YOU ARE DOWNLOADING DOCUMENT

Please tick the box to continue:

Transcript
Page 1: Internal Audit Vice Presidency (IADVP) FY11 First Quarter ...siteresources.worldbank.org/.../IADVP-FY11-Q1-ActivityReport.pdf · Internal Audit Vice Presidency (IADVP) FY11 First

Internal Audit Vice Presidency (IADVP)

FY11 First Quarter Activity Report

July to September 2010

FOR OFFICIAL USE ONLY Issue date: January 12, 2011

Pub

lic D

iscl

osur

e A

utho

rized

Pub

lic D

iscl

osur

e A

utho

rized

Pub

lic D

iscl

osur

e A

utho

rized

Pub

lic D

iscl

osur

e A

utho

rized

wb370910
Typewritten Text
59211
Page 2: Internal Audit Vice Presidency (IADVP) FY11 First Quarter ...siteresources.worldbank.org/.../IADVP-FY11-Q1-ActivityReport.pdf · Internal Audit Vice Presidency (IADVP) FY11 First
Page 3: Internal Audit Vice Presidency (IADVP) FY11 First Quarter ...siteresources.worldbank.org/.../IADVP-FY11-Q1-ActivityReport.pdf · Internal Audit Vice Presidency (IADVP) FY11 First

Executive Summary

FY 11 First Quarter Activity Report / 1 FOR OFFICIAL USE ONLY

1 During FY11 Q1, eight engagements were completed by IAD. Seven of the engagements were started in FY10. The engagements included one World Bank Group (WBG) wide engagement, five IBRD/IDA (Bank) engagements, one engagement for the International Financial Corporation (IFC) and one engagement for the Multilateral Investment Guarantee Agency (MIGA). Also, IAD completed the planning and began fieldwork for six FY11 engagements.

2 IAD completed the final phase of the review of Management's Implementation of the IDA Internal Controls Five-Point Action Plan and provided an overall assessment of the implementation. In IAD’s view, IDA internal controls have been significantly strengthened at both the transaction and entity levels. To assure operating effectiveness of the controls, IAD will perform testing during regular reviews conducted in FY11 and beyond.

3 During Q1 IAD completed three advisory reviews. These reviews covered: the newly developed Risk Based Releasing functionality within the Integrated Loan Administration Platform system; the Administration of the PACT Trust Fund and DGF Grants to the African Capacity Building Foundation; and the WBG’s Risk Management Framework.

4 Four of the engagements completed during FY11 Q1 pertained to IAD’s participation in the annual assessment of the Internal Controls over Financial Reporting (ICFR). IAD completed testing of the design and effectiveness of controls provided by management over financial reporting for IBRD/IDA, IFC and MIGA.

5 IAD improved its approach to engagement rating methodology. The modifications included revised definitions for concluding on engagements and introduction of individual ratings at the issue level. IAD will monitor the application of ratings through the end of the second quarter to determine if any recalibration of the ratings is necessary.

6 IAD completed a review of specific engagements concluded in FY10 as part of its Quality Assessment and Improvement Program (QAIP). The objective of the review was to ensure that the VPU is consistently following professional Institute of Internal Auditors (IIA) and IAD standards in conducting its engagements. The review concluded that IAD generally follows established policies and procedures, and highlighted areas for improvement.

7 IAD is focused on building its Professional Practices Team to support the operations of the function. The team will focus on improving methodology and practices, enhancing the use of technology, monitoring staff development, and managing resources and budget of the function.

8 The IAD Vice President and Auditor General attended the 41st Annual Meeting of Representatives of Internal Audit Services (RIAS) of the United Nations Organizations and Multilateral Financial Institutions. The meetings provided an opportunity to gain collective knowledge about emerging issues and conduct informal benchmarking with the audit functions of the UN system.

9 IAD total expenditures during FY11 Q1 were $2.6 million representing 21% of the FY11 budget of $12.2 million and had a headcount of 50 staff.

Page 4: Internal Audit Vice Presidency (IADVP) FY11 First Quarter ...siteresources.worldbank.org/.../IADVP-FY11-Q1-ActivityReport.pdf · Internal Audit Vice Presidency (IADVP) FY11 First

FY 11 First Quarter Activity Report / 2 FOR OFFICIAL USE ONLY

Table of Contents

1. Summary of Key Engagement Outcomes ................................................................................ 03

2. Revised Rating System ........................................................................................................... 06

3. R esults of Quality Assurance .................................................................................................. . 08

4. Staffing and Resource Utilization .............................................................................................. 10

Annex 1: List of Engagements Completed during FY11 Q1 ................................................................. 11

The Internal Audit Vice Presidency (IAD) is an independent and objective assurance and advisory function designed to add value to the World Bank Group (WBG) by improving the operations of the WBG organizations. It assists WBG in accomplishing its objectives by bringing a systematic and disciplined approach to evaluate and improve the effectiveness of the organization’s risk management, control, and governance processes. The purpose of this report is to provide a high level overview of IAD activities during the quarter to Senior Management and the Audit Committee. This Quarterly Activity Report is also publicly disclosed, under the Bank’s Access to Information Policy.

Page 5: Internal Audit Vice Presidency (IADVP) FY11 First Quarter ...siteresources.worldbank.org/.../IADVP-FY11-Q1-ActivityReport.pdf · Internal Audit Vice Presidency (IADVP) FY11 First

FY 11 First Quarter Activity Report / 3 FOR OFFICIAL USE ONLY

1. Summary of Key Engagement Outcomes

IDA internal controls have been significantly strengthened at both the transaction and entity levels.

To assure operating effectiveness of the controls, IAD will perform testing during regular reviews conducted in FY11 and beyond.

IAD performed an advisory review for ACBF and noted improvement opportunities in supervision of long term programs and coordination between units.

1. Review of the Implementation of Management’s IDA Internal Controls Assessment Five Point Action Plan

IAD completed the last phase of a three part review of the implementation of the Five Point Action Plan. IAD concluded that Management’s assertion that IDA internal controls have been significantly strengthened at both the transaction and entity levels is fairly stated. The introduction of new tools and frameworks at the entity and transaction levels satisfactorily address the adequacy of the design of controls identified for review. Given that the operating effectiveness of most of these controls can only be assessed after a reasonable period of operation, IAD will cover operating effectiveness in the course of its regular reviews in FY11 and beyond (refer to Table 1 for indicative coverage).

Table 1: IAD Planned Reviews that include IDA Controls

Audit Name Area

Management of procurement complaints Procurement, F&C

Knowledge portfolio management (advisory) Accountability, AAA

Regional quality assurance process Investment Lending, Risk Management

Corporate monitoring of procurement activities

Procurement, Investment Lending

2. Advisory Report Related to the Bank's Administration of the PACT Trust Fund and DGF Grants to the African Capacity Building Foundation

At the request of the Africa Region, IAD conducted an advisory review related to the Bank’s administration of the PACT Trust Fund, a multi-donor trust fund, and Development Grant Facility (DGF) grants provided to the African Capacity Building Foundation (ACBF). The funding relates to ACBF’s program called the Partnership for Capacity Building in Africa (PACT).

IAD noted improvement opportunities, specifically in the periodic review of the Bank’s financing strategy, engagement, and supervision for long-term programs; and continued diligence in maintaining accountabilities and coordination between operating regions and central units.

.

Page 6: Internal Audit Vice Presidency (IADVP) FY11 First Quarter ...siteresources.worldbank.org/.../IADVP-FY11-Q1-ActivityReport.pdf · Internal Audit Vice Presidency (IADVP) FY11 First

FY 11 First Quarter Activity Report / 4 FOR OFFICIAL USE ONLY

1. Summary of Key Engagement Outcomes (continued)

IAD will continue to be involved in the development of the integrated risk management framework.

Risk Based Releasing represents an enhancement to the Bank’s loan disbursement process by increasing efficiency.

3. Advisory Engagement Related to the World Bank Group’s Risk Management Framework

The engagement provided an objective update on the status of the Group’s integrated risk management (IRM) framework and offered recommendations to support the development process. IAD observed that the WBG entities have made significant progress over the past few years in strengthening risk practices. Overall, Management demonstrates strong risk-awareness and each institution has effective oversight processes over significant risks. However, IAD noted that the existing process is fragmented and does not provide WBG's Board and Senior Management with a holistic and integrated view of risk across the entire group. IAD suggested a phased approach initially focused on strengthening central risk management functions, establishing common methodologies, standards and tools, risk aggregation and analysis, and integrated reporting. The recommendations will be discussed with the Chief Risk Officer, once appointed. IAD will continue to be involved in the development of the integrated risk management framework, acting initially as an advisor to management during the design phase, and in the future, providing assurance on the operating effectiveness of the framework.

4. Advisory Review Related to the Development of the Risk Based Releasing Functionality within the iLAP System.

At the request of the Loan Department Disbursement Management Unit (CTRDM), IAD conducted an advisory review related to the development of the Risk Based Releasing (RBR) functionality within the Integrated Loan Administration Platform (iLAP) system. This engagement was a pre-implementation review of the control design related to the RBR functionality in iLAP, from both the business process and systems perspectives. The objective of the engagement was to evaluate the control design of the RBR functionality within the iLAP system and advise management of any potential improvements.

IAD noted that the concept of RBR was well thought-out by the Loan Department Disbursement Unit and thorough user acceptance testing was performed in order to ensure the automation worked as planned. IAD provided advice on documenting procedures, establishing KPIs and monitoring access.

Page 7: Internal Audit Vice Presidency (IADVP) FY11 First Quarter ...siteresources.worldbank.org/.../IADVP-FY11-Q1-ActivityReport.pdf · Internal Audit Vice Presidency (IADVP) FY11 First

FY 11 First Quarter Activity Report / 5 FOR OFFICIAL USE ONLY

1. Summary of Key Engagement Outcomes (continued)

IAD performed testing on internal controls to support Management’s assertion on Internal Controls over Financial Reporting (ICFR). Management determined that none of the issues represented a significant deficiency or material weakness.

5. Engagement related to testing of Internal Controls over Financial Reporting (ICFR)

As part of FY10 Work Program and at the request of Management, IAD performed testing of key Internal Controls over Financial Reporting (ICFR), which supported WBG entities’ assertions as to the adequacy of the internal controls over the financial statements. IAD’s scope was limited to evaluating the design and/or testing the operating effectiveness of key controls already identified by Management and reporting any issues to Management. Management was responsible for evaluating the impact of the issues and determining whether issues noted could represent a significant deficiency or material weakness, and if controls should be further strengthened.

During FY11 Q1, IAD audit teams finalized testing on behalf of Management for more than three hundred key controls distributed among IBRD/IDA, IFC and MIGA. IAD noted issues in design and implementation, operating effectiveness and documentation. Management reviewed the issues raised and determined that none of the issues represented a significant deficiency or material weakness.

In addition to ICFR testing, IAD also issued a report related to IBRD’s disclosure controls and procedures for External Financial Reporting. Based on the information and evidence provided by management, IAD’s testing of the disclosure controls and procedures over external financial reporting for FY10 did not identify any deficiencies in the operating effectiveness of the documented controls.

Page 8: Internal Audit Vice Presidency (IADVP) FY11 First Quarter ...siteresources.worldbank.org/.../IADVP-FY11-Q1-ActivityReport.pdf · Internal Audit Vice Presidency (IADVP) FY11 First

FY 11 First Quarter Activity Report / 6 FOR OFFICIAL USE ONLY

2. Revised Rating System

IAD is applying ratings to individual issues observed during assurance engagements beginning in FY11.

1. IAD is applying ratings to individual issues found during assurance engagements beginning in FY11. Refer to Table 2 for the issue level ratings. The issue level ratings allow:

Differentiation between key issues with an institutional impact and

lower level operational issues. Prioritization of remediation efforts by management based on the

severity of the issue. Direct linkage of the individual issues found to the integrated risk

framework, and better articulation of the issues and their impact. More transparency in the rationale for engagement level ratings.

Prior to the launch, the Vice President and Auditor General obtained feedback from Management on the proposed issue level ratings. Management is supportive on the basis that this initiative will bring better focus to key issues.

Table 2: Issue Level Ratings

Issue Level Rating Definitions

Low

The issue requires management attention to maintain a satisfactory control environment.

Medium

A control design and/or operating effectiveness issue that, if not addressed, may cause loss or reputational damage. The issue has a significant impact on the process under review.

High

A serious weakness in control design and/or operating effectiveness that, if not addressed, is likely to impact the entity’s ability to achieve its business objectives, comply with key policies and/or maintain control over mission-critical systems. The issue has a significant impact at the entity level.

The implementation of issue level ratings will be monitored to ensure effectiveness and consistency in application. IAD will review the results of the rating system over the first two quarters of FY11 to determine if recalibration of the ratings is necessary.

Page 9: Internal Audit Vice Presidency (IADVP) FY11 First Quarter ...siteresources.worldbank.org/.../IADVP-FY11-Q1-ActivityReport.pdf · Internal Audit Vice Presidency (IADVP) FY11 First

FY 11 First Quarter Activity Report / 7 FOR OFFICIAL USE ONLY

2. Revised Rating System (continued)

IAD also revised the definition of engagement level ratings to better reflect IAD’s assessment of key controls in the area under review.

2. IAD also categorizes its overall opinion of specific audit engagements. For FY11, the engagement rating descriptions have been revised to better reflect IAD’s assessment of key controls in the areas under review. Refer to Table 3 for the revised engagement level ratings.

Table 3: Engagement Level Ratings

Issue Level Rating Definitions

Satisfactory

Internal audit identified no significant issues related to the design of controls or to the proper functioning of controls as designed. If issues were noted, they were considered minor in nature.

Needs Improvement

Internal audit identified issues related to the design of the controls and/or in the functioning of controls. Although none of these issues, either individually or in the aggregate, indicate significant weaknesses, management should address these issues in a timely manner to further strengthen the system of controls.

Unsatisfactory

Internal audit identified issues that indicate significant weaknesses in the design and/or operating effectiveness of controls. Management should take immediate action to establish a satisfactory system of controls.

Page 10: Internal Audit Vice Presidency (IADVP) FY11 First Quarter ...siteresources.worldbank.org/.../IADVP-FY11-Q1-ActivityReport.pdf · Internal Audit Vice Presidency (IADVP) FY11 First

FY 11 First Quarter Activity Report / 8 FOR OFFICIAL USE ONLY

3. Results of Quality Assurance

IAD completed an examination of selected engagements as part of its Quality Assurance and Improvement Program.

1. IAD recognizes the importance of having a comprehensive Quality Assurance and Improvement Program (QAIP) and is currently revising the program to further align it to the Institute of Internal Auditors (IIA) Standards, as well as leading practices in the industry. One of the key elements of the QAIP is ongoing monitoring. In Q1, IAD completed a review of six engagements completed in FY10 Q3 and Q4 to determine if ongoing monitoring was being carried out properly. The review concluded that IAD generally follows established policies and procedures; however, improvement opportunities were noted. The review team summarized the improvement opportunities for the IAD Management Team and will monitor the planned actions in future QAIP reviews. Table 4 summarizes the issues and planned actions:

Table 4: Issues and Planned Actions

Issue Noted Planned Action

There is some inconsistency in the documentation maintained for each phase of the lifecycle of the audit, including planning and review.

A post-engagement checklist will be introduced to assist in maintaining consistent documentation for the work performed.

Stronger discipline in the use of the audit tool could be enforced.

A periodic report highlighting incorrect or missing information will be provided to the IAD Managers for action.

IAD is using standard objectives in the engagement Terms of Reference which does not provide the client with the specific objectives of the engagement.

For each engagement a preliminary risk assessment is being developed and specific audit objectives will reflect the results of the risk assessment. In addition, there will be increased focus during Manager review of engagement workpapers.

An opportunity exists for improved monitoring of planned versus actual hours spent for each engagement.

A monitoring report will be developed integrating actual results from the time tracking system with the planned engagement days. This report will be provided to the IAD Managers for appropriate explanation and/or action.

The Progress Control indicators used to measure milestones need to be updated.

The Progress Control report has been restructured to reflect the milestones that will be measured for all engagements starting in FY11.

Page 11: Internal Audit Vice Presidency (IADVP) FY11 First Quarter ...siteresources.worldbank.org/.../IADVP-FY11-Q1-ActivityReport.pdf · Internal Audit Vice Presidency (IADVP) FY11 First

FY 11 First Quarter Activity Report / 9 FOR OFFICIAL USE ONLY

3. Results of Quality Assurance (continued)

IAD has engaged the IIA to conduct an external quality assessment review during Q2.

2. An external assessment will be conducted by the IIA which is scheduled for December 2010. The International Standards for the Professional Practice of Internal Auditing require that external assessments be conducted at least once every five years by a qualified, independent reviewer or review team from outside the organization. IAD’s last QAR was concluded in 2005.

The engagement of the IIA was discussed and approved by the Audit Committee on September 22, 2010. The Audit Committee supports the external assessment and looks forward to receiving the report that will assist in improving IAD going forward.

Page 12: Internal Audit Vice Presidency (IADVP) FY11 First Quarter ...siteresources.worldbank.org/.../IADVP-FY11-Q1-ActivityReport.pdf · Internal Audit Vice Presidency (IADVP) FY11 First

FY 11 First Quarter Activity Report / 10 FOR OFFICIAL USE ONLY

4. Staffing and Resource Utilization

IAD is focused on building a Professional Practices Team to support and strengthen VPU performance.

1. IAD is building a Professional Practices Team, which will focus on establishing and improving methodology and supporting technologies; enhancing the training and build-out of competencies for staff development; implementing and monitoring the results of the Quality Assurance and Improvement Program; improving the internal and external relations with stakeholders and industry peers; and providing reporting, resource management and administrative support to the function.

2. On September 14-17, 2010, the Vice President and Auditor General attended the 41st Annual Meeting of Representatives of Internal Audit Services (RIAS) of the United Nations Organizations and Multilateral Financial Institutions. The meeting allowed information-sharing and benchmarking on the following relevant topics: cooperation and allocation of roles and responsibilities between the audit committee and the external and internal auditor; key differences to be considered when auditing private and public sectors under the Audit Committee perspective; review of the audit function and implementation of Enterprise Risk Management in UN system organizations; challenges faced by internal auditing when interacting with other oversight functions (e.g., investigation, evaluation, ethics); assertions on the adequacy and effectiveness of governance, risk management and control processes; and issues around the disclosure of internal audit reports; and the impact of 2010 IIA Standards.

3. As of September 30, 2010, IAD had a headcount of 50 staff. Total expenditures during FY11 Q1 were $2.6 million representing 21% of the FY11 budget of $12.15 million.

Page 13: Internal Audit Vice Presidency (IADVP) FY11 First Quarter ...siteresources.worldbank.org/.../IADVP-FY11-Q1-ActivityReport.pdf · Internal Audit Vice Presidency (IADVP) FY11 First

FY 11 First Quarter Activity Report / 11 FOR OFFICIAL USE ONLY

Annex 1: List of Engagements Completed during FY11 Q11

WBG Engagements (covering processes across Bank, IFC & MIGA)

No. Entity Engagement Title Report No. Date Issued

1 WBG Advisory Engagement Related to the World Bank Group’s Risk Management Framework WBG FY11-01 3-Sep-10

World Bank (IBRD/IDA) Engagements

No. Entity Engagement Title Report No. Date Issued

2 IBRD/IDA FY10 Testing of IBRD’s Disclosure Controls and Procedures over External Financial Reporting IBRD FY11-01 2-Aug-10

3 IBRD/IDA FY10 Testing of Bank's Internal Controls over External Financial Reporting IBRD FY11-02 12-Aug-10

4 IBRD/IDA Review of Management's Implementation of the IDA Internal Controls Five-Point Action Plan IBRD FY11-03 8-Sep-10

5 IBRD/IDA Report on an Advisory Engagement Related to the Bank's Administration of the PACT Trust Fund and DGF Grants to the African Capacity Building Foundation

IBRD FY11-04 13-Sep-10

6 IBRD/IDA Advisory Review Related to the Development of the Risk Based Releasing Functionality within the iLAP System IBRD FY11-05 23-Sep-10

IFC Engagements

No. Entity Engagement Title Report No. Date Issued

7 IFC FY10 Testing of IFC’s Internal Controls over External Financial Reporting IFC FY11-01 24-Sep-10

MIGA Engagements

No. Entity Engagement Title Report No. Date Issued

8 MIGA FY10 Testing of MIGA's Internal Controls over External Financial Reporting MIGA FY11-01 12-Aug-10

1 As per paragraph 16 (d) of the Bank’s Access to Information Policy, July 1, 2010, audit reports prepared by IAD shall not be publicly disclosed, except its finalized Annual and Quarterly Activity Reports.


Related Documents