1. Legislative, normative and institutional framework of EU member states in relevant issues (internal control and risk management) - some key points drawn from Bulgarian experience - BAKU,23.01.2012 STEFAN BELCHEV, INTERNAL AUDIT DIRECTOR MINISTRY OF FINANCE - BULGARIA

2. Brief IC review of European commission and some EU member states Reform in the EC Reform in the EC - FMC systems - Internal audit function Holland Holland France France Belgium Belgium

3. BULGARIAN PIFC SYSTEM TROUGH THE TIME

4. Law and executive body: Law and executive body: - State Financial Control Law - State Financial Control Department, MoF Pure revision /inspection/ until 2000

5. Authority: Authority: - Ex-post financial checks only for compliance with the laws and contracts of all public organizations and state owned companies (focus on assets, inventories and expenditures, contracts procurements and executions, etc.) - Sanctioning powers - fines in cases of administrative violations stipulated in the laws - Delivering a copy of every single report to the Prosecutor's office

6. Transitional period 2001-2006 In the January the 1-st 2001 Former Financial Inspectors of State Financial Control Department became Internal Auditors in the PIFC Agency Law and Enforcement Body: Law and Enforcement Body: - Public Internal Financial Control Law - Public Internal Financial Control Agency Authority: Authority: - Internal auditing – special assessment of organization activities aiming at recommendations for improvements, mixed with - Imposing sanctions (fines) for law violations

7. What was PIFC Agency  Centralized structure with local offices  Up to 8 000 numbers of auditee organizations (Ministries, Agencies, Commissions, Municipalities, State owned companies etc.)  Up to 1 100 internal auditors  Delegated – in the ministries, large agencies and municipalities  For Special Tasks  Role of CHU for IA - special directorate (January 2004 – September 2005) transferred to MoF

8. Reform of the BG PIFC system   Engagements taken under Chapter 28 Financial Control   Recommendations from the SIGMA peer reviews on the PIFC system in the Republic of Bulgaria   Intense discussions between DG Budget of the EC and the Ministry of Finance Main factors caused the changes:

9. Main directions of the BG - PIFC model reform   Strengthening managerial accountability and financial management and control (FMC)   Establishment of internal audit units (IAU) within public sector organizations   Establishment of Central Harmonization Units for FMC and IA   Establishment of financial inspection

10. Strategy for the development of PIFC in the Republic of Bulgaria - adopted by the Council of Ministers in 2005 -  Drafting 3 new laws to replace old PIFC Law  Establishment of CHU as a directorate within the Ministry of Finance  Segregation of internal audit and financial inspection and internal audit pilot decentralization  Transformation of the Public Internal Financial Control Agency (PIFCA) into a Public Financial Inspection Agency (PFIA)

11. BG internal control Legislation Reform PIFC Law (2001-2006) Law on Financial Management and Control in the Public Sector (March 2006) Law on Internal Audit in the Public Sector (April 2006) Law on State Financial Inspection (April 2006)

12. Law on Financial Management and Control in the Public Sector  FMC definition  Managerial Accountability Principle  Integrated Framework for Internal Control COSO model  Annual reporting on the condition of internal control in public sector organizations  Latest changes – “financial questor” in public state companies

13. Law on Internal Audit in the Public Sector Based on the Professional Practices Framework of Internal Auditing of the IIA  Definition  Principles and tasks  Structuring  Rights and responsibilities of heads of internal audit and of internal auditors  Audit process

14. Checks of documents, inventory and assets (detailed testing) Checks of documents, inventory and assets (detailed testing) All (100 % from the chosen period) All (100 % from the chosen period) Results – each error – even insignificant – must be included in the revision report Results – each error – even insignificant – must be included in the revision report Responsible persons are pointed, but not reasons Responsible persons are pointed, but not reasons Check of control systems (control testing) Check of control systems (control testing) Based on control test results IA decides whether he will do detailed testing and the volume of this testing Based on control test results IA decides whether he will do detailed testing and the volume of this testing Results – the report includes all checks – negative as well as positive Results – the report includes all checks – negative as well as positive Reports includes reasons (causes), conclusions and recommendations Reports includes reasons (causes), conclusions and recommendations Inspection Internal Auditing Inspection Internal Auditing

15. ex post checks - mainly yes/no - for law compliance ex post checks - mainly yes/no - for law compliance from outside from outside (MoF – FI State Agency) (MoF – FI State Agency) of financial activities of financial activities focused on individuals focused on individuals aim: detecting violations and imposing sanctions aim: detecting violations and imposing sanctions reviewing for the past to assure financial and budgetary discipline reviewing for the past to assure financial and budgetary discipline ex post checks for assurance, but also consulting ex post checks for assurance, but also consulting from inside from inside of all activities of all activities focused on systems focused on systems aim: assessing systems and recommending improvements aim: assessing systems and recommending improvements reviewing for the future to help management reviewing for the future to help management

16. Initial focus - structuring of IA, methodology, training and certification Current situation:  Where - 159 organizations  Who - 559 IAs, all of them certified  Methodology – role of CHU and IAs

17. Difficulties  Ongoing management's misunderstanding IAs role  Administrative capacity of IA – staffing, certification, competency  Planning – long-term, of audit engagement  Writing reports  Quality assurance program  Monitoring

18. THANK YOU FOR YOUR ATTENTION ! s.belchev@minfin.bg