Attendance recording policy - For government | … · Web viewDSITI Internal Audit plays a key role...

Management assurance frameworkQueensland Shared ServicesVersion number: V8.0 Reference number: QSS/2134-01

Policy owner: Director, Corporate Assurance and Risk Management Total number of pages: 18

Effective date: July 2015 Review date: July 2016

Security classification: PUBLIC Uncontrolled when printed

Table of Contents1 Introduction...............................................................................................................................3

1.1 Background......................................................................................................................3

1.2 Internal control and risk environment...............................................................................3

1.2.1 Governance of QSS operations..............................................................................3

1.2.2 Risk management...................................................................................................4

1.2.3 Control activities.....................................................................................................4

1.2.4 Information and communication.............................................................................4

1.2.5 Monitoring...............................................................................................................4

2 Purpose.....................................................................................................................................4

3 Scope........................................................................................................................................5

4 Management assurance framework details..............................................................................5

4.1 Internal control objectives................................................................................................5

4.1.1 Governance controls..............................................................................................5

4.1.2 Business process controls......................................................................................5

4.1.3 Information technology general controls................................................................6

4.2 Internal control assessment.............................................................................................6

4.2.1 Assessment scope.................................................................................................6

4.2.2 Methodology...........................................................................................................6

4.2.3 Assurance from third party providers......................................................................7

4.2.4 DSITI Internal Audit................................................................................................7

4.3 Reporting.........................................................................................................................7

4.3.1 Interim status update..............................................................................................7

4.3.2 Final management assurance report......................................................................7

Queensland Shared Services Security classification: Public

4.3.3 Post balance date assurance.................................................................................8

4.4 Continuous improvement.................................................................................................8

4.5 CARM solution.................................................................................................................8

5 Responsibilities.........................................................................................................................9

6 Endorsement and approval.....................................................................................................11

Appendix A: Contacts.......................................................................................................................12

Appendix B: References...................................................................................................................12

Appendix C: Definitions....................................................................................................................13

Appendix D: Internal control assurance model.................................................................................15

Appendix E: DSITI assurance framework........................................................................................17

Appendix F: MAF process map........................................................................................................18

of 18

Security classification: Public Management assurance framework

1 Introduction

1.1 BackgroundQueensland Shared Services (QSS) is a provider of corporate services to Queensland Government entities, that is, state government departments and statutory bodies (hereafter referred to as customers). QSS provides financial services, human resource management services and underlying application support and maintenance services to its customers. QSS has established Service Agreements (SAs) with its customers.

QSS is a business area (division) within the Department of Science, Information Technology and Innovation (DSITI) and the Director-General of DSITI is the accountable officer for QSS.

Agency accountability and financial administration requirements are underpinned by the Queensland Financial Accountability Act 2009 (FAA) and the Queensland Financial and Performance Management Standard 2009 (FPMS).

Under section 61 of the FAA, accountable officers are responsible for the efficient, effective and economical operation of their department and for the establishment and maintenance of appropriate systems of internal control and risk management.

To discharge this responsibility, section 77 of the FAA includes the requirement, for departments only, that an accountable officer must delegate the establishment and review of financial internal controls to the chief finance officer (CFO). The CFO must provide to the accountable officer a statement before or at the same time the CFO certifies the annual financial statements, about whether the financial internal controls of the department are operating efficiently, effectively and economically. As prescribed in section 57(1)(d) of the FPMS, the CFO statement must include assurance over external service providers in relation to their internal controls.

As an external service provider of corporate services, QSS is responsible for the design, implementation, maintaining and monitoring of an internal control framework for its operations. In carrying out this responsibility, QSS has regard to the interests of its customers, other key government stakeholders and to the general efficiency, effectiveness and economical operation of its business.

1.2 Internal control and risk environmentThe FAA defines internal control as:…the methods adopted within an entity to safeguard its assets; check the accuracy and reliability of its accounting information; and secure compliance with the prescribed requirements that apply to the entity.

QSS has established its internal controls based on the principles outlined in the Committee of Sponsoring Organisations (COSO) Internal Control Integrated Framework Guidance on Monitoring Internal Control Systems, May 2013.

1.2.1 Governance of QSS operationsQSS has a formalised organisational structure with distinct operational responsibilities including: Service Delivery (Finance, Human Resources and Mail) Systems Business Transformation Corporate Assurance and Risk Management (CARM)

of 18


The Executive Directors are responsible for the provision of services within their area of responsibility and they report directly to the Assistant Director-General, QSS within DSITI. CARM is an independent business unit which directly reports to the Assistant Director-General, QSS.

1.2.2 Risk managementQSS has implemented a robust risk management process in accordance with the approved DSITI departmental risk management framework, policy and guidelines. Risk management assessment is performed regularly and a risk register is in place which incorporates risk treatment plans for the identified risks. The risk register is tabled at the monthly QSS Executive Management Group (QSS EMG) meeting for review. The CARM unit coordinates the risk management process.

1.2.3 Control activities QSS management has established its internal control environment with documented control objectives and control activities through a risk management process. These control objectives have been developed to address risks relating to QSS delivery of financial, human resource management (including payroll) and information technology services.

1.2.4 Information and communication QSS has implemented an effective communication process around its management reporting and business operations to communicate pertinent information for reporting and decision making. There are different forums, committees and groups established within QSS to facilitate such communication. Key stakeholders have been identified and an effective communication strategy implemented with customers and suppliers.

1.2.5 MonitoringQSS has established a reasonable number of internal monitoring and review processes necessary for evaluating the continual effectiveness of controls. The monitoring and control functions are carried out as follows: The QSS EMG is responsible for overseeing the primary governance of QSS. The QSS EMG

convenes weekly and at least once a month reviews and provides direction on QSS issues covering governance, risk management, compliance and audit.

The CARM unit regularly monitors the effectiveness of established internal controls and compliance with relevant policies and practices as part of the annual Management Assurance Framework (MAF) testing and reporting.

At the DSITI departmental level, the DSITI Audit and Risk Management Committee provides oversight in relation to the internal control systems, risk management systems and the internal and external audit functions.

2 PurposeThe purpose of the MAF is to provide a high level framework for QSS to effectively manage its internal controls and comply with relevant legislation for the provision of Service Agreement based services. Refer to Appendix B for a list of references used to develop the MAF. Effective implementation of the MAF enables QSS to provide reasonable assurance to its customers that management has maintained, in all material respects, efficient, effective and economical internal controls for its operations.

The MAF forms part of the QSS Internal Control Assurance Model (refer to Appendix D) and DSITI Assurance Framework (refer to Appendix E).

of 18


3 ScopeThe MAF is limited to the scope of services as outlined in the SAs signed between QSS and its customers. It does not encompass responsibilities undertaken by customers for their part of service provision or the external audit assurance requirements under the Standard on Assurance Engagements ASAE 3402 Assurance reports on controls at a service organisation.

4 Management assurance framework detailsThe framework includes the below components:

Refer to Appendix F for the detailed process of implementing the MAF.

4.1 Internal control objectivesThe following is a list of the internal control objectives identified through the risk management process.

4.1.1 Governance controlsInternal control objective 1: A formal governance structure is established with clear roles and responsibilities to ensure effective decision making, monitoring and review of QSS’s operations and performance and information is communicated to relevant QSS stakeholders.

Internal control objective 2: A robust risk management process has been implemented by business areas to manage operational risks effectively.

4.1.2 Business process controlsInternal control objective 3: Processing of transactions is subject to customer agency authorisation and adequate procedures are implemented within QSS to ensure the accuracy, completeness and integrity of documents being processed.

of 18


Internal control objective 4: Segregation of duties (SoD) is implemented either through preventative or compensating controls to mitigate SoD risks.

Internal control objective 5: Validation and reconciliations are performed adequately to ensure the accuracy, completeness and integrity of transactions processed.

Internal control objective 6: Processes and procedures have been implemented to manage customer agencies’ records in accordance with relevant record management standards.

4.1.3 Information technology general controlsInternal control objective 7: Logical access security (including application security management) is implemented adequately to comply with relevant information security standards and ensure the confidentiality, integrity and availability of information systems and data.

Internal control objective 8: Change management processes have been implemented effectively with segregation of duties to manage all information, communication and technology changes.

Internal control objective 9: Business continuity (BCP) and Disaster recovery (DRP) plans are developed and implemented effectively to ensure the continued business operations in case of unexpected events or disruptions to the systems.

Internal control objective 10: Physical and environmental security is restricted to prevent inadvertent or unauthorised access to systems, assets and information that are managed, maintained, owned or used by QSS.

4.2 Internal control assessmentQSS performs annual control self-assessments to test the internal control objectives and associated internal control activities, covering the period from 1 July to 30 June of each financial year.

4.2.1 Assessment scopeThe assessment scope will be determined based on the following items: internal control objectives for QSS to provide services to its customers as outlined in the

service agreements internal control activities including the key specific policies and procedures established to meet

internal control objectives QAO QSS ASAE 3402 Assurance Report testing coverage and issues identified; all processes

related to the issues raised in the recent QAO QSS ASAE 3402 report should be considered to be included in the MAF testing depending on the risk level

DSITI Internal Audit coverage for QSS during the current financial year and issues identified. the QSS risk register initiatives and internal control environment changes within QSS during the current financial

year consultation with key stakeholders within QSS.

4.2.2 Methodology Control self-assessment methodology will be used to test the effectiveness of the internal control activities. The following steps will be undertaken:

of 18


Control self-assessments including comprehensive internal control activities will be distributed and completed by QSS Service Delivery (Finance, Human Resources and Mail), QSS Systems and any other applicable business areas.

Sampling techniques will be used to submit evidence to support responses. The actual sampling size will be determined before the testing, taking into account the complexity and consistency of the control activities applied for each customer agency.

Responses and supporting evidence will be reviewed and approved by responsible directors. Responses and supporting evidence will be independently analysed and control weaknesses, if

any, will be identified by the CARM unit with action plans agreed with management. The CARM unit will continue to monitor the implementation of action plan by management.

4.2.3 Assurance from third party providersQSS obtains assurance reports from its third party providers annually and performs an assessment of those against the internal control objectives.

The assessment process is to provide reasonable assurance regarding: compliance with control objectives and procedures appropriate risk management policies and procedures are in place appropriate internal controls are in place monitoring and reporting is adequate, accurate and timely.

4.2.4 DSITI Internal AuditDSITI Internal Audit plays a key role in the departmental assurance framework. In accordance with the approved internal audit annual audit plan, Internal Audit sets out the audits intended to be carried out for QSS. The audit findings and recommendations arising from such audit activity are formally reported to QSS management for consideration and corrective action.

The CARM unit is responsible for monitoring the implementation of corrective actions implemented by management.

QSS will communicate with the appropriate customer agency officer any issues raised by DSITI Internal Audit which may have a material impact on customer agencies.

4.3 Reporting 4.3.1 Interim status updateIn February of each year QSS provides each customer agency’s Chief Finance Officer a status update by email, containing: a list of all audit issues raised by DSITI Internal Audit and the current status update a list of material control exceptions identified through previous financial year’s MAF testing and

status update

The purpose is to provide each customer agency with an update of QSS internal controls and highlight any material internal control weaknesses to the customer.

4.3.2 Final management assurance reportBy 31 July each year QSS provides each customer agency’s accountable officer with a detailed management assurance report and an accompanying letter. The assurance report covers the previous financial year and provides assessment results concerning the effectiveness of internal controls established and operated by QSS. The intent is to provide reasonable assurance that, in all material aspects, the internal controls have been operating efficiently, effectively and economically.

of 18


The final management assurance report will include the following information: assessment results for control objectives and control activities operated by QSS DSITI Internal Audit issues identified and a status update on management actions assurance outcomes provided by QSS third party providers.

It is important to mention that the management assurance report is not intended to diminish the customer’s responsibility and accountability for designing, implementing and reporting on the adequacy and effectiveness of its own risk management and internal control system.

4.3.3 Post balance date assurance By mid-August each year QSS provides each customer agency’s accountable officer with a separate post balance date assurance letter prior to certification of their financial statements.

This assurance letter states whether or not there have been any significant internal control changes or financial events within QSS since the balance date that may have a material effect on the financial management of the customer agency. Where applicable, the impact of any change or event is identified and quantified in the letter.

4.4 Continuous improvementThe CARM unit facilitates the continuous improvement of implementing the MAF through working with management in the following activities: review and update QSS risk register review and update internal control objectives to reflect relevant legislative changes, other

external drivers and QSS risks review and update control activities and control self-assessments to reflect the control

environment changes, new initiatives within QSS and audit issues raised by DSITI Internal Audit and external auditor

continuously improve the control self-assessment methodologies and techniques to ensure efficient and effective assurance processes.

4.5 CARM solution The CARM solution is a web based system implemented and utilised by QSS to simplify the control self-assessment process and related MAF testing and reporting. The CARM solution is used to:

assess control activities, develop improvement plans and review, consolidate and analyse results on a real time basis

improve efficiency and timeliness of the process support the quality assurance process improve reporting mechanisms and enable effective compliance reporting facilitate business improvements enable assessment of non-financial systems (e.g. human resources, information

technology) store data in a central electronic repository resulting in easy access to information and a

considerable improvement to the efficiency and effectiveness of the appraisal process.

The CARM unit provides the system support, maintenance and helpdesk function to all users.

of 18


5 Responsibilities The below table describes the responsibility of each stakeholder to ensure the effectiveness of MAF implementation.

Role ResponsibilityDirector-General, DSITI

Approve the MAF Endorse and sign the management assurance reports and post balance date

assurance letters issued to customers’ accountable officers Requires the Assistant Director-General, Queensland Shared Services (QSS) to

establish and maintain the MAF Requires QSS to regularly review the framework and its associated system of

reporting on internal control objectives and internal control activities.Assistant Director-General, QSS

Own the control environment encompassing the responsibility for establishing, endorsing and reviewing the MAF and associated internal control environment and internal control objectives

Review and certify the management assurance reports and post balance date assurance letters following acceptance by the executive directors

Provide leadership to the QSS Executive Management Group (EMG) which shapes and endorses the values, principles and operating policies that form the basis of the framework of internal controls.

Executive Directors and Directors

Ensure that the framework is incorporated within their area of responsibility Ensure that internal controls and other policies and procedures aimed at ensuring

QSS meets its internal control objectives are established and maintained Develop processes that identify, monitor and review operational risks and

developing strategies that mitigate identified risks Be cognisant of audit recommendations and, where weaknesses are identified,

take appropriate and timely action to strengthen control and compliance procedures

Actively support the annual program of work provided by internal and external audit

Implement appropriate responses to issues raised by internal and external audit Review the adequacy and effectiveness of control self-assessments and refine

where necessary Review and complete the control self-assessments Oversee all aspects of QSS internal control activities within their area of

responsibility and ensure that managers apply a range of tools, structures, forums and strategies to adhere to the MAF.

Internal Audit DSITI Internal Audit has a direct reporting relationship to the Director-General, DSITI and the DSITI Audit Committee

In accordance with the approved DSITI internal audit annual audit plan, Internal Audit sets out the audits intended to be carried out which includes coverage within QSS. The audit findings and recommendations arising from such audit activity are formally reported to departmental management for consideration and corrective action

Monitor and report on the implementation of agreed audit recommendations Provide independent audit advice as an observer to QSS EMG.

External audit – Queensland Audit Office

Support the role of the Auditor-General in providing Parliament with an independent assessment of the financial management-related activities of public sector entities

Undertake independent ASAE 3402 controls assurance review of QSS in accordance with its program of work

Report on audit issues and recommendations requiring further consideration or attention to QSS EMG

Provide external audit assurance to the Director-General, DSITI.

of 18


Role ResponsibilityQSS Executive Management Group

Ensure formal decision-making, monitoring and review structures or forums are established within QSS

Ensure structures or forums are transparent and subject to scrutiny Ensure structures or forums communicate effectively with stakeholders as

appropriate Ensure reviews are undertaken around QSS operational performance and

management of risk in the context of QSS internal control objectives Be accountable to the Assistant Director-General, QSS and focus on the quality

of internal controls that support the delivery of services. This includes the effectiveness of and conformance with the MAF, risk management, compliance and audit issues management.

Corporate Assurance and Risk Management (CARM) unit

Implement and manage a risk-based control self-assessment program Independently review the control self-assessment results and follow up non-

compliant control activities Prepare statements of assurance including results from internal and external

audit reviews Actively support the annual program of work provided by internal and external

audit Facilitate appropriate responses to issues raised by internal and external audit Complete an annual review of the MAF to ensure its currency Review and update internal control objectives as required Regularly review and update internal control activities and control self-

assessments to reflect internal control environment changes.Customers of QSS Ensure the accuracy, completeness and authorisation of its financial data and

that legislative requirements have been met. Customers rely on QSS to ensure that the relevant control mechanisms continue to function as intended to the extent that QSS has control over those mechanisms

Ensure that it has a complementary set of internal controls in relation to its responsibilities in the end-to-end processes for services provided by QSS

Provide complete, accurate and timely documentation and instructions to QSS Provide correct agency authorisations or approvals based on customer

delegations Ensure that specific delegations and authorisations provided to QSS to approve

expenditure on behalf of the customer are appropriate for the operations of the agency and are in accordance with the FAA and the Public Service Act 2008

Monitor delegations and authorisations exercised on behalf of the agency by QSS Ensure the accuracy, completeness and integrity of the agency’s financial

statements and that financial statement reporting requirements have been met – these specific responsibilities cannot be delegated to QSS

Own and operate information systems or utilise system applications which QSS maintains and accesses to provide agreed services to the customer

Maintain an effective system of internal controls to support the confidentiality, integrity and accuracy of information systems that it owns and operates and system applications that it utilises

Grant and approve user access to its systems for its own staff and customers Satisfy themselves that the access sought to its information is appropriate and

reviewed on a regular basis View the control and security environment at QSS as an integral part of its own

internal control structure in relation to its information systems and data.

6 Endorsement and approval This framework has been endorsed by:

of 18


Name Irene Violet

Position A/Assistant Director-General

Queensland Shared Services

Signature Endorsed and signed Date: 07/08/2015

This framework has been approved by:

Name Jamie Merrick

Position A/Director-General

Department of Science, Information Technology and Innovation

Signature Approved and signedDate: 11/08/2015

of 18


Appendix A: Contacts Corporate Assurance and Risk ManagementQueensland Shared ServicesDepartment of Science, Information Technology and InnovationLevel 5, 160 Mary StreetBrisbane Qld 4000

Telephone: 07 3179 1264Email: [email protected]

Appendix B: References Financial Accountability Act 2009 Financial and Performance Management Standard 2009 Financial Accountability Regulation 2009 Financial Accountability Handbook – Queensland Treasury Public Service Act 2008 Internal Control – Integrated Framework, Guidance on Monitoring Internal Control Systems,

Volume 2: Application, Committee of Sponsoring Organizations of the Treadway Commission (COSO), May 2013

Australian Auditing Standards Australian Accounting Standards

of 18

mailto:[email protected]


Appendix C: Definitions Term DefinitionAccountable officer Chief Executive Officer with responsibility for management of the department or

agency as defined under the FAACustomers A customer is a Queensland Government department or other body to which QSS

provides a range of corporate services under a SLACommittee of Sponsoring Organisations (COSO)

The COSO of the Treadway Commission is an internationally recognised voluntary private sector organisation that has established a common internal control model against which organisations may assess their control systems.

Control environment The control environment includes the governance and management functions concerning the customer’s internal control and its importance in the agency. It sets the tone of an organisation, influencing the control consciousness of its employees and is the foundation for effective internal control providing discipline and structure. Reference: ASA 315, Understanding the Entity and its Environment and Assessing the Risks of Material Misstatement, para 80. Australian Auditing and Assurance Standards Board, October 2009

DSITI Audit and Risk Management Committee

This committee acts as an advisory body to the Director-General, DSITI to assist in the effective discharge of the responsibilities in the FAA and FPMS and other relevant legislation and prescribed requirements. The committee is chaired by the Director-General, DSITI.

Financial Accountability Act 2009 (FAA)

The FAA is legislation enacted by the State of Queensland to provide for accountability in the administration of the State’s finances and financial administration of departments and statutory bodies.

Financial and Performance Management Standard 2009 (FPMS)

The FPMS is subordinate legislation made under the FAA. It provides a framework for an accountable officer to develop and implement systems, practices and controls for efficient, effective and economic financial and performance management of the department or statutory body.

Governance Section 7 of the FPMS states that governance is the way the department or statutory body manages the performance of its functions and operations.Governance is generally accepted to encompass management’s behaviour and accountability for the way it directs an agency’s operations. It may also relate to the agency’s structure, responsibilities, competencies, reporting and risk management processes.

Information systems As defined by the FPMS, information systems mean the methods, mechanisms and records established within the department or statutory body to identify, assemble, analyse, classify, record and report transactions and other events affecting the department or statutory body. Within QSS this may include tools categorised as business application systems.

Internal control objective

The specific target used to determine whether an internal control is operating effectively, efficiently and economically is called the internal control objective.

Management assurance framework (MAF)

A description of the QSS internal control environment, internal control objectives and internal control activities established to provide reasonable assurance that QSS is managing its business operations efficiently, effectively and economically.

of 18


Term DefinitionMaterial/materiality In the context of the MAF, the concept of materiality relates to the internal controls

and the systems being reported on, not the financial reports/statements of the customer agency. The MAF is used to assess whether the internal controls at QSS are suitably designed and are operating effectively, efficiently and economically in all material respects in delivering SLA services to customer agencies. Such assessment includes those financial controls which are relevant to the financial reporting of customer agencies.

CARM solution The CARM solution is a web based system implemented by the CARM unit to simplify and automate the process of completing and reporting on the MAF control self-assessments.

QSS Executive Management Group (QSS EMG)

The QSS EMG is the primary governance body of QSS in providing leadership and stewardship for directing and controlling the business of QSS. It is chaired by the Assistant Director-General, QSS.

Queensland Audit Office (QAO)

The QAO supports the role of the Auditor-General in providing Parliament with an independent assessment of the financial management-related activities of public sector entities. It provides independent audit services and reports to Parliament to enhance public sector accountability.

Reasonable assurance

A general acknowledgement that it is not possible to certify absolutely and certainly that an event will or will not occur due to the limitations inherent in all internal control systems. In the context of the management assurance report, it therefore refers to the degree of satisfaction that the evidence obtained from monitoring activities undertaken by QSS supports the certifications made.

Service Agreement (SA)

A formal agreement between QSS and a customer agency for the provision of services. The SA includes details of all services provided by QSS including a description of each service, QSS responsibilities, customer agency responsibilities and QSS performance measures.

Services Functions and activities that QSS can provide to customers on a fee-for-fee service basis and which are described in the SA.

of 18


Appendix D: Internal control assurance model

of 18


Appendix E: DSITI assurance framework

Page 17 of 18


Appendix F: MAF process map

Page 18 of 18

Attendance recording policy - For government | … · Web viewDSITI Internal Audit plays a key role...

Documents

Transcript of Attendance recording policy - For government | … · Web viewDSITI Internal Audit plays a key role...