CAS project 2.2, SDP of IFPP on providing guidance on compliance audit Ingvild Gulbrandsen Office of the Auditor General of Norway 9th October 2018, Luxembourg

Working title for the new pronouncement Guidance on authorities to be considered while examining regularity and propriety aspects in compliance audit

Project objectives The guidance will focus on assessment of compliance with criteria relating to regularity and propriety in conducting compliance audit in the context of different mandates of Supreme Audit Institutions and forming conclusion/opinion.

The working group’s intepretation – work in progress Give guidance on assessing authorites as a source for determing regularity and/or propriety criteria. Showing how this can be done from planning to reporting by using examples. Explain how this can be done within different SAI models

FIPP liaison officers and their role Josephine Mukomba from AFROSAI-E Karen Mohr from SAI Guatemala The role of the liaison officer is to: explain FIPPs expectations to the project (in order to pave the way for approval), to ensure that FIPP provides comments/directions to the project group on draft and ensure that the project group is aware of drafting conventions etc……

FIPP liaison officers and their role cont. Contact with the liaison officers to discuss the project and drafts through physical meetings in Nairobi and Oslo, and by e-mail. Feedback this is a grey area that is not properly understood and that needs extra consideration it is important to show mandates that allow / forbid propriety (my remark: who are they in addition to Turkey, Peru and Puerto Rico?)

Drafting conventions for guidance documents in the IFPP Definition of a GUID that will support the SAIs to: Enhance organisational performance in practice related to the organisational requirements and the implementation of ISSAIs Implement mechanisms and programms for competency development in line with the ISSAIs Definition of a GUID that will support the auditor to: Apply the ISSAIs in practice in the compliance audit processes. Understands a specific subject matter and the application of the relevant ISSAIs. The GUIDs translate the fundamental auditing principles into more specific, detailed and operational guidelines.

Supplementary guidance to the drafting conventions for the GUIDs The scope of the GUID is on how to audit the subject matter in accordance with the ISSAIs, and therefore any describing of the subject matter should be left to the purpose. The GUID should be closely linked to ISSAI 100 and the audit type. The GUID should expand on requirements and explanation for these principles, and not merely repeat or overlap the relevant ISSAIs The auditor should be directed to the relevant ISSAI for requirements for planning, execution and conclusion/reporting phases.

Work in progress The working group consist of: SAI Norway (leader), ECA, SAI France, SAI India and SAI South Africa. A discussion group were established in SAI Norway consisting of: Mona Paulsrud (responsible for ISSAI 400), Anders Pilskog (CA-auditor and short time advicer - CA in AFROSAI-E and Myanmar) and Esther Thomas (long time advicer in AFROSAI-E, responsible for the CAM). Discussions with IDI All the regions have been asked about the use of regularity – propriety criteria etc The work progress has been communicated through e-mail

Questions sent to the regions the 24.4.18 Is it possible to have a list of SAIs that perform audits using propriety criteria? Is it possible to get information about the legal status of propriety concepts in different countries? How is it enforced? How is it audited? Who is the auditee? What type of engagement is it (direct reporting/attestation )? Is it mostly used by SAIs with jurisdictional powers (Cours des Comptes), or the Westminster Model? Is it possible to get audit reports dealing with propriety?

SAIs not using propriety criteria In response to your request of information for the new GUID project on Compliance Audit, specifically in terms of “propriety audits”, I must inform the SAI of Mexico does not carry out such type of audit.

SAIs not using propriety criteria Propriety audits involve the auditing of the decisions of the Government and, as such, require that the expenditure incurred are justified and necessary. In this regard, it is seen as touching on policy issues and auditing the policies of Government which the Audit Office of Guyana does not currently do.

SAIs not using propriety criteria You have touched upon a very sensitive issue regarding the compliance audit standards. Coming from an SAI which has been implementing compliance audit for more than a century, I was surprised when I read the explanations regarding criteria on propriety. In our SAI, the criteria we use in compliance audit is strictly based on laws and regulations. The way propriety criteria is defined in ISSAIs, as taking its basis from expectations", is subjective and cannot be used in our work. In fact, we have a specific provision in our law which prohibits the usage of propriety criteria. The relevant article in the law states that "Turkish Court of Accounts shall not undertake propriety audit and shall not render decisions that limit or remove the discretionary powers of administrations." The way I see it, propriety criteria, as described in the standards, empowers the auditor to act as it pleases himself, without being subject to supervision.

SAIs using propriety criteria We do use propriety criteria in our audits and there is also a special legal offense for public servants (and public company’s CEO) who commit management errors. The court of justice for this offense in not the Cour des comptes but a little special court that is associated to the Cour des comptes : members of this court (called cour de discipline budgétaire et financière ie disciplinary court for budgetary and financiary issues) are partly members of the Cour des comptes and the prosecutor is the General attorney of the Cour des comptes.

Answer from one region (CAROSAI) only cont. Chile, Cuba, Equador, Honduras, Mexico, Venezuela and Panama do not use propriety criteria. Peru and Puerto Rico use propriety criteria. Chile: The general principles of probity and public ethics are used in the framework of compliance audits. Cuba: In the audits conducted (PA, FA, CA and forensic), the ethical behavior of public servants (as ISSAI-12) is evaluated, which can be translated as decency

Answer from one region (CAROSAI) only cont. Honduras: There is a Public Ethics and Probity Departement in charge of: Promote the performance of public servants based on probity and ethics. Formulate, guide and direct the system of transparency of the management of public servants Conduct ethical audits in government institutions in order to determine compliance with ethical standards, cases of nepotism or any other violation of the Code of Ethical Conduct.

Answer from one region (CAROSAI) only cont. Comptroller General’s Office of the Republic of Peru: The Supreme Court of Administrative Responsabilities resolves on infractions foreseen in the paragraph b) in article 46th of the Law 27785, and its amendments, described and specified in article 7th of the Regulation of Law No. 29622, norm reproduced in the current «Regulation of Infractions and Sanctions for the Determination of the Function Administrative Responsability derived from the Reports issued by the Bodies of the National Controler System» approved by resolution of the Comptroller No. 100-2018-CG, of April 3, 2018.

Answer from one region (CAROSAI) only cont. Puerto Rico: Provides, inter alia, in the law: will be duty of the heads of agencies, corporate entities, legislative bodies, and the Secretary avoid those expenditures of public funds which they believe are unnecessary, excessive and extravagant.

Internal hearing among CAS members the 7th of July 2018 Russia answered: Definition of regularity should be specified. To our mind legality definition can also include a prohibition set by the law, breaking of which can be considered as illeagal behavior. Portugal answered: Thank you for your communication. We do not have any comments concerning this version of the Exposure draft Project 2.2 of SDP.

Questions for discussion Do we in complianc audit need this GUID? Why do we need it? What is missing? Where do we have to expand our explanations?