Public Services and Procurement Canada
Internal audit: Audit of Public Services and Procurement Canada’s vaccination process: Phase 1

Final report
Office of the Chief Audit, Evaluation and Risk Executive

On this page

Introduction

On October 6, 2021, the Government of Canada announced that all employees of the Core Public Administration, including the Royal Canadian Mounted Police, had to be vaccinated as an requirement of the now rescinded vaccination policy. It should be noted that the Policy on COVID-19 Vaccination for the Core Public Administration Including the Royal Canadian Mounted Police was suspended as of June 20, 2022. From this date, federal employees are no longer required to be vaccinated as a condition of employment.

The policy requirement applied whether the “employee was working on site, remotely, and teleworking (full time or part time)”. Contracted personnel who required access to federal government worksites in order to perform work for the Government of Canada also had to be vaccinated. Under Section 4.1.7 of this policy, deputy heads were required to “conduct audits on attestations and consent forms”.

Background

In accordance with the Policy on COVID-19 Vaccination for the Core Public Administration Including the Royal Canadian Mounted Police, managers may, at any time, validate an employee’s attestation by requiring additional documents supporting their attestation, including proof of vaccination. In addition, organizations in the core public administration were required to document and implement a verification process to confirm the validity of attestations. To support organizations in documenting verification, an additional functionality was added to the Government of Canada Vaccine Attestation Tracking System (GC-VATS) to allow managers to confirm the result of the validation of the proof of vaccination.

In addition, Treasury Board issued a Guideline on sampling for verifications of attestations and consent forms to further support implementation of the requirement for conducting audits on attestations and consent forms under Section 4.1.7 of the policy. In order to comply with Section 4.1.7, Public Services and Procurement Canada (PSPC) developed a procedure to perform this exercise and completed a review of 1,007 employees’ vaccination statuses (or files). The development and implementation of the PSPC Procedure for Validating Attestations and Verifying Proof of COVID-19 Vaccination was led by the Human Resources Branch (HRB).

Human Resources Branch also developed operational processes and procedures for employees who requested a duty to accommodate, were placed on administrative leave without pay, as well as return to work from leave related to the COVID-19 attestation process.

This audit led by the Office of Chief Audit, Evaluation and Risk Executive will assess whether the processes and procedures for vaccination attestations, the duty to accommodate, administrative leave without pay, and return to work from leave at PSPC were adequately documented, and implemented.

Focus of the audit

This internal audit was included in the Office of the Chief Audit, Evaluation and Risk Executive`s approved Risk-Based Audit Plan 2022 to 2025.

Importance

This audit is important as it confirms and validates the work that was completed by the branch in its compliance with the Treasury Board Policy on COVID-19 Vaccination for the Core Public Administration Including the Royal Canadian Mounted Police requirement that deputy heads conduct audits on attestations and consent forms.

Objective

The objective of this assurance engagement is to determine whether the processes and procedures for vaccination attestations at PSPC were adequately documented and implemented. Processes and procedures include the vaccination attestation, the duty to accommodate, administrative leave without pay and return to work from leave.

Due to the suspension of the Policy on COVID-19 Vaccination for the Core Public Administration Including the Royal Canadian Mounted Police in June 2022, HRB had to process employees’ return to work, hence had limited capacity to provide evidence requested by internal audit in a timely manner. As the required evidence has not been obtained to meet the reporting timelines, the audit will be conducted in 2 phases. Phase 1 will address documentation and communication, and phase 2 will address the implementation of the policy. Details are outlined in the Appendix A: Audit criteria and methodology section.

Scope

This assurance engagement will cover operational processes and procedures associated with the vaccination attestation of core public administration employees including: the duty to accommodate, administrative leave without pay and return to work from leave.

The scope of this engagement will exclude contractors as the vaccination policy is only applicable to core public administration employees.

The period covered in this audit will be from October 6, 2021 (the effective date of the Policy on COVID-19 Vaccination for the Core Public Administration Including the Royal Canadian Mounted Police) to June 20, 2022. Relevant information obtained subsequent to the audit scope period will be considered.

In phase 2, for the vaccination attestation, we will verify a random statistical sample selected from the population of 1,007 employees tested by the branch. The branch’s sample included all PSPC employees whether they worked in PSPC branches or regions. We will also verify a random statistical sample of employees in the duty to accommodate, administrative leave without pay and return to work from leave categories. The phase 2 report is expected to be presented to the Departmental Audit Committee in November 2022.

A documentation review of relevant documents will be performed, as well as interviews with key employees in the branch.

Audit criteria, sources and methodology

The audit criteria, sources of criteria and methodology can be found in Appendix A: Audit criteria and methodology.

The examination phase of the audit took place from June 2022 to August 2022.

The internal audit was conducted in accordance with the International Standards for the Professional Practice of Internal Auditing, as supported by the results of the quality assurance and improvement program.

High level observations and findings

Operational processes and procedures for the vaccination attestation, the duty to accommodate, administrative leave without pay, and return to work from leave were adequately designed, documented, reviewed and approved by the branch senior management.

Additionally, relevant information concerning the 4 processes was communicated to stakeholders such as the branch staff and people managers involved in the process in a timely fashion.

Findings, recommendations, and management action in response to the recommendation

There are no recommendations presented in this report.

Processes and procedures

Based on our review, we found that the branch had adequately designed and documented the operational processes and procedures for the vaccination attestations, duty to accommodate, administrative leave without pay and return to work from leave. As these were operational processes and procedures, there was no official sign off on the documents. However internal audit reviewed evidence that they were reviewed by senior management prior to implementation.

Processes and procedures to support vaccination attestation validation, duty to accommodate, administrative leave without pay and return to work from leave were adequately designed, documented and approved by senior management.

We expected that the branch’s operational processes and procedures for the vaccination attestations, duty to accommodate, administrative leave without pay and return to work from leave to be adequately designed, documented and approved by senior management.

Vaccination attestation validation

To support the vaccination attestation validation process, the branch prepared the following key documents:

  • Procedure for Validating Attestations and Verifying Proof of COVID-19 Vaccination
  • Human Resources Branch Attestation Verification Team Playbook
  • PSPC Management Processes for the Implementation of the Policy on Vaccination
  • Managers' Toolkit for the Implementation of Mandatory Vaccination

Further detail on the contents and purpose of the documents can be found below.

The “Procedure for Validating Attestations and Verifying Proof of COVID-19 Vaccination” outlined the processes and procedures for conducting validations of the attestations of vaccination status. The verification process was separated to 3 sections that provided detailed instructions on the verification process. Section 1 instructed the users to verify the proof of vaccination of a sample of employees who attested to being fully vaccinated. Section 2 instructed the user to verify the proof of vaccination of a sample of new PSPC employees, employees returning from leave and employees whose status changed from partially to fully vaccinated on a monthly basis. In contrast with the other sections, section 3 instructed the user to verify all special situations, including duty to accommodate requests, non-compliant individuals and suspicious cases. The instructions included different procedures for the user to employ when the proof of vaccination was credible, when it was unable to conclude and when it was not credible. The document provided users of the vaccination attestation procedure with clear processes, which they were required to follow, and clear procedures for vaccination verification.

The “Human Resources Branch Attestation Verification Team Playbook” provided additional information regarding the roles and responsibilities of the Attestation Verification Team Coordination Manager, Attestation Verification Team Members/Verifiers and Labour Relations. The document provided a detailed verification process, escalation and referral process. It also outlined for users how to implement the vaccination process, clearly outlining each role in the process.

The “PSPC Management Processes for the Implementation of the Policy on Vaccination” provided management processes and procedures for different scenarios, including:

  • the process when an employee needed to submit a paper attestation form
  • the process for unvaccinated (current active) employees and employees who had not attested by October 29, 2021 (for unvaccinated employees or those who have not attested by deadline)
  • processes for unvaccinated employees and employees who had not attested by attestation deadlines (employees returning from leave after October 29, 2021)

Each process detailed a list of actions, deadlines for the actions and who did the actions. By documenting all scenarios that a user could encounter, it ensured the proper vaccination process design was followed during unusual situations.

Finally, the “Managers' Toolkit for the Implementation of Mandatory Vaccination,” available to all people managers via PSPC’s intranet, provided instructions on what to do when an employee was unable to attest or unwilling to attest. It provided additional instructions for the vaccination attestation tracking system (GC-VATS), and instructions on how to record employee vaccination verification. This supplemented the other information provided to users further ensuring their ability to effectively execute the vaccination attestation.

Duty to accommodate

The branch developed the following key documents to support duty to accommodate situations:

  • PSPC Management Processes for the Implementation of the Policy on Vaccination
  • Managers' Toolkit for the Implementation of Mandatory Vaccination
  • Employee attestation indicates employee is unvaccinated and requesting accommodation: Process for managers

The “PSPC Management Processes for the Implementation of the Policy on Vaccination” provided management processes and procedures for unvaccinated employees requesting accommodation. This included 3 scenarios: permanent accommodation was supported, temporary accommodation was supported and accommodation was not supported. Each scenario detailed a list of actions, deadlines for the actions, and who was to act. This document provided users with clear processes, which they were required to follow for unvaccinated individuals seeking accommodation.

To supplement this, “Managers' Toolkit for the Implementation of Mandatory Vaccination” provided questions and answers for the duty to accommodate processes in regards to medical contraindications, religion, other prohibited grounds and general questions.

Finally, the “Employee attestation indicates employee is unvaccinated and requesting accommodation: Process for managers” outlined the process for a manager to follow when receiving a request for accommodation. The types of accommodation requests included requests related to a medical contraindication, requests based on religious grounds and requests related any other prohibited grounds of discrimination in the Canadian Human Rights Act.

Administrative leave without pay

The “PSPC Management Processes for the Implementation of the Policy on Vaccination” provided management processes and procedures for placing an employee on leave without pay. Employees who should have been put on leave without pay were clearly defined. The process detailed a list of actions, detailed deadlines for the actions, and identified who was responsible to act. This document provided users with clear documented processes, which they were instructed by PSPC management to follow when placing someone on administrative leave without pay. Additionally, the “Managers' Toolkit for the Implementation of Mandatory Vaccination” included questions and answers for leave without pay and other impacts on the employee. This document was complementary to the other related processes and procedures discussed herein.

Return to work from leave

The “PSPC Management Processes for the Implementation of the Policy on Vaccination” provided management processes and procedures for employees returning from leave without pay. The process detailed a list of actions, deadlines for the actions and who was to act. This document provided users with clear documented processes, which they were required to follow when someone was returning from administrative leave without pay.

Timely information communication

Overall, based on our review we found that the branch had clearly and consistently communicated key information to all employees and stakeholder groups within PSPC regarding the vaccination policies and subsequent attestation validation processes. The branch shared information using existing channels such as branch-wide emails and targeted communications to specific stakeholder groups. Further, it led a minimum of 5 meetings open to all PSPC people managers over the vaccination attestation process to ensure they understood their role. Multiple other meetings were held on an ad-hoc basis to further assist people managers. Per our review, information on how to administer the vaccination attestation validation process was shared with people managers in a timely fashion.

Relevant information was shared with all stakeholders involved in the vaccination attestation validation process in a timely fashion.

We expected the branch to clearly communicate relevant information regarding the vaccination policy to all stakeholders in a timely manner. The key stakeholders during the vaccination process included the branch staff, people managers and all employees.

The branch first developed procedures and processes for the vaccination attestation for all PSPC employees. As described in the section above, this process was approved by the branch and appropriately described branch employees’ role in the process. Their role would mainly include providing training, answering questions from people managers and employees, and completing the verification of the vaccination attestation for all employees. The branch staff received access to the internal vaccination attestation instructions and supporting documents in early October 2021, allowing them to have time to learn, and become proficient in the process before the employee attestations were required on October 29, 2021.

Human Resources Branch senior management worked on the attestation verification guidelines starting in December 2021. In mid-December 2021, they engaged our office to confirm the appropriateness of the attestation sample size. We were informed that Human Resources Branch had informal communications with senior management and the staff concerning the vaccination attestation verification guidelines. On February 28, 2022, the branch staff received the finalized vaccination attestation verification guidelines in which a sample of the original attestations were to be verified to ensure the accuracy of the original attestation process. The multi-week vaccination verification process began on March 8, 2022.

Information provided to the people managers allowed them to execute their role in assisting employees in preparing vaccination attestations for the branch staff to validate. During the vaccination process, PSPC employees received direct communication regarding the vaccination process via email and were instructed to communicate with their managers or with the branch for additional support if required.

The following provides a high-level timeline of how these stakeholders were engaged and supported through the process:

October 6, 2021: The first set of communications could be seen in an email titled “From the Deputy Minister (DM)’s Desk,” in which the vaccination attestation deadline of October 29, 2021 was introduced. Additional vaccination information and links regarding the duty to accommodate, administrative leave without pay and return to work from leave were also provided to all employees. The communication was sent 3 weeks before the vaccination deadline, thus giving time to employees to meet the requirement.

October 8, 2021: Following the announcement regarding the implementation of the vaccination policy, all people managers received a “Took Kit for Managers.” This document provided detailed instructions, training modules and resources to ensure people managers could provide assistance to PSPC employees regarding the complete vaccination process, which included the vaccination attestations, the duty to accommodate, administrative leave without pay and return from leave.

October 12, 2021: A second reminder about the attestation deadline and information regarding the vaccination policy was included in the “In the Know” newsletter. Key vaccination information resources were shared, and tools to enabling the user to book vaccination appointments were linked directly in the newsletter. Additionally information and links were shared to all employees regarding the vaccination attestation, the duty to accommodate, administrative leave without pay and return from leave processes.

October 13, 2021: The branch delivered information sessions targeted towards people managers in order to further prepare them for their role in the vaccination attestation process starting on October 29, 2021 and as a forum to answer questions.

December 2021: Consistent communications began between the branch and the Office of the Chief Audit, Evaluation and Risk Executive regarding PSPC’s approach to the verification process of the vaccination attestations. The 2 parties discussed possible sampling methodologies that the branch could undertake in order to ensure that their verification work would achieve its policy objectives.

March 2, 2022: The branch communicated to all people managers that there would be additional vaccination verification for a sample of employees. The employees were provided information in a timely manner. Thus they could prepare for the testing starting March 8, 2022.

March 4, 2022: The branch communicated to all employees via email that they will be verifying vaccination attestations via testing a sample of the submitted vaccination attestations beginning March 8, 2022. Within the email sent to the employees, the sample selection method was shown. It stated that the sample would be a random sample of attestation stratified to represent all PSPC branches and regions.

Additionally on at least a bi-monthly basis from October 2021 to June 2022, the branch shared status updates to PSPC people managers through emails, GCdocs (PSPC’s document repository) and virtual meetings. Per our review of the meeting agendas and interviews with the people managers who attended the meetings, they were presented key information and updates regarding the status of the vaccination process.

Based on the information reviewed, we can conclude that the branch clearly communicated relevant vaccination information to all stakeholders. This information was shared on a timely basis enabling stakeholders to have an appropriate amount of time to meet the policy requirements.

Conclusion

Based on our review, we found that operational processes and procedures for the vaccination attestation, the duty to accommodate, administrative leave without pay and return to work from leave were adequately designed, documented, reviewed and approved by branch senior management.

Additionally, relevant information concerning the 4 processes was communicated to stakeholders such as branch staff, and people managers involved in the process in a timely fashion.

Acknowledgement

In closing, we would like to acknowledge, recognize and thank the branch for the time dedicated and the information provided during the course of this engagement.

Appendices

Below there are 2 appendices relating to audit criteria, methodology, and terms used within this report.

Appendix A: Audit criteria and methodology

Based on the Office of the Chief Audit, Evaluation and Risk Executive risk assessment, the following lines of enquiry were identified:

Table 1: Lines of enquiry and criteria
Lines of enquiry Criteria

1. Vaccination Attestations: The operational processes and procedures for the Vaccination Attestations were adequately documented and implemented.

 1.1 (Phase 1) Vaccination Attestation validation process is adequately designed, documented and approved by senior management.
1.2 (Phase 1) Relevant information is shared with stakeholders such as Human Resources Branch staff, people managers involved in the process in a timely fashion.
1.3 (Phase 2) Human Resources Branch has documentation to confirm and validate that the process was adequately followed and implemented.
1.4 (Phase 2) Human Resources Branch has documentation to confirm and validate that the process was adequately implemented in the cases where employees made false attestations.

2. Duty to Accommodate: The operational processes and procedures for the Duty to Accommodate were adequately documented and implemented.

 2.1 (Phase 1) Duty to Accommodate process is adequately designed, documented and approved by senior management.
2.2 (Phase 1) Relevant information is shared with stakeholders such as Human Resources Branch staff, people managers involved in the process in a timely fashion.
2.3 (Phase 2) Human Resources Branch has documentation to confirm and validate that the process was adequately followed and implemented.
2.4 (Phase 2) Human Resources Branch has documentation to show the steps completed if an employee was not granted an accommodation.

3. Administrative Leave Without Pay: The operational processes and procedures for the Administrative Leave Without Pay were adequately documented and implemented.

 3.1 (Phase 1) Administrative Leave Without Pay process is adequately designed, documented and approved by senior management.
3.2 (Phase 1) Relevant information is shared with stakeholders such as Human Resources Branch staff, people managers involved in the process in a timely fashion.
3.3 (Phase 2) Human Resources Branch has documentation to confirm and validate that the process was adequately followed and implemented.
3.4 (Phase 2) Human Resource Branch has documentation to confirm that the processes were followed by managers (as putting the employee on administrative leave without pay is a manager responsibility).

4. Return to Work from Leave: The operational processes and procedures for the Return to Work from Leave were adequately documented and implemented.

 4.1 (Phase 1) Return to Work from Leave process is adequately designed, documented and approved by senior management.
4.2 (Phase 1) Relevant information is shared with stakeholders such as Human Resources Branch staff, employees and people managers involved in the process in a timely fashion.
4.3 (Phase 2) Human Resources Branch has documentation to confirm and validate that the process was adequately followed and implemented.
4.4 (Phase 2) Human Resource Branch has documentation to confirm that the processes were followed by people managers.

Methodology

The methodology for examination includes the following:

  • the planning phase will include document collection and review, as well as interviews with key stakeholders in the Human Resources Branch
  • the examination phase will include in-depth interviews with key departmental personnel along with additional documentation review
  • at the end of the examination phase, the audited organization will be requested to provide validation of the findings
  • during the reporting phase, the audit team will document the audit findings, conclusions and recommendations in a Director's Draft Report
  • this report will be internally cleared through the Office of the Chief Audit, Evaluation and Risk Executive quality assessment function
  • the audited organization will be provided with the Director’s Draft Report and will be requested to review and comment on the report
  • comments will be assessed and incorporated in the Chief Audit, Evaluation and Risk Executive's Draft Report
  • this report will be sent to the audited organization for final acceptance
  • a management response to the report, and a Management Action Plan in response to the audit recommendations, will be requested if applicable
  • the Draft Final Report, management response and Management Action Plan, if applicable, will be tabled at the Departmental Audit Committee meeting for final approval

Appendix B: Glossary

Government of Canada Vaccine Attestation Tracking System (GC-VATS)
Government of Canada Vaccine Attestation Tracking System is the system that allows employees to report their current vaccination status.
Duty to Accommodate
Employer’s obligation to provide accommodation needs for employees who are unable to be fully vaccinated based on a medical contraindication, religion, or another prohibited ground of discrimination as defined under the Canadian Human Rights Act.
Administrative Leave Without Pay
A temporary non-pay status and absence from duty with the employer’s permission due to the employee’s unvaccinated status.
Return to Work from Leave
Employees who take leave or were placed on administrative leave without pay to be restored to the position of employment held by the employee when the leave commenced.
Date modified: