WIXLIB

40 February 2011 A Middle East Point of View

Internal auditInternalaudit in thepublic sectorThe quiet revolutionIt used to be that internal auditing in the publicsector served as a simple administrative procedurecomprised mainly of checking accuracy oftransactions, pre-payment verification and control,counting assets and reporting on past events tovarious types of management. But in recent times,a combination of forces has led to a quietrevolution in the profession. Governments movingtoward higher levels of transparency mustdemonstrate accountability in the use of publicmoney and efficiency in the delivery of services.Larger and more complex operations demandgreater competency and professionalism frominternal auditors to minimize and manage risk.A Middle East Point of View February 2011 41

Risk ManagementGovernanceControlThe role of internal auditing can be identified asinvolving three main elements evaluation andimprovement of risk management, control andgovernance processes. Auditors use tools such asfinancial audits, performance audits and investigativeand advisory services to fulfill each of these roles.There are five main pillars that are considered critical forbuilding an effective internal audit function in the publicsector. These are: perception and ownership, improvedprocesses and governance, legislative support, improvedincentives and a commitment to change.Perception and ownershipA more professional internal audit function will be ableto establish priorities for effective and efficient servicedelivery, assist management in decision-making and thusfill a more proactive and forward-looking role. Theorganization's leadership can set the tone byestablishing governance, risk management and controlsystems and consistently applying sanctions in the caseof non-compliance.Internal Auditing – Assurance & Consultancy ServicesIn recent years, the aim has been to reach a stagewhereby public sector auditing provides the requiredservices to their organizations and ultimately, to thepublic (see box). This requires a shift in focus by internalauditors to review management procedures forimproved efficiency and effectiveness, a change inemphasis which will require time – typically 3 to 5 years.So how should governments proceed?There is much room for improvement in the internalaudit functions in developing economies. There is lackof qualified internal auditors, as well as insufficientopportunities for internal auditors to become qualified.Although there is a general awareness of internal auditstandards among audit practitioners, for the most partthese standards are not applied.To make the transition from merely ensuring compliancewith rules and regulations to truly delivering added valuerequires more than just organizational changes. Asubstantial shift in culture is required. In many settings,public sector staff is poorly paid and unmotivated, workethics are weak and governance practices areineffective. Additionally, many organizations lack thesupport from senior management and regulatorybodies, and the internal audit function is often not asindependent as desired.42 February 2011 A Middle East Point of ViewInternal audit functions need to work on raisingawareness of internal auditing in the public sector byestablishing specific marketing plans. These plans,however, must be accompanied by improved internalaudit service delivery and the introduction of a qualityassurance program. The establishment of a professionalbody to communicate internal audit matters would raiseawareness of the internal audit function and could alsoserve to sanction members who fail to meet professionalstandards.Improved processes and governanceThere are several key elements essential to helping theinternal audit function become more organized andbetter structure its processes. Annual audit coverage planning through riskassessment: as there is usually a host of auditassignments, different views and needs, managementand the internal audit function need to establishpriorities, based on a risk assessment, and obtain theaudit committee's formal approval for the plan. Toincrease audit efficiency, internal auditors shouldconcentrate on areas that carry the highest degree ofrisk. The ability to establish a reliable risk profile iscrucial to audit effectiveness.The internal audit function also needs to considerwhich effectiveness/efficiency reviews ("value for

Internal auditmoney") would improve the service delivery of theorganization and thus could raise awareness of theadded value of internal auditing. Assignment planning: auditors should develop anassignment planning memo by performing apreliminary review of the audit area and determiningthe assignment scope and objectives. Testing and reporting: establish, test, monitor andassess controls. The key finding of the audit andsubsequent recommendations should be in harmonywith the risk profile.The effectiveness of the internal audit function dependsupon several factors: True independence: a formal mandate from the boardor audit committee would give the internal auditfunction the authority to audit anything that, in itsprofessional opinion, impacts the effectiveness ofgovernance, risk management and control processes.Does internal auditing have its own budget? Whoappoints the internal audit manager? A good understanding of issues facing theorganization: internal auditing needs to functioneffectively as a member of the organizational team. Itmust understand the daily challenges faced bymanagement and structure its coverage accordingly.Unless internal auditing can consistently show that itswork contributes to better service delivery, it will bedifficult to ensure management backing forinvestment in the audit function. A non-value-addedaudit organization in the public sector could alsohamper any attempts at increased transparency andaccountability in governance. Responsiveness to management's needs: the ability torespond to management follows from anunderstanding of organizational challenges. Ad hocassignments are one way of responding tomanagement's needs. Proactive communication with management: toensure continued audit effectiveness, internal auditleaders should follow events in the organizationclosely and maintain a running dialogue withmanagement. Implementation of recommendations: the number ofrecommendations implemented is a highly relevantmeasure of audit effectiveness. A high proportion ofrecommendations implemented suggests thatmanagement is convinced of the audit function'susefulness. Matching of skills set to needs: does the auditmanager have the authority to fire and recruit staff?Can he plan and implement a training program andallow funds for certification? Use of technology to work more effectively:technology must actively contribute to audit efficiencyand effectiveness. Computerization without planningcan be counter-productive, cementing existingproblems instead of helping to solve them.To make the transition frommerely ensuring compliancewith rules and regulations totruly delivering added valuerequires more than justorganizational changes. Asubstantial shift in cultureis required.A Middle East Point of View February 2011 43

There are five main pillars thatare considered critical forbuilding an effective internalaudit function in the publicsector. These are: perception andownership, improved processesand governance, legislativesupport, improved incentivesand a commitment to change.Legislative backboneInternal auditing in the public sector should be writteninto Law. The legislation should clearly set out therequirement for internal auditing and the appropriategovernance arrangements to support effective internalauditing, such as an audit committee and its role andoperations. In support of the aforementioned, there isalso a need to fully integrate internal auditing intoongoing public finance management reforms.The head of internal auditing should be required to holdthe appropriate professional designation (IIA member orCPA) with appropriate academic qualifications. The auditfunction should formally adopt The IIA's InternationalStandards for the Professional Practice of InternalAuditing.Improved incentivesCivil service has been, and still is in some places, alifetime occupation, where set advancement is based onthe number of years in service, not merit, achievement,or education. Change is likely to be resisted by staff, if itwill only mean additional work, without any possibilityof merit-based advancement.44 February 2011 A Middle East Point of ViewMost public sector organizations, whether in developedor developing countries, cannot compete with privatesector salaries. Non-financial motivators take on evengreater importance in public sector environments andmust be targeted to the individual. There are severalsuggestions for motivating staff: Create tailored development plans, including trainingopportunities and career progression. Include praise for recommendations made. Allow the staff member to represent the internal auditfunction at meetings and conferences. Recognize the staff member with awards. Praise the staff member's work in audit publications. Offer a choice of assignments and travel opportunities. Allow the staff member to participate in exchangeprograms, spending time in other work areas.Commitment to changeCountries just beginning to make the change to valueadded internal auditing may benefit from studying theexperiences of those that have recently made thetransition. Crucial elements that should be examinedinclude leadership ethics, government support, aproactive focus and staff development. Bringing aboutthe necessary changes in culture, perception, or eveninternal audit services themselves demands a long-rangecommitment from leadership at the highest level.Strong, active leadership support to improve governanceis the over-whelming prerequisite for successful reformof internal auditing in the public sector. For sustainedchange, internal cooperation is not enough. Externalstakeholders and policy- and decision-makers need to besupportive and must be kept aware of changes, reformsand improvements in internal auditing, so they will takeinto account the contributions internal auditing can offer.by Hani Mounir Khoury, partner in Enterprise RiskServices (ERS), Deloitte in the Middle East