1. Internal Audit Agency Integrity + Professionalism INTERNAL AUDIT AGENCY ISACA Presentation 15 July, 2013 Alisa Hotel, ACCRA

2. Internal Audit Agency Integrity + Professionalism AUDIT and RISK Building IS Audit Capacity

3. Internal Audit Agency Integrity + Professionalism System of Internal Control

4. Internal Audit Agency Integrity + Professionalism System of Internal Control The system of internal control comprises the policies, procedures and operations established to ensure the achievement of objectives, the appropriate assessment of risk, the reliability of internal and external reporting and accountability process, compliance with applicable laws and regulations, and compliance with behavioral and ethical standards set for the organization

5. Internal Audit Agency Integrity + Professionalism Responsibility for Effective Internal Controls - Senior Management is responsible for the design of effective internal control procedures - Internal Audit is responsible for reviewing the design and effectiveness of internal control procedures and making recommendations

6. Internal Audit Agency Integrity + Professionalism Internal Auditing

7. Internal Audit Agency Integrity + Professionalism Internal Audit Unit Section 16(1) of Act 658 provides for the establishment of IAU in all MDAs and MMDAs Section 120(1) of the Local Government Act requires each Assembly to have an IAU At the end of 2012: 303 IAUs established. (There 82 IAUs yet to be established).

8. Internal Audit Agency Integrity + Professionalism IIA Definition Internal Auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes

9. Internal Audit Agency Integrity + Professionalism RISK RISK may simply be defined as anything that prevents you from achieving your objective the UNCERTAINTY of an event occurring that could have an impact on the achievement of objectives – IIA May be POSITIVE (opportunity) or NEGATIVE (threat)

10. Internal Audit Agency Integrity + Professionalism Risk Management A dynamic process for taking all reasonable steps to find out and deal with risks that impact on our objectives “Although organizations use the term “risk management” frequently it is misleading, because risk is never actually managed. It is the organization that is managed in anticipation of the uncertainty (and opportunities) presented by risk in the environment”

11. Internal Audit Agency Integrity + Professionalism Internal audit activity should evaluate risk exposures relating to the organization’s information systems regarding the reliability and integrity of financial and operational information Internal Audit & ICT

12. Internal Audit Agency Integrity + Professionalism Information Systems Risk Theft of information Eavesdropping Abuse of internet access Denial of service Viruses Sabotage of data System penetration Fraud

13. Internal Audit Agency Integrity + Professionalism Auditing around the box Traditional approach to auditing computer based systems –Still relevant for auditing computer systems –Does not address issues around the information system itself – a specialist area Transition to full IS Audit requires extensive capacity building and infrastructure

14. Internal Audit Agency Integrity + Professionalism Approaches to IS Audit Use consultants/specialists Train general auditors in IS audit techniques Use consultants and general auditors

15. Internal Audit Agency Integrity + Professionalism Areas of Expertise Systems Development and Projects Computerized Applications IS Security Standards CAATs Systems Project Management Disaster Recovery and Contingency Planning Internet Design and Security

16. Internal Audit Agency Integrity + Professionalism Areas of Expertise cont’d Overall IS Strategy Data Protection and Legal Requirements Network Management Database Management

17. Internal Audit Agency Integrity + Professionalism Computer Audit General Internal Auditors –Review of Management Information System Input Controls Process Controls Output Controls Specialized Computer Audit Hardware Controls Software Controls

18. Internal Audit Agency Integrity + Professionalism Building IS Audit Capacity GIFMIS functionality training for 500 internal auditors in MDAs CAATs Training/User Manual to be published under GIFMIS project CAATs training for 100 internal auditors Setting up of Computer Labs under GIFMIS project Dedicated 20-seater computer lab at IAA for training internal auditors in CAATs (in the pipeline).

19. Internal Audit Agency Integrity + Professionalism CHALLENGES

20. Internal Audit Agency Integrity + Professionalism Challenges Integrated Management Information System –GIFMIS –IPPD –HRMIS (Planned) Budget for –Hardware –Software –Training

21. Internal Audit Agency Integrity + Professionalism Challenges cont’d Encouraging Staff to obtain CISA certification –Arranging practical exposure –Course Material –Funding Retaining trained IS Audit Staff Top Leadership Support

22. Internal Audit Agency Integrity + Professionalism How ISACA can Help

23. Internal Audit Agency Integrity + Professionalism ISACA Interventions ISACA workshops & seminars for Public Service IS Auditors CISA certification Collaboration with IAA to promote IS Audit in the Public Service DP Funded Programs (as part of IAA/ISACA collaboration)? ?

24. Internal Audit Agency Integrity + Professionalism Thank You