Internal Control system A unique framework to transform our mind set MOF, Georgia, Internal Audit Department, November, 2018 Shalva Kiknadze

Main topics we will cover Internal Control System – A process, measure or outcome; Implementing strategy for Financial Management and Control System in Georgia™ - Managerial accountability, the first cornerstone of ICS in Georgian current administrative practice; How ICS saves disoriented managers and auditors; Main challenges we face.

Internal control – multiple meanings A system or process - the entirety of an organization’s internal control system, i.e., an organization’s internal control system; An activity or measure - the actual measure to treat risks and to effectuate internal control, i.e., individual controls; A state or outcome - an organization is “in control,” when it has achieved its internal control objectives.

Internal control – a system or process Internal control is an integrated part of an organization’s governance system and risk management, which is understood, effected, and actively monitored by the organization’s governing body, management, and other personnel, to take advantage of opportunities and to counter the threats, in line with risk management strategy and policies on internal control set by the governing body to achieve an organization’s objectives through, among other things: executing effective and efficient strategic and operational processes; providing useful information to internal and external users for timely and informed decision making; ensuring conformance with applicable laws and regulations, as well as with the organization’s own policies, procedures, and guidelines; safeguarding the organization’s resources against loss, fraud, misuse, and damage; and safeguarding the availability, confidentiality, and integrity of the organization’s information systems, including IT. Source: Global Survey on Risk Management and Internal Control, IFAC (2011)

Internal control – an activity or measure Activities performed to treat risks and effectuate internal control. Examples of actual control activities include managerial controls, such as executing the „Plan-Do-Check-Act Cycle,“ or transaction controls, such as verifications, reconciliations, authorizations, physical controls, and supervisory controls that oversee transaction controls. Source: Global Survey on Risk Management and Internal Control, IFAC (2011)

How ICS can be build-in not build-up in public organisation’s ordinary fiscal cycle Budget Cycle within the SU Plan M C Do Check Act Plan M C ? Management cycle Control cycle State Budget cycle Act Do M C M C Check M C Budget organisations Spending units (SUs) -Ministries

Internal control – A state or outcome An organization is „in control,“ when it has achieved its desired internal control objectives by treating the risks an organization faces in accordance with its risk management strategy and policies on internal control, while achieving the organization’s objectives. Source: Global Survey on Risk Management and Internal Control, IFAC (2011)

Risks identified and assessed Internal Control ≡ always risk oriented and dynamic system General system logic   System sponsors and Owners Assurance providers Assurance reports Risks identified and assessed Operational reports and information/metrics on the system performance M C Monitoring Objectives of internal Controls Operational Processes Control procedures Policies or system’s objectives and plans Assurance reports System managers

Some attributes of Internal control concept creating obstacles in Georgian public sector organisations   Designed to serve mainly broad social and public best interests not to interests of particular major groups; Is relatively new and  ambiguous concept than another tasks of management and governance (e.g. Controlling, strategic planning, management accounting, inspection, forecasting, budgeting, quality, accounting, Auditing); Needs clear defined and strong ownership and champions to establish, maintain and keep as an influential mechanism;

Main Precondition to establish control processes in the Georgian public organisation   They should be designed and maintained to treat/respond risks identified and therefore to enhance the chance accomplishing business objectives. Otherwise they are blind, dysfunctional, disoriented activities and center of non-recoverable costs. Thus we need well articulated objectives, strategies, annual plans. Establishing and maintaining Internal Control are primary responsibility for Senior management which can’t be separated from theirs managerial accountability tasks. Due this treat we started to establish internal control system with defining clear managerial accountability arrangements based on budget programs.

Internal control integrated in managerial accountability Managers at all hierarchical levels of an institution shall be accountable to their superior managers for their activities and for the accomplishment of the goals and objectives of the institution by lawful, economical, effective and efficient management of funds. Source: Law of Georgia on Public Internal Financial Control, article 7.

What can be concluded when managers did not establish and maintain sound internal control systems They did not know how to manage this task; They think that there is already some adequate system of internal controls in place; They consider the task as not important one; They think that the task is outside theirs responsibility, and in the most worst case, It does not matter what outputs or outcomes they get from the processes or activities they carry out.

Why it is hard for senior managers to deal with internal controls within a organization Not segregated political and administrative level within the organisation; Very weak political and supervisory pressure for poor performance from legislative body; Not articulated objectives and strategies; Decentralization and delegation is a taboo; Poor developed corporate sector;

Finance and Economic Departement Integration new FMC rules into our public administration system – An overview Annual statement on organisational Financial managementr and control system Minister Deputy Minister FMC Coordinator Deputy Minister Program manager Deputy Minister Program manager Deputy Minister Program manager Deputy Minister Program manager Deputy Minister Program manager SLA, Performance standards SLA, Performance standards SLA, Performance standards SLA, Performance standards Finance and Economic Departement Budget Executor Progran 2301 Regularreports, EF&FIN Regularreports, EF&FIN Regularreports, EF&FIN Regularreports, EF&FIN Budget Executor Progran 2302 Budget Executor Progran 2303 Budget Executor Progran 2303 Budget Executor Progran 2303 SLA – Agreement on the terms for providing public services EF & FIN - Reports on the financial, non-financial perfomance and FMC issues

What internal auditors can do (and add values) when there aren’t clear articulated business objectives, priorities and strategies Help managers to set some suitable one; Consider the using internal control objectives categorized into thee main groups (Compliance, reporting, process efficiency and effectiveness); seek another alternatives.

მადლობთ ყურადღებისათვის