CRA Annual Report to Parliament 2011-2012 (PDF - Agence du ...

Control frameworks
The CRA uses the Committee of Sponsoring Organizations (COSO) framework to assess the design effectiveness of its system
of internal controls, since it is the most widely used model of control for purposes of assessing ICFR. The COSO framework is
based on five interrelated components of control. Each component contains a number of principles and attributes that an
organization’s ICFR may be assessed against: control environment, risk assessment, control activities, information systems
and communication, and monitoring.
Because the COSO only provides limited guidance to help organizations establish and evaluate information technology
controls, the CRA uses the COBIT (Control Objectives for Information and related Technology) for SOX (Sarbanes-Oxley Act of
2002) framework to document and assess the design of its information technology controls that are relevant to financial
reporting.
4. Progress and assessment results as of March 31, 2012
This section summarizes the CRA’s key assessment results from the design and operating effectiveness testing completed to
date. In accordance with the plan published in the 2010-2011 Annex, the CRA completed the following activities for the
2011-2012 fiscal year.
Agency activities financial reporting
An assessment of the operating effectiveness of key controls over the five business processes related to financial reporting
on agency activities as well as relevant application controls and information technology general controls for the Corporate
Administrative System, the purchasing system (Synergy), and the budget tracking system.
As a result of this review, the CRA identified areas for improvement and developed action plans to address findings on
key controls related to segregation of duties and the design and management of access profiles.
Administered activities financial reporting
Further to the requirements of the tax collection agreements, the Office of the Auditor General completed its audit of the
CRA’s description of the design effectiveness of the individual (T1) income tax program as assessed by the CRA as of
November 30, 2010. The audit included testing 88 entity level controls, 54 information technology controls over 44
processing systems, and 102 business process activities. The audit results confirmed that the CRA needs to enhance the
design of certain key controls in the following areas:
Documentation: Greater consistency in the quality and availability of documentation for audit trail purposes.
Information technology general controls: Strengthen controls related to access and change management.
Segregation of duties: Strengthen access provisioning practices as they relate to segregation of duties, and strengthen
business process controls related to the design and management of access profiles.
The CRA’s internal audit function completed an assessment of the operating effectiveness of controls related to the corporate
(T2) income tax program. Management intends to use the assessment results to identify and plan any adjustments needed
to enhance the effectiveness of these controls in preparation for the Auditor General’s next controls audit under the tax
collection agreements that will be completed in accordance with the Canadian Standard on Assurance Engagements 3416
auditing guidelines.
These reviews, including the Auditor General’s report, included entity level control assessments and confirmed that the CRA
continues to have a strong system of entity level controls.
CANADA REVENUE AGENCY
137
ANNUAL REPORT
2011-2012