Topic : Value adding audit committee reports THE ANNUAL INTERNAL AUDIT CONFERENCE DATE: 8th -11th NOVEMBER 2016 VENUE: - WILD WATERS, MOMBASA THEME: “Internal Audit as an enabler of Business" Topic : Value adding audit committee reports Presenter: Griffine Songole , CIA, CFA (EA), CPA(K). Director- Internal Audit & Risk Management Services, Nairobi City Water &Sewerage Co. Ltd

Session Outline Introduction………………………………….......…….3-4 Examples of Audit Committee reports………………………….5 Key issues that must be covered in the Audit Committee reports…………..6- 8 Quality Audit Committee reports…………………………..….9-11 Timely submission of the Audit Committee reports………………………………….........................................12 Other considerations………………………………………………13 Questions……………………………………………………………………….14

Introduction Audit committee!! Who are they “Audit committee is a selected number of members of a company's board of directors whose responsibilities include helping auditors remain independent of management. The committee provides independent review and oversight of a company's financial reporting processes, internal controls and independent auditors.” www.investopedia.com Other roles of the Committee may include-oversight on corporate governance and risk management.

Introduction….  The role of audit is currently under heightened scrutiny. The unprecedented global financial upheaval which has also been witnessed within the key sectors in Kenyan economy has increased stakeholders questions on the value of audit in public institutions.

Examples of Audit Committee reports Special Investigations and reviews Implementation status report of Enterprise Risk Management mitigation/control strategies Implementation status report of the Board and the committees resolutions Internal audit reports based on the approved annual internal audit plan .Implementation status report for all reviews undertaken by external consultants (EACC, EY, Deloitte) Follow up audit reviews for previous years- audit recommendations Summary examples

Key issues to be covered in Audit Committee reports State the overall rating of the reviewed business process control environment. Summary of findings – in tabular form with the corresponding impact rating. Clear review objectives and recommendations. Clear timeframe to implement the agreed corrective action/way forward and the responsible business owner. The implementation status of the previous audit recommendations for similar assignments. Kindly refer to the next slide . Specific example

Key issues to be covered in Audit Committee reports Key issues to be covered in Audit Committee reports...(summary implementation status) Status of recommendations Section Ref. No. of Audit Findings Percentage %   Fully Implemented 6.1 3 17% Partially Implemented 6.2 11 61% Not Implemented 6.3 4 22% Total no of recommendations 18 100%

Key issues to be covered in Audit Committee reports Key issues to be covered in Audit Committee reports...(example of implementation status) Ref No Summary audit findings Details on how recommendations have been implemented Internal Audit Comments 4.1 Customer payments received from Agents do not reflect in the Customer Management System   There are instance where some transactions are not updated in the customer accounts despite having the correct account details. During the period January to June 2012, 284no transactions totalling Kshs 1,196,573.25 were not reflected in the respective customers’ accounts. The department instituted a reconciliation process for all the previous un-reconciled items. However the reconciliation process for the current period shall be undertaken daily and any omissions noted shall be addressed immediately. Similar cases have been observed and highlighted in current audit (Reference no 5.3).

Quality Audit Committee reports Use of reasonable business language /terms e.g. documentation/support documents, powerful /qualified, do or make/prepare, British accounts/BAT accounts, picked/selected or appointed, keep records/maintain records, done/carried out, details on appendix X or see appendix X/please or kindly refer to appendix X for details. Use of short and clear sentence e.g. The request to review British American Tobacco ltd accounts was made by the Internal Audit and Risk Management Director on 13th January 2016 based on a contentious bill on account no 2382276 of Kshs 33,609,528.4. (The request to review British American Tobacco ltd accounts was made by the Internal Audit and Risk Management Director on 13th January 2016. This was as a result of a contentious bill on account no 2382276 of Kshs 33,609,528.4).    

Quality Audit Committee reports Clarity in risk identification e.g. theft of information/loss or unauthorized disclosure of confidential information. Clear finding and recommendations.

Quality Audit Committee reports (example of an audit finding) Duplicated agency customer payments There were 567no agency customers’ payments duplicated in customer accounts amounting to Kshs.1,547,058 for the period February-November 2015 reviewed (See Schedule B).   Risks Understatement of customer outstanding balance which may lead to revenue loss. Inaccurate financial reporting. Recommendations Reverse all the duplicated transactions and identify all other duplicate transactions that are outside the scope of this review and reverse them accordingly. Reconciliation between CMS, agent soft copy files and bank statements should be done regularly. As a long term solution, the system should be enhanced to be able to detect duplicate transactions. Management comments:

Timely submission of the Audit Committee reports Reports for audit committee discussion /meeting must be submitted within the set timeframe as provided in the board charter. This allows the committee sufficient time to study and review in preparation for a fruitful meeting. In the case of Nairobi City Water, the agenda notice and the relevant support reports are supposed to be submitted to the committee 10 days before the date of the meeting. Kindly refer to attached example-agenda notices

Other KEY considerations Value adding reviews-Examples-fraudulent cheques , medical scheme management and kirigiti water improvement reviews. Strategic reviews/to meet business objectives-Board & Committee resolutions ,EACC & forensic reports recommendations implementations. Banking hall cheque and cash collections reviews and the key integrity issues not covered in daily operations reports & reconciliations. Project risk assessments requirements. Matters arising- reporting template for key resolutions. Pitfalls or challenges in relations to Audit Committee members expectations. How management or board perceive the value of internal audit. Salient secrets in preparing Audit Committee reports .

THANK YOU QUESTIONS Griffins Songole , CIA, CFA (EA), CPA(K). Head of Internal Audit ,Nairobi Water &Sewerage Co. Ltd