Audit of the Canadian Firearms Program continuum of eligibility for firearms licensing

Vetted report

February 2018

Access to information

This report has been reviewed in consideration of the Access to Information Act and Privacy Acts. The asterisks [***] appear where information has been removed; published information is UNCLASSIFIED.

Table of contents

1. Acronyms and abbreviations
2. Executive summary
3. Management's response to the audit
4. 1 Background
5. 2 Objective, scope, methodology
   • 2.1 Objective
   • 2.2 Scope
   • 2.3 Methodology
   • 2.4 Statement of conformance
6. 3 Audit findings
   • 3.1 Governance
   • 3.2 Training, sufficiency and timeliness of information
   • 3.3 Monitoring and oversight
   • 3.4 Risk management
7. 4 Conclusion
8. 5 Recommendations
9. Appendix A – Audit objective and criteria

Acronyms and abbreviations

BI

Business Intelligence

CFIS

Canadian Firearms Information System

CFO

Chief Firearms Officer

CFP

Canadian Firearms Program

CFPM

Canadian Firearms Program Manual

CPIC

Canadian Police Information Centre

CPS

Central Processing Site

ES

Enhanced Screening

DAC

Departmental Audit Committee

FBI

Firearms Business Improvement

FO

Firearms Officer

NHQ

National Headquarters

ORMS

Operational Records Management Systems

PRIME

Police Records Information Management Environment

PROS

Police Reporting and Occurrence System

RCMP

Royal Canadian Mounted Police

Executive summary

The Canadian Firearms Program's (CFP) mission is to enhance public safety by reducing the risk of harm from misuse of firearms. Through the offices of Chief Firearms Officers (CFOs), the CFP works with the provinces and territories to manage firearms licensing, authorizations to carry or transport, and the continuous eligibility of licensees in each jurisdiction. Under the current licensing regime, client eligibility is assessed at the time the individual applies for a firearms licence, continuously while the individual is a licence holder, and at the time the individual applies to renew their licence (every five years).

The objective of the engagement was to assess the effectiveness of the processes in place to ensure the eligibility of firearms licence applicants and holders, and the adequacy of the supporting management control framework.

Overall, the audit found that an effective management control framework is in place and that eligibility processes and investigations are compliant with legislation and policies. Nevertheless, opportunities exist to improve processes and to mitigate risks impacting the eligibility screening process. Challenges were found in the areas of policy, training, availability and timeliness of information, processing delays and monitoring and prioritization of work queues.

With respect to the national policy framework and training standards, opportunities to improve consistency and decision-making exist by updating the national Canadian Firearms Program Manual and developing standardized training for personnel in key decision-making roles.

Required information to assess eligibility which is directly available to the CFP is generally available on a timely basis. Information which needs to be requested from third parties may experience delays, thereby delaying the conduct of eligibility investigations. This increases the potential risk to public safety.

Emphasis on developing additional mechanisms to monitor and triage priority files as well as assessing options to improve the timeliness of third party information could further mitigate these risks. Leveraging the CFP's existing capacity to perform data analytics using business intelligence tools to proactively monitor and triage work queues based on predetermined risk factors would assist in this regard.

Opportunities may also exist to further analyse and assess the residual risks related to the reengineered approach to Enhanced Screening. The management responses included in this report demonstrate the commitment from senior management to address the audit findings and recommendations. A detailed management action plan is currently being developed. Once approved, RCMP Internal Audit will monitor its implementation and undertake a follow-up audit if warranted.

Management's response to the audit

Specialized Policing Services is in agreement with the Audit Findings as outlined within Section 3 of the Report. Specialized Policing Services is also in agreement with the Audit Recommendations, as outlined within Section 5 of the Report, and have taken the following steps.

The CFP has initiated a project which will complete the CFP Subsidiary Manual and ensure continuous updates and maintenance through a management control framework. This project will also develop national Standard Operating Procedures (SOP) for each key Program business activity.

The CFP has initiated discussions to secure a National Training Coordinator whose mandate will be the implementation of a National Training Regime which will include training on: the Firearms Act and associated Regulations; investigative methodologies and techniques; the CFP Policy & SOPs; and the automated tools which support the administration of the Firearms Act.

The CFP is currently in discussions with Contract & Aboriginal Policing (CAP), as well as management within CPIC Services, to modify the current CFP Policy on the use of PROS to ensure timely accessibility to information which assists in assessing the eligibility of Program clients to acquire or possess firearms. In addition, the Chief Firearms Officer (CFO) of British Columbia (BC)/Yukon Territory is in discussions with the BC Ministry of Public Safety and Solicitor General regarding their access to PRIME, based on Recommendation #37 of the BC Illegal Firearms Task Force Report which supports increased access to this Information Management System.

In October 2017, the CFP initiated a pilot project which re-engineered the Enhanced Screening Protocol in an effort to acquire relevant information *** which would assist the CFO in establishing the eligibility of an applicant to acquire or possess firearms. Additionally, the CFP have included an initiative within their 2018/2019 Strategy Map which will "Develop enhanced processes and additional training to strengthen screening and investigation of mental health-related files".

The CFP executed an Organizational & Operational Review of the Federal CFOs, as a follow up to the 2013 Review, in the fall of 2017 which assessed work volume, work prioritization and roles and responsibilities. This report, to be published in early spring 2018, includes action items to address the triage of workloads and the use of performance metrics to enhance the prioritization and management of work.

The CFP will construct a Management Action Plan which will track each of these recommendations within the Audit Report. Specialized Policing Services would like to express its appreciation and gratitude for the level of effort put forth by Internal Audit respecting the execution of this initiative and the level of detail which was documented within the Report.

Assistant Commissioner François Bidal
Acting Deputy Commissioner, Specialized Policing Services

1 Background

The Canadian Firearms Program's (CFP) mission is to enhance public safety by reducing the risk of harm from misuse of firearms. It provides direct service to the public in relation to the administration of the Firearms Act and its associated regulations, which govern possession, licensing, transportation, use, registration and storage of firearms in Canada. This includes screening individual owners to confirm their eligibility to possess firearms, and promoting responsible ownership, storage and use of firearms. The CFP also provides direct operational support to law enforcement in all firearm-related inquiries and investigations.^{Footnote 1}

In 2006, the Royal Canadian Mounted Police (RCMP) became responsible for managing the CFP. The CFP currently reports to the Commissioner of Firearms, who is also the Commissioner of the RCMP.

Through the offices of Chief Firearms Officers (CFOs), the CFP works with the provinces and territories to manage firearms licensing, authorizations to carry or transport, and the continuous eligibility of licensees in each jurisdiction. There is a CFO for each province and territory. The provinces of Ontario, Quebec, New Brunswick, Prince Edward Island, and Nova Scotia are known as the "Opt-in provinces" since these provinces have chosen to administer the Firearms Act and its regulations within their jurisdictions. As such, these CFOs are provincially appointed and are accountable to the federal Minister of Public Safety through contribution agreements. The CFOs in the remaining provinces and territories of Alberta/Northwest Territories (AB/NT), British Columbia/Yukon (BC/YT), Manitoba/Nunavut (MB/NU), Saskatchewan, and Newfoundland and Labrador are federally appointed and report directly to the CFP. These CFOs are referred to as federal CFOs and these jurisdictions are known as the "Opt-out provinces and territories". The federal CFOs are RCMP employees reporting to the Director General (DG) CFP through the Director, Firearms Regulatory Services.

Under the CFP's Firearms Service Delivery directorate, the Central Processing Site (CPS), located in Miramichi New Brunswick, carries out central processing functions for the CFP as a whole. CPS is comprised of a Contact Centre and various processing facilities including the Data Processing/Mailroom units which intake and process approximately 260,000 firearm licence and renewal applications annually, and the CFO Support Unit which provides administrative and operational support to multiple CFOs across Canada.

In Canada, individuals who possess or use firearms must be licensed, unless an individual is using a firearm under the direct and immediate supervision of a licensed holder. Similarly, all individuals who acquire firearms or ammunition must be licensed. The Possession and Acquisition Licence (PAL) is currently the only firearms licence issued to applicants over the age of 18.^{Footnote 2} In 2016, the CFP issued 406,592 new licences and there was a total of 2,076,840 valid licence holders in Canada.^{Footnote 3}

Under the Firearms Act (the Act), CFOs are authorized to refuse an application for a firearms licence or to revoke a firearms licence based on their assessment of an individual's potential risk to public safety. There were 2,223 firearms licences revoked and 771 firearms licence applications refused for various public safety reasons in 2016.^{Footnote 4} Under the current licensing regime, client eligibility is assessed at the time the individual applies for a firearms licence, continuously while the individual is a licence holder, and at the time the individual applies to renew their licence (every five years).

To ensure compliance with the Act, firearms licence holders are continuously screened to assess their eligibility to remain licensed. This is known as continuous eligibility screening. Accordingly, if a licence holder is involved in an event involving violence (or other offences specified in Section 5 of the Firearms Act), it is reported in the Canadian Firearms Information System (CFIS) via a Firearms Interest Police (FIP) and sent to the relevant CFO for review. There were 29,487 FIP events in 2016 that were matched to individuals with a firearms licence.^{Footnote 5}

The Commissioner-approved 2016-2019 Risk-Based Audit Plan included an audit of the CFP. The CFP's high public profile along with recent heightened scrutiny stemming from coroner's inquiries supported an independent review of eligibility screening for firearms licensing.

2 Objective, scope and methodology

2.1 Objective

The objective of the engagement was to assess the effectiveness of the processes in place to ensure the eligibility of firearms licence applicants and holders, and the adequacy of the supporting management control framework.

2.2 Scope

The scope of the audit included the processes in place to ensure the eligibility of firearms licence applicants, existing firearms licence holders and clients renewing their licences. This included a review of the procedures undertaken by the "Opt-out" CFOs as well as the supporting operations of CPS and the CFP policy centre located at national headquarters. Since the federal CFOs and the CPS are composed of RCMP employees who report to the DG CFP, their activities fall within RCMP Internal Audit's mandate to audit. The Opt-in CFOs and their staff are employees of their respective provincial Department of Justice or Solicitor General and not RCMP employees. Accordingly, their activities do not fall within RCMP Internal Audit's mandate to audit and were not examined.

The period of scope for files reviewed for this audit was January 1, 2016 to December 31, 2016.

The audit did not assess the quality of data within CFIS.

2.3 Methodology

All work was conducted in accordance with the Institute of Internal Auditors International Standards for the Professional Practice of Internal Audit (2015) and the 2017 TB Policy on Internal Audit.

Planning for the audit was completed in May 2017. In this phase, the audit team conducted interviews, process walkthroughs and examined relevant policies, procedures and results of previous audit work performed.

Sources used to develop audit criteria and audit tests included the Firearms Act and related regulations as well as RCMP policies and guidelines. The audit objective and criteria are available in Appendix A.

The examination phase, which concluded in November 2017, employed various auditing techniques including interviews, documentation reviews and testing of client files. Site visits took place at CPS and two "Opt-out" CFO Offices, CFO BC/YT and CFO AB/NT to review files and assess practices. Upon completion of the examination phase, the audit team held meetings to validate findings with personnel and debriefed senior management of the relevant findings.

The table below provides a summary of the number of files tested during the audit. Sampling methodology involved random sampling based on CFIS data extracts obtained from the CFP. To review the application process, the audit team tested a random sample of approved first-time applications and licence renewals for various types of firearms (non-restricted [NR], restricted [R] and prohibited [P]), as well as first-time and renewal applications which were refused. To review the continuous eligibility process, the audit team sampled client files which had eligibility events during the 2016 calendar year.

2.4 Statement of conformance

The audit engagement conforms to the Institute of Internal Auditors' International Professional Practices Framework and the Treasury Board of Canada Directive on Internal Audit, as supported by the results of the quality assurance and improvement program.

3 Audit findings

3.1 Governance

Policies and procedures

The Firearms Act and its related regulations are the legislative components that govern the administration of the CFP. The Act defines criteria which are to be considered by CFOs to assess an individual's eligibility to hold a firearms licence. This includes assessing whether or not an individual has been convicted of certain Criminal Code offences, has been treated for mental illness, has a history of violent behaviour, or is the subject of a prohibition order against possessing firearms. The Act also specifies that an individual is only eligible to hold a licence if they have successfully completed the necessary firearms safety courses. The Act solely authorizes CFOs to make licensing eligibility determinations. Pursuant to Section 98 of the Act, these powers, duties and functions are formally delegated by the CFO to CFP Firearms Officers (FOs).

The audit noted that the screening processes in place to assess eligibility are focussed on obtaining information necessary to assess the various criteria as specified in the Act. For example, in order to assess criminal convictions, a Canadian Police Information Centre (CPIC) inquiry is conducted on the individual. Similarly, court records are queried in order to determine the existence of any prohibition orders. The policies and procedures in place were found by the audit team to be in alignment with the requirements of the Act.

In terms of a policy framework we expected the CFP to have national policy in place which would govern eligibility activities program-wide and provide the basis from which more detailed unit level policies and procedures could be developed.

The Canadian Firearms Program Manual (CFPM) is the national policy manual. Among the subjects included in the CFPM is licensing. A number of sections in the licensing portion (Part 2) of the CFPM which relate to eligibility screening are currently blank, including Section 7 – Continuous Eligibility, Section 8 – Court Orders, and Section 10 – Refusals and Revocations.

Compensating for this gap in the national policy manual, both the CPS and the CFO offices have detailed policies and procedural guidance in place at the unit level to govern eligibility processes. Given the repetitive nature of the steps involved in processing applications and reviewing continuous eligibility concerns, these detailed standard operating procedures assist to ensure standardization of processes.

At the unit level, it was observed that the CPS and CFO office staff are aware of policies given that they refer to them for their day to day activities. Managers and supervisors communicate updates or changes to policies in a timely fashion and there are mechanisms in place such as intranet sites which serve as central repositories for relevant policies and procedures as well as for sharing updates and important information.

As a result of the 2013 Operational Review which sought to centralize common administrative processes, many of the administrative processes and lower risk decision-making are carried out by the CFO Support Unit within CPS on behalf of CFOs. One of the key controls in place to operationalize this decision-making is a matrix which delineates what can be approved by CFO Support Unit staff and what requires escalation to CFO offices for review. The matrix has been refined over time and discussion is ongoing within the program as to whether or not additional decision-making should be delegated to the CFO Support Unit.

Compliance

To review the integrity of the eligibility screening process, different types of files in both CFIS and at the CFO offices were examined to assess whether the required procedures were completed and appropriate supporting evidence was on file to support eligibility decisions.

Applications/renewals

Audit testing demonstrated that the necessary eligibility checks had been carried out prior to licence issuance for 100% of the 110 approved firearms applications and renewals which were sampled. This included automated system checks as well as manual steps when required.

Similarly, the necessary checks were found to have been completed for 100% of the 12 refused applications/renewals sampled. In each case, the rationale for the decision was documented and aligned with the eligibility criteria contained in the Act. Where necessary, there was evidence that an eligibility investigation was conducted to support the decision to refuse the application.

Continuous eligibility files

To assess the timeliness of the Continuous Eligibility screening process, audit testing was performed on a total of 66 files which had incurred a FIP event, including files for which the final outcome of the eligibility investigation was still pending.

In general, the file review determined that although the CFP is notified of a FIP event relatively quickly through the continuous eligibility process (two-day average) and the CPS in turn provides disclosure and notifies CFO offices of these occurrences in a timely fashion, there are significant delays in both initiating investigations and in the duration of eligibility investigations themselves. In many cases, where charges have been laid against a client, it appears the CFP chooses to await the court outcome before making an eligibility decision.

• Revocations and Valid Licences: testing of files relating to revoked licences (16) as well as files relating to licences that had been flagged for eligibility concerns but which had their status returned to 'valid' after investigation (14) were all found by the audit team to be fully compliant with the eligibility criteria contained under Section 5 of the Firearms Act. For the revoked licence files, the average amount of time from the FIP event to an eligibility decision by the CFO was 110 days^{Footnote 6} (80 days for CFO BC/YT and 140 days for AB/NT). For the files whose status was returned to 'valid', the average amount of time from the FIP event to an eligibility decision by the CFO was 231 days^{Footnote 7} (203 days for CFO BC/YT and 268 days for AB/NT).
• RSR and Under Review: for the 27 files reviewed from both CFO offices which had incurred a FIP event but did not yet have a final decision as at the time of the audit (i.e. still in "RSR" or "Under Review" status), the average time which had passed since the initial FIP event was 331 days^{Footnote 8} (324 days for CFO BC/YT and 337 days for AB/NT).
• Expired Licence: nine files were reviewed which had experienced a FIP event for which the status of the licence was "expired" at the time of review. In all cases, the licence had expired before the CFP was able to review/investigate the FIP and make a final eligibility determination. For these files, the average time from the FIP event to licence expiration was 189 days^{Footnote 9} (142 days for CFO BC/YT and 249 days for AB/NT).

The risk to public safety in delays is often mitigated by the fact that law enforcement has seized the individual's firearms and firearms licence. The audit noted that it is a priority for FOs to determine whether such seizure has occurred when reviewing FIP events. This is done by a review of the occurrence details and by contacting the police officer involved, if necessary.

Possibly the more significant risk to public safety occurs whenever files with FIP events await initial review by the CFO for an extended period of time. Although both BC and Alberta have similar volumes to process, BC has the additional mitigation measure of reviewing each file immediately upon receiving it in their queue for a first level "triage". This practice is not currently being employed in the CFO AB/NT office. The main contributing factor cited by the CFO AB/NT office for these delays was a staff shortage. At the national level, the CFP has been considering workload redistribution among CFOs to alleviate some of Alberta's backlog (i.e. sending Alberta files to be processed by CFO MB/NU). Further discussion of the CFP's monitoring and management of file backlogs follows in section 3.3 of this report.

3.2 Training, sufficiency and timeliness of information

Training

Employee training is important to ensure that processes are carried out as intended. It also facilitates standardization and efficiency. The audit expected to find that national training standards existed and that employees had received the necessary training to carry out their responsibilities.

The majority of the processes related to eligibility processing are administrative in nature. As such, most new employees are trained by "job shadowing" a more senior employee. Given that many of the tasks are repetitive, procedural guidance has been documented at the unit level to support employees in carrying out various tasks. In addition to on-the-job training related to specific roles, formal training related to specific work tools^{Footnote 10} are offered and there are also some mandatory courses for all new RCMP employees offered online through AGORA. As well, Legal Counsel assigned to the CFO AB/NT and CFO BC/YT offices offer training courses on the Firearms Act and related regulations to new CFO staff as well as training on specialized legal topics specific to FOs. In addition, both CFO AB/NT and CFO BC/YT have documented training requirements for new employees in various roles (i.e. specific material to which employees are to be exposed) to aid in developing suitable individual training plans.

As of October 2016, a Program Expertise (PE) unit has been responsible for developing and administering training to all new staff in some of the CPS units (Contact Centre, Data Processing, CFO Support Unit). PE plans to expand its training offerings to the remaining units in the future (Mail & Records, Exceptions Handling). PE is also responsible for providing technical guidance and quality assurance monitoring.

The audit team noted the best practice of cross training staff within functional groups to be able to work on a variety of tasks. This allows flexibility to reallocate staff within CPS or within respective CFO offices to address backlogs and priorities. With the exception of employees working in the role of FO, staff interviewed at both CPS and CFO offices generally felt the training received was sufficient for performing their job related duties.

The training gap identified by interviewed CFOs and FOs was the absence of a training standard for employees working as FOs, a role for which a broad skillset is necessary. FOs have the responsibility of conducting investigations into eligibility concerns and making final eligibility decisions based on the results of those investigations. Given the role of the FO, it was considered an asset to have previous working experience in a regulatory environment, and/or conducting investigations. However, CFOs reported that finding suitable candidates with the necessary experience was difficult and that current FOs have differing backgrounds.

Collaborating with RCMP Learning and Development to develop a training standard for FOs could assist in addressing gaps in employee experience and foster consistent practices and decision-making. One of the CFOs has been leading an initiative to develop a national training approach for FOs. This will include leveraging any pre-existing RCMP training modules (e.g. investigative techniques, note-taking, interviewing) and identifying any gaps where specific training needs to be developed.

Sufficiency and timeliness of information

A number of information sources are used to assess an individual's eligibility to hold a firearms licence. These sources include but are not limited to CPIC, PROS, PRIME BC, other police records management systems (RMS), court records, responses to Personal History Questions on a firearms licence application, and enhanced screening results.

Under continuous eligibility, additional information sources are typically involved as part of an investigation into a FIP event. For example, additional information may be obtained from the client via an interview, disclosure of an occurrence may be requested from the police of jurisdiction, or in Mental Health Act (MHA) cases, information from a medical practitioner (RCMP form 6423) may be obtained. The CFP's ability to conduct an accurate assessment of an individual's eligibility is dependent on access to and availability of complete information.

The audit found that in general, sufficient information is available to program personnel to make eligibility determinations. It was noted however, that there is room for improvement in certain areas.

Coding of Occurrences

Under continuous eligibility, client information within CFIS (the CFP's information system), is continually compared against information in CPIC to monitor client interactions with law enforcement which might be of interest. CFP staff have indicated a risk relating to generic coding by police officers of occurrences that may be relevant to CFP eligibility assessments. While one CFO office estimated that one to two such occurrences are noted on a weekly basis, the audit team only noted one such occurrence as part of the sample of files reviewed for testing. The program has attempted to mitigate this risk with proactive outreach to policing partners to educate on the importance of accurate coding of occurrences to the FIP process. In consultation with the CFP, Contract and Aboriginal Policing (CAP) has recently issued policy updates relating to incidents involving violence in relationships where the suspect has mental health issues and access to firearms.^{Footnote 11}

Access to CPIC Information

As a regulatory body, the CFP is bound by privacy considerations and does not have unrestricted access to PROS/PRIME.

The CFP is classified as a "Category III" agency for CPIC purposes which is support to law enforcement. As such, Chapter 2.6 of the CFPM contains direction which limits what information CFP staff can access in these systems. Specifically, section 4.2 states that "[T]he CFO/delegate must only access the occurrence associated to the FIP entry or to its investigation when querying ORMS." Section 4.4 specifies that "[A]ll queries undertaken using a surname, address, or any other search entry besides the operational occurrence number related to the FIP will be considered a breach of access, and may result in the suspension of access, a review of the individual's security clearance, and/or disciplinary actions."^{Footnote 12}

Through formal discussion with the police of jurisdiction related to a FIP, the CFP can be made aware of the existence of additional relevant eligibility information in ORMS. In these instances, additional disclosure must be requested from the police of jurisdiction in order for the CFP to have authorized access to this information. While CFP staff and CFOs have indicated that increased access to other historical occurrences would assist in providing additional information to assess eligibility it would mean unfettered access to personal information that may be unrelated to the assessment. As such, further assessment of the impact on privacy concerns is required by the organization.

Disclosure of Information

An additional risk relates to the timeliness with which information relevant to assess eligibility is available. Based on evidence obtained from interviews and file testing, timeliness in obtaining eligibility related information varies depending on the information source and whether or not program personnel have access to the information directly or whether the information needs to be requested from a third party. Where delays existed in obtaining information it was most often out of the CFP's control.

Generally, CPIC, court information, and PROS disclosure is obtained within one or two days. On average, CPS staff obtain any required disclosure for PROS related occurrences within a day. CFO AB/NT has direct, full access to JOIN (Alberta court record information system), and to both Edmonton Police Service and Calgary Police Service RMS. This facilitates obtaining information in a timely fashion. In the case of CFO BC/YT, staff have direct, full access to JUSTIN, which is the BC provincial court record information system.

Delays were noted with non-PROS (PRIME BC or other RMS) related disclosures. In these cases, turnaround time for disclosure was reported to be between a few days and a few weeks depending on the policing partner involved. CPS cannot perform PRIME disclosures on behalf of CFO BC/YT, so all FIPs originating from BC are sent to CFO BC/YT for disclosure. CFO BC/YT in turn does an initial PRIME check and sends disclosure requests to the police of jurisdiction. As part of the sample of files reviewed for CFO BC/YT, five files were noted as having been reassigned to an FO for investigation with varying timeliness with respect to PRIME disclosure turnaround (four months, four months, four weeks, three weeks, two weeks). Although CFO AB/NT relies on CPS for PROS disclosure, staff will send disclosure requests to non-RCMP police of jurisdiction (i.e. Medicine Hat, Lethbridge) when required.

Delays were also noted in obtaining medical information pertinent to assessing mental health risks and applicant/client eligibility. Such delays can impact rendering an eligibility decision as the physician's opinion can inform an FO's assessment of the individual's suitability to obtain/retain a firearms licence.

The typical process involves applicants/clients providing a medical questionnaire (RCMP Form 6423) to their medical practitioner for completion and submission to the CFP. To mitigate the risk of prolonged delays in obtaining medical information, the CFP implemented a policy which requires the medical form to be completed and returned within 60 days. If medical information is not received by the end of the 60 days, the program may proceed with a firearms licence refusal or revocation. An extension can be provided but only in special circumstances. The CFP relies on outreach to policing partners and medical associations to convey the importance of timely processing of requests for pertinent information to assess eligibility concerns.

Enhanced screening

The enhanced screening (ES) process, introduced in 2007 involved conducting telephone interviews with the applicant and two references in order to flag any potential public safety risks in granting the individual a firearms licence. In 2010, the CFP conducted a review of the effectiveness of ES as a means of flagging eligibility issues. Based on the review, the CFP decided in April 2014 to reduce the ES process to a single telephone interview with just one of the applicant's references.

In 2017^{Footnote 13} as part of a pilot project, the process of interviewing references by telephone was phased out ***. As the pilot project progresses, policies and SOPs are being developed and formalized. It is estimated that approximately 14,400 applicants would meet the criteria for screening annually under the new ES process. The CFP intends to evaluate the effectiveness of the new process once the pilot has been in place for four months.

The audit team's assessment is that further analysis should be carried out to assess the residual risk of changing the approach to ES. Potential trade-offs related to the change in process should be assessed. ***. The CFP should consider such factors as part of its review of the results of the pilot project.

Another initiative to be undertaken by the program, to potentially increase the usefulness and relevance of the information requested for screening licence applicants, is a review of the personal history questions^{Footnote 14} on the current licence application form. Given that the questions have been the same for many years, the program intends to review them for alignment with current risk factors.

3.3 Monitoring and oversight

The audit expected to find that processes existed to review eligibility activities carried out by the CFP to identify opportunities for improvement, and that performance information was being captured and used by management for decision-making. The audit also expected to find quality assurance (QA) processes at the unit level to monitor compliance of eligibility activities and that work queues were being monitored and prioritized based on risk factors.

Within the CFP, the Firearms Business Improvement (FBI) directorate leads the design of business processes based on policy and operational requirements. Using business intelligence (BI), as well as by conducting internal operational reviews, it evaluates processes with a view to improving efficiency and effectiveness. The review of the effectiveness of ES and proposed changes to the ES process discussed previously in this report were led by the FBI directorate.

In 2013, the FBI directorate led a national Organizational and Operational Review (OOR) of CFO offices focused on key business activities, volume of work for each activity, level of effort for each activity (time in motion study) and resource requirements. The review also assessed the feasibility and impact of centralizing common administrative activities. This led to the establishment of CPS' CFO Support Unit. Since the 2013 OOR, CFP staff and management identified that there are likely additional opportunities for work to be reallocated from the CFO offices to the CFO Support Unit to allow the CFO offices to focus on higher risk investigative work. The audit team's assessment supports reviewing the possibility of reallocating work between CPS and CFO Offices.

As a follow-up to the 2013 review, the FBI directorate initiated an organizational review of CPS CFO Services in September 2017^{Footnote 15}. The review was to focus on executing a comprehensive analytical assessment of CFO and CFO Support Unit business activity process work flows to identify inconsistencies, anomalies/issues as well as to identify public safety risks. The results of the review were not available prior to the completion of this audit.

The FBI's BI group performs data analytics using information in CFIS to provide reports to the CFP's other directorates that can help inform decision-making. For example, regular reports are prepared for the Director of Firearms Regulatory Services and the Director of Firearms Service Delivery on work volumes, queues and backlogs. It can also carry out more in-depth analysis to enable the CFP's other directorates to monitor areas of concern and help foster continuous improvement. Data analysis conducted by the FBI directorate identified process improvements relating to the timing of Legal Services' involvement in the revocation process as well as the development of a standardized revocation letter in 2017. While the audit found that the FBI directorate plays a role in helping to ensure that CFP eligibility processes are monitored and reviewed for enhancement opportunities, opportunities exist to further leverage the FBI directorate's data analytics capacity to monitor the nature of work volumes and backlogs at CFO offices and hone in on specific risk areas of concern to the CFP as a whole (e.g. risks relating to the significant backlogs in the CFO AB/NT office). This would enable the CFP to have greater visibility on backlogs and develop additional strategies to address them, in addition to the strategy of transferring workload from one CFO office to another.

Quality assurance

The accountability for QA monitoring of eligibility screening processes rests with the CPS and the CFOs where the eligibility activities have taken place.

The PE group within the CPS conducts QA on the output of certain units; namely, the Contact Centre, the Data Processing unit, and the CFO Support Unit. Each employee in those units has a PE analyst who regularly reviews a sample of their work and provides feedback. As PE's mandate is relatively new, the QA function is still to be developed for other processes within the CPS. Currently Mail & Records, Exceptions Handling-Accreditation are not subject to QA processes.

At the CFO offices, a number of processes were in place at the time of the audit to ensure quality control of eligibility processes. For example, the reviewed files included checklists and templates to ensure completeness and process standardization. FOs are expected to engage their supervisors (Operations Managers or Team Leaders) and CFOs on files that are sensitive, and Legal Counsel reviews all proposed application refusals and licence revocations.

In recent years, the CFP has required CFOs to carry out the unit level quality assurance (ULQA) process related to "Quality of Investigations". For both CFO offices visited, the results of their 2016 ULQAs, which were based on an internal review of over 110 files, were reviewed by the audit team. Deficiencies noted for both CFOs related to ensuring that all investigational steps undertaken by staff were documented in CFIS. The ULQA results in both cases suggested that supervisory review could mitigate the deficiencies noted.

Audit evidence obtained through both file testing and interviews support the need for additional supervision. It was noted that supervisory review of files is currently focused solely on files with negative eligibility decisions. The effectiveness of the QA process could be improved if files with all types of outcomes were reviewed for compliance and consistency, as there are inherent risks in an individual obtaining/retaining a firearms licence at the conclusion of an eligibility investigation.

Monitoring and management of file backlogs

Given the highly process-based operating environment within the licensing portion of the CFP, the audit expected to find that work queues were monitored for backlogs and bottlenecks, and that mechanisms were in place to prioritize files based on predefined risk factors.

Overall, it was noted that there was a shared understanding among program units as to what eligibility risks were most significant. This in turn led to a generally consistent approach to prioritizing workload. Priority files were those with mental health (MH) concerns, public safety concerns, and FIP events related to current clients. New licence applicants with eligibility issues were considered less of a priority because of the assumption that these individuals do not have legal access to firearms so the risk to public safety is not as great.

As a means of ensuring that MH files are prioritized, a CFO work queue dedicated to MH related files was created in the Spring of 2017. This queue allows the CPS to quickly notify the relevant CFO offices of such priority files. The CFO offices in turn ensure that staff investigate any of the files in this queue on a priority basis. However, the newly created queue does not apply to BC files. Since BC related FIP events come from the PRIME-BC RMS, and CPS does not have access to this system, they cannot perform a first level triage for these files. Therefore, CFO BC/YT performs the triage of its FIPs and uses its own method for flagging MH files internally using a "PRIORITY" descriptor in the file heading. They have been doing this since 2013.

The audit found that workload is regularly monitored at both CPS and CFO offices. At the CPS it was noted that units were heavily focussed on monitoring queues of various sub-tasks to identify delays and backlogs. Given the CPS is highly service standard driven, this monitoring provided supervisors with the information required to adjust priorities and reallocate resources to focus on areas with greater backlogs. This is facilitated by the fact that employees are cross-trained and can work on more than one task within their respective units.

Within CFO offices, the reporting capabilities within CFIS are used to monitor work volumes, backlogs and individual employee queues. It was noted that in addition to CFIS, an additional spreadsheet tool entitled "Workload Support Tool" was being used to track and monitor progress of open files being worked on by FOs.

Despite some of the mechanisms in place, significant backlogs of both applications with eligibility issues and FIP events related to current licence holders were noted at the CFO offices visited. These backlogs have created delays in addressing eligibility issues, with the greater risk being unaddressed eligibility concerns related to current licence holders who have access to firearms.

Although both CFO offices visited had similar backlogs of FIP events, opportunities for improvement were noted in the manner in which CFO AB/NT monitors this backlog. With the exception of MH files, CFO AB/NT treats all FIPs on a first-in first-out basis. The current backlog is an accumulation of eligibility concerns which have not yet been opened or reviewed by CFO AB/NT staff. No analysis has been performed to prioritize or assess the risk level of the files in the backlog. Without any form of review when they are initially received, individuals who may no longer be eligible to have a firearms licence retain their licence until such time as an investigation gets underway and a decision is made regarding their eligibility.

In contrast, all files in the BC queue are reviewed within a day of being received from CPS at the Firearms Agent level prior to being reassigned to the FO if necessary. This ensures a level of awareness of FIP incidents and the types of files they are so they can be prioritized based on the nature of the eligibility issue (e.g. MHA, violence, etc.). For CFO BC/YT, as of July 2017, there was a backlog of 2930 applications (with eligibility flags) which had yet to be worked on. The backlog of FIPs (notifications) which had yet to be worked on was 2092.

For CFO AB/NT, as of June 2017, there was a backlog of 1713 licence applications with eligibility concerns. The backlog of FIPs requiring investigation was 3188. By comparison, the CFO AB/NT backlogs in April 2016 were 1550 applications and 2264 FIPs, demonstrating that the FIP backlog had increased by 41% from 2016 to 2017.

While work queues are generally monitored and prioritized, not all CFO offices prioritize their backlogs based on risk factors. These practices should be reviewed to ensure risks are appropriately mitigated.

3.4 Risk management

The audit expected to find that the CFP had processes in place whereby risks are identified, assessed, prioritized and linked to program priorities, as supported by the RCMP's approach to Integrated Risk Management as outlined in the Administration Manual 18.3.

Overall, the CFP appears to have a sufficient risk identification and assessment process in place. Program wide identification and assessment of risks, including those impacting eligibility activities, is part of the CFP's formal business planning process which includes the development of a five-year business plan and semi-annual CFO led meetings to discuss risks and related mitigating strategies.

The risk analysis section of the 2012-2017 CFP Business Plan contains a number of identified risks related to eligibility processes such as: ineligible clients having access to firearms; lack of resources; consistency of practices; and accessibility of information from police databases. Through interviews, the audit team confirmed that the risks originally identified in the 2012-2017 Business Plan continue to be in alignment with Management's view of key risks currently impacting eligibility. Based on interviews with CFP staff at all levels it was noted that the CFP's top priority is reducing public safety risk related to firearm use while focussing on the risks related to MH and current licence holders with eligibility issues.

Risks specifically impacting eligibility activities are also identified and assessed, and strategies to address them at an operational level are discussed at the CFO conferences which are held twice a year. The CFO conferences are attended by all CFOs, the Director of Firearms Service Delivery, Director of Firearms Regulatory Services and the Director of Firearms Business Improvement. As strategies are implemented, they become part of business processes discussed at the monthly Governance Committee teleconferences (including CPS, Opt-out CFOs, and CFP), and at the monthly Integrated Program Operations Team (IPOT) teleconference which includes representatives from all CFOs and major CFP directorates linked to operations. IPOT serves as a forum to identify, raise awareness and make recommendations to resolve operational issues.

The Record of Decision for the February 2017 CFO Conference demonstrates that decisions/action items, action owners and due dates are tracked for risk related issues discussed at these meetings. The audit also found that there is program-wide awareness of risks impacting eligibility activities. For example, the decision to prioritize existing clients over applicants stems from an identification and assessment that there are likely greater risks to public safety from eligibility events related to existing clients who have firearms licences (due to their access to firearms) than for eligibility events related to new licence applicants.

There is also ongoing monitoring of risks at multiple levels within the program. For example, CFOs, supported by their Team Leaders/Operations Managers, monitor risks in their respective day to day operations. CPS uses CFIS to monitor risk areas as manifested in its work queues. This includes tracking the files flagged as MH for action by the CFOs. Within the policy centre, the BI group conducts program-wide monitoring of work queues and volumes to help inform decision-making in the respective CFP directorates. As per section 3.1 of this report, although this information is being used in the consideration of workload distribution amongst CFOs, opportunities remain for the CFP to take further steps to address volume backlogs and the risks they engender. Additional opportunities exist to leverage the FBI directorate's data analytics capacity to further monitor and triage work volumes at CFO offices based on predetermined risk factors, and develop corresponding strategies to address backlogs.

Another aspect of the risk management process which was assessed was the implementation of strategies to mitigate the risks identified. The audit was unable to conclude on the effectiveness of the mitigation actions themselves but noted that actions were being taken to address significant risks impacting the program. Examples of risk mitigation initiatives being undertaken include:

• To further reduce the risk that ineligible applicants obtain firearms licences, the CFP has launched a pilot project to reengineer the manner in which ES is performed on first time applicants.
• To ensure MH files are prioritized nationally, a system change was implemented in CFIS in April/May 2017 where first level triage by CPS places such files in a separate MH priority queue.
• CFO offices are targeting increased outreach with police agencies to encourage improved Uniform Crime Reporting coding and with the medical community to encourage collaboration on medical disclosure.

The audit found that risk mitigation activities are being designed and implemented with the objective of reducing identified risks. However, as several risk mitigation activities are at early stages of development, it is premature to assess their completeness as well as their ultimate impact on reducing risk. The effectiveness of the mitigation strategies in addressing each risk will depend on their successful implementation that includes ongoing monitoring.

4 Conclusion

Overall, the audit found that an effective management control framework is in place and that eligibility processes and investigations are compliant with legislation and policies.

Nevertheless, opportunities exist to improve processes and to mitigate risks impacting the eligibility screening process. Challenges were found in the areas of policy, training, availability and timeliness of information, processing delays and monitoring and prioritization of work queues.

With respect to the national policy framework and training standards, opportunities to improve consistency and decision-making exist by updating the national CFPM and developing standardized training for personnel in key decision-making roles.

Emphasis on developing additional mechanisms to monitor and triage priority files as well as assessing options to improve the timeliness of third party information could further mitigate these risks. Leveraging the CFP's existing capacity to perform data analytics using business intelligence tools to proactively monitor and triage work queues based on predetermined risk factors would assist in this regard.

Opportunities may also exist to further analyse and assess the residual risks related to the reengineered approach to Enhanced Screening.

5 Recommendations

1. The Deputy Commissioner Specialized Policing Services should ensure that the CFP supports standardization of processes at the national level by updating the CFP Manual.
2. The Deputy Commissioner Specialized Policing Services should ensure that the CFP, in collaboration with Learning and Development develops a standardized training program for Firearms Officers.
3. The Deputy Commissioner Specialized Policing Services should continue efforts to assess the timeliness of information from third parties relevant to eligibility screening decision-making.
4. The Deputy Commissioner Specialized Policing Services should ensure that the CFP conducts further analysis of current processes with the aim of increasing the effectiveness of eligibility screening.
5. The Deputy Commissioner Specialized Policing Services should ensure that the CFP make use of its capacity to perform data analytics to monitor and triage work queues based on predetermined risk factors.

Appendix A – Audit objective and criteria

Date modified:

2018-10-25