The National Research Council of Canada (NRC) carries out independent audits of its research centres, branches, programs and initiatives, in accordance with the Treasury Board Policy on Internal Audit.
Here is a list of the most current reports on the results of these audits.
2026-2027
2025–2026
2024–2025
2023–2024
2022–2023
- Audit of acquisition card management - February 2023
- Audit of Cyber incident response
- Audit of Digital authorization
2021–2022
2020–2021
2019–2020
- Audit of Intellectual Property (IP)-related royalties and awards
- Audit of Research and licensing agreement management
- Audit of conflict of interest management
- Audit of Acquisition card management
- Audit of procurement and contracting
- Audit of IT Security
If you want a complete copy of audit reports listed as summaries, please contact the NRC Internal Audit Reports.
Audit performance results
Key compliance attributes are published as required under sections A.2.2.3 and A.2.2.3.1 of the Directive on Internal Audit.
These results, or key attributes demonstrate that the main fundamental elements necessary for oversight are in place, are performing as required under the Policy on Internal Audit and the Directive on Internal Audit and are achieving results.
Why publish key compliance attributes of internal audit?
Key compliance attributes
| Performance indicators | Key compliance attributes | August 31, 2025 | Definitions |
|---|---|---|---|
| Do internal auditors in departments have the training required to do the job effectively? Are multidisciplinary teams in place to address diverse risks? | % of staff with an internal audit or accounting designation (Certified Internal Auditor (CIA), Chartered Professional Accountant (CPA)) | 56% | |
| % of staff with an internal audit or accounting designation in progress (Certified Internal Auditor (CIA), Chartered Professional Accountant (CPA)) | 33% | In progress: The staff member (an indeterminate employee) has formally registered with and has been accepted by the certifying body to complete the requirements of the professional designation in a prescribed time frame and has registered for at least one component of the certification process. | |
| % of staff holding other designations (CGAP, CISA, etc.) | 22% | ||
| Is internal audit work performed in conformance with the international standards for the profession of internal audit as required by Treasury Board policy? | Date of last comprehensive briefing to the Departmental Audit Committee on the internal processes, tools, and information considered necessary to evaluate conformance with the IIA Code of Ethics and the Standards and the results of the quality assurance and improvement program (QAIP) | June 2025 | Last comprehensive briefing:
External assessments (practice inspections) must be conducted at least once every five years by a qualified, independent assessor or assessment team from outside the organization. |
| Date of last external assessment | June 2023 | ||
| Is internal audit credible and adding value in support of the mandate and strategic objectives of the organization? | Average overall usefulness rating from senior management (ADM-level or equivalent) of areas audited. | No recent results | Average "overall usefulness" rating: Post-audit surveys to senior management of the area audited should include a question on the overall usefulness of the audit. |
Internal audit status
| Internal audit title | Audit status | Report approved date | Report published date | Original planned Management Action Plan completion date | Management Action Plan Implementation status (%) |
|---|---|---|---|---|---|
| Audit of real property management | Published – Management Action Plan fully implemented | 2021/03/26 | 2021/06/30 | 2024/03/31 | 100% |
| Audit of cyber incident response | Approved – Not published | 2022/12/22 | N/A | 2023/12/31 | 100% |
| Review of the hazard prevention program | Approved – Not published | 2023/01/30 | N/A | 2024/03/31 | 100% |
| Audit of professional services contracting | Published – Management Action Plan fully implemented | 2024/08/30 | 2024/09/05 | N/A | 100% |
| Audit of recruitment and staffing | Published – Management Action Plan not fully implemented | 2025/01/27 | 2025/06/30 | N/A | N/A |
| Audit of IT governance | Postponed | N/A | N/A | N/A | N/A |
| Audit of integrated risk management | Published – Management Action Plan not fully implemented | 2025/05/25 | 2025/09/03 | N/A | N/A |
| Audit of business continuity management | Approved – Not published | 2026/04/29 | N/A | 2026/10/30 | N/A |