Office of the Auditor General of Norway 14th CAS meeting in New Delhi What happened between the CAS meeting in Beijing 2015 and the CAS meeting in New Delhi 2017 Ingvild Gulbrandsen Office of the Auditor General of Norway 14th CAS meeting in New Delhi 20-21. February 2017

The History of the Compliance Audit Subcommittee 2004 - 2017 2004 the starting point, and the planning for the first meeting in the INTOSAI ASC working group on Compliance Audit started 2005 the first meeting in INTOSAI ASC working group on Compliance Audit was held in Oslo in March as a host and chair The members at that time were: Argentina, Denmark, India, Namibia, Norway, Saudi Arabia, Slovakia, Sweden, Tunisia and Ukraine (10).

CAS in 2017 2017 India has taking over the chairmanship of the Compliance Audit Subcommittee The CAS committee has 18 members from different regions and with different types of organizations, including several operating in a court environment. CAS-member SAIs 2016 are : Brazil, China, the European Court of Auditors, France, Georgia, Hungary, India, Lithuania, Mexico, Namibia, Norway, Portugal, Romania, Saudi Arabia, Slovakia, South Africa, the Republic of Azerbaijan and Tunisia. IDI and AFROSAI-E has status as observers.

From guidelines and principles to a standard 2010 – Guidelines ISSAI 4000, 4100 and 4200 endorsed at INCOSAI in South Africa 2013 – Fundamental Principles of Compliance Auditing, ISSAI 400 endorsed at INCOSAI in China 2016 – The standard ISSAI 4000 endorsed at INCOSAI in United Arab Emirates

Compliance Audit Standard Abu Dhabi, United Arab Emirates ISSAI 4000 Compliance Audit Standard Ingvild Gulbrandsen INCOSAI Abu Dhabi, United Arab Emirates 8. December 2017

ISSAI 4000 – One Standard in Compliance Audit Based on the Fundamental Principles in ISSAI 100/400 Requirements (shall) followed by explanations The different parts of ISSAI 4000 must be seen together, to accomplish a high quality audit

ISSAI 4000 – One Standard in Compliance Audit One document with common concepts and a common process for all SAIs will hopefully provide a fruitful environment for sharing experiance and learning from eachother

ISSAI 4000 – One Standard in Compliance Audit

What we said in Beijing in 2015 Professional standards have no value unless they are implemented, and used by the auditors and their leaders in their day to day work.

Implementation work done by IDI and Afrosai-E with a helping hand from CAS Handbook in Compliance Audit iCAT development and use of the tool in PASAI, ASOSAI and ARABOSAI 10 SAIs in PASAI doing there first compliance audit within procurement AFROSAI-E developing their own manual in Compliance Audit (CAM), followed by a pilot workshop on implementation of ISSAI 4000 where 7 SAIs will do compliance audits within different subject matters

Challenges in understanding and using these concepts Authorities and crieria Subject matter and subject matter information Assurance Compliance audit Authorities that govern them – vanskelig å forstå delegasjonssystemet i sentralforvaltningen. Criteria and their sources, folk har problemer med å forstå at kriteriene skal utledes og at man ikke bare skal henvise til en lov og dens paragrafer. Hva skal de egentlig revidere. Hva er subject matter information. Dette klarer mange ikke å skille. Three parties er viktig. Er man ikke klar over hvem det er, og diskuterer det, kan man henge bjella på feil ku. Assurance, forholdet mellom limited og reasonable er uklart. Three parties

Do you asses the criteria against these characteristicks ISSAI 4000/118? Relevant Reliable Complete Neutral Criteria Comparable Available Acceptable Understandable

ISSAI 100/18, an audit is a systematic process, but how Is the subject matter material and based on risk The audit objective, is it clear and understood The criteria, which authoriteis are they deduced from The audit question(s), are they linked to the criteria The audit evidences, are they sufficient and appropriate

ISSAI 100/18, an audit is a systematic process, but how cont. The audit findings, is there a proper analyze of the evidence The audit conclusions, are they based on the findings or assumptions The audit recommendations, are they directed twords those that can do anything with it