1. The World Bank
Keeping on Track:
Keeping on Track:
Internal Control and Internal Audit
Internal Control and Internal Audit
2. The World Bank
Control systems involve:
Internal Control and Internal Audit
2
Identification of Risk
Development of
Internal Controls
Development of of
Internal Audit
Internal Control
& Audit
3. The World Bank
Risks
3
Misuse and waste
of financial, human
and technical
resources,
including external
aid
Fraud and error
Unsatisfactory
accounting
records
Lack of timely and
reliable financial
and resource
management
information
Going off the rail -- risks
4. The World Bank
2
1
Internal Control & Internal Audit: Professional Standards
4
See: INTOSAI at http://www.intosai.org/ and IIA
at http://www.theiia.org/
Standards for the Professional Practice of Internal Auditing
INTOSAI
Guidelines for Internal Control Standards
5. The World Bank
A process within an
organization to provide
reasonable assurance
regarding the following
primary objectives:
Definition of Internal Control
The reliability and
integrity of information
Compliance with
policies, plans,
procedures, laws and
regulations
The safeguarding of
assets
The economical and
efficient use of
resources
The accomplishment of
established objectives
and goals of operations
and programs
Definition of Internal Control:
“Internal control is a management tool … the
organization, policies and procedures used to help
ensure that government / company programs
achieve their intended results; that the resources
used to deliver these programs are consistent with
the stated aims and objectives of the organizations
concerned; that programs are protected from waste,
fraud and mismanagement; and that reliable and
timely information is obtained, maintained, reported
and used for decision making.”
-- INTOSAI, Guidelines for Internal Control, June 1992
5
6. The World Bank
Key Concepts of Internal Control
Internal control is …
… a process
… affected by
people. It’s not
merely policy
manuals and
procedures, but
people at every
level of the
organization
… can be expected
to provide only
reasonable
assurance, not
absolute
assurance to an
entities’
management &
stakeholders
… geared to the
achievement of
objectives
6
7. The World Bank
7
Importance of Internal Control in Government
Ministries
If these responsibilities are fulfilled properly, the
result will be effective control over resources,
decisions and activities and the achievement of the
company objectives.
The average company has a number of responsibilities (committing funds,
recruiting staff, contracting for supplies and services, approving actions,
registering transactions and events, deploying resources and controlling,
supervising and reporting on implementation of policies).
If not, abuses will proliferate and efficiency decline.
8. The World Bank
Two Principles of Internal Control
8
Governing
bodies of any
sectors
entities need
to ensure that
a framework
of control is
established
and operates
in practice
and that a
statement on
its
effectiveness
is included in
the entity’s
annual report.
Governing
bodies of
internal
bodies need
to ensure
that effective
systems of
risk
management
are
established
as part of
the
framework
of internal
control.
9. The World Bank
9
Three Approaches to Internal Control
A. Emphasis on
controls that are
exercised by a
third party
organization, at the
center of company,
often an agency of
external auditors
B. Emphasis on
responsibility for control
being decentralized to line
the company and other
affiliates
C. Mixed
approaches
(e.g., transition
companies)
10. The World Bank
Clear instructions to staff and appropriate training on
the objectives, policies and code of conduct of the
ministry or agency
An unambiguous definition of the responsibilities of
staff
Clear separation of function and duties between staff
members in handling financial transactions or
resources issues, e.g., contracts
Development of an “open” culture to encourage staff at
all levels to draw attention to non-compliance and
irregularity
Requirements that staff at all levels are aware of and
apply all relevant instructions
Support from effective internal audit procedures
Procedures
Control Procedures
10
11. The World Bank
Physical:
e.g., security
procedures intended
to control access to
documents and
records
Procurement
Controls:
e.g., rules for
advertising and
tendering major
contracts
Accounting Controls:
e.g., requirement for
all cash receipts to be
deposited daily in a
bank, internal
procedures to detect
and report anomalies
Process Controls:
e.g., issuance of a purchase order or the
approval of a sizeable contract may require
documentation from the requesting official,
review by a purchasing clerk, and approval
by a supervisor
Management of
Financial & Other
Records:
Essential to establish
audit trail
Separation of Duties:
Both a control measure and
an indispensable element of
many control systems – at
least two officials should be
involved in any transaction to
avoid risk of improper actions
Categories of Internal Control
11
12. The World Bank
Design flaws
12
Limitations of Internal Control
No system of internal control can
provide an absolute guarantee
against the risk of wronging or
error. The proper goal of internal
control is to provide “reasonable
assurance” that improprieties will
not occur, or if they do occur, they
will be revealed, reported and
appropriate action taken.
Poor
implementation
Poor response to
reported anomalies
Collusion
Wrongdoing by top
managers
13. The World Bank
Definition of Internal Audit
Definition of Internal Audit:
“Internal auditing is an independent, objective,
assurance and consulting activity designed to
add value and improve an organization’s
operations. It helps an organization accomplish
its objectives by bringing a systematic,
disciplined approach to evaluate and improve
effectiveness of risk management, control, and
governance processes.”
13
Internal Audit
14. The World Bank
14
Internal Audit – Different Approaches
In the Auditor-General tradition,
internal audit is usually
reflected in internal audit units
of individual ministries or
agencies, reporting directly to
top management
Such internal audit units may
also exist in the Court of
Accounts tradition
Other variations – US Inspector
General of each agency reports
to agency management and to
the Congress
The external auditor (SAI) may
use the work of the internal
auditor
Many countries of the
Court of Accounts tradition
have a central
(independent) internal
control agency located
within the Ministry of
Finance
In some cases these have
an extensive pre-audit role
Generally wide powers of
inspection and review, and
in many cases a
prosecutorial role
15. The World Bank
What does the Internal Auditor Look For?
15
Systems &
Procedures
How well do the
systems and
procedures of
internal control
function?
Procurement
In the procurement
field, has there
been adequate
publicity for calls to
tender, are there
satisfactory
procedures for
receiving and
evaluating tenders,
is the justification
for contract awards
in accordance with
national
requirements?
Objectives’
Achievement
Have programs
and actions
achieved their
intended
objectives?
Are the systems
and procedures
in place to ensure
that resources
are used in
accordance with
the relevant rules
and regulations?
Resource use
16. The World Bank
Independence of the Internal Auditor
Not equivalent to the independence of the Auditor
General or President of the Audit court. The
internal auditor is responsible to the head of a
ministry or agency and is part of the staff of that
organization.
“Internal auditors are independent when they carry
out their work freely and objectively. Independence
permits internal auditors to render their impartial
and unbiased judgments essential to the proper
conducts of audits. It is achieved through
organizational status and objectivity.”
Status and “weight” of internal auditor can be
enhanced by having an audit committee chaired by
the head of the ministry or agency.
The internal auditor should not be involved in the
internal control process which he is required to
assess and judge.
16
Source: The Institute of Internal
Auditors
17. The World Bank
Audit Trail
An audit trail is necessary to keep under review the timely and adequate flow of funds
and the procedures for efficient accounting and the reconciliation of expenditure
reports with funds received or claimed. It is necessary to trace or check:
17
To trace the
budget
provision
that
authorized
payment
To check the
transfer of
funds
authorized by
the treasury to
the line ministry
or agency
To trace and evaluate
the systems and
procedures through
which approval for
payment to the
contractor or
beneficiary will be
required to pass
To locate
completed
payment files with
evidence that
payment has, or
has not, been
made in
accordance with
rules and
regulations
