1. Steps in the Transition to an Impact- Focused Audit Function Modifying Procedures, Audit Practices, and Reports to Address Risk Gert van der Linde, World Bank Uganda, Kampala May 18, 2004

2. From…… Pre-audit (often 100%) Checking compliance to procedural rules and regulations No independence Limited impact to improve the control environment ………..……to

3. An Independent IA function Audit Committee Annual Audit Coverage Planning Assignment Planning Risk Assessment Control Identification Control Assurance Reporting

4. Annual Audit Coverage Planning Determine audit universe Compile audit coverage plan –Prioritisation and rating of areas –Type of assignment e.g. Business process, Product, Branch audit, etc. Contract with line manager & SBU Exco Approval by Group Exco Approval by GACC Deliverable: Annual Audit Coverage Plan

5. Assignment Planning Preliminary review –Obtain background information of audit area Determine assignment scope & objectives –Risk Management Plan, Control Adequacy Evaluation, Control Effectiveness Evaluation Develop Assignment Planning Memorandum –Sign-off by Line manager –Notification to / Sign-off by SBU Exco member –Sign-off by Audit Services Section Head Deliverable: Assignment Planning Memorandum

6. Risk Assessment Identify functional areas Identify risk areas Identify risks Identify risk elements Prioritisation of risks & risk elements Deliverable: Risk Profile

7. Risk Measurement The risk elements of each risk are used to determine risk levels Risks are evaluated by determining – the PROBABILITY of a risk occurring and –the SEVERITY should the risk materialise As perceptions are measured it is important to involve senior management and experts Deviations from median calculations are evaluated

8. Risk Measurement Probability rating is done according to: –Past frequency –Current possibility Seriousness rating is done according to –Monetary Loss –Time Loss –Image Loss

9. Risk Measurement Risk rating tables are used to provide a standard to equate all risks Worksheets are used to record the risk rating of risk elements A weighted average of all risk elements is calculated per risk to establish the probability and severity rating of each risk

10. Probability rating guideline to ensure a uniform rating approach

11. Seriousness rating guideline to ensure a uniform rating approach

12. A “Risk Profile” 1314151617181920212223242526293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788 Probability 0 123 4 56 7891011 1 2 3 4 5 6 7 8 9 10 11 0 Seriousness TREASURY - AGRIS Control Profile 6 13 2 1 4 5 3 9 8 Risk areas 12 10 7 11 Low Risk Areas Medium Risk Areas High Risk Areas 1 -Implementation of trading strategy 2 -Marketing of products / services 3 -Market / product liquidity 4 -Obtaining of credit approvals 5 -Security documentation 6 -Management of counterparty exposures 7 -Dealing and pricing systems 8 -Quoting of rates 9 -Trading 10 -Income generation 11 -Fee / commission structure 12 -Position revaluation 13 -VaR / Sensitivity Analysis

13. Control Identification Identify preventative controls Identify contingent controls Determine responsibility for controls Deliverable: Risk Management Plan

14. Risk Management Plan - Contents Risk number Risk Definition of the risk Probability rating Seriousness rating Risk value Risk elements and ratings Preventative controls Contingent controls Responsibility Target dates

15. Control Assurance Perform control adequacy evaluation –Ensure existence of controls –Evaluate economy and efficiency of application Perform control effectiveness evaluation –Provide an opinion on the level of effectiveness of adequate controls Perform substantive testing –To substantiate the impact where no controls exist Deliverable: Audit Findings

16. Reporting and follow-up Present findings and recommendations Obtain management responses Rank findings, using standard rating tables Compile an Executive Summary –Critical and significant findings –Audit opinion on area audited Risk Management Plan –Detailed findings GACC reporting –Critical findings –Follow up actions Deliverable: Audit Assignment Report

17. Challenge – Maintain a “Control Profile”

18. Steps in the Transition to an Impact- Focused Audit Function Modifying Procedures, Audit Practices, and Reports to Address Risk Questions?