Audit of Human Resource Management

This page has been archived on the Web

Information identified as archived is provided for reference, research or recordkeeping purposes. It is not subject to the Government of Canada Web Standards and has not been altered or updated since it was archived. Please contact us to request a format other than those available.

Prepared by the Centre for Public Management Inc.

May 13, 2010

1.0 Executive Summary

This audit was undertaken by the Centre for Public Management Inc on behalf of OPC and was identified as part of the OPC Risk-Based Audit Plan for 2009/10-2011/12, which was approved by the Departmental Audit Committee in March 2009. Audit field work was performed over between September and December, 2009.

The objective of this audit was to determine the effectiveness of the governance structure, the risk management processes and the management and operational controls that support HR management at the OPC; and to make practical recommendations to improve the management of human resources.

Management of human resources in the context of this audit includes:

  • Appropriateness of organizational structure and impact on HR management;
  • Skills identification, recruitment, hiring, retention, promotion and succession planning; and
  • Knowledge and talent managementFootnote 1 (including Learning Innovation and Change Management).

Main Findings and Recommendations

Organizational Structure and Retention

OPC faces challenges due to its relatively small size and flat organizational structure. This creates limited opportunity for advancement and as a result turnover is an issue. Talent management and training are two approaches which can be used to manage turnover, and opportunities for improvement were noted in both areas:

  • Talent management processes are not currently formalized into an overall OPC approach, with responsibility left to branch managers to design and implement their respective strategies.
  • Although HR has been working to collect required information, the current consolidated staff learning plan process is not reconciled to the learning budget from which funds are drawn. Plans are developed and approved at the branch level, but the funds are allocated centrally. Once staff learning plans are approved this results in the completion of staff learning plans on a first-come-first-serve basis; creating a disconnect between budget use and approved learning plans.

These observations resulted in the following two audit recommendations:

  • HR Management should continue to monitor the talent management tools that are currently in development and select and maintain those which will achieve the desired outcome of an OPC wide talent management strategy which is linked to retention and recruitment activities. (Recommendation #4)
  • HR Management should review and make necessary changes to the learning plan process that would better align the training budget with approvals of training plans. The re-design should ensure the implementation of approved learning plans and a linkage into an overall OPC talent management strategy. (Recommendation #5)

Change Management

There are many examples of change initiatives being implemented at OPC, ranging from small process changes to large IT system changes. Change management strategies can include training, communication, information sessions and normally based upon an assessment of the extent of the change on an organization. There is a strong awareness among branch heads of the importance of change management strategies to facilitate the implementation of these changes. Change management is being implemented at the branch level on an ad hoc basis with little central guidance provided to assist with this function. This observation gave rise to the following recommendations:

  • Senior Management should ensure that a formal strategy for change management is developed as a requirement for all OPC initiatives which result in significant change. (Recommendation #6)
  • A change management tool kit (including, for example, communication templates, sample change management tasks and performance measurement approaches) should be developed and maintained by HR, ensuring that appropriate checkpoints are in place. Periodic follow-ups of significant branch projects should be conducted by HR to ensure branches have a good understanding of the strategy and are aware of the resources available to them. (Recommendation #7)

Other Findings and Recommendations

In addition to the major findings noted above, the audit identified other findings and recommendations in the areas of governance, planning and organizational structure; recruitment and retention; and engaging resources. These findings and recommendations are included in the body of this audit report.

Conclusion

Based on the results of the audit we conclude that while there are improvements required to fully meet the audit criteria, there is evidence of an effective governance structure, risk management processes, and management and operational controls that support HR management at OPC. The successful implementation of the recommendations identified in this report along with the completion of other initiatives already underway by management will further strengthen Human Resource Management at OPC. A management action plan to address our recommendations can be found in Section 5.0.

Statement of Assurance

We have conducted this engagement using Government of Canada Internal Auditing Standards and the Institute of Internal Auditors International Standards for the Professional Practice of Internal Auditing. The audit examined sufficient, relevant evidence and obtained sufficient information and explanations to provide reasonable assurance on the reported conclusion.

Signed:

(Original signed by)

Centre for Public Management Inc.

January 15th, 2010

Date

2.0 Background

2.1 Introduction

Mandate of the Office of the Privacy Commissioner (OPC)

The OPC is responsible for overseeing compliance with both the Privacy Act, which covers the personal information-handling practices of federal government departments and agencies, and the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's private sector privacy law.

The Privacy Commissioner of Canada is an Agent of Parliament who reports directly to the House of Commons and the Senate. The Commissioner works independently from any other part of the government to investigate complaints from individuals with respect to the federal public sector and the private sector.

The Commissioner is an advocate for the privacy rights of Canadians and her powers include:

  • Investigating complaints, conducting audits and pursuing court action under two federal laws;
  • Publicly reporting on the personal information-handling practices of public and private sector organizations;
  • Supporting, undertaking and publishing research into privacy issues; and
  • Promoting public awareness and understanding of privacy issues.

The OPC has a single Strategic Outcome, the privacy rights of individuals are protected; and its Program Activity Architecture (PAA) is designed around the Office's three core functions of: compliance activities (including investigations, inquiries, and audits), research and policy development, and public outreach. These three program activities are supported by a fourth activity, Internal Services, which enables the OPC to deliver on its mandate.

Context for Management Initiatives at OPC

As an Agent of Parliament, the OPC works independently from the Government of Canada and is therefore not obligated to follow the management improvement initiatives put forward in the Federal Public Service. Nevertheless, the Office is firmly committed to achieving a standard of organizational excellence, applying sound business management practices, and continually improving its performance.

The OPC has invested considerable effort over the past three years to put in place a solid management framework including numerous key initiatives such as developing and approving a Performance Measurement Framework and implementing a method to self assess management processes and practices against the requirements of the Management Accountability Framework (MAF).

The Management of Human Resources for Decision-Making

The Human Resources (HR) Management Branch is responsible for the provision of strategic advice, management and delivery of comprehensive human resource management programs in areas such as staffing, classification, staff relations, human resource planning, learning and development, employment equity, official languages and compensation.

Strategic Direction

Each fall, a strategic planning session involving the Office's senior management cadre serves as the basis for setting corporate priorities. The session pulls together information required to set the priorities including: strategic privacy issues, corporate risks, opportunities, organizational strengths and weaknesses, and status information about achievements and possible gaps. Once the annual corporate priorities are set, they become the foundation to align all OPC plans: the corporate or strategic plan, which is the Report on Plans and Priorities (RPP), the Branches' business plans (and Divisions' plans where they exist), and the Performance Management Program Plans. The plans integrate all aspects including financial resource allocations, HR, and IM/IT.

Governance Structure

OPC's corporate governance structure includes the Senior Management Committee (SMC). The committee is chaired by the Commissioner and composed of the two Assistant Commissioners and the senior manager in each branch of the Office. The committee meets bi-weekly. The committee has an advisory role and is responsible for making recommendations to the Commissioner on the following:

  • Planning the strategic course;
  • Allocation and management of the OPC budget;
  • Reviewing the continuous performance of the Office; and
  • Strategic and corporate decision-making on the management of the OPC's human, technology, and information resources, on corporate policies, and on corporate communications.

The SMC is aligned to the organizational structure of the Office (i.e., the branches) and not directly to the PAA. The OPC PAA has three Program Activities, including Compliance Activities, Research and Policy Development, Public Outreach, plus Internal Services, and the organizational structure is designed around five branches. While the branches primarily invest their resources in one of the Program Activities, they generally support the other Program Activities as well. This allows for an effective integration of the activities and delivery of the OPC outcomes.

Since the fall of 2007, a more formal process to assess mid-year progress against plans at the Branch and corporate levels (called the Mid-Year Report Cards) has been in place. This is complemented by the financial and HR plan reviews at mid-year, ¾ year, and year-end.

Work started in 2007-2008 to develop service standards in Corporate Services and Human Resources to inform SMC quarterly on the performance of its internal services. HR service standards were implemented for the fiscal year 09/10.

Change Management and the Human Resource Environment

With the implementation of PIPEDA, OPC has evolved from a relatively stable organization to one which has experienced constant change as privacy becomes an increasingly important concern for Canadians. Organizationally, OPC has experienced much change in the past 4-5 years and while there is more stability now in terms of management structure and size, the Office experiences staff turnover and retention challenges.Footnote 2 Turnover, expressed as the percentage of departures over staffed positions, was 19% and 29% for 2008/09 and 2009/10 respectively. As a small organization OPC is impacted by turnover differently than a large organization due to the fact there may only be one or two resources performing a particular task. Their departure may result in a large impact if there is no readily available backup resource.

The organization has also been struggling for several years with the very challenging issue of the investigations backlog. As prime example of technological as well as process change, one of the approaches to address this issue is the implementation of a new system to track investigations (Case Management System (CMS) that is regarded as a re-engineering project. Since investigations represent OPC's core business, changes generated from this project will affect all processes across the Office.

2.2 Objective

This audit was undertaken by the Centre for Public Management Inc on behalf of OPC and was identified as part of the OPC Risk-Based Audit Plan for 2009/10-2011/12, which was approved by the Departmental Audit Committee in March 2009. This engagement covered the 2008-09 fiscal year and was conducted in accordance with the Government of Canada's Policy on Internal Audit as well as the Institute of Internal Auditors International Standards for the Professional Practice of Internal Auditing.

This assignment is an assurance and management control audit to determine the effectiveness of the governance structure, the risk management processes and the management and operational controls that support HR management at the OPC; and to make practical recommendations to improve the management of human resources.

Management of human resources in the context of this audit includes:

  • Appropriateness of organizational structure and impact on HR management;
  • Skills identification, recruitment, hiring, retention, promotion and succession planning; and
  • Knowledge and talent management (including Learning Innovation and Change Management).

2.3 Scope

The scope of this audit assignment includes the three areas within human resources defined above, including governance and organizational structure, recruitment and retention, and knowledge and talent management. Focusing on the outcome of our planning phase assessment of high risk areas, this audit addresses the main activities of the OPC including: audits, PIA reviews, public outreach and communications activities, research, policy development, parliamentary affairs, and litigation activities.

This audit involved testing of a sample of human resources elements to corroborate findings generated through interviews and a documentation review.

2.4 Approach and Methodology

Observations and assessments were drawn against the following audit criteria; developed as part of a risk-based audit planning process:

  • Governance, Planning and Organizational Structure: The organizational structure has been designed and established to provide overall direction, decision making and resource commitment, and is working effectively.
  • Recruitment and Retention: OPC staffing policies and procedures are implemented such that they support OPC's current and future needs.

    Knowledge and talent management processes and tools are in place to guide recruitment and retention appropriately. Processes also facilitate the efficient allocation of financial resources.
  • Engaging Resources: Change Management strategies, processes, and tools are effective and support ongoing OPC operations.

As part of the audit planning, conduct, and reporting phases, we:

  • Reviewed and analyzed relevant information management documentation;
  • Conducted interviews with senior management and selected staff;
  • Conducted a risk assessment within each functional area;
  • Based on the risk assessment, developed the Audit Criteria; and
  • Developed a detailed Audit Program.

3.0 Detailed Observations and Recommendations

3.1 Governance, Planning and Organizational Structure

Audit Criterion: The organizational structure has been designed and established to provide overall direction, decision making and resource commitment, and is working effectively.

3.1.1 Organizational Structure

Reporting to the Commissioner, HR is responsible for the provision of strategic advice, management and delivery of comprehensive human resource management programs in areas such as staffing, classification, staff relations, human resource planning, learning and development, employment equity, official languages and compensation.

As part of audit, we engaged in interviews with senior management to determine if current OPC and internal branch organizational structures are effective and where changes should be made. The audit team also tested a directed sample of branch level organizational charts to ensure they include key decision makers, control points, and that key positions are staffed with resources at the specified classification.

The audit found the following:

  • While there is no formal structural connection between Finance and HR, the lack of a formalized link between the two areas has not created issues to-date. This audit did find that current collaborative initiatives and information sharing is largely due to the good working relationship between the two branches.
  • HR communicates well with the operational OPC branches. There have been no major issues with communication related to the organizational structure. For the most part, branch heads articulated a strong and functioning relationship with the HR.
  • Organizational structures within the operational and corporate branches are predominantly flat with minimal opportunity for staff progression, inhibiting retention of employees. Upon analysis, given the nature of work performed by the individuals within OPC branches, in most cases the flat organizational structures are in line with a requirement for senior staff. Interviews with branch heads indicated that they were exploring innovative approaches to adapt organizational design to facilitate increased retention rates.

Conclusion

The OPC organizational structure has been established to provide overall direction and decision making and appears to be working effectively. With regard to resource commitment, the current flat branch structure supports the mandate of OPC but inhibits the retention of staff.

Recommendations

  • 1. In order to ensure that the appropriate level of interaction between HR and Finance continues, formal linkages and processes should be established between these branches.
  • 2. HR Management should develop a formal plan to mitigate the implication of flat branch organizational structures building on existing OPC branch level best practices as well as those of other similar Government organizations.

3.1.2 Classification and Staffing

The classification and staffing monitoring framework is a key control in ensuring that the function is being performed in conformance to the required policies and guidelines. Our approach was designed to test the operation of this control to obtain assurance that staffing and classification was functioning as intended. In order to determine the effectiveness of this function the following steps were taken:

  • Assessed the qualifications of the individual performing the control measures;
  • Documented the steps necessary to perform the work; and
  • Performed tests on a selection of staffing and classification files to ensure that the work was done appropriately.

The audit found the following:

  • Classification and staffing monitoring is in place and functioning as intended; the file testing methodology has been documented and the individual performing the review has attained qualifications and work experience that would enable the conduct of this review with sufficient expertise.
  • The sampling strategy employed by OPC as part of their monitoring framework is sufficient to provide reasonable assurance.
  • The checklists used in the monitoring process highlight the governance, planning, and organizational aspects of the processes, but are not precise in identifying documents that are required. This has not had a material impact on the quality of the monitoring process due to the qualifications and background of the reviewer; however the process could be further standardized in order to minimize the reliance on the reviewer skill set.

Conclusion

Overall, the control provided by the staffing and classification monitoring framework is effective.

Recommendation

  • 3. The staffing and classification monitoring process should be clearly documented to the extent that the work can be performed by a person with a reasonable level of staffing and classification experience.

3.1.3 Resource Planning

The audit team reviewed a directed sample of resource plans (i.e., quarterly reports to SMC, Labour Management Consultation Committee meeting minutes, Business/HR plans) to determine whether workload is documented, tracked, and updated. Interviews were also conducted with management to determine if corrective action is taken when needed to rectify workload imbalances.Footnote 3

The audit found the following:

  • Workload is documented, tracked, and/or updated using tools such as the Quarterly Report to SMC, the Labour Management Consultation Committee, and Business/Human Resource Plans.

Conclusion

Overall, indicators and metrics on workload and resource commitment are being tracked and discussed.

3.2 Recruitment and Retention

Audit Criterion: OPC staffing policies and procedures are implemented such that they support OPC's current and future needs.

Knowledge and talent management processes and tools are in place to guide recruitment and retention appropriately. Processes also facilitate the efficient allocation of financial resources.

Over the course of this audit, the audit team reviewed documentation on staffing policies, procedures, and frameworks and interviewed senior management to determine if staffing policies and procedures are easily accessible and consistently implemented.

The team reviewed and analyzed documentation pertaining to developmental programs, learning strategies, and learning spend. Interviews with senior management also addressed the appropriateness of current developmental programs / learning strategies in attracting / retaining employees and processes used to track employee performance.

The audit found the following:

  • There is an overall recognition by all branch heads that OPC must think in an innovative manner in order for staffing processes to yield candidates with appropriate current and emerging skill set requirements.
  • Talent management processes are not currently formalized into an overall OPC approach, with responsibility left to branch managers to design and implement their respective strategies.
  • Several OPC wide talent management tools (i.e., Management Forum, Coaching Offer, Young Professionals Network) are currently in the preliminary phases of implementation.
  • Although HR has been working to collect required information, the current consolidated staff learning plan process is not reconciled to the learning budget from which funds are drawn. Plans are developed and approved at the branch level, but the funds are allocated centrally. Once staff learning plans are approved this results in the actualization of staff learning plans on a first-come-first-serve basis; creating a disconnect between budget use and approved learning plans.
  • Multiple systems and processes are currently in place to track learning spending. This audit did not find evidence of reconciliation between systems at regular intervals.
  • HR and IM/IT are currently designing a SharePoint pilot project entitled "MySite" that would enable the sharing of information regarding staff member area of expertise, current projects, and interests. This would facilitate a strategic linkage between staffing, talent management, and learning within the context of current and emerging skill set requirements.

Conclusion

Overall, it appears that the implementation of OPC staffing policies and procedures is moving forward with a view to support OPC's current and future needs. Talent management is occurring informally at the branch level, although OPC wide initiatives have not been delivered to-date.

Staff level learning plan processes are in place, yet the consolidated plan is not reconciled to the learning budget; this does not facilitate the efficient allocation of financial resources.

Recommendations

  • 4. HR Management should continue to monitor the talent management tools that are currently in development and select and maintain those which will achieve the desired outcome of an OPC wide talent management strategy which is linked to retention and recruitment activities.
  • 5. HR Management should review and make necessary changes to the learning plan process that would better align the training budget with approvals. The re-design should ensure the implementation of approved learning plans and a linkage into an overall OPC talent management strategy.

3.3 Engaging Resources

Audit Criterion: Change Management strategies, processes, and tools are effective and support ongoing OPC operations.

In order to assess the appropriateness of the OPC wide change management strategy, the audit team engaged in senior management interviews and reviewed relevant documentation to identify the extent to which the processes are formalized, clear, and comprehensive. To gain a better understanding of specific change processes, the audit reviewed two change initiatives to assess the documentation and implementation of a change management strategy, these initiatives included the CMS project and SharePoint priority area site project. Following is a brief description of the two initiatives:

  • The CMS is a re-design of the Inquiries and Complaints Investigation function and has been developed to replace and modernize existing computer systems; and
  • OPC has implemented the Microsoft SharePoint tool by building user SharePoint sites in alignment with the four OPC priority areas to support a collaborative work environment and the sharing of information.

The audit found the following

  • There is a strong awareness among branch heads of the importance of change management strategies. Change management is being implemented at the branch level yet there is little central guidance provided to assist with this function.
  • Two initiatives were analyzed (CMS and the SharePoint priority area sites) with respect to change management activities.
    • Our analysis demonstrated evidence that a communications strategy was drafted for CMS, detailing specific change management issues and mitigating initiatives.
    • With respect to the SharePoint priority area sites, in the course of interviews and document analysis there was little evidence that a change management strategy was documented or used to implement the initiative.

Conclusion

While change management initiatives take place, they are as a result of Branch initiatives and not overall OPC change management strategies, processes and tools.

Recommendations

  • 6. HR Management should ensure that a formal strategy for change management is developed as a requirement for all OPC initiatives which result in significant change.
  • 7. Management should continue with the Information Management Internal Service Improvement strategy and integrate and/or consolidate existing IM and knowledge sharing tools through the re-engineering of business processes by OPC branches.

4.0 Overall Conclusion

Based on the results of the audit we conclude that while there are improvements required to fully meet the audit criteria, there is evidence of an effective governance structure, risk management processes, and management and operational controls that support HR management at OPC.

The successful implementation of the recommendations identified in this report along with the completion of other initiatives already underway by management will further strengthen Human Resource Management at OPC. A management action plan to address our recommendations can be found in Section 5.0.

Appendix A – Management Response and Action Plan

Recommendations
(Taken integrally from the Draft Audit Report)
Management Response
(Agree or Disagree-with rationale)
Action Plan Key Performance Indicator
(specific items to be completed)
Deadline Responsibility
Recommendation 1:

1.In order to ensure that the appropriate level of interaction between HR and Finance continues, formal linkages and processes should be established between these branches.
Agree – action already identified and measures underway to address
  • During the Mid-year Review exercise in October 2009, it was identified that the lack of established administrative practices between HR and the Finance and Administrative division is causing delays (HR Request forms, security, etc).
  • The Human Resources Management Branch met with the Finance and Administration Division and will continue to meet to establish internal administrative practices with the purpose of increasing efficiency and documenting processes;
Revised planning process documentation

Modification to Organization Charts to reflect funding allocation by branch

Processes and internal controls between Finance and Admin Division and Human Resources Branch are formally documented and communicated to staff; establishment of meeting schedule on regular intervals to ensure appropriate exchange of information
September 2010 Lead – Director, HR - Director, Finance and Administrative Services
Recommendation 2:

HR Management should develop a formal plan to mitigate the implication of flat branch organizational structures building on existing OPC branch level best practices as well as those of other similar Government organizations.
Agree
  • Identify risks
  • Conduct internal survey or environmental scan to identify branches at risk
  • Identify ways to reduce the risks including a compendium of best practices
  • Results of environmental scan results presented to SMC
  • Development of self assessment tool to assist managers conduct their own internal scan
  • Imbed this discussion within the context of HR Planning process conducted at the beginning of the year and mid-year review
September 2010 and March 2011 Lead, HR
Recommendation 3:

The staffing and classification monitoring process should be clearly documented to the extent that the work can be performed by a person with a reasonable level of staffing and classification experience.
Agree Review of Existing Practice to identify gaps Existing checklists to be modified to provide more comprehensive guidance to person conducting the monitoring exercise June 2010 Director, HR

Manager, HR Operations
Recommendation 4

HR Management should continue to monitor the talent management tools that are currently in development to ensure that they will achieve the desired outcome of an OPC wide talent management strategy which is linked to retention and recruitment activities.
Agree – Implementation of the Harnessing the Power of Demographics Initiative and Talent Management program underway Develop a Talent Management Program for OPC linking in the Harnessing the Power of Demographics Initiative Identifying Talent Development Priorities - for Branches and the OPC generally including the identification of core competencies with a link to succession planning
Identifying Talent - People
Assessing Talent – Performance and Potential
Developing Talent – Talent Roadmaps
March 2011 Director, HR
Recommendation 5.

Management should review and make necessary changes to the learning plan process that would better align the training budget with approvals. The re-design should ensure the implementation of approved learning plans and a linkage into an overall OPC talent management strategy.
Agree Call letter for Employee Performance Appraisal and Objectives including the Branch Training Plan issued

Review of Branch Training Plans
Branch Training plans submitted to HR for review and finalization within first quarter

Quarterly reconciliation and update of Branch Training Plans presented to SMC

Branch Heads Performance Management Agreements to reflect accountability regarding implementation of branch learning plans

Develop a Talent Management Program with links to the performance Evaluation Program cycle
March 1, 2010

Quarterly

April of each year
Lead, Director HR (all managers)

Branch Head
Recommendation 6

Management should ensure that a formal strategy for change management is developed as a requirement for all OPC initiatives which result in significant change.
Agree Initiate a discussion on Change Management at SMC
  • Reach agreement on approach
  • Development of a strategic framework on change management
July 2011 Lead, HR

SMC
Recommendation 7

A change management tool kit (including, for example, communication templates, sample change management tasks and performance measurement approaches) should be developed and maintained by HR, ensuring that appropriate checkpoints are in place. Periodic follow-ups of significant branch projects should be conducted by HR to ensure branches have a good understanding of the strategy and are aware of the resources available to them.
Agree
  • Consult existing best practices
  • Establish working group to provide guidance on the development of the toolkit
  • Toolkit established
  • Information sessions held on the utilization of the Toolkit
  • Monitor effectiveness of Toolkit
March 2011 Lead, HR
Report a problem or mistake on this page
Please select all that apply (required): Error 1: This field is required.

Note

Date modified: