Our followup audit focused on the recommendation to AER. The department’s management told us their recommendation is not yet implemented. We are planning a separate audit at the department to look at the overall MFSP system to gauge if it is well designed or effectively mitigates risks to Albertans.
We concluded as of August 31, 2018, AER had implemented our 2015 recommendation to develop and execute a risk-based plan for its MFSP monitoring activities to ensure it is carrying out the appropriate amount of MFSP security verification audits. Should there be significant MFSP program, policy and design changes, we may consider initiating a new audit at AER.