1. The World Bank Presented by: Richard Allen, PEFA Program Keeping on Track: Internal Control and Internal Audit Public Expenditure & Financial Accountability Course PREM Learning Week: April 9, 2003

2. The World Bank Control systems involve: Internal Control and Internal Audit 2 Identification of Risk Development of Internal Controls Development of Internal Audit Internal Control & Audit

3. The World Bank Risks 3 Misuse and waste of financial, human and technical resources, including external aid Fraud and error Unsatisfactory accounting records Lack of timely and reliable financial and resource management information Going off the rail -- risks

4. The World Bank 2 1 Internal Control & Internal Audit: Professional Standards 4 See: INTOSAI at http://www.intosai.org/ and IIA at http://www.theiia.org/ http://www.intosai.org http://www.theiia.org/ See: INTOSAI at http://www.intosai.org/ and IIA at http://www.theiia.org/ http://www.intosai.org http://www.theiia.org/ Standards for the Professional Practice of Internal Auditing INTOSAI Guidelines for Internal Control Standards INTOSAI Guidelines for Internal Control Standards

5. The World Bank A process within an organization to provide reasonable assurance regarding the following primary objectives: Definition of Internal Control The reliability and integrity of information Compliance with policies, plans, procedures, laws and regulations The safeguarding of assets The economical and efficient use of resources The accomplishment of established objectives and goals of operations and programs The reliability and integrity of information Compliance with policies, plans, procedures, laws and regulations The safeguarding of assets The economical and efficient use of resources The accomplishment of established objectives and goals of operations and programs Source: The Institute of Internal Auditors Definition of Internal Control: “Internal control is a management tool … the organization, policies and procedures used to help ensure that government programs achieve their intended results; that the resources used to deliver these programs are consistent with the stated aims and objectives of the organizations concerned; that programs are protected from waste, fraud and mismanagement; and that reliable and timely information is obtained, maintained, reported and used for decision making.” -- INTOSAI, Guidelines for Internal Control, June 1992 Definition of Internal Control: “Internal control is a management tool … the organization, policies and procedures used to help ensure that government programs achieve their intended results; that the resources used to deliver these programs are consistent with the stated aims and objectives of the organizations concerned; that programs are protected from waste, fraud and mismanagement; and that reliable and timely information is obtained, maintained, reported and used for decision making.” -- INTOSAI, Guidelines for Internal Control, June 1992 5

6. The World Bank Key Concepts of Internal Control Source: Committee of Sponsoring Organizations of the Treadway Commission (COSO) Internal control is … … a process … affected by people. It’s not merely policy manuals and procedures, but people at every level of the organization … can be expected to provide only reasonable assurance, not absolute assurance to an entities’ management & stakeholders … geared to the achievement of objectives 6

7. The World Bank 7 Importance of Internal Control in Government Ministries If these responsibilities are fulfilled properly, the result will be effective control over resources, decisions and activities and the achievement of ministry objectives. The average Ministry has a number of responsibilities (committing funds, recruiting staff, contracting for supplies and services, approving actions, registering transactions and events, deploying resources and controlling, supervising and reporting on implementation of policies). If not, abuses will proliferate and efficiency decline.

8. The World Bank Two Principles of Internal Control 8 Governing bodies of public sector entities need to ensure that a framework of control is established and operates in practice and that a statement on its effectiveness is included in the entity’s annual report. Governing bodies of public bodies need to ensure that effective systems of risk management are established as part of the framework of internal control. Source: IFAC, Corporate Governance in the Public Sector, 2000

9. The World Bank Clear instructions to staff and appropriate training on the objectives, policies and code of conduct of the ministry or agency An unambiguous definition of the responsibilities of staff Clear separation of function and duties between staff members in handling financial transactions or resources issues, e.g., contracts Development of an “open” culture to encourage staff at all levels to draw attention to non-compliance and irregularity Requirements that staff at all levels are aware of and apply all relevant instructions Support from effective internal audit procedures Clear instructions to staff and appropriate training on the objectives, policies and code of conduct of the ministry or agency An unambiguous definition of the responsibilities of staff Clear separation of function and duties between staff members in handling financial transactions or resources issues, e.g., contracts Development of an “open” culture to encourage staff at all levels to draw attention to non-compliance and irregularity Requirements that staff at all levels are aware of and apply all relevant instructions Support from effective internal audit procedures Procedures Control Procedures 9

10. The World Bank 10 Role of the Ministry of Finance 1. To establish a framework of regulations and operational standards and guidelines, on internal control, for spending ministries 2. To ensure that the regulations are complied with spending ministries (internal audit) 3. In Francophone countries: To participate in the exercise of internal control in spending ministries* Ministry of Finance * Note: In some Anglophone countries also, officials who perform the internal control function in spending ministries are employees of the internal audit department of the Ministry of Finance (e.g., Kenya, Uganda, Malawi)

11. The World Bank Controleur financier (MoF) Ordonnateur (Commitment Officer) Controleur financier Checks regularity and conformity of commitment against budget appropriations Issues a payment order to the Treasury Issues a second visa (approval) to make commitment legally binding Treasury Accountant (Directeur de la Comptabilite Publique) Makes the payment Francophone System of Internal Control Four Stages: 11

12. The World Bank Physical: e.g., security procedures intended to control access to documents and records Physical: e.g., security procedures intended to control access to documents and records Procurement Controls: e.g., rules for advertising and tendering major contracts Procurement Controls: e.g., rules for advertising and tendering major contracts Accounting Controls: e.g., requirement for all cash receipts to be deposited daily in a bank, internal procedures to detect and report anomalies Accounting Controls: e.g., requirement for all cash receipts to be deposited daily in a bank, internal procedures to detect and report anomalies Process Controls: e.g., issuance of a purchase order or the approval of a sizeable contract may require documentation from the requesting official, review by a purchasing clerk, and approval by a supervisor Process Controls: e.g., issuance of a purchase order or the approval of a sizeable contract may require documentation from the requesting official, review by a purchasing clerk, and approval by a supervisor Management of Financial & Other Records: Essential to establish audit trail Management of Financial & Other Records: Essential to establish audit trail Separation of Duties: Both a control measure and an indispensable element of many control systems – at least two officials should be involved in any transaction to avoid risk of improper actions Separation of Duties: Both a control measure and an indispensable element of many control systems – at least two officials should be involved in any transaction to avoid risk of improper actions Categories of Internal Control 12

13. The World Bank Design flaws 13 Limitations of Internal Control No system of internal control can provide an absolute guarantee against the risk of wronging or error. The proper goal of internal control is to provide “reasonable assurance” that improprieties will not occur, or if they do occur, they will be revealed, reported and appropriate action taken. Poor implementation Poor response to reported anomalies Collusion Wrongdoing by top managers

14. The World Bank Definition of Internal Audit Source: The Institute of Internal Auditors Definition of Internal Audit: “Internal auditing is an independent, objective, assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve effectiveness of risk management, control, and governance processes.” Definition of Internal Audit: “Internal auditing is an independent, objective, assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve effectiveness of risk management, control, and governance processes.” 14 Internal Audit

15. The World Bank 15 Internal Audit – Different Approaches In the Anglophone tradition, internal audit is usually reflected in internal audit units of individual ministries or agencies, reporting directly to top management Mixed internal/external audit systems,  Germany: internal audit is part of the Federal Court of Audit (external)  US: Inspector General of each agency reports to agency management and to the Congress Most Francophone countries have an internal audit unit – L’Inspection des Finances – located in the Ministry of Finance Generally have wide powers of inspection and review, and in many cases a prosecutorial role Some Anglophone countries also have an inspection department in the MoF, with similar powers Note: There are many different models in developing countries, e.g., Anglophone Africa, Francophone Africa, Latin America (Controloria), FSU countries, former SFR Yugoslavia. See: J. Diamond, “The Role of Internal Audit in Government Financial Management: An International Perspective”, IMF Working Paper, WP/02/94.

16. The World Bank What does the Internal Auditor Look For? 16 Systems & Procedures How well do the systems and procedures of internal control function? Procurement In the procurement field, has there been adequate publicity for calls to tender, are there satisfactory procedures for receiving and evaluating tenders, is the justification for contract awards in accordance with national requirements? Achievement of Objectives Have programs and actions achieved their intended objectives? Are the systems and procedures in place to ensure that resources are used in accordance with the relevant rules and regulations? Resource use

17. The World Bank Audit Trail An audit trail is necessary to keep under review the timely and adequate flow of funds and the procedures for efficient accounting and the reconciliation of expenditure reports with funds received or claimed. It is necessary to trace or check: 17 To trace the budget provision that authorized payment To check the transfer of funds authorized by the treasury to the line ministry or agency To trace and evaluate the systems and procedures through which approval for payment to the contractor or beneficiary will be required to pass To locate completed payment files with evidence that payment has, or has not, been made in accordance with rules and regulations

18. The World Bank “The overall design of the IA function should be geared to the specific priorities of a country. For those countries with governance problems, the first and foremost objective should be to ensure compliance with the financial laws and regulations. For those developing and transitional economies faced with a high degree of fiscal stress, the need to ensure macroeconomic objectives will be paramount. For those countries that can ensure compliance with the law and have reached a fair degree of macro- economic stability, more attention can be paid to ensuring efficiency and effectiveness of resource use, as currently emphasized in the OECD countries.” “A fundamental design issue that usually has to be faced is the degree of centralization in the organization of the IA function … The centralized approach has often been viewed as better from a capacity building viewpoint. However, disadvantages of centralization are also evident, namely … weakening accountability of line ministry management, limited effectiveness because of weak transparency, and failure to foster close cooperation with other departments.” Source: J. Diamond, “The Role of Internal Audit in Government Financial Management: An International Perspective,” IMF Working Paper, WP/02/94. Reforming Internal Audit in Developing & Transitional Countries 18

19. The World Bank Reviewing the compliance with the existing Government financial regulations Evaluating the effectiveness of the Internal Control Systems. Appraising the economy and effectiveness with which financial and other resources are being used. Reviewing the reliability and integrity of record keeping and reporting on financial and operating information systems. Pre-audit of payments documents and of all documents used in initiating commitments, as well as contract agreements. Verifying and certifying periodical financial returns such as pending bills returns, expenditure returns, revenue returns, staff returns, vehicle returns, etc. Investigation of irregularities identified or reported and reporting on cases leading to wastage of resources cases of general misuse or misappropriation of financial resources and Government property. Ensuring that revenue and other receipts collection points, projects, supply, and delivery sites to ensure compliance with procedures and regulations. Reviewing budgetary controls on issuance of warrants, commitments, expenditures, revenue collection, and accounting from time to time. Ensuring that government physical assets are appropriately recorded and are kept under safe custody. Reviewing the budgetary reallocation process to ensure legislative and administrative compliance and advising when commitments are entered into when there is no budgetary provision or adequate cash. Source: J. Diamond, “The Role of Internal Audit in Government Financial Management: An International Perspective,” IMF Working Paper, WP/02/94. Duties and Responsibilities of Internal Audit 19

20. The World Bank There should be proper coordination to ensure adequate audit coverage and to minimize duplication of effort. There should be access to each other’s audit plans and programs. Periodic meetings should be organized to discuss matters of mutual interest. There should be an exchange of audit reports. Institutional mechanisms should be created to ensure common understanding and sharing of audit techniques and methods. Sharing of training and exchange of staff for two-three years in each case. The external auditor should review the performance of internal auditors (I.e., are they performing according to their objectives and plans?). A quality assessment of their work should be included. The external auditor should strengthen the position of the IA by reviewing and commenting on lack of action on IA reports. Source: J. Diamond, “The Role of Internal Audit in Government Financial Management: An International Perspective,” IMF Working Paper, WP/02/94. Recommended Coordination Between Internal & External Audit 20

21. The World Bank Q&A & Discussion