Strengthening Democracy: Role of Auditor-General in Public Sector Oversight

1. Human Settlements 5TH Parliament Capacity Building Presentation 9 September 2014 WELCOME

2. REPUTATION PROMISE/MISSION The Auditor-General of South Africa has a constitutional mandate and, as the Supreme Audit Institution (SAI) of South Africa, it exists to strengthen our country’s democracy by enabling oversight, accountability and governancein the public sector through auditing, thereby building public confidence.

3. PURPOSE OF PRESENTATION To provide members of parliament with the necessary information/guidance on the role of the AGSA to enable them to effectively execute their oversight function.

4. CONTENT • Audit mandate and process • AGSA mandate & Legislative requirements • Regularity audit – process and timelines • Types of Audits • Audit report structure • 2. Oversight role • Oversight model • AGSA contribution to oversight • Combined assurance model • Briefing process • Tools & Process

5. AUDIT MANDATE AND PROCESS

6. AGSA Mandate and Legislative requirements Available on Treasury website www.treasury.gov.za/legislation/pfma/circulars Also refer to AG Directive General Notice 263 of 2014 issued 2 April 2014

7. The regularity audit – what we do and what not

8. The regularity audit – AGSA products Regularity Audit – Mandatory (Annual) • Verify whether there is no omitted information on financial statements • Consists of – Financial, Compliance , PDO and Internal control • Full application of international auditing standards Regularity audit is supported by: DISCRETIONARY Agreed upon procedures, i.e. donor funding certificates MANDATORY ISA focus on the assessment of the information systems environment, use of Computer Assisted Audit Techniques (CAATs) in audits and data analytics DISCRETIONARY An independent process to prevent or detect fraud/ crime in the public sector Specific focus area of financial misconduct maladministration & impropriety DISCRETIONARY(PAA: Section 20(3)) 1. Evaluate measures to ensure economic procurement of resources and efficient and effective application of the same 2. Effect of policy implementation (not policy evaluation) 3. Reporting is factual and does not include an audit opinion 4. Audit is conducted by performance auditors and may include subject matter experts 5. Focuses on a specific government programme, project or management project Information systems Audit Performance Audits Special Audits Investigations

9. The regularity audit – process THE ANNUAL AUDIT PROCESS What do auditors do? Why they do it? Risk assessment Agree terms of engagement Terms of engagement are communicated & agreed to ensure a clear understanding of responsibilities of the parties, the objectives of the audit, access to information and the reports to be provided. Plan the audit An understanding of the auditee is obtained for risk assessment purposes & an audit plan is prepared. Perform risk assessment procedures A risk assessment is performed to determine the number and type of procedures to perform. Design and Perform procedures to address identified risk Risk response Procedures are performed to obtain evidence that the financial statements & annual performance report do not contain material misstatements and that key legislation has been complied with. Prepare Management Report (Not published) The report is only provided to the management of the auditee and the executive authority at the end of the audit. It details the findings from procedures performed, identifies the root causes of these findings and makes recommendations for improvement. Reporting Prepare Audit Report (Published) The report is published in the auditees’s annual report. It informs those responsible for oversight, the public and others of material misstatements in the financial statements, material findings on the usefulness and reliability of the performance report, material non-compliance with key legislation in specific focus areas, and the deficiencies in internal control that were identified during the audit.

10. AGSA Audits (service types and value add) Value add processes Performance Audit Performance Audits – (independent auditing process to evaluate the measures instituted by management to ensure that resources have been procured economically and are used efficiently and effectively)Focus on performance while spending – the three Es •Economy •Efficiency •Effectiveness + = VALUE FOR MONEY SERVICE DELIVERY Ask: what do I need, what quality do I need, when do I need it, where do I need it, how much of it do I need and where can I get all my needs met at the lowest price? Examples of findings: Needs assessments were not always done, Competitive bidding processes were not always followed, Contracts were open-ended in terms of cost and time Ask: was the work done with the minimum of effort? (Best results with what we have?) Examples of findings: Projects were extended because of a lack of project management and monitoring, Payments were made in excess of the amounts approved, The document archiving system was not adequately maintained Ask: Did we do what we set out to do? (Did we reach our Goal?) Examples of findings: Project objectives were not achieved, and deliverables only partially completed, Skills transfer was not always effective, Projects were not analysed to determine whether objectives were met and to determine the benefits received Performed when: problems are identified/requested International Standards of Supreme Audit Institutions (ISSA) 3000 and ISSAI 3001

11. The regularity audit - Timelines of audit cycle

12. Audit report structure Report on the financial statements • Introduction • Accounting officer/authority’s responsibility • Auditor-General’s responsibility • Opinion • Emphasis of matters (notes) • Additional matters (notes) Report on other legal and regulatory requirements • Predetermined objectives • Compliance with laws and regulations ( Treasury regulations, PFMA etc) Internal control • Leadership • Financial and performance management • Governance d) Other reports • Investigations • Performance audits • Agreed up procedures

13. Financial audit opinions four (4) Financial audit opinions financial statements give a true and fair view (or are presented fairly, in all material respects) in accordance with the applicable financial reporting framework. Audit report structure - opinions Unqualifiedwith findings on compliance and PDO Qualified departures from financial reporting framework, or limitation on scope which is not so material and pervasive (unqualified opinion cannot be expressed ) Disclaimer the auditor has NOT been able to obtain sufficient appropriate audit evidence to form an opinion (unable to express opinion) The auditor disagrees with the representation made by management in the financial statements to the extent of confirming that it’s not fair reflection of the financial position, performance and cash flow.(qualification of the report is not adequate to disclose the misleading or incomplete nature of the AFS) Adverse

14. Audit report structure - Audit of predetermined objectives

15. Audit report structure - Audit of predetermined objectives

16. Audit report structure - Good Administration / Clean audit

17. Good Administration / Best Practices – Key controls Best practices on how to achieve a good administration? • Matters reported by external and internal auditors should receive timeous management attention, internal controls should address the following key areas: • Leadership • Establish a culture of honesty, ethical business practices and good governance • Exercise oversight responsibility • Ensure effective human resource practices • Implement appropriate policies and procedures • Approve and monitor the implementation of action plans to address internal control deficiencies • Approve an appropriate information technology governance framework • Financial and performance management • Ensure proper record keeping of all transactions • Maintain effective controls over daily and monthly processing and reconciling of transactions • Produce regular, accurate and complete financial and performance (service delivery) reports • Review and monitor compliance with applicable legislation • Design and implement formal controls to mitigate information technology risks • Governance • Ensure that risks are periodically identified, assessed and effectively mitigated • Maintain an adequately resourced and functioning internal audit unit • Maintain an audit committee that performs its legislated duties and promote accountability and service delivery

18. Visibility of the AGSA beyond the mandate The AGSA provides the oversight committees in parliament and all legislatures with briefings on root causes and recommendations on corrective measures to improve audit outcomes before the entity hearings. The AGSA consults widely with the stakeholders in the executive and legislatures prior to tabling the General Reports that consolidate the audit outcomes of National, provincial and municipalities The General Reports are tabled in Parliament & Legislatures

19. THE ROLE OF OVERSIGHT

20. Oversight model OVERSIGHT: Parliament, provincial legislature or municipal council • Identify desired impacts Assess and Specify adjust performance indicators Monitor Set targets and take and allocate corrective action resources Policy development 1. Strategic Planning INSTITUTION National department Provincial department Municipality Public entity Municipal entity 2. Operational planning and budgeting 4. End-year reporting 3. Implementation and in-year reporting

22. AGSA contribution to oversight • Provide briefings to committees: • On audit reports before the portfolio committee compiles their BRRR (read with the annual report) • Update on progress of current year audits. Sharing of audit risks & status of key controls • Before the APPs is reviewed by the portfolio committee to discuss the findings identified from the pro-active audit of the PDOs of the department • Attend and provide clarity during public hearings • Road shows after tabling of the general report (PFMA & MFMA) • Regular follow-up on the progress of implementation of resolutions • Interactions with the chairpersons (possible quarterly) • Assist in building capacity of members via APAC.

23. Oversight – Key timelines Figure below illustrates the oversight cycle on an annual basis: The oversight cycle requires Parliament to take a long-term view of oversight in order to ensure effective oversight of sustainable delivery. The parliamentary oversight cycle provides a means through which Parliament can monitor government delivery in terms of long-term commitments, rather than focusing exclusively on annual commitments, annual planning and performance assessments. The cycle thus provides for continuity in Parliament’s oversight activities from year to year.

24. Combined assurance model Management assurance First level of assurance Oversight assurance Second level of assurance Independent assurance Third level of assurance Senior management Senior management Accounting officers/ authority Accounting officers/ authority Executive authority Coordinating / Monitoring institutions Internal audit Audit committee Oversight (portfolio committees / councils) Public accounts committee Required assurance levels Required assurance levels Required assurance levels Extensive Extensive Extensive Extensive Extensive Extensive Extensive Extensive • Management’s assurance role • Senior management– take immediate action to address specific recommendations and adhere to financial management and internal control systems • Accounting officers/ authority– hold officials accountable on implementation of internal controls and report progress quarterly and annually • Executive authority– monitor the progress of performance and enforce accountability and consequences • Oversight’s assurance role • National Treasury/ DPSA– monitor compliance with laws and regulations and enforce appropriate action • Internal audit– follow up on management’s actions to address specific recommendations and conduct own audits on the key focus areas in the internal control environment and report on quarterly progress • Audit committee– monitor risks andthe implementation of commitments on corrective action made by management as well as quarterly progress on the action plans • Role of independent assurance • Oversight (portfolio committees)– review and monitor quarterly progress on the implementation of action plans to address deficiencies • Public accounts committee– exercise specific oversight on a regular basis on any report which it may deem necessary

25. BRIEFING PROCESS

26. Annual Report including Audit Report & Performance Report AGSA Briefing Notes State of the Nation Address/Budget speeches TOOLS Accounting officer and audit committee ’s Reports • Estimates of National Expenditure Briefing process - tools

27. Briefing process • Reliable, accurate and complete Annual Reports by entities • AGSA review of annual reports critical in ensuring complete, reliable and accurate reporting - Oversight committees must obtain an understanding of the entity - The Annual Report of the entity must be studied prior to the briefing and hearing • - AGSA briefing of Root causes of audit outcomes • - Root causes are linked to the Key Focus Areas • Analysis and understanding of the Root causes of the audit outcomes by oversight • AGSA make recommendations to oversight in addressing the deficiencies reported • Oversight committees issues their findings and must make recommendations which address the deficiencies identified by way of resolutions • Recommendations must have milestones and conform to the “SMART” principles • Send reports to executives for implementation. • Entities must compile an action plan to address the deficiencies • Action plans must have deliverable milestones and also conform to the “SMART” principles • Progress on implementation of action plan and measures to improve the audit outcomes must be reported to oversight for monitoring. Reporting by departments and entities Understanding Mandate of entities by Oversight Actual Briefing process Recommend-actions by oversight committees Action plans by entities and progress monitoring EFFECTIVE BRIEFING PROCESS

28. Acts applicable

29. THANK YOU