OTTAWA — The development of the federal government’s ArriveCan app was riddled with sloppiness and impropriety, auditor general Karen Hogan reported Monday, delivering detailed findings on a mess that’s already the subject of a scathing procurement report, police and disciplinary investigations and a suspended parliamentary inquiry. 

Here’s what you need to know about a piece of software that was supposed to make it easier to enter Canada during the worst of the COVID-19 pandemic:

Final cost uncertain: The auditor general estimates it at $59.5 million, more than the government’s figure of $54 million. But because of “poor documentation and weak controls” at the Canada Border Services Agency (CBSA), the auditors aren’t certain.

Gaps everywhere: The CBSA and the Public Health Agency of Canada worked together on ArriveCan, since it was to help the CBSA apply the health agency’s rules. This was a problem from the get-go: “Each agency believed that its counterpart was responsible for establishing a governance structure,” the auditors found (they said it was the health agency’s job).

As a result, the CBSA went ahead despite having no formal objective or budget.

Decision after decision by the CBSA has little documentation behind it, the report said. Among the findings:

• The agency gave GC Strategies, a general contractor for IT work, an initial $2.35-million contract in April 2020 and can’t document why; it doesn’t even have a proposal on file from the firm. In media reports and parliamentary hearings, GC Strategies has been characterized as a middleman that took a cut for doing little of value. 
• The agency accepted a later proposal from another company, 49 Solutions, for a non-competitive contract and sole-sourced more work to KPMG, and can’t say why.
• Eighteen per cent of the invoices the auditors checked didn’t include enough detail to be certain whether they were even for ArriveCan.

They were warned: The government’s central procurement authority, Public Services and Procurement Canada, urged the CBSA to at least run quick competitions or limit the length and size of its sole-sourced deals, the auditors reported. It didn’t.

The pandemic doesn’t justify it: The rush to react to COVID-19 justified relaxing some rules around procurement and contracting, the auditors acknowledged. But that didn’t excuse government agencies from demonstrating “due diligence and controls around expenditures” and documenting their decisions.

The auditor stayed away from possible crimes: The CBSA is investigating potential violations of its internal codes—such as employees being invited to dinners with vendors and not reporting them—and has called in the Mounties. The auditor general chose to “avoid duplicating or compromising those ongoing processes.”

On the upside: Canada has an app to streamline border crossings now, which it didn’t before the pandemic. As the auditors wrote: “The enduring benefit of the ArriveCan application is that it remains available for customs and immigration declarations.”