Subject: Treatment Of Access To Information Requests For Audit Information
Question concerning this notice should be directed to:
Policy and Special Projects,
Centre of Excellence for Internal Audit
Comptrollership Branch, TBS
Purpose and Scope
The purpose of this Policy Interpretation Notice (PIN) is to provide the internal audit community with guidance relating to the treatment of requests for audit information made under the Access to Information Act. It is expected that departmental access co-ordinators will seek function- specific advice from the heads of internal audit concerning the release of audit records. Working within the basic tenets of the Act, this PIN identifies a decision-path approach which should enable audit officers to provide consistent and uniform advice to officers responsible for access decisions; advice which meets both the letter and intent of the Act in a meaningful way.
The guidance provided in this PIN supplements the formal policy instructions contained in the Interim Policy Guide, Access to Information Act and the Privacy Act issued by TBS (circular no.: 1983-35). The guidance is not meant to provide an alternative approach to the formal TBS instructions relating to access requests. The formal TBS policy clearly represents the authoritative document for dealing with requests under the Act and should be followed as a normal matter of course in all circumstances.
The guidance in this notice was considered necessary because of the impact of the Access to Information Act on the Standards for Internal Audit, particularly standards 17, 20 and 22. The standards relating to audit evidence, assignment reporting and post-audit consultation will be influenced by the release of audit records and as such further internal audit policy interpretation is appropriate.
The Interdepartmental Advisory Committee on Internal Audit felt that a government-wide, general approach to the treatment of requests for audit information would be beneficial in those instances where auditors are asked to give advice to their deputies. Auditors, in such situations, would provide advice which:
- deals with the provision of audit information according to the letter and intent of the law;
- helps applicants satisfy their requirements for audit information in a meaningful way;
- provides a consistent way of dealing with requests for audit records;
- ensures that requests are dealt with in an efficient manner; and
- maintains the integrity of the internal audit function.
The approach presented in this PIN is based upon these intended purposes. Its technical accuracy has been verified through discussions with both Justice Department legal advisers and the Treasury Board's Access to Information Task Force. The approach adopted reiterates the desire on the part of the internal audit community to honour the public's rights to audit information and to be sensitive to their needs. The PIN also explains those limited situations where the auditor may be expected to protect particular kinds of information, the release of which would cause identifiable harm or would be contrary to the law.
Interpretation Notice Position
In determining an approach to the treatment of requests for audit information, a number of basic premises were identified. These premises relate largely to the internal audit community's interpretation of the requirements of the Access to Information Act, within the context of the unique features of the internal audit process. They are meant to provide a logical basis from which an approach to information requests can be extracted. Although the premises have been carefully researched and their appropriateness discussed with a number of government officials, including legal advisers, they cannot be claimed to represent a conclusive basis for an approach in the absence of court interpretation of a number of the Act's provisions.
The premises underlying the proposed approach to access requests are:
- an ineffective internal audit function will be injurious to the internal decision-making processes of a government institution. In this regard, injury to the internal decision- making processes of the government is most likely to occur when audit information is released prior to the conclusion of the auditor's deliberative process. Disclosure of audit information prior to the conclusion of the auditor's deliberations may cause harm to the auditee by releasing information which unintentionally misrepresents the nature and state of the operations under review. Such disclosure of audit information will also likely hinder the frank exchange of views between auditors and auditees. Once an audit has been completed, however, the likelihood of injury resulting from disclosure of audit information is significantly diminished;
- the auditor's deliberations in arriving at an overall assessment of the auditee's processes and systems are not concluded until the auditee has had the opportunity to comment on the validity, completeness and relevance of the auditor's facts and conclusions presented in a draft report. Appendix A illustrates the audit process as a decision-making process and identifies the nature of the auditor's deliberations;
- since the amount of audit information related to any particular request may be extensive, auditors may seek to clarify, through informal discussions with the applicant, the nature of the interest in the audit information. This clarification will serve to localize the information requirement, thereby eliminating unnecessary retrieval, review and edit procedures and helping to reduce the access fee. Informal discussions, however, would only be conducted when the access co-ordinator acknowledges and approves of the nature of discussion intended;
- that portion of requested audit documents which contain data prepared for or by the auditee (i.e. source data), will be referred by the auditor to the auditee for determining whether disclosure can be permitted, Using the concept upon which subsection 8(1) of the Act is based, the original source of raw data is assumed to have "greater interest" while the auditor's interest is derivative and, and therefore, secondary. Formal use of subsection 8(1), however, would only apply in those situations where the auditee and auditor are employed in different government institutions.
The term "working papers" as used here is consistent with the descriptions provided in the Policy Interpretation Notice, 1983-02, "Audit Working Papers". In that document, draft audit reports are considered to be an integral part of working papers. This understanding of the term working papers is significant to the reader when considering the discussion provided below.
Treatment of Request for Information
Three possible paths are presented to guide the treatment of requests for internal audit information. The paths are distinguishable by the types of audit documents requested and the stage of the audit at the time the request for information is received. Figure 1 illustrates the following narrative comments in the form of a decision-path flow chart.
Please refer to flow chart found in hard copy.
Decision Path 1
In this scenario, the request for information is received subsequent to the completion of an audit and is clearly directed towards obtaining the final audit report. When this situation occurs, it is suggested that as a general rule, release of the entire report be recommended to the deputy head. This disclosure includes the release of recommendations, management's response, and action plans, where it is the practice to include these in the report. Notwithstanding the general rule, auditors may recognize limited instances where conclusions and recommendations contained in the final report include information, the disclosure of which could cause identifiable harm to the internal decision-making processes of the government institution. For such instances, the invocation of paragraph 21(1)(a) may be applicable. For instance, if an institution's decision-making capability is likely to be harmed as a result of disclosing audit conclusions and recommendations, this information should be protected until the likelihood of injury passes. Harm in this context means having a detrimental effect on the specific interest, the decision-making process, covered by this exemption. Although administrative change or embarrassment to public servants could result from disclosure of audit conclusions and recommendations, auditors should note that these effects by themselves are insufficient in demonstrating harm to the decision-making process and therefore don not represent satisfactory grounds for invoking paragraph 21(1)(a).
The general rule favouring full disclosure is thought to be associated with certain benefits. First, full disclosure of the final audit report provides the applicant with a complete and balanced view of the processes under review and minimizes the risk of misinterpretation. The disclosure of auditee comments in response to audit recommendations enhances the credibility of the reported results. The release of the action plans, in response to the audit recommendation, provides evidence to the constructiveness of the audit process. Second, full disclosure of audit reports is also an efficient treatment of requests. Costs associated with editing the contents (severing, per section 25) for release to the public would be limited to those associated with the identification and removal of specific exempt information as noted above.
Audit officers cannot be expected to be aware of all the implications related to the release of information contained in audit reports. Consequently, prior to recommending release of the audit report, the audit officer should consult with the auditees in order to determine whether they feel that there are any legal restrictions relating to disclosure.
For full disclosure of final audit reports to be a practical method of satisfying access to information requests, the auditor must ensure that the existing candour in reporting is maintained. While strong senior departmental management and audit committee support for complete and informative audit reports will in large measure ensure retention of an effective reporting process, auditors must do their part; they must ensure that the quality and integrity of their reports is not adversely affected by the knowledge that the contents may be disclosed to the public.
Decision Path 2
In this scenario, it is assumed that a request for information is received subsequent to the completion of an audit, but is directed towards obtaining audit information not contained in the final report.
Initially, the auditor may find it useful to informally attempt to clarify, through discussion with the applicant, the nature of the interest in audit information. Given the broad descriptions provided in the Access Register, the auditor may be able to help applicants localize their information requirement. This could be beneficial in that the volume of information that must be reviewed and edited may be reduced and discussion could help the applicant avoid excessive costs associated with access. Informal discussions, however, should not be seen as an attempt to circumvent the formal processed provided by the Act, and audit officers are advised to consult with their departmental access co-ordinator that use of subsection 1(8) of the Act may be in order.
Where Audit Services Bureau of Supply and Services Canada performs audits for client audit groups, the decision for disclosure of information will rest with the client department. It is the Audit Services Bureau's policy to transfer requests received directly by them to the client department through the application of subsection 8(1) of the Act. Requests for audit information received directly by the client department will not require the application of subsection 8(1) but the audit group would have to make arrangements with the Audit Services Bureau for retrieval of any audit records stored at their premises.
Where the applicant requires working paper information other than source data, the auditor should review the requested material according to the provisions of the Access to Information Act. Particular attention during this review should be given to the applicability of sections 16, 19, 21 and 22 of the Act. These exemptions and their use are fully described in the TBS Interim Policy Guide and should be carefully reviewed by all auditors. These sections are considered more likely to be associated with the normal contents of working papers than other exemption provisions included in the Act, but emphasis on these sections does not preclude a full consideration of all other exemptions.
Paragraph 21(1)(a) may technically apply to parts of draft reports included within the audit working papers. In addition, paragraph 21(1)(b) could apply to working papers documentation such as interview notes and minutes of meetings between government officials. However, as noted in Decision Path 1, sub-section 21(1) is a discretionary class test exemption and the auditor is advised to determine the existence of harm to the internal decision-making processes when deciding on whether to apply this provision. In this scenario, the audit deliberations have been completed and it is less likely that injury to the internal decision-making processes can be demonstrated. Consequently, under normal circumstances it is expected that paragraphs 21(1)(a) and (b) would not be applied.
Decision Path 3
The most difficult scenario in the treatment of access requests is that situation where a request for audit information is received prior to the completion of the audit. Disclosure of audit information containing tentative observations or conclusions may result in unintentional misrepresentation of the nature and state of the processes under review. Such disclosure would likely hinder the working relationship between the auditor and auditee and ultimately the effectiveness of the auditor's decision-making process which depends to a large extent on the frank exchange of views between auditor and auditee. Equally important, it could do considerable, sometimes irreparable, harm to the auditee. Until the auditee has had an opportunity to comment on the validity, completeness and relevance of the auditor's facts and conclusions as presented in the draft audit report, both the auditee's operations and the audit decision-making process are particularly vulnerable to injury from disclosure of information.
Treatment of request for audit information in this scenario is illustrated according to the timing of the request. Distinctions in terms of approach are based on whether the request is received: before preparation of the draft report; while the auditor is preparing the draft report or it is being reviewed by the auditor; or after the draft report has been reviewed and verified by the auditee. For all alternative approaches provided in this decision-path scenario, it is assumed that the auditor will initially clarify, through informal discussion with the applicant, the nature of the interest in the audit information (as was discussed under Decision Path 2).
Requests received before the preparation of the draft report
Formally, request for audit reports at this stage in the audit process may be denied on the basis that the record does not exist as per subsection 10(1) of the Act. Informally, however, the audit officer may decide to accommodate the applicant's request beyond the strict requirements of the Act. The auditor may wish to indicate to the applicant that the requested report may be forwarded within a reasonable period subsequent to the completion of the audit field work. It is stressed once again that these informal discussions should be arranged through the departmental access co- ordinators.
The intent of the auditor in offering informally the completed audit report is to ensure that all requests for information are treated in a reasonable manner. To accomplish this, it is also necessary for the auditor to ensure that the report is completed and made available within an acceptable time frame. The following procedures are expected to achieve this purpose:
- auditee comments on a draft audit report will normally be received, and incorporated where necessary into a revised report, within a maximum two-month time period from the date the initial draft was completed; and
- the revised audit report will be made available to the applicant within this two-month period.
The OCG will continue to provide, through its performance assurance activity related to timeliness of audit reporting, an assessment of the reasonableness of the time frame between the end of audit field work and completion of an initial draft report.
Regardless of the reasonableness of the two-month time period considered necessary to provide a quality audit report, the audit officer may be required in certain circumstances to furnish the report to the applicant in less time. The applicant may not accept the auditor's informal offering of the draft report within the time frame discussed above. Instead, the applicant may choose to submit a second formal request for information at a later point in time when the report is in the process of being prepared by the auditor or being reviewed by the auditee. In such cases, as will be discussed later in this scenario, the auditor will be required to disclose the report, as it exists, to the applicant within 30 days.
When a request is received prior to the preparation of the draft report and the applicant's interest is directed towards obtaining working paper information, the auditor should review the requested information according to the provisions of the Act (particular attention should be paid to sections 16, 19, 21 and 22). This is similar to the method discussed under Decision Path 2. The major distinction in this scenario, however, is that the likelihood of injury to the internal decision-making processes, and to the auditee, may be greatly owing to the timing of the request. Because the auditor's deliberations are incomplete, the risk of harmful effects from disclosure may be greater. While the use of exemptions in this case should not be automatic, the auditor may technically have a more sound basis for invoking certain provisions to protect the audit decision-making (consultative and deliberative) process. In particular, use of section 21(1)(b) for certain interview notes, minutes of meetings or other accounts of consultations and deliberations may be appropriate should disclosure of such information inhibit the frank exchange of views among officials and thereby hinder the completion of the audit process.
Requests received while the draft report is being prepared by the auditor or being reviewed by the auditee
When a request for an audit report is received at this point in time, the auditor is required by the provisions of the Act to disclose the record to the applicant the auditor's deliberations in arriving at an assessment, particular care is required in ensuring that disclosure at this point in the audit does not harm the decision-making processes which are as yet incomplete. Review of the Act suggests that the audit process is particularly vulnerable to injury should requests be received at this point in the audit. Certain exemptions noted below, may apply to portions of the content of draft reports but the protection available is not considered to fully remove the risk of injury to the integrity of the audit process.
The following exemptions may be important should requests for audit reports be received prior to their review by the auditee. Use of paragraph 21(1)(a) may be appropriate for protecting advice and recommendations contained in the draft report if the auditor determines that disclosure of this information will cause injury or harm to the particular internal processes to which it relates. Paragraph 21(1)(b) may be applied to protect accounts of consultations or deliberations relating to the contents of draft reports if disclosure is injurious, but the actual contents of the report itself probably cannot be withheld using this exemption. Finally, if the auditor firmly believes that it is clearly necessary and reasonable to have more than the critical 30 days for providing access to draft audit reports, the Act allows a time extension per subsection 9(1). This subsection allows extension of the initial 30-day period if consultation is necessary and cannot be completed within this time period. At present, however, use of this provision is considered very tentative and not generally recommended, particularly given its very limiting interpretation in the Interim Policy Guide issued by TBS.
For audit groups that employ private-sector consultants to perform audit activities, the use of the exemptions noted above is limited. Paragraph 21(1)(b) provides that subsection 21(1) does not apply in respect of a record that contains a report prepared by a consultant or advisor who was not, at the time a report was prepared, an officer or employee of a government institution or a member of the staff of a Minister of the Crown. It is likely that the use of the term "report" in the Act will not be applied literally but will extend to all records under the control of the government institution prepared by the consultant. As has been suggested by this paper, however, the limited usage of subsection 21(1) by the internal audit community will not likely create a significant distinction between the degree of disclosure required for the contents of records prepared by consultants versus government auditors. Nevertheless, should a request for information prepared by consultants be received prior to the completion of the audit, there may be increased need on the part of consultants to expedite verification of the accuracy of records requested within the 30-day period allowed for responding to access requests.
When an incomplete or unsubstantiated draft audit report must be released, the auditor may wish to provide additional information to the applicant clarifying the basis, and any related reservations, upon which the contents have been derived to this point in the audit. The auditor may also wish to identify on the draft report disclaimers with respect to the accuracy of representations provided. The best protection to the deliberative aspects of the audit process, however, is to ensure that, prior to the preparation of draft reports, auditors carefully determine and confirm the accuracy of their observations through continual dialogue with the auditee. The importance of the Standard 22 of the Standards for Internal Audit in the Government of Canada, which relates to the discussion of audit findings and recommendations with the officials responsible for the activities begin commented upon, becomes increasingly significant given the broader potential readership of audit records.
Requests received subsequent to auditee review and verification of the draft report
Receipt of a request for information at this point in time is normally not considered problematic to auditors. The deliberative process is considered essentially complete and the likelihood of injury as a result of disclosure of audit information is significantly lessened. As such, the auditor should treat such requests in the manner described under Decision Path 1.
One final reminder is that any contact with applicants should be fully documented. Aside from the desirability of keeping track of the nature and timing of requests for administrative purposes, such information will be useful as input to possible future revisions of this document, or even the Act and/or its associated Treasury Board Policy. It will also, of course be useful should there be any subsequent intervention by the Information Commissioner or legal action.
The internal audit community is invited to provide comment to IASSD on the contents of this notice. Monitoring of experiences with the Act and review of the procedures adopted to deal with requests for audit information will be performed as part of the performance assurance review program of IASSD.
Federal Government Reference Documents (formal)
- Circular No.: 1983-35, Interim Policy Guide, Access to Information Act and the Privacy Act, Treasury Board Secretariat; June 1, 1983.
- Bill C-43, as passed by the House of Commons; June 28, 1982.
- Standards for Internal Audit in the Government of Canada, Office of the Comptroller General, Policy Development Branch, Treasury Board, 1982.
Departmental Internal Audit Reference Documents (informal)
- Office of the Comptroller General, Policy Development Branch, Internal Audit and Special Studies Division, Policy Interpretation Notice 83-02: "Audit Working Papers".
The Working Paper File as the Documented Record of a Decision-making Process
The Working Paper File is a documented record of the internal audit assignment's field work phase. Table 1, below, illustrates the audit process as a decision-making process and identifies the nature of the auditor's deliberations:
The purpose in drawing parallel between the audit process and a decision- making process is twofold. The first is to demonstrate that the audit process, a particular type of decision-making process, has the same consultative and deliberative content as any decision-making process which, therefore, is at least technically subject to exemption per paragraph 21(1)(b), given that injury due to disclosure of that particular content can be demonstrated. The second, is to provide a framework within which it is possible to distinguish the approach to be taken to treatment of requests for information (see discussion of Decision Paths 1, 2 and 3).
Table 1: Decision Making
|Process Stage||Generic Decision Making||Field Work||Working Papers|
|Problem Identification||Identification of problems / opportunities / constraints, values relevance criteria||Assignment planning: (Identification of scope,
suspected weaknesses, lines of inquiry, objectives)
|Problem Specification||Specification of the problem in terms of its nature, structure, variables parameters constraints and objectives / success criteria||Review phase: describing the auditee environment;
development of predetermined control model (success criteria);
preliminary testing to localize problem / opportunity areas and
constraints and verification
|Detailed descriptions, flow charts, data; predetermined control model; list of potential weaknesses|
|Alternative||Enumerate and develop alternative solutions (a form of hypothesistesting); choose best solution||Evaluation Phase: confirm problems; perform cause /
effect analysis; consolidate conclusions
|Documented analyses, findings tests, conclusions|
|Choice||Enumerate and develop alternative solutions (a form of hypothesistesting); choose best solution||Evaluation Phase: confirm problems; perform cause /
effect analysis; consolidate conclusions
|Documented analyses, findings tests, conclusions|
|Report||Confirm and document the results of the decision||Develop conclusions and overall opinions
|Draft and final reports|
Essentially, the issue is that disclosure of internal audit record content during the decision-making process is more liable to be injurious, to both auditee and the audit function than after the decision-making process is completed. In the future, a "Letter of Representation" procedure used by private sector accounting firms, may be a useful means of further clarifying the point at which the audit decision-making (consultative/deliberative) process is complete.
- Date modified: