COMPTROLLER OF ACCOUNTS

Ministry of Finance

Government of the Republic of Trinidad Tobago

Internal Audit Manual

Prepared by the Financial Management Branch,

Treasury Division, Ministry of Finance

i

TABLE OF CONTENTS Pages

Introduction ……………………………………………………………………………… iii

1. The Internal Audit Environment

1.1 Legislative Framework – Specific to the Government of the Republic of

Trinidad and Tobago

1.1.1 Constitution of the Republic of Trinidad and Tobago………………… 3

1.1.2 Exchequer and Audit Act, Chapter 69:01……………………………. . 4

1.1.3 Financial Regulations to the Exchequer and Audit Act………….. …… 5

1.1.4 The Financial Instructions 1965………………………………………. 5

1.1.5 Ministry of Finance and Comptroller of Accounts Circulars………… 5

1.1.6 Manual of the Terms and Conditions of Employment……………….. 5

1.1.7 Chief Personnel Officer Circulars…………………………………….. 6

1.1.8 Commissions and Relevant Acts……………………………………… 6

1.1.9 Civil Service Act Chapter 23:01……………………………………… 7

1.1.10 Civil Service Regulations…………………………………………….. 7

1.1.11 Civil Service (External Affairs) Regulations…………………………. 8

1.1.12 Public Service Commission Regulation, 1966……………………….. 8

1.2 The Changing Environment of Internal Auditing

1.2.1 Compliance vs. Risk Management…………………………………… 10

1.2.2 Manual Environment vs. Information Technology Environment……. 11

1.2.3 Independence – Location vs. Mental Attitude……………………….. 12

1.2.4 Post Auditing vs. Ongoing Audits……………………………………. 13

1.3 International Standards

1.3.1 International Best Practice…………………………………………… 14

1.3.2 The Code of Ethics…………………………………………………… 15

1.3.2.1 Code of Ethics – Principles…………………………………………… 15

1.3.2.2 Rules of Conduct ……………………………………………………. 16

1.3.3 International Auditing Standards ……………………………………. 17

ii

1.4 The Committee of Sponsoring Organizations

1.4.1 Control Environment…………………………..……………………… 19

1.4.2. Risk Assessment…………………………………….………………… 19

1.4.3. Control Activities……………………………………………………… 20

1.4.4. Information and Communication……………………………………... 20

1.4.5 Monitoring…………………………………………………………..... 21

1.5 Criteria of Control Committee……………………………………………... 23

1.6 COBIT – Control Objectives for Information and Related Technology

1.6.1 What is COBIT………. ………………………………………............ 25

1.6.2 Benefits of implementing CobiT…………………………................... 25

1.6.3 COBIT Structure – Process Oriented…………………………………. 26

1.6.3.1 How does CobiT Work?……………………………………................ 28

1.6.3.2 Control Based …………………………………………….................... 29

1.6.3.3 Use of COBIT by the Internal Auditors………………………………. 29

1.7 Reporting Relationships

1.7.1 The Parliament of Trinidad and Tobago……………………………… 31

1.7.2 Minister of Finance …………………………………………………… 31

1.7.3 The Accounting Officer...……………………………………….......... 32

1.7.4 The Treasury Division……………..…………………………………. 33

1.7.5 Auditor General‟s Department ………………………………………. 34

1.7.6 The Public Accounts Committee and the Public Accounts Enterprises 35

Chapter 2

Treasury Statement on Corporate Governance

2.1 The Governance Structure of the Public Service – Legal Environment……38

Chapter 3

Management of the Internal Audit Unit

iii

3.1 The Corporate Planning Process……………………………………… 37

3.1.1 Government‟s overall Objectives & Policies…………………………. 38

3.1.2 The Ministry‟s Corporate Plan & Operational Plan…………………. 38

3.1.3 The Internal Audit Unit Corporate Plan……………………………… 38

3.1.3.1 Internal Audit Vision and Mission Statement ………………………. 39

3.1.3.2 Ministry‟s Priority Policies, Key Outcomes and Strategic Objectives 39

3.1.3.3 Strategies …………………….............................................................. 40

3.1.3.4 Key Output……………………………………..................................... 40

3.1.4 The Internal Audit Unit Operational Plan……………………………. 40

3.1.5 The Annual Audit Plan ………………………………………………. 41

3.2 Risk Assessment……………………………………............................ 42

3.2.1 Risk Assessment and Professional Judgement……………………….. 43

3.2.2 Information Sources……………………………………........................ 43

3.2.3 Setting Priorities…………………………………….............................. 43

3.3 Human Resource Management……………………………………....... 44

3.3.1 Training…………………………………………................................... 44

Chapter 4

Performance of Audit Work

4.1 Planning the Audit Assignment………………………………………. 46

4.1.1 Background Information……………………………………................ 47

4.1.2 Conducting Risk Assessment……………………………………......... 47

4.1.3 Establishing audit Objectives and Scope……………………………… 48

4.1.4 Ensure Subject Is Auditable……………………………………........... 49

4.1.5 Determining the necessary resources to perform the audit…………… 49

4.1.6 Communicate with the Relevant Stakeholder of the Audit…………… 50

4.1.7 Preliminary Survey……………………………………........................ 50

4.1.8 Development the Audit Programme…………………………………... 51

4.1.9 Define recipients of audit results……………………………………... 51

4.2 Audit Evidence……………………………………............................... 52

4.2.1 Nature of Evidence……………………………………........................ 52

4.2.2 Attributes of Evidence……………………………………................... 54

4.3 Documentation and Working Papers…………………………………. 55

4.3.1 Working Papers……………………………………............................. 55

iv

4.3.2 Purpose of the Working Papers………………………………………. 56

4.3.3 Documentation…………………………………….............................. 56

4.3.4 Supervisory Review…………………………………………............... 58

4.3.5 Control and Retention of Working Papers…………………………… 58

4.3.6 Permanent Files……………………………………............................. 59

4.4 Reporting……………………………………....................................... 59

4.4.1 Purpose of Report…………………………………….......................... 59

4.4.2 Elements of a Good Report……………………………………........... 60

4.4.3 Format of the Report……………………………………..................... 61

4.5 Interviews……………………………………...................................... 62

4.5.1 Identifying Availability of Evidence………………………………… 62

4.5.2 Exit Interview……………………………………................................ 63

4.6 Follow-up……………………………………...................................... 63

4.6.1 Timing of the follow-up……………………………………................. 63

Chapter 5

Value for Money Auditing

5.1 Background…………………………………….................................... 65

5.2 Economy, Efficiency and Effectiveness……………………………… 65

5.3 Approaches to VFM Auditing……………………………………....... 66

5.3.1 Procedures or Process-Oriented Approach…………………………… 67

5.3.2 Results-oriented Approach……………………………………............ 67

5.4 The Audit Process……………………………………......................... 68

5.4.1 The Planning Process…………………………………….................... 69

5.4.2 The Examination Phase…………………………………………......... 69

5.4.3 The Reporting Phase………………………………………….............. 70

5.4.4 The Follow-up Phase…………………………………………............. 71

5.5 Generic Questions for scope the audit……………………………….. 71

Chapter 6

Information Technology Audit

6.1 Background…………………………………….................................... 75

v

6.2 Computer-assisted audit Techniques (CAATS) ……………………… 76

6.2.1 Concept…………………………………….......................................... 76

6.2.2 Planning…………………………………………................................. 77

6.3 The Environment in which CAATS operate…………………………. 78

6.3.1 Understanding of the System………………………………………..... 78

6.3.2 Characteristics of the Data……………………………………............. 78

6.3.3 Audit Objectives………………………………………….................... 78

6.3.4 Audit Scope……………………………………................................... 79

6.4 Data Access……………………………………................................... 79

6.5 Application of CAATS……………………………………................. 79

6.6 Follow up Investigations……………………………………............... 80

6.7 Working Papers……………………………………............................ 81

6.8 Reporting……………………………………...................................... 81

Chapter 7

Role of Audit Committee……………………………………………………………………. 82

Glossary 83- 89

Appendices

vi

INTRODUCTION

(i) Purpose

This Internal Audit manual is designed to provide a comprehensive guidance for the

development and operations of internal auditing in the Public Service. It is intended to be used as

a source of reference and guidance for Internal Auditors in the daily performance of their duties.

Users of this manual are assumed to possess a basic knowledge and understanding of

management framework with practical guidance, tools and information for managing the Internal

Audit activity and for planning, coordinating and reporting to Management / the Accounting

Officer.

Against this background, this document aims to provide a standard set of guidelines regarding

Internal Auditing in the Public Service.

Internal Auditors must keep pace with current trends in their profession if they are to remain

effective in assisting management in the proper discharge of their duties

The Comptroller of Accounts believes that this manual will set the tone and will create the

necessary impetus for a sustainable and effective Internal Auditing mechanism in Government.

(ii) Definition of Internal Auditing

The Institute of Internal Auditors (IIA) (the world-wide professional organization for Internal

Auditing) defines internal audit as:-

„Internal Auditing is an independent, objective assurance and consulting activity designed to

add value and improve an organization’s operations. It helps an organization accomplish its

objectives by bringing a systematic, disciplined approach to evaluate and improve the

effectiveness of risk management, control and governance processes.’

In order to assist Accounting Officers in achieving their objectives in an intelligent manner,

Internal Auditors must be aware of the environment in which they operate and the rules which

govern their work activities.

vii

(iii) The Objective of Internal Auditing

The overall objective of Internal Auditing is to assist the Accounting Officer in the effective

discharge of his/her responsibilities by furnishing objective analyses, appraisals,

recommendations and pertinent comments on the activities reviewed.

The Internal Auditor must therefore be involved in any phase of activity in which he can be of

service to the Accounting Officer.

Activities include:-

appraising the soundness and application of accounting, financial and operating controls;

ascertaining the reliability of accounting and other data developed within the

organization;

ascertaining the extent of compliance with establish policies and procedures;

appraising the quality of performance in carrying out assigned responsibilities;

NB: Please note that this Auditing Manual is a work in progress. Inclusions will be inserted as

the various sections areas developed, reviewed and verified.

8

CHAPTER 1

INTERNAL AUDIT ENVIRONMENT

The Internal Audit Environment is shown on the flowchart at figure 1, page 2. The various

components are as follows:-

Legislative Framework- specific to the Government of Trinidad and Tobago;

Legislative Framework – International Best Practice;

The Treasury;

The Accounting Officer;

Minister of Finance;

The Auditor General Department;

The Parliament.

The ensuing sections give details of these areas.

9

Figure 1 – The Internal Audit Environment

Internal Audit

Section

The Treasury The Accounting Officer- Appointed by the Minister of Finance

- Governance & Transparency

Legislative Framework

Specific to GORTT

-Constitution of the Republic of

Trinidad & Tobago

-The Exchequer & Audit Act Chap: 69:01

- Financial Regulations

-Financial Instructions 1965

-Civil Service Act.

-Public Service Regulations

-Terms & Conditions of Employment

-Relevant Circulars

Establishes, Overseers & Monitors

Reports to

Auditor General’s Department

Provides guidance on:

-Work Programme

-Audit Reports

-Auditing& Accounting Standards

- Audits the work done by the

Internal Auditor

Minister of Finance

Reports to

Parliament

Reports to

The Internal Audit Environment

Page 1

Legislative Framework

International Best Practice

- Institute of Internal Auditors (IIA)

(International Auditing Standards)

- COSO

- COBIT

- COCO

- International Accounting Standards (IAS)

Governs the

Reports to

The Changing Environment

of Internal Audit

Current Environment New Environment

- Compliance - Risk management

- Independence - Independence

(location) (mind)

- Post Auditing - During the Audit

- Manual - IT Environment

Relationship

with

Objectives

- Contribute to the organization

achieving its objectives by improving

the effectiveness of Risk management

controls & processes

Accounting Environment

- Accounting Unit

- Legislative (Fin. Regs. & Instructions)

- Circulars - (CPO., MOF. COA.)

- Budget Cycle

Personally and peculiarly

responsible for the operations of

the Accounting Unit

10

1.1 THE LEGISLATIVE FRAMEWORK- SPECIFIC TO THE GOVERNMENT

OF THE REPUBLIC OF TRINIDAD AND TOBAGO

Internal Auditors in the operation and execution of their duties are governed by legal

provisions. These provisions are as follows:-

1.1.1 The Constitution of the Republic of Trinidad and Tobago Ch 1:01

Chapter 8 of the Constitution of the Republic of Trinidad and Tobago deals with Finance and

outlines the following requirements:-

The establishment of the Consolidated Fund

The authorization of expenditure from the Consolidated Fund

The responsibility of the Minister of Finance

The establishment of the Office and the functions of the Auditor General

The requirements for the appointment of the Auditor General and the setting up of the

Public Accounts Committee.

Chapter 8, Section 113 (1) of the Constitution of the Republic of Trinidad and Tobago states:-

(1) “The Minister responsible for Finance shall cause to be prepared and laid before the

House of Representatives before or not later than thirty days after the commencement

of each financial year estimates of revenues and expenditure of Trinidad and Tobago

for that year.”

Chapter 8, Section 116 (1-2) of the Constitution of the Republic of Trinidad and Tobago

states:-

(1) “There shall be an Auditor General for Trinidad and Tobago, whose office shall

be a public office.”

and

(2) “The public accounts of Trinidad and Tobago and of all officers, courts and authorities of

Trinidad and Tobago shall be audited and reported on annually by the Auditor General,

and for that purpose the Auditor General or any person authorized by him in that behalf

shall have access to all books, records, returns and other documents relating to those

accounts.”

In order to assist the Minister of Finance in complying with these provisions, Accounting

Officers are charged with the responsibility for preparing and submitting the estimates of

revenue and expenditure to the Minister of Finance and the Appropriation Accounts to the

Auditor General. Accounting Officers have the responsibility of ensuring that proper systems

of accounting as prescribed by the Treasury are establish and maintained within their

respective Ministry/Department.

The Auditor General is empowered by the Constitution to carry out audits of the accounts,

balance sheets and other financial statements of all enterprises that are owned or controlled by

or on behalf of the State. She shall submit reports annually to the Speaker, the President of the

11

Senate and the Minister of Finance. The Auditor General is also responsible for monitoring the

systems and records used in the preparation of these accounts to ascertain whether they are

functioning properly and are in compliance with the relevant laws and guidance.

Internal Auditors in Central Government are charged with the responsibility of assisting

Accounting Officers in the effective discharge of their duties as defined in the Exchequer and

Audit Act, Chapter 69:01. Internal Auditors must examine the records of their

Ministries/Departments in order to ascertain the extent of compliance with established policies

and procedures as established by the Treasury and must ensure that expenditure incurred and

revenue earned conform to the Estimates of Expenditure/Revenue approved by Parliament.

They must also ensure that expenditure incurred under the various votes, are made in

accordance with Budgeted Allocations and that expenditure does not exceed releases granted.

1.1.2 The Exchequer and Audit Act, Chapter 69:01

In the daily performance of their duties, Officers are guided by and operate under the rules as

enshrined in the Exchequer and Audit Act, Chap.69:01.

This Act provides for:-

- the control and management of the public finances in the Republic of Trinidad and Tobago;

- the duties and powers of the Auditor General;

- the collection of, issue and payment of public moneys;

- the audit of the Public Accounts and the protection and recovery of public property;

- the control of the powers of statutory bodies and for matters connected therewith.

The Act also interprets the title of the Accounting Officer in Part I Section 2 which states inter-

alia:-

“an accounting officer means any person appointed by the Treasury and charged with the duty

of accounting for any service in respect of which moneys have been appropriated by the

Constitution or by Parliament, or any person to whom issues are made from the Exchequer

Account.”

Internal Auditors are a valuable resource for Accounting Officers and as such must be aware of

the role of the Accounting Officer.

1.1.3 The Financial Regulations to the Exchequer and Audit Act, Chapter 69:01

In addition to the Exchequer and Audit Act which states and interprets the law, Internal

Auditors are also guided by the Financial Regulations in their daily operations. These

Regulations provide a more detailed guidance and makes provision for an independent Internal

Audit Unit.

Part II Section 13 (4) of the Regulations states:-

“Each Accounting Unit shall have a check staff and an independent internal audit

unit”

12

Part II Sections 4 (1) and (3) of the Exchequer and Audit Act makes provision for the control

and management of the accounts.

Part I Section 8 of the Regulations also states:

“It is the duty of an accounting officer to –

(a) ensure that the proper system of accounting as prescribed by the Treasury is

established and maintained.”

Guided by the Financial Regulations in their role and responsibilities, Internal Auditors will be

able to give assurance to Accounting Officers that records are accurate, systems of internal

controls are performing effectively, and there is compliance with systems laid down by the

Treasury.

1.1.4 The Financial Instructions 1965

The Financial Instructions 1965 was issued by the Treasury under Section 4 of the Exchequer

and Audit Ordinance 1959. These Instructions give details on accounting procedures to be

adopted by the various Ministries/Departments so as to promote reliance on the accuracy of

records and to ensure that systems are functioning as intended.

1.1.5 Ministry of Finance and Comptroller of Accounts Circulars

Circulars are issued from time to time by the Minister of Finance and the Comptroller of

Accounts.

Circulars from the Minister of Finance are issued when new accounting

systems/procedures are being introduced.

Circulars from the Comptroller of Accounts are issued for clarification/updating of

existing systems and procedures.

1.1.6 Manual of the Terms & Conditions of Employment

The terms and condition of employment for officers employed in the Public Service has been

compiled in a manual by the Chief Personnel Officer (CPO). Unlike the Financial Regulations

which deals with accounting matters within the Public Service and the treatment of such, the

Manual of the Terms and Conditions of Employment addresses the administration of rules,

regulations and circular instructions relating to the terms of employment of Officers in the

Public Service.

Section I of the manual embodies those rulings, guidelines, interpretations and classifications

that are most frequently sought from the CPO in respect of areas such as:

- hours of work,

- treatment of work in excess of normal working hours,

- different types of leave, traveling and subsistence allowance,

- transfers between Trinidad and Tobago,

- uniform and

- employment on contract.

13

Each area dealt with in the Manual is referenced to the relevant regulations from the Civil

Service, Public Service, CPO and Ministry of Finance Circulars.

Sections II and III of the manual contain circulars/circular memoranda mentioned in Section I.

The manual must be read in conjunction with the relevant provisions of the Civil Service

Regulation, Public Service Regulation or the Traveling Allowances Regulations as may be

appropriate.

This manual is one of the tools used by the Internal Auditor in interpreting and clarifying

issues on the terms and conditions of employment of officers employed in the Public Service.

1.1.7 Chief Personnel Officer Circulars

The Chief Personnel Officer issues circulars from time to time for the variation of officer‟s

terms and conditions of employment in relation to the terms and conditions, salaries and

allowances for all officers employed in the Civil Service as well as clarification of existing

circulars when necessary.

1.1.8 Commissions and Relevant Acts

Various Commissions established under the Constitution of the Republic of Trinidad and

Tobago are as follows:-

1. Public Service Commission

2. Police Service Commission

3. Teaching Service Commission

4. Judicial and Legal Service Commission

5. Statutory Authorities Commissions

These Commissions are followed by specific Acts and Regulations governing the relevant

service are as follows:-

- Public Service Commission:

Civil Service Act Chapter 35:50 - Civil Service

Fire Service Act Chapter 23:01 - Fire Service

Prison Service Act Chapter 13:02 - Prison Service

- Police Service Commission:

Police Service Act Chapter 15:01– Police Service

- Teaching Service Commission:

Education Act Chapter 39:01 – Teaching Service

- Judicial and Legal Service Commission:

Judicial & Legal Service Act Chapter 6:01 – Judicial and Legal Service

- Statutory Authorities Commission

Statutory Authorities Act Chapter 34:01 - Statutory Bodies

14

1.1.9 Civil Service Act Chapter 23:01

The Civil Service Act, Chapter 23:01 makes provision for the establishment and classification

of:

- the Civil Service,

- a Personnel Department,

- procedures for negotiations and consultation between the Government and members of

the Civil Service,

- the settlement of disputes,

- other matters concerning the relationship between the Government and the Civil Service.

The Act outlines the terms and conditions of employment of officers employed in the Civil

Service.

1.1.10 Civil Service Regulations

The Civil Service Regulations guided by the Civil Service Act, Chapter 23:01 defines the

various positions within the Civil Service and the details of the entitlements of these positions.

The Regulations also treats with various areas such as probation periods, secondment,

remuneration, increments, allowances, payment of pensions and gratuities and other matters

relating to officers.

An amendment to the Regulations in 1996 made provision for the Code of Conduct.

It is recommended that copies of the Regulations and Code of Conduct should be given to

every officer on their first appointment by the Public Service Commission by which he was

appointed together with his letter of appointment.

The Code of Conduct in the Civil Service Regulation deals with the conduct of an officer while

the Public Service Commission Regulations defines the method for dealing with an officer‟s

discipline and the relevant disciplinary action to be taken.

1.1.11 Civil Service (External Affairs) Regulations

The Civil Service (External Affairs) Regulations established under the Civil Service Act,

provides detailed requirements for Foreign Service Officers at the various Missions and the

entitlements to those Officers. Areas addressed under the Regulations are as follows:

Entry into the Foreign Service;

Postings to and from the Missions;

Allowances and other benefits;

Housing accommodations;

Leave and leave passage; and

Conduct of officers assigned to the Missions.

1.1.12 Public Service Commission Regulations, 1966

The Public Service Commission Regulations defines the following:

15

The “Public Service” includes the Civil Service, the Fire Service, the Prison Service, and for

the purposes of Section 53 of the Education Act, shall be deemed to include the Teaching

Service.

An “officer” means a person employed in that part of the Public Service established

respectively as the Civil Service, the Fire Service, the Prison Service, or any other service in

the Public Service who is subject to the jurisdiction of the Commission and, for the purposes of

Section 53 of the Education Act, shall be deemed to include all persons employed in the

Teaching Service.

A “Public Office” includes the Civil Service, the Fire Service, the Prison Service, and for the

purposes of Section 53 of the Education Act, shall be deemed to include the Teaching Service.

The Public Service Commission Regulations addresses the following areas within the Public

Service:

1. Appointments

2. Promotions

3. Transfers

4. Staff reports

5. Resignations

6. Retirement

7. Termination of appointments

The Civil Service Regulations also deals with the recruitment of officers as well as the terms

and conditions of these officers. The Public Service Regulations provides all officers and in

particular the Internal Auditor with the necessary guidance and knowledge in interpreting

matters listed above.

The Civil Service Act, Chapter 23:01 amended in 1966 provides for a Code of Conduct which

addresses the general conduct of a Civil Servant whereas the methods for dealing with Public

Officers‟ discipline and disciplinary actions are covered by the Public Service Commissions

Regulations.

The Internal Auditor in the conduct of the audit must be knowledgeable of the following laws

in relation to the various bodies:

1. The Civil Service Act, Chapter 23:01

2. The Fire Service Act, Chapter 23:01

3. The Prison Service Act, Chapter:13:02

4. The Police Service Act, Chapter: 15:01

5. The Education Act, Chapter 39:01

6. The Statutory Authorities Act, Chapter 34:01

The various Acts, Regulations, Instructions and Circulars are some of the main tools used by

Internal Auditors. The Internal Auditor must be knowledgeable of all aspects in order to

interpret and apply them to accounting transactions, verify compliance with the relevant laws

and provide advice and recommendations to his Accounting Officer.

The Internal Auditor, in assessing and reviewing the existing internal controls provides

Accounting Officers with an independent assessment of the Department‟s internal controls and

16

risk management framework and policies. This promotes reliability of information provided

and used in the decision-making process.

Summary to this Section- The legislative framework – specific to Government of the

Republic of Trinidad and Tobago provides guidance and

assists the internal auditors in their daily function and is

MANDATORY as tools to be used in all Internal Audit and

Accounting Units in the Public Service.

1.2 THE CHANGING ENVIORNMENT OF INTERNAL AUDITING

The increasing demand for good governance and transparency by the citizenry in the use of

taxpayer‟s dollars has impacted the way in which organizations conducted their businesses in

the past. In order to facilitate this demand for good governance and transparency and in

keeping with Government‟s mission and vision, the Public Service business processes,

communication techniques, and delivery services are continuously being upgraded and

transformed.

In this changing environment where the pace of Legislative Reform tends to lag behind, the

Internal Auditor is met with challenges in carrying out his responsibilities. In order to cope

with these challenges, the Internal Auditor must adopt relevant Standards and Tools from

internationally recognized Auditing and Accounting bodies in the conduct of their audits.

In the past the focus of Internal Audit activities within the Public Service was in the areas of

compliance, independence, post-auditing and auditing in a manual environment. This

traditional approach has continued in audit activities in the current environment. Internal

Auditors must now enhance their approach in order to fulfill their audit responsibilities in this

continuously evolving environment.

1.2.1 Compliance vs. Risk Management

Presently Internal Auditors are primarily concerned with checking accounting transactions

(historical) for compliance with financial laws. Checks are transaction based with a financial

focus in accordance with the relevant authorities and adherence to prescribed policies,

procedures and systems.

While compliance to relevant authorities, policies and procedures continues to be important,

the way in which compliance is currently being carried out must now change to compliance

with a risk focus. The Internal Auditor must be able to assess whether the existing controls are

adequate and relevant in addressing existing and potential risks which can prevent/delay the

organization achieving its objective.

The Committee of Sponsoring Organizations of the Treadway Commission (COSO), an

internationally recognized body gives guidance on monitoring internal controls systems. COSO

recognizes that risk changes over time and as such internal control systems need to be

reassessed for relevance and must address new risks as they emerge.

Ongoing assessment is recommended through the monitoring and evaluation of the

organization‟s internal control system and should be able to ascertain whether:

17

- management needs to reconsider the design of the existing controls when risk changes

and

- the controls which were designed to reduce risk at an acceptable level, continues to

operate effectively.

With ongoing assessments and the efficient and effective management of risks through strong

internal controls, the organization is able to have:

- more efficient , reliable and cost effective delivery of services to it‟s customers;

- more reliable decisions;

- innovation;

- minimal waste and fraud;

- better value for money through the efficient use of resources;

- improved project and programme management – better outputs and outcomes.

Once risks are mitigated, the organization‟s performance will improve and the likelihood of its

strategic and current objectives being achieved will increase.

1.2.2 Manual Environment vs. Information Technology Environment

Internal Auditors have traditionally operated in a paper based environment within the Public

Service. Checks for completeness, accuracy and verification of accounting transactions are

carried out against the relevant hard copy documents. A manual system provides an audit trail

which allows the Auditor to trace a transaction from its source to its completion. While manual

processing has its advantages it often operates at a slower pace and is prone to a higher degree

of errors.

Government, in improving its business processes with the aim of promoting the efficiency and

timeliness of its service delivery to its customers is engaged in ongoing development and

implementation of Information Technology (IT) related systems within the Public Service.

Internal Auditors must now be able to identify and assess the controls in this computerized

environment. Auditing software is now available for use by Internal Auditors in the form of

Computer Assisted Auditing Techniques (CAAT). With CAAT tools, an auditor can review,

test and analyze an entire population of data. Some areas of testing include testing in

compliance with standards, identifying control issues, verification of balances etc.

With the continuous development in new IT systems and the upgrading of existing ones,

business processes are constantly evolving with IT driven processes. Several accounting and

reporting processes within the Public Service are undergoing changes due to the incorporation

of either partially or wholly IT applications into its processes.

With the introduction and varying complexity of computerized systems, there exists a

corresponding loss of audit trail. The Internal Auditor must now tailor his audit activities in

order to give assurance on the integrity, accuracy, validity, timeliness and completeness of

outputs derived from such systems. He must assess the controls for adequacy and relevance

which will mitigate any risk which may prevent or delay the organization‟s ability in meeting

its objectives.

Some areas of risk in an IT environment that the Internal Auditors must consider in relation to

internal controls are:

18

- Data input

- Controls that are no longer relevant

- Hardware failure

- Threats /viruses

- System failure

- Fraud – human factor

- Resource management – efficient use of

COBiT, Control Objectives for Information and related Technology, is a framework which

addresses IT governance and gives guidance to management, IT professionals and auditors

on strategy and tactics that can best contribute to the achievement of the organization‟s

objectives

A methodology consisting of recognized and accepted standards and controls which is able

to assist IT professionals in implementation, reviewing, administrating and monitoring

various IT processes of the organization is available using COBiT. It is a tool that can be

used to assist them in linking Information Technology and control practices and addresses

the needs of IT governance and the integrity of information and information systems.

COBiT can be used by the Internal Auditor to:

- establish and review control baselines and standards:

- facilitate and creates performance metrics for risk assessments

- develop audit plan

- facilitate the audit

- manage residual risk

- issue control advisory and recommendations to IT groups.

While there is currently no legislation on auditing in an IT environment in the Public Service,

the Treasury advises that the principles with respect to COBiT be incorporated into the design

of their audit work programme. In this regard, the Internal Auditor must consult with the

Treasury Division for guidance on these matters.

1.2.3 Independence - Location vs. Mental Attitude

It is usual for Internal Audit Units within Ministries/Departments to be set up separately from

the Accounting Units for which most of its audit activities are carried out. This was seen to

promote the independence of the Internal Auditor. While independence is encouraged by

separate location, the need for independence must shift to one where it is more a state of mind.

In an era of new accountability and control there is a need for greater transparency and

accountability in the use of public funds.

The Internal Auditor, in meeting his responsibilities must conduct the audit in line with the

organization objectives for transparency and accountability. This will require the Internal

Auditor to develop a sound working relationship with management and relevant staff at all

levels. The internal auditor‟s knowledge and understanding of the organization will assist in

building effective relationships and in evaluating and improving the effectiveness of risk

management, internal controls and governance processes. Also, an effective and well run audit

team will be sought out for services, information and guidance.

19

The Internal Auditor must analyze the strengths and weaknesses of the organization‟s internal

controls, considering its governance, organizational culture, and related threats and opportunities

for improvement which can affect whether the organization is able to achieve its goals.

Internal Auditors may be called upon to advice on controls necessary in the development of

new systems for the organization and may also be involved in the auditing of those systems for

efficiency and effectiveness of the controls in place. In order to maintain independence in these

circumstances, Audit Committees within the Organizations can be set up to review the Audit

Report of the Internal Auditor.

Independence and objectivity continues to be required of the Internal Auditor in the

performance of his duties. He must have an unbiased mental attitude in the performance of his

engagements in such a manner that the quality and integrity of his work is not compromised in

any way.

1.2.4 Post-Auditing vs. Ongoing Audits

The work viewed by the Internal Auditor has been primarily historical in nature. Upon

completion of the transaction process, the Internal Auditor verifies the various accounting

transactions for compliance, accuracy and completeness. Errors and irregularities are often

discovered at this stage. With the emphasis on good governance and transparency this

continued approach to auditing will not mitigate impending risks. Risk-based auditing allows

the Internal Auditor to continuously assess new and emerging risk and to review existing

policies and procedures in order to strengthen where necessary. Reports from ongoing audits

may recommend new controls, where needed, in order to safeguard and use the resources of the

organization in an efficient manner, add value to and improve its operations.

1.3 INTERNATIONAL STANDARDS

Internal Auditing is conducted in a wide range of organizations diverse in their legal and

cultural environment. The complexity, size, structure and purpose are unique to each

organization. While differences may affect the practice of Internal Auditing in any given

environment, the Institute of Internal Auditors International Standards for Professional Practice

of Internal Auditing (Standards) is essential in providing guidelines with respect to the conduct

of the audit.

The purpose of the Standards is to:

Delineate basic principles that represent the practice of internal auditing;

Provide a framework for performing and promoting a broad range of value-added

internal auditing;

Establish the basis for the evaluation of internal audit performance;

Foster improved organizational processes and operations.

1.3.1 International Best Practice

The Institute of Internal Auditors (IIA) - Internal Auditing Standards

20

The Institute of Internal Auditors (IIA) is an international organization of internal auditing

professionals which sets guidance for Internal Auditors. Developed under the IIA is the

International Professional Practices Framework (IPPF) and its scope has been narrowed to

include only authoritative guidance which is categorized under the following two areas:

1. Mandatory:

i. The Definition of Internal Auditing; ( defined in the Introduction on page iii)

ii. The International Standards for the Professional Practice of Internal Auditing;

and

iii. The Code of Ethics.

2. Strongly Recommended:

i. Position Papers;

ii. Practice Advisories; and

iii. Practice Guides.

The Standards addressed under the International Professional Practices Framework are as

follows:

- Attribute Standards

- Performance Standards

- Practice Advisories to the Standards

- Assumption of Non-Audit Duties

- Assurance

- Board and Senior Management Reporting

- Chief Audit Executive Responsibilities

- Compliance with Standards

- Consulting

- Disclosures

- Engagement Communication

- Engagement Performance

- Engagement Planning and Scope

- Engagement Work papers

- Governance

- Independence & Objectivity

- Internal Control

- Outsourcing or Co-sourcing

- Proficiency and Due care

- Quality Assurance and improvement Program

- Resource Management

- Risked-based Planning

- Risk management and Assessment

1.3.2 The Code of Ethics

The Code of Ethics of the Institute of Internal Auditors (IIA) are principles relevant to the

profession and practice of internal auditing, and the rules of Conduct that describes behavior

expected of internal auditors. The Code of Ethics applies to both individuals and entities that

21

provide internal audit services. The purpose of the Code of Ethics is to promote an ethical

culture in the global profession of internal auditing.

Although it is not mandatory for Internal Auditors within the Public Service and State

enterprises to be members of the IIA, registered members in the Public Service are governed

by the Code of Ethics which include Principles that is relevant to the profession and practice of

internal auditors and the rules of conduct which are intended to guide the ethical conduct of

internal auditors.

Founded on the trust placed in its objectives assurance with respect to Governance, Risk

Management and Control, the Code of Ethics is appropriate and necessary in the Internal

Auditing profession.

1.3.2.1 Code of Ethics – Principles

Internal auditors are expected to apply and uphold the following principles:

i. Integrity

The integrity of internal auditors establishes trust and thus provides the basis

for reliance on their judgment.

ii. Objectivity

Internal auditors exhibit the highest level of professional objectivity in

gathering, evaluating, and communicating information about the activity or

process being examined. Internal auditors make a balanced assessment of

all the relevant circumstances and are not unduly influenced by their own

interests or by others in forming judgments.

iii. Confidentiality

Internal auditors respect the value and ownership of information they

receive and do not disclose information without appropriate authority

unless there is a legal or professional obligation to do so.

iv. Competency

Internal auditors apply the knowledge, skills, and experience needed in the

performance of internal audit services.

1.3.2.2 Rules of Conduct

i. Integrity

In demonstrating integrity, Internal auditors shall:

Perform their work with honesty, diligence, and responsibility;

Observe the law and make disclosures expected by the law and the profession;

22

Not knowingly be a party to any illegal activity, or engage in acts that are discreditable

to the profession of internal auditing or to the organization;

Respect and contribute to the legitimate and ethical objectives of the organization.

ii. Objectivity

Internal auditors shall:

Not participate in any activity or relationship that may impair or be presumed to impair

their unbiased assessment. This participation includes those activities or relationships

that may be in conflict with the interests of the organization;

Not accept anything that may impair or be presumed to impair their professional

judgment;

Disclose all material facts known to them that, if not disclosed, may distort the

reporting of activities under review.

iii. Confidentiality

Internal auditors shall:

Be prudent in the use and protection of information acquired in the course of their

duties;

Not use information for any personal gain or in any manner that would be contrary to

the law or detrimental to the legitimate and ethical objectives of the organization.

iv. Competency

Internal auditors shall:

Engage only in those services for which they have the necessary knowledge, skills, and

experience;

Perform internal audit services in accordance with the International Standards for the

Professional Practice of Internal Auditing;

Continually improve their proficiency and the effectiveness and quality of their

services.

Refer to Appendix 1.3.2A for the full list of the Code of Ethics.

1.3.3 International Auditing Standards

For more specific guidance, users of this manual should refer to Appendix 1.3.3A for the full

list of the relevant Standards. Where an appropriate standard was not developed to address an

area within the public sector environment, the Treasury Division will advise on the controls

to be used.

Refer to appendix 1.3.3A for relevant standards.

23

1.4 THE COMMITTEE OF SPONSORING ORGANIZATIONS (COSO) –

TREADWAY COMISSION

In 1992, five U.S. accounting and finance professional groups, in an alliance known as the

Committee of Sponsoring Organizations of the Treadway Commission (COSO) introduced the

Internal Control – Integrated Framework (the COSO Framework), a comprehensive report on

internal controls.

The motivation for the COSO report was the concern about the lack of uniform internal control

standards in organizations. The COSO framework is meant for managers and auditors to use in

developing and evaluating internal control systems.

Included within the COSO framework are five interrelated and equally important components

of internal control (Figure 1). The components are:

control environment;

risk assessment;

control activities;

information and communication; and

monitoring.

These are detailed in the ensuing sub-sections.

Figure 1: The COSO Internal Control Integrated Framework

1.4.1 Control Environment

An organization‟s control objective is its “tone at the top”. This is the attitude of

management towards internal controls. Is the organization control conscious of or is it

24

relatively indifferent to internal controls? The components of the control environment

are as follows:

1. Integrity and Ethical Values - sound integrity and ethical values, particularly of top

management, are developed and understood and set the standard of conduct for

financial reporting.

2. Management - management understands and exercises oversight responsibility related

to financial reporting and related internal control.

3. Management‟s Philosophy and Operating Style - Management‟s philosophy and

operating style support achieving effective internal control over financial reporting.

4. Organizational Structure - the Company‟s organizational structure supports effective

internal control over financial reporting.

5. Financial Reporting Competencies - the Company retains individuals competent in

financial reporting and related oversight roles.

6. Authority and Responsibility - Management and employees are assigned appropriate

levels of authority and responsibility to facilitate effective internal control over

financial reporting.

7. Human Resources - Human resource policies and practices are designed and

implemented to facilitate effective internal control over financial reporting.

1.4.2 Risk assessment

The COSO report recognizes risk assessment as an important component of internal

control. The enterprise‟s risk framework will provide the organization with guidance

in developing plans to identify, measure, evaluate, and respond to risk. In assessing

risk internal auditors should consider the different types of risk as follows:

Financial Reporting Risks - the Company identifies and analyzes risks to the

achievement of financial reporting objectives as a basis for determining how the risks

should be managed.

Fraud Risk - the potential for material mis-statement due to fraud is explicitly

considered in assessing risks to the achievement of financial reporting

objectives.

1.4.3 Control activities

Control Activities are specific internal control procedures and policies. Examples are

authorizations, approvals, passwords, and segregation of duties. These are the heart of

internal controls. The activities are as follows:

1. Integration with Risk Assessment - Actions are taken to address risks to the

achievement of financial reporting objectives.

25

2. Selection and Development of Control Activities - Control activities are selected and

developed considering their cost and potential effectiveness in mitigating risks to the

achievement of financial reporting objectives.

3. Policies and Procedures - Policies related to reliable financial reporting are

established and communicated throughout the company, with corresponding

procedures resulting in management directives being carried out.

4. Information Technology - Information technology controls, where applicable, are

designed and implemented to support the achievement of financial reporting

objectives.

1.4.4 Information and Communication

Information and communication refers to the need for the organization to ensure that it

obtains and communicates the information needed to carry out management strategies and

objectives. The information may be internal or external to the organization. That is,

management must communicate internal control policies and procedures across the

organization, and to related parties outside the organization.

Types of information/communication are as follows:

1. Financial Reporting Information - Pertinent information is identified, captured, used at

all levels of the company, and distributed in a form and within a timeframe that

supports the achievement of financial reporting objectives.

2. Internal Control Information - Information needed to facilitate the functioning of other

control components is identified, captured, used and distributed in a form and within a

timeframe that enables personnel to carry out their internal control responsibilities.

3. Internal Communication - Communications enable and support understanding and

execution of internal control objectives, processes and individual responsibilities at all

levels of the organization.

4. External Communication - Matters affecting the achievement of financial reporting

objectives are communicated to outside parties.

1.4.5 Monitoring

COSO calls for continuous monitoring of an internal control system. This may be

accomplished by regular audits and evaluation, as well as by constant attention to

internal controls. Monitoring consists of:

1. Ongoing Monitoring and Separate Evaluations - Ongoing monitoring and/or separate

evaluations enable management to determine whether the other components of internal

control over financial reporting continue to function over time.

2. Reporting Deficiencies - Internal control deficiencies are identified and communicated

in a timely manner to those parties responsible for taking corrective action, and to

management and the Board as appropriate.

26

Four of the components of the COSO framework relate to the design and operation of the

system of internal control. These are:

control environment;

risk assessment;

control activities;

information and communication.

The fifth component- monitoring, is designed to ensure that internal control continues to

operate effectively.

The framework is designed to assist businesses and other organizations in assessing and

enhancing their internal control systems. IT provides a set of 20 basic principles drawn

directly from the five components mentioned above.

The following is a diagrammatic representation by COSO of a monitoring design and

implementation progression of an internal control system:-

This framework has since been incorporated into policies, rules and regulations, and has been

used by thousands of organisations to better control their activities in moving towards

achievement of their established objectives.

27

1.5 CRITERIA OF CONTROL COMMITTEE (COCO)

The Canadian Criteria of Control Committee (CoCo) was an initiative of the Canadian Institute

of Chartered Accountants to strengthen control and governance. According to CoCo the

essence of control in any organization is a combination of the organization‟s purpose,

commitment, and capability, monitoring and learning.

In CoCo, control entails all the elements of an organization which taken together, support

people in the achievement of the organization‟s objectives.

The elements include:

resources

systems

processes

culture

structure and

tasks

SUMMARY:

While it is management‟s responsibility to ensure that the organisation has a strong system of

internal controls, the Internal Auditor plays an important role in evaluating the effectiveness of

the internal control system and contributes to its ongoing effectiveness by significantly

monitoring internal controls in the organisation. Internal Auditors as well as the management

team can use the above framework as part of the process of improving the effectiveness and

efficiency of their internal control systems.

In order to have assurance that the controls are adequate, the Internal Auditor in the Public

Service can incorporate the above principles into their work programme. In so doing, they must

do the following:

i. Understand the organization‟s risks and prioritize in accordance with its objectives.

This process can influence management decisions regarding the type,

timing and extent of monitoring in relation to its internal controls. ii. Identify the controls which will address the existing and potential risk. With the

prioritization of risks, key controls can be identified within the organization‟s internal

control system. With key controls identified, monitoring resources of the organization

can be allocated where they can provide the most value. iii. Identify information which will indicate persuasively whether the controls selected are

operating effectively. This information is used by evaluators of the internal control system in

order to support a conclusion on whether or not the

system is operating effectively.

28

iv. Develop and implement cost effective procedures in order to evaluate persuasive

information supporting the conclusion that the internal control system is operating

effectively. Ongoing assessment of the monitoring procedures and/or evaluating and

analyzing information supporting conclusions on the effectiveness of the internal controls can

manage or mitigate identified risks.

1.6 COBIT – CONTROL OBJECTIVES FOR INFORMATION AND

RELATED TECHNOLOGY

1.6.1 What is COBIT

With the increasing reliance on Information Technology in business processes within

organizations, Managers need assurance that the information used satisfies business objectives.

Information must have and conform to characteristics which include – Effectiveness,

Efficiency, Confidentiality, Integrity, Availability, Compliance, and Reliability. This is critical

in influencing decisions made by managers and is useful for the organization‟s business

processes with the aim of achieving its objectives.

As a result of this increasing reliance on IT, the need for standards governing the IT processes

adopted by managers became necessary. The institute of IT Governance, established under the

Information Systems Audit and Control Association (ISACA) created the Control Objectives

for Information and Related Technology (CobiT).

CobiT, a tool primarily designed for use by Auditors has evolved into a management resource

due to the increasing need for IT governance in addressing current and future risks. It provides

management with a foundation upon which IT related decisions and investments can be based

and assists them in understanding their IT systems. It also assists managers in deciding on the

level of security and controls necessary to protect the organization‟s assets through the

development of an IT governance model. It includes internal and external stakeholders who

provide IT services and who have a control/risk responsibility.

The CobiT framework is based on the principle that the enterprise needs information for

decision making and therefore –

- requires information to achieve its objectives,

- needs information to invest in its IT resources and

- needs information to manage and control its IT resources.

29

This is best illustrated in the following diagram

1.6.2 Benefits of implementing CobiT

The use of CobiT as a governance framework over IT includes:

Better alignment, based on a business focus

A view, understandable to management, of what IT does

Clear ownership and responsibilities, based on process orientation

General acceptability with third parties and regulators

Shared understanding amongst all stakeholders, based on a common language

The use of COBIT as a tool must not be interpreted as any of the following and is therefore

not:

Audit Software

An IT audit plan

An IT Internal Audit work program

An IT Audit testing plan

Guide on how to Audit IT

The CobiT framework helps identify risks and the controls which have an impact on the

organization. It is divided into four distinct groups or domains which address these risks and

controls. Within each of these groups, guidelines are provided to analyze and understand

internal controls in the organization‟s IT resources. It provides its users with a set of generally

accepted measures, indicators, processes and best practices to assist them in analyzing and

evaluating IT governance. With the use of CobiT, Auditors are able to identify and assess IT

controls within the company‟s IT environment and to provide advice to management on these

matters. It also assists them in corroborating their audit findings and in substantiating their

opinions.

Business

Requirements which

responds to

Enterprise

Information

drive the

investments in

COBIT

IT Processes

IT Resources

to deliver that are

used by

30

1.6.3 COBIT Structure -Process Oriented

CobiT defines IT activities in a generic process model within the following four domains:

Plan and Organize - provides direction to solution delivery and service delivery.

Acquire and Implement - provides the solutions and passes them to be turned into

services.

Deliver and Support -receives the solutions and makes them usable for end users.

Monitor and Evaluate – monitors.

This model guide managers in tailoring the process model necessary for the organization. This

enables responsibilities and accountability to be defined. To govern IT effectively, it is

important to appreciate the activities and risks within IT that need to be managed.

The following diagram represents the four interrelated Domains of COBIT

(a) Plan and Organize

The Plan and Organize domain covers the use of Information & Technology and how best it

can be used in a company to help achieve the company‟s goals and objectives. It also

highlights the organizational and infrastructural form IT is to take in order to achieve the

optimal results and to generate the most benefits from the use of IT. This domain also covers

the organization‟s strategy and tactics. The realization of the strategic vision needs to be

planned, communicated and managed for different perspectives. A proper organizational as

well as technological infrastructure should be put in place.

The Plan and Organize domain typically addresses the following management questions:

Are IT and the business strategy aligned?

Is the enterprise achieving optimum use of its resources?

Does everyone in the organisation understand the IT objectives?

Are IT risks understood and are they being managed?

Is the quality of IT systems appropriate for business needs?

Plan and Organise

Acquire and

Implement

Deliver

and

Support

Monitor and Evaluate

31

(b) Acquire and Implement

The Acquire and Implement domain covers identifying IT requirements, acquiring the

technology, and implementing it within the company‟s current business processes. This domain

also addresses the development of a maintenance plan that a company should adopt in order to

prolong the life of an IT system and its components. Changes in and maintenance of existing

systems are covered by this domain to ensure that the solutions continue to meet business

objectives.

The Acquire and Implement domain addresses the following management questions:

Are new projects likely to deliver solutions that meet business needs?

Are new projects likely to be delivered on time and within budget?

Will the new systems work properly when implemented?

Will changes be made without upsetting current business operations?

(c) Deliver and Support

The Deliver and Support domain focuses on the delivery aspects of the information

technology. It covers areas such as the execution of the applications within the IT system and

its results as well as the support processes that enable the effective and efficient execution of

these IT systems. These support processes includes service delivery, management of security

and continuity, service support for users, training, and management of data and operational

facilities.

The Deliver and Support domain addresses the following management questions:

Are IT services being delivered in line with business priorities?

Are IT costs optimised?

Is the workforce able to use the IT systems productively and safely?

Are adequate controls for confidentiality, integrity and availability of information in

place for information security?

(d) Monitor and Evaluate

The Monitor and Evaluate domain addresses a company‟s strategy in assessing the needs of the

company and whether or not the current system still meets the objectives for which it was

designed and the controls necessary to comply with regulatory requirements and governance. It

covers the independent assessment by auditors of the effectiveness of the IT System in its

ability to meet business objectives.

The Monitor and Evaluate domain addresses the following management questions:

Is IT performance measured to detect problems before it is too late?

Does management ensure that internal controls are effective and efficient?

Can IT performance be linked back to business goals?

Are adequate controls for confidentiality, integrity and availability of information in

place for information security?

32

1.6.3.1 How does CobiT Work?

Contained under the four groups or domains of the CobiT framework are 34 high level control

objectives. Each of these high level control objectives contains several detailed control

objectives. Each of the 34 IT process can be broken down into the following steps:

Process Description

Control Objectives

Management Guidelines

Maturity Model

1.6.3.2 Control Based

Control is defined as the policies, procedures, practices and organizational structures designed

to provide reasonable assurance that business objectives will be achieved and undesired events

will be prevented or detected and corrected.

IT control objectives provide a complete set of high-level requirements to be considered by

management for effective control of each IT process.

1.6.3.3 Use of COBIT by the Internal Auditors

COBIT can be used by the Internal Auditor in the following ways:

Assisting in the development of the audit plan.

Facilitating and creating performance metrics for Risk Assessments for managers.

Facilitating the audit.

Managing Residual Risk in the organisation.

Issuing effective controls advisory in order to reduce risk and making recommendations

to the IT Department for improved efficiency.

While CobiT targets control issues, it is not a replacement for the COSO internal control

framework (which focuses on internal controls in a manual environment) but addresses the

internal controls in today‟s Information Technology environment.

The Treasury Division advises that the principles with regard to the processes of CobiT can be

found in the CobiT 4.1 booklet which will be accessed through the Treasury Division. In this

regard, the Internal Auditor can consult with the Treasury Division for guidance.

SUMMARY:-

CobiT is an internationally accepted controls-based framework for IT governance that was first

released by ISACA in 1996. The framework provides guidance to an organisation on how to

use IT resources (i.e. applications, information, infrastructure and people) to manage IT

domains, processes and activities to respond to business requirements (i.e. compliance,

effectiveness, efficiency, confidentiality, integrity, availability and reliability). Well-governed

IT practices can assist businesses in complying with laws, regulations and contractual

arrangements.

33

1.7 REPORTING RELATIONSHIPS

1.7.1 The Parliament of Trinidad and Tobago

Chapter 4, Section 39 of the Constitution of the Republic of Trinidad and Tobago makes

provision for the establishment of the Parliament and states „There shall be a Parliament of

Trinidad and Tobago which shall consist of the President, the Senate and the House of

Representatives‟

The Minister of Finance reports to Parliament on the Public Accounts of the Republic of

Trinidad and Tobago. The Minister in pursuance of his statutory obligation also lays and

presents in the House of Representatives, the Budget Speech and the Appropriation Bill.

The Budget Speech is presented and the Appropriation Bill is debated and passed in the House

of Representatives. The Bill is then brought before the Senate where it is also debated and

passed after which it is forwarded to the President of the Republic of Trinidad and Tobago for

his assent. It then becomes the Appropriation Act for the particular year.

1.7.2 The Minister of Finance

(a) Control and Management of Public Finance

The Minister of Finance under Chapter 8, Section 113 (1) and (2) of the Constitution of the

Republic of Trinidad and Tobago and the provisions of the Exchequer and Audit Act Chapter

69:01 is responsible for the management of the Consolidated Fund and the supervision, control

and direction of all matters in relation to the financial affairs of the state which are not by law

assigned to any other Minister.

(b) Authorization of Expenditure from the Consolidated Fund

Chapter 8, Section 113 (1) and (2) of the Constitution states:

(1) “The Minister responsible for finance causes to be prepared and laid before the

House of Representatives before or not later than thirty days after the

commencement of each financial year, estimates of the revenues and

expenditure of Trinidad and Tobago for that year.”

(2) “The heads of expenditure contained in the estimates, other than expenditure

charged upon the Consolidated Fund by this Constitution or any Act, shall be

included in a Bill, to be known as an Appropriation Bill, providing for the

issue from the Consolidated Fund of the sums necessary to meet that

expenditure and the appropriation of those sums for the purposes specified

therein.”

After the Appropriation Act has been passed by Parliament (see 1.7.1 above) a General

Warrant is issued by the Minister of Finance to the Comptroller of Accounts authorizing him to

make withdrawals from the Consolidated Fund within the limits approved under the Act and in

accordance with Treasury directives.

34

Further, if within any financial year it is found that the sum appropriated may be insufficient,

or that there is need to expend on an item for which no appropriation was made, or that

money may have been over-expended on an appropriated item, a supplementary estimate,

showing the sum required or spent shall be laid before the House of Representatives and the

heads of any such expenditure shall be included in a Supplementary Appropriation Bill.

If the Appropriation Act in respect of any financial year does not come into operation by the

beginning of that financial year, the Minister of Finance may authorize the withdrawal of

moneys from the Consolidated Fund to meet the expenditure necessary to carry on the

services of the Government, until the expiration of thirty (30) days from the beginning of that

financial year of the coming into operation of the Act, whichever is the earlier.

Parliament may also provide for the establishment of a Contingencies Fund, and for

authorizing the Minister of Finance to make advances from that Fund, if he is satisfied that

there has arisen an urgent and unforeseen need for expenditure for which no other provision

exists.

1.7.3 The Accounting Officer

An Accounting Officer is defined in Section 2 Part 1 of the Exchequer and Audit Act Chapter

69:01 as:

„any person appointed by the Treasury and charged with the duty of

accounting for any service in respect of which moneys have been

appropriated by the Constitution or by Parliament, or any person to whom

issues are made from the Exchequer Account.‟

The duties and responsibilities of the Accounting Officer are as follows:

An accounting officer shall be appointed by a letter addressed personally to him by the

Treasury setting out in details his duties and responsibilities.

An accounting officer shall be responsible for ensuring –

a) that the financial business of the State for which he is responsible is properly

conducted; and

b) that public funds entrusted to his care are properly safe-guarded and are applied

only to the purposes intended by Parliament.

All accounting officers are personally and pecuniary responsible for –

c) the due performance of the financial duties of their departments;

d) the proper collection and custody of all public moneys receivable by them; and

e) for any accounts rendered by them or under their authority.

It is the duty of an accounting officer to –

a) ensure that the proper system of accounting as prescribed by the

Treasury is established and maintained.

To assist Accounting Officers in the efficient execution of their duties, the Internal Auditor is

provided as a management aid and reports directly to them. Prevention and detection of fraud

is management‟s responsibilities and the Internal Auditor must be alert to risks and exposures

that could allow for fraud.

35

The Internal Auditor‟s responsibility is therefore to the Accounting Officer. The scope of work

undertaken by the Internal Auditor is determined by his Accounting Officer to whom he is

responsible. The Audit Work programme of the Internal Auditor must be approved by the

Accounting Officer; consequently, the Accounting Officer can limit or expand the extent of the

Audit Work programme.

The Accounting Officer shall be answerable to the Public Accounts Committee and is required

to attend Public Accounts Committee (PAC) meetings on any matter relating the formal

regularity and propriety of accounts of all the expenditure out of the votes for which he is

responsible.

The Accounting Officer reports to the Minister of Finance on any irregularity connected with

the public accounts that may have been discovered.

1.7.4 The Treasury Division

In accordance with Section (2) Part I of the Exchequer and Audit Act Chapter 69:01:

“Treasury means the Minister, and includes such officer or officers in the Ministry of Finance

as may be deputed by the Minister to exercise powers and to perform duties under this act.”

The Minister of Finance is responsible for the control and management of the financial affairs

of the State. One of the core agencies through which this is accomplished is the Treasury

Division.

The Comptroller of Accounts is the Head of the Treasury Division as deputed by the Minister

of Finance and is charged with the responsibility of superintending the expenditure of public

moneys and ensuring that proper arrangements for accounting to the House of Representatives

are made.

Responsibilities

The core responsibilities of the Treasury Division are as follows:

to provide financial management and accounting services to Ministries and

Departments;

to produce the consolidated accounts of the Republic of Trinidad and Tobago;

to administer superannuation and/or terminal benefits to retired public

officers/beneficiaries;

to ensure that the appropriation account of the Republic of Trinidad and

Tobago are laid in Parliament on a timely basis.

To facilitate these operations the Treasury Division is divided into three broad functional areas

as follows:-

i. Financial Management;

ii. Treasury Management; and

iii. Pensions Management.

36

In the execution of its responsibilities for the management of the financial affairs of the State,

the Treasury Division develops implements and monitors financial management and

accounting systems throughout the Public Service. In addition, the Division is also responsible

for ensuring that the internal audit operates effectively. The Comptroller of Accounts is the

Head of the Treasury Division as deputed by the Minister of Finance and is charged with the

responsibility of superintending the expenditure of public moneys so and to ensure that proper

arrangements for accounting to the House of Representatives are made.

1.7.5 The Auditor General‟s Department

The Auditor General is appointed by the President after consultation with the Prime Minister

and The Leader of the Opposition. The office of the Auditor General is a public office, its staff

are public officers appointed in accordance with section 117 of the Constitution of the

Republic of Trinidad and Tobago. As stated in the Constitution the Auditor General, in the

exercise of his/her functions shall not be subject to the direction or control of any other person

or authority. This independence is necessary for an unbiased opinion on the accounts

examined.

The Auditor General reports annually to the Speaker, the President of the Senate and the

Minister of Finance on the Public Accounts of the Republic of Trinidad and Tobago.

In accordance with Section 25 (1) of the Exchequer and Audit Act, the Auditor General is

required to audit the accounts of Ministries, Departments and other Government Agencies to

ensure that expenditure was carried out in accordance with the Appropriation Act. The

Appropriation Accounts together with the Auditor General‟s Report must be submitted to the

Speaker of the House of Representatives, the President of the Senate and the Minister of

Finance by April 30th.

On receipt of such reports, the Speaker and the President of the Senate

are obliged to lay such reports before the respective houses of Parliament at the first sitting

after receipt thereof. It is then referred to the Public Accounts Committee for examination.

The Internal Auditors have an independent appraisal function within the

Ministries/Departments and is answerable to their Accounting Officer while the Auditor

General has a statutory responsibility to express an independent opinion to Parliament on the

financial statements and stewardship of Ministries and Departments whose budgets have been

funded by the Annual Appropriation Act of Parliament.

The Auditor General has the authority to appraise the effectiveness of the internal audit

function and may report her findings to Parliament.

The relationship between the Auditor General‟s Department and The Internal Audit Unit is one

where the Auditor General examines the work of the Internal Auditor by reviewing their

quarterly and annual work programme to ensure adequate audit coverage of the

Ministries/Departments and public entities, and also assist in minimizing the duplication of

efforts.

Co-operation between the Internal Audit Unit of each Ministry/Department and the Auditor

General‟s Office may take place in the following ways:

Shared knowledge of planned audit coverage to minimize the incidence of

overlapping.

37

Joint reporting by both Auditor General and Internal Auditors at the developmental

stage where changes from manual to computer-based systems are involved.

Exchange of audit reports and management letters.

Common understanding of audit techniques, methods, and terminology.

In addition to auditing Ministries, Statutory Authorities and State Enterprises the Auditor

General is also responsible for approving the Grant of Credits on the Exchequer Account.

1.7.6 The Public Accounts Committee and the Public Accounts Enterprises

Committee

The Constitution of the Republic of Trinidad and Tobago establishes the Public

Accounts Committee (PAC) and the Public Accounts Enterprises Committee

(PAEC).

The PAC is charged with the responsibility of examining the appropriation accounts of moneys

granted by Parliament to meet the public expenditure of Trinidad and Tobago. This Committee

therefore examines the audited accounts of Government Ministries and Departments, paying

close attention to the comments made by the Auditor General which relate to financial

management.

In the performance of its work, the PAC calls to account many Permanent Secretaries and

Heads of Government Departments and has been instrumental in the establishment of a more

responsive attitude on the part of Administrative Heads of Government Ministries/Departments

to the advice and requirements of the Auditor General‟s Department.

The PAEC was established as a result of the growth of the public sector. Since the early 1970‟s

there has been an increase in the number of Statutory Corporations and State Enterprises

covering a wide range of industrial and other economic activities. Consequently, it was

considered that since parliamentary control was too remote and not continuous, a mechanism

should be created for Parliament to keep an effective watch over public sector projects in

which millions of taxpayers‟ dollars had been invested.

The PAEC examines the reports and accounts of the public undertakings and determines

whether the affairs of these institutions are being managed in accordance with sound business

principles and prudent commercial practices.

The work of both the PAC and PAEC are facilitated by the assistance of personnel from the

Offices of the Comptroller of Accounts as well as the Auditor General whose audited reports of

Government Ministries and Departments and public sector enterprises form the basis of the

scrutiny exercised by these Committees.

38

CHAPTER 2

The Governance Structure of the Public Service-Legal Environment

Corporate Governance refers to the process by which organizations are directed, controlled and

held to account, and is underpinned by the principles of openness, integrity and accountability.

Governance is concerned with structures and processes for decision-making, accountability,

control and behavior at the top of organizations.

The Public Service plays a major role in society, and effective governance in the Public Service

can encourage the efficient use of resources, strengthen accountability for the stewardship of

those resources, improve management and service delivery, and thereby contribute to improving

peoples‟ lives. Effective governance helps to build confidence in public service entities which is

necessary if public service entities are to be effective in meeting their objectives.

The proper conduct of public service business requires a framework which must include

effective systems of control and accountability, and above all responsible attitudes on the part of

those handling public money.

The Governance Structure in the Public Service is outlined below.

39

PARLIAMENT

(LEGISLATIVE)

CABINET

(EXECUTIVE)

AUDITOR GENERAL

Report on Public

Accounts

MINISTER OF

FINANCE

LINE MINISTER

Budgetary Releases

and Accounting Officers

Letters

CPO

Terms & Conditions

of Employment

Civil Service Act No.

29 of 1965

SERVICE COMMISSIONS

Recruitment, Appointment and

Disciplinary Control

Constitution Sections:-

(120)

(122)

(124)

(110)

Monday, July 04, 2011

THE GOVERNANCE STRUCTURE OF THE PUBLIC SERVICE

Prepared by:MM

CTB

Procurement and

Disposals

Act No. 22 of

1961

LEGAL ENVIRONMENT

Constitution

Exchequer and Audit Act and

the Financial Regulations

Civil Service Regulations

Judicial Review

INDEPENDENT BODIES

TREASURY DIVISION

Financial and

Accounting Advice

ACCOUNTING

OFFICER

2.1 The purpose of this chapter is to provide an overview of the Governance Structure in

the Public Service.

Governance Structure of The Public Service - Legal Environment

An important part of the framework of Public Service governance is the legislative framework within which the laws of Trinidad and Tobago, rules, regulations and policies are made and adhered to. This legal framework gives the public service a certain amount of predictability in that citizens have a common understanding of what measures can be applied to government policy. The Legislative Framework that governs the Public Service comprises the following: i) The Constitution of the Republic of Trinidad and Tobago; ii) Exchequer and Audit Act Chapter 69:01; iii) Financial Regulations to the Exchequer and Audit Act; iv) The Financial Instructions 1965; v) Ministry of Finance and Comptroller of Accounts Circulars; vi) Manual of the Terms and Conditions of Employment; vii) Chief Personnel Officer Circulars; viii) Commissions and Relevant Acts; ix) Civil Service Act Chapter 23:01; x) Civil Service Regulations; xi) Civil Service (External Affairs) Regulations; xii) Public Service Commission Regulation, 1966. As the legislative framework is provided for in the Constitution, other issues like accountability follow closely. Accountability deals with the criteria used: - to assess performance- productivity i.e. financial, economic etc.; - to hold public officials responsible for their actions; - to assess the system of control that determines how money is spent and for what purpose. It also deals with the process by which private persons seek redress for actions and decisions of government, public officials and institutions. With responsibility comes accountability and accountability laws are enshrined in the Constitution of the Republic of Trinidad and Tobago in the Exchequer and Audit Act, Chapter 69:01. Outlined in the Act is the mandate given to the Office of the Auditor General to audit “the public accounts…of all officers, courts and authorities of Trinidad and Tobago.” It also gives “the Auditor General or any person authorized by him…access to all books, records, returns and other documents relating to those accounts.” The Integrity Commission and the Office of the Ombudsman also call public officials to account for their actions. For example the Integrity in Public Life Act (Amendment 2010) seeks “to make provisions for the prevention of corruption of persons in public life by providing for public disclosure”. The Act also seeks to regulate the conduct of person exercising public functions and to preserve and promote the integrity of public officials and institutions. The Office of the Ombudsman assists members of the public who feel aggrieved by the actions of entities in the public service. The availability of information on government, public officials and institutions also contributes to another facet of governance in the Public Service. Public sector companies such as state enterprises are required by law to provide published public reports on their operations. Even if the reports are not published the public has the right to access such information. 40

41

The Freedom of Information Act of 1999 “give members of the public a general right (with exceptions) of access to official documents of public authorities and for matters related hitherto”. The Act is the legal mechanism for the prevention of corruption. It has been argued that the Act helps to reduce corruption among public officials. The national Chapter of Transparency International monitors activities in the public service. It is a non-governmental organization registered under the Companies Act of 1999 and controlled by a board of directors. Its objective is to reduce corruption and foster good governance by raising awareness, stimulating action and contributing to the reform of systems, institutions and laws. The Treasury is empowered by the Exchequer and Audit Act 20 of 1959, Chapter 69:01 to oversee and monitor the operations of all Government entities such as Ministries, Departments, Agencies etc. Part II 4. (1)- (3) of this Act state the powers of the Treasury as follows: (1) “All persons concerned in the collection, receipt, custody and payment or issue of public moneys, stores, stamps, securities or other state property shall obey all such instructions as they may from time to time receive from the Treasury in respect of public moneys, stores, stamps, securities or other state property, or accounting for the same.” (2) “The Permanent Secretary to the Minister, or any officer in the Treasury authorised by him, shall be entitled to inspect all offices and to have such access to all official books, documents and other records as may be necessary for the exercise of the powers and duties of the Treasury under this Act.” (3) “The Treasury shall so superintend the expenditure of public moneys as to ensure that proper arrangements for accounting to the House for such expenditure are made.” 2. Parliament (Legislative Arm of Government) Parliament which is the Legislative arm of Government provides authority for the acquisition and use of financial resources and is responsible for overseeing administration. It is basically responsible for sanctioning the overall public sector financial plan or budget and authorizing the executive to make expenditures (within limit), invest, borrow and administer programs in accordance with any laws that may affect them.

Because it provides financial authority and powers, Parliament has the right and responsibility to hold government and its entities accountable for the management of the financial affairs, the use of resources entrusted to them and the result achieved. In effect, accountability is the obligation to answer for a responsibility that has been conferred. It presumes the existence of at least two parties: one who allocates responsibility and one who accepts it with the undertaking to report upon the manner in which it has been discharged. Therefore, Parliament plays an important role in the overall framework of governance in the public sector.

Parliament needs to exercise control over the expenditure of public monies made available to the Ministers by way of budgets. It usually reviews the annual reports of public service entities, evaluates the standard of their work and makes recommendations, based on the facts contained in the various audit reports by the external auditor and the Minister in question. In the interest of transparency, such hearings need to be public hearings.

41

42

3. Cabinet (Executive Arm of Government)

The Constitution provides for a Cabinet under the general direction and control of the Government, collectively responsible to Parliament. The Cabinet has effective control of the nation‟s affairs and is headed by the Prime Minister, who is appointed by the President, and such numbers of other Ministers as he may decide to have, of whom one shall be the Attorney General, chosen from among the members of the House of Representatives and the Senators appointed by the President acting in accordance with the advice of the Prime Minister.

The functions of the Cabinet include initiating and deciding on policy, the supreme control of the Government and the Coordination of Government departments. 4. Role and Function of the Minister of Finance

The Minister of Finance is responsible for the management of the Consolidated Fund and the

supervision, control and direction of all matters in relation to the financial affairs of the state

which are not by law assigned to any other Minister. The Minister of Finance issues the

General Warrant to the Comptroller of Accounts authorizing him to make withdrawals from

the Consolidated Fund within the limits approved by the Appropriation Act for the relevant

financial period.

The Minister of Finance also has the power to authorize the withdrawal of moneys from the

Consolidated Fund to meet necessary expenditure to carry on government services if the

Appropriation Act is not operational at the beginning of any financial year. The Minister of

Finance is also authorized by Parliament to withdraw moneys from the Contingency Fund in

cases of urgent and unforeseen need for expenditure. The Accounting Officer is appointed by

the Minister of Finance.

5. Role and Function of Line Ministers

The President acting on the advice of the Prime Minister appoints Cabinet Ministers and may

assign to the Prime Minister or any other Minister responsibility for any business of the

Government including the administration of any Department of Government. A Minister

assigned responsibility for any Department of government exercises general direction and

control over that Department and is answerable to Parliament for that Department‟s

activities. Ministers assist in: 1) the management of financial affairs and resources of the Ministry. 2) developing a budget or financial plan for the Ministry within the overall approved level of expenditure for approval by Cabinet. They are also responsible for overseeing and monitoring the implementation of the approved budget or financial plan.

6. The Service Commissions

The Accounting Officer is dependant on the Service Commissions for recruitment and

appointment of staff and the disciplinary control of staff.

Four Service Commissions are established under the Constitution of the Republic of Trinidad

and Tobago. These are:

The Public Service Commission (sec.120);

43

The Teaching Service Commission (sec.122);

The Police Service Commission ( sec.124) and

The Judicial and legal Service Commission (sec.110).

The objective of establishing non-political bodies was for the sole purpose of maintaining

neutral services operating on the basis of merit, free from patronage; discrimination,

nepotism and injustice.

Functions of the Service Commissions

The Service Commissions are vested with the power to appoint persons to hold or to act

in public offices in the relevant services, including the power to make appointments on

promotion and transfer and to confirm appointments and to remove and exercise

disciplinary control over persons holding or acting in offices governed by the respective

Service Commissions. The Service Commissions also act as appellate bodies for officers

who feel aggrieved by any decision of Permanent Secretaries/Accounting Officers or

Heads of Departments or the Commissions themselves.

Responsibilities of the Service Commissions

As the administrative head of the Service Commissions Department, the Director of

Personnel Administration is responsible for the efficient conduct and work of the entire

Department and as such is responsible for:

i) the recruitment of the best possible candidates including government

scholars, for appointment to entry level offices within the various classes of

offices in the Services in keeping with the requirements for such offices and

the principles, procedures and policies laid down by the respective Service

Commissions by regulations or otherwise;

ii) ensuring that the human resource needs at the higher levels of the service

falling under the constitutional responsibility of the various Service

Commissions and the legitimate career goals and expectations of officers are

satisfied; and monitoring the management activities attendant thereto;

iii) assisting the Commissions in fostering a positive discipline among employees

of the public service and ensuring where there are breaches of the code of

conduct that the appropriate procedures are applied; and

iv) provision of support staff for the Examination Board and ensuring that the

Examination Board is properly staffed at all times.

7. The Personnel Department

The Accounting Officer relies on the Personnel Department to provide terms and

conditions of employment for staff attached to his Ministry/Department.

The Personnel Department, headed by the Chief Personnel Officer was established by the

Civil Service Act, No. 29 of 1965 which came into force on August 27, 1966. The duties

and responsibilities of the Department as set out at Section 14(1) of the Act are:

44

(a) to maintain the classification of the Civil Service and to keep under review the

remuneration payable to civil servants;

(b) to administer the general regulations respecting the Civil Service;

(c) to provide for and establish procedures for consultation and negotiation between the

Personnel Department and an appropriate recognized association/s in respect of:

(i) the classification of offices;

(ii) any grievances;

(iii) remuneration; and

(iv) the terms and conditions of employment.

The Personnel Department is also empowered to perform the same functions for:

the Teaching Service, the Police Service, the Fire Service and the Prison Service.

The clients of the Personnel Department include public officers, officers of Statutory

Authorities and workers as defined by the IRA, who are in the employ of the Government

or the Municipal Corporations.

As a central Human Resource Management Agency, the Personnel Department is involved

in the following:

formulating policy in areas of Human Resource Management which are not within the

purview of the Service Commission.

Formulating specific public sector policies in areas such as Occupational Safety and

Health, and the development of guidelines for the Public Service on the treatment of

persons afflicted with HIV/AIDS and other life threatening diseases.

Reviewing the legal and regulatory framework for aspects of Human Resource

Management in the Public Service.

Providing advisory and consultative services in the sphere of Human Resource

Management to line agencies.

Facilitating the implementation of specific strategic Human Resource management

initiatives in the Public Service; and

Monitoring and auditing the practice of human resource management in line agencies.

The terms and conditions of employment of persons employed on contract are, by decision

of Cabinet, determined by the Personnel Department.

8. The Central Tenders Board (CTB)

The Central Tenders Board aids the Accounting Officer in the procurement of supplies and

services for his Ministry/Department.

The Central Tenders Board was established by Act No. 22 of 1961 to ensure that the proper

procedures are followed to obtain the most suitable supplies and services from available

sources. The CTB is the main authority-

1. to act for, in the name and on behalf of the Government and the Statutory Bodies to

which the Ordinance applies, in inviting, considering and accepting or rejecting offers for

the supply of articles or for the undertaking of works or any services in connection

therewith, necessary for carrying out the functions of the Government or any of the

Statutory Bodies;

45

2. to dispose of surplus or any unserviceable articles belonging to the Government or

any of the Statutory Bodies;

3. to perform other functions and duties as the President may by order prescribe from

time to time; and

4. to appoint consultants in connection with any project.

Other bodies such as NIPDEC and all state enterprises have their own procurement Boards.

9. The Treasury Division

The Treasury Division, Ministry of Finance is headed by the Comptroller of Accounts who

is the Chief Accounting Officer of the Public Service and charged with the responsibility

of:

1. Superintending the expenditure of public moneys and ensuring that proper

arrangements are in place for accounting to the House of Representatives.

2. providing financial management and accounting services to Ministries and

Departments.

3. producing the Consolidated Accounts of the Republic of Trinidad and Tobago.

4. administering superannuation and/or terminal benefits to retired public

officers/beneficiaries.

5. ensuring that the Appropriation Accounts of the Republic of Trinidad and

Tobago are laid in Parliament on a timely basis.

The Treasury Division is also responsible for submitting recommendations to CTB for the

disposal of unserviceable articles in the Public Service. The Accounting Officer of the

Ministry/Department submits a memorandum to the Comptroller of Accounts, the Head of

the Treasury Division, requesting to dispose of the items and stating the location of the

items. The Treasury Officer would review the relevant documents and would appoint a

Special Board of Survey to inspect the items.

The Board would make recommendations based on the findings such as sell by auction,

repair, transfer and destroy, or other. The Chairman of the Board of Survey would then

forward the documentations to the Comptroller of Accounts who would review the

documents and forward to the Director of Contracts, Central Tenders Board. If the

recommendations made are acceptable to the Director of Contracts the Central Tenders

Board then contacts the Ministry /Department on the final decision. The CTB contacts the

Treasury Division if the recommendations are not acceptable for further recommendations.

10. The Auditor General

The Auditor General is appointed by the President after consultation with the Prime

Minister and the Leader of the Opposition. As stated in the Constitution the Auditor

General, in the exercise of his/her functions shall not be subject to the direction or control

of any other person or authority. This is necessary in order to have an unbiased opinion on

the accounts examined.

In accordance with Section 25 (1) of the Exchequer and Audit Act, the Auditor General is

required to audit the accounts of Ministries, Departments and other Government Agencies

46

to ensure expenditure was made in accordance with the Appropriation Act. The Auditor

General reports annually to the speaker, the President of the Senate and the Minister of

Finance on the Public Accounts. The Auditor General also has the authority to appraise the

effectiveness of the internal audit function in Ministries/Departments and may report the

findings to Parliament. The Accounting Officer has to approach the Auditor General for the

approval of Grant of Credits on the Exchequer Account.

11. Role and Function of the Accounting Officer

The Accounting Officer in the Public Service is usually the Permanent Secretary/Head of

Department of a Ministry/Department.

The Exchequer and Audit Act Chapter 69:01, Part I section 2 describes an Accounting

Officer as follows: “any person appointed by the Treasury and charged with the duty of

accounting for any service in respect of which moneys have been appropriated by the

Constitution or by Parliament, or any person to whom issues are made from the

Exchequer Account;”

An Accounting Officer is responsible for:

(a) ensuring that the financial business of the state for which he is responsible is

properly

conducted;

(b) ensuring that public funds entrusted to his care are properly safe-guarded and

are applied only to the purposes intended by Parliament;

(c) the due performance of the financial duties of his department;

(d) the proper collection and custody of all public moneys receivable by him; and

(e) for any accounts rendered by him or under his authority.

The duties of an Accounting Officer are detailed in the Financial Regulations to the

Exchequer and Audit Act at Part I Section 8 (a)-(l).

The Accounting Officer is usually responsible for the planning, directing and controlling

of day-to-day operations and for preparing reports that provide an account of his

administration. His responsibilities include directing operations with due regard to

economy and efficiency, maintaining an adequate system of internal control, ensuring

compliance with applicable authorities, selecting and applying appropriate accounting

policies, safeguarding assets, measuring the effectiveness of programs and reporting on

his performance to Parliament.

The Accounting Officer is at the core of the Governance Structure. He is firstly accountable to

the Minister appointed to his Ministry/Department and then to Parliament for the operational

aspects of his Ministry/Department. He may be called to give evidence before the Public

Accounts Committee on the basis of reports by the Auditor General. It is therefore up to the

Accounting Officer to perform his duties within the scope of law. The Accounting Officer is

responsible for the day-to-day running of the office and as head of the department the buck

ultimately stops with him. The relationship between the Minister and the Accounting Officer is

a political/administrative one. The Accounting Officer is responsible for advising the Minister,

implementing the government‟s agenda and managing his Department.

47

The Accounting Officer interacts with numerous Ministries/Departments in the Public Service

in order to fulfill his roles and responsibilities. Some of the major ones as outlined above are:

1. The Service Commissions for recruitment of staff;

2. The Personnel Department for guidelines re remuneration to staff;

3. The Central Tenders Board for Procurement and Disposal of Assets;

4. The Treasury Division for financial and accounting advice;

5. The Auditor General.

48

CHAPTER 3

MANAGEMENT OF THE INTERNAL AUDIT

UNIT

The corporate planning process is outlined in this Chapter, showing Government‟s

overall objective and how each Ministry and their respective

Departments/Divisions/Units strategize to meet that objective. Additionally, the

relationship between the corporate plan, the operational plan, and the annual audit plan is

highlighted.

This Chapter also looks at preliminary risk assessment as a part of the planning process

and provides guidelines for the management of human resources within the Internal Audit

Unit.

3.1 THE CORPORATE PLANNING PROCESS

The Internal Audit Unit within a Ministry or Department is required to prepare:

a Corporate Plan

an Operational Plan

an Annual Audit Plan.

In order to do this the Internal Audit Unit needs to be fully aware of its function, how its

operations impact on the areas it serves and how it is integrated into the Ministry‟s

strategic policies.

In Government, the planning process is carried out at three levels –

Cabinet

the Ministries

Departments/Divisions/Units.

In order to understand the process, the link between the government‟s overall

objective(s), the respective Ministry‟s strategic policies and its Departments‟, Divisions‟

and Units‟ strategic objectives are discussed.

49

3.1.1 Government‟s overall Objective & Policies

The Government of Trinidad and Tobago has an overall objective and to achieve this,

several strategic policies are developed. Each Ministry has a major role in the process and

as a result will establish policies, in collaboration with Cabinet, that complement the

overall objective of Government and the Ministry‟s portfolio.

The government, in an effort to ensure that adequate attention is given to priority policies,

require each Ministry to develop three-year Corporate Plans. These plans should

directly relate to the achievement of sector and overall policy outcomes. The corporate

plan is to be updated and rolled forward each year.

3.1.2 The Ministry‟s Corporate Plan & Operational Plan

The Ministry‟s Corporate (Strategic) Plan is the translation of national development

policies into medium and long term goals and objectives, the adoption of strategies to

achieve these goals, along with the allocation of necessary resources and the

establishment of performance criteria to facilitate monitoring and evaluation.

The Operational Plan provides the details for carrying out the responsibilities and

objectives of the Corporate Plan. This represents the first year of the three-year corporate

plan.

Each Ministry must include all the Heads of Departments, Divisions and Units in the

corporate planning process. The Departments‟, Divisions‟ or Units‟ Corporate and

Operational Plans are “pull downs” of the Ministry‟s. For purposes of this section, the

corporate planning process will be looked at in greater detail at the Internal Audit Unit

level.

The Ministry of Finance (Comptroller of Accounts) will be used as an illustration.

The elements of the Ministry‟s Corporate & Operational Plan are the same as its

Departments‟, Divisions‟ and Units‟ and the link between both are:

The Ministry‟s priority policies and their desired outcomes; and

Its strategic objectives and related outputs.

3.1.3 The Internal Audit Unit Corporate Plan

The Corporate Plan of the Internal Audit Unit is at a micro-level and should have a direct

link to its Ministry‟s or Department‟s Corporate Plan. The Internal Audit Unit‟s

Corporate Plan is of a strategic nature and presents a broad description of what the

Internal Audit Unit hopes to achieve within the three year period. This Corporate Plan

should also to be updated and rolled forward.

50

The Internal Audit Unit Corporate Plan should have the following headings. (They are

the same headings as the Ministry‟s Corporate Plan):

The Name of the Unit e.g. Internal Audit Unit

The Vision of the Unit

The Mission of the Unit

The Ministry‟s Outcome Indicator (Desired Outcome) to which the Internal Audit

Unit will contribute.

The Priority Policy/ies to which the Internal Audit Unit will contribute.

The Strategic Objective/s to which the Internal Audit Unit will contribute.

The Strategy/ies that the Internal Audit Unit will employ to realise the strategic

objectives.

The Key Output/s of the Internal Audit Unit specific to the strategies that it will

employ.

The Performance Indicators/Targets

These headings are discussed below:

3.1.3.1 Internal Audit Vision and Mission Vision Statement

The vision statement should give direction to the Internal Audit Unit and be an

expression of how the Unit would like to be perceived.

Mission Statement

The mission statement should outline the purpose for which the Internal Audit Unit

exists. It should also embrace the audit responsibilities relating to the scope of audits

carried out within the Ministry or Department.

Note – Appendix 3.1.3.1.A contains an example of a generic vision statement and

mission statement. Individual units may modify these documents to meet their

particular needs. The Head of the Internal Audit Unit should ensure that the

Permanent Secretary signs off on these statements.

3.1.3.2 Ministry‟s Priority Policies, Key Outcome Indicators, And Strategic

Objectives

The Internal Audit Unit must identify which of the Ministry‟s key outcome indicator(s),

priority policy (ies) and strategic objective(s) that it relates to.

In the instance of the Internal Audit Unit of the Ministry of Finance, it can contribute to

the Ministry achieving “cost effective public services”.

51

Of the five priority policies, the Internal Audit Unit may identify two that it could

adequately contribute to, namely “Improving the overall efficiency of the Ministry of

Finance and “Increase operational efficiency and reduce waste in the public sector”.

The strategic objectives that the Internal Audit Unit might have a direct impact on are: -

To build an excellent Public Service through harnessing creativity and effective

management of our resources and;

To improve the financial management of public sector investment projects.

Safeguarding Government‟s Assets.

3.1.3.3 Strategies

For each strategic objective the Internal Audit Unit will be required to outline the

strategies to be adopted. The strategies should indicate how the Internal Audit Unit would

meet the strategic objective(s).

Some examples are as follows:

Monitor systems and procedures to ensure effectiveness, efficiency and

compliance with regulations.

Provision of timely analyses, appraisals, recommendations and commentaries of

the audit activities to management.

3.1.3.4 Key Output

Once the strategies to achieve the strategic objectives have been identified, the Internal

Audit Unit can determine the key outputs they must deliver. Outputs are the things or

conditions that occur as a result of the Internal Audit Unit employing the strategies.

Some examples are:

Effective Internal Audit Unit

Improved Scope and Performance of Audits

Improved compliance to laws, regulations, policies, standards and instructions.

Effective and efficient systems and procedures.

3.1.4 The Internal Audit Unit Operational Plan

The Internal Audit Unit Operational Plan is the detailed plan of the first year of the Unit‟s

Corporate Plan. It highlights the key outputs of the Corporate Plan, the major tasks and

costs associated with these outputs for the twelve-month period.

52

The format of the Operational Plan includes the following headings:

The Name of the Unit e.g. Internal Audit Unit

The Vision of the Unit

The Mission of the Unit

The Ministry‟s Outcome Indicator

The Strategic Objectives

The Key Outputs of the Internal Audit Unit

The Performance Indicators

The Targets

The Major Tasks

Major Tasks

These are the activities that will be carried out to achieve the key outputs specified. Some

examples are:

Prepare an annual audit plan.

Perform value for money, compliance, operational and special audits.

Prepare audit reports and conduct follow –up.

Conduct in-house training.

Conduct cash surveys where necessary.

Conduct Site Inspections.

3.1.5 The Annual Audit Plan

The Annual Audit Plan of the Internal Audit Unit is directly linked to its Operational

Plan. It incorporates some of the major tasks that are to be undertaken by the Unit within

the twelve-month period of the operational plan.

The plan should include, but be not limited to, the activities to be audited; when they will

be audited and the estimated time required. Other factors to be taken into account when

developing the Annual Audit Plan are the scope of the audit planned and the risk

assessment process.

The main steps to develop an Annual Audit Plan are:

Establish goals for the unit.

Identify potential audit areas. This involves selecting the audits that will be

attempted during the course of the year.

Estimate audit time requirement for each potential audit. This involves

calculating audit time available and estimating the audit time requirement for

projected audit work.

53

Decide priorities and allocate resources. This involves deciding which areas or which

audits will be given most emphasis, and therefore where the resources will be first

allocated.

The allocation of priorities takes into consideration the following factors:

a. Areas of high risk / areas undergoing change

b. Management concerns

c. Significance of the area/impact of the area

d. Likelihood of success

The main components of the Annual Audit Plan are as follows:

List of proposed audits.

Priorities allocated to each of the audits selected. Audits can be ranked using a

scale of 1-5. It is important that the annual audit plan has a key that identify the

ranking.

Frequency in which the audit will be conducted.

The last date that area was reported.

Budgeted audit days – this gives an estimate of the audit resources in days

required. Actual days to complete the audit can be inserted into the Annual Audit

Plan. This can be used for comparative purposes and assist in future planning.

An indication of the quarter in which the audit will commence.

Personnel expected to be assigned - this highlights the personnel resources

Estimated start and completion dates for each audit selected.

The Annual Audit Plan should be approved and signed off by the Permanent

Secretary.

3.2 RISK ASSESSMENT

The risk assessment process provides a structured means of evaluating information and

applying professional judgment as to the most important areas for audit examination.

A detailed risk assessment is undertaken during the planning phase of the engagement to

confirm that the lines of enquiry and the initial objectives have indeed focused on the

most important risks associated with the program or activity being audited.

The Head of the Internal Audit Unit should conduct a preliminary risk assessment prior to

deciding which audits to include in the Annual Audit Plan and the amount of resources to

apply to each audit area.

The process should be conducted annually to assist in the development of the operational

plan. The risk assessment process is crucial to the development of the operational plan.

54

The risk assessment process should include:

Identification of auditable activities

Identification of relevant risk factors

Assessment of their relative significance

An assessment of the inherent risk in each potential audit area;

An evaluation of internal controls, to judge the control risk; and

A measure of the materiality: both in terms of the overall amount of resources

involved in the area of audit and the likely resources at risk (through loss, waste

or inefficient use of resources).

3.2.1 Risk Assessment and Professional Judgment

The Head of the Internal Audit Unit may decide to weigh the risk factors to signify their

relative significance. This weighing reflects his/her professional judgment about the

relative impact a factor may have on selecting an activity for audit.

The risk assessment then is a process for assessing and integrating professional judgment

about probable adverse conditions. The assessment process should provide a means of

organizing and integrating professional judgment for selecting the audit assignments for

the year.

3.2.2 Information Sources

Information to assist in the assessment can be gathered from the following sources:

Analyses of financial and operating data

Interviews and discussions with various levels of management

Discussions with the external auditors

Prior year audit files of internal audit and management letters from the external

audit.

Review of applicable laws, regulations and manuals

Review of preliminary survey findings if any

News media

3.2.3 Setting Priorities

The risk assessment process should assist the Internal Auditor to assign priority ratings to

the assignments selected. The Internal Auditor should generally assign higher audit

priorities to activities with higher risks.

Because the environment is always changing, audit priorities that are determined through

the risk assessment process should be reviewed and updated throughout the year as

necessary.

55

There should be a periodic assessment of the effect of any major changes in the audit

areas selected or related risk factors, which have occurred since the operational plan was

prepared. This assessment will assist the Internal Auditor in making appropriate

adjustments to the Annual Audit Plan.

The Internal Auditor, with the assistance of other members of the Internal Audit Unit,

should be able to make these assessments based on the knowledge and experience already

existing within the unit.

3.3 HUMAN RESOURCE MANAGEMENT

The organisational status of the Internal Audit Unit and the support accorded to it by

Permanent Secretaries, Heads of Departments and Agencies determine the range and

value of the services that Senior Managers will obtain from the Internal Audit Function.

One factor that will affect the perceived value of the Internal Audit Unit is its level of

professionalism and this requires professional staff. The staff must possess a broad

knowledge of audit methods and techniques in order to satisfy the extended reach of

modern internal auditing. The Internal Auditor must therefore consider certain attributes

of professional knowledge, ability, and qualities of character when making personnel

selections.

Each Internal Audit Unit should have an established programme for selecting and

developing the Human Resources of the Unit. The programme should provide for:

Developing written job descriptions for each level of the internal audit staff.

Selecting qualified and competent individuals.

Training and providing continuing educational opportunities for each internal

auditor.

Appraising each internal auditor‟s performance at least annually.

Providing counsel to internal auditor‟s on their performance and professional

Development.

3.3.1 Training

Training is a means of self-protection and stabilization for the organisation. The loss of

highly qualified personnel can severely affect the audit services provided. Appropriate

training programs can provide assurance that backup personnel are immediately available

or will be within a reasonable period of time.

The head of the Internal Audit should coordinate, and keep under review, the training

requirements of internal auditors. He/she should be responsible for preparing training

profiles that identify the training requirements for different grades of Internal Audit, and

should maintain personal training records for each individual.

56

The type of training provided will vary, depending on the level of experience of the

internal auditor. Most of the training for the new internal auditor will be on-the-job. This

should be designed to give them experience in the various phases of an audit project and

must be documented in order to ensure that all pertinent matters have been covered. On-

the-job training should be supplemented by giving the auditors the opportunity to attend

seminars given by the relevant auditing institute.

The training program for senior internal auditors should include an opportunity to act in a

supervisory capacity for a period of time. This should go beyond merely sitting in during

vacation periods. The assignment should last long enough to expose him/her to a number

of audit projects and administrative situations.

The individual Internal Audit Units should incorporate into their annual plans, a specific

time allocation for training and development for each auditor at all levels in the

organisation.

If there is a Training Unit in the Ministry/Department that has overall responsibility for

the training of officers, the head of the Internal Audit Unit should liaise with the training

officer to ensure that the training needs of the Unit are met.

See “Guide to Systems Survey” at Appendix

57

CHAPTER 4

PERFORMANCE OF AUDIT WORK

This Chapter deals specifically with the execution of the audit assignment. It details the

various stages of the audit assignment and includes the standards for working papers and

reports. Planning, in this context is specific to the management of an audit.

4.1 PLANNING THE AUDIT ASSIGNMENT

Planning is the preparatory work that the internal auditor performs prior to conducting the

detailed fieldwork. The planning must be documented and should involve:

Obtaining background information about the activities to be audited

Conducting risk assessment

Establishing audit objectives and scope of work.

Ensuring the subject is auditable.

Determining the resources necessary to perform the audit.

Communicating with all persons who need to be aware of the audit.

(Have a planning meeting with the client.)

Performing a preliminary survey to become familiar with the activities

and controls to be audited, to identify areas of audit emphasis.

Developing the audit program.

Determining how, when, and to whom audit results will be communicated.

58

4.1.1 Background Information

A review of the background information should be done to determine the impact of the

audit and also to obtain an understanding of the business of the entity.

This understanding can be obtained through the review of key documents, studies and

interviews with management and other personnel.

Some examples of documentation to be reviewed and collected include:

The relevant legislation, regulations and important public statements regarding the

entity/area to be audited.

The corporate plans, budgets and other planning documents;

A list of the main products and services produced and/or regulatory

functions provided;

Any studies, reports or evaluations done on the entity/area;

Financial and performance reports (past years as well as the

current year‟s reports to determine trends and conduct other analytical

assessment);

Minutes of senior management committees and/or Board meetings;

Organisational structure, with the major managerial positions, and what the

different parts of the organization are responsible for;

Background material on major assets (such as buildings, vehicles, public utilities,

etc.), substantial expenditures (such as major capital projects) and revenues (areas

of revenue collection);

Past audits reports

Any other material that helps to gain an understanding of the business including

the main resources consumed, the revenues generated, the activities, outputs and

outcomes of the entity that are being considered for inclusion in the audit.

4.1.2 Conducting Risk Assessment

After gaining an understanding of the organization‟s operation, the internal auditor

should conduct a risk assessment to determine the audit risk in the execution of his/her

assignment.

Audit risk, which is the risk of arriving at an incorrect conclusion, based on the audit

findings, is broken down into three categories:

Inherent risk -

which is the susceptibility to error or loss unrelated to any internal control system.

Control risk-

which is the risk of error or loss not prevented or detected on a timely basis by the

internal control structure.

59

Detection risk-

which is the risk of major error or loss going undetected despite controls and audit

effort.

As it relates to inherent risk, the audit should focus on those areas of materiality and

significance. First, the auditor needs to ask what could go wrong and what would be the

likely consequences. If the likelihood of the occurrence is low and the materiality or

significance of the consequence is low, the auditor need not be concerned. Where the

likelihood is high and the significance is high the auditor must be assured that either the

internal controls are strong enough to detect and prevent such occurrences or the audit

coverage is sufficient to detect such occurrences with a high level of assurance.

In relation to control risk, the internal auditor should determine how the controls are

applied, assess their adequacy and identify significant control gaps. He/she should expect

to see stronger controls where the risks are highest and limited controls where the risks

are low.

For example, there should be strong controls in place to ensure contracts involving large

expenditure are well managed: for the selection of the contractor, for drawing up the

contract and for the control of performance under the contract. On the other hand, there

should be minimal effort applied to controlling small items of inventory where the risk of

loss, damage or theft is low.

When dealing with detection risk (which is dependent on the selected audit methodology,

audit scope and extent of substantive testing) the auditor should bear in mind that there is

a trade off between this risk and the cost of audit. Thus the risk assessment process is

particularly important in determining the extent to which the audit will examine the

systems, procedures, practices and transactions that govern matters at the lower end of

the objective and control hierarchy.

The nature, timing, audit scope and extent of the substantive audit procedures should be

determined based on the level of audit risk and assessment of the organization‟s inherent

and control risks.

4.1.3 Establishing Audit Objectives and Scope

Defining the audit objectives and scope should be based on the particular audit

assignment and background information gathered.

Audit objectives are broad statements developed by internal auditors and it

defines the intended audit accomplishments, i.e. what do we hope to achieve?

Audit scope is the activities covered by the internal auditor on the assignment.

The audit objectives along with the audit procedures, which are instructions to carry out

the audit work, help the auditor to establish the scope of the work.

60

In setting the audit objectives and the scope of work to be covered the conclusions drawn

from the risk assessment completed at the beginning of the year should be reviewed as

the audit objectives established and the procedures developed should address the risk(s)

that appear to be associated with the particular area.

The scope of the audit should be determined by the magnitude of identified audit risk.

Examples of Audit Objectives

To ascertain whether accounting for payroll is adequate and proper, including

bank account reconciliations.

To determine whether payroll preparation procedures are effective in preventing

the processing of unauthorized transactions.

To determine whether the entity is acquiring, protecting and using its resources

economically and efficiently.

4.1.4 Ensure subject is auditable

Before going any further, some thought should be given to the auditability of the subject.

There is no point in proceeding further if the auditor already knows there is no evidence

to audit or that access will be denied, such as in the case of confidential cabinet

documents. Government sometime imposes secrecy rules for national security. Lack of

evidence may in itself be an audit finding.

4.1.5 Determining the necessary resources to perform the audit

The resources required for each assignment should be estimated. Initially the budgeted

time and personnel to be assigned to the assignment would have been determined during

the preparation of the operational plan at the beginning of the financial year; however this

plan can be amended if required.

In estimating resources the following areas need to be addressed:

The complexity of the audit assignment needs to be considered.

Consideration of the knowledge, skills and disciplines available within the Unit.

This will assist in properly selecting persons for the assignment.

The training and the professional development needs of the unit should also be

considered as the assignment can serve as on-the-job training for the unit.

The preparation of the Time Sheets.

61

4.1.6 Communicate with the Relevant Stakeholders of the Audit

The planning process should be formalized. A part of the planning process requires the

auditor-in-charge to interact with all who need to know about the audit.

The communication process should be a two-way process. The first task in this process is

the identification of individuals with whom to communicate, and then discussing the

audit with these individuals.

A preparatory meeting should be scheduled with the individuals identified.

This will enhance the two-way process.

Topics to be discussed can include:

Planned audit objectives and scope of work

The timing of the audit. Stating intended start and completion dates, and reporting

time.

Introducing the internal auditors assigned to the assignment.

Producing a list of documents/files and other information that will be needed

during the course of the audit.

Communication process throughout the course of the audit.

Arrangement of interviews for the survey phase to obtain an understanding of the

systems in place.

Feedback from management, that is, any concerns or questions that management

may have.

Outlining the reporting, exit interviewing and follow-up processes.

This phase should be documented as minutes and filed in the working paper file.

NOTE: Surprise cash inspections may take a different format, at the discretion of the

Internal Auditor

4.1.7 Preliminary Survey

The primary steps in conducting the survey are:

Initial study - The internal auditor is able to review prior working papers and

audit findings, study organizational charts, review auditee facilities and gain some

familiarity with the audit area.

Documenting – The internal auditor can prepare useful reminder lists,

questionnaires for interviews and discussions to be conducted. All work done in

the survey phase must be documented. At this point the internal auditor can call

on the auditee for the initial preparatory meeting.

62

Meeting - During the meeting, the internal auditor explains to the auditee the

purpose of the audit and the approach that will be taken. The auditor will use this

meeting to explore the objectives, goals, and standards of the operation and its

inherent risks.

During the discussions with unit heads and supervisors, the auditor would seek to

gain an insight into the style of management exercised.

Gathering Information - The internal auditor would seek to gather information

about systems and processes by discussing activities with employees and

obtaining copies of instructions, procedures and other key documents.

He/she may have to document the current procedures by way of interviewing the

employees. This will also assist in planning the rest of the survey.

Observing – Throughout this survey phase, the internal auditor can identify the

purpose of the activity, observe the work flow, the rhythm of activity, and observe

how knowledgeably people seem to be functioning and whether employees seem

to be comfortable with what they are doing. This can highlight how well the

activities are being managed and people are being trained; also identify risks and

related controls.

Flowcharting – This can help and assist with detailed analysis of the operation

being audited.

Reporting – A professional survey often yields information on controls and risks

that may warrant written presentation of the survey findings. This may prompt

action to correct any inadequacies highlighted prior to the audit.

4.1.8 Developing the Audit Programme

The objective of writing the audit programme is to put together in one place the

programme that needs to be completed in order to accomplish the audit objectives.

The audit programme lists directions for the examination and evaluation of the

information needed to meet audit objectives within the scope of the audit assignment.

The audit programme is the link between the preliminary survey and the fieldwork, and

therefore should be prepared prior to the start of the audit work.

The Audit Programme should be designed to:

Document the internal auditor‟s procedures for collecting, analyzing, interpreting,

and documenting evidence and other information.

State the objectives of the audit assignment.

Set forth the scope and degree of testing required to achieve the audit objectives.

State the nature and extent of the testing required.

Be evidence of the audit work performed and completed.

63

The Audit programme should also include:

The period of review

Working paper references

The initial of the internal auditor who has completed the work

The date of completion

4.1.9 Define recipients of audit results

The Internal Auditor is responsible for determining how, when and to whom audit results

will be communicated.

The results of the audit should be transmitted to individuals responsible for taking action

on audit findings and recommendations. The audit report can be transmitted in total to

involved individuals, or those parts of the report applicable to specific individuals can be

sent to them for information and/or action.

Ultimately it is the responsibility of accounting officers to ensure action has been taken

on findings and recommendations. Therefore a copy of the report should be sent to them.

4.2 AUDIT EVIDENCE

The internal auditor should collect, analyse, interpret and document information to

support audit results.

The efficiency and effectiveness of the audit work depends on the manner in which

evidence is collected.

The internal auditor should have a sound understanding of:

The nature of evidence

What constitutes appropriate quality and quantity of evidence

Most appropriate methods of collecting evidence

4.2.1 Nature of Evidence

Audit evidence is the information internal auditors obtain through observing conditions,

interviewing people, and examining records. Audit evidence should provide a factual

basis for audit opinions, conclusions, and recommendations.

64

Audit evidence can be categorized:

Physical

Testimonial

Documentary

Analytical

Physical Evidence

This evidence is obtained by observing people, property and events. This evidence can

take the form of photographs, charts, maps, graphs, or other pictorial representations.

Graphic evidence is persuasive. All observations should, if possible, be supported by

documented examples.

Testimonial Evidence

This evidence takes the form of letters or statements in response to inquiries or

interviews. These forms of evidence standing alone are not conclusive; they should be

supported by documentation if possible. Auditee statements can be important leads not

always obtainable by independent audit testing.

Documentary Evidence

This is the most common form of audit evidence and it may be either external or internal.

External evidence includes:

Letters received by the auditee

Memoranda received by the auditee

Supplier‟s invoices

Leases

Contracts

Third party confirmation

Internal evidence (originates within the Auditee organization) includes:

Accounting records

Copies of outgoing correspondence

Work plans

Organization charts

Corporate plans

Budgets

Internal policies and procedures

65

Analytical Review

This type of evidence stems from analysis and verification.

The sources of such evidence are computations; comparisons with prescribed standards,

past operations, similar operations and laws or regulations; and reasoning.

There are many uses for evidence derived from analysis.

These can include:

Checking that data from different sources are consistent.

Conducting reconciliations.

Calculating averages to compare performance.

Ensuring interest payments are properly calculated.

Confirming payroll and other expenditures are accurate. Also ensure that they

comply with regulations, agreements and other controls for payments.

4.2.2 Attributes of Evidence

All evidence should stand the tests of sufficiency, relevance, reliability, and objectivity.

Sufficient

Evidence is sufficient if it is so factual, adequate, and convincing that it would lead a

reasonable (prudent) person to the same conclusions as the auditor. This, however, would

be a matter of judgment; but the judgment should be objective. Therefore, when samples

are used, the samples should be the result of objective, acceptable sampling methods. The

samples selected should provide reasonable assurance that they are representative of the

population from which they were selected.

Relevant

The relevance of audit evidence refers to the relationship of the information to its use and

applicability. The facts and opinions used to prove or disprove a finding must have a

logical, sensible relationship to that finding.

Evidence must support audit statements directly. Evidence used to support audit

conclusions should be timely, as the relevance of audit findings generally diminishes over

time.

Reliable

Reliable evidence is competent evidence. It should be the best evidence that is reasonably

obtainable. For example:

An original document is more reliable than a copy.

66

Direct evidence is superior to hearsay evidence.

A corroborated oral statement is more reliable than a statement

standing alone.

Objective

Evidence should be objective and free from bias. The auditor should guard against

assuming that the initial findings or assumptions are the only interpretation of the

situation. Whenever there are contradictions in the evidence collected, the auditor should

not reject certain evidence but rather seek an explanation as to why the evidence is not

consistent. Evidence should be evaluated objectively.

4.3 DOCUMENTATION AND WORKING PAPERS

The auditor‟s documentation in the form of audit files is referred to as working papers.

The audit files should be complete in themselves. The auditor must prepare papers that

are accurate, clear, organized, and professional.

There are generally two files maintained by the internal audit unit.

These are:

Current File – Working paper file

Permanent file

4.3.1 Working Papers

Working papers document the audit. They record the information obtained and the

analyses made during the audit process. Working papers are prepared from the time the

internal auditor first launches the assignment until he/she reviews corrective action and

close the audit assignment.

Working papers document the following steps in the audit process:

The plans for the audit, including the audit programme.

The examination and the evaluation of the adequacy and effectiveness of the

systems of internal control.

The audit procedures followed, the information obtained, and the conclusions

reached.

The supervisory reviews

The audit reports.

The follow-up of corrective action

See template and completed worksheets at Appendices 4.3.1A and 4.3.1B

67

4.3.2 Purpose of the working paper file

The working paper file serves the following purposes:

To provide support for audit reports. Well-structured working papers make it

easier for the auditor to transfer the material written during the audit to the

reports.

To record information obtained through the questioning of people, the review of

instructions and directives, the analysis of systems and processes and the

examination of transactions.

To identify and document audit findings.

To offer a basis for supervisory review. Reviews of documented work are more

productive than conversations between audit supervisor and auditor. The

supervisor‟s review also documented in the working papers is a means of control

over the audit.

To provide a means by which external auditors can evaluate the internal audit

work and then use it in their own assessment of the organization‟s system of

internal control.

Assist in planning subsequent audit assignments.

4.3.3 Documentation

Working papers should follow a reasonably consistent form and arrangement, not only on

the assignment level but also throughout the audit unit.

The Internal Auditor must:

Establish and maintain a suitable filing system

Maintain the standards for the formulation of the working paper files

Working papers may include the following information:

Planning documents and audit programs

Internal Control questionnaires (ICQ‟s), flowcharts, checklists, and the results of

control evaluations

Notes of interviews

Organization charts, policy and procedure statements, and job descriptions

Copies of important contracts and agreements

Letters of confirmation and representation

Tests and analyses of transactions.

Results of analytical review procedures.

Relevant audit correspondence.

Audit reports and management responses.

68

The working papers should be arranged in a manner that makes them parallel with the

audit program. That is, each distinct subject should be included in a separate segment of

the papers. This will ensure ready reference during and after the audit.

In general, internal auditors should ensure that working papers are neat, uniform,

understandable, relevant, complete, simple and logically arranged.

Each working paper sheet should generally contain:

A Heading. The heading should identify the organization‟s name, the function

being audited and the period of the audit. For example:

Ministry of XXXXX

Bank Reconciliation Statements

For the period April 1999- July 1999

The date of preparation and the auditor‟s initials. The date should indicate

when the work was complete. The auditors‟ initials should appear on each

worksheet.

The reference for the working papers. Working papers should be referenced.

The reference for each audit area is listed on the index. Working papers should be

kept in logical groupings. It is discouraging for the auditor and the reviewer of the

file to see a mass of working papers unnumbered and uncontrolled.

Tick marks and other symbols. These should be uniform throughout

the audit. They should be small and neatly placed and explained in

footnotes.

Sources of data. Sources should be clearly identified.

Cross-referencing. An independent reviewer should be able to retrace the

auditor‟s steps - from basic audit schedules to summaries and comments - without

needing to ask for additional information.

Therefore working papers should be properly cross-referenced to other related working

papers and to the audit program.

Each working paper file must begin with an index and the file jacket must be properly

labeled with the name of the organization, period of audit, volume number for the file (if

more than one volume) and the type of audit.

69

4.3.4 Supervisory Review

Supervision is a continuous process beginning with planning and ending with the

conclusion of the assignment. The best control over the work on which audit opinions are

based is supervisory review of all audit work. The Head of the Internal Auditor Unit is

responsible for providing appropriate audit supervision.

Such reviews should be evidenced on each sheet by the name or initials of the

supervisor/Head Internal Auditor and the date of the review. Review questions should be

written and included with the working papers. The working papers should not be

considered complete until the questions have been answered to the supervisor‟s

satisfaction.

In reviewing working papers the Internal Auditor/supervisor should be concerned that:

The planning of the audit assignment was properly executed before the fieldwork

began.

The audit programme was followed and specific instructions to auditors were

followed.

The working papers were accurate and reliable, that is, that they reflect adequate

work performed, and that they demonstrably support the audit findings.

Conclusions reached were reasonable, logical and valid.

There were no planned steps that have been omitted.

The standards on the compiling of working papers and other professional

standards have been adhered to.

Reviews with auditees were carried out and adequately recorded and that disputes

were resolved.

The Internal Auditor or the supervisor should review working papers as soon as possible

after they are completed. This will minimize disruption to the workflow and problems

will be resolved before reports are finalized and auditors reassigned.

4.3.5 Control and Retention of Working Papers

Control

The Head of the Internal Audit Unit must take direct interest in the control of auditor‟s

working papers.

Working papers are confidential and are the property of the Internal Audit Unit, and

should be kept under their control. Internal auditors should know exactly where the

papers and the audit files are at all times during the audit.

Audit files should not be made available to people who have no authority to have or use

them. However, this does not mean that internal auditors may not show their work to

auditees under certain circumstances. Also, access to working papers and reports may be

70

allowed to external auditors and to persons within the organization other than the persons

being audited. This must however be with the permission/approval of the Head of the

Internal Audit Unit. Where persons outside the organization seek access to the working

papers, the chief internal auditor must obtain approval from senior management and/or

legal counsel.

Retention

Working papers should be retained within the internal audit unit, seven (7) years after the

completion of the audit assignment.

However, where fraud and irregularities have been investigated and are awaiting legal

decision, the circumstances may demand retention beyond the seven-year period.

4.3.6 Permanent Files

This file includes information that will be of continuing importance to the audit activity.

The file should be flexible and useful. The file should be reviewed and updated as

necessary during the planning phase of the assignment. It should not be cluttered with

material that will not help the current audit or planning of future audits. When reviewed

the contents page should be initialed by the internal auditor to signify review.

The permanent file may include the following information:

Prior audit reports and responses

External audit reports

Post audit reviews

Copies of relevant government legislation, regulations, guidelines and other rules

affecting the operation.

Functions and objectives of the entity

Vision and Mission statements

Corporate plans

Operational plans of the entity

Organization charts

Lists of key personnel

Building layout and /or location of operation

Chart of Accounts

Flow-Charts of the accounting system and other systems within the organization

Summary of accounting principles used by the organization

Contracts and Leases

Important correspondence specifically related to the audit project

Basic directives or instructions applicable to specific activities

71

4.4 REPORTING

Reports are the internal auditors‟ opportunity to get management‟s undivided attention.

When management gives them an audience, internal auditors must never forget that they

are selling.

They must be consciously persuasive – by the techniques of motivation and by the style

they use and must highlight what is management-oriented. They must downplay or omit

what is immaterial and point skillfully to the need for taking action, describe the action,

and explain the penalties for avoiding action.

4.4.1 Purpose of the Report

The purpose of the Internal Audit report is to:

Inform- The report must tell management what is happening, by making them

aware of the results of the audit and also alerting them to recommendations made.

Persuade - Information presented to management must be of direct significance

to the organization or the area in which they are accountable. In the report, the

auditor must explain his findings pointing to the cause of the findings and the

effect of the findings on the section being audited and the organization.

Get results - The auditor should provide direction to management for decision

making by offering recommendations for improvement. Management must be

convinced of the benefits of implementing the recommendations so they will see

the need to take action. The benefit of taking action must exceed the cost of

implementation. The recommended action must be a constructive and practical

means of achieving the needed change.

4.4.2 Elements of a Good Report

The final stage of the audit process is the audit report. The effort made in carrying out the

fieldwork and the analysis of the results will be lost if the information is not properly

communicated in the audit report. There are certain qualities that make up a good report:

1. Accurate

It should be complete, factual and objective without incorrect grammar and spelling.

2. Clear

Reports should put into the mind of the reader exactly what is in the mind of the writer.

Technical jargon that is unfamiliar to the reader should be avoided.

72

3. Concise

Brief statements, condensed key ideas say more than long explanations that detail all

components of a thought.

4. Appropriate

Reports should relate to the reader‟s interest. It should have the proper emphasis and

present relevant and valid information.

5. Timely

The value of audit reports is directly related to the speed with which the information is

acted upon. The final, formal report is not designed to be a historical document but

should answer management‟s need for current information. The effect is therefore lost if

it is not timely.

4.4.3 Format of the Report

There are varying formats that can be used in writing the audit report.

Regardless of the outline used, the auditor must ensure that he is satisfying the needs of

the reader. The final report must always contain the following:

Table of Contents

Introduction

- Scope of the Audit

Conclusion and Recommendations

Findings

(a) Condition – The factual evidence as to what was found.

(b) Criteria – Standards, measures, or expectations used in making an

evaluation and/or verification.

(c) Cause – The reason for a difference between the criteria and the condition.

It should point to the underlying reason.

(d) Effect – The result of the condition or the potential results.

Management Response

Sometimes, it is a good idea to include an executive summary. Whenever possible it is

desirable to estimate achievable savings if recommendations are acted upon.

Interim Reports:

These are reports prepared before the completion of an assignment that may take a longer

time than budgeted and the report is a means by which management can be updated on

the status of the work. Interim reports can also be reports based on work done before the

assignment starts.

73

Report Distribution

Reporting arrangements, including the format and distribution of Internal Audit Reports

should be agreed with management. The Head of Internal Audit should ensure that

reports are sent to managers who have a direct responsibility for the unit or function

being audited and who have the authority to take action on the Internal Audit

recommendations. Internal Audit Reports are confidential documents and their

distribution should be restricted to those managers who need to know and the Permanent

Secretary or the Head of the Division.

Appendix 4.4.3A contains varying formats of internal audit reports.

The Head of the Internal Audit Unit should use his initiative in deciding on a format for

his report based on an analysis of the target audience.

4.5 INTERVIEWS

The internal auditor needs to possess strong interviewing skills. In many cases, success in

obtaining the breadth and depth of evidence required for the audit is highly dependent on

information collected through interviews.

Interviewing may be used for:

a) Identifying availability of evidence

b) Briefing management on the results of the audit

4.5.1 Identifying Availability of Evidence

It is almost impossible for the internal auditor to find and examine all possible

information about an operation. Also, the internal auditor does not have the time to seek

out all information.

The interviewing is the best means of determining:

Sources of information describing the operations (objectives, organization,

resources, activities, systems and procedures, outputs, outcomes);

Where to obtain the information; and

How to go about collecting the information.

Exploratory interviews must be supplemented with direct investigation by the internal

auditor such as file reviews, analysis of data and checking corroborating sources within,

or external to, the organization.

There are different ways of conducting the interview. In some situations, the internal

auditor must adhere strictly to predefined questions; other times, the interviewer has to

explore an area of questioning without any prepared set of questions (the unstructured

74

interview); but in most cases, the interview consists of a mix of prepared questions and

responsive questions.

The output of the interview is the information collected. Therefore, the auditor must be

able to produce sound, representative and accurate notes of the interview. It is difficult to

conduct an interview and at the same time take sufficient notes to be able to write-up

extensive and accurate interview notes later. If there are two or more auditors present,

they can agree who leads the discussions and who is responsible for producing the audit

notes afterwards.

4.5.2 Exit Interview

The Internal Auditor should normally meet with management to discuss the audit

findings at the completion of fieldwork for each Internal Audit assignment and the formal

written report should be presented to management as soon as possible thereafter.

Before issuing the final report, the Internal Auditor should normally discuss the contents

with the appropriate level of management and may submit a draft report to them, for

confirmation of factual accuracy.

4.6 FOLLOW-UP

The role of the auditor is not fulfilled unless, as a result of the audit, any deficiencies

identified have been corrected or at least addressed. The auditor needs to follow up on all

recommendations and major findings and conclusions to determine whether management

is properly addressing them.

It is management‟s responsibility to ensure that proper consideration is given to internal

audit reports. The internal auditor should ensure that appropriate arrangements are made

to determine whether action has been taken on internal audit recommendations or that

management has understood and assumed the risk of not taking action.

The manager responsible for the audited area should produce an action plan to address

the deficiencies and the internal auditor should review the status of management actions

against the plan.

Internal audit reports should remain open until the internal auditors consider the replies

satisfactory, that is, that action has been or will be taken to resolve the defects.

4.6.1 Timing of the Follow-up

The auditors should not be satisfied solely with the statement or description of corrective

action from the auditee. It may be necessary to return to the audit site or schedule interim

examinations within a given period to satisfy themselves that effective action has been

taken.

75

There is no simple rule as to when follow up should be conducted. The timing of the

follow up will depend, to a large extent, on the nature of the actions required to correct

deficiencies.

The timing of the follow up will depend on:

The seriousness of the deficiencies

Realistic timing of proposed action plans

Progress reports provided by management

How follow up can best fit into the Internal Audit Unit‟s schedule

of audit work.

Very serious deficiencies that can be corrected quickly should be followed up within a

short timeframe while the follow up of minor deficiencies may sometimes be postponed

until the next audit of the area.

The Internal Audit Unit should have a formal method of closing reports that have been

satisfactorily responded to. This could take the form of a memorandum or audit responses

to management comments in the final report.

76

Chapter 5

VALUE-FOR MONEY AUDITING

5.1 BACKGROUND

Value-for–money (VFM) auditing is a concept that was pioneered by the Swedish

National Audit Office and the Office of the Auditor General of Canada in the late 70‟s

and early 80‟s. It adds an operational dimension to the traditional compliance and

financial attest audits that had been known as regulatory auditing in the public sector.

While value-for-money auditing started in the Supreme Audit Institutions, it has spread

throughout the internal audit community, strengthening the traditional operational audit

practices of internal auditors.

5.2 ECONOMY, EFFICIENCY AND EFFECTIVENESS

Value-for-money auditing is concerned with assessing whether Government Departments

and agencies are managed with due regard to economy, efficiency and effectiveness.

These are known as the three E‟s in VFM auditing.

When a Ministry or Department exhibits “due regard”, it considers the factors of

economy and efficiency in a manner that is reasonable and appropriate in the

circumstances. Economy refers to the terms and condition under which an organization

acquires financial, human, physical and information resources.

Economy means getting the right amount of the right resource, at the right level of

quality, at the right time, in the right place, at the best price. Lack of economy in

acquiring resources could result in products or services costing more than they should, or

products or services of inappropriate quality, quantity or timeliness.

Indicators of potential economy issues or matters of significance include:

Financial resources such as overspent budgets, year end spending sprees, lapsed

funds, duplication of payments or overpayments;

Human resources issues such as high staff turnover, large number of grievances,

unclear or lack of job descriptions, duplication and overlaps of duties, high

absenteeism, too much overtime, excessive use of consultants;

Physical resource issues such as underused or unused equipment, excessive

maintenance costs, shortages and stock outs, inadequate or excess space, absence

of documented procedures and poor procurement processes;

Information technology issues such as a lack of IT strategy, proliferation of

equipment types, incompatibility of systems, high down time and maintenance

costs; inappropriate reports and poor security.

77

Efficiency refers to the relationship between the quantity and quality of the goods or

services produced and the resources used to produce them. An efficient operation

produces the maximum quantity and quality of output for any given resource inputs, or it

uses minimum inputs for a given quantity and quality of output.

Indicators of potential efficiency issues or matters of significance include backlog, idle

capacity, overtime, and complaints about service, lack of production targets, deadlines

and production standards, lack of performance measures and measurement procedures

and inadequate use of performance information to improve efficiency.

Effectiveness involves assessing the extent to which program objectives or intended

consequences are achieved. Where negative effects occur, effectiveness must be judged

on the balance of positive and negative consequences. Effectiveness measurement

includes assessing the procedure for measuring effectiveness and determining whether

the procedures are sufficient, reliable and that information is correctly reported.

Economy is obtaining the appropriate quality and quantity of goods and services

at the appropriate time and at the best prices.

Efficiency is achieving the best possible productive use of goods,

people and money.

Effectiveness is the extent to which programmes are actually

accomplishing what they were intended to do.

VFM auditing is directed at examining the following matters:

financial management and accounting for public money;

safeguarding and control over public property;

assessment, collection and allocation of revenues;

compliance with authority;

waste and extravagance

due regard to economy;

due regard to efficiency; and

whether or not there are appropriate procedures in place for measuring and

reporting program effectiveness.

5.3 APPROACHES TO VFM AUDITING

The keys to the success of a VFM audit are clearly defined objectives, scope, methods of

evaluation and a participatory approach to the audit.

The focus of a VFM audit will depend on the objectives of the particular audit. An audit

could be focused on any one of the above matters or on a combination of them.

There is no single right way to focus an audit. It takes considerable judgment to target the

best issues. It very much depends on the objectives set for the audit. This is done in the

planning phase of a VFM audit.

78

Basically there are two ways to focus an audit:

A Procedures Or Process-Oriented Approach or

A Results-Oriented Approach.

Over the last two decades VFM auditing has moved away from process type auditing and

become more results oriented. In some cases a combination of the two may be the most

appropriate way to complete the audit.

5.3.1 Procedures or Process-Oriented Approach

A procedures or process-oriented approach starts by examining the relevant activities of

an organization, programme or function and the related management practices to identify

possible strengths and weaknesses, particularly those that have an impact on VFM issues.

Criteria are developed and used to assess the activities or procedures.

These criteria are derived from policies, directives, manuals etc. or accepted management

practices in other similar situations.

In each case the audit objective in the broadest sense, is to assess the extent to which

activities, systems and procedures that should be implemented are in fact, in place. The

auditor must determine if the systems and procedures are well designed or properly

functioning. Where the auditor identifies significant deficiencies, he must examine the

outputs or results of weaknesses with a view to identify causes and effects.

5.3.2 Results-Oriented Approach

A results-oriented approach to VFM auditing proceeds in the opposite direction. It starts

with examining programme outputs or program delivery. The auditor attempts to identify

problems in the outputs or programme delivery and the underlying reasons for the

problem. When negatives are observed the auditor looks for root causes.

In doing so the auditor may revert to examining systems and procedures to determine

why weaknesses persist. Once the weakness is identified, the auditor can report his

finding and recommend corrective action. Benefits from corrective actions must clearly

outweigh the cost of the corrective action.

If no problem is apparent, the auditor can write a positive observation but most seldom do

as a positive observation may be seen as a blanket blessing on a small sample. Never the

less, when auditors are confident that appropriate results are being achieved, they should

state so. Auditing is not just finding negatives. Positives should be reported too.

79

5.4 THE AUDIT PROCESS

The procedures/process approach and the results-oriented approach are complementary.

Usually auditors employ a combination of the two.

Both approaches employ similar phases or stages, which are:

the planning phase;

the examining and evaluating information phase;

the reporting phase; and

the follow-up phase

5.4.1 The Planning Phase

After the area for audit has been chosen, decisions need to be made about:

what and how much to audit;

what audit approaches, methodology and technology to employ to assess

performance; and

what staff skills, disciplines and experience to assign to the audit.

The planning phase takes quite a lot of time as it allows the audit team to communicate

its understanding of the entity, its operations outputs and results. It also allows the auditor

to gain an understanding of the problems in the entity. The process is usually divided into

two stages:

1. The Overview Stage

During this phase the auditor will:

Gather background information on the audit area.

Understand the organization‟s business, objectives, mission, etc.

Interview senior management.

Scope the audit based on

- auditor‟s knowledge of the area‟s relative materiality

- the operational risk presented

Form questions to be answered in the next phase.

The auditor will prepare an overview report that contains a brief description of the audit

entity, sources of overview information, lines of audit enquiry to be explored during the

examination stage and reasons for selecting the lines of enquiry or excluding them.

2. Lines of Inquiry

Usually the Internal Audit Unit does not have the resources or does not need to examine

all aspects of a programme. Therefore, the auditor has to decide what aspects of the

80

management framework and activities of the programme(s) should be examined. This is

known as the lines of inquiry.

Criteria for each line of enquiry will be developed and audit risks will be assessed to

develop the audit strategy. The overview report should also identify the audit objectives

for the audit, an audit plan, the key assignments and tasks, the human resources needed

and a time budget and schedule. Potential savings should also be identified.

3. The Survey Stage

The survey stage of the planning phase follows up on previous audit recommendations,

confirms the specified audit criteria, conducts a preliminary assessment, identifies matters

of significance and finalizes the audit scope and plan. During the survey stage the auditor

should refine the focus and procedures to satisfy the audit objectives.

He should determine if:

the financial information developed for the activity is appropriate for senior

management;

the financial information can be related to program results information to

provide management with the information it needs for operating the program

and decision making;

the financial management controls play an appropriate role in regular

monitoring of operations, efficiency, compliance and accountability;

the financial management information adequately supports performance

measurement, analysis and feedback to make managers aware of progress

toward intended results;

regular assessments are made of quality and levels of service;

the financial management systems assist managers in planning, controlling

and accounting for the use of resources;

there are financial controls in place to ensure that expenditures are made for

purposes intended that are not wasteful or extravagant and do not exceed the

levels approved in the budget;

the Ministry or Department has an accurate listing of all assets;

there are appropriate controls over cash, receivables inventories and other

assets;

financial managers have been given authority and responsibility

commensurate with sound financial management practices; and

financial resources and authorities have been assigned to managers

commensurate with expected results and financial accountability

relationships are clearly defined.

5.4.2 The Examination Phase

The examination phase implements the audit plan developed in the planning phase. The

auditor pursues the lines of enquiry, documenting findings as he/she proceeds. The record

81

of findings forms the basis of the audit report and management letters. Following the

lines of enquiry and using the criteria developed in the planning phase, the auditor

compares actual conditions to the theoretical criteria and explores weaknesses and

deficiencies revealed by the comparison process. He/she gathers supportive evidence and

documents the evidence to assist in arriving at conclusions and recommendations.

The Internal Auditor should review the audit evidence gathered and ensure that the audit

working papers are complete and that the findings are relevant and significant enough to

report to a Permanent Secretary or Head of Department. He/she should also estimate what

savings are achievable if management implements the auditor‟s recommendations.

The major techniques for gathering and selecting evidence are analysis, interviews,

replications, physical observation, documentation, confirmation and systems testing

Evidence can be acquired by:

inspecting documentation such as correspondence, memoranda, minutes, reports

etc.;

analysis of comparisons of figures, operating results, trends, ratios, etc.;

interviews, surveys and inquiries;

replication by walking through or repeating operational steps;

physical observation and inspection. Taking photos provide valuable evidence;

confirmation from independent third parties;

conducting systems tests, usually on a sampling basis;

statistical sampling.

5.4.3 The Reporting Phase

The Reporting Phase is the drafting of the audit report and the management letter. The

audit report should contain the scope of the examination; observations of matters of

significance; recommendations; and potential savings achievable.

This report should be cleared by the auditee and amendments made if the auditee can

demonstrate that the audit report is flawed. The final version of the report can include

management‟s responses.

Conclusions and Recommendations

Judgment, communication skills and experience are the key attributes of a good VFM

auditor to enable him/her to report conclusions and recommendations. Conclusions are

drawn from assessments of the audit findings and their possible causes and effects.

The conclusion may be negative or positive. Wherever justified, positive observations

should be made to provide a fair and balanced report. For negative observations the

auditor drafts recommendations to guide management into corrective action.

82

When drawing up recommendations the auditor should consider:

circumstance that help or hinder the organisation in meeting criteria;

alternative courses for remedial action;

effects and savings that may arise if the recommendations are adopted; and

the feasibility and cost of adopting the recommendations

Before the conclusions and recommendations are finalized, they should be reviewed with

the appropriate level of management and responses should be obtained in writing.

5.4.4 The Follow-up Phase

The Follow-up Phase is done after management has had sufficient time to respond to the

auditor‟s recommendations. Actual achievable savings are noted along with observations

where the management has not responded appropriately to the auditor‟s

recommendations.

5.5 GENERIC QUESTIONS FOR SCOPING THE AUDIT

Management Direction

To what extent is there harmony between the governing body and management

with respect to the strategic directions and priorities they see for the

organisation/program?

To what extent does staff know what is expected of them of them and how this

supports the overall mission of the organisation?

To what extent does staff have the authority and tools needed to make decisions

and take action in accordance with their responsibilities?

To what extent does staff understand the limits of their authority and that matters

that transcend these limits are referred to the appropriate person?

To what extent are programs, operational and work plans in place, linked, and

focus on the issues most pertinent to the decision-making and accountability

interests of those responsible?

Do the organizations‟s planning and communication practices foster the above?

Relevance

What is the nature and extent of the problems, conditions, demands and needs to

which the program is directed?

To what extent have these problems, conditions, demands and needs changed over

time?

To what extent does the program continue to make sense given prevailing

government policy and corporate and community philosophies?

83

Appropriateness

To what extent is each of the program‟s major activities necessary to the

accomplishment of the stated objectives?

To what extent are the program products and services designed and delivered in a

manner that best responds to the nature and extent of the problems, conditions,

demands and needs?

To what extent are the program products and services consistent with prevailing

standards of practice, ethics etc.?

To what extent is the overall level and distribution of effort represented by the

program‟s products and services sufficient in relation to stated objectives and

identified needs? Do the level and distribution of effort exceed legitimate

requirements?

Achievement of Intended Results

To what extent does the program‟s achievements in key result areas meet

expectations in terms of:

- the problems, conditions, demands and needs concerned;

- established performance targets;

- past organizational performance;

- the performance of comparable organizations or programs.

To what extent is the program meeting its own prescribed standards of

performance?

Are the program‟s objectives sufficiently challenging?

Acceptance

What is the nature of the expectations of various stakeholders (e.g. taxpayers) and

the basis for their expectations?

To what extent have stakeholders indicated acceptance of or satisfaction with the

program/services and what is their level of acceptance or satisfaction?

Secondary Impacts

What are the significant unintended effects of the program (both positive and

negative) on the clients, other key stakeholders, related organizations and

programs and/or the community at large?

Do any of the secondary impacts significantly impede or work at cross purposes

to the organization‟s stated objectives?

In what way, do the secondary impacts call into question the value attached to the

primary program objectives?

84

Responsiveness

To what extent does the program have networks, mechanisms, and processes in

place to identify and assess possible consequences of relevant trends and events in

its environment?

To what extent has the program‟s demonstrated responsiveness or its lack thereof

in relation to trends and events?

To what extent does the program‟s responsiveness compare favourably with

similar institutions in relation to the same trends and events?

Financial Results

How do cost and revenue ratios compare to those of similar organizations?

To what extent is the program‟s overall financial position viable?

Does the program have a history of conducting its operations within approved

budgets and funding levels?

Are the books of account, records, and financial management control and

information systems in accordance with sound financial policies and procedures?

Working Environment

To what extent does the program have the number, type, and mix of staff needed

to deliver the program/services?

Do staff job descriptions appropriately reflect work responsibilities?

To what extent does staff have the ability and opportunity to provide services to

clients in a way that is valued by clients?

Does the staff have adequate facilities and equipment to complete their tasks?

Is the organization providing a safe environment for employees and clients?

Are staff members performing to stated and agreed expectations, and are they

receiving appropriate recognition for their efforts?

Is the program making adequate investments in relation to job-and career

satisfaction they derive, and the program‟s management practices?

Does the program have an appropriate human resources management plan for

enabling the recruitment, retention, development and replenishment of well-

qualified people?

Protection of Assets

To what extent has the organisation identified its key assets and assessed their risk

of loss and/or impairment?

To what extent does the organisation have strategies in place that adequately

respond to the nature and level of risk assessed?

85

To what extent do these strategies and their performance compare to industry

practice and standards, as well as comply with external requirements (for

example, legal, regulatory, accreditation, and so on)?

Monitoring and Reporting

To what extent do Cabinet, management, and key users receive complete,

credible, and fair performance information that satisfies their decision-making and

accountability requirements?

Are the right things being reported at the right time and in the appropriate level of

detail and aggregation to achieve accountability?

Are the monitoring and reporting systems and processes cost-effective?

Does the program have an appropriate human resources management plan for

enabling the recruitment, retention, development and replenishment of well-

qualified people?

Protection of Assets

To what extent has the organisation identified its key assets and assessed their risk

of loss and/or impairment?

To what extent does the organisation have strategies in place that adequately

respond to the nature and level of risk assessed?

To what extent do these strategies and their performance compare to industry

practice and standards, as well as comply with external requirements (for

example, legal, regulatory, accreditation, and so on)?

Monitoring and Reporting

To what extent do Cabinet, management, and key users receive complete,

credible, and fair performance information that satisfies their decision-making and

accountability requirements?

Are the right things being reported at the right time and in the appropriate level of

detail and aggregation to achieve accountability?

Are the monitoring and reporting systems and processes cost-effective?

86

CHAPTER 6

INFORMATION TECHNOLOGY AUDIT

6.1 BACKGROUND

The Financial Regulations to the Exchequer and Audit Act and the Financial Instructions

1965 have designated the management of all Ministries and Departments as stewards of

the Government‟s assets and resources. As such, there is an implicit requirement for them

to ensure that a proper system of internal controls is in place.

A key element in determining whether management is fulfilling that mandate is to get the

information necessary to assess performance. In order to achieve this, information

technology is being employed in the various Government Ministries and Departments.

Heads of Ministries and Departments are therefore required to provide assurance that the

type of information that is processed is accurate, timely, useful and relevant.

There is an increasing dependence on information systems to carry out the ministries‟ and

departments‟ operations and to process, maintain and report essential information.

Consequently, information systems are becoming the lifeblood of the public sector. No

longer are computer systems merely recording business transactions but are also

contributing to the achievements of the various objectives and goals of the ministries and

departments.

An information system is not just a computer. It can be complex and have many

components that are integrated to make a business solution. Assurances about an

information system can be obtained only if all the components are evaluated and secured.

The proverbial weakest link is the total strength of the chain. Therefore the reliability of

computerized data and of the systems that process, maintain and report these data should

be a major concern for all including auditors.

The internal audit functions are required to undertake regular monitoring and review of

key controls and procedures, and because of the reliance that may be placed on

information technology, it is an area that should be audited.

Information Technology (IT) Audit (a subset of the audit process) is the process of

collecting and evaluating evidence to determine whether a computer system (information

system) safeguards assets, maintains data integrity, achieves organisational goals

effectively and consumes resources efficiently.

In order to reduce the risk of loss due to errors, fraud, other illegal acts and disasters or

incidents, an internal auditor may be required to evaluate the reliability of computer-

generated data supporting the financial system or evaluate the adequacy of controls in an

information system.

87

The purpose of IT audit is to review and provide feedback, assurances and

recommendations to management about the effectiveness, efficiency, availability,

confidentiality and integrity of the system.

The major elements of the IT Audit can be broadly classified:

Physical and environmental review – This includes physical security, power

supply, air conditioning, humidity and other environmental factors.

System administration review – This includes security review of the operating

systems, database management systems, all administration procedures and

compliance.

Application software review – The business application could be payroll (e.g.

Government Payments System GPS), Integrated Financial Management

Information Systems (e.g. IFMIS), Integrated Human Resource Information

System (e.g. IHRiS) among others. Review of such application software includes

access control and authorizations, validations, error and exception handling,

business process flows within the application software and complementary

manual controls and procedures

Additionally, a review of the system development life cycle (SDLC) for information

systems being developed and implemented should also be conducted.

Network security review – Review of internal and external connections to the

system, perimeter security, firewall review, router access control lists, port

scanning and intrusion detection are some typical areas of coverage.

Business continuity review – This includes existence and maintenance of fault

tolerant and redundant hardware, backup procedures and storage, and

documented and tested disaster recovery/business continuity plan.

Data integrity review – The purpose of this is scrutiny of live data to verify

adequacy of controls and impact of weaknesses, as noticed from any of the above

reviews. Such substantive testing can be done using generalized audit software

(e.g. computer assisted audit techniques- CAATs).

6.2 COMPUTER-ASSISTED AUDIT TECHNIQUES (CAATS)

6.2.1 Concept

Computer Assisted Audit Techniques are powerful and important tools for the auditor in

performing audits. With the use of CAATs, the auditor can inspect records and perform

tests on the records almost instantaneously, which would consume extensive audit effort

if performed manually. They include many types of tools and techniques such as

88

generalized audit software, utility software, test data, application software, tracing and

mapping and audit expert systems.

CAATs may be used in performing various audit procedures including: -

Test of detail transactions and balances;

Analytical review procedures;

Compliance test of general and application controls;

Penetration testing.

6.2.2 Planning

When planning the audit, the auditor should consider an appropriate combination of

manual techniques and CAATs. In determining whether to use CAATs, the factors to be

considered include: -

Computer knowledge, expertise, and experience of the auditor;

Availability of suitable CAATs and Information Systems (IS) facilities;

Efficiency and effectiveness of using CAATs over manual techniques.

Time constraints;

Integrity of the information systems and IT environment;

Level of audit risk.

The major steps to be undertaken by the auditor in preparing for the application of the

selected CAATs are: -

Set the audit objectives. Identify what is to be examined and tested;

Determine the accessibility and availability of the organizations IS facilities

programs/system and data;

Define the procedures to be undertaken e.g. statistical sampling, recalculation,

confirmation etc;

Define output requirements;

Determine resource requirements i.e. personnel, CAATs, processing environment

(e.g. organization‟s IS facilities or audit IS facilities);

Obtain access to the organization‟s IS facilities, programs/system data including

file definitions. Understand the operating system and characteristics of the data;

Document CAATs to be used, including objectives, high level flowcharts and run

instructions;

Arrange for the software to access the operating data files or for the required data

to be downloaded;

Apply the CAAT data analysis and tests; and

Follow up on anomalies and particular transactions to determine explanations for

the results obtained.

89

6.3 THE ENVIRONMENT IN WHICH CAATS OPERATE

6.3.1 Understanding of the System

The auditor should obtain a clear understanding of the systems to be examined.

This understanding should include:

Processing procedures and practices;

Internal controls (both existing and desirable and what tests are needed to

determine whether the existing are operating properly);

Control weaknesses (observed and to be tested);

Security and other environmental considerations (such as back-up procedures,

roles and responsibilities, operating breakdowns, access controls, etc.);

Other issues relating to the particular application.

6.3.2 Characteristics of the Data

The auditor should examine documentation about the systems and/or develop means of

determining the characteristics of the systems.

These should include:

Flow charts of the process;

The internal controls in place;

Characteristics of the files / records / fields in the data;

Processing logic built into the software; and

Any anomalies, such as changes to the database, data gaps, coding problems or

changes in definitions.

6.3.3 Audit Objectives

Although normally, the use of CAATs involves some degree of exploration, the auditor

should initially define, what is to be achieved through the use of the CAATs.

Audit objectives should be defined. Examples of these could be:

Correlate vouchers with purchase order amounts and total contract amounts to

provide assurances that the expenditures have been properly authorized.

Verify the accuracy of financial reports by analysis of transactions and thus

provide assurances on the reliability of the financial statements.

Compare expenditures against budget and confirm that no expenditures are in

excess of budget or out of wrong budget categories.

Check for any duplicate purchase orders or receipts without purchase orders.

Compare overtime hours with normal working hours over a period of time to

identify any overtime abuse.

90

On a sample basis, confirm no misuse of funds or excessive expenditures.

Determine whether internal controls, such as data entry controls, are operating

effectively.

6.3.4 Audit Scope

The auditor has to decide also what audit coverage to provide. The auditor may decide to

examine the total database, or restrict examination to particular areas of the organization

or particular functions. Further, the auditor has to decide what period, or periods to

examine.

The auditor may decide to examine just the current year, or go back three or four years. If

the auditor wishes to determine if there is some pattern of expenditure/income, the total

data within the period selected can be looked at as a whole. Alternatively, the auditor

may want to take discrete periods and compare them with other periods.

6.4 DATA ACCESS

The auditor may require assistance in obtaining access to the data. Data files such as

detailed transaction files are often only retained for a short period. Consequently, the

auditor should make arrangements for the retention of the data covering the appropriate

time frame. Access to the organization‟s IS facilities programs/system and data should be

arranged for well in advance of the needed time period in order to minimize the effect on

the organization‟s production environment. The auditor must be satisfied that the data

examined is a true, accurate and complete set of data utilized in the management of the

organisation under audit.

The CAATs may be applied to the live production data (on-line) or alternatively, a copy

of the required data is made on which the CAATs can be applied off-line. When the

CAAT is operated on-line, there must be assurances that the CAAT has full access to all

data and is not subject to any access controls.

The auditor should assess the effect that changes to the on-line programs may have on the

use of the CAATs. In doing so, the auditor should consider the effect of these changes on

the integrity and usefulness of the CAATs, as well as the integrity of the

programs/systems and data used by the auditor.

6.5 APPLICATION OF CAATS

Before the auditor can perform tests on the data, he/she needs to have input file

definitions, used to describe the record layout of the data file, in order to tell the software

how to read the data in the file.

The first concern is to establish the validity of the data, either on-line or downloaded. The

auditor should conduct various tests to determine number of records, totals, etc. and

wherever possible compare these with reports produced by the programs/systems.

91

The auditor should also ensure that the electronic files examined are for the period under

examination and in line with the understanding of the data being examined. For example,

a test should be performed to see if any transactions in the data file fall outside of the

period under examination.

The auditor should perform tests to confirm that particular controls are working. For

example if the system is meant to have data entry controls such as not accepting a record

unless there is a $ value in a particular field, the auditor can test to see if any records exist

with “0” or blank in the field which is meant to have a “$ value”.

Data analysis includes:

Listing transactions in chronological order or, in increasing or decreasing order of

magnitude for particular fields;

Grouping transactions according to various criteria, such as those with the same

date, the same supplier/recipient/whatever, or combination of characteristics, such

as same supplier with same date or same value of payment;

Searching for fields with values greater than some figure (for example, all

employees with a particular classification level that have received payments

greater than the usual payment for the period);

Calculating aggregate figures for a particular period;

Conducting various calculations on the data, such as average payment for the

acquisition for a particular product; or

Conducting follow up analysis on particular sets of transactions selected on the

basis of an initial cut.

The use of the CAATs should be controlled by the auditor to provide reasonable

assurance that the audit objectives and detailed specifications of the CAATs have been

met.

6.6 FOLLOW UP INVESTIGATION

The auditor has to decide which items identified by the tests should be followed up for

detailed examination. In some cases, a sample can be taken for follow up. The

explanation for all material items should be determined if possible. On the other hand,

when the auditor discovers an underlying explanation on the examination of an initial few

items within a group of items, further audit may not be needed on that group of items.

Explanations for the items discovered may be a systemic problem / pattern or an

individual error/anomaly. Explanations may be discovered very easily and quickly or

may consume extensive audit effort. The auditor needs to apply judgment on how many

items should be investigated in detail and how much audit effort should be applied.

92

6.7 WORKING PAPERS

The step-by-step CAATs process should be sufficiently documented to provide adequate

audit evidence. The audit work paper should contain sufficient documentation to describe

the CAATs application, including the details set out:

Planning of the audit

CAATs objective

CAATs to be used

Controls to be exercised

Staffing and timing

Execution of the audit

CAATs preparation and testing procedures and control

Details of the tests performed by the CAATs

Details of inputs (e.g. data used file layouts) processing (e.g. CAATs high level

flowcharts, logic) and outputs (e.g. log files, reports)

Audit Evidence

Output produced

Description of the audit work performed on the output

Audit findings

Audit conclusions

Audit recommendations

6.8 REPORTING

The objectives, scope and methodology section of the report should contain a clear

description of the CAATs used. This description should not be too detailed but should

provide a good review for the reader. The description of the CAATs used should also be

included in the body of the report where the specific finding relating to the use of the

CAATs is discussed. If the description of the CAATs used is applicable to several

findings, or is too detailed, it should be discussed briefly in the objectives, scope and

methodology section of the report and a more detailed description be placed in an

appendix to the report.

See Appendix 6.8.A for Recommended uses of CAATs.

93

Chapter 7

Role of Audit Committee

The Institute of Chartered Accountants of Trinidad and Tobago (ICATT) sought to

provide guidance with respect to the role that Audit Committees play in organizations.

Appendix 7 provides the material compiled and distributed by ICATT at a seminar on

Audit Committees. This material should provide sufficient knowledge on the importance

of having an Audit Committee as part of an organization.

94

GLOSSARY

Glossary

Accountability: Relates to the structure of: conferred responsibilities; the authority

delegated to carry out those responsibilities; and reporting on the discharge of those

responsibilities. Proper accountability is required to hold individuals accountable for

performance, in achieving intended results and avoiding loss, waste or ineffectiveness.

.

Action plan: In response to an audit report, the responsible manager(s) should produce

an action plan. This should address all recommendations and major findings and

conclusions; and provide proposed corrective action for each deficiency, with the

individual responsible for the action and a schedule for implementation. The action plan

and progress reports against the plan should be tabled with the Audit Committee. The

auditor should review these reports during any audit follow up work.

Application System: An integrated set of computer programs designed to serve a

particular function that has specific input, processing and output activities (e.g. general

ledger, manufacturing resource planning, human resource management).

Area of Significance: Large or important cost or non-cost (e.g.: backlog, idle capacity,

overtime and complaints about service) item or event in its own particular context. To be

distinguished from material, which relates to its size or importance relative to the

organization as whole.

Audit Charter: The charter of the internal audit activity is a formal written document

that defines the activity‟s purpose, authority and responsibility. The charter should (a)

establish the internal audit activity‟s position within the organization; (b) authorise access

to records, personnel and physical properties relevant to the performance of engagements;

and (c) define the scope of the internal audit activities. (IIA Standards)

Audit Evidence: The information obtained by internal auditors to arrive at and support

their findings and recommendations.

95

Audit Expert System: Expert or decision support systems that can be used to assist the

auditor in the decision-making process by automating the knowledge of experts in the

field. The technique includes automated risk analysis, system software and control

objectives software packages.

Audit objectives: Broad statements developed by internal auditors and define intended

audit accomplishments. (IIA Standards)

Audit Procedures: Tasks the internal auditor undertakes for collecting, analyzing,

interpreting, and documenting information during an audit. (IIA Standards)

Audit Plan: A high level description of the audit work to the performed in a certain

period of time (ordinarily a year). It include the areas to the be audited, the type of work

planned, the high level objective and scope of the work and other topics like budget,

resource allocation, schedule dates, types of report and its intended audience and other

general aspects of the work.

Audit Programme: A document, which lists the audit procedures to be followed during

an audit. The audit programme also states the objectives of the audit. (IIA Standards)

Audit Scope: Areas examined, or to be examined, during the audit – locations, functions

and activities, aspects of performance, systems and procedures, audit methods and tests.

Cause: is the reason for the difference between the expected and the actual conditions. -

Why the differences exist. (IIA Standards)

Cause and Effect Analysis: A process of identifying, or judging, the underlying cause of

an observation and the possible, or actual, effect of the weakness observed.

Compensating Controls: Management control framework (also referred to as

Management Framework): Additional procedures designed to reduce the risk of errors or

irregularities. Controls that compensate for the increased risk where adequate resources

may not exist to eliminate or prevent errors from occurring.

96

Compliance: The ability to reasonably ensure conformity and adherence to organisation

policies, plans, procedures, laws, regulations, and contracts. (IIA Standards)

Compliance Testing: Testing designed to establish the controls established by

management are operating as intended and are effective.

Conclusion (Opinions): The internal auditor‟s evaluations of the effects of the findings

on the activities reviewed. Conclusions usually put the findings in perspective based upon

their overall implications. (IIA Standards)

Condition: The factual evidence, which the internal auditor found in the course of the

examination. - What does exist (IIA Standards)

Control: Any action taken by management to enhance the likelihood that established

objectives and goals will be achieved. Management plans, organizes and directs the

performance of sufficient actions to provide reasonable assurance that objectives and

goals will be achieved. Thus, control is the result of proper planning, organizing and

directing by management. (IIA Standards)

Control Environment: The attitude and actions of the board and management regarding

the significance of control within the organization. The control environment provides the

discipline and structure for the achievement of the primary objectives of the system of

internal control.

The control environment includes the following elements: (IIA Standards)

Management‟s philosophy and operating style

Assignment of authority and responsibility

Control Objective: The objectives of controls, derived from the management objectives

of the system, used by the auditor as criteria against which to appraise the adequacy of

internal controls.

97

Control Risk: Risk of error or loss not prevented or detected by the internal control

structure.

Corporate Plan: A three-year strategic plan to be produced by every

Ministry/Department/Agency, and sub-organizations, within the GOJ.

Criteria: The standards, measures, or expectations used in making an evaluation and/or

verification. - What should exist (IIA Standards)

Detection Risk: A risk of major error or loss going undetected despite controls and audit

effort. Also referred to as “audit risk”.

Effect (in auditing): The result or impact of a weakness (finding) not being corrected or

addressed (in government programmes) the result, outcome or impact of a government

programme / the result of government activities in pursuing programme objectives – there

can be both intended and unintended effects and both positive and negative effects

Efficiency: The relationship between goods or services produced (outputs) and the set of

resources used to produce them (inputs). Efficiency is measured in terms of outputs

divided by inputs. Efficiency can be increased by producing more outputs for a given

amount of inputs or by producing the same amount of outputs while reducing the amount

of inputs.

Entity: In this Manual, the “entity” refers to the organisation subject to audit. Other

expressions could be “audit entity” or “auditee”.

Findings: Any observation, or deduction, that the auditor determines worthy of reporting

– derived by judgment, comparison of situation against a criterion or standard,

assessment of significance, consideration of risk, assessment of good management

practice.

General Audit Software: A computer program or series of programs designed to

perform certain automated functions. The functions include reading computer files,

selecting data, manipulating data, sorting data, summarizing data, performing

calculations, selecting samples and printing reports or letters in a format specified by the

auditor. This technique includes software acquired or written for audit purposes and

software embedded in production systems.

98

High-level flow chart (also called first-level or top-down flow chart):

A graphical representation of how a process works, showing the sequence of those major

steps within the process. It also includes the intermediate outputs of each step (the

product or service produced) and the sub-steps involved. Such a flow chart offers a basic

picture of the process, illustrates a “bird‟s eye view” of the process and identifies the

changes taking place within the process.

Indicators of Risk: Situations, or results of enquiry that suggest the existence of a risk

Inherent Risk: Susceptibility to error or loss unrelated to internal control system.

Internal Audit: An independent appraisal within a department, which operates as a

service to management by measuring and evaluating the effectiveness of the internal

control system.

Internal controls: Policies and procedures established by management to provide as far

as practical reasonable assurance that the entity‟s objectives are being met.

Internal Control Questionnaire: A list of questions, related to control objectives, used

by internal auditors to assist in the evaluation of the internal control system.

Internal Control System: The whole network of systems established in an organisation

to ensure that its objectives are achieved in the most efficient and economic manner.

Level of Service: The speed with which a customer is served is referred to as the “level

of service”.

Management Framework: Also referred to as the Management Control Framework

consists of Planning; Organizing; Controlling; Directing (or Leading); and

Communicating (or Reporting and Evaluating). It should also include the Management of

Resources - human, financial, information and materiel resources.

Materiality: An expression of relative significance or importance of a particular matter

in the context of the organisation as whole.

Outcomes: What happens as a result of the outputs produced or activities performed.

Other similar terms include “impacts” and “results”. For example, if the government

99

provides loans to companies (“outputs” of the programme), the “outcome” is what

happens to the companies, or their environment: do their sales increase more rapidly than

might have occurred without the loan; did any go bankrupt, despite the loan; or other

outcomes such as increased employment.

Penetration Testing: An auditor may perform penetration testing to determine if he/she

can break into an organization‟s security defense system (e.g. hacking into a computer

system). By performing penetration testing the auditor is able to identify possible

weaknesses within the various systems or programs and consequently report to

management so that corrective action. The aim of this exercise is to prevent hackers or

unauthorized persons from compromising the systems and exploiting, for example,

proprietary information.

Preliminary Survey: An initial review of an audit area: to gain an understanding of the

business; to identify the major resources, activities, outputs and outcomes; to determine

the internal controls; and to identify the major risks. The preliminary survey is conducted

through an examination of key documents and by interviewing one or more managers of

the area to be examined. (See also Survey.)

Recommendations: Actions the internal auditor believes necessary to correct existing

conditions or improve conditions. (IIA Standards)

Responsive questions: (May not be the appropriate term.) Questions generated in

response to answers to previous questions; and therefore not normally questions

developed prior to the interview.

Review: The examination by an auditor, programme evaluator, consultant or

management team, to assess the performance of an area of the entity. It is not normally as

structured as an audit, does not demand the use of standards or criteria, and places more

emphasis on fast reporting than on the extensiveness of evidence and level of assurance.

Risk: The probability of an occurrence that prevents or hinders an entity achieving its

objectives or meeting its legal requirements. (See also: inherent risk, control risk and

detection risk.)

Risk Assessment: A process of identifying risks, estimating both the likelihood and

potential magnitude of the impact of the risk and evaluating the controls that reduce the

occurrence of risks.

Scope: The extent or range of an audit or the internal audit function

100

.

Significant Audit Findings: Those conditions, which, in the judgment of the Head of

Internal Audit, could adversely affect the organisation. (Based on IIA Standards)

Substantive Testing: Testing of transactions and other data to enable a conclusion to be

reached on the completeness, accuracy and validity of data tested and on the effect of

weaknesses in internal controls.

Survey (also referred to as an Audit Survey): A review of an audit area: to gain an

understanding of the business; to examine the major resources, activities, outputs and

outcomes; to determine the key areas of potential significance; to assess the internal

controls; and to identify the major risks. The components of the survey are: an

examination of key documents; interviews (generally unstructured) of the managers in

the area to be examined; and an analysis of controls, risks and areas of significance. (See

also Preliminary Survey).

Test Data: simulated transactions that can be used to test processing logic, computations

and controls actually programmed in computer application. Individuals programs or

entire system can be tested.

Tracing & Mapping (Application): specialized tools that can be used to analyse the

flow of data through the processing logic of the application software and document the

logic, paths, control condition and processing sequences.

Utility Software: specialized system software used to perform particular computerized

functions and routines that are frequently required during normal processing e.g. sorting,

back-up and erasing of data.

101