Thank You!

You are attempting to access subscriber-restricted content.

Are You Ready to Experience Everything Internal Auditor (Ia) Has to Offer?

​Navigating Public-Private Partnerships

Private industry agility and public sector oversight can be a powerful combination — but there are numerous risks for auditors to consider.

Comments Views

​Like private-sector organizations, government-run services are increasingly technology-based, complex, and driven by innovation. However, private-sector organizations often have the advantage of being more nimble and better able to respond to market demand. Meanwhile, government agencies are often tasked with building systems and launching programs at the behest of legislators, sometimes with little warning, tight timelines, and limited resources. 

Still, while people like to joke about government bureaucracy — recall the slow-paced Department of Mammal Vehicles in the Disney animated film Zootopia — few citizens would trust private industry to carry out government-run services like monitoring the food supply, setting safety standards, regulating pharmaceuticals, or handling national defense. 

Enter the public-private partnership, or P3. This approach to a large-scale government mandate can offer the best of both worlds — the agility of private industry coupled with the oversight and accountability of a public enterprise.

Working with private vendors is not a new idea, but P3 initiatives go beyond a traditional procurement relationship in that they are usually long-term, large capital projects. In P3s, private-sector vendors may be responsible not only for building some type of infrastructure, but for managing and maintaining the asset over decades. P3s may also involve revenue-sharing and private financing. 

"They're a different kind of contractual arrangement between government and the private sector, and they're designed to shift the risk away from government," explains Carol Bellringer, president and CEO of the Canadian Audit and Accountability Foundation, based in Ottawa, Ontario. "The life cycle of the arrangement can go for a long, long time, so the auditor has to figure out when to jump in and take a look at it."

Pros and Cons of a Hybrid Model

Sheri Ostridge, chief audit executive and chief risk officer for Employment and Social Development Canada (ESDC), says P3s offer many benefits to public service projects. Ostridge, who resides in Charlottetown, Prince Edward Island, is helping to oversee the modernization of the Canada Pension Plan and Old Age Security programs.

"We're taking old systems and we're transforming them onto different platforms, migrating massive data holdings, so it's a major, major transformation," Ostridge explains. To carry out the initiative, the ESDC is working with a variety of private sector vendors, including software and cloud developers, and business architecture, research, and management consulting firms. 

"There are a lot of advantages," Ostridge says. "Your capacity's enhanced, your knowledge level, the actual skill sets, the technical competencies are all amazing. Especially in the technology space, there's lots of value in bringing in expertise that can just bolster a project."

Even though P3s are meant to shift risk away from government, there are still risks involved, and the role of public sector auditors can take on even more importance in P3 arrangements. For instance, because responsibilities for risks are built into contracts up front, having an audit team at the table during the planning and procurement phases can be valuable for ensuring risks are identified. Politicians' desire for a "quick fix" can also create risk, Bellringer explains.

"Bringing that objective voice to the table coming from audit is a really valuable one to balance out what [can be] strong political pressure, and at the same time saying, 'Yeah, there are suppliers who can do this, but let's be realistic about what they can deliver,'" Bellringer says. "There are places where P3s can be very, very useful as a solution. But they're not an automatic do-it-all-the-time, nor are they an automatic never-do-it, so the assessment piece is really critical."

Ostridge says one of the biggest risks she sees with P3s involves the interdependencies between the various vendors. "If you have all of these different partners doing different things for a big initiative, the risk level goes up related to how they connect horizontally," she explains. "So if everyone's doing their piece of the work, that's great, but from a schedule perspective, as one example, what are the risks and, most importantly, the mitigations to reduce risk and maximize success?" 

Besides project management challenges, there are also cost concerns and "perceived or real conflicts of interest," Ostridge says. And for something like the ESDC project where the data of Canadian citizens is involved, "there are issues of privacy of information — and do you have the proper information management pieces in place to deal with that? We have partners in procurement and legal to ensure fairness, transparency, and privacy laws are respected and upheld."

Ostridge points out that even with private industry shouldering more of the risk, the public will ultimately hold the government accountable more so than the private-sector contractors if a project has problems. "It's still the organization at the end of the day, so if something goes wrong, the accountability is there," she says.

A P3 Cautionary Tale

In the case of a P3 program involving the U.S. Department of Defense (DOD), military housing, and private companies, alleged negligence on the part of some private companies has resulted in litigation, congressional hearings, legislative actions, and bad press for the DOD and the companies. The program, the Military Housing Privatization Initiative (MHPI), involves more than 200,000 military housing units with approximately 80 projects, managed by 14 private companies. Military departments formerly owned and managed military family housing, but the properties were generally in poor condition and required replacement or major renovation. Therefore, Congress passed legislation in 1996 creating the MHPI program. But according to a 2019 New York Times article, the 20-year-old program recently has been the subject of "widespread complaints about neglected or slipshod repairs, unsafe conditions, and especially, mold problems." Some military families alleged that the issues caused them to get sick, and several families filed lawsuits. 

"There has been one case of fraudulent maintenance records in the news," says Ted Paulson, an Indianapolis-based audit project manager for the DOD Office of Inspector General (OIG), who leads a team in auditing the MHPI. "In that case, two employees pled guilty to falsifying maintenance records to meet or exceed maintenance goals. By meeting or exceeding those goals, the private company received $3.5 million in unearned financial incentives."

Paulson says military members occupying the housing who sought the maintenance records were originally rebuffed by the companies, saying they weren't required provide those details to tenants. As a result, in 2020 Congress required the companies to provide seven-year maintenance histories as part of a tenant bill of rights. "In addition, Congress took action to improve the DOD's oversight of the private companies, including enhanced inspections of the houses," Paulson says. "Plus, Congress required the DOD OIG to evaluate the DOD's efforts to improve oversight of the private companies for three consecutive years."

The Public Sector Advisor

According to Bellringer, it is important to get auditors plugged in as early as possible in the procurement process. "Auditors can be watching for things to be built into the contract — from full access to supplier records to a role for the auditor," she says. Ideally, auditors should continue to be involved throughout the life of the P3 project, "to make sure that things are proceeding as expected with areas like inspections, so that things can be fixed before they go wrong — and at the end to take a long look at what worked and what needs to be improved for future contracts."

One way Ostridge's team tries to get ahead of long-term problems is by engaging in more continuous audit practices. "We're developing new methodologies — health checks, deep dives, checkpoints — which are names that are being created and probably exist in other professions, but we're looking at situations in real time," she explains. "This approach is aligned to advisory work rather than compliance. The audit team joins all the key meetings and has open access to all data." 

Ostridge says the Canadian government is using auditors in a more proactive way to mitigate risk. "Now in government, there are a few other large-scale projects that have a lot of implications for Canadians," Ostridge says. "They're being managed differently, and audit is being pulled in for a really foundational role. At least where I sit, it's a function that's supported and respected, and I think growing in acceptance of the role."

Carol Bellringer, Sheri Ostridge, and Ted Paulson will be speakers at the upcoming IIA Virtual Symposium: Public Sector — Public-Private Partnerships, Aug. 24 & 26. 

Christine Janesko
Internal Auditor is pleased to provide you an opportunity to share your thoughts about the articles posted on this site. Some comments may be reprinted elsewhere, online or offline. We encourage lively, open discussion and only ask that you refrain from personal comments and remarks that are off topic. Internal Auditor reserves the right to remove comments.

About the Author



Christine JaneskoChristine JaneskoChristine Janesko is a content developer and writer, Standards and Professional Knowledge, at The IIA.<br>


Comment on this article

comments powered by Disqus
  • AuditBoard-November-2021-Premium-1
  • OnRisk-2022-November-2021-Premium-2
  • 2021-All-Star-Conference-November-2021-Premium-3



Stopwatch Auditing Auditing
Thanks, We Already Know That, We Already Know That
Hidden Goals Goals
Building a Better Auditor: Which Way Should I Go? a Better Auditor: Which Way Should I Go?