Presented by: Richard Allen, PEFA Program

1. Keeping on Track: Internal Control and Internal Audit Budget Execution & Implementation for Public Expenditure & Financial Accountability Course Washington, DC: January 17, 2003 Presented by: Richard Allen, PEFA Program

2. Internal Control and Internal Audit Control systems involve: Internal Control & Audit Identification of Risk Development of of Internal Audit Development of Internal Controls 2

3. Risks Going off the rail -- risks Lack of timely and reliable financial and resource management information Misuse and waste of financial, human and technical resources, including external aid Fraud and error Unsatisfactory accounting records 3

4. 1 2 Internal Control & Internal Audit: Professional Standards INTOSAI Guidelines for Internal Control Standards Standards for the Professional Practice of Internal Auditing 4 See: INTOSAI at http://www.intosai.org/ and IIA at http://www.theiia.org/

5. Definition of Internal Control • The reliability and integrity of information • Compliance with policies, plans, procedures, laws and regulations • The safeguarding of assets • The economical and efficient use of resources • The accomplishment of established objectives and goals of operations and programs A process within an organization to provide reasonable assurance regarding the following primary objectives: Definition of Internal Control: “Internal control is a management tool … the organization, policies and procedures used to help ensure that government programs achieve their intended results; that the resources used to deliver these programs are consistent with the stated aims and objectives of the organizations concerned; that programs are protected from waste, fraud and mismanagement; and that reliable and timely information is obtained, maintained, reported and used for decision making.” -- INTOSAI, Guidelines for Internal Control, June 1992 5 Source: The Institute of Internal Auditors

6. Key Concepts of Internal Control Internal control is … … a process … affected by people. It’s not merely policy manuals and procedures, but people at every level of the organization … can be expected to provide only reasonable assurance, not absolute assurance to an entities’ management & stakeholders … geared to the achievement of objectives 6 Source: Committee of Sponsoring Organizations of the Treadway Commission (COSO)

7. Importance of Internal Control in Government The average Ministry has a number of responsibilities (committing funds, recruiting staff, contracting for supplies and services, approving actions, registering transactions and events, deploying resources and controlling, supervising and reporting on implementation of policies). If these responsibilities are fulfilled properly, the result will be effective control over resources, decisions and activities and the achievement of ministry objectives. Ministries If not, abuses will proliferate and efficiency decline. 7

8. Two Principles of Internal Control Governing bodies of public sector entities need to ensure that a framework of control is established and operates in practice and that a statement on its effectiveness is included in the entity’s annual report. Governing bodies of public bodies need to ensure that effective systems of risk management are established as part of the framework of internal control. 8 Source: IFAC, Corporate Governance in the Public Sector, 2000

9. Three Approaches to Internal Control B. Emphasis on responsibility for control being decentralized to line ministries and other government agencies (Anglo-Saxon, Scandinavian tradition) A. Emphasis on controls that are exercised by a third party organization, at the center of government, often an agency of the Ministry of Finance or the MOF itself (“Napoleonic” tradition) C. Mixed approaches (e.g., transition countries) 9

10. Control Procedures • Clear instructions to staff and appropriate training on the objectives, policies and code of conduct of the ministry or agency • An unambiguous definition of the responsibilities of staff • Clear separation of function and duties between staff members in handling financial transactions or resources issues, e.g., contracts • Development of an “open” culture to encourage staff at all levels to draw attention to non-compliance and irregularity • Requirements that staff at all levels are aware of and apply all relevant instructions • Support from effective internal audit procedures Procedures 10

11. Categories of Internal Control Procurement Controls: e.g., rules for advertising and tendering major contracts Physical: e.g., security procedures intended to control access to documents and records Accounting Controls: e.g., requirement for all cash receipts to be deposited daily in a bank, internal procedures to detect and report anomalies Separation of Duties: Both a control measure and an indispensable element of many control systems – at least two officials should be involved in any transaction to avoid risk of improper actions Process Controls: e.g., issuance of a purchase order or the approval of a sizeable contract may require documentation from the requesting official, review by a purchasing clerk, and approval by a supervisor Management of Financial & Other Records: Essential to establish audit trail 11

12. Limitations of Internal Control No system of internal control can provide an absolute guarantee against the risk of wronging or error. The proper goal of internal control is to provide “reasonable assurance” that improprieties will not occur, or if they do occur, they will be revealed, reported and appropriate action taken. Wrongdoing by top managers Collusion Poor response to reported anomalies Poor implementation Design flaws 12

13. Definition of Internal Audit Internal Audit Definition of Internal Audit: “Internal auditing is an independent, objective, assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve effectiveness of risk management, control, and governance processes.” 13 Source: The Institute of Internal Auditors

14. Internal Audit – Different Approaches • In the Auditor-General tradition, internal audit is usually reflected in internal audit units of individual ministries or agencies, reporting directly to top management • Such internal audit units may also exist in the Court of Accounts tradition • Other variations – US Inspector General of each agency reports to agency management and to the Congress • The external auditor (SAI) may use the work of the internal auditor • Many countries of the Court of Accounts tradition have a central (independent) internal control agency located within the Ministry of Finance • In some cases these have an extensive pre-audit role • Generally wide powers of inspection and review, and in many cases a prosecutorial role 14

15. What does the Internal Auditor Look For? Procurement Systems & Procedures In the procurement field, has there been adequate publicity for calls to tender, are there satisfactory procedures for receiving and evaluating tenders, is the justification for contract awards in accordance with national requirements? How well do the systems and procedures of internal control function? Resource use Objectives’ Achievement Are the systems and procedures in place to ensure that resources are used in accordance with the relevant rules and regulations? Have programs and actions achieved their intended objectives? 15

16. Independence of the Internal Auditor • Not equivalent to the independence of the Auditor General or President of the Audit court. The internal auditor is responsible to the head of a ministry or agency and is part of the staff of that organization. • “Internal auditors are independent when they carry out their work freely and objectively. Independence permits internal auditors to render their impartial and unbiased judgments essential to the proper conducts of audits. It is achieved through organizational status and objectivity.” • Status and “weight” of internal auditor can be enhanced by having an audit committee chaired by the head of the ministry or agency. • The internal auditor should not be involved in the internal control process which he is required to assess and judge. Source: The Institute of Internal Auditors 16

17. Audit Trail • An audit trail is necessary to keep under review the timely and adequate flow of funds and the procedures for efficient accounting and the reconciliation of expenditure reports with funds received or claimed. It is necessary to trace or check: To trace and evaluate the systems and procedures through which approval for payment to the contractor or beneficiary will be required to pass To check the transfer of funds authorized by the treasury to the line ministry or agency To locate completed payment files with evidence that payment has, or has not, been made in accordance with rules and regulations To trace the budget provision that authorized payment 17

18. Internal Audit – Issues • Who is in charge of internal auditing and what are their responsibilities? • What is the desired relationship between external and internal auditors? What information should they share? Should they coordinate their work programs? • How should the internal auditor fulfill his responsibilities to senior management? What are the limits on instructions that management may give to the auditor? • Who should be the recipients of internal audit reports, other than senior management? • What basic documents should the internal auditor produce, e.g., an annual audit plan, an annual audit report, etc.? • Should the government follow the internal audit standards of the IIA or guidance from INTOSAI? 18

19. Q&A & Discussion