Summary of the Assessment of Effectiveness of the Systems of Internal Control over Financial Reporting and the Action Plan of the Canadian Institutes of Health Research for the Fiscal Year 2025–26 (Unaudited)

Annex to the Statement of Management Responsibility Including Internal Control over Financial Reporting

  1. Introduction
  2. CIHR’s System of Internal Control over Financial Reporting
  3. CIHR Assessment Results during Fiscal Year 2025-26
  4. Departmental Action Plan

1. Introduction

This document provides summary information on the measures taken by the Canadian Institutes of Health Research (CIHR) to maintain an effective system of internal control over financial reporting, including information on internal control management, assessment results and related action plans.

Detailed information on CIHR’s authority, mandate and program activities can be found in the CIHR 2025-26 Departmental Plan.

2. CIHR’s System of Internal Control over Financial Reporting

2.1. Internal Control Management

CIHR has a well-established governance and accountability structure to support agency assessment efforts and oversight of its system of internal control. The agency internal control management framework, approved by the President, includes:

The Audit Committee provides advice to the President on the adequacy and functioning of CIHR’s risk management, control and governance frameworks and processes.

2.2. Service Arrangements Relevant to Financial Statements

CIHR relies on other organizations for the processing of certain transactions that are recorded in its financial statements as follows.

Common Arrangements

Specific Arrangements

3. CIHR Assessment Results during Fiscal Year 2025-26

The key findings and significant adjustments required from the current year’s assessment activities are summarized below.

New or significantly amended key controls: In the current fiscal year, there were no significantly amended key controls in existing processes that required a reassessment and there were no new processes to test for design and operating effectiveness.

Ongoing monitoring program: As part of its rotational ongoing monitoring plan, CIHR completed the assessment of design effectiveness for the following business processes:

The assessment conducted by the independent consulting firm found that most of the key controls tested were designed effectively. Some deficiencies were noted but were deemed to be low or medium risk (no high risk deficiencies were noted) and were not expected to create any material misstatements of the financial statements. Management has taken appropriate actions to address the issues identified going forward. At an upcoming Audit Committee meeting, a Management Action Plan (MAP) will be presented to the Audit Committee on how CIHR plans to address the medium risk items identified through the 2025-26 testing. Management feels confident that the low risk items will be addressed effectively in short order by ensuring effective compensatory controls are in place.

4. Departmental Action Plan

4.1. Progress During Fiscal Year 2025-26

CIHR continued to conduct its on-going monitoring according to the previous year’s rotational plans as follows:

Progress During the Fiscal Year 2025-26
Previous year’s rotational on-going monitoring plan for current year Status
Prior Year Findings
Procurement

Tested in 2023-24. No deficiencies were noted.

Testing of operating effectiveness (OE), originally scheduled for fiscal year 2025-26, was deferred due to operational constraints within the Procurement team. Given that Procurement was also subject to a risk-based internal audit in 2024, and all resulting MAPs have been completed, the risk associated with deferring OE testing was assessed as low.

Financial Management (Budgeting and Forecasting)

Tested in 2024-25. The controls were deemed to be operating as designed.

  • No remedial actions were required.
Grants and Awards (including Payments)

Tested in 2024-25. The controls were operating as designed.

  • No remedial actions were required.
IT General Controls Tested in 2024-25. One low risk item was identified during testing, and the finding was provided to the business process owner.
Travel, Hospitality, Conference, and Event Expenditures

Tested in 2024-25. One low risk item and two medium risk items were identified requiring MAPs.

  • The MAP pertaining to the development of a Financial Control Framework is complete.
  • The integration of the automated Section 33 control in SAP prior to payment release remains on track for completion by July 2026.
Current Year Findings
Entity-Level Controls

Testing of design effectiveness identified two medium risk findings, for which business process owners agreed with the results and developed MAPs to address the following areas:

  • Ensuring CIHR’s Conflict of Interest Policy is reviewed every two years to ensure alignment with relevant legislation.
  • Strengthening organizational risk management through the development and implementation of a formal Risk Management Framework, including the establishment and maintenance of a corporate risk register to monitor enterprise-level risks.
Financial Statement Closing Process (including PAYE) Testing of design effectiveness identified one low risk item which has been provided to the business process owner.
Payroll and Salary benefits

Testing of design effectiveness identified three low risk items which were provided to the business process owner.

Additionally, four medium risk items were identified, for which the business process owner agreed with the results and developed MAPs to address the following areas:

  • Reinforce use of electronic signatures on payroll documents
  • Conducting bi-annual access review of the MyGCHR system
  • Implementing a verification process to ensure documented Section 32 approvals are obtained for overtime expenditures
  • Revising pay termination activities to strengthen and document the peer verification process of final payments to salaried employees

4.2. Action Plan for the Next Fiscal Year and Subsequent Years

The ongoing monitoring plan as shown in the following table has been adjusted to test all key business processes over the next five fiscal years. Environmental scans will be done in the intervening years to ensure the proposed plan reflects the current business landscape and risks. Any subsequent adjustments to the proposed plan will be supported by the results of the environmental scan.

Key control areas 2026-27 2027-28 2028-29 2029-30 2030-31
Entity-Level Controls Yes No Yes No Yes
IT General Controls Yes No Yes No Yes
Financial statements close process (including PAYE) No Yes-OE No Yes-OE No
Grants and awards, including collaborative agreements Yes-OE No Yes-DE No Yes-OE
Payroll and salary benefits Yes-OE No Yes-DE No Yes-OE
Travel, Hospitality, Conference and Event Expenditures No Yes-DE No Yes-OE Yes-DE
Procurement No Yes-DE No Yes-OE Yes-DE
Planning, budgeting, and forecasting Yes-DE Yes-OE No No No

DE = Design Effectiveness

OE = Operating Effectiveness

In addition to the on-going monitoring rotational plan, CIHR will complete additional assessment work to complement the system of internal control, including risk-based quality assurance activities.

Date modified: