The government department overseeing the troubled Phoenix public service pay system is vowing to enforce "tighter controls" of sensitive information, in the wake of a leak of a confidential document.

An investigation was launched into an unauthorized disclosure after CBC News obtained a legal risk assessment that highlighted concerns about merging an aspect of the federal pay and pension systems.

Last fall, Ottawa considered awarding technology giant Hewlett Packard more than $13 million to build a case management system that would be shared by the federal pay and pension programs.

But according to the assessment, such a move would come with a "medium/high" legal risk, as another company, IBM, was already selected to perform the work.

Contract infringement concerns

"There is a contract in place for the Pay Modernization Project with IBM," the assessment says. "IBM may argue that the requirement to increase the capacity of the Case Management System.... is within the scope of the Pay Modernization contract and that the award of work to HP is a contract infrigement."

If challenged in court, "IBM's chances of success are High," the document says.

Public Service and Procurement, the department overseeing Phoenix, would not answer specific questions about whether it hired Hewlett Packard to do the case management work, despite the legal risks.

A statement from spokesman Jean-François Létourneau instead makes reference to the government's newly announced task force, which aims to get the pay system working properly.

Since Phoenix was launched in February of 2016, tens of thousands of public servants have been underpaid, overpaid, or not paid at all. There is no timeline as to when employees will be paid properly, or when lingering cases will be resolved.

Last week, Ottawa announced the $140-million savings the Phoenix program was supposed to generate over the next two years would instead be put toward resolving issues.

Leak investigation

CBC News learned about the leak investigation through an access to information request. In a memo to the deputy minister of Public Services and Procurement, the scope of the probe is clearly laid out.

"Special Investigations and Internal Disclosure (SIID) was charged with investigating the matter on October 7, 2016," the memo states.

Oversight officials interviewed staff, but were unable to determine the source of the leak.

"The investigation was inconclusive in determining the unauthorized disclosure... the documents were saved in different electronic environments rendering IT searches unviable."

The memo concludes that no further action will be taken on this matter, but that "tighter controls" will be put in place on cabinet confidences.