ISSAI 4000: Issues coming out of the maintenance groups

1. ISSAI 4000:Issuescomingoutofthemaintenancegroups Mona Paulsrud CAS meeting, Oslo 17th of September 2014

2. Workahead December 2014: ISSAI 4000 draft for comments in PSC steeringcommittee May 2015: ISSAI 4000 exposure draft to the PSC steeringcommittee August- October 2015: ISSAI 4000 exposureperiod May 2016: ISSAI 4000 endorsementversion to the PSC steeringcommittee October 2016: ISSAI 4000 endorsement at INCOSAI, Abu Dhabi

3. Furtherprocesson ISSAI 4000 draft 15th ofOctober: Deadline for comments and proposalsonlanguage and style 31st ofOctober: Deadaline for comments and proposalsonsubstance and contents

4. Prerequisites from ISSAI 100/400 Processorientedapproach Risk basedauditing Professional judgement & skepticism Coveringthevarietyofcomplianceauditpracticesacross INTOSAI Bothdirectreporting and attestationengagements

5. ComplianceAuditSubject Matters

6. …theauthoritieswhichgovernthem “Relevant acts or resolutions of the legislature or other statutory instruments, directions and guidance issued by public sector bodies with powers provided for in statute, with which the audited entity is expected to comply.”

7. Authorities - thesourcesofauditcriteria Authorities Criteria

8. Narrowingdowntheauditscope..

9. Authorities in two forms GREY ZONE OF INTERPRETATION

10. How to drawthe line.. REGULARITY PROPRIETY General principles of sound public sector financial management and conduct of public sector officials. The concept that the subject matter is in accordance with authorizing legislation, regulations issued under governing legislation and other relevant legal documents which lay down the rules and procedures to be adhered to by the audited entity which provide a legal framework within which the subject matter is being exercised, and these are properly sanctioned.

11. Issuesraised • Doesthe spirit or intentionoflaws and regulationsbelong to regularity or propriety? • A codeofconduct or ethics – would it belong to regularity or propriety? • Are fraud risks generallylinked to breachofpropriety?

12. Assurance

13. Assurance Intended users wish to be confident about the reliability and relevance of the information which they use as the basis for taking decisions. Audits therefore provide information based on sufficient and appropriate evidence, and auditors should perform procedures to reduce or manage the risk of reaching inappropriate conclusions. The level of assurance that can be provided to the intended user should be communicated in a transparent way. However, due to inherent limitations, audits can never provide absolute assurance. ISSAI 100 paragraph 31

14. The coreofassurance Is theauditevidenceobtainedsufficient and appropriate so as to reducetheaudit risk to an acceptablylowlevel? Reconsidering:

15. Communicatingassurance Depending on the audit and the users’ needs, assurance can be communicated - through opinions and conclusions which explicitly convey the level of assurance. ISSAI 100 para. 32

16. Opinion and conclusion – what is thedifference? The conclusion is a statement of the auditor covering the audit scope on the basis of the findings assessed against the criteria and conveying explicitly the level of assurance of the audit. NEW ISSAI 4000 para. 158 - 160 An opinion is a statment of the auditor expressed in a standardized form of a clear written expression of modification or unmodification. NEW ISSAI 4000 para. 161-166

17. Issuesraised • Is an opinion only relevant in attestationengagements? – NO • Is an opinion only given in relation to thefinancial statements? – NO • Can an opinion only be given onquantitativesubject matters? - NO

18. Opinion and conclusion – what is thedifference? “The conclusion may be expressed as an elaborate answer to specific audit questions or take the form of a clear written statement of opinion on compliance, often in addition to the opinion on the financial statements. While an opinion is common in attestation engagements, the answering of specific audit questions is more often used in direct reporting engagements.” NEW ISSAI 4000 para. 160

19. Opinion and conclusion – what is thedifference? “Where an opinion is provided the auditor states whether it is unmodified or has been modified on the basis of the evaluation of materiality and pervasiveness. Delivering an opinion would normally require a more elaborate audit strategy and approach that encompasses a tangible population covered both by quantitative and qualitative sampling during the audit.” NEW ISSAI 4000 para. 163

20. Opinion and conclusion – what is thedifference? ISSAI 4000 para. 158 - 160 ISSAI 4000 para. 161- 166 Opinion ISSAI 4000 para. 137-141

21. Audit sampling

22. ISSAI 4000 – in needoffurtherelaboration? • Materiality • Reasonable and limitedassurance • Auditscope • Subject matter and criteria in relation to directreporting and attestationengagements • Understandingtheentity

23. ISSAI 4000 – in needoffurtherelaboration? (continuing) • Control environment/ intrenalcontrols • Risk of non compliance • Documentation • Combinations ofcompliancewithfinancial and/or performanceauditing

24. ISSAI 4000 – theneed for furtherelaborations? Prioritizations and furtherworkofthecommittee.