19 March 2008Assessment workshop1 Assessment methodology

19 March 2008Assessment workshop2 Characteristics Focus on: Integrity, not corruption Prevention, not repression Organisations, not legislation Processes, not people

19 March 2008Assessment workshop3 Assessment methodology Object definition - organisation - processes Assessment vulnerabilities Assessment Maturity level Integrity Control System Gap analysis Recommendations for strengthening controls

19 March 2008Assessment workshop4 Outcome Depending on the objective, thoroughness, scope and results of these steps, the result could be: –In-depth Risk Analysis –Action agenda –Audit proposal –Audit report

19 March 2008Assessment workshop5 Assessment of vulnerabilities Assess the vulnerability profile: What are the inherent vulnerabilities? Are there circumstances that may increase the vulnerability of the organisation? Result: –Vulnerability profile –List of vulnerable processes

19 March 2008Assessment workshop6 High vulnerability areas Areas dealing with the public or with the private sector CollectingAssessments, taxes, import duties, excise duties, fees, charges ContractingTenders, orders, assignments, awards PaymentSubsidies, benefits, allowances, grants, sponsoring Granting/ issuancePermits, passports, driving licenses, identity cards, authorisations, inspections Public servicesHealth care, education, garbage collection, water supply etc. RegulatingDesign and implementation of new regulations Supervising/ enforcement Supervision, control, inspection, prosecution, detection, justice, punishment Areas dealing with government property InformationNational security, confidential information, documents, dossiers, copyright Money treasury, financial instruments, portfolio management, cash/bank via budgets, premiums, expenses, bonuses, allowances, etc. GoodsBuying/selling (auction), management and consumption Real estateBuying/selling (buildings / land)

19 March 2008Assessment workshop7 Vulnerability Enhancement Profile Factors Complexity Change/dynamics Management Personnel Problem history

19 March 2008Assessment workshop8 Assessment maturity level integrity control system Assess the maturity level of the integrity control system What is the maturity of the integrity control system? –Existence of controls –Operation of controls –Performance of controls Result: –Maturity profile of integrity control system

19 March 2008Assessment workshop9 Maturity levels LevelCriteria 0 - This measure does not exist 1 - This measure exists - Its implementation / observance is unclear 2 - This measure exists - It is implemented / observed - Its effectiveness is unclear 3 - This measure exists - It is implemented / observed - It is effective

19 March 2008Assessment workshop10 Integrity Control System

19 March 2008Assessment workshop11 Gap analysis Match maturity level of integrity control system with established risks –What are the organisations most important integrity risks? –Does the integrity control system protect the organisation against these integrity risks? –What are the remaining risks?

19 March 2008Assessment workshop12 Gap analysis: Vulnerabilities Resilience is determined by the maturity level of integrity controls Balance may be achieved by reducing vulnerability or enhancing controls Vulnerabilities Resilience Remaining Vulnerability

19 March 2008Assessment workshop13 Gap analysis: Risks Mitigation of risks is possible by introducing specific controls Remaining unbalance = Remaining risks Vulnerabilities Resilience Risks Mitigation Remainin g risks

19 March 2008Assessment workshop14 Assessment methodology Mini workshop

19 March 2008Assessment workshop15 Assessment vulnerabilities Assess the vulnerability profile: Check and name high vulnerability areas for this organisation Check and name vulnerability increasing circumstances Award score of increased vulnerability in profile

19 March 2008Assessment workshop16 Assessment maturity level of integrity control system Assess the integrity control system / resilience –Assess the maturity level of the integrity controls –Analyse the strengths and weaknesses of the integrity control system

19 March 2008Assessment workshop17 Gap analysis Match resilience (maturity level of integrity control system) with established vulnerabilities Vulnerabilities Resilience Remaining Vulnerability