The World Bank Presented by: Richard Allen, PEFA Program Keeping on Track: Internal Control and Internal Audit Budget Execution & Implementation for Public.

The World Bank

Presented by:Richard Allen, PEFA Program

Keeping on Track:Keeping on Track:

Internal Control and Internal AuditInternal Control and Internal Audit

Budget Execution & Implementation forPublic Expenditure & Financial Accountability CourseWashington, DC: January 17, 2003

The World Bank

Control systems involve:

Internal Control and Internal Audit

2

Identification of Risk

Development of Internal Controls

Development of of Internal Audit

Internal Control & Audit

The World Bank

Risks

3

Misuse and waste of financial, human

and technical resources,

including external aid

Misuse and waste of financial, human

and technical resources,

including external aid

Fraud and errorFraud and errorUnsatisfactory

accounting records

Unsatisfactory accounting

records

Lack of timely and reliable financial

and resource management information

Lack of timely and reliable financial

and resource management information

Going off the rail -- risks

The World Bank

2

1

Internal Control & Internal Audit: Professional Standards

4See: INTOSAI at http://www.intosai.org/ and IIA at

http://www.theiia.org/

See: INTOSAI at http://www.intosai.org/ and IIA at

http://www.theiia.org/

Standards for the Professional Practice of Internal AuditingStandards for the Professional Practice of Internal Auditing

INTOSAI

Guidelines for Internal Control Standards

INTOSAI

Guidelines for Internal Control Standards

The World Bank

A process within an organization to provide reasonable assurance regarding the following

primary objectives:

Definition of Internal Control

The reliability and integrity of information

Compliance with policies, plans, procedures, laws and regulations

The safeguarding of assets

The economical and efficient use of resources

The accomplishment of established objectives and goals of operations and programs

The reliability and integrity of information

Compliance with policies, plans, procedures, laws and regulations

The safeguarding of assets

The economical and efficient use of resources

The accomplishment of established objectives and goals of operations and programs

Source: The Institute of Internal Auditors

Source: The Institute of Internal Auditors

Definition of Internal Control:

“Internal control is a management tool … the organization, policies and procedures used to help ensure that government programs achieve their intended results; that the resources used to deliver these programs are consistent with the stated aims and objectives of the organizations concerned; that programs are protected from waste, fraud and mismanagement; and that reliable and timely information is obtained, maintained, reported and used for decision making.”

-- INTOSAI, Guidelines for Internal Control, June 1992

Definition of Internal Control:

“Internal control is a management tool … the organization, policies and procedures used to help ensure that government programs achieve their intended results; that the resources used to deliver these programs are consistent with the stated aims and objectives of the organizations concerned; that programs are protected from waste, fraud and mismanagement; and that reliable and timely information is obtained, maintained, reported and used for decision making.”

-- INTOSAI, Guidelines for Internal Control, June 1992

5

The World Bank

Key Concepts of Internal Control

Source: Committee of Sponsoring Organizations of the Treadway

Commission (COSO)

Source: Committee of Sponsoring Organizations of the Treadway

Commission (COSO)

Internal control is …

… a process… a process

… affected by people. It’s not merely policy manuals and

procedures, but people at every

level of the organization

… affected by people. It’s not merely policy manuals and

procedures, but people at every

level of the organization

… can be expected to provide only

reasonable assurance, not

absolute assurance to an

entities’ management & stakeholders

… can be expected to provide only

reasonable assurance, not

absolute assurance to an

entities’ management & stakeholders

… geared to the achievement of

objectives

… geared to the achievement of

objectives

6

The World Bank7

Importance of Internal Control in Government

Ministries

If these responsibilities are fulfilled properly, the result will be effective control over resources,

decisions and activities and the achievement of ministry objectives.

If these responsibilities are fulfilled properly, the result will be effective control over resources,

decisions and activities and the achievement of ministry objectives.

The average Ministry has a number of responsibilities (committing funds, recruiting staff, contracting for supplies and services, approving actions, registering

transactions and events, deploying resources and controlling, supervising and reporting on implementation of policies).

The average Ministry has a number of responsibilities (committing funds, recruiting staff, contracting for supplies and services, approving actions, registering

transactions and events, deploying resources and controlling, supervising and reporting on implementation of policies).

If not, abuses will proliferate and efficiency decline. If not, abuses will proliferate and efficiency decline.

The World Bank

Two Principles of Internal Control

8

Governing bodies of

public sector entities need to ensure that a framework of control is established

and operates in practice and that a

statement on its

effectiveness is included in

the entity’s annual report.

Governing bodies of

public bodies need

to ensure that effective systems of

risk management

are established as part of

the framework of internal

control.

Source: IFAC, Corporate Governance in the Public Sector,

2000

Source: IFAC, Corporate Governance in the Public Sector,

2000

The World Bank9

Three Approaches to Internal Control

A. Emphasis on controls that are exercised by a

third party organization, at the

center of government, often an agency of the

Ministry of Finance or the MOF itself

(“Napoleonic” tradition)

A. Emphasis on controls that are exercised by a

third party organization, at the

center of government, often an agency of the

Ministry of Finance or the MOF itself

(“Napoleonic” tradition)

B. Emphasis on responsibility for control

being decentralized to line ministries and other

government agencies (Anglo-Saxon,

Scandinavian tradition)

B. Emphasis on responsibility for control

being decentralized to line ministries and other

government agencies (Anglo-Saxon,

Scandinavian tradition)

C. Mixed approaches (e.g., transition

countries)

C. Mixed approaches (e.g., transition

countries)

The World Bank

Clear instructions to staff and appropriate training on the objectives, policies and code of conduct of the ministry or agency

An unambiguous definition of the responsibilities of staff

Clear separation of function and duties between staff members in handling financial transactions or resources issues, e.g., contracts

Development of an “open” culture to encourage staff at all levels to draw attention to non-compliance and irregularity

Requirements that staff at all levels are aware of and apply all relevant instructions

Support from effective internal audit procedures

Clear instructions to staff and appropriate training on the objectives, policies and code of conduct of the ministry or agency

An unambiguous definition of the responsibilities of staff

Clear separation of function and duties between staff members in handling financial transactions or resources issues, e.g., contracts

Development of an “open” culture to encourage staff at all levels to draw attention to non-compliance and irregularity

Requirements that staff at all levels are aware of and apply all relevant instructions

Support from effective internal audit procedures

Procedures

Control Procedures

10

The World Bank

Physical:e.g., security

procedures intended to control access to

documents and records

Physical:e.g., security

procedures intended to control access to

documents and records

Procurement Controls:

e.g., rules for advertising and tendering major

contracts

Procurement Controls:

e.g., rules for advertising and tendering major

contracts

Accounting Controls:e.g., requirement for

all cash receipts to be deposited daily in a

bank, internal procedures to detect and report anomalies

Accounting Controls:e.g., requirement for

all cash receipts to be deposited daily in a

bank, internal procedures to detect and report anomalies

Process Controls:e.g., issuance of a purchase order or the

approval of a sizeable contract may require documentation from the requesting official, review by a purchasing clerk, and approval

by a supervisor

Process Controls:e.g., issuance of a purchase order or the

approval of a sizeable contract may require documentation from the requesting official, review by a purchasing clerk, and approval

by a supervisor

Management of Financial & Other

Records:Essential to establish

audit trail

Management of Financial & Other

Records:Essential to establish

audit trail

Separation of Duties:Both a control measure and an indispensable element of many control systems – at

least two officials should be involved in any transaction to avoid risk of improper actions

Separation of Duties:Both a control measure and an indispensable element of many control systems – at

least two officials should be involved in any transaction to avoid risk of improper actions

Categories of Internal Control

11

The World Bank

Design flaws

12

Limitations of Internal Control

No system of internal control can provide an absolute guarantee against the risk of wronging or

error. The proper goal of internal control is to provide “reasonable assurance” that improprieties will not occur, or if they do occur, they

will be revealed, reported and appropriate action taken.

No system of internal control can provide an absolute guarantee against the risk of wronging or

error. The proper goal of internal control is to provide “reasonable assurance” that improprieties will not occur, or if they do occur, they

will be revealed, reported and appropriate action taken.

Poor implementation

Poor response to reported anomalies

Collusion

Wrongdoing by top managers

The World Bank

Definition of Internal Audit

Source: The Institute of Internal Auditors

Source: The Institute of Internal Auditors

Definition of Internal Audit:

“Internal auditing is an independent, objective, assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve effectiveness of risk management, control, and governance processes.”

Definition of Internal Audit:

“Internal auditing is an independent, objective, assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve effectiveness of risk management, control, and governance processes.”

13

Internal Audit

The World Bank14

Internal Audit – Different Approaches

In the Auditor-General tradition, internal audit is usually reflected in internal audit units of individual ministries or agencies, reporting directly to top management

Such internal audit units may also exist in the Court of Accounts tradition

Other variations – US Inspector General of each agency reports to agency management and to the Congress

The external auditor (SAI) may use the work of the internal auditor

Many countries of the Court of Accounts tradition have a central (independent) internal control agency located within the Ministry of Finance

In some cases these have an extensive pre-audit role

Generally wide powers of inspection and review, and in many cases a prosecutorial role

The World Bank

What does the Internal Auditor Look For?

15

Systems & Procedures

How well do the systems and procedures of internal control function?

Procurement

In the procurement field, has there been adequate publicity for calls to tender, are there satisfactory procedures for receiving and evaluating tenders, is the justification for contract awards in accordance with national requirements?

Objectives’ Achievement

Have programs and actions achieved their intended objectives?

Are the systems and procedures in place to ensure that resources are used in accordance with the relevant rules and regulations?

Resource use

The World Bank

Independence of the Internal Auditor

Not equivalent to the independence of the Auditor General or President of the Audit court. The internal auditor is responsible to the head of a ministry or agency and is part of the staff of that organization.

“Internal auditors are independent when they carry out their work freely and objectively. Independence permits internal auditors to render their impartial and unbiased judgments essential to the proper conducts of audits. It is achieved through organizational status and objectivity.”

Status and “weight” of internal auditor can be enhanced by having an audit committee chaired by the head of the ministry or agency.

The internal auditor should not be involved in the internal control process which he is required to assess and judge.

Not equivalent to the independence of the Auditor General or President of the Audit court. The internal auditor is responsible to the head of a ministry or agency and is part of the staff of that organization.

“Internal auditors are independent when they carry out their work freely and objectively. Independence permits internal auditors to render their impartial and unbiased judgments essential to the proper conducts of audits. It is achieved through organizational status and objectivity.”

Status and “weight” of internal auditor can be enhanced by having an audit committee chaired by the head of the ministry or agency.

The internal auditor should not be involved in the internal control process which he is required to assess and judge.

16Source: The Institute of Internal

Auditors

Source: The Institute of Internal Auditors

The World Bank

Audit Trail

An audit trail is necessary to keep under review the timely and adequate flow of funds and the procedures for efficient accounting and the reconciliation of expenditure reports with funds received or claimed. It is necessary to trace or check:

An audit trail is necessary to keep under review the timely and adequate flow of funds and the procedures for efficient accounting and the reconciliation of expenditure reports with funds received or claimed. It is necessary to trace or check:

17

To trace the budget

provision that

authorized payment

To trace the budget

provision that

authorized payment

To check the transfer of

funds authorized by the treasury to

the line ministry or agency

To check the transfer of

funds authorized by the treasury to

the line ministry or agency

To trace and evaluate the systems and

procedures through which approval for

payment to the contractor or

beneficiary will be required to pass

To trace and evaluate the systems and

procedures through which approval for

payment to the contractor or

beneficiary will be required to pass

To locate completed

payment files with evidence that

payment has, or has not, been

made in accordance with

rules and regulations

To locate completed

payment files with evidence that

payment has, or has not, been

made in accordance with

rules and regulations

The World Bank

Internal Audit – Issues

Who is in charge of internal auditing and what are their responsibilities?

What is the desired relationship between external and internal auditors? What information should they share? Should they coordinate their work programs?

How should the internal auditor fulfill his responsibilities to senior management? What are the limits on instructions that management may give to the auditor?

Who should be the recipients of internal audit reports, other than senior management?

What basic documents should the internal auditor produce, e.g., an annual audit plan, an annual audit report, etc.?

Should the government follow the internal audit standards of the IIA or guidance from INTOSAI?

Who is in charge of internal auditing and what are their responsibilities?

What is the desired relationship between external and internal auditors? What information should they share? Should they coordinate their work programs?

How should the internal auditor fulfill his responsibilities to senior management? What are the limits on instructions that management may give to the auditor?

Who should be the recipients of internal audit reports, other than senior management?

What basic documents should the internal auditor produce, e.g., an annual audit plan, an annual audit report, etc.?

Should the government follow the internal audit standards of the IIA or guidance from INTOSAI?

18

The World Bank

Q&A

&

Discussion