2. UK National Audit Office
Internal Control
Mark Babington
Audit Manager
UK National Audit Office

3. NAO Audit Methodology
Audit 21 is the NAO’s risk based audit methodology, designed to provide assurance to the C&AG
The approach gathers inherent assurance, controls assurance, and assurance from substantive procedures. Seeking to develop controls assurance is a main focus of Audit 21

4. The Internal Control Framework
Corporate Governance initiatives undertaken as the behest of the UK Treasury, to improve financial control and accountability.
Earliest reports for the Public sector were Cadbury and Turnbull – followed the regulations for the Stock market.

5. Statements of Internal Financial Control
Established through DAO 13/97 ( onwards)
Accounting Officers required to establish and report on systems of internal financial control
NAO examines these during the course of each audit assignment, and reports where it feels disclosures are misleading.

6. Statements of Internal Control
Replaced SOFIC – introduced through DAO13/00. Expanded accounting officers statement to cover internal controls – not just financial controls. This has major impacts for risk management. Implementation timetable to

7. Implications for Audit
Established and embedded risk management procedures can be used to manage entities – NAO can help to develop these control procedures and then test and take assurance from them.

8. Assessing Internal Controls
Key – high level strategic financial controls, used for managing the organisation and delivering key objectives
Mid-level – monitoring controls
Low-level – physical checking and compliance controls

9. Where to place assurance ?
The desirable approach is to place reliance on the highest, strategic controls, as if working effectively these will operate over all transactions.

10. Developing our Clients
Where client bodies do not have established and embedded internal control environments, the auditor can have a significant impact on working with clients to develop more effective control and accountability.

11. The role of controls in the audit approach

12. Implications for IT Audit
When placing reliance on internal controls, it is vital for the audit to confirm the integrity of management information used to manage the organisation concerned.
IT audit must confirm system integrity, else controls assurance may not be reliable.

13. Effects on our audit -
Reduced costs through efficiency savings of 15% over 3 years.
Allows C&AG to provide greater assurance to Parliament about proper governance and management of public funds.
Provides much greater audit assurance.
Improves our understanding of business systems and operational factors.

14. ISA’s
NAO Audit 21 approach to the audit of controls is in compliance with the ED ISA 200 (revised).
Focus is not just on accuracy of accounts but the integrity and robustness of underlying systems.

15. UK Examples
Audit of the UK Meteorological Office (audit completed within 4 weeks of the year end)
Audit of UK Public Sector Pension Funds (transaction testing replaced by controls assurance)
UK Atomic Energy Authority (strong risk management culture allows controls assurance)

16. Any Questions ?