14 th PASAI Congress ISSAI Workshop

1. 14th PASAI CongressISSAI Workshop Sarah Lineham Assistant Secretary-General – PASAI, Sector Manager NZ OAG August 2011 Image here

2. Background ISSAI = International Standard of Supreme Audit Institutions • ISSAIs are the professional standards governing public sector auditing • Developed by the INTOSAI Professional Standards Committee • Endorsed at XX INCOSAI in South Africa in 2010 • Based on the framework for SAIs and the purpose of public sector auditing set out in the Lima Declaration of Guidelines on Auditing Precepts 1977

3. The ISSAI Framework • Level 1 – Founding Principles • Level 2 – Prerequisites for the Functioning of SAIs • Level 3 – Fundamental Auditing Principles • Level 4 – Auditing Guidelines

4. Level 2 – Prerequisites for the Functioning of SAIs • ISSAI 10 – Mexico Declaration on SAI independence • ISSAI 11 – Guidelines and Good Practices related to SAI Independence • ISSAI 20 – Principles of transparency and accountability • ISSAI 21 – Principles of transparency and accountability – Principles and Good Practices • ISSAI 30 – Code of Ethics • ISSAI 40 – Quality Control for SAIs

5. ISSAI 10 – Mexico Declaration on Independence • Based on the Auditing Principles of the Lima Declaration • Contains eight core principles recognised to be essential requirements of proper public sector auditing • Requires SAIs to protect the value of their work by adding proper safeguards and removing real and perceived barriers to their independence • ISSAI 11 provides good practice examples to support the 8 principles of ISSAI 10 shared as a means of increasing and improving SAI independence

6. ISSAI 10 – Mexico Declaration on Independence • Summary of the eight core Principles • 1 An appropriate and effective constitutional/statutory/legal framework • 2 Independence of SAI heads and members • 3 Sufficiently broad mandate and discretion to discharge functions • 4 Unrestricted access to information • 5 The right and obligation to report on work • 6 The freedom to decide content and timing of audit reports and to publish and disseminate them • 7 Existence of effective follow up mechanisms on SAI recommendations • 8 Financial and administrative autonomy and availability of appropriate resources

7. ISSAI 10 – Mexico Declaration on Independence • ISSAI 10 Checklist • Legislation spells out the extent of SAI independence required by ISSAI 10. • If legislative framework does not establish sufficient independence to meet this standard, have you developed practices to ensure as much distance as possible is maintained between the SAI and the Executive. • Legislation specifies conditions of appointment, re-appointment, removal and retirement. • Legislation includes immunity from prosecution in relation to acts in the normal discharge of duties. YES/NOYES/NOYES/NO YES/NO

8. ISSAI 10 – Mexico Declaration on Independence YES/NOYES/NOYES/NO YES/NO • ISSAI 10 Checklist • Your SAI has an approved broad mandate and full discretion to discharge functions. • Your SAI is not involved or appearing to be involved in the management of the organisations you audit. • Do you have systems in place to ensure personnel do not develop too close a relationship with the entities they audit such as rotation policies and personnel independence declaration systems. • Does the SAI complete an annual activity report to the Legislature that is also made public.

9. ISSAI 10 – Mexico Declaration on Independence YES/NOYES/NOYES/NO YES/NO • ISSAI 10 Checklist • Is the importance of independence emphasised to SAI staff through training courses and other mechanisms that embed its importance into the organisation’s culture. • Does the SAI have adequate powers to obtain timely, unfettered, direct and free access to all necessary documents and information. • There are no restrictions on the reporting of the results of the SAI’s audit work. • Are the results of audits required by law to be reported at least once a year.

10. ISSAI 10 – Mexico Declaration on Independence YES/NO YES/NOYES/NOYES/NO YES/NO • ISSAI 10 Checklist • Is the SAI free to decide the content and timing of audit reports. • Is the SAI free to publish and disseminate their reports once they have been tabled. • Does the Legislature have a review and follow up system for audit recommendations. • Does the SAI have a review and follow up system to ensure audited entities properly address recommendations. • Does the SAI have the necessary resources and ability to control its own budget.

11. ISSAI 20 – Principles of Transparency and Accountability • The purpose of ISSAI 20 is to advance principles of transparency and accountability by leading by example in their own governance and practices. • Contains nine principles recognised to be essential requirements of proper public sector auditing. • A major challenge facing SAIs is to promote better understanding of their roles in society, to achieve this work practices, activities and products should be transparent, communicated openly and visible in the public arena. • ISSAI 21 provides good practice examples to support the nine principles of ISSAI 20 shared as a means of leading SAIs towards the goal of transparency and accountability.

12. ISSAI 20 – Principles of Transparency and Accountability • Summary of the nine Principles • 1 SAIs perform their duties under a legal framework that provides for accountability and transparency • 2 The mandate, responsibilities, mission and strategy of the SAI are made public • 3 SAIs adopt audit standards, processes and methods that are objective and transparent • 4 SAIs apply a high standard of integrity and ethics for staff at all levels • 5 Principles of accountability and transparency are also applied for outsourced activity • 6 SAIs manage their operations economically, efficiently, effectively and in accordance with laws and regulations and reports publicly • 7 SAIs report publicly on the results of their audits and on conclusions regarding overall government activities • 8 SAIs communicate timely and widely on their activities • 9 SAIs make use of external and independent advice to enhance their quality and credibility

13. ISSAI 20 – Principles of Transparency and Accountability YES/NO YES/NOYES/NOYES/NO YES/NO • ISSAI 20 Checklist • Does the legislation and regulation guiding your SAI include terms on which you can be held responsible and accountable. • Does the SAI make publicly available the legislation under which it operates, such as on your website. • Does the SAI make publicly available details of mandate, responsibilities, mission and current strategy. • Has the SAI adopted audit standards, processes and methods that align to INTOSAI standards. • Does the SAI routinely communicate the scope of audit activities, the basis of their risk assessment and planning processes, audit objectives, methodologies, and findings to audit entities.

14. ISSAI 20 – Principles of Transparency and Accountability YES/NO YES/NOYES/NOYES/NO YES/NO • ISSAI 20 Checklist • Does the SAI provide audit findings and recommendations to the entity for comment and discussion. • Does the SAI have effective follow up mechanisms to assess action taken in response to recommendations including entity explanation of corrective actions. • Does the SAI have an appropriate system of quality assurance over audit activities, is this system subject to periodic independent review. • Are the results of periodic independent practice reviews published. • Does the SAI have processes in place to maintain alignment of audit methodologies and internal auditing guidance with INTOSAI standards.

15. ISSAI 20 – Principles of Transparency and Accountability YES/NO YES/NOYES/NOYES/NO YES/NO • ISSAI 20 Checklist • Does the SAI have ethical codes, policies and practices in place. • Does the SAI have a system in place to monitor and document potential conflicts of interest between staff and audited entities. • If the SAI outsources any work does it have contracting rules to ensure principles of accountability and transparency are maintained. • Does the SAI have sound internal management practices in place, including internal controls over its financial management and operations. • Are your SAI financial statements audited in a timely manner, do you measure and report on SAI operational efficiency and effectiveness.

16. ISSAI 20 – Principles of Transparency and Accountability YES/NO YES/NOYES/NO YES/NO YES/NO • ISSAI 20 Checklist • Does the SAI make public their conclusions and results from audits. • Does the SAI maintain a strong relationship with relevant parliamentary committees, such as through regular formal and informal meetings with chairs. • Does the SAI have a process to communicate openly with the media and other interested parties on their operations and audit results. • Are SAI reports available on SAI website. • Does the SAI use external experts to provide independent expert advice on technical matters, for reviews of its operations/peer reviews.

17. ISSAI 30 – Code of Ethics • The Code of Ethics is a comprehensive statement of the values and principles that should guide the daily work of auditors. • The Lima Declaration of Guidelines on Auditing Precepts is the foundation of the Code of Ethics. • Each SAI must develop its own Code of Ethics which best fits its environment. • Contains five chapters covering the key concepts of fundamental importance for ethical behaviour.

18. ISSAI 30 – Code of Ethics • Summary of the five Chapters of the Code of Ethics • 1 Trust, confidence and Credibility • 2 Integrity • 3 Independence, Objectivity and Impartiality, including political neutrality and conflicts of interest • 4 Professional Secrecy • 5 Competence, including Professional Development

19. ISSAI 30 – Code of Ethics YES/NO YES/NOYES/NO YES/NO YES/NO • ISSAI 30 Checklist • Has the SAI adopted a Code of Ethics. • Is the SAI confident that all staff are acquainted with the adopted Code of Ethics and are held accountable for acting accordingly. • Does the SAI have systems in place to act on breaches of the Code of Ethics. • Has training on the behaviours and cultures required by the Code of Ethics been provided to all staff within the past year. • Do SAI staff understand the importance of independence and impartiality, not only in fact, but also in appearance.

20. ISSAI 30 – Code of Ethics YES/NO YES/NOYES/NO YES/NO YES/NO YES/NO • ISSAI 30 Checklist • Are all staff of the SAI maintaining both actual and perceived political neutrality. • Does the SAI have a system to monitor the receipt of gifts and gratuities. • Does the SAI have a system to manage any relationships between staff and audited entities. • Have staff been trained on the importance of protecting the confidentiality of information obtained in the auditing process. • Do SAI staff have a good understanding of the legal, constitutional, legal and institutional principles and standards governing the operations of all audited entities. • Are all SAI staff meeting the continuous obligation to update and improve the skills required to discharge their professional responsibilities.

21. ISSAI 40 – Quality Control for SAIs • ISSAI 40 is designed to assist SAIs to establish and maintain an appropriate system of quality control which covers all their work • For a system of quality control to be effective it must be part of a SAI’s strategy, culture and policy and procedures, so that quality is built into all the work the SAI does • Based on the key principles of the International Standard on Quality Control ISQC 1 adapted for SAIs as necessary • Guidelines on quality control at an individual engagement level are contained in the Level 4 ISSAIs • ISSAI 40 sets out 6 elements of a quality control system

22. ISSAI 40 – Quality Control for SAIs • Summary of the six elements of the Quality Control Framework • 1 Leadership responsibilities for quality within the SAI • 2 Relevant ethical requirements • 3 Acceptance and continuance • 4 Human resources • 5 Performance of audits and other work • 6 Monitoring

23. ISSAI 40 – Quality Control for SAIs YES/NO YES/NO YES/NO YES/NO YES/NO • ISSAI 40 Checklist • Does the SAI have a documented formal system of quality control that has been communicated to all staff. • Does the SAI have policies and procedures designed to promote an internal culture that recognises quality is essential in performing all of its work. • Have you as Head of the SAI taken specific steps to set a “tone at the top” that emphasises the importance of quality. • Does the SAI have sufficient resources to maintain the system of quality control within the SAI. • Does the SAI have procedures in place which emphasise the importance of meeting ethical requirements, are these requirements being demonstrated by senior staff in particular.

24. ISSAI 40 – Quality Control for SAIs YES/NO YES/NO YES/NO YES/NO YES/NO • ISSAI 40 Checklist • Does the SAI have systems to consider the risks to quality which arise from carrying out particular work. • Does the SAI have a system to prioritise work in a way that takes into account the need to maintain quality. • Does the SAI have procedures for the acceptance and continuance of discretionary work. • Does the SAI have a regular process that it uses to assess whether it has sufficient competent and capable staff, with commitment to ethical principles to carry out its work to relevant standards. • Is the SAI active in promoting the importance of learning and training to encourage staff professional development.

25. ISSAI 40 – Quality Control for SAIs YES/NO YES/NOYES/NOYES/NO YES/NO YES/NO YES/NO • ISSAI 40 Checklist • Does the SAI have policies and procedures in place that provide reasonable assurance that work is carried out in accordance with relevant standards. • Are supervision and review responsibilities clearly documented. • Are audits completed and documented in a timely manner. • Are documents retained for the periods specified in laws, regulations, professional standards and guidelines. • Does the SAI have a system to monitor the effectiveness of the system of quality control. • Has an independent review of the overall system of quality control been completed recently. • Does the SAI have procedures for dealing with complaints or allegations about the quality of work performed by the SAI.

26. Time for reflection • What are your SAI’s areas of strength? • How can you share your strengths to assist the development of other PASAI members? • What are the areas of weakness for your SAI? • What are your priorities for addressing areas of weakness?