1. 1 Portfolio Committee on Home Affairs Presentation on Internal Audit 19 April 2013 Building a New Home Affairs

2. 2 Content of the presentation Legislative Mandate Internal Audit Budget Internal Audit Establishment Compliance with International Standards Key actions taken to comply with ISPPIA Findings of the Auditor-General Audit of foreign missions Current challenges Remedial steps

3. 3 RefDescriptionComplianceComments PFMA 38(1)(A)(I) The Accounting Officer of a department must ensure that the department has and maintains effective, efficient and transparent systems of financial and risk management and internal audit”.  TR 3.2.5The purpose, authority and responsibility of the internal audit function must, in consultation with the audit committee, be formally defined in an audit charter and be consistent with the Institute of Internal Auditors (“IIA”) definition of internal auditing  TR 3.2.6Internal audit must be conducted in accordance with the standards set by the Institute of Internal Auditors.  Partially compliant according to the review conducted during 2010/11 Legislative Mandate

4. 4 RefDescriptionComplianceComments TR 3.2.7An internal audit function must prepare, in consultation with and for approval by the audit committee - a rolling three-year strategic internal audit plan based on its assessment of key areas of risk for the institution, having regard to its current operations, those proposed in its strategic plan and its risk management strategy. An annual internal audit plan for the first year of the rolling three year strategic internal audit plan. Plans indicating the proposed scope of each audit in the annual internal audit plan. A quarterly report to the audit committee detailing its performance against the annual internal audit plan, to allow effective monitoring.  Legislative Mandate

5. 5 RefDescriptionComplianceComments TR 3.2.9An internal audit function must report directly to the accounting officer and shall report at all audit committee meetings. The function must be independent of activities that are audited, with no limitation on its access to information.an internal audit function must prepare, in consultation with and for approval by he audit committee-  TR 3.2.10The internal audit function must co-ordinate with other internal and external providers of assurance to ensure proper coverage and to minimize duplication of effort.  Legislative Mandate

6. 6 RefDescriptionComplianceComments TR 3.2.11.The internal audit function must assist the accounting officer in maintaining efficient and effective controls by evaluating those controls to determine their effectiveness and efficiency, and by developing recommendations for enhancement or improvement. The controls subject to evaluation should encompass the following- (a) the information systems environment; (b) the reliability and integrity of financial and operational information; (c) the effectiveness of operations; (d) safeguarding of assets; and (e) compliance with laws, regulations and controls.  The Auditor-General has reported that there is insufficient auditing of information systems audit, performance information as well as monthly management accounts and interim financial statements Legislative Mandate

7. 7 RefDescriptionComplianceComments TR 3.2.12.The internal audit function must assist the accounting officer in achieving the objectives of the institution by evaluating and developing recommendations for the enhancement or improvement of the processes through which - (a) objectives and values are established and communicated; (b) the accomplishment of objectives is monitored; (c) accountability is ensured; and (d) corporate values are preserved.  Legislative Mandate

8. 8 DetailsTotal BudgetCompensationGoods and Services TOTAL20 792 00011 543 0009 249 000 Internal Audit Budget

9. 9 No of funded posts22 No of filled posts17 Employment offers made Director: IT and Continuous Audit Deputy Director: IT and Continuous Audit Office Manager 3 Current vacancies 2 x Senior Internal Auditors 2 Internal Audit Establishment

10. 10 An external quality assurance review was done in 2010. The state of play at that point compared to now is as follows: April 2013July 2011 Compliance with the International Standards for the Professional Practice of Internal Auditing (ISPPIA)

11. 11 Quality Assurance Findings – July 2011

12. 12 Quality Assurance Findings – April 2013

13. 13 Extensively revised the Internal Audit Methodology to bring it in line with a risk-based audit approach Introduced checklists at critical points in the audit process to improve quality control Trained Internal Audit staff in the application of the Internal Audit Methodology Improved the systems for documenting and tracking management’s implementation of audit recommendations Enhanced the time management system Enhanced reporting to the Audit Committee Key actions taken to comply with ISPPIA

14. 14 Took steps to bring in IT audit capacity Took steps to bring in an Office Manager to assist in monitoring of time and project management Took steps to reorganise internally to improve productivity Expanded the use of computer assisted auditing techniques (CAATs), however, there is still more room to improve the use of CAATs With regard to the audit of the foreign missions closer collaboration has been fostered with DIRCO Internal Audit to establish synergies Key actions taken to comply with ISPPIA

15. 15 NoFindingsStatus 1The internal audit function did not submit reports, detailing the performance against the annual internal audit plan, to the audit committee every quarter, as required by Treasury Regulation 3.2.7(d). Resolved 2The internal audit function did not have a three year rolling strategic plan in place, as required by Treasury Regulation 3.2.7(a). Resolved 3The purpose, authority and responsibility of the internal audit function were not formally defined in an audit charter, as required by Treasury Regulation 3.2.5. Resolved Findings of the Auditor-General

16. 16 Findings of the Auditor-General (Continued) NoFindingsStatus 4The internal audit function did not have an annual internal audit plan for the first year of the rolling three year strategic internal audit plan, as required by Treasury Regulation 3.2.7(b) Resolved 5The internal audit function did not evaluate the reliability and integrity of financial and operational information, as required by Treasury Regulation 3.2.11(b). Partially resolved. As IA did not manage to execute 100% of the audit plan some of the projects related to these matters were not completed.

17. 17 54 foreign missions have DHA staff performing DHA functions and are audited by DHA Internal Audit All other missions have DIRCO staff performing DHA functions and are audited by DIRCO Internal Audit Steps have been taken recently to ensure that DHA receives reports from DIRCO on the audits that they have done with regard to the DHA functions A risk ranking matrix for foreign missions has been implemented to inform which missions must be audited The following foreign missions were audited in 2010 /11: Luanda, Angola and Kinshasa, DRC The following foreign missions were audited in 2011 /12: Accra, Ghana; New Delhi, India and Nairobi, Kenya No foreign missions were audited in 2012/13 and the following audits are planned for 2013/14: Windhoek, Namibia; Maputo, Mozambique; Sao Paolo, Brazil; Canberra, Australia; Toronto, Canada and Mbabane, Swaziland. Asmara, Eritrea and 1 other mission to be agreed upon will be audited jointly with DIRCO Internal Audit Audit of the foreign missions

18. 18 Situation of the Chief Audit Executive Capability of Internal Audit staff Quality of internal audits Long delays in finalising internal audit projects Operating model of Internal Audit Current Challenges

19. 19 A process is underway to appoint an Acting Chief Audit Executive on a full time basis pending resolution of the labour relations process against the incumbent CAE Greater attention is being given to improve the implementation of quality assurance, time keeping and project management tools On going staff development programmes There is an increased focus on staff performance management. The Audit Committee and Executive have instructed that serial non-performers must be performance managed out of Internal Audit and possibly the department. Remedial Steps

20. 20 A strategic co-sourcing model has been agreed upon. A pool of service providers will be established to supplement the internal capacity. The SCM process to give effect to this has commenced. The priority task of the incoming IT Audit specialists will be to design and implement a system of continuous auditing Remedial Steps

21. 21 THANK YOU Questions? Comments? Suggestions?