1. Office of the Auditor General of Norway 14th CAS meeting in New Delhi
What happened between the CAS meeting in Beijing 2015 and the CAS meeting in New Delhi 2017
Ingvild Gulbrandsen
Office of the Auditor General of Norway
14th CAS meeting in New Delhi
February 2017

2. The History of the Compliance Audit Subcommittee 2004 - 2017
2004 the starting point, and the planning for the first meeting in the INTOSAI ASC working group on Compliance Audit started
2005 the first meeting in INTOSAI ASC working group on Compliance Audit was held in Oslo in March as a host and chair
The members at that time were: Argentina, Denmark, India, Namibia, Norway, Saudi Arabia, Slovakia, Sweden, Tunisia and Ukraine (10).

3. CAS in 2017
2017 India has taking over the chairmanship of the Compliance Audit Subcommittee
The CAS committee has 18 members from different regions and with different types of organizations, including several operating in a court environment. CAS-member SAIs 2016 are : Brazil, China, the European Court of Auditors, France, Georgia, Hungary, India, Lithuania, Mexico, Namibia, Norway, Portugal, Romania, Saudi Arabia, Slovakia, South Africa, the Republic of Azerbaijan and Tunisia. IDI and AFROSAI-E has status as observers.

4. From guidelines and principles to a standard
2010 – Guidelines ISSAI 4000, 4100 and 4200 endorsed at INCOSAI in South Africa
2013 – Fundamental Principles of Compliance Auditing, ISSAI 400 endorsed at INCOSAI in China
2016 – The standard ISSAI 4000 endorsed at INCOSAI in United Arab Emirates

5. Compliance Audit Standard Abu Dhabi, United Arab Emirates
ISSAI 4000
Compliance Audit Standard
Ingvild Gulbrandsen
INCOSAI
Abu Dhabi, United Arab Emirates
8. December 2017

6. ISSAI 4000 – One Standard in Compliance Audit
Based on the Fundamental Principles in ISSAI 100/400
Requirements (shall) followed by explanations
The different parts of ISSAI 4000 must be seen together, to accomplish a high quality audit

7. ISSAI 4000 – One Standard in Compliance Audit
One document with common concepts and a common process for all SAIs will hopefully provide a fruitful environment for sharing experiance and learning from eachother

8. ISSAI 4000 – One Standard in Compliance Audit

9. What we said in Beijing in 2015
Professional standards have no value unless they are implemented, and used by the auditors and their leaders in their day to day work.

10. Implementation work done by IDI and Afrosai-E with a helping hand from CAS
Handbook in Compliance Audit
iCAT development and use of the tool in PASAI, ASOSAI and ARABOSAI
10 SAIs in PASAI doing there first compliance audit within procurement
AFROSAI-E developing their own manual in Compliance Audit (CAM), followed by a pilot workshop on implementation of ISSAI 4000 where 7 SAIs will do compliance audits within different subject matters

11. Challenges in understanding and using these concepts
Authorities and crieria
Subject matter and subject matter information
Assurance
Compliance audit
Authorities that govern them – vanskelig å forstå delegasjonssystemet i sentralforvaltningen.
Criteria and their sources, folk har problemer med å forstå at kriteriene skal utledes og at man ikke bare skal henvise til en lov og dens paragrafer.
Hva skal de egentlig revidere. Hva er subject matter information. Dette klarer mange ikke å skille.
Three parties er viktig. Er man ikke klar over hvem det er, og diskuterer det, kan man henge bjella på feil ku.
Assurance, forholdet mellom limited og reasonable er uklart.
Three parties

12. Do you asses the criteria against these characteristicks ISSAI 4000/118?
Relevant
Reliable
Complete
Neutral
Criteria
Comparable
Available
Acceptable
Understandable

13. ISSAI 100/18, an audit is a systematic process, but how
Is the subject matter material and based on risk
The audit objective, is it clear and understood
The criteria, which authoriteis are they deduced from
The audit question(s), are they linked to the criteria
The audit evidences, are they sufficient and appropriate

14. ISSAI 100/18, an audit is a systematic process, but how cont.
The audit findings, is there a proper analyze of the evidence
The audit conclusions, are they based on the findings or assumptions
The audit recommendations, are they directed twords those that can do anything with it