The World Bank Presented by: Richard Allen, PEFA Program Keeping on Track: Internal Control and Internal Audit Budget Execution & Implementation for Public Expenditure & Financial Accountability Course Washington, DC: January 17, 2003

The World Bank Control systems involve: Internal Control and Internal Audit 2 Identification of Risk Development of Internal Controls Development of of Internal Audit Internal Control & Audit

The World Bank Risks 3 Misuse and waste of financial, human and technical resources, including external aid Fraud and error Unsatisfactory accounting records Lack of timely and reliable financial and resource management information Going off the rail -- risks

The World Bank 2 1 Internal Control & Internal Audit: Professional Standards 4 See: INTOSAI at and IIA at See: INTOSAI at and IIA at Standards for the Professional Practice of Internal Auditing INTOSAI Guidelines for Internal Control Standards INTOSAI Guidelines for Internal Control Standards

The World Bank A process within an organization to provide reasonable assurance regarding the following primary objectives: Definition of Internal Control The reliability and integrity of information Compliance with policies, plans, procedures, laws and regulations The safeguarding of assets The economical and efficient use of resources The accomplishment of established objectives and goals of operations and programs The reliability and integrity of information Compliance with policies, plans, procedures, laws and regulations The safeguarding of assets The economical and efficient use of resources The accomplishment of established objectives and goals of operations and programs Source: The Institute of Internal Auditors Definition of Internal Control: “Internal control is a management tool … the organization, policies and procedures used to help ensure that government programs achieve their intended results; that the resources used to deliver these programs are consistent with the stated aims and objectives of the organizations concerned; that programs are protected from waste, fraud and mismanagement; and that reliable and timely information is obtained, maintained, reported and used for decision making.” -- INTOSAI, Guidelines for Internal Control, June 1992 Definition of Internal Control: “Internal control is a management tool … the organization, policies and procedures used to help ensure that government programs achieve their intended results; that the resources used to deliver these programs are consistent with the stated aims and objectives of the organizations concerned; that programs are protected from waste, fraud and mismanagement; and that reliable and timely information is obtained, maintained, reported and used for decision making.” -- INTOSAI, Guidelines for Internal Control, June

The World Bank Key Concepts of Internal Control Source: Committee of Sponsoring Organizations of the Treadway Commission (COSO) Internal control is … … a process … affected by people. It’s not merely policy manuals and procedures, but people at every level of the organization … can be expected to provide only reasonable assurance, not absolute assurance to an entities’ management & stakeholders … geared to the achievement of objectives 6

The World Bank 7 Importance of Internal Control in Government Ministries If these responsibilities are fulfilled properly, the result will be effective control over resources, decisions and activities and the achievement of ministry objectives. The average Ministry has a number of responsibilities (committing funds, recruiting staff, contracting for supplies and services, approving actions, registering transactions and events, deploying resources and controlling, supervising and reporting on implementation of policies). If not, abuses will proliferate and efficiency decline.

The World Bank Two Principles of Internal Control 8 Governing bodies of public sector entities need to ensure that a framework of control is established and operates in practice and that a statement on its effectiveness is included in the entity’s annual report. Governing bodies of public bodies need to ensure that effective systems of risk management are established as part of the framework of internal control. Source: IFAC, Corporate Governance in the Public Sector, 2000

The World Bank 9 Three Approaches to Internal Control A. Emphasis on controls that are exercised by a third party organization, at the center of government, often an agency of the Ministry of Finance or the MOF itself (“Napoleonic” tradition) B. Emphasis on responsibility for control being decentralized to line ministries and other government agencies (Anglo-Saxon, Scandinavian tradition) C. Mixed approaches (e.g., transition countries)

The World Bank Clear instructions to staff and appropriate training on the objectives, policies and code of conduct of the ministry or agency An unambiguous definition of the responsibilities of staff Clear separation of function and duties between staff members in handling financial transactions or resources issues, e.g., contracts Development of an “open” culture to encourage staff at all levels to draw attention to non-compliance and irregularity Requirements that staff at all levels are aware of and apply all relevant instructions Support from effective internal audit procedures Clear instructions to staff and appropriate training on the objectives, policies and code of conduct of the ministry or agency An unambiguous definition of the responsibilities of staff Clear separation of function and duties between staff members in handling financial transactions or resources issues, e.g., contracts Development of an “open” culture to encourage staff at all levels to draw attention to non-compliance and irregularity Requirements that staff at all levels are aware of and apply all relevant instructions Support from effective internal audit procedures Procedures Control Procedures 10

The World Bank Physical: e.g., security procedures intended to control access to documents and records Physical: e.g., security procedures intended to control access to documents and records Procurement Controls: e.g., rules for advertising and tendering major contracts Procurement Controls: e.g., rules for advertising and tendering major contracts Accounting Controls: e.g., requirement for all cash receipts to be deposited daily in a bank, internal procedures to detect and report anomalies Accounting Controls: e.g., requirement for all cash receipts to be deposited daily in a bank, internal procedures to detect and report anomalies Process Controls: e.g., issuance of a purchase order or the approval of a sizeable contract may require documentation from the requesting official, review by a purchasing clerk, and approval by a supervisor Process Controls: e.g., issuance of a purchase order or the approval of a sizeable contract may require documentation from the requesting official, review by a purchasing clerk, and approval by a supervisor Management of Financial & Other Records: Essential to establish audit trail Management of Financial & Other Records: Essential to establish audit trail Separation of Duties: Both a control measure and an indispensable element of many control systems – at least two officials should be involved in any transaction to avoid risk of improper actions Separation of Duties: Both a control measure and an indispensable element of many control systems – at least two officials should be involved in any transaction to avoid risk of improper actions Categories of Internal Control 11

The World Bank Design flaws 12 Limitations of Internal Control No system of internal control can provide an absolute guarantee against the risk of wronging or error. The proper goal of internal control is to provide “reasonable assurance” that improprieties will not occur, or if they do occur, they will be revealed, reported and appropriate action taken. Poor implementation Poor response to reported anomalies Collusion Wrongdoing by top managers

The World Bank Definition of Internal Audit Source: The Institute of Internal Auditors Definition of Internal Audit: “Internal auditing is an independent, objective, assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve effectiveness of risk management, control, and governance processes.” Definition of Internal Audit: “Internal auditing is an independent, objective, assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve effectiveness of risk management, control, and governance processes.” 13 Internal Audit

The World Bank 14 Internal Audit – Different Approaches In the Auditor-General tradition, internal audit is usually reflected in internal audit units of individual ministries or agencies, reporting directly to top management Such internal audit units may also exist in the Court of Accounts tradition Other variations – US Inspector General of each agency reports to agency management and to the Congress The external auditor (SAI) may use the work of the internal auditor Many countries of the Court of Accounts tradition have a central (independent) internal control agency located within the Ministry of Finance In some cases these have an extensive pre-audit role Generally wide powers of inspection and review, and in many cases a prosecutorial role

The World Bank What does the Internal Auditor Look For? 15 Systems & Procedures How well do the systems and procedures of internal control function? Procurement In the procurement field, has there been adequate publicity for calls to tender, are there satisfactory procedures for receiving and evaluating tenders, is the justification for contract awards in accordance with national requirements? Objectives’ Achievement Have programs and actions achieved their intended objectives? Are the systems and procedures in place to ensure that resources are used in accordance with the relevant rules and regulations? Resource use

The World Bank Independence of the Internal Auditor Not equivalent to the independence of the Auditor General or President of the Audit court. The internal auditor is responsible to the head of a ministry or agency and is part of the staff of that organization. “Internal auditors are independent when they carry out their work freely and objectively. Independence permits internal auditors to render their impartial and unbiased judgments essential to the proper conducts of audits. It is achieved through organizational status and objectivity.” Status and “weight” of internal auditor can be enhanced by having an audit committee chaired by the head of the ministry or agency. The internal auditor should not be involved in the internal control process which he is required to assess and judge. Not equivalent to the independence of the Auditor General or President of the Audit court. The internal auditor is responsible to the head of a ministry or agency and is part of the staff of that organization. “Internal auditors are independent when they carry out their work freely and objectively. Independence permits internal auditors to render their impartial and unbiased judgments essential to the proper conducts of audits. It is achieved through organizational status and objectivity.” Status and “weight” of internal auditor can be enhanced by having an audit committee chaired by the head of the ministry or agency. The internal auditor should not be involved in the internal control process which he is required to assess and judge. 16 Source: The Institute of Internal Auditors

The World Bank Audit Trail An audit trail is necessary to keep under review the timely and adequate flow of funds and the procedures for efficient accounting and the reconciliation of expenditure reports with funds received or claimed. It is necessary to trace or check: 17 To trace the budget provision that authorized payment To check the transfer of funds authorized by the treasury to the line ministry or agency To trace and evaluate the systems and procedures through which approval for payment to the contractor or beneficiary will be required to pass To locate completed payment files with evidence that payment has, or has not, been made in accordance with rules and regulations

The World Bank Internal Audit – Issues Who is in charge of internal auditing and what are their responsibilities? What is the desired relationship between external and internal auditors? What information should they share? Should they coordinate their work programs? How should the internal auditor fulfill his responsibilities to senior management? What are the limits on instructions that management may give to the auditor? Who should be the recipients of internal audit reports, other than senior management? What basic documents should the internal auditor produce, e.g., an annual audit plan, an annual audit report, etc.? Should the government follow the internal audit standards of the IIA or guidance from INTOSAI? Who is in charge of internal auditing and what are their responsibilities? What is the desired relationship between external and internal auditors? What information should they share? Should they coordinate their work programs? How should the internal auditor fulfill his responsibilities to senior management? What are the limits on instructions that management may give to the auditor? Who should be the recipients of internal audit reports, other than senior management? What basic documents should the internal auditor produce, e.g., an annual audit plan, an annual audit report, etc.? Should the government follow the internal audit standards of the IIA or guidance from INTOSAI? 18

The World Bank Q&A & Discussion