HANSARD

Printed and Published by Nova Scotia Hansard Reporting Services

Ms. Maureen MacDonald (Chair)

Mr. Chuck Porter (Vice-Chair)

Hon. Leonard Goucher

Mr. Keith Bain

Mr. Graham Steele

Mr. David Wilson (Sackville-Cobequid)

Mr. Keith Colwell

Mr. Leo Glavine

Ms. Diana Whalen

[Mr. Wayne Gaudet replaced Mr. Keith Colwell]

[Mr. David Wilson (Glace Bay) replaced Ms. Diana Whalen]

WITNESSES

Office of the Auditor General

Mr. Jacques Lapointe, Auditor General

Mr. Alan Horgan, Deputy Auditor General

Mr. Terry Spicer, Assistant Auditor General

Ms. Ann McDonald, Assistant Auditor General

In Attendance:

Ms. Darlene Henry

Legislative Committee Clerk

Ms. Sherri Mitchell

Committees Office

HALIFAX, WEDNESDAY, APRIL 29, 2009

STANDING COMMITTEE ON PUBLIC ACCOUNTS

9:00 A.M.

CHAIR

Ms. Maureen MacDonald

VICE-CHAIRMAN

Mr. Chuck Porter

MADAM CHAIR: Good morning. I'll call the committee to order. We will begin, as usual, with introductions. Mr. Steele.

[The committee members and witnesses introduced themselves.]

MADAM CHAIR: Thank you. Mr. Lapointe, if you wish to make an opening statement, the floor is yours.

MR. JACQUES LAPOINTE: Thank you, Madam Chair. As you know, my Spring 2009 Report was tabled last week with the House of Assembly and I am pleased to have the opportunity to discuss it with you here today. With me are three members of my senior management team who worked on this report and can answer questions in detail: Alan Horgan, the Deputy Auditor General, and Assistant Auditors General Ann McDonald and Terry Spicer.

My report covers audit work that my office completed during the winter of 2009, after our last report in November 2008. The report includes three chapters on program performance audits, two government-wide audits on public sector audit committees and on information technology security, and an audit on truck safety programs at Transportation and Infrastructure Renewal and Service Nova Scotia and Municipal Relations. There is a chapter on our follow-up of the 2006 audit recommendations.

As an independent and non-partisan officer of the House, my responsibility is to assist the House to hold the government to account for its management of public funds and to contribute to improving the performance of the public sector. One of the ways in which I perform this role is by identifying and recommending solutions to problems in government programs and suggesting improvements to government operations. My report this April makes 47 such recommendations. Madam Chair, we will be pleased to answer your questions.

MADAM CHAIR: Thank you very much. The opening round of questions will be 20 minutes per caucus. I recognize Mr. Steele with the NDP caucus.

MR. GRAHAM STEELE: Thank you very much, Mr. Lapointe; my compliments, as always, to you and your staff for an excellent report, very well presented. It's very useful information for those of us who sit on the Public Accounts Committee and those of us who sit in the Legislature.

I am not going to take my time this morning to go over the substantive findings of the report because that was pretty well-discussed last week, both in the session of the Public Accounts Committee and also in the media comments. What I want to focus on in the first round this morning is the government's response. As you will know, in the past I have expressed a concern that when your office releases a report with recommendations for improvement, the government has a standard communication strategy which involves minimizing the concerns that you've raised, downplaying them, essentially saying there is no problem.

Let me give you a concrete example of that and that has to do with the inspection system for trucks. I want to read, just for the record, the paragraph in Chapter 1 of your report. It says, "Transportation and Infrastructure Renewal's safety, inspection and enforcement programs do not effectively mitigate the risk of a truck being involved in an accident. The commercial carrier safety fitness rating and audit program at Service Nova Scotia and Municipal Relations is compromised due to untimely, incomplete and inaccurate information. This may allow commercial and passenger carriers with poor safety records to continue to operate unsafe vehicles." That is a direct quotation from your report.

Last week you said, even more bluntly, "at present we feel public safety is being compromised." Now it seems to me that that's pretty clear, but the government's response was to minimize and essentially dismiss those findings. On the same day that your report was released, the Premier said that we have one of the best safety records in the country with respect to transportation. "Our truckers are highly qualified and there are policies, guidelines, rules in place, and because of that, Nova Scotia's roads are ..." among "... the safest in the country." Now, one of you is wrong - which one of you?

MR. LAPOINTE: Good question, Mr. Steele. Really I don't think it's a question here of either of us being right or wrong - we are saying different things. My audit did not go out and look at the statistics and audit the safety of the roads in comparison to other provinces and so on, we were looking at the government's program to improve that safety in regard to trucks and buses. And we concluded that the processes that were being followed were insufficient, that they set certain goals in the program and needed to do more to achieve those goals that were achieving less than they intended - that's what we were commenting on.

MR. STEELE: So when the Premier says that we have one of the best safety records in the country with respect to transportation, do you know what evidence he is basing that statement on?

MR. LAPOINTE: No, I do not.

MR. STEELE: Now it leaves me to wonder whether, in fact, one of the reasons why the inspection system and safety audit system is not meeting the standards that your office was measuring them against in the audit was because the government doesn't really believe that there's a problem. The same day that you released a report last week, for example, the Minister of Transportation and Public Works was quoted as saying the following: "My experience has been that the scales could open at any time, 24/7. It's always been the way, so while yes, in fact perhaps the reality is they are not open as much as we would like, there's always that potential there, the potential for them to be there."

So what the Minister of Transportation and Public Works was trying to convey there is that even though the hours may be fairly predictable - as your report found - and therefore easy to avoid if anybody were minded to avoid the weigh scales or the inspection stations, that in fact they could open at any time. So I wonder if you, or Mr. Spicer, could comment on this, that in the course of your audit, what information did you find about what you might call surprise openings, or unexpected hours of the weigh scales, that might reduce the predictability?

MR. LAPOINTE: Yes, thank you, I will ask Mr. Spicer to speak to that one.

MR. TERRY SPICER: It is true that they can open basically whenever they want. But what we did was we basically looked at in-depth for two months to see when they were in fact open - and that detail is in the report - and what we found was that typically they were open at standard times and predictable times for those two months.

MR. STEELE: In the course of your audit, Mr. Spicer, did you at any time talk to the truckers themselves or the Truckers Association?

MR. SPICER: No, we did not.

MR. STEELE: Because the idea that the minister is trying to convey is that although there are deficiencies, as identified in your audit, that there are other elements of the program that actually reduce the risk - one of them being that there might be unexpected openings. I mean, did you find in the course of your audit, looking at the records for two months, that in fact there was a certain element of unpredictability that the weigh stations, the inspection stations could be open 24/7?

MR. SPICER: I would have to look back at the details whether there were any days when they were open 24/7. But our conclusion, based on a detailed analysis of those two months, was that they were open in predictable time periods.

MR. STEELE: Now the minister said something else that day - again this is part of what seems to be a concerted government communications plan to minimize the findings of your audit - he also said that besides the weigh scale houses, his department also has 13 mobile vehicle compliance officers. The implication of this was that even if a vehicle was not stopped at a weigh station, there was always a chance they might get inspected by this mobile vehicle compliance officer contingent. What did your audit find out about these mobile vehicle compliance officers?

MR. SPICER: That's correct, there are mobile compliance officers out there. What we found was that they typically operate on the second-tier roads, not the main 100-Series Highways in Nova Scotia. Typically, what we found was that they would operate trying to catch those vehicles that might be trying to avoid the scales or operating on the second-tier - not level 1, 100-Series Highways.

MR. STEELE: Did your audit allow you to form any opinion about whether the relatively random nature of these mobile vehicle compliance officers helps to ensure that truckers are compliant, or as many as possible are compliant?

MR. SPICER: No, we weren't able to conclude that.

MR. STEELE: The minister also said last week - I couldn't find the precise words when I was looking for them yesterday, but it was something along the lines of, Nova Scotia has the safest rigs in North America, or among the safest rigs in North America. In the course of your audit, did you come across information that would support a statement like that?

MR. SPICER: We did not, but nor did we look for that.

MR. STEELE: Because the thing I'm curious about is, as the government responds to this in a concerted effort to downplay the seriousness of your findings, which I read at the beginning of my remarks, you can't escape the conclusion that if we do indeed have among the safest trucking rigs in North America and yet we have a fairly deficient system of inspections, that maybe we don't need a system of inspections. Maybe there are other factors

that lead the truckers to ensure that the rigs are safe and, in fact, maybe the inspection system is a big waste of money. Because if it's not working very well and yet at the same time the minister can assert that we have among the safest rigs in North America, maybe we're wasting our money on the existing inspection system. Did your audit allow you to form any conclusions about that? Is it possible it's just a big waste of money?

MR. SPICER: That's a difficult question to answer. Management at Transportation and Infrastructure Renewal have indicated to us the importance of the inspection program and the importance of the enforcement programs. We believe they're needed.

As far as answering your specific question, I wouldn't be able to do that, but I think the importance of having a strong inspection and enforcement program is commonly known.

MR. LAPOINTE: If I could add to that as well, it may be that either more or less inspections would be desirable, but that would be a decision of the government and the senior management of the day. We were operating on the basis that there is a program with goals and that it seeks to achieve certain safety goals in the province, and therefore a decision has been made that a certain level of safety is desirable.

Given that, we are asking whether the program is achieving the goals it had set for itself. We were measuring against established policy goals as they are now, as to whether they should change or not, but it would not be our call.

MR. STEELE: If I understand you correctly, Mr. Lapointe, basically what you were looking at is whether the program is achieving what the program itself says it's trying to achieve.

MR. LAPOINTE: That's correct.

MR. STEELE: And it is failing to meet its own objectives.

MR. LAPOINTE: That would be what we were looking at.

MR. STEELE: And that if there were to be changes made to the inspection system, that would be a policy decision for government to make, but that's not one of the recommendations in your audit.

MR. LAPOINTE: That's correct.

MR. STEELE: In the course of your audit on trucking safety, did you look in any manner at the efficiency of the existing inspection system?

MR. LAPOINTE: Yes, I could ask Mr. Spicer to speak to that as well.

[9:15 a.m.]

MR. SPICER: Again, that's a difficult area to look at so I guess the quick answer to that is no, we weren't able to assess whether trucks were going through the weigh scales in an efficient time period.

MR. STEELE: Just to give you a concrete example of this, a couple of weeks ago I was driving out towards the airport and past the weigh station that's close to the airport and I saw a long line of trucks lining up at the weigh scale and inspection station. It occurred to me as I was driving past that this was a horribly inefficient way of dealing with this. In the trucking industry, time is money and even based on your audit results, the majority, even the great majority of the trucks that were waiting in line that day were likely to be fully safe, fully compliant. Yet they were being required to stay in a long line when what they needed to do was be on the road.

In the course of your audit, did you form any conclusions about whether it was possible to improve the efficiency of the system so that trucks could be moved through these inspection stations more quickly so they could get back on the road as quickly as possible?

MR. SPICER: No, we didn't form any conclusions like that although I will add that part of the idea around the CVSA inspections is, it is a national and North America-wide program where if there's an inspection done on a truck in another part of the country, if they have one of these stickers, they will move through the weigh scale system faster because they know that truck has actually been inspected at some point in time. So that is one of the elements that does help speed up the lines at the weigh scales but we weren't able to determine whether there was any efficiency gains by changing anything else.

MR. STEELE: It does seem to me, looking at the report, that if there was a system, some kind of a pass system where the good trucks - the compliant trucks, the ones that we knew were in good shape - could either by-pass the inspection station or move through them like through an express lane, kind of like the way that we move a lot of the commercial traffic through the Canada-U.S. border now, where you can apply for and qualify for a certain kind of pass that is just going to get you moving more quickly. It just seemed to me, particularly that day, that the system was not serving the truckers because they had to wait in a very long line. Maybe it was partly related to staffing at the station, which is one of the issues raised in your audit - that they just didn't seem to have enough staff to do the job.

Now I imagine that these difficulties and deficiencies identified in the audit will be of concern to staff as well who want to do a good job but, as in many areas of government, are probably significantly under-resourced. In the course of your audit, did you have occasion to speak specifically to staff and/or the staff union about their concerns about resourcing as opposed to talking to management?

MR. SPICER: We did speak to the vehicle inspection officers out there but the discussions were more focused around what you do, how you do your inspections, how often you do them, what guidelines, what supervision you receive. We didn't specifically ask the question of whether you had enough people to do your job. Now we did speak to management as well throughout the audit and, as we reported in here, one of the comments that they made around the staffing of the weigh scales was that part of the problem was they didn't have enough people to have two people on all the time.

MR. STEELE: One of the other issues raised later on in your report is the government's very poor record of implementing Auditor General recommendations. Now if you look back to when you first started tracking this - I believe it's 2002 - the government consistently is under 50 per cent and these are recommendations that the government accepts. Now there's a certain percentage of recommendations that the government simply rejects either because they don't accept the analysis or they say would require too many resources to implement and you know, I'm actually fine with that - I understand that there can be an honest difference of opinion. But what you have is the vast majority of the recommendations are accepted by the government and they say they're going to do them and then they don't. Consistently the government implements less than half of all the recommendations made in your report.

Mr. Lapointe, last week you said that on this particular chapter, you had reason to hope that the government's record would be better. What is it that happened differently this time that made you think that a record of poor implementation of Auditor General recommendations, lasting over six or seven years, is going to change in this instance?

MR. LAPOINTE: There were two things in this one that were a little bit different. Firstly, the response itself - if you look at the written response that we inserted into the report, it's very specific about the commitment to implement. For the most part, where they agree - and there are disagreements, of course, as you mentioned - the departmental response tends to be along the lines of they agree, here is what we are going to do and sometimes the time frame by which we will do it. This is a specific commitment - recommendation by recommendation - which is, as I've said, an exemplary way to respond to our recommendations. Then we understand exactly where we stand with each one and we know what to look for two years later when we go back.

The other was in a discussion with the deputy ministers in each of the departments on this. They reiterated their commitment, as senior management in the government, to what they state in their response, in terms of their agreement and their time frame. That level of commitment and specific response tells me that I can expect that when I go back, if I can't expect to see these done in that situation and I never could.

MR. STEELE: The overall message from this chapter, I think, is one of frustration; certainly frustration from the trucking industry which is looking at inconsistent results -

depending on the time of day, which weigh station they approach, which inspector they approach, they're going to get different results; frustration on the part of staff who would like to do a good job but are under-resourced; frustration on the part of the Auditor General - you used the word frustration last week about the government's poor record of implementing recommendations. I would say overall the government has a very poor record of implementing the recommendations made in your report.

MADAM CHAIR: The time has expired for the NDP caucus. I recognize Mr. Glavine for the Liberal caucus. You have 20 minutes, until 9:43 a.m.

MR. LEO GLAVINE: Thank you very much, Madam Chair and thank you, Auditor General and staff for coming in today and following up on your report.

The first thing I wanted to deal with is a little bit of a similar theme to my colleague and that is as we take a look at the historical reports from your office and the level of completing recommendations, the picture is not very comforting from 2002 to 2006 and with that report having been followed up in 2009. The government of the day has never broken the 50 per cent compliance barrier and that is certainly troubling and frustrating and I know on a number of occasions you have said things like, ". . . we have to conclude the outstanding recommendations have not been given priority." "We sent a request to each department or entity in early October 2008 asking that a self-assessment of the implementation status be completed and returned to us by October 31, 2008. We encountered significant delays in obtaining self-assessments by that date . . ."

Another quote, "While we were able to complete our procedures by our deadlines, the resources required to follow up the late responses would have been better used elsewhere."

Could you describe for us today the level of frustration with this current government over the failure to comply with the recommendations from your report?

MR. LAPOINTE: Yes, thank you. Well I've been fairly consistent, I guess, in the last few reports in following up and stating what I consider to be the expectation that I have in terms of these recommendations. I was reiterating the fact that, no, they are not being implemented at a rate that I consider satisfactory, and it's not because of my desire to see my recommendations implemented, but because I believe that we make recommendations in areas that are important to this Legislature and to the people of the province. So there are reasons for it and there are consequences when they're not put through, but the only thing that I can do is to continue to reiterate my concern and to continue to follow up and to bring it to the attention of the House through this committee.

MR. GLAVINE: So would you describe then, perhaps, that the efforts to date have been somewhat, you know - a token gesture? Would you go that far, Auditor?

MR. LAPOINTE: Sorry.

MR. GLAVINE: Would you go so far as to say that the efforts to date have been somewhat of a token gesture as opposed to a real determination to put your recommendations into full compliance?

MR. LAPOINTE: I wouldn't use those words. What we see is inconsistency, and sometimes possibly an insufficient priority in administration applying itself to these recommendations. We understand that people are busy and have a lot of things to do - we understand that, but we feel that these are important. You understand that my office began to make formal recommendations this way in 2002 and we've been improving the way we do it ourselves and also giving time for government and management to get used to the concept that our recommendations are intended to be implemented and are being followed up on. So I consider that there's a learning curve involved here and so on, and I'm making that assumption that over time what I expect to see is improvement in the direction of this - not that we would expect in 2003 to get 90 per cent implementation right away, but that over time the direction of improvement is the way we want it to be. So I would like to see a higher rate of implementation today than there was yesterday.

MR. GLAVINE: Are you aware in terms of the follow-up - because there generally are a couple of years in the process of following up - are you aware of any directive from elected officials to enhance the compliance level of your recommendations?

MR. LAPOINTE: I'm not aware of any such directive, or if there is something, we haven't become aware of it in the office. I am aware of the tracking system that Finance and Treasury and Policy Board have been developing and trying to put in place to follow up themselves; we worked with them to help set that up, to track and report on at that level. So I'm hoping that that will lead to some improvement because of there being more knowledge available about the situation.

MR. GLAVINE: I ask that because I've been at some public meetings where, in fact, your recommendations have been referred to. Right here in this Chamber you delivered a pretty scathing report on safety of school buses to the South Shore Regional School Board and I have met with officials of the South Shore Regional School Board and, of course, they returned here to Province House. So here we have an elected board that had really not much of a directive from the Department of Education but took tremendous responsibility and took your recommendations to actually follow in a very detailed manner and, of course, the results are an outstanding improvement on the South Shore. So I ask that question around whether or not you think, you know, our elected officials, the government, should in fact be doing that same kind of due diligence to their departments when the auditor's recommendations are put forth?

[9:30 a.m.]

MR. LAPOINTE: I believe that, and I think we've had that kind of discussion in the Public Accounts Committee as well, but I believe that there needs to be some oversight of this, I think in some form, either by government or by the House itself, or possibly through this committee, so that there is attention on the issue and it's not simply left to go its own way. What that specific form should be is really not for me to say but I agree that there needs to be some form of oversight to it.

MR. GLAVINE: I was wondering about the experience in other provinces. Do Auditors General in other provinces have the same problem of not being able to reach beyond the 50 per cent compliance, which is the status of where we are today?

MR. LAPOINTE: We don't have official numbers or statistics on this thing but I know that our informal knowledge of what transpires on this is that it varies considerably across the country but the implementation rate in pretty well all cases will vary after a couple of years or two or three years from say, 45 per cent to as high as over 90 - in the 80s and 90s, 40s and 50s but higher than we have here.

MR. GLAVINE: Just to go back to where I was a moment ago, obviously recommendations to Treasury and Policy Board do have very serious implications for the province and I'm wondering in that area, were there any directives that were put forth, especially around the IT area that again, you brought forth in your latest report - directives around making sure that the recommendations were given adherence?

MR. LAPOINTE: I am not aware of any such directives.

MR. GLAVINE: Thank you. With the self-assessments that were sent out in October - they asked for a return date of October 31^st - when did you receive the last self-assessments?

MR. LAPOINTE: I'll ask Ms. McDonald to speak to that one.

MS. ANN MCDONALD: Thank you. We would have received the last self-assessments in late January. That would have been the latest time frame.

MR. GLAVINE: So is there anything further, any further background in terms of the delays and why they did occur?

MS. ANN MCDONALD: No, just we sent repeated requests and, in some cases, we just had to keep repeating our request and asking for the information. Then, when we did get the information, it was a fairly fast process after that.

MR. GLAVINE: And, of course, you know ministers are responsible for their departments. Are elected officials informed that the requests are not coming forward? Is there any role or part that they play in this?

MS. ANN MCDONALD: I'm not aware of any. We send a request to the deputy ministers and then ask that the deputies in each department to send out the self-assessment to their own staff, as appropriate.

MR. GLAVINE: So again, further delays that you've experienced, is this part of the whole difficulty experienced by the Auditor General's Department, in terms of delays and not that full, co-operative spirit that should be developed here?

MS. ANN MCDONALD: Well there certainly is a level of frustration in trying to get this assignment finished when the requests that we sent out are not dealt with on a timely basis.

MR. GLAVINE: Well last year you commented by saying, there was a lack of culture of control within the government. Do you stand by that statement, by that comment, because we have another report which clearly shows only 39 per cent of recommendations have been completed?

MR. LAPOINTE: Yes, I would stand with that. It was a pretty broad, general statement, you understand, but we are looking at the overall culture and attitude, in terms of prioritizing and what is important to people and I would say it still stands today.

MR. GLAVINE: So how do you see that undergoing a change and a much more - I guess, you know - positive relationship with your department and government and the recommendations, at least given full exploration, in terms of their implementation?

MR. LAPOINTE: Well a culture, in terms of related to internal controls and accountability, is a question of general attitudes and the priorities across an organization. It's a very large thing and I think what needs to transpire is that over time a general attitude develops amongst public servants, generally speaking, that controls are important and that in setting priorities, controls must be set at a higher priority because they affect other things and they affect your ability, in effect, to operate and achieve your operational goals. But, that is something that has to keep being reiterated and that develops over time.

MR. GLAVINE: Just to move a little bit from that overall view of your department in relationship to government to focus a bit on the IT issue and my colleague will pick up on the transportation areas.

Again, as a background, a couple of your quotes: "The organizational structure for government's IT operations remains confusing and onerous." "Planning for information

technology security is not adequate." "Management practices for monitoring and enforcing compliance with policies and standards are not adequate." So, in this Spring's report, again, you've found a number of deficiencies. How long has your office been aware of significantly weak systems and controls, government-wide, with IT security?

MR. LAPOINTE: In one form or another, if you look back at our reports, we've had comments on different aspects of these weaknesses for some time in several reports, coming out in such things in looking at a financial program finding that there were weaknesses in terms of access, inappropriate access in terms of passwords and so on. Or, we commented fairly recently that we were looking at management letters coming from external auditors of agencies and that a number of them had their recommendations to the agencies on improvements in IT systems and in their general controls.

It's those widespread observations that led to my comments about a general culture of control - it wasn't a specific program or a specific area, but generally speaking, a lot of system issues that keep resurfacing. That was one of the reasons we decided we had to look at it in more depth the governance and security issues in government and led to this chapter.

MR. GLAVINE: So, some of this has preceded your time as Auditor General? I'm wondering if somebody in the department can kind of give us a tracking of the timeline that government has known there are a number of inherent weaknesses in our current system.

MR. LAPOINTE: I don't know how - things change so much over time that I don't know how far back we can go to something that's relevant to this. Certainly I would say, though, that I was aware of comments in previous reports going back a couple of years before I started, that would be related to this and relevant to it.

MR. GLAVINE: Your report, in my view, if I do a short conclusion on what you've said, is that it hasn't been given the priority that I think Nova Scotians want and want some greater degree of security around this. What will it take then for this to become a priority in your view, Auditor?

MR. LAPOINTE: It's hard to say what it would take to become a priority. All we're saying is that at some point, over time, the priority has to improve and I'm looking at the direction of improvement. I'd like to see that over time the response to recommendations improve, that the implementation rate improves and that the culture of control becomes stronger across government and that incrementally every year, a little better than the year before and I think that is the key. It's not something that you either are or not, it's not something that happens overnight, but that you continue to improve every year.

MR. GLAVINE: Government recently designated a Chief Information Officer. When was this person first put in place?

MR. LAPOINTE: We became aware of this very recently. I believe it was in December 2008 when the position was created.

MR. GLAVINE: And are you aware of their mandate and any relationship to the audits that you have carried out and the recommendations around IT security?

MR. LAPOINTE: The mandate is developing and has first created the position gradually, developed the responsibilities and authorities for it. Just post the printing for the completion of our report we became aware of an OIC which starts to reorganize IT responsibilities under this position and gradually, you know, create the mandate for it. So that, as we understand, is a work in progress now. And it's certainly, from what we can see, a move in the right direction.

MR. GLAVINE: You also commented in your report that there did not exist adequate standards, policies, and compliance to properly protect personal information that is stored on many government-wide databases. Of course, this is a grave concern to Nova Scotians who believe that their information is safe when it is disclosed to government officials, because we know that happens on a daily basis - as we sit here, that information is coming forward. Can you comment on how safe you believe the personal information of Nova Scotians really is?

MR. LAPOINTE: To speak to that in a little more detail, I would like to ask Alan Horgan to answer your question.

MR. ALAN HORGAN: The confidentiality of public and confidential information is fundamental to IT security and is just one element of IT security. So in performing this audit what we've wanted to do is look at the whole framework that government has developed to maintain IT security. In doing so, I mean looking at organizational structure, planning for security, looking at the policies and standards and the enforcement of those standards, we found there's a lot of room for improvement and we ended up making 21 recommendations. So taken as a whole, that indicates that the framework for security is not as strong as it could be. It's not being managed at the highest levels of government and that will trickle down and create various weaknesses which could impact the security of private information.

MADAM CHAIR: Order, please. The time has expired for the Liberal caucus. I recognize Mr. Goucher for the PC caucus. You have 20 minutes.

HON. LEONARD GOUCHER: Thank you very much, Madam Chair. I'm going to continue along the vein of the IT review under Section 3. IT at the best - to me, and I'm no expert on it but it's almost like a black hole that keeps getting deeper, deeper, and deeper as technology keeps improving. We buy within government and we personally buy electronic devices and buy computer services that six months down the road need to be changed. In

your report, and I'm just going to quote, "Government made a significant and positive move in creating the position of Chief Information Officer, which will hopefully result in stronger leadership and clearer lines of authority for the governance and management of information technology." I guess really, can you tell me - maybe expand a little bit on what you would expect to see of that role and maybe why you believe it is positive in nature?

[9:45 a.m.]

MR. HORGAN: We conducted an audit about a year ago on the whole governance structure surrounding IT, and that's where we first made the observation that the organizational structure overseeing information technology is quite confusing and onerous. One of the reasons it's confusing is because there are so many players and it's unclear as to how these players relate to each other and what kind of authority each of these players have. So in developing the position of Chief Information Officer, we see two - at least two - very important factors come into play. One is there's going to be a central leadership, one position who can marshall all the other elements so that they're all focused on one goal, all marching in the same direction; and, as well, there's going to now be one source of authority, a position that can say this is the way it's going to be, we have now co-operatively decided we're going to do something and I'm going to oversee it and make sure it gets done. That really didn't exist when the system was more decentralized.

MR. GOUCHER: Can you maybe expand a little bit more? What remains to be undefined? I mean, we can talk about the centralization of leadership and a single source of entry for authority, but I'm looking to try to get a little bit more information from your standpoint as what you believe is undefined within the IT sector. I don't even pretend to sit here - and I think most of us in this room, probably a lot of us, don't understand it in great depth but, by the same token, as politicians sitting here, I'm trying to understand where you're coming from.

I think one of the comments, if I have it here, and I'll just have to go back to the book, I'm sorry, had to do with the role - the organization's responsibilities and authorities of the new position have not yet been finalized. What would you like to see from that - where would you like to see this particular role go within the organization?

MR. HORGAN: Keep in mind that at the time of our audit a number of the centralization moves that the government has made hadn't occurred at that point. So I would start by saying that one of the things that would help define that role is who is going to report to it and what are the accountabilities, what parts of the IT organization are responsible to it and how would they report to it?

One role that still remains unclear, in my mind, is the function of the Business Technology Advisory Committee. It comprises a number of deputy ministers and it is a committee of Treasury and Policy Board. It's not clear to me what the relationship of that

committee is to the chief information officer, and will this committee still have significant authority to do things or is this authority all going to fall to the chief information officer; will this committee become more an advisory committee or will it become a functional action-oriented committee - so, things like that.

MR. GOUCHER: Okay. I'm going to try to go a little deeper here - the issue of security. I guess simply put, we can talk about firewalls and we can talk about protecting the systems from intrusion, but we know in today's world that you're never going to get 100 per cent. I mean, it's just not going to happen, there are just too many things happening, even whether it's Canada or the United States, whether it's any level of government, there is always that risk there.

In Nova Scotia, within the report I believe you commented that there are 10,000 people who use computers and we have a budget of around, I think, $100 million in the province. What guidelines and standards and at what cost - how much is enough from your standpoint, from the audit perspective? I mean, let's face it, we could probably spend $500 million, and is it going to give us 100 per cent security? Probably not. We could probably spend a billion dollars and the same thing is said.

So I guess my question to you - and I know it may be a difficult one from an audit perspective - at what point, from your audit perspective, are we doing enough within the province fiscally to meet your audit perspective?

MR. HORGAN: It's an excellent question. With regard to any government system you should always ask how much is enough. With regard to IT security, as it is with so many elements of government, it comes down to risk. Enough probably is a measure of what are the most significant risks and what is the impact if these risks aren't able to prevent, in this case, the intrusions and maybe the release of private information?

One of the things we would expect from any organization we're auditing - and it was definitely a finding of this audit and the previous audit that I mentioned - is that we'd expect government to have done that analysis, to have looked at their whole system, the information technology system, and start studying and addressing the risks. Where are the high risk areas, which areas are lower risk, and then marshall your resources towards your high risk.

Without that risk analysis, it's hard to say for us, it's hard to say even for the government, whether they're doing enough things in the right places. It's just kind of a more narrow example. In our report we indicate that there has been no threat risk assessments done on the wide area network in 10 years. I mean that's just kind of an example. Government needs to look even at their technical systems and say what devices, what systems do these devices protect, what is the risk from people trying to penetrate the system, and how should we best try to protect against those risks? Until you ask those questions and answer those questions, you can never answer the question: How much is enough?

MR. GOUCHER: So it's difficult from our perspective as well as yours. I guess background-wise - and this is not meant as a personal affront - but from the standpoint of the audit, who did the IT review and, if you don't mind me asking, what was the expertise of the individuals doing it?

MR. HORGAN: The audit was led by the leader of our IT audit team, and he retired just recently. He had been with the office for, at that point, 34 years, most of it as an IT auditor. His qualification is that he is a Certified Information System Auditor, which is an international certification standard for IT auditing. He was assisted by two other information technology auditors in our office and they both have the same certification as he did.

MR. GOUCHER: If you look at - and, again, I'm going to try to look at it a little broader - Nova Scotia, can you tell me, within the Canadian Provinces, are we really, from the standpoint of internal audit with regard to IT, are we that much different or are all provinces facing the same challenges that you see here in this province? In other words, I'm trying to look at Nova Scotia and compare it to other places. I know we all face the same challenges from intrusion but are we, as a province and from the audit review, are we that much different than other provinces - or do you have that information?

MR. HORGAN: No, I don't have that information; that wasn't part of our audit process, as our audit process does not make comparisons to other jurisdictions. It's a very, very difficult thing to do because systems, whether they're information technology systems or programs or regulatory regimes, the environment is so different from jurisdiction to jurisdiction that making comparisons is quite difficult.

MR. GOUCHER: But generally speaking, when we talk about many of the systems, they're common systems that are used throughout the country. I have to sit here and ask the question why there wouldn't be some comparators, because as provinces we try to make comparisons between provinces to see how we're doing and rate ourselves. I find that - and I'm sitting here and this is not meant to be a negative statement - it would be nice to be able to try to compare ourselves with other provinces to see where we are, not that we still shouldn't be making every effort to plug these holes to ensure that personal information from the people of this province and from taxpayers and within government is not protected. I just sometimes find that that's maybe a little difficult, as far as from a political perspective, to compare.

MR. HORGAN: Just to clarify, if you don't mind, government does have those comparisons, they just were not part of the audit process.

MR. GOUCHER: Madam Chair, I'm going to take the last few minutes that I have and share them with my colleague.

MADAM CHAIR: Certainly.

The honourable member for Hants West, and you have until 10:03 a.m.

MR. CHUCK PORTER: Thank you, Madam Chair. I have a few questions in different areas, but I want to go back a little bit to the vehicle stuff - and I'll be fairly direct as I know my time is short. Are the commercial vehicles making our highways unsafe, would you say that?

MR. LAPOINTE: Pardon?

MR. PORTER: Are commercial vehicles making our highways unsafe?

MR. LAPOINTE: I think that's not a question anyone can really answer. Every vehicle has a safety risk - your vehicles and the trucks and so on. What we were simply looking at was the degree of risk and the level of safety that the province attempts to achieve in its programs. So all we were saying here in this report was that we thought the government might need to take some actions in the programs to make them more effective in reaching a level of safety on the roads that it wanted to achieve. So I guess - I'm sorry, that's a pretty roundabout answer to your question.

MR. PORTER: Thank you for that. You recommended in the audit committee that an audit committee should include more independent members.

MR. LAPOINTE: Yes.

MR. PORTER: Why is that?

MR. LAPOINTE: Well, we have found that a lot of committees that bring in people from outside the organization - this is more of a private sector best practice that they found; it's easier in boards of directors - they found that it brings in an expertise and it brings in a different point of view that the members of the committee find very helpful. I know that in government the tendency for audit committees is for them to be deputy ministers, and that is the currently evolving practice, but in jurisdictions, in other countries or in Canada where they have started to bring in independent members - I know the federal government is doing this - the response from the existing members at the deputy level is positive as a rule. They actually find that they benefit from having an outside view and also some expertise specifically on the audit function. So it's an effectiveness issue.

MR. PORTER: Who would that be comprised of, Mr. Lapointe, do you think, when you're talking about this outside view and expertise? So, you know, are you talking about the Truckers Association, for example, or who are we talking about here?

MR. LAPOINTE: The members who are appointed to audit committees as independent outsiders tend to be people with some audit or financial expertise and some

government background. I have heard of cases of ex-deputy ministers, retired deputy ministers, who possibly had been Deputy Minister of Finance or something of that kind, being brought in - or retired partners of chartered accounting firms. It's very difficult to tap the right kind of person to do this kind of work, but you bring in people with a very high level of expertise and experience in that kind of committee.

MR. PORTER: In auditing that kind of committee - you know, I'm thinking about finances . . .

MR. LAPOINTE: Or in government, specifically, and the idea is to have people whose expertise and knowledge you trust who can just bring in a view that you can respect and get some benefit from.

MR. PORTER: And I guess that's what I was getting at, too. I was kind of confused there because you're talking about from the financial people, obviously, auditors versus somebody who is actually out there in the field doing the job. Who knows what they're doing? You know, they either own the companies or they've been on the road for 30 years driving a truck - just as an example of that one piece of the audit that you did. You know, are we right out there, or recommending that we take these experts - those are the experts, the people who are working at it every day who know what's right and know what's wrong and know what's safe, right?

[10:00 a.m.]

That's what I'm looking at. Is that what you're suggesting? But I don't think it is - I think what you're suggesting is the more, again, maybe too high a level, having a grand overview, you know, globally, of everything versus the hands-on piece, right down to the actual fact that you're auditing.

MR. LAPOINTE: Yes. What you have to look for in someone to serve on an audit committee - this is someone who's coming in from outside to do public service, whether paid or not, but they're coming into public service - is someone who is able to do bring a fairly wide breadth of approach. The government audit committee, for instance, reviews results of all the reports of the internal audit group who, like us, will do audits of all kinds all over the government in different specified areas, and so they might do trucking today and IT tomorrow, the same as us. So now, when you're sitting on a committee reviewing all of the - you can't be too narrowly focused in your knowledge. If you're simply, say, a medical expert, well you might be able to look at medical audit, but will that really help you in a social service program audit? You look for the kind of person who has some experience in doing that kind of thing.

MR. PORTER: What I hear, it's great and we certainly appreciate - as all of us and members regardless of what caucus we come from - the work that you and all your folks do,

so don't take this statement to be offensive in any way, or in any way disrespectful, but the average person on the street - and let's just say he's a truck driver - says, oh, gee, the province just did an audit and the AG says commercial drivers aren't doing that great a job out there on the highway. It's all in the perception of how they're taking it and they're asking who is determining that and what expertise does he have or his committee have. That's why I ask the question: Who do you think - as a rule, is it the hands-on kind of folks out there in the departments, not just departments but the people doing the jobs - how deep does your audit go?

I know you're saying maybe you can't go that deep because of time, money, et cetera, but if we're going to make bold statements about certain things, I'm just saying I'd really like to be able to come back, when the buddy who is the truck driver asks me the question, and say, well you know what? Mr. Lapointe and his team consulted and did this, this, and this and this, and all these steps, and the people who actually do the work commented and reported the following. That's why I ask that question. I don't know if you want to comment on that or not. I know my time is just about up here.

MR. LAPOINTE: Well the issue of bringing in outside, specialized expertise in an audit is actually a quite valuable one and it has been done and can be done - not in all audits and not always necessary, but it can add. It is a question, however, to some extent, of resourcing. If you want to do an audit of a specific program like trucking and you say, well we want to bring in an advisor to work with us, you do have to go and find an individual - it takes more time - and bring the person in, it's likely that you have to bring them in as a paid advisor, so there's cost involved. But, yes, it can in fact be beneficial.

MR. PORTER: The reason I say that is because you saw the headline in the paper the next day about trucks being unsafe and the truckers are sitting back going, what? There is that whole perception. Sorry, I know I'm over, thank you.

MADAM CHAIR: Order, the time has expired for the PC caucus. The final round of questions will be 15 minutes per caucus.

The honourable member for Sackville-Cobequid, and you have until 10:18 a.m.

MR. DAVID WILSON (Sackville-Cobequid): Thank you, Madam Chair, and again I'd like to echo the comments of my colleague in thanking you for the work you do, not only to provide information on behalf of this committee, but I believe all Nova Scotians can look upon the work you do to ask those questions, especially around government programs and the delivery of government programs to ensure that they have the controls in place, the safety mechanisms in place and that they're following the practices that should be in place when delivering government services, especially in the environment we're in now. The public are going to make a choice, maybe in a few weeks or a month, and I think part of what you do

will play a role in that. People will look at how the government is doing and, ultimately, the decision on any election day is: Is the government doing enough for that individual?

So with that, I think the number-one concern with - and I'll ask some questions around Chapter 4, around truck safety, with my time I have today - the number-one concern definitely for all people in this committee and all Nova Scotians is safety, public safety. When you did the audit on truck safety in the province it begs the question: Is the government doing everything they can to ensure that the trucks on our roads are safe and are following the rules and controls that we have in place for those truckers and the carriers that provide the service?

With your audit in truck safety, your first comments in it really, I think, don't support the idea that this is the number-one concern for government. I'd like to quote your first line here:"The Department of Transportation and Infrastructure Renewal safety, inspection and enforcement programs are not adequate to effectively mitigate the risk of a truck being involved in an accident."

Further down, in the second paragraph, you also noted, and I quote: "Due to the potential seriousness of accidents involving trucks it is important to the safety of Nova Scotia road users that programs be effective in reducing the likelihood of an accident to an acceptable level."

So with those comments that you made in that audit, would you say - with the system when you audited it - public safety is the number-one concern, or are you concerned that the controls aren't in place to ensure that that's the number-one priority for government?

MR. LAPOINTE: I would say that clearly, by the very existence of these programs and regulations dealing with safety on the roads, that there is a priority of public safety on the road. There is an intent in these programs to improve public safety and minimize risk. What we found was that the implementation was faulty and needed improvement. It was the effectiveness of the programs put in place to deal with that safety that required improvement, from our point of view. So the commitment that was lacking is in the implementation.

MR. DAVID WILSON (Sackville-Cobequid): So with the recommendations you made here, if nothing happened, if government didn't respond to anything that you found within this audit, would you say Nova Scotians would be more at risk on the highways because the rules, the controls, those safety mechanisms need improvement and they haven't changed? So, if no changes happen, would you think Nova Scotians would be at risk with their safety, travelling on the highways?

MR. LAPOINTE: Well, it depends on how you put that. I was asked that before and had the comment that we're always at risk on the roads. The risk is always there, and cannot be taken away, every time we get in a vehicle. The difficulty with this is that you can do

things to reduce that risk and to improve the safety. The recommendations we made are designed to make the programs more effective and to reduce that risk. So clearly they need to be implemented in order to achieve the level of safety that the program itself wants to achieve. So it's a question of degree of risk and minimizing it.

MR. DAVID WILSON (Sackville-Cobequid): So with your recommendations - we know the past history over the last number of years, the recommendations that have come from your office, the numbers, or the percentage that the government has implemented, are low - are you confident, are you reassured that with this audit, especially in this area, that the government, their response, are you positively looking towards them implementing changes so that the risks that you have identified in your audit will be addressed?

MR. LAPOINTE: Clearly I have no past history on which to have any confidence that improvements will be made, but I do have some confidence that they will be for the simple reason that I have very strong commitments from the existing administration, in writing and verbally, that in this area in particular it is a priority and they will, in fact, be implemented. So I am hoping that these commitments mean that there will be a very high implementation rate when we go back in two years.

MR. DAVID WILSON (Sackville-Cobequid): So what I'd like to do now is maybe just go into a bit of detail into some of the recommendations, some of the findings. One of the things you talked about was the Carrier Activity Profile System under Service Nova Scotia and Municipal Relations. They oversee the Carrier Activity Profile System and it's legislated, if I'm correct, that the province is supposed to identify the riskiest 5 per cent of carriers. Is that goal being met currently in the province?

MR. LAPOINTE: No, it's not right now.

MR. DAVID WILSON (Sackville-Cobequid): I know it's in here; I know I read it - but what percentage are we at right now?

MR. LAPOINTE: Currently the system we found was identifying 0.9 per cent - slightly under 1 per cent - rather than 5 per cent to follow up on and be audited by them.

MR. DAVID WILSON (Sackville-Cobequid): And I think that indicates where government needs to improve, because I mean, as everybody knows, the majority of the truckers and those carriers out there are doing their safety checks or providing safe courses for their drivers and abiding by all the laws, but there is a small percentage that aren't, and it concerns me that if legislation states we need to identify - the risk is 5 per cent and we're at 0.9 per cent, I mean, government needs to act on that. One of the statements you made in here is that you identified several times, or noted instances of delays of more than one year in entering accident data - is there a standard national timeline that states when that

information should be entered so that government can recognize they have the proper information when determining who the riskiest 5 per cent of carriers in the province may be?

MR. LAPOINTE: I would like to ask Mr. Spicer to speak to that.

MADAM CHAIR: Mr. Spicer.

MR. TERRY SPICER: There is no specific target that has been established that we're aware of, although management has indicated that they're aware that it takes too long to enter this information and they've indicated that they're going to take a serious look at how they can improve that.

MR. DAVID WILSON (Sackville-Cobequid): So with your statement, though, you're saying a year seems long. So it's the department themselves that are saying, you know, a year is probably too long?

MR. SPICER: That is true, yes.

MR. DAVID WILSON (Sackville-Cobequid): And I mean, with that information, really what you come away with is how accurate is the information when we're only looking at the 0.9 per cent identified currently as the riskiest carriers - really, how accurate is that information if it's taking a year to enter it?

One of the other things you mention in here, and you covered, was around weight scales, and my colleague asked a few questions around that but I would like to continue with that. He had mentioned driving past the Enfield weigh scales and noticing a long line of trucks trying to go through that scale. One of the things you identified here is the goal of 100 hours that the government wishes to have the scales open per week, and I think you identified, with the two months you looked at, that they're hitting a target of about 78 per cent.

The other thing you mentioned about the weight scales is the risk of the public through excessive damage to roadways, and greater chances that trucks will be involved in an accident because of these weight scales not being open - with that target of 100 hours. Especially in rural Nova Scotia, we know that roads are in serious disrepair, so how do you think it would impact that - have you identified what the goals are with opening the weight scales over that 100 per cent, what kind of impact we would see? Would it reduce the number of trucks that are violating that weight restriction maybe? Do you feel that they would be able to pick up more of those vehicles and ensure that those trucks are taken off the road so that the damage is not as severe?

MR. SPICER: Based on our conversations with management, again, they acknowledge that, and I think this is sort of not Nova Scotia-specific, but throughout the

country - that the more weigh scales are opened, the better the chances that they're going to catch carriers that may be operating unsafe vehicles or vehicles that are overweight. So it's a reasonable conclusion that the more you open the weigh scales, the more you're going to catch.

[10:15 a.m.]

MR. DAVID WILSON (Sackville-Cobequid): One of the things you also mentioned is the personnel. Often you have indicated that you find that there's only one individual at the weigh scale. They're trying to improve that. What kind of efficiency would we see if two safety officers were at the scale? Would it improve identifying, or I guess, identifying those carriers that might be trying to break the rules, might be overweight - would it be more efficient to have two safety officers at the scales when they're open?

MR. SPICER: We can't comment to the efficiency of putting trucks through the weigh scales, but if there are two inspectors at the weigh scales, one could be weighing the trucks going through, which allows the other one to actually do more visual inspections of the vehicles, including the loads that they may be carrying, which is one of the inspections they do to make sure they're secured safely.

The fact is that the more staff you have on there available to do those types of inspections, the greater the chance you are going to be able to identify those that are operating unsafely.

MR. DAVID WILSON (Sackville-Cobequid): The government said they have a target of having hours of operation at about 100 hours per week. Do they have a target of how many times - how many hours or what percentage of the time they have staff at those scales would be for having two staff? You noted that 19 per cent of the time there is more than one officer on average for the two months you looked at. Is there a percentage the government is trying to achieve or is there a standard that might be most appropriate or a target the government should be trying to get?

MR. SPICER: No specific standard was provided to us, or that we're aware of as part of the audit.

MR. DAVID WILSON (Sackville-Cobequid): So on the national side we know rules have been changed, more updated standards. Is the government in need of updating current legislation to kind of come in line with more of what we see nationally with standards on trucking and road safety?

MR. SPICER: There are two main areas where our legislation here in Nova Scotia is not up to date with the current national safety codes - one of them is around hours of

service and the other is around trip inspection regulation. In those two areas, our legislation is not currently up to date with the National Safety Code.

MR. DAVID WILSON (Sackville-Cobequid): Has the government indicated when they might see an update to that legislation?

MR. SPICER: There's no specific date that has been indicated, although they have indicated that they realize they need to do that and that they are going to be working on that.

MADAM CHAIR: Order. Time has expired for the NDP caucus.

The honourable member for Clare. You have until 10:33 a.m.

MR. WAYNE GAUDET: Thank you, Madam Chair. This morning I want to focus a little bit about truck safety that has been discussed here quite heavily this morning, so I just want to continue with this line of questioning.

In your recent report you revealed there was an inadequate inspection process for large commercial trucks in our province. I want to begin by focusing on scale houses. You pointed out in your report that scale houses were closed for a total of 61 days during your test period. You've also indicated in your report that management should know when trucks are most likely to travel on roadways and other travel patterns. Yet you also made an interesting observation - that while this data was available, the division had not attempted to use it to determine truck traffic patterns and whether adjustments to scale houses' operating hours were necessary.

Let me begin by asking - were you able to find out why the scale houses were closed on those specific days? Was it planned by government, by the department - were you able to find out why? Why were those scale houses closed for 61 days?

MR. LAPOINTE: I will ask Mr. Spicer to speak to that.

MR. SPICER: Based on our discussions, again with management, there are a couple of reasons why they would be closed. One of them might be illness - if the particular individual was sick that day. Another issue that was mentioned was simply the number of staff to staff them at the level they had established. Those are probably the two main reasons that were given to us as to why they would be closed those hours.

MR. GAUDET: If we do recognize there are limited resources available, and at the same time we're looking at truck safety on our roads, I'm curious, in your discussions, were you able to find out from government officials to acknowledge that basically that was one of the reasons and they would be, more or less, looking at improving upon increasing those resources?

MR. SPICER: Management has indicated they are aware that they simply can't staff at that level with the people they have. As far as what they plan to do about that, we didn't really discuss how they were going to do that.

MR. GAUDET: Okay. They acknowledged, because of limited resources, of course, they can't have those scale houses open all the time.

All right. You've also pointed out that scale houses weren't open long enough, they were understaffed and someone made a comment earlier, and I made a note on that - when you were in to do your audit in these scale houses, you had time to observe what these individuals do in these scale houses, again, with limited resources. My question would be simply, what do they do in these scale houses? Many people here have gone by the scale house in Enfield near the airport, I've seen long lineups of trucks, we all understand time is money, especially in the trucking business when you're tied down in a lineup, that truck's not moving. We know they're understaffed, there's usually only one individual working in these scale houses so I'm curious - what do they do?

MR. SPICER: I can comment sort of generally about what they do. We didn't do a time study of how they spend their time on each particular shift, but their primary role as the trucks come in is to weigh them and make sure they meet appropriate regulations for weight. They also, as time permits, they would actually go out and do inspections of the vehicles, at various levels. They could do what we call more of a level 1 inspection which would actually be looking for all of the safety violations underneath the truck and then there are different levels where they may only look at a driver's licence and those types of things.

So, generally, that's their primary role.

MR. GAUDET: I'm just trying to think - here we have a whole lineup of trucks waiting to go through the scales. There's only one individual working in the scale house; he needs to find out if they have the appropriate weight, if they're overweight. At the same time, we would certainly love to have them go outside and just go around the truck and do a very quick inspection. I'm trying to get a better understanding if these individuals, with the amount of time that's available to them - and it doesn't matter where the scale house is, Amherst or Enfield, there are trucks coming down the highway all the time - with limited time available for these inspectors who are working in those scale houses, do we know if most of their time is spent inside the scale house weighing the trucks or do they spend half of their time inside and outside? Do we have, more or less, a sense of knowing approximately how their day is spent while they're on the job?

MR. SPICER: We wouldn't have that level of detailed information. As our report indicates, we are concerned that the less amount of time that weigh scales are staffed by two individuals - the ability to go outside and do those checks is reduced.

MR. GAUDET: Do we have a sense of how many of the scale houses we have around the province are, let's say, managed by two individuals compared to one individual at a time?

MADAM CHAIR: Mr. Spicer.

MR. SPICER: Thank you. On Page 64 of our report we did an analysis based on February and September 2008 where we looked at the specific scale houses and did our calculations of the percentages for those particular months. For the two months' averages, as the table indicates, Kelly Lake was on average of 25 per cent; Enfield, 29 per cent; Canso Causeway, 12; Amherst inbound, 15; Amherst outbound, 12, with an overall average of 19 per cent.

MR. GAUDET: If we expect one individual to basically raise concerns, report infractions - we're practically making these jobs very difficult to perform with only one individual on duty. At the same time we can certainly understand that when there's at least two individuals on duty at the same time a much more efficient job will be carried out. There's going to be a lot more dialogue with the truckers as they go through these scale houses. We basically have a better chance to improve truck safety on our roads when we have two individuals working, yet there's only one. The numbers are there; I'm sure that the department is well aware of that.

I'm just curious about whether you've had a chance to speak with the department officials on your audits, and if so, did the government officials indicate to you whether they have some expectations upon improving the resources that are available at the scale houses? I guess my first question is, did you get a chance to speak to government officials about your audit?

MR. SPICER: Yes, we would have had quite a lot of conversations throughout the audit with various levels of the departments and we would have, at the end of the audit, discussed our findings and recommendations with the management there, and I'm encouraged by those conversations. They agreed with our recommendations and agreed with, I believe overall, our findings there and they did indicate that they will be looking at how they can address them.

MR. GAUDET: Thank you. I'm just noticing my time is practically run out. I'm going to run quickly here to Page 64, Section 4.16: "the effectiveness of scale houses as a safety control to detect and deter truck safety violations was compromised because they were closed at predictable times." You know, the fact that we've raised a major concern about the effectiveness of our scale houses as a safety control, if government wants to improve upon the effectiveness of our scale houses as a safety control, my obvious question to you would be, what needs to be done? If we're going to improve upon the effectiveness of our scale houses, what needs to be done?

[10:30 a.m.]

MADAM CHAIR: Mr. Spicer.

MR. SPICER: Thank you. Well, a couple of things, as our findings indicated in the report, looking at staffing weigh scale houses with two people more often would be one of the areas I think that they should be looking at. Looking at when scale houses should be open. The first recommendation in the report about establishing a risk management process where they would look at what are the risks and focusing on - one of the areas would be weigh scales - when should they be open, when are the trucks travelling, you know, when have we been finding most of our violations during certain time periods - and incorporating all that into looking at, you know, when are the optimum times to have the weigh scales open?

MR. GAUDET: Good. One final question before I move on to another topic. Did your office get a chance to compare the effectiveness of our scale houses with our neighbouring provinces?

MR. SPICER: No.

MR. GAUDET: No, all right. I want to move quickly to - in your report you stated that 32 per cent of trucks that were tested for brakes had a failing grade. Do we know - when we look at that 32 per cent, you know, were they the same company, the same drivers identified? It was stated here earlier that a lot of the carriers, a lot of the individual truckers certainly take safety as a very critical issue with them, but when I read 32 per cent certainly had a failing grade, the obvious question was, are we talking about 5 per cent of the industry? Are we just talking about the same company, the same drivers? Do we have a sense of these individuals if they were, you know - were they basically identified, or was one driver or one carrier identified more than once in your finding?

MR. SPICER: Unfortunately, I don' t have that level of detail here. We would have that in our files, as would Transportation and Infrastructure Renewal. That information is all in their CAPS where the data that we extracted from looked at that. The extraction was basically done to determine where the defects were. So that information would be there but I don't have that level of detail here.

MR. GAUDET: All right, I guess looking at that number, has your office been able to compare this finding with previous audits or statistics that were done in our province? Do we have something to compare, you know, if that is basically a trend that's continuing or if it was just a one-shot deal type thing?

MR. SPICER: That data is really unique to our audit. I don't think there is comparative data out there.

MADAM CHAIR: Order, please. The time has expired for the Liberal caucus. I recognize Mr. Bain for the PC caucus. You have 15 minutes until 10:49 a.m.

MR. KEITH BAIN: Thank you very much, Madam Chair. There's a lot of discussion this morning on the scale stations, scale houses, and everything else, but I want to bring this forward and I'm wondering if it's part of the statistics or the overall audit that's being done. Although we've been talking about scale houses, we have vehicle compliance officers who are on the road and doing roadside inspections. Are those numbers included in your audit findings?

MR. SPICER: Yes, they would be included in the details that we have.

MR. BAIN: So although we're talking scale houses, we're talking much broader than that?

MR. SPICER: We're talking inspections in general although the majority of them would be done at the scale houses, yes.

MR. BAIN: Okay, that's great. I just wasn't sure because I know that you often see the compliance officer sometimes having the truck stopped on the side of the road, but I just wondered if that was part of it. What kind of latitude do these compliance officers have? Do they have zero tolerance for everything or can they use their own discretion as to whether to issue a warning or a fine?

MADAM CHAIR: Mr. Spicer.

MR. BAIN: I'm sorry, I'm looking at you directly, Mr. Spicer, but I realize I should be going through Mr. Lapointe.

MR. SPICER: Whether they issue a warning, whether they write a ticket, it is really their discretion and one of the recommendations in the report is that we recommended that there be some guidelines put around, you know, when enforcement - at what level of enforcement should happen.

MR. BAIN: Do they receive an annual performance appraisal that you're aware of?

MR. SPICER: I'm not sure. We didn't look at whether performance appraisals were done as part of the audit.

MR. BAIN: And we talk about the risk is 5 per cent to be identified. How is that target communicated to these compliance officers to be aware of anything in that respect?

MR. SPICER: That's actually the program through Service Nova Scotia and Municipal Relations; they're responsible to run that side of the program. So the officers who are out there, they would do an inspection and based on their results - or issue a ticket. That information then gets fed into what we call this CAPS system and then from that CAPS system the information is drawn to feed into the audit program which is what Service Nova Scotia and Municipal Relations is responsible for. So they're really responsible for that 5 per cent target.

MR. BAIN: I would like to know, and you do spell it out in some degree in your report, the concerns that you have about the current audit report and what improvements you feel can be made to them? Again I'm looking directly at you, Mr. Spicer, sorry.

MADAM CHAIR: Mr. Lapointe.

MR. LAPOINTE: Sorry, are you asking what improvements can be made in this program?

MR. BAIN: Yes, yes.

MR. LAPOINTE: Well, the recommendations that we made dealt with both the department and we felt that a lot of the improvements that had to be made in the transportation area had to do with the running of the weigh scales, you know, and the inspections and the way those kinds of things we've been discussing.

The other part of this, though, was the identification of that 5 per cent in Service Nova Scotia and Municipal Relations and the targeting or attempting to identify and monitor carriers as opposed to individual trucks. The difficulty there was to quite a large extent the information that's available that was faulty if it made too many flaws to allow them to identify well the people they wanted to find and target, in terms of carriers.

So we felt that a major system improvement in this would be to improve the information that people in the department have available to them and also it looks like the program itself - the system rather, the IT system - then sorts it out and identifies what should be 5 per cent and is giving us 0.9 per cent. There are some IT issues involved in that too that they're looking at but making sure that information is a little better and can be relied on more than it is now.

MR. BAIN: Thanks for that. I'm going to share the rest of my time, Madam Chair, with my colleague.

MADAM CHAIR: I recognize Mr. Goucher. You have until 10:49 a.m.

MR. GOUCHER: Thank you again for being here, I appreciate the candidacy of the answers. Just going back, I'm going to go back to the IT issue. I know sometimes our eyes glaze over when we talk about computers. I want to talk a little bit about the policy and standards and Paragraph 3.33 basically states: "We were encouraged to see that government has established and implemented the above noted policies, standards and guidelines. The Information Management Policy, which became effective on October 1, 2008, is perhaps the most important of the policies. It addresses the collection, use, and management of information by government . . ."

It goes on: "These policies, as a package, partially set the stage to define an effective management and control framework around IT operations, and IT security." But it goes on to say, "However, we observed certain issues . . ." Could you expand on that a little bit and tell me what some of those issues were?

MR. LAPOINTE: Yes, certainly and I'll ask Mr. Horgan to address that for you.

MADAM CHAIR: Mr. Horgan.

MR. HORGAN: There were a few issues, one pertaining to the wide area network threat risk assessment process guide - that's one of the standards that we list on, starting on Page 49. We noted that process guide has been in place since 1998 but has never been updated so the world of information technology, as you mentioned earlier, changes so quickly; standards and guidelines need to be regularly updated.

Some of the issues we referred to with regard to policies were whether these policies are being followed. We notice that there was no threat risk assessment performed on the wide area network in the last 10 years. It's a very important control function that examines systems and makes sure it's protected from threats from outside and inside.

Another very important policy for government is one called an Acceptable Use Policy. That is a policy that will tell everyone who uses government computers what they're allowed to use those computers for, make sure that they are in use just for appropriate purposes. That policy was started in 2007 and is still in draft format and hasn't been rolled out and communicated to these 10,000 users throughout government.

We also mentioned that policies require that security awareness training be provided to the people who use government systems. This would be training that would make sure that they do not fall victim to some of the security risks, you know, like those e-mails that we all receive that kind of ask us to hand over information that we should not be handing over and this security awareness training has not really been rolled out on a government-wide basis. I mean, those are a few; there is more.

MR. GOUCHER: I go back and it basically says, you said that the wide area network, there has been no threat risk assessment. But yet in your report it says you are aware of two threat risk assessments performed in the past year.

MR. HORGAN: Yes, those were of some smaller defined systems and we're always glad to see that kind of assessment being done. We're looking at the information technology security on a government-wide basis and primarily that means the wide area network, which is what links all of government together, so it's a much larger entity that needs this threat risk assessment.

MR. GOUCHER: I guess even with those two smaller assessments that were done, that would probably help in the overall formulation of providing the larger picture?

MR. HORGAN: Yes, that would be true.

MR. GOUCHER: I guess I'm looking right now at the hiring practice and I find it kind of interesting for IT employees that they would go through a different regime than the average person. I'm not disagreeing with it either, but would you mind just elaborating a little bit more on that? I found it kind of interesting when I read it.

MR. HORGAN: The reason that we suggest this is that information technology specialists, professionals, have access to so much information, so many programs and this access might allow them to do things that the average user of a computer would not be able to do. So if per chance someone with, say, a criminal background were to be employed and was inclined to continue such activities, well then they would have greater ability to actually do some of the stuff than your average computer user would.

[10:45 a.m.]

MR. GOUCHER: I do agree with that. Just one other quick question going back to the previous policy and standards - would you see the CIO as the lead person on that?

MR. HORGAN: Yes I would, that would be one way of showing strong leadership over information technology is to oversee all policy standards and guidelines.

MR. GOUCHER: I'm going to go somewhere that I'm questioning myself whether I should go, which is the use of mobile devices. We can talk about laptops, we can talk about wireless networks which exist and the vulnerability. We can talk about security problems issuing around these little things that we carry, which to me, are probably so vital in today's world, but in reality if they're not password protected, there is a lot of information there for access. Vulnerability of these portable devices to the systems, protection of personal information - you can go on and on - can I ask you to elaborate about a little bit on that? I know that's a wide open question. I have a little background in IT, probably not like yourself,

but I'm rather interested to know how - and I have read this and I know there are issues surrounding it - from your perspective, where should we be going with this from an audit perspective? Is that okay?

MR. HORGAN: Sure. Just a couple of considerations. First, I'd like to say it is good that government actually does have a policy that oversees these mobile computing devices. It's called their laptop policy, so it's somewhat focused in that regard, but inside the policy they mentioned other mobile devices, so it's good that there are some guidelines out there that indicate virus protection should be used and stuff like that.

Where we found it a bit lacking was in the area of requiring access control to these devices, which basically is passwords. There's virtually nothing said about requiring passwords on laptop computers, requiring passwords on BlackBerries, and nothing about only using USB drives , which so many of us use - those little things we push into the computer to hold some of our data - whether data should only be held in those devices if it's encrypted. That's a practice our office uses, that any data that goes into one of those drives is encrypted first. So we'd certainly like to see standards around those.

The other thing that concerned us a little bit is the whole fact that they refer to these as guidelines, and the general understanding of a guideline is that it's nice to do, perhaps there's a moral understanding to do it, but you're not required to do it - and we suggested that these should have the force of policy, the force of standard.

MR. GOUCHER: I would agree. The thing being, I guess - and I go back to a question that I brought forward before when we started talking about the black hole and how it just keeps going and it never ends as technology keeps moving - when we get to a point, where does the whole issue of security get to a point where it starts infringing upon our ability to be able to perform the job?

We talk about our USB drives and encryption - encryption, for the average person, is not an easy thing. For you and I, maybe, we could do it quite easily, but for the average person, you start talking about encryption, especially on our USB devices, you know we carry 8 gigabyte, 16 gigabyte, which could probably put every piece of material in that library on one little device, but I guess the thing being, where does the issue of security and the issue of the government being able to form its performance duties in an acceptable manner and in a timely manner - I don't know how else to put it, but there is that line and I was going to ask the question, but I guess I'm out of time. I do appreciate your answers and thank you for you very much.

MADAM CHAIR: The time for questions has concluded. I would invite the Auditor General to make a closing comment, if you wish.

MR. LAPOINTE: Thank you. I want to thank the committee for this opportunity to discuss this report with you. As always, I appreciate the committee's commitment to oversight of public spending and your continuing support for the work of my office. Thank you.

MADAM CHAIR: Thank you very much for being here today.

The clerks are distributing some correspondence that we've received with respect to Labour and Workforce Development from our April 15^th meeting, as well as information about the annual conference of Public Accounts Committees.

At this stage, if there's no other business, we stand adjourned.

[ The committee adjourned at 10:51 a.m.]