ARCHIVED - Audit of Immigration Controlled Forms Managed by the CBSA
Internal Audit Report

This page has been archived.

February 2008

Table of Contents

• Executive Summary
• Introduction
• Audit Objective and Scope
• Audit Approach
• Findings, Recommendations and Management Action Plans
  • Accountability
  • Policies and Procedures
  • Monitoring
• Appendix A - Lines of Enquiry and Criteria
• Appendix B - Forms and Acronyms

---

Executive Summary

Background

This audit forms part of the Canada Border Services Agency’s (CBSA) Risk-Based Multi-Year Audit Plan 2007-2010.

Immigration controlled forms are documents that provide permit holders official status in Canada. The permits can be valid for various lengths of time depending on the amount of time the individual remains in Canada. With the creation of the CBSA in December 2003, immigration responsibilities at ports of entry (POEs) were transferred from Citizenship and Immigration Canada (CIC) to the CBSA. A memorandum of understanding (MOU) was established to govern the relationships between the two organizations and clarify roles and responsibilities according to their respective mandates. Under this MOU, policy responsibility with regard to temporary resident processing, status and documents falls under CIC, while service delivery is shared between CIC and the CBSA. The MOU also states that each organization is responsible for ensuring that the standards and requirements of the Government Security Policy for the safeguarding of sensitive information and assets under their control are met.

The number of immigration controlled forms issued at POEs for the period of April 1, 2006, to March 31, 2007, was 284,290.

Objective and Scope

The objective of the audit was to provide assurance to senior management that immigration controlled forms within the CBSA are managed in compliance with delegated authorities and in accordance with applicable regulations, policies and procedures.

The immigration controlled forms reviewed include Visitor Records, Work Permits, Study Permits and Temporary Resident Permits. The scope of the audit focused on the management of the immigration controlled forms inventory at POEs and related monitoring and oversight activities by the CBSA.

The audit was conducted between March and July 2007 at eight POEs in the Quebec, Northern Ontario, Greater Toronto Area, Windsor-St. Clair and Pacific regions. These regions accounted for 76% of the permits issued across Canada from April 1, 2005, to March 31, 2006.

Audit Opinion

The audit found weaknesses with the CBSA’s management of immigration controlled forms. When this activity was transferred to the CBSA, the primary responsibility for the management of these forms was not designated, nor was it included in POE policies and procedures relating to the issuance of the forms. The audit also identified gaps within the CBSA’s policies and procedures related to immigration controlled forms and the need for the communication of these policies and procedures as well as related training to new and existing POE employees.

Opportunities exist for the improvement of the management of immigration controlled forms process at CBSA POEs. Accountability for management and monitoring activities related to immigration controlled forms needs to be identified at the CBSA Headquarters level. Immigration controlled forms issuance needs to be monitored to ensure that the CBSA is adhering to policies and procedures. Improvements in the management of immigration controlled forms issuance should aid in decreasing the errors identified at the POE level. 

1.0 Introduction

The Canada Border Services Agency (CBSA) Audit Committee has approved this audit of immigration controlled forms [ 1 ] issued at ports of entry (POEs). This audit forms part of the CBSA’s Risk-Based Multi-Year Audit Plan 2007-2010.

Immigration controlled forms are documents that provide permit holders official status in Canada. The permits can be valid for various lengths of time depending on the amount of time the individual remains in Canada. With the creation of the CBSA in December 2003, immigration responsibilities at POEs were transferred from Citizenship and Immigration Canada (CIC) to the CBSA. A memorandum of understanding (MOU) was established to govern the relationships between the two organizations and clarify roles and responsibilities according to their respective mandates. Under this MOU, policy responsibility with regard to temporary resident processing, status and documents falls under CIC, while service delivery is shared between CIC and the CBSA. The MOU also states that each organization is responsible for ensuring that the standards and requirements of the Government Security Policy for the safeguarding of sensitive information and assets under their control are met.

The number of immigration controlled forms issued at POEs for the period of April 1, 2006, to March 31, 2007, was 284,290.

The immigration controlled forms issued at POEs are as follows:

• IMM 1097B - Visitor Record
• IMM 1102B - Work Permit
• IMM 1208B - Study Permit
• IMM 1263B - Permit to Come into or Remain in Canada (Temporary Resident Permit)
• IMM 1442B - Generic Document

The IMM 1442B is generic and can be used to issue any of the four types of permits when processed through the Field Operations Support System (FOSS). The first four documents listed above are manually issued, pre-printed forms that are specific to each permit. They are used when FOSS access is not available. All five of these documents are kept on-site at each POE and are required to be managed and secured in accordance with established policies and procedures. 

These documents provide evidence of status, identity or eligibility for services and benefits, and are considered high-value assets requiring protection. As well, some have a monetary value on the market [ 2 ] . Consequently, the management of and operational controls over immigration controlled forms are important. These forms require secure storage and handling to ensure that they do not fall into the hands of unauthorized persons. 

According to the Report on Document Integrity, the main vulnerability of immigration controlled forms is that fraudulent permits may be accepted as evidence of identity for access to other programs (e.g. social assistance programs) and/or other official documents in Canada. This suggests that these forms can sometimes have a secondary purpose given the type of document and service being requested. Therefore, the risk associated with the forms may not only be fraudulent use to gain entry to Canada, but also the ability to access secondary services offered by the country.

The CBSA policies and guidelines used to administer immigration controlled forms were adopted from the CIC manual entitled SA 6 Forms Management Program (CBSA manual).

The CBSA manual outlines information on the creation, revision, distribution, disposition and protection of immigration controlled forms by the CBSA. Its main purpose is to describe the roles and responsibilities of the forms control officer (FCO) at each POE, who is responsible for the security of immigration controlled forms as well as the implementation and review of a system of accountability for them. 

The FCO is required to submit various types of information and provides the following reports to the forms management officer (FMO) at CIC:

• IMM 1409B - Requisition for Immigration Controlled Forms
• IMM 5448B - Certificate of Destruction / Transfer / Receipt of Transferred Immigration Key Control Forms
• IMM 5392B - Quarterly Inventory of Immigration Control (Key) Form
• IMM 5442B - Immigration Key Forms Custodian Register

A number of branches within the CBSA have responsibilities with respect to the management of immigration controlled forms. The Operations Branch is responsible for communicating to the regions directives, policies and procedures relating to immigration controlled forms. Regional operations issue the forms and monitor this issuance as well as the forms inventory. The Comptrollership Branch is involved in the physical security review of POE facilities and is made aware of any issues concerning the security of immigration controlled forms. The Enforcement Branch ensures that any fraudulent documents are properly recorded and that appropriate action is taken. The Admissibility Branch maintains immigration policies and acts such as the Immigration and Refugee Protection Act. Publishing Services within the Strategy and Coordination Branch is responsible for the publication and distribution of immigration controlled forms prepared only by the CBSA.

2.0 Audit Objective and Scope

The objective of the audit was to provide assurance to senior management that immigration controlled forms within the CBSA are managed in compliance with delegated authorities and in accordance with applicable regulations, policies and procedures.

The scope of the audit was limited to verifying compliance with the CBSA’s security policies and procedures related to immigration controlled forms at POEs. The audit did not include a financial analysis of cost recovery for forms or the collection of applicable fees. The audit sample and review of documents or reports were limited to those dated within the period of January 1 to December 31, 2006. The audit’s lines of enquiry and criteria are outlined in Appendix A, and were created based on the CBSA manual. 

Eight POEs were selected from the following CBSA regions:

• Northern Ontario
• Quebec
• Windsor-St. Clair
• Greater Toronto Area
• Pacific

These POEs accounted for more than three quarters of the permits issued across Canada during the 2005-2006 fiscal year. The audit fieldwork was conducted between March and July 2007.

3.0 Audit Approach

This audit was planned and conducted in accordance with the Internal Auditing Standards for the Government of Canada.

The methodology used to conduct this audit includes the following:

• interviews with management and staff at Headquarters (HQ); a review of legislation, regulations and statistics; an analysis of policies, procedures and guidelines; the identification of documentation relating to immigration controlled forms; and the development of regional audit procedures to test controls.
• walkthroughs of the POEs as part of the physical security review; a review of documentation relating to the management of immigration controlled forms; and interviews with management, FCOs and staff responsible for immigration controlled forms at the POEs.
• interviews with the Admissibility, Operations, Enforcement, Comptrollership, and Strategy and Coordination branches within HQ.

4.0 Findings, Recommendations and Management Action Plans

4.1 Accountability

There was no primary area of responsibility for immigration controlled forms within the CBSA. 

A key control for any program or activity is that related authorities, responsibilities and accountabilities are clearly defined and communicated.

The audit found that the current MOU between the CBSA and CIC, in effect since December 2003, outlines the roles and responsibilities for both organizations with respect to immigration controlled forms. 

According to the CBSA manual, FCOs are to advise the FMO of changes in POE contact information. Due to turnover and changes, the FMO did not always have the current contact name for the FCO at each POE. The last time a contact list was provided to CIC was in January 2006. This results in difficulties for the FMO at CIC to obtain, verify and correct information from the CBSA. As well, there was no primary area of responsibility for managing immigration controlled forms at the CBSA and for taking action when issues arise.   

Recommendation:

1. The Operations Branch should designate a primary contact within the Agency responsible for overseeing immigration controlled forms.

Management Action Plan	Completion Date
The Operations Branch recognizes the importance of designating a primary contact to oversee immigration controlled forms. The Operational Services Division will appoint a contact.	February 14, 2008

4.2 Policies and Procedures

CBSA policies and procedures related to immigration controlled forms have not been reviewed nor updated to reflect the CBSA’s role. Knowledge of these policies and procedures varied between POEs.   

CBSA policies and procedures are important preventative controls. They should be designed to support the achievement of operational objectives and the management of risks, and be communicated so that employees understand what is expected of them.

The audit included a review of applicable policies and procedures for immigration controlled forms management within the CBSA (the CBSA manual, the IC 3 manual, enforcement manuals and security procedures). It found that there were gaps in these policies and procedures. Through interviews and an analysis of these documents, it was noted that the roles and responsibilities of staff at POEs regarding immigration controlled forms were unclear. For example, it was difficult to identify where to send non-compliance reports for forms management issues or when these reports should be completed. It was also noted that the reporting of immigration controlled forms that were unaccounted for and of other security incidents related to them was not always performed properly. Hence, CBSA senior management had not always been properly informed of security incidents. Further, no information updates or changes were made to CBSA policies and procedures regarding immigration controlled forms since the CBSA’s creation.

Knowledge of Policies and Procedures

Prior to the creation of the CBSA and the transition of immigration controlled form-related activities to the CBSA, CIC was responsible for the delivery of these activities at POEs across Canada. Immigration officers at POEs were trained to process and issue the necessary permits. Some POEs had retained these immigration officers who possess a knowledge of how to handle immigration controlled forms. Following the transfer of immigration controlled forms issuance to POEs, CBSA officers became responsible for conducting this activity and were unfamiliar with it and the related security requirements.

The audit found that no formal training had been provided to management, the FCO and staff at each POE on the policies and procedures outlined in the CBSA manual and their corresponding responsibilities. The audit further noted that the level of knowledge of the procedures was higher at POEs where a former CIC employee was the FCO. For example, at the Lacolle POE, within the Quebec Region, a former CIC employee performed this function prior to the creation of the CBSA, and was trained on FCO roles and responsibilities. The audit noted that immigration controlled forms were very well managed at this POE.

The FCO function is essential to the control of immigration controlled forms at POEs. The CBSA manual requires each POE issuing these forms to designate an FCO and a back-up person to monitor the process, manage the inventory and prepare the necessary reports. The audit found that one POE did not have an FCO in place due to recent turnover and that five of the eight POEs visited did not have a back-up person in place to perform the function if required. 

Requisition and Receipt

The CBSA manual requires that all requisitions for immigration controlled forms be kept on file for tracking, reporting and record keeping purposes. All orders for immigration controlled forms should be indicated on a Requisition for Immigration Controlled Forms (IMM 1409B) and faxed to the FMO at CIC. Once the order is received at the POE, the FCO is required to acknowledge receipt of the shipment by fax to the CIC printing contractor. This should be done immediately as it confirms that the appropriate POE received the shipment and that there were no discrepancies. The fax confirmation and the packing slip should also be retained on-site with the relevant order information for possible follow-up purposes. Fax confirmations should also be kept as validation that the required acknowledgement of receipt was faxed on time. 

The audit found that the documents pertaining to the requisition and receipt of immigration controlled forms during 2006 were properly sent and kept on-site by four of the eight POEs visited. The other four POEs did not have all of the required documentation on-site to support the full requisition and receipt process.

Destruction and Transfer

The CBSA manual outlines instructions for the FCO when immigration controlled forms are required to be destroyed. A Certificate of Destruction / Transfer / Receipt of Transferred Immigration Key Control Forms (IMM 5448B) should be completed to attest to the destruction of voided documents. The serial numbers should be recorded, the immigration controlled forms should be shredded, and a witness should observe the procedure and sign the form. It is important that all destroyed forms also be identified in the form registers so that a reconciliation can be performed by the FCO as per the responsibilities outlined in the CBSA manual. Therefore, the destroyed forms indicated in the registers should match those listed on the IMM 5448B. All IMM 5448B forms were reviewed for the period of 2006 and the audit noted that IMM 5448B forms were not prepared at four of the eight POEs visited. Therefore, the POEs cannot confirm if the forms listed in the registers were destroyed in the appropriate manner or were actually destroyed.

Another purpose of the IMM 5448B is the transfer of immigration controlled forms between POEs. The CBSA manual indicates that this should be made in rare situations and only when absolutely necessary. The audit noted that the POEs visited were in compliance with this policy and no unnecessary transfers were made.

Completeness and Accuracy of Immigration Controlled Form Registers

The form registers are essential for managing immigration controlled forms at POEs. Border services officers are required to record information in the registers concerning forms that are issued or destroyed. Registers are required for all five types of immigration controlled forms. The Generic Documents (IMM 1442B) are packaged in boxes of 250, while the manual permits come in boxes of 50. Each package contains a different pre-printed serial number sequence that must be recorded in the form registers. 

The audit noted a best practice relating to the management of forms at a number of POEs whereby the FCO on-site prepared the register for each box when the shipment of forms was received from the printing contractor. The register was attached to the box, thereby ready for use when needed. The audit noted that two POEs had registers that contained gaps in the serial numbers. The best practice described above was not followed at those POEs. The CBSA manual does not specify what information should be included in the immigration controlled form registers used by the CBSA. Each POE had minor differences in the templates they used for their registers. Most POEs kept the IMM 1442B register next to the printer so that it was convenient for border services officers to complete the entry. Interviews with officers indicated that this was a good practice. 

As part of the audit methodology, a check was made to ensure that all IMM 1442B registers were accounted for within the audit period. All registers were accounted for at five POEs, which totalled 117 registers. Two other POEs had two registers each that were unaccounted for out of a total of 524 registers. The final POE could not account for 172 out of 297 registers. These registers are important as they are the only link connecting the pre-printed IMM 1442B serial number identified on the immigration controlled forms to the Field Operations Support System (FOSS) used to issue these forms. The pre-printed serial number is not entered into the FOSS when a permit is issued. The FOSS and immigration controlled form registers are linked either by the client ID or the FOSS-generated number assigned to each issued permit. Either of these numbers should be recorded in the register to link them to the pre-printed serial number. The audit was unable to confirm whether the immigration controlled forms applicable to the missing form registers were issued.

The registers for manual permits were also reviewed and it was noted that three POEs were unable to provide registers for the manual permits issued. Although not used as frequently as the IMM 1442B registers, registers for the manual permits are still required due to the pre-printed serial number sequences for each package of 50 permits.

A sample of IMM 1442B registers and all manual permit registers were reviewed from each POE to determine their completeness and the accuracy of the information. The audit noted that there was incomplete information in the registers at all eight POEs. The missing information included missing form serial numbers, insufficient information to be able to research the permit in the FOSS, and a lack of confirmation of whether the permit was issued or destroyed. If a permit is not recorded in the register, the risk that it may have been fraudulently used is increased.

The FCO at the POE is responsible for monitoring the registers to ensure that they are complete and that there are no gaps in the serial number sequence. The FCO is required to take samples and check the information against the FOSS to ensure that the data is correct and that the permits have been issued to the individual stated in the register. This type of continuous monitoring is critical as it provides the assurance of accuracy and that all permits are properly accounted for. Based on interviews and analyses performed at the eight POEs, the audit noted that one POE did not meet the monitoring requirements as there was no FCO in place at the time of the audit. Also, six POEs did not perform the sampling activities outlined in their roles and responsibilities, and one POE only performed this activity during a portion of the review period. In addition, based on the errors identified with the immigration controlled form registers, the audit noted weaknesses relating to how the FCOs performed their overall monitoring responsibilities.

Quarterly Inventory Reports

Reporting on the inventory of immigration controlled forms is the responsibility of the FCO at each POE. Detailed instructions on how to complete the Quarterly Inventory of Immigration Control (Key) Forms (IMM 5392B) are outlined in the CBSA manual. This report is to be prepared each quarter and submitted to the FMO at CIC. The purpose of this report is to provide CIC with the total amount of immigration controlled forms that are used, received, transferred and destroyed during the quarter. 

The audit found that four of the eight POEs did not prepare the required quarterly reports for the period of 2006. One POE had not prepared any reports for the period and the FCO was unaware of the requirement to do so. All inventory reports were reviewed and the majority of the errors found related to the Generic Documents (IMM 1442B). Examples of errors found include discrepancies between the values reported under “Used” and “Destroyed,” and ending inventory totals that did not correspond to the serial number range(s) recorded for the ending inventory. Further, not all form inventories were recorded as required. The accuracy of these reports is important as they are used by CIC to monitor form use and inventories at POEs.

The audit noted that a best practice was applied at the Lester B. Pearson International Airport in Toronto, Ontario, the land border crossing in Douglas, British Columbia, and the Vancouver International Airport in Vancouver, British Columbia, for controlling the inventory of the IMM 1442B generic documents. The practice was to have sign-out sheets located with the inventory. When the officers removed the boxes from the storage room, they would be required to indicate their name and the date of removal. These sheets provided an additional security measure to manage the inventory of immigration controlled forms. Interviews with FCOs indicated that they found the sheets to be useful for monitoring as well as for completing the various audit procedures. 

Physical Security

The CBSA manual provides specific guidelines on how to properly safeguard the Generic Documents (IMM 1442B) and manual immigration controlled forms. For the IMM 1442B documents, this involves having an appropriate working storage area where the documents are retained for everyday use and a deep storage area where the remainder of the inventory is kept. The audit did not find any issues concerning the physical security of IMM 1442B Generic Documents. Most of the POEs visited maintained one box at the printer(s) at all times, with the remainder locked in a secure storage room. Some POEs had printers that were enclosed in locked cabinets where a small working storage inventory was kept, and had the remainder of the inventory locked in a secondary storage area (deep storage).

Although manual immigration controlled forms are not used as frequently, related security requirements are outlined in the CBSA manual. The market value of these forms and the risks associated with them increase the need for the forms to be locked in a storage cabinet for safekeeping. The audit did not find any issues concerning how these forms were safeguarded. However, the CBSA manual does outline that the inventory of these forms should be kept to a minimum given that they are not frequently used. The CBSA manual suggests that a six-month supply be the standard. The audit found that one POE had a very high inventory (several years supply) of these forms. A high inventory increases the risk of theft or misuse of the manual forms.

Recommendations:

2. The Operations Branch, in collaboration with the Comptrollership, Enforcement and Admissibility branches, should update all CBSA policies and procedures related to immigration controlled forms, including Agency roles and responsibilities.

Management Action Plan	Completion Date
The Operations Branch will chair an initial meeting with the CBSA branches identified above and CIC in order to update and improve the current CBSA policies and procedures related to immigration controlled forms.	March 31, 2008

3. The Operations Branch should provide training and communicate policies and procedures to POEs concerning immigration controlled forms management.

Management Action Plan	Completion Date
Once revised policies and procedures are in place, the Operations Branch will begin to work immediately with the Training and Learning Directorate to ensure that up-to-date training material with respect to immigration controlled forms management is available and provided to officers at POEs.	October 31, 2008

4. The Operations Branch should ensure the frequent review and monitoring of immigration controlled form registers maintained at POEs.

Management Action Plan	Completion Date
The Operations Branch has developed and implemented a module in the Process Monitoring Framework (PMF) Manual that reviews and monitors immigration controlled form registers at the POE level on a bi-annual basis.	Currently in effect.

4.3 Monitoring

No monitoring activities were conducted by the CBSA to ensure that POEs were complying with the immigration controlled form requirements outlined in the CBSA manual.  

Monitoring is a core fundamental control. Programs and activities should be monitored on a regular basis and the results should be documented and reported to the required management level.

The audit analyzed the various procedures relating to immigration controlled forms that were followed at the POE level to ensure that they were functioning smoothly. These procedures are outlined in the CBSA manual. They are in place to control the use of these forms and safeguard the forms inventory at POEs.

The audit indicated that no monitoring activities were performed relating to immigration controlled forms at the regional or HQ level. As such, the CBSA does not have the information to determine if procedures relating to immigration controlled forms are operating effectively.

Recommendation:

5. The Operations Branch should implement a monitoring and reporting process within HQ to ensure compliance with policies and procedures at POEs.

Management Action Plan	Completion Date
The CBSA will develop reviewing and monitoring procedures as part of the PMF Manual.	October 31, 2008

Appendix A - Lines of Enquiry and Criteria

Compliance with Policies and Procedures - Security/Controls

• The policies and procedures in place concerning the requisition, receipt, destruction, transfer and/or receipt of transferred immigration controlled forms are being complied with properly.
• Issues of non-compliance with any policy in the CBSA manual are being reported correctly.
• Management and staff are aware of these policies and procedures and follow them. 
• The physical facilities are adequate to safeguard immigration controlled forms.
• Deleted or voided immigration controlled forms are recorded in the FOSS and in the registers.

Compliance with Policies and Procedures - Monitoring

• Manual or electronic immigration controlled form registers are kept and updated as required.
• The inventory of immigration controlled forms is completed quarterly and sent to CIC National Headquarters on time. 

Appendix B - Forms and Acronyms

Immigration controlled forms

IMM 1097B  Visitor Record

To record data on the entry of a visitor to Canada.

IMM 1102B  Work Permit

Issued to a visitor who wants to work in Canada temporarily.

IMM 1208B  Study Permit

Authorization given to foreign students studying in Canada.

IMM 1263B  Permit to Come into or Remain in Canada (Temporary Resident Permit)

To allow temporary entry into Canada of persons whose admission is prohibited by the Immigration and Refugee Protection Act.

IMM 1442B  Generic Document

To document clients under the visitor and enforcement system. The four types of permits listed above are issued on this document when they are processed through the FOSS.

Forms for the management of immigration controlled forms

IMM 1409B  Requisition for Immigration Controlled Forms

To request a supply of immigration controlled forms.

IMM 5448B  Certificate of Destruction / Transfer / Receipt of Transferred Immigration Key Control Forms

To register serial-numbered forms for destruction or transfer.

IMM 5392B  CIC and CBSA - Quarterly Inventory of Immigration Control (Key) Forms

To record the stock of immigration controlled forms.

IMM 5442B  Immigration Key Forms Custodian Register

To register all permanent resident visas issued in numerical sequence.

Acronyms

CBSA

Canada Border Services Agency

CIC

Citizenship and Immigration Canada

FOSS - Field Operations Support System

An electronic system used to enter and obtain information about clients.

FCO - forms control officer

The officer responsible for the security of immigration controlled forms, and for the implementation and review of a system of accountability for these forms at each POE.

FMO - forms management officer

The officer responsible for forms management procedures at CIC National Headquarters.