures; and Updated relevant monitoring controls.	The CIP Branch will reflect the recommendations provided in the management action plan by updating guidance and training, updating the ICIP Management Control Framework (MCF) and revising the ICIP Program Risk Profile. The CIP Branch can ensure that roles and responsibilities are clearly communicated and defined to regional teams and management by revising current program guidance materials (MCF, CVRIS Analyst Guide, Project Submission Guide, Progress Report Guide, training materials) to ensure that the processes around the CVRIS project review and approval are well defined for program delivery staff. The Program Risk Profile and the Program Control Framework section of the ICIP MCF will be updated to reflect any emerging risks and mitigation measures of the CVRIS funding stream to reflect senior management's risk tolerance.	Review of program guidance materials, incl. training (to clarify roles and responsibilities as needed) Updated Management Control Framework and Program Risk Profile (to update emerging risks) ICIP Committee discussion on the CVRIS monitoring tools	CIP, ADM March 1, 2023

---

Annex

Annex A - Audit Objective and Criteria

Objective

Efficient and effective processes and internal controls are in place under the CVRIS to assess and recommend project submissions for funding approval and to monitor those projects submitted by P/Ts in accordance with the terms and conditions under the ICIP and IBAs.

Audit Criteria

• 1.1 Roles and responsibilities for the implementation and delivery of the CVRIS are clearly defined, documented and communicated in a timely manner.
• 1.2 The CVRIS is implemented consistently across program operations with effective policies, procedures, and guidance in place in order to support management and staff in fulfilling their responsibilities in accordance with the terms and conditions under the ICIP and IBAs.
• 1.3 In the context of the pandemic and considering the tight timelines to launch and deliver the stream, INFC has sufficient staff in place required for the effective design and delivery of the stream, including meeting the CVRIS service standards related to project approvals.
• 1.4 INFC has an adequate and documented risk management process in place to assess and mitigate stream and project risks.
• 1.5 INFC has an adequate monitoring process in place to ensure that approved CVRIS projects are meeting reporting and other requirements established in the IBAs, and that project changes or delays are handled efficiently, in compliance with the terms and conditions under the ICIP and IBAs.

Annex B - Internal Audit Methodology

Internal Audit Approach

In accordance with INFC’s approved 2021-22 to 2025-26 Integrated Audit and Evaluation Plan (IAEP), the Internal Audit Directorate undertook the Just-In-Time Audit of the ICIP’s COVID-19 Resilience Infrastructure stream.

A Just-In-Time auditing approach was used to provide timely assurance of the effectiveness of selected core controls. The audit performed a targeted review using a limited sample of projects; therefore, the audit results cannot be extrapolated. It is not a fully comprehensive assessment of all internal controls.

A risk-based approach was used to establish the objectives, scope, and approach for this internal audit.

Considering these risks, detailed audit criteria (found in Annex A) were developed to guide the audit field work and form the basis for the overall engagement conclusion.

The internal audit engagement included various tests, as considered necessary, to provide reasonable assurance on the overall engagement conclusion. These tests included, but were not limited to, interviews, walkthroughs, a review of supporting documentation, and other audit procedures. All project files were reviewed as part of the testing procedures.

The field work was substantially completed on July 27, 2022.

Internal audit findings were communicated to the auditee to validate facts and to confirm the clarity, accuracy, and completeness of the information reported.