2. Procedure of internal financial audit of a public financial body and taking steps following audit results STEFAN BELCHEV – INTERNAL AUDIT DIRECTOR MoF BULGARIA Ukraine, Kiev 28.01.2011

3. A. PRE-PLANNING AND PREPARATION FOR THE AUDIT Choosing an audit strategy – identification of the type and volume of checks Assessment of the controls against the risks in the audited activity/process Identification and assessment of the risks in the audited activity/process Identification of the specific /control/ objectives PREPARATION OF AN AUDIT PLAN AND ALLOCATION OF RESOURCES Undertsanding and documenting of the audited activity/process Phase One PLANNING PLANNING 4 phases of standard internal audit engagement

4. Drawing up of the preliminary report Drawing up of the final report Formulation of conclusions and recommendations Carrying out checks and analysis of the results of the checks and the residual risk Follow-up of the fulfilment of the recommendations Phase Two FIELDWORK FIELDWORK Phase Three REPORTING REPORTING Phase Four FOLLOW-UP FOLLOW-UP 4 phases of standard internal audit engagement

5. Stage PLANNING Understanding and documenting of the audited activity/process Understanding and documenting of the audited activity/process Identification of the specific /control/ objectives Identification of the specific /control/ objectives Identification and assessment of the risks in the audited activity/process Identification and assessment of the risks in the audited activity/process Assessment of the controls against the risks in the audited activity/process Assessment of the controls against the risks in the audited activity/process Choosing an audit strategy – identification of the type and volume of checks Choosing an audit strategy – identification of the type and volume of checks Preparation of an audit plan and allocation of resources Preparation of an audit plan and allocation of resources

6. Undertsanding and documenting of the audited activity/process The understanding of the activity is achieved by means of collecting and study of information about: The understanding of the activity is achieved by means of collecting and study of information about: regulatory and internal acts, regulating the activity of the audited activity/process; regulatory and internal acts, regulating the activity of the audited activity/process; the objectives of the organisation; the objectives of the organisation; the organization structure – allocation of responsibilities, job descriptions, etc. the organization structure – allocation of responsibilities, job descriptions, etc. main areas of operation; main areas of operation; risk assessment methodology, applied in the organization; risk assessment methodology, applied in the organization;

7. Undertsanding and documenting of the audited activity/process information processing procedures and the key controls for their proper functioning; information processing procedures and the key controls for their proper functioning; the accounting environment and the accounting policy applied; the accounting environment and the accounting policy applied; financial management and control systems; financial management and control systems; the staff turnover; the staff turnover; financing; financing; other applicable documents. other applicable documents.

8. Identification of the specific /control/ objectives Examples of audit objectives for payroll To determine if the payroll function is properly controlled and secure. To ensure that all employees on the payroll are valid, active employees. To ensure that all payroll disbursements are processed for valid work performed only. To determine that payroll deductions are correctly applied. Other? Other?

9. Identification and assessment of the risks in the audited activity/process Examples of audit risks for the Transactions may not be processed or processed incorrectly. Financial statements may be misstated due to entry omissions, incorrect coding, duplicate journal entries, or improper cut-offs. Employment laws and regulations may be violated resulting in fines, penalties, or litigation. Incorrect data in the master file could result in incorrect wage payments. Payroll withholdings may be incorrect. Awards, incentives, recognitions, etc., may not be accurately reflected on the master file. Other?

10. Engagement Planning Objectives Objectives Scope Scope Timing Timing Resource allocations Resource allocations

11. Field work phase Carrying out checks Carrying out checks Analysis of the results Analysis of the results Analysis of the residual risk Analysis of the residual risk

12. Field work phase Residual risk is the process risk which continues to exist even after the application of controls. Residual risk is the process risk which continues to exist even after the application of controls. RISK  CONTROL PROCEDURES  RESIDUAL RISK

13. Typical preconditions for the existence of residual risk The established controls are not applied in practice The established controls are not applied in practice The established controls are not applied effectively The established controls are not applied effectively Lack of controls to manage process risks Lack of controls to manage process risks

14. Field work phase Formulation of : Findings Findings Conclusions Conclusions Recommendations Recommendations

15. Reporting phase Preparation of a preliminary report Preparation of a preliminary report Preparation of the final report and action plan Preparation of the final report and action plan

16. Structure of the audit report Summary Summary Introduction Introduction Findings Findings Conclusions Conclusions Recommendations Recommendations

17. Closing meeting and action plan

18. Follow-up phase Follow-up of recommendations by letters to management Follow-up of recommendations by letters to management Follow-up of recommendations by planned audits Follow-up of recommendations by planned audits

19. Any Questions?