Presented by: Richard Allen, World Bank

1. Keeping on Track: Internal Control and Internal Audit Public Expenditure & Financial Accountability Course November 5, 2003 Presented by: Richard Allen, World Bank

2. Internal Control and Internal Audit Control systems involve: Internal Control & Audit Identification of Risk Development of Internal Audit Development of Internal Controls 2

3. Risks Going off the rail -- risks Lack of timely and reliable financial and resource management information Misuse and waste of financial, human and technical resources, including external aid Fraud and error Unsatisfactory accounting records 3

4. 1 2 Internal Control & Internal Audit: Professional Standards INTOSAI Guidelines for Internal Control Standards Standards for the Professional Practice of Internal Auditing 4 See: INTOSAI at http://www.intosai.org/ and IIA at http://www.theiia.org/

5. Definition of Internal Control • The reliability and integrity of information • Compliance with policies, plans, procedures, laws and regulations • The safeguarding of assets • The economical and efficient use of resources • The accomplishment of established objectives and goals of operations and programs A process within an organization to provide reasonable assurance regarding the following primary objectives: Definition of Internal Control: “Internal control is a management tool … the organization, policies and procedures used to help ensure that government programs achieve their intended results; that the resources used to deliver these programs are consistent with the stated aims and objectives of the organizations concerned; that programs are protected from waste, fraud and mismanagement; and that reliable and timely information is obtained, maintained, reported and used for decision making.” -- INTOSAI, Guidelines for Internal Control, June 1992 5 Source: The Institute of Internal Auditors

6. Key Concepts of Internal Control Internal control is … … a process … affected by people. It’s not merely policy manuals and procedures, but people at every level of the organization … can be expected to provide only reasonable assurance, not absolute assurance to an entities’ management & stakeholders … geared to the achievement of objectives 6 Source: Committee of Sponsoring Organizations of the Treadway Commission (COSO)

7. Importance of Internal Control in Government The average Ministry has a number of responsibilities (committing funds, recruiting staff, contracting for supplies and services, approving actions, registering transactions and events, deploying resources and controlling, supervising and reporting on implementation of policies). If these responsibilities are fulfilled properly, the result will be effective control over resources, decisions and activities and the achievement of ministry objectives. Ministries If not, abuses will proliferate and efficiency decline. 7

8. Two Principles of Internal Control Governing bodies of public sector entities need to ensure that a framework of control is established and operates in practice and that a statement on its effectiveness is included in the entity’s annual report. Governing bodies of public bodies need to ensure that effective systems of risk management are established as part of the framework of internal control. 8 Source: IFAC, Corporate Governance in the Public Sector, 2000

9. Control Procedures • Clear instructions to staff and appropriate training on the objectives, policies and code of conduct of the ministry or agency • An unambiguous definition of the responsibilities of staff • Clear separation of function and duties between staff members in handling financial transactions or resources issues, e.g., contracts • Development of an “open” culture to encourage staff at all levels to draw attention to non-compliance and irregularity • Requirements that staff at all levels are aware of and apply all relevant instructions • Support from effective internal audit procedures Procedures 9

10. Role of the Ministry of Finance 2. To ensure that the regulations are complied with spending ministries (internal audit) 1. To establish a framework of regulations and operational standards and guidelines, on internal control, for spending ministries 3. In Francophone countries: To participate in the exercise of internal control in spending ministries* Ministry of Finance * Note: In some Anglophone countries also, officials who perform the internal control function in spending ministries are employees of the internal audit department of the Ministry of Finance (e.g., Kenya, Uganda, Malawi) 10

11. Francophone System of Internal Control Four Stages: Controleur financier (MoF) Checks regularity and conformity of commitment against budget appropriations Ordonnateur (Commitment Officer) Issues a payment order to the Treasury Issues a second visa (approval) to make commitment legally binding Controleur financier Treasury Accountant (Directeur de la Comptabilite Publique) Makes the payment 11

12. Categories of Internal Control Procurement Controls: e.g., rules for advertising and tendering major contracts Physical: e.g., security procedures intended to control access to documents and records Accounting Controls: e.g., requirement for all cash receipts to be deposited daily in a bank, internal procedures to detect and report anomalies Separation of Duties: Both a control measure and an indispensable element of many control systems – at least two officials should be involved in any transaction to avoid risk of improper actions Process Controls: e.g., issuance of a purchase order or the approval of a sizeable contract may require documentation from the requesting official, review by a purchasing clerk, and approval by a supervisor Management of Financial & Other Records: Essential to establish audit trail 12

13. Limitations of Internal Control No system of internal control can provide an absolute guarantee against the risk of wronging or error. The proper goal of internal control is to provide “reasonable assurance” that improprieties will not occur, or if they do occur, they will be revealed, reported and appropriate action taken. Wrongdoing by top managers Collusion Poor response to reported anomalies Poor implementation Design flaws 13

14. Definition of Internal Audit Internal Audit Definition of Internal Audit: “Internal auditing is an independent, objective, assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve effectiveness of risk management, control, and governance processes.” 14 Source: The Institute of Internal Auditors

15. Internal Audit – Different Approaches • In the Anglophone tradition, internal audit is usually reflected in internal audit units of individual ministries or agencies, reporting directly to top management • Mixed internal/external audit systems, • Germany: internal audit is part of the Federal Court of Audit (external) • US: Inspector General of each agency reports to agency management and to the Congress • Most Francophone countries have an internal audit unit – L’Inspection des Finances – located in the Ministry of Finance • Generally have wide powers of inspection and review, and in many cases a prosecutorial role • Some Anglophone countries also have an inspection department in the MoF, with similar powers Note: There are many different models in developing countries, e.g., Anglophone Africa, Francophone Africa, Latin America (Controloria), FSU countries, former SFR Yugoslavia. See: J. Diamond, “The Role of Internal Audit in Government Financial Management: An International Perspective”, IMF Working Paper, WP/02/94. 15

16. What does the Internal Auditor Look For? Procurement Systems & Procedures In the procurement field, has there been adequate publicity for calls to tender, are there satisfactory procedures for receiving and evaluating tenders, is the justification for contract awards in accordance with national requirements? How well do the systems and procedures of internal control function? Resource use Achievement of Objectives Are the systems and procedures in place to ensure that resources are used in accordance with the relevant rules and regulations? Have programs and actions achieved their intended objectives? 16

17. Audit Trail • An audit trail is necessary to keep under review the timely and adequate flow of funds and the procedures for efficient accounting and the reconciliation of expenditure reports with funds received or claimed. It is necessary to trace or check: To trace and evaluate the systems and procedures through which approval for payment to the contractor or beneficiary will be required to pass To check the transfer of funds authorized by the treasury to the line ministry or agency To locate completed payment files with evidence that payment has, or has not, been made in accordance with rules and regulations To trace the budget provision that authorized payment 17

18. Reforming Internal Audit in Developing & Transitional Countries “The overall design of the IA function should be geared to the specific priorities of a country. For those countries with governance problems, the first and foremost objective should be to ensure compliance with the financial laws and regulations. For those developing and transitional economies faced with a high degree of fiscal stress, the need to ensure macroeconomic objectives will be paramount. For those countries that can ensure compliance with the law and have reached a fair degree of macro-economic stability, more attention can be paid to ensuring efficiency and effectiveness of resource use, as currently emphasized in the OECD countries.” “A fundamental design issue that usually has to be faced is the degree of centralization in the organization of the IA function … The centralized approach has often been viewed as better from a capacity building viewpoint. However, disadvantages of centralization are also evident, namely … weakening accountability of line ministry management, limited effectiveness because of weak transparency, and failure to foster close cooperation with other departments.” Source: J. Diamond, “The Role of Internal Audit in Government Financial Management: An International Perspective,” IMF Working Paper, WP/02/94. 18

19. Duties and Responsibilities of Internal Audit • Reviewing the compliance with the existing Government financial regulations • Evaluating the effectiveness of the Internal Control Systems. • Appraising the economy and effectiveness with which financial and other resources are being used. • Reviewing the reliability and integrity of record keeping and reporting on financial and operating information systems. • Pre-audit of payments documents and of all documents used in initiating commitments, as well as contract agreements. • Verifying and certifying periodical financial returns such as pending bills returns, expenditure returns, revenue returns, staff returns, vehicle returns, etc. • Investigation of irregularities identified or reported and reporting on cases leading to wastage of resources cases of general misuse or misappropriation of financial resources and Government property. • Ensuring that revenue and other receipts collection points, projects, supply, and delivery sites to ensure compliance with procedures and regulations. • Reviewing budgetary controls on issuance of warrants, commitments, expenditures, revenue collection, and accounting from time to time. • Ensuring that government physical assets are appropriately recorded and are kept under safe custody. • Reviewing the budgetary reallocation process to ensure legislative and administrative compliance and advising when commitments are entered into when there is no budgetary provision or adequate cash. 19 Source: J. Diamond, “The Role of Internal Audit in Government Financial Management: An International Perspective,” IMF Working Paper, WP/02/94.

20. Recommended Coordination Between Internal & External Audit • There should be proper coordination to ensure adequate audit coverage and to minimize duplication of effort. • There should be access to each other’s audit plans and programs. • Periodic meetings should be organized to discuss matters of mutual interest. • There should be an exchange of audit reports. • Institutional mechanisms should be created to ensure common understanding and sharing of audit techniques and methods. • Sharing of training and exchange of staff for two-three years in each case. • The external auditor should review the performance of internal auditors (I.e., are they performing according to their objectives and plans?). A quality assessment of their work should be included. • The external auditor should strengthen the position of the IA by reviewing and commenting on lack of action on IA reports. 20 Source: J. Diamond, “The Role of Internal Audit in Government Financial Management: An International Perspective,” IMF Working Paper, WP/02/94.

21. Case Study Country X – What to Do? • Facts • The Ministry of Finance has Financial Inspectors in line ministries with theoretical authority to audit expenditures. But in practice, they have limited power to override/amend spending decisions taken by ministers. • There is no internal audit system in the government, either in the MOF or in line agencies. • Cash distributions through the treasury are made by the central bank, and are thus not under the control of the Ministry of Finance. • The government is decentralizing fiscal authority to governorates and districts, but has no current plans to establish appropriate control and audit arrangements. • Most government financial transactions are paper-based. The Bank is providing $12 million to finance the first phase of a integrated financial management information system (IFMIS) but there is limited “buy-in from the MOF. • The civil service is overstaffed, underpaid, incentives are weak and appointments/promotions to senior positions are politically determined. • There is widespread corruption on all levels of the administration, and weak management controls. • The external audit authority and the parliament exert no effective oversight of public financial management. How should the Bank advise the Government to establish a more effective system of internal control and audit? 21