1. Liberia Workshop Developing Internal Audit March 1, 2011 Mario Pessoa

2. 2 Good PFM Systems Require Attention to Multiple Issues Legal and institutional framework Legal and institutional framework Medium-term planning Medium-term planning Budget preparation and execution Budget preparation and execution Internal Control and Internal Audit Internal Control and Internal Audit Cash and Debt Management Cash and Debt Management Asset Management Asset Management Accounting and Reporting Accounting and Reporting External Audit External Audit

3. 3

4. 4

5. 5 Internal Audit Function in the World Indicator 21 on Internal Audit: (i) Coverage and quality of the internal audit function; (ii) frequency and distribution of reports; (iii) extent of management response to internal audit findings Indicator 21 on Internal Audit: (i) Coverage and quality of the internal audit function; (ii) frequency and distribution of reports; (iii) extent of management response to internal audit findings PEFA Assessments in 106 countries appoints that “indicator 21” on Internal Audit scores “C” or “D” in 101 countries, “B” in 3 (Mozambique, Mauritius, Seychelles), and “A” in only 2 (South Africa and Brazil) PEFA Assessments in 106 countries appoints that “indicator 21” on Internal Audit scores “C” or “D” in 101 countries, “B” in 3 (Mozambique, Mauritius, Seychelles), and “A” in only 2 (South Africa and Brazil)

6. INTOSAI INTERNAL AUDIT STANDARDS Basic postulates : the development of adequate information, control, evaluation, and reporting systems facilitates the accountability process. Authorities should ensure the promulgation of acceptable accounting standards for financial reporting and disclosure relevant to the needs of the government. Each audit body should establish a policy to ensure its work is of high quality Basic postulates : the development of adequate information, control, evaluation, and reporting systems facilitates the accountability process. Authorities should ensure the promulgation of acceptable accounting standards for financial reporting and disclosure relevant to the needs of the government. Each audit body should establish a policy to ensure its work is of high quality General standards : individual auditors and the audit body must be independent of the executive, of the individual entity being audited, and of any political influence; they must possess the required competence; and they must exercise due care and concern in complying with specific auditing standards General standards : individual auditors and the audit body must be independent of the executive, of the individual entity being audited, and of any political influence; they must possess the required competence; and they must exercise due care and concern in complying with specific auditing standards Field standards : auditors should design procedures for the completion of regularity audits to provide reasonable assurance of detecting errors, irregularities, and illegal acts that could have a direct and material effect on the financial statement amounts; auditors should evaluate the reliability of internal controls; and a regularity audit should provide assurance that the budget and accounts are complete and valid Field standards : auditors should design procedures for the completion of regularity audits to provide reasonable assurance of detecting errors, irregularities, and illegal acts that could have a direct and material effect on the financial statement amounts; auditors should evaluate the reliability of internal controls; and a regularity audit should provide assurance that the budget and accounts are complete and valid Reporting standards : following each audit, the chief auditor should prepare a written opinion or report setting out the findings in an easy-to-understand form, including only information that is supported by competent and relevant audit evidence; audit reports should be independent, objective, fair, and constructive (i.e., they should address future remedial action) Reporting standards : following each audit, the chief auditor should prepare a written opinion or report setting out the findings in an easy-to-understand form, including only information that is supported by competent and relevant audit evidence; audit reports should be independent, objective, fair, and constructive (i.e., they should address future remedial action) 6

7. Definition of Internal Audit (IA) IA is an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations IA is an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations IA evaluates and improves effectiveness of internal control processes and risk management IA evaluates and improves effectiveness of internal control processes and risk management It Improves an organization’s operations, particularly internal control It Improves an organization’s operations, particularly internal control It helps an organization accomplish its objectives It helps an organization accomplish its objectives 7

8. 8 IAA Standards The International Standards for the Professional Practice of Internal Auditing issued by the Institute of Internal Auditors (IIA) are: The International Standards for the Professional Practice of Internal Auditing issued by the Institute of Internal Auditors (IIA) are: The purpose, authority, and responsibility of the internal audit activity must be formally defined The purpose, authority, and responsibility of the internal audit activity must be formally defined The internal audit activity must be independent, and internal auditors must be objective in performing their work The internal audit activity must be independent, and internal auditors must be objective in performing their work The chief audit executive must communicate and interact directly with the board The chief audit executive must communicate and interact directly with the board Internal auditors must have an impartial, unbiased attitude and avoid any conflict of interest Internal auditors must have an impartial, unbiased attitude and avoid any conflict of interest Internal auditors must possess the knowledge, skills, and other competencies needed to perform their individual responsibilities Internal auditors must possess the knowledge, skills, and other competencies needed to perform their individual responsibilities The chief audit executive must establish risk-based plans to determine the priorities of the internal audit activity The chief audit executive must establish risk-based plans to determine the priorities of the internal audit activity

9. IAA Standards (cont.) The chief audit executive should share information and coordinate activities with other internal and external providers of assurance and consulting services to ensure proper coverage and minimize duplication of efforts The chief audit executive should share information and coordinate activities with other internal and external providers of assurance and consulting services to ensure proper coverage and minimize duplication of efforts The internal audit activity must evaluate and contribute to the improvement of governance, risk management, and control processes using a systematic and disciplined approach The internal audit activity must evaluate and contribute to the improvement of governance, risk management, and control processes using a systematic and disciplined approach Internal auditors must document relevant information to support the conclusions and engagement results Internal auditors must document relevant information to support the conclusions and engagement results Communications must include the engagement's objectives and scope as well as applicable conclusions, recommendations, and action plans Communications must include the engagement's objectives and scope as well as applicable conclusions, recommendations, and action plans Communications must be accurate, objective, clear, concise, constructive, complete, and timely Communications must be accurate, objective, clear, concise, constructive, complete, and timely The chief audit executive must establish and maintain a system to monitor the disposition of results communicated to management The chief audit executive must establish and maintain a system to monitor the disposition of results communicated to management 9

10. IA Models Centralized – third-party ex-ante approach – MOF directly intervenes in ex-ante controls placing its own staff in Line Ministries Centralized – third-party ex-ante approach – MOF directly intervenes in ex-ante controls placing its own staff in Line Ministries Decentralized – management responsibility approach – Each line ministry takes full responsibility for spending its own budegt and for ensuring appropriate checks and safeguards on the way this is spent Decentralized – management responsibility approach – Each line ministry takes full responsibility for spending its own budegt and for ensuring appropriate checks and safeguards on the way this is spent 10

11. Country’s Approach France, Portugal, Spain – strong focus on ex- ante control France, Portugal, Spain – strong focus on ex- ante control UK – decentralized with centralized guidance from the Treasury UK – decentralized with centralized guidance from the Treasury USA – IA inspector general reports to the head of the agency but reports go to Congress USA – IA inspector general reports to the head of the agency but reports go to Congress Germany – is part of the external control system. Federal Court of Audit supervise and guide the work of the IA. Report only to external auditor. Pre-audit role. Germany – is part of the external control system. Federal Court of Audit supervise and guide the work of the IA. Report only to external auditor. Pre-audit role. 11

12. Country’s Approach (cont.) Anglophone African Countries – Westminster model – MOF is primarily an office of superintendence and appeal. The IA can be viewed as support to the MOF in the monitoring of compliance by the line ministries with financial regulations and accounting procedures. But there are two ambiguous roles: central control and service provided to the accounting officers. Anglophone African Countries – Westminster model – MOF is primarily an office of superintendence and appeal. The IA can be viewed as support to the MOF in the monitoring of compliance by the line ministries with financial regulations and accounting procedures. But there are two ambiguous roles: central control and service provided to the accounting officers. 12

13. Country’s Approach (cont.) Francophone African Countries – centralized IA function. Pre-audit role performed by financial comptroller and public accountants, centrally managed. The FC and accountants approve payments individually after authorization issued by financial controller. IA has a more investigative approach in case of irregularities. Sometimes functions are not well defined. Francophone African Countries – centralized IA function. Pre-audit role performed by financial comptroller and public accountants, centrally managed. The FC and accountants approve payments individually after authorization issued by financial controller. IA has a more investigative approach in case of irregularities. Sometimes functions are not well defined. 13

14. Country’s Approach (cont.) Latin America – centralized and focused in pre-audit of payments. Some Contralorias accumulate accounting and auditing functions (Chile, Colombia, Mexico). Most recently some countries adopted an independent, centralized IA that is focused in pre-audit, reports to the SAI, defines audit standards, and has expanded the scope to work also with performance audit (Argentina, Brazil). Latin America – centralized and focused in pre-audit of payments. Some Contralorias accumulate accounting and auditing functions (Chile, Colombia, Mexico). Most recently some countries adopted an independent, centralized IA that is focused in pre-audit, reports to the SAI, defines audit standards, and has expanded the scope to work also with performance audit (Argentina, Brazil). 14

15. Brazil – Comprehensive Approach Performance Compliance MTEF/BUDGET Legal and Accounting Rules Resources FINANCE LM

16. Brazil - Organization of the Internal Control System Evaluation of Program Performance Evaluation of Rules and Procudures IA Evaluation of Fiscal Rules

17. ABC Curve of Program Hierarchy (Relevance, Materiality, Risk)

18. GENERAL SPACIAL DISTRIBUTION PacificOcean AtlanficOcean

19. PARANÁ – SAMPLE REGIONAL DISTRIBUTION

20. Housing Program Inspection Habitational Unit Built House made of gross sand (saibro) previously inhabited

21. TRANSPARENCY PORTAL

23. 23 Key challenges in this area Design level issues: Scope of IA Scope of IA Its central role in the context of the trend toward devolution of controls to line agencies Its central role in the context of the trend toward devolution of controls to line agencies IA is a tool of the management (In addition to compliance and financial audits, to what extent the IA should focus on ensuring efficient and effective use of resources to achieve the management’s objectives?) IA is a tool of the management (In addition to compliance and financial audits, to what extent the IA should focus on ensuring efficient and effective use of resources to achieve the management’s objectives?) Organizational structure for IA Organizational structure for IA Degree of centralization: role of central ministry of finance vs. line ministries/agencies Degree of centralization: role of central ministry of finance vs. line ministries/agencies Should IA units be established in all or in key ministries/agencies? Should IA units be established in all or in key ministries/agencies? Role and responsibilities of Internal Auditors Role and responsibilities of Internal Auditors Internal audit vs. External Audit Internal audit vs. External Audit Ex ante control vs. Internal Audit Ex ante control vs. Internal Audit Staging/sequencing of IA reform and linking it to reforms in related PFM areas Staging/sequencing of IA reform and linking it to reforms in related PFM areas

24. 24 Key challenges in this area Implementation issues: Overall PFM structure as a foundation for IA Overall PFM structure as a foundation for IA Is the basic PFM structure adequate to make an IA system functional? (sequencing of reforms is important) Is the basic PFM structure adequate to make an IA system functional? (sequencing of reforms is important) Professional proficiency Professional proficiency Appropriate audit methodology, work practices Appropriate audit methodology, work practices Technical competence of Internal Auditors Technical competence of Internal Auditors Management of IA function Management of IA function Identifying risk and evaluating internal control systems and procedures to counter risk Identifying risk and evaluating internal control systems and procedures to counter risk Audit planning and personnel management Audit planning and personnel management Ensuring complementarity with external audit Ensuring complementarity with external audit Follow-up (on findings of IA) and oversight (by Parliament and external audit) Follow-up (on findings of IA) and oversight (by Parliament and external audit) Culture Culture “Open” culture to detect irregularities or non-compliance “Open” culture to detect irregularities or non-compliance Integrity of top management (to whom Internal Auditors report) Integrity of top management (to whom Internal Auditors report) Scope for collusion Scope for collusion

25. 25 Discussion and Questions and Answers

26. Reference http://www.theiia.org/ http://www.theiia.org/ http://www.theiia.org/ http://blog-pfm.imf.org/pfmblog/research- papers.html - Jack Diamond - The Role of Internal Audit in Government Financial Management – IMF WP/02/94 http://blog-pfm.imf.org/pfmblog/research- papers.html - Jack Diamond - The Role of Internal Audit in Government Financial Management – IMF WP/02/94 http://blog-pfm.imf.org/pfmblog/research- papers.html http://blog-pfm.imf.org/pfmblog/research- papers.html 26