Confidential information about millions of Canadians is not properly secured on federal government computer systems, the Auditor General of Canada said in a report tabled in the House of Commons.

Senior federal government managers do not understand the risks to information technology security and do not understand how security breaches could affect their operations, Auditor General Sheila Fraser said.

"As more and more government services are offered on-line, individuals and businesses need to have confidence the information they share will be well protected."

Fraser told Canada AM in an interview on Wednesday that in a self-assessment done by government, out of the 46 departments that reported in, "only one indicated they were in compliance with the government's own policies and standards."

She added that not enough departments are doing vulnerability assessments, "and the ones that did them did indicate there were some serious weaknesses. So it's a problem throughout government."

CTV's Mike Duffy said the auditor general offered some worrying examples, but stopped short of condemnation.

"Her own experts were able to go in and hack into the government system," he told CTV News.

But Fraser repeated her reassurance that she doesn't "want to create a great fear in the minds of Canadians in that they stop doing business with the government electronically."

"That's not the purpose of our audit," she told Canada AM. "Our audit was really looking at the controls that were in place . . . and what we're saying is that the departments really need to step up, they really need to give higher priority to this, especially as they're moving more and more systems to be delivered electronically. . ."

Asked about whether she has any personal fears of submitting information to the government, Fraser told Canada AM:

"I have no concerns; I file my tax returns electronically."

Fraser's findings were part of her quarterly Status Report to the House of Commons. The Auditor General is an independent watchdog who reports directly to the House of Commons.

In her report Tuesday, Fraser said the federal government had not made much progress on four large-scale initiatives to improve government.

"Canadians need to see more progress in such critical areas as the governance of Crown corporations, …the accountability of foundations, and the management of the government's financial information."

Crown agencies

For example, Canada's Crown corporations still operate too far from the scrutiny of Parliament and the taxpayer, Fraser said, blasting Ottawa for its "unsatisfactory progress" in addressing recommendations issued in an audit four years ago.

Some improvements have been made at Canada's 43 Crown agencies, she said, but many questions remain.

Among the 15 largest Crown corporations, more than one third of board members' terms had expired -- and four are operating without a permanent CEO.

Fraser called for new policies to ensure the country's Crown corporations, which include the Canadian Broadcasting Corp., Canada Post, and VIA Rail, quickly replace departing boards of directors and chief executives with individuals who have appropriate training and skills.

There also needs to be better formal mechanisms for communicating government expectations to the organizations that manage $78 billion in public assets and employ more than 73,000 countrywide.

Poor oversight

Fraser also said there was poor oversight of billions of public funds held by federal foundations -- the not-for-profit organizations that manage special programs and dispense federal funding.

Since 1997, the federal government has transferred more than $9 billion to foundations, of which more than $7.7 billion is still collecting interest in their bank accounts.

Fraser said once this money is transferred to foundations, there are no formal means to ensure the money is spent appropriately and there is no way for the government to make adjustments to a foundation's mission or purpose.

Asked on Canada AM why she doesn't have access to the foundations' books, Fraser replied that her mandate is limited to the departments, agencies and certain crown corporations of the federal government.

"These foundations have been set up in such a way as to make them "arms length" from the federal government.

"So my mandate does not extend to them. It is possible, though, for the government to give me the authority to include them in broad, government-wide audits that we would do, and that's really what we're asking for," she told Canada AM.

Fraser also said that the federal government has been slow to implement new accounting and financial management systems -- systems that many other countries and several Canadian provinces already use.

"I find it difficult to understand why, after years of study, the federal government has not resolved this matter," Fraser said Tuesday.

Her report also noted that the Canadian International Development Agency (CIDA) has ramped up its use of grants, sacrificing much of its ability to monitor the cash it disperses.

Grants are not subject to the same performance conditions and restrictions as contributions in the form of donations, Fraser said, noting that the use of grants to CIDA have increased from $6 million to $148 million since the 1999-2000 fiscal year.

"We're concerned that . . . CIDA may be sacrificing a degree of control and oversight over how recipients spend CIDA funding,'' Fraser wrote.

With files from CTV's David Akin