Internal Audit of Federal Government Consulting Contracts Awarded to McKinsey & Company (March 2023)

Conformance with professional standards

This internal audit was conducted in conformance with the International Standards for the Professional Practice of Internal Auditing.

Lindy McQuillan
Chief Audit Executive
Veterans Affairs Canada

Background

Procurement in the Government of Canada (GC) is subject to the Directive on the Management of Procurement (and the now rescinded Contracting Policy prior to May 13, 2022)^{Footnote 1}, which has as its objective to ensure that procurement of goods, services and construction obtains the necessary assets and services that support the delivery of programs and services to Canadians, while ensuring best value to the Crown. As a result, among others, procurements are expected to enable operational outcomes, to be subject to effective governance and oversight mechanisms, to be fair, open, and transparent, and to meet public expectations in matters of prudence and probity.

The Prime Minister tasked Minister Fortier, as President of the Treasury Board (TB), along with Minister Jaczek, Minister of Public Services and Procurement, to undertake a review of contracts awarded to McKinsey & Company (McKinsey). On February 8, 2023, the Office of the Comptroller General (OCG) requested from government organizations, by February 15, 2023, a list of all contracts with McKinsey dating back to January 1, 2011, as well as related information on these. For those organizations that have been the technical authority and/or entered into any such contracts as the contracting authority, the OCG has directed the Chief Audit Executives (CAEs) of these organizations to conduct a formal independent internal audit of the related procurement processes, with results to be reported to the OCG by March 22, 2023.

Audit objectives and scope

The objectives of the audit were to determine the following for all scoped-in contracts with McKinsey:

1. The integrity of the procurement process was maintained consistent with adhering to the Values and Ethics Code for the Public Sector and the Directive on Conflict of Interest;
2. The procurements were conducted in a fair, open and transparent manner consistent with the Treasury Board (TB) Policy that was in place at the time (Contracting Policy or the Directive on the Management of Procurement); and
3. The procurements were conducted in a manner consistent with the organization’s internal processes and control frameworks (i.e., consistent with procurement management frameworks, financial controls, security controls).

The scope of the audit focused on the examination of the procurement practices for all competitive and non-competitive contracts^{Footnote 2} with McKinsey that were awarded (i.e., signed) by the organization between January 1, 2011, and February 7, 2023^{Footnote 3}. More specifically, the audit included an assessment of the following contracts:

The audit did not assess:

• All contracts with any entity other than McKinsey.
• All contracts awarded (and signed) outside of the audit period.
• Compliance with any other policy instrument, laws and/or regulations not specifically mentioned in this audit report.

Approach

The OCG provided all departments with an audit plan and audit work program to ensure consistency of coverage across the GC. While the OCG developed the objectives, scope, audit criteria, and audit work program for use by implicated departments, audit findings and recommendations were developed independently by Veteran Affairs Canada’s internal audit function. The approach followed by Veteran Affairs Canada (VAC) was in alignment with the approach described in the OCG audit plan and audit work program.

For VAC’s internal processes, the approach included reviewing the department’s internal direction and guidance for procurement and contracting and using a risk-based approach to identifying key internal processes that were not covered by the OCG audit plan and audit work program. To ensure the integrity and objectivity of the audit work, this audit was conducted only by public servant internal auditors subject to the Global Internal Auditing Code of Ethics of the Institute of Internal Auditors.

Findings and recommendations

Findings for objective 1: integrity of the procurement process

Conclusion

Overall, VAC was compliant with this audit objective. There was no evidence to indicate the integrity of the procurement was not maintained in accordance with the Values and Ethics Code for the Public Sector and the Directive on Conflict of Interest.

What we found

The audit team reviewed many emails regarding this contract. In reviewing these and the other documentation around the contract, no evidence was found to lead us to believe the Minister or their staff was involved in the contracting process. We also found no evidence that public servants involved in the contracting process did not adhere to the Values and Ethics Code for the Public Sector and the Directive on Conflict of Interest. There was no contracting involving former public servants or Public Office Holders.

Areas of improvement^{Footnote 4}

There are no areas for improvement for this audit objective.

Recommendations

There are no recommendations for this audit objective.

Findings for objective 2: fairness, openness, and transparency, in line with applicable policy

Conclusion

Overall, VAC was compliant with this audit objective. The procurement for this contract was conducted in a fair, open and transparent manner consistent with the Contracting Policy in place at the time of the contract. One area of partial-compliance was found, which relates to a verbal extension of a contract, and is described below.

What we found

The one contract issued to McKinsey and Company by VAC was a non-competitive contract against Public Service and Procurement Canada’s (PSPC’s) Task and Solutions Based Supply Arrangement, valued at less than $40,000.^{Footnote 5} It did not go through a competitive bidding process, which is appropriate based on section 6 of the Government Contracts Regulations. McKinsey was a qualified supplier under the mandatory supply arrangement in place.

The expenditure initiation documentation was completed and signed off appropriately. The price was determined by procurement to be fair and reasonable. The contract was properly signed and was disclosed on the Government of Canada’s Open Information website.^{Footnote 6}

Three amendments were made. The amendments did not change the value of the contract. All amendments were approved, however, one contract extension was made verbally, with formal documentation signed at a later date. A substantial amount of the work had already been completed by McKinsey under the original contract terms before the verbal contract extension. The verbal extension was for a minor portion of the work left to be completed. The audit team was informed McKinsey continued to engage with the project authority in good faith, all parties believing that the contract was still in effect. The extension revising the contract end date to March 31, 2021 was not disclosed on the Government of Canada’s Open Information website, however, Contracting Policy does not require disclosure of non-financial amendments.

The project authority was involved in the monitoring of the contract, with regular emails, meetings, and examination of the work in progress. The project authority was satisfied with the main deliverable, a 90-page Power Point presentation to guide the facilitation of an outreach workshop directed towards women Veterans, that could then be used as a template for future outreach workshops.

Section 34 of the Financial Administration Act requires certification that the work under a contract has been performed by an authorized person prior to any payment being made. Furthermore, the Directive on Delegation and Spending Authority requires that the person providing Section 34 authority is to verify that the work has been performed per the contract or agreement terms.

The project authority provided Section 34 approval for two contract invoices. Approval for the first invoice was provided electronically by email, as it happened at the beginning of the Covid 19 pandemic. Treasury Board of Canada Secretariat provided guidance during the pandemic that financial authorities can be done via email, provided the necessary controls are in place to ensure the integrity of the electronic authorizations. VAC has controls in place to access the email system, such as password protection. Considering all of these factors, email approval for this invoice is reasonable.

Area of improvement

The verbal contract extension with subsequent documented approval had minimal impact, as the value remaining on the contract was only $5,000, the amendment did not change the value of the contract, the amendment did later get formalized and the work did get completed. However, contracting in this manner has the potential to expose VAC to unnecessary risk.

Recommendations

There are no recommendations for this audit objective, based on the contract examined because the contract presented a low level of risk for VAC.

Findings for objective 3: adherence to departmental processes and control frameworks

Conclusion

Overall, VAC was compliant with this audit objective. Nothing significant came to our attention to lead us to believe that the procurements were not conducted in a manner consistent with the organizations’ internal processes and control frameworks. The area for improvement noted below does not represent non-compliance, merely an observation for improvement.

What we found

At the time of the contract, VAC did not have a procurement management framework in place. The internal processes and control frameworks were guided by Government of Canada legislation, policies and directives, VAC Procurement Services Manual and various guidance documents available to staff on VAC’s intranet site. Subsequent to the timeframes for this contract, VAC implemented a procurement management framework.

VAC does have a Contract Review Board (CRB). At the time of this contract, CRB’s terms of reference indicated it was to act as an objective body in order to maintain a strong challenge function on contractual proposals processed through the Procurement, Contracting and Asset Management unit. The scope of the CRB’s work included review and approval of all service contracts with a value of $10,000 or more. Approval was obtained for this contract in accordance with the CRB terms of reference. However, the objective in the summary information submitted to CRB for approval did not agree with the approved Statement of Work, which is the authoritative document defining objectives and deliverables. These changes did not significantly change the nature of the contract.

VAC’s Senior Designated Official for the management of procurement and the Chief Financial Officer confirmed to the audit team they were not aware of any specific or unique controls in place relevant to the McKinsey contract that differed from normal departmental controls.

Area of improvement

As an oversight body, the CRB plays an important role to ensure contracts are in accordance with policies and procedures. Providing inaccurate information to the CRB leads to a risk of inappropriate approvals.

Recommendations

There are no recommendations for this audit objective, based on the contract examined because the contract presented a low level of risk for VAC.

Management response

The findings of this audit were presented to management of Veterans Affairs Canada. The audit report was reviewed and recommended for deputy head approval by Veterans Affairs Canada’s Departmental Audit Committee.

Management has accepted the audit findings.

The Deputy Head of Veterans Affairs Canada approves this report.

Paul Ledwell
Deputy Minister
Veterans Affairs Canada

Appendix A: Audit criteria

Note: On April 11, 2019, the contracting limits for organizations and PSPC were updated to reflect a 25% increase to account for inflation (see Appendix C of the Contracting Policy).

Appendix B: Management Action Plan

Not applicable – No recommendations are required. Some areas for improvement are noted in the report but do not represent a significant risk to VAC to warrant recommendations.

Appendix C: Breakdown of findings