INTERNAL AUDIT MANUAL

GOVERNMENT OF ZIMBABWE

1
FOREWORD

The purpose of this Internal Audit Manual is to document the policies, methods,
approaches and general rules applied by the Government to promote and maintain
integrity and accountability in its financial system. The manual is intended to serve as a
reference guide to all Internal Audit staff in Government; and to promote general
uniformity in working papers and documentation; as well as provide the means to the
production of quality and professional internal audit work.

This manual provides an overview of the internal audit function in government, its
structure, responsibilities, the services it provides and the relationships with key
stakeholders. It discusses the policies and principles that apply to Internal Auditing
including the administrative aspects of an internal audit department.

The manual details the internal audit procedures of executing an audit engagement
from planning an engagement through to the resolution of outstanding issues. It also
describes the procedures for carrying out some specific audit engagements in
government.

It is expected that all Accounting Officers, Heads of Departments, Internal Auditors,

Accountants, and other Government officers will access and read this Internal Audit
Manual to broaden their knowledge thus contributing significantly to the financial
management systems reform programmes.

This Manual will be reviewed and updated periodically in line with changes in
government legislation, technological advances and economic realities.

The auditor, while applying the information in this Manual to specific audit assignments,
will be expected to exercise sound professional judgement. This Manual is solely meant
to provide guidance and should not inhibit professional judgment and innovation during
audit work.

Accountant General

Ministry of Finance and Economic Development

October, 2017.

2
Contents
1.1. INTRODUCTION........................................................................................................................... 9

1.2. INTERNAL AUDITING ................................................................................................................ 9

1.3. OBJECTIVES OF THE MANUAL .............................................................................................. 9

1.4. Mandate, Governing Framework and Standards ...................................................................... 10

1.5. STRUCTURE OF AN INTERNAL AUDIT SECTION ............................................................ 12

1.6. Mission, Objective and Scope of Work ....................................................................................... 15

1.5.1 Responsibilities .......................................................................................................................... 16

1.7. INTERNAL AUDIT SERVICES ................................................................................................. 17

1.6.1 Types of Audits .......................................................................................................................... 17

1.8. INTERNAL AUDIT RELATIONSHIPS .................................................................................... 19

1.8.1. Internal audit and the Accounting Officer ............................................................................. 19

1.8.2. Internal audit and senior management ................................................................................... 19

1.8.3. Internal audit and professional associations........................................................................... 20

1.8.4. Audit Committees ..................................................................................................................... 20

1.8.5. Internal audit and the Auditor – General (AG) .................................................................... 21

1.8.6. Method of coordinating with other stakeholders. .................................................................. 21

2.1 Code of Conduct and Professional Guidance ............................................................................. 22

2.1.1 Code of Ethics ............................................................................................................................ 22

2.1.2 Integrity ..................................................................................................................................... 22

2.1.3 Objectivity ................................................................................................................................. 23

2.1.4 Confidentiality ........................................................................................................................... 23

2.2 PROFESSIONAL RESPONSIBILITIES ................................................................................... 24

2.2.1 Independence and objectivity .................................................................................................. 24

2.2.2 Accountability ........................................................................................................................... 25

2.2.3 Proficiency and Due Care......................................................................................................... 26

3
2.2.4 Continual Professional Development ...................................................................................... 26

2.2.5 Quality Assurance ..................................................................................................................... 27

2.3 MANAGING THE INTERNAL AUDIT DEPARTMENT ....................................................... 27

2.3.1 Strategic and Annual Plan ....................................................................................................... 27

2.3.2 The Planning Process ................................................................................................................ 27

2.3.3 Assessment of Risk .................................................................................................................... 28

2.3.3.1 Defining the auditable unit ....................................................................................................... 29

2.3.3.2 Establishing the audit universe ................................................................................................ 29

2.3.3.3 Establishing the risk criteria .................................................................................................... 29

2.3.3.4 Constructing the risk model ..................................................................................................... 29

2.3.3.5 Ranking the audit universe ...................................................................................................... 29

2.3.3.6 Allocating audit resources ........................................................................................................ 30

2.3.4 Progress Register or Time Sheets ............................................................................................ 30

2.3.5 Internal Audit Activity Key Performance Indicators ............................................................ 30

3 INTRODUCTION............................................................................................................................. 32

3.1 Planning an Audit Engagement ................................................................................................... 33

3.1.1 Engagement Objectives ............................................................................................................ 34

3.1.2 Engagement Scope .................................................................................................................... 35

3.1.3 Engagement Resource Allocation ............................................................................................ 35

3.1.4 Engagement Work Program .................................................................................................... 35

3.2 Opening conference ...................................................................................................................... 35

3.3 AUDIT FIELDWORK ................................................................................................................. 37

Objectives................................................................................................................................................... 37

3.3.1 Executing the Work Programme ............................................................................................. 37

3.3.2 Audit Working Papers .............................................................................................................. 37

4
3.3.2.1 Characteristics of working papers........................................................................................... 38

3.3.3 Audit Evidence .......................................................................................................................... 39

3.3.3.1 Types of Evidence ..................................................................................................................... 40

3.3.4 Methods of obtaining Audit Evidence ..................................................................................... 40

3.3.5 Processing of findings ............................................................................................................... 41

3.3.6 Effective supervision ................................................................................................................. 42

3.3.7 The closing conference .............................................................................................................. 42

3.4 AUDIT COMMUNICATIONS.................................................................................................... 42

3.4.1 Introduction ............................................................................................................................... 42

3.4.2 Review of draft reports ............................................................................................................. 43

3.4.3 Characteristics of a Good Audit Report ................................................................................. 43

3.4.4 Content and format of audit reports ....................................................................................... 44

3.4.5 Disseminating Results ............................................................................................................... 46

3.4.6 Errors in Reports ...................................................................................................................... 47

3.4.7 Response to Audits .................................................................................................................... 47

3.5 AUDIT FOLLOW UP .................................................................................................................. 48

3.5.1 Monitoring Implementation of Audit Results ........................................................................ 48

3.5.2 Resolution of Senior Management’s Acceptance of Risks ..................................................... 48

4.1 INTRODUCTION......................................................................................................................... 49

4.2 AUDITING OF REVENUE ......................................................................................................... 49

4.2.1 Some of the sources of revenue to the State include the following: ...................................... 49

4.2.2 Role of Internal Audit ............................................................................................................... 50

4.2.3 Audit Objectives ........................................................................................................................ 50

4.2.4 Audit Procedures ...................................................................................................................... 50

4.3 AUDITING GRANTS AND CONTRACTS ............................................................................... 51

5
4.3.1 Definition ................................................................................................................................... 51

4.3.2 Audit Objectives ........................................................................................................................ 51

4.3.3 Audit Procedures ...................................................................................................................... 51

4.4 AUDITING OF RECEIVABLES ................................................................................................ 52

4.4.1 Audit Procedures ...................................................................................................................... 52

4.5 AUDITING CASH AND BANK .................................................................................................. 53

4.5.1 Introduction ............................................................................................................................... 53

4.5.2 Audit Procedure ........................................................................................................................ 54

4.5.3 Procedure to be taken when there is a cash deficiency .......................................................... 56

4.5.4 Bank Balance ............................................................................................................................. 56

4.6 AUDITING PROCUREMENT. .................................................................................................. 57

4.6.1 Audit Objectives ........................................................................................................................ 57

4.6.2 Audit Procedures ...................................................................................................................... 57

4.7 AUDITING OF PAYMENTS ...................................................................................................... 58

4.7.1 Audit objectives ......................................................................................................................... 59

4.7.2 Audit Procedures ...................................................................................................................... 59

4.8 AUDITING STORES ................................................................................................................... 61

4.8.1 Audit objectives ......................................................................................................................... 61

4.8.2 Audit Procedures ...................................................................................................................... 61

4.9 AUDITING HUMAN RESOURCESAND SALARIES ............................................................. 63

4.9.1 Audit Procedures ...................................................................................................................... 63

4.10 AUDITING SUSPENCE ACCOUNTS – ADVANCES ............................................................. 65

4.10.1 Audit objectives ......................................................................................................................... 65

4.10.2 Audit procedures ....................................................................................................................... 66

4.11 INFORMATION TECHNOLOGY (IT) AUDITING................................................................ 67

6
4.11.1 General controls ........................................................................................................................ 67

4.11.2 Application controls .................................................................................................................. 68

4.11.3 Testing the system ..................................................................................................................... 68

4.12 ASSET MANAGEMENT AUDIT PROCEDURES ................................................................. 69

4.12.1 Audit objectives ......................................................................................................................... 69

4.12.2 Audit Procedures ...................................................................................................................... 69

5.1 PROCEDURAL GUIDANCE ON SPECIAL AUDITS ............................................................ 73

5.1.1 FRAUD INVESTIGATION PROCEDURES......................................................................... 73

5.1.1.1 Introduction ............................................................................................................................... 73

5.1.1.2 Terms of Reference ................................................................................................................... 74

5.1.1.3 Investigation Procedure............................................................................................................ 75

5.1.1.4 Investigation Findings-Reporting the results of a fraud investigating ................................. 77

5.2 VALUE FOR MONEY AUDITS ................................................................................................. 78

5.2.1 Audit objectives ......................................................................................................................... 78

5.2.2 Planning ..................................................................................................................................... 79

5.2.3 The examination phase ............................................................................................................. 79

5.2.3.1 Reports arising from Value for Money audits often include the following elements: ........ 80

5.3 DEPARTMENTAL AUDITS....................................................................................................... 81

5.4 FORENSIC AUDITING............................................................................................................... 81

5.4.1 Role of forensic auditing ........................................................................................................... 81

5.4.2 Applications of forensic audit .................................................................................................. 82

5.4.3 STATUTORY AUDIT/REGULATORY COMPLIANCE ................................................... 82

5.5 AUDITING PROJECT FUNDED BY GRANTS AND LOANS .............................................. 83

5.5.1 Introduction ............................................................................................................................... 83

5.5.2 Audit objectives ......................................................................................................................... 84

7
5.5.2.1 General objectives ..................................................................................................................... 84

5.5.2.2 Specific objectives ..................................................................................................................... 84

5.5.3 Audit procedures ....................................................................................................................... 84

ANNEXURE A .......................................................................................................................................... 86

ANNEXURE B .......................................................................................................................................... 91

ANNEXURE C .......................................................................................................................................... 94

ANNEXURE D .......................................................................................................................................... 98

ANNEXURE E ........................................................................................................................................ 100

ANNEXURE F ........................................................................................................................................ 102

ANNEXURE G ........................................................................................................................................ 105

ANNEXURE H ........................................................................................................................................ 107

ANNEXURE I ......................................................................................................................................... 112

ANNEXURE J ......................................................................................................................................... 114

ANNEXURE K ........................................................................................................................................ 117

GLOSSARY OF TERMS ....................................................................................................................... 119

8
 CHAPTER 1

GOVERNMENT INTERNAL AUDIT FUNCTION

1.1.INTRODUCTION
The role of internal audit with respect to good governance is to assist the entity in
achieving its goals while creating and maintaining particular values. It does so by
evaluating processes that contribute to the achievement of these goals and values,
their communication, the processes used to monitor their respective achievement
and accountability.

The internal auditing activity must therefore be well planned, organised, staffed,
directed and monitored. It must also have policies and procedures that implement
professional standards and systems that can ensure that the standards are followed
in performing the work. This also includes ensuring that the work performed
meets the expectations and the needs of management and Treasury.

It is against this backdrop that Treasury developed this manual to establish uniform
policies and procedures to be followed in conducting internal audits of
Government operations, systems, programmes and functions.

1.2.INTERNAL AUDITING
The Standards for the Professional Practice of Internal Auditing define Internal
Auditing as, “an independent, objective assurance and consulting activity designed
to add value and improve an organisation’s operations”. It helps an organization
accomplish its objectives by bringing a systematic, disciplined approach to
evaluate and improve the effectiveness of management, control and government
processes.

1.3. OBJECTIVES OF THE MANUAL

1) To standardise procedures in government internal auditing.
2) To provide guidance to internal auditors in performing their day to day
work.
9
 3) To clearly define duties and responsibilities of internal auditors in
government.
4) To increase accuracy and efficiency when discharging their duties.
5) To facilitate training of new staff so that they can learn more quickly and
perform more effectively with minimum supervision.
6) To enhance consistence and efficiency of staff handling issues in audit units.

1.4. Mandate, Governing Framework and Standards

a) Internal Auditors are appointed in terms of Section 80 of Public Finance
Management Act [Chapter 22:19] to assist Treasury in the management and
control of public resources.
b) Internal Audit Charter

The Standards for the Professional Practice of Internal Auditing (IIA 1000)
requires that the purpose, authority and responsibility of the internal audit function
must be formally defined in an audit charter and shall be consistent with the
Institute of Internal Auditors standards for internal auditing. The crafting and
amendment of the Internal Audit Charter is done in consultation with the audit
committee.

The purpose of the charter is to set out the nature, role, responsibility, status and
authority of internal auditors within an institution and to outline the scope of the
internal audit work. The internal audit charter should be developed for each
internal audit function, approved by the Audit Committee and accepted by
management. An internal audit charter should cover the following topics:

i. The purpose and mandate of internal audit.

ii. The mission, objective and scope of work.
iii. The accountability of internal auditor.

10
iv. Independence of internal auditor.
v. Authority of internal auditor; and
vi. Quality assurance matters.

As a minimum requirement the IA charter should give IA function free and

unrestricted access to all information, records, documentation, data and employees
of the entity from both internal and external sources.

The head of internal audit should periodically assess whether the purpose authority
and responsibility as defined in the charter continue to adequate to enable the IA
unit to accomplish its objectives. The result of this assessment should be
communicated to senior management and audit committee.

c) Governing Framework and Standards

Internal auditors shall conduct their work in accordance with the standards,
principles and the code of ethics set by the Institute of Internal Auditors. This
Manual complies with the technical requirements of the Institute of Internal
Auditors’ Professional Standards of Internal Auditing and all internal auditors are
required to be guided by the IIA Standards in the performance of their work. In
addition to the Professional Standards of the Institute of Internal Auditors, all
internal auditors shall also comply with the technical provisions of the
International Accounting Standards (IAS), International Financial Regulatory
Standards (IFRS), Statement of Accounting Standards issued by the Accounting
Standards Board (SAS).

Internal Auditors are also guided by relevant sections relating to finance and
accounting controls in the Treasury Instructions of the Government of Zimbabwe
and Treasury Circulars and current regulations and practices in the State.

11
1.5. STRUCTURE OF AN INTERNAL AUDIT SECTION

Accounting
Officer

Audit
Committee

Chief Internal
Auditor

Senior Auditor/Principal Senior Auditor/Principal Senior Auditor/ Principal

Auditor Auditor Auditor

Auditor Auditor
Auditor

1.5.1 JOB DESCRIPTIONS

a) Chief Internal Auditor

1. Ensuring efficient and economic use of public resources and assessing the
cost-effectiveness of any projects undertaken by the Ministry.
2. Reviewing, evaluating and analyzing common practical auditing issues with
a view to soliciting practical solutions for implementation and improvement
of the effectiveness of financial and other audits.
3. Evaluating and providing reasonable assurance that risk management,
control, and governance systems are functioning as intended to enable the
Ministry to meet its goals and objectives.

12
 4. Formulating and reviewing strategic audit plans, developing audit policies,
practices and general development of audit functions and ensuring that these
are consistent with the internal audit charter and goals of the Ministry.
5. Monitoring the effectiveness of audit effort through reviewing of audit
papers or direct audit involvement and ensuring that audit work is as per the
requirements of Section 80 of the Public Finance Management Act (PFMA)
(Chapter 22:19), and conforms with the Institute of Internal Auditors’ (IIA)
International Professional Practice Framework (IPPF) Standards.
6. Reviewing and approving final audit work (reports) before issuance and
distribution and ascertaining that appropriate action is taken on reported
audit findings.
7. Performing any other function that may be assigned by the Accounting
Officer of the Ministry.
8. Providing technical support by writing policies and procedures.

b) Auditor/Senior Auditor/Principal Auditor

Planning, writing and reviewing of audit programmes.

1. Planning, organizing, directing and monitoring internal audit operations.

2. Reporting risk management issues and internal control deficiencies
identified and providing recommendations for improving the Ministry's
operations, in terms of both efficient and effective performance.
3. Conducting system, risk based operational, compliance and financial audits.
4. Conducting special/investigative audits.
5. Developing Annual audit plans for review by the Chief Internal Auditor.

13
 6. Leading audit teams and supervising subordinates. This includes identifying
training and development needs of subordinates and giving them on the job
training.
7. Composing summary memos, preparing working papers and reporting audit
findings.
8. Reviewing working papers and verifying audit findings.
9. Assisting the Chief Internal Auditor with the overall management of the
Ministry’s Internal Audit function.
10.Reviewing and evaluating internal control systems and making
recommendations.
11.Making follow-ups on outstanding issues and ensuring implementation of
recommendations regarding activities audited.
12.Analysing audit replies and ensuring compliance with standing rules and
regulations.
13.Attending exit briefing meetings.
14.Gathering audit evidence and writing audit reports to:
i. Management
ii. Auditor – General
iii. Accountant – General

c) Audit Assistant

1. Assisting with the development of annual audit plans for review by the
Chief Internal Auditor.
2. Planning audit engagements.
3. Conducting independent verification of all accounting and asset records.
4. Preparing working papers and reporting audit findings.

14
 5. Distributing reports and ascertaining that appropriate action is taken on
reported audit findings.
6. Filing working papers and audit reports.
7. Reviewing and evaluating internal control systems and making
recommendations.
8. Gathering audit evidence and writing audit reports to Management
9. Carrying out special investigations/reviews as and when assigned.

1.6. Mission, Objective and Scope of Work

The IA function will assist the government in fulfilling its vision, mission, strategic
initiatives, and objectives while adhering to its core value by bringing a systematic,
disciplined approach to evaluate and improve the effectiveness of the risk
management, internal control systems and governance processes.

Ultimately, the internal audit function will help ensure:

i. Risks are appropriately identified and managed;

ii. Significant financial, managerial and operating information is
accurate, reliable and timely;
iii. Employees’ actions are in compliance with government policies,
standards, procedures and applicable laws and regulations;
iv. Government resources are acquired economically, used efficiently and
adequately safeguarded;
v. Government operations are transacted in accordance with sufficient
internal controls, good business judgement and high ethical standards;
vi. Quality and continuous improvement are fostered in the government’s
internal control processes;

15
 vii. Significant legislative or regulatory issues impacting the government
are recognised and addressed appropriately; and
viii. Opportunities for improving the Ministries internal controls and
operating efficiency may be identified during internal audits. These
opportunities will be shared with the audit committee and
management.
1.5.1 Responsibilities
The internal audit function shall assist the Accounting Officer to maintain efficient
and effective controls by evaluating those controls and recommending
improvements to:-

a) the information systems;

(ii) the reliability and integrity of financial and operational information;

(iii) the effectiveness and transparency of operations;

(iv) safeguarding of assets;

(v) compliance with laws, regulations and controls; and

(vi) the functioning of other operating systems and practices.

b) The internal audit function shall also assist the Accounting Officer to
achieve the performance required from the Public Entity, Ministry or
Constitutional Entity by making recommendations for the enhancement or
improvement of the processes through which -

(i) performance requirements are set, reported and monitored;

(ii) accountability is ensured; and

(iii) corporate values are set and preserved.

16
1.7.INTERNAL AUDIT SERVICES
The Ministry’s internal auditors provide independent, objective assurance and
consulting services on governance, risk management and control processes,
designed to add value and improve the operations of the Ministry.

Assurance services involve the internal auditor’s objective assessment of evidence

to provide an independent opinion or conclusions regarding a process, system or
other subject matter.

Consulting services are advisory in nature and are generally performed at the
request of Management or the Audit Committee. Whilst the nature and scope of
assurance audits are determined by the internal auditors, the nature and scope of
consulting services are subject to agreement with the party requesting for the
assistance.

1.6.1 Types of Audits

In preparing the annual internal audit plan, the internal auditor shall determine the
type of audit to be performed for each audit. The following is a summary of the
various types of audits which may generally be conducted.

a) Financial Audits

These are designed to validate the accuracy and completeness of records and
account balances. Financial audits will utilise substantive tests, analytical reviews
and other validation procedures, which may or may not include functional tests or
transactional reviews.

Financial audits determine whether the financial information of the Ministry’s

function, activity, department or unit under audit fairly represents the financial

17
position, result of operation, and cash flows and changes in financial position of
the auditee is in accordance with the Generally Accepted Accounting Principles.

b) Operational Audits

An operational audit process is designed to:

I. Understand the responsibilities and risk faced by auditable department, unit

or process.
II. Assess the level of control exercised by management.
III. Identify, with management participation opportunities for improving control.
IV. Provide senior management of the Ministry and audit committee with an
understanding of the degree to which management has achieved its
responsibilities and mitigated the risk associated with the operations of the
Ministry. This includes:

(i) Reliability and integrity of financial and operational information.

(ii) Effectiveness and efficiency of operations.

(iii) Safeguarding of assets.

(iv) Compliance with laws, regulations and contracts.

c) Compliance Audits

They involve testing and reporting on whether the Ministry or department has
complied with the requirements of various laws, regulations, policies and
procedures. Recommendations typically call for improvements and processes and
controls intended to ensure compliance with regulations.

18
 d) Other Audits

Other types of audits are investigations and special audits which are covered in
detail in Chapter 4.

1.8. INTERNAL AUDIT RELATIONSHIPS

1.8.1. Internal audit and the Accounting Officer
It is important that the Chief Internal Auditor has direct access, as required, to the
Accounting Officer. This contact should be used as an opportunity for internal
audit to gain insights into new and emerging risks, issues facing the Ministry and
to discuss the role the Accounting Officer expects internal audit to fulfill in the
entity.

1.8.2. Internal audit and senior management

To effectively fulfill its responsibilities, it is important that internal audit has a
professional and constructive relationship with senior management of the entity.

Internal audit functions will interact on a regular basis with members of the senior
management team, and through the delivery of practical, business-focused and
useful reports and advice, will build a relationship that is based on cooperation,
collaboration and mutual respect.

Meetings with managers should be used as an opportunity to be briefed on key

developments and associated risks facing the Ministry. These meetings should also
be used to obtain informal feedback about the performance of internal audit and to
assist in identifying ways that internal audit can best assist management. One
measure of the effectiveness of internal audit is the extent to which managers seek
out internal audit to assist them in managing their business.

19
1.8.3. Internal audit and professional associations
It is generally expected that individual internal audit staff will be members of the
Institute of Internal Auditors and/or other relevant professional associations such
as the Institute of Chartered Accountants of Zimbabwe and, for information
technology auditors, Information Systems Audit and Control Association.

It is important that internal audit staff take advantage of their membership to keep
abreast of professional and industry developments and use networking
opportunities to assist in their ongoing professional development.

1.8.4. Audit Committees

The Audit Committee oversees the work of Internal Audit. The relationship with
internal audit involves:

a) The Audit Committee endorsing the internal audit charter and being
responsible for either reviewing or approving internal audit plans.

b) Internal audit functionally reports to the Audit Committee. This places the
committee in the role of being internal audit’s primary client and requires
internal audit to have a sound professional relationship with the committee;

c) Internal audit reports and general IA interaction with the Audit Committee,
provides a key source of information on the effectiveness of controls and the
performance of the entity;

d) Chief Internal Auditor provides secretariat support to the Audit Committee;

and

e) The Audit Committee is involved in assessing the performance of internal

audit, change of the Chief Internal Auditor and/or any external service
provider.

20
1.8.5. Internal audit and the Auditor – General (AG)
Establishing a professional working relationship between internal audit and the AG
should deliver benefits to both parties. It is important that internal audit seek input
from the AG in developing the internal audit strategy and internal audit work plan.
Internal and AG audit consult with each other during the planning phase of
individual audits that address the key financial and business systems underpinning
the Ministry’s financial statements. In order for the AG to use specific work of
the internal auditor, the AG is required to evaluate the work of internal audit to
determine its adequacy for external audit purposes.

A consultative approach can also be usefully applied in relation to proposed

performance audit coverage when developing respective work plans.

1.8.6. Method of coordinating with other stakeholders.

These can be summarised as follows;

Relationship with How?

Accountant General Through Reports

Auditor – General Through Reports

Professional Bodies Consultative

Other Stakeholders Consultative

21
 CHAPTER 2

INTERNAL AUDIT POLICIES

2.1 Code of Conduct and Professional Guidance

2.1.1 Code of Ethics
The purpose of the Institute’s Code of Ethics is to promote an ethical culture in the
profession of internal auditing.

A Code of Ethics is necessary and appropriate for the profession of internal

auditing. It is founded on the trust placed in its objective assurance about risk
management, control and governance.

The Code of Ethics, together with the Institutes Professional Practices Framework,
and other relevant Institute pronouncements provide guidance to how internal
auditors execute their mandate.

Internal auditors are expected to apply and uphold the following principles and
rules of conduct:

2.1.2 Integrity
The integrity of internal auditors establishes trust and thus provides the basis for
reliance on their judgement.

Internal auditors shall:

(a) Perform their work with honesty, diligence and responsibility.

(b) Observe the law and make disclosures expected by the law and
profession
(c) Not knowingly be a party to any illegal activity or engage in acts that
are discreditable to the profession of internal auditing or to the
Ministry.
22
 (d) Respect and contribute to the legitimate and ethical objectives of the
Ministry.
2.1.3 Objectivity
Internal auditors exhibit the highest level of professional objectivity in gathering,
evaluating and communicating information about the activity or process being
examined. Internal auditors make a balanced assessment of all the relevant
circumstances and are not unduly influenced by their own interest or by others
informing judgements.

Internal auditors shall:

(a) Not participate in an activity or relationship that may impair or be

presumed to impair their unbiased assessment. This participation
includes those activities or relationships that maybe in conflict with the
interest of the organisation.
(b) Not accept anything that may impair or be presumed to impair their
professional judgement.
(c) Disclose all material facts known to them that, if not disclosed may
distort the reporting of activities under review.
2.1.4 Confidentiality
Internal auditors respect the value and ownership of information they receive and
do not disclose information without appropriate authority unless there is a legal or
professional obligation to do so.

Internal auditors shall:

(a) Be prudent in the use and protection of information acquired in the course of
their duties.

23
 (b) Not use information for any personal gain or in any manner that will be
contrary to the law and detrimental to the legitimate and ethical objectives of
the organisation.

2.2 PROFESSIONAL RESPONSIBILITIES

2.2.1 Independence and objectivity
Independence

a. Refers to the auditor’s ability to maintain an objective and impartial mental

attitude throughout the engagement.
b. The internal audit unit should be sufficiently independent from line
management to ensure that its professional judgements are objective and
impartial.
c. To be effective, internal audit needs to have authority and report at a
sufficiently senior level within the Ministry.
d. IA takes its authority from The Public Finance Management Act and terms
of reference from the audit committee and Accounting Officer to whom the
Chief Internal Auditor should report and have the right of direct access.

Objectivity

a. Objectivity is an independent attitude of mind that internal auditors should

maintain when performing internal audit work.
b. Objectivity requires internal auditors to carry out audits in such a way that
the quality of their work or their honest belief in the results of their work is
not compromised.
c. Internal auditors should not be placed in situations in which they feel unable
to make objective and impartial professional judgements.

24
 d. The following are situations which may impair independence of internal
auditors:
i. Conflict of interest arising either from professional, personal
relationships, or other interest in the Ministry or activity that is subject to
audit.
ii. Undue influences which either restrict or modify the scope or conduct of
the internal auditors work or overrule significantly affect judgement as
to the content of the audit report.
iii. Auditing an activity for which they have had an authority or
responsibility in the past year.
iv. Interest of an internal auditor’s relatives such as financial interest and
business relationships of an auditor’s spouse or direct dependent.
v. Acceptance of gifts in cash or kind from clients. The receipt of
promotional items (such as pens, calendars, or samples) that are
available to the general public and have minimal value should not hinder
internal auditors' professional judgments. Internal auditors should report
the offer of all material fees or gifts immediately to their supervisors.
2.2.2 Accountability
The Chief Internal Auditor must report directly to the Accounting Officer. This
will provide sufficient authority to promote independence and to ensure broad
coverage, adequate consideration of engagement communications and allow
appropriate action on engagement recommendations. The Chief Internal Auditor
should report operationally to the Audit Committee, and administratively to the
Accounting Officer of the entity to:

25
 (a) Assist Accounting Officers by providing periodical assessments on the
adequacy and effectiveness of the entities process for controlling its
activities;
(b) Report significant issues related to the processes for controlling the activities
of the entity, including potential improvements to those processes; and
(c) Periodically provide information on the status and results of the annual audit
plan and the sufficiency of the IA resources.
2.2.3 Proficiency and Due Care
Internal auditors apply the knowledge, skills and experience needed in the
performance of internal auditing services as required by IIA Code of Ethics.

Internal auditors shall:

(a) Engage only in those services for which they have the necessary knowledge,
skills and experience.
(b) Perform internal auditing services in accordance with the International
Standards for the Professional Practice of Internal Auditing.
(c) Continually improve their proficiency and the effectiveness and quality of
their service.
2.2.4 Continual Professional Development
a. Internal auditors must enhance their knowledge, skills, and other
competencies through continuous professional development.
b. The Accounting Officer shall provide staff development and training to
Internal Auditors to keep abreast of changes in both the profession of
internal auditing and stakeholder needs within the confines of resources
provided by Treasury.

26
2.2.5 Quality Assurance
In order to ensure that the quality of Internal Audit work is consistently at a high
standard, the Internal Audit function shall abide by this Internal Audit Manual.
External quality assurance is also encouraged by the IIA professional standards.

2.3 MANAGING THE INTERNAL AUDIT DEPARTMENT

2.3.1 Strategic and Annual Plan
An internal audit function shall prepare, in consultation with the Accounting
Officer, the Executive Authority and the audit committee –

(i) a rolling three-year strategic internal audit plan based on its assessment
of key areas of risk having regard to its current operations, the annual and
strategic plans and the risk management strategy;
(ii) an annual internal audit plan for the first year of the rolling three-year
strategic internal audit plan;
(iii) plans indicating the proposed scope of each audit in the annual internal
audit plan; and

(iv)a quarterly report to the audit committee detailing its performance against
the annual internal audit plan to support effective monitoring and appropriate
interventions.

The internal audit plan shall be approved by the Audit Committee which shall
consider but not be bound by the views of the Accounting Officer and the
Executive Authority.
2.3.2 The Planning Process
a. Audit planning should be based on an assessment of risk and exposures that
may affect the organisation. This should be done annually in order to reflect
the most current strategies and direction of the organization.

27
 b. Risk assessment need to include input from management. This can be
accomplished by studying the organisations strategic plan and then discuss
with management the risks to achieving the objectives.
c. A risk based audit plan ensures that audit activities are effectively focused
on those areas where the risks or materiality of exposure is greatest.
d. The basic audit planning process consists of two phases:
i. the assessment of risk; and
ii. the allocation of audit resources.
2.3.3 Assessment of Risk
a. Risk assessment is the process of identifying the possibility that events will
occur that will be harmful to Ministry or will be detrimental to the
achievement of the Ministry’s goals.
b. Risk assessment is the most critical phase of audit planning.
c. A risk assessment and audit planning methodology is a structured approach
to a subjective process.
d. Even the most sophisticated risk assessment and planning models is the
product of value judgements.
e. The key to good audit planning is to develop a methodology that will
produce a plan that reflects management’s concerns.
f. Assessment of risk consists of:
i. Defining the auditable unit.
ii. Establishing the audit universe.
iii. Establishing the risk criteria.
iv. Constructing the risk model.
v. Ranking the audit universe.

28
2.3.3.1 Defining the auditable unit
An auditable unit is simply the subject or business process that becomes the audit
entity. The Business Process is any combination of transactions, systems, processes
or interfaces that constitutes a logical process.

2.3.3.2 Establishing the audit universe

To provide flexibility and to a manageable size the scope of an audit project sub –
units can be identified. Determine the skill – set needed for an audit project after
the individual objectives for an audit are defined.

2.3.3.3 Establishing the risk criteria

Individual elements used in risk analysis should be afforded different levels of
importance depending on whether consideration is being given to priority or
frequency, for example, time since last audit is likely to be of significant
importance in considering order of priority but not frequency.

2.3.3.4 Constructing the risk model

For the assessment of priorities and frequencies, the calculation of risk indices is
probably the most useful approach. It provides a way of combining the
characteristics or elements of a system. In calculating the weights, the auditor can
assign different weights to each of the elements he/she is combining to incorporate
his/her judgement of their relative importance in terms of risk. In allocating
weights, the auditor judges between the relative significance of different elements,
as they are likely to apply to the systems.

2.3.3.5 Ranking the audit universe

The total rating is the sum of the individual criteria weights multiplied by their
scale, as with any model the results will be analysed to see if they are consistent
with what professional judgement would expect. At this point management input

29
is strongly recommended. The audit universe could then be risk ranked by sorting
the units from highest to lowest risk.

2.3.3.6 Allocating audit resources

Allocation of audit resources focuses on establishing a strategy or selection
approach that optimises the available audit resources. This requires establishing a
risk strategy or selection policy.

The Chief Internal Auditor should communicate the internal audit activity’s plans
and resources requirements, including significant interim changes to senior
management and to the board for review and approval. The Chief Internal Auditor
should also communicate the impact of resource limitations. (Standard 2020)

Chief Internal Auditor should ensure that audit resources are appropriate,
sufficient, and effectively deployed to achieve the approved plan. (Standard 2030)

2.3.4 Progress Register or Time Sheets

Internal Auditor will maintain under his or her personal control, a Register or Time
Sheet to record the progress of the audit. The Register will normally be in
columnar form to record in the specific tasks to be undertaken in the period
covered. At the end of each month, he or she would initial to indicate the task that
he has completed and submit against the budgeted time and an explanation of any
variances.

2.3.5 Internal Audit Activity Key Performance Indicators

(a) The key performance indicators (KPIs) used are of central importance
because those features that are measured are the matters that tend to receive
the highest priority. It is important, therefore, that the KPIs for internal audit
be aligned with the Ministry’s internal audit strategy and work plan, and
help to drive the behaviour the Ministry expects from internal audit.

30
(b) It is also important that performance is measured over time in order to
identify trends, and that performance is measured against both qualitative
and quantitative targets. Such targets should be challenging but realistic.
While recognising that every organisation is different, the ministry may
benefit from formal or informal benchmarking of indicators and
performance.
(c) It would be expected that KPIs would be limited in number but, as a
minimum, would measure the timeliness, cost and quality of both audit work
and any other services provided by internal audit. KPIs include measurement
of the:
i. timeliness and cost of internal audits commensurate with the
objectives or benefits of the internal audit;
ii. acceptance of recommendations made by internal audit;
iii. quality of assurance reviews, advisory services and audit support
activities, including stakeholder satisfaction;
iv. progress in delivery of the approved program;
v. internal audit staff qualifications and professional development;
vi. internal audit staff satisfaction; and
vii. overall contribution made by the internal audit function.

31
 CHAPTER 3

INTERNAL AUDIT PROCEDURES

3 INTRODUCTION
Internal Audit procedures describe in detail how an audit engagement is carried out
from the time of planning an audit engagement until the recommended action will
have been implemented. The following diagram is a graphic illustration of the
auditing process for specific audit assignments

Audit planning – the audit staff assigned will review background information, contracts,
prior audit files, policies, laws, regulations, etc., applicable to the audit area and prepare an
audit programme. It includes procedures to be followed during the audit.

Entrance conference/meeting – a meeting will be held between the audit staff and the
managers of the audit area. The audit staff will discuss the purpose of the audit, the time
period of the audit and the resources needed. Management is given the opportunity to
discuss any concerns or questions about the audit.

Fieldwork – during field work the auditors will interview personnel concerning their duties
and responsibilities, observe day to day operations, flowchart processes, perform various
tests of transactions, review supporting documentation and document issues of concern and
areas of non-compliance

32
 Report draft – once the fieldwork is completed, the auditor will write a report that reflects
what was done, what was found and any other recommendations for improvement.

Exit meeting/conference – a meeting is held with management of the audited area to

discuss the audit findings before findings are officially released. Management is allowed
the opportunity to concur or not concur with the findings and to present evidence to support
any non – concurrence with the auditors. Any recommendations by the auditors for
improvement or corrective action are also discussed at the time

Follow up – after a reasonable period of time, the audit staff will conduct a follow up
review of areas previously audited to determine if corrective action has been effectively
taken.

3.1 Planning an Audit Engagement

a. Audit plans are accomplished by effectively managing each audit project.
b. Establishing a plan for performing internal audit work is primarily a
responsibility of the Chief Internal Auditor.
c. In planning an engagement, internal auditors should consider:
(i) The objectives of the activity being reviewed, the means by which the
activity controls its performance and achievements of those objectives.
(ii) The significant risks to the activity, its objectives, resources and operations
and the means by which the potential impact and/or likelihood of risk is kept to an
acceptable level.

33
(iii) Adequacy and effectiveness of the activity’s risk management and control
systems compared to a relevant control framework or model.
3.1.1 Engagement Objectives
(i) Objectives must be established for each engagement.
(ii) Internal auditors must conduct a preliminary assessment of the risks relevant
to the activity under review. Engagement objectives must reflect the results of this
assessment. This stage includes the process of the internal auditor identifying the
various types of information and documentation needed from the auditees. This
information and documentation will generally include items such as organisational
charts, job descriptions, department manuals and relevant reports.Common
examples of data are likely to include the following:
i. Accounting information not available from the Ministries accounting
system;
ii. Important contracts and agreements;
iii. Established policies, procedures and accounting processes;
iv. Minutes of important senior management meetings; and
v. Important correspondence and information.

During the organising stage the internal auditor will obtain a copy of the
appropriate organisational chart and confirm its accuracy during the opening
conference. The organisational chart will be reviewed in detail during the opening
conference to assist the internal auditor in understanding the function, activity,
department, or unit of the Ministry that is the subject of the audit

(iii) Internal auditors must consider the probability of significant errors, fraud,
non – compliance and other exposures when developing the engagement
objectives.

34
3.1.2 Engagement Scope
(i) The established scope must be sufficient to satisfy the objectives of the
engagement.
(ii) The scope of the engagement must include consideration of relevant
systems, records, personnel, and physical properties, including those under
the control of third parties.
3.1.3 Engagement Resource Allocation
Internal auditors must determine appropriate and sufficient resources to achieve
engagement objectives based on an evaluation of the nature and complexity of
each engagement, time constraints, and available resources.

3.1.4 Engagement Work Program

(i) Internal auditors must develop and document work programs that achieve
the engagement objectives.
(ii) Work programs must include the procedures for identifying, analyzing,
evaluating, and documenting information during the engagement. The work
program must be approved by the Chief Internal Auditor prior to its
implementation, and any adjustments approved promptly
(iii) During this stage an agenda for the opening conference will be
prepared
(iv) The major outcome of this stage is the preliminary audit programme
which the internal auditor can later make modifications as necessary.
Adequate planning and a sound audit programme will ultimately allow the
internal auditor to perform an effective and efficient internal audit.
3.2 Opening conference
The purpose of the opening conference is to discuss the plans for the overall
conduct of the audit. During the opening conference, the internal auditor will:

35
(i) Explain the type of audit being undertaken, the scope of the planned audit,
the audit objectives, the period to be audited and the general approach to the
audit;
(ii) Verify that the auditee understands the role of the internal auditor and the
commitments needed from the auditee to support the audit and respond to
audit requests;
(iii) Ask the appropriate members of management if they have any
particular areas of risk or concern which they would like reviewed;
(iv) Request management plans. Objectives, or other documents that may
have a material impact on the audit outcome;
(v) Review audit findings from previous internal or external audits and the
current status of corrective actions;
(vi) Develop a list of key personnel in the auditee department to be
contacted for meetings or information;
(vii) Discuss the procedure for preparing and reviewing the formal audit
report, which is a compilation of reportable findings and auditee responses;
(viii) Enquire about current developments relating to the Ministry’s
function, activity, department or unit under audit;
(ix) Attempt to resolve any questions with respect to the documentation
requested in the audit notification letter;
(x) Confirm the location of documents and records needed during the audit;
(xi) Explain the preliminary audit programme in general terms and
establish priorities for the audit;
(xii) Prepare a working paper memo which summaries the date, time,
location and person in attendance at the opening conference; and
(xiii) Discuss any other applicable topics.

36
 3.3 AUDIT FIELDWORK
Objectives
During the conducting stage the internal auditor will:

(i) Execute the approved audit programme;

(ii) Compile audit working papers which detail the necessary audit work
accomplished to satisfy each step of the audit programme;
(iii) Prepare a draft final audit report;
(iv) Obtain management responses to preliminary findings; and
(v) Hold the closing conference.

3.3.1 Executing the Work Programme

The conducting stage of the audit begins with the finalisation of the audit
programme and ends with the closing conference. The extent of tests performed
during this stage is heavily dependent upon the discretion and judgement of the
internal auditor. The materiality of the amounts involved and the relative risk of
the existence of errors and other irregularities will be weighed heavily when
considering and planning audit tests.

3.3.2 Audit Working Papers

(i) In the performance of audit work, the Standards for Professional Practice on
Internal Auditing state that “internal auditors should collect, analyse,
interpret and document information to support audit result”.
(ii) The internal auditors work papers will provide the principal evidence that
these standards were met, and the audit was performed professionally.
(iii) The term “work papers” includes all documents and papers collected
or prepared during a given audit.
(iv) Work papers provide the basis and support for the conclusions
reached by the internal auditor.
37
 (v) All relevant work papers prepared during a review will be preserved and
included in the work paper files maintained by the internal auditor.
3.3.2.1 Characteristics of working papers
Work papers include the evidential matter that links field work and the final audit
report. Work papers will contain the necessary evidence to support the findings,
judgments and conclusions in the final report.

i. Sufficiency

Work papers will always be complete and accurate, and include adequate data to
precisely indicate the audit work performed. Work papers will also provide support
for findings, judgments and the conclusions reached by the internal auditor as a
result of the internal audit process.

ii. Accuracy

Work papers will include only high quality information and evidence.
Accordingly, the internal auditor will take all necessary steps to help ensure that
the information contained therein is reliable.

iii. Relevance

The information contained in the work papers will be restricted to matters that are
materially important and relevant to the audit objectives for usefulness. The
evidence retained in the work papers must be useful in helping the Ministry
achieve its goal.

iv. Clarity and understandability

Work papers must be understandable without detailed supplementary oral

explanations. Work papers should also be complete and concise.

38
 Principles of documentation

(i) Work papers will substantiate everything included in the final audit
report.
(ii) A work paper or series of work papers will be prepared for each step
in the audit programme.
(iii) Work papers will clearly identify the documents or series of
documents examined. It’s not necessary to include a copy of each
document examined although in some cases efficiency may result by
utilising copies of the documents.
3.3.3 Audit Evidence
(i) In performing internal audits, the internal auditor generally gathers evidence
from internal sources, which may require verification from external sources.
Some of the internal sources of audit evidence include books of accounts,
ledgers and records, memoranda, minutes of meetings, documents that
support transactions and management letters.
(ii) Information gathered from these sources may verified from external
sources that include confirmation of bank balances, accounts receivable,
investment balances, assets held by third parties, long term debts and other
assets and liabilities.
(iii) All of the information gathered to support the internal audit effort, and
the conclusions drawn there from should be considered audit evidence,
which may be categorised as analytical, documentary, physical, or
testimonial:

39
3.3.3.1 Types of Evidence
(i) Analytical evidence

This includes computations, comparisons, reasoning, and the separation of

information into components.

(ii) Documentary evidence

This consists of letters, contracts, accounting records, invoices, etc.

(iii) Physical evidence

This is obtained by direct inspection or observation of activities, property or

events. It may take the form of memorandum, photographs, charts or other
summary documentation.

(iv) Testimonial evidence

This is obtained from others through statements received in response to enquiries

or through interviews. The critical to the audit will be corroborated through
independent verification when feasible.

3.3.4 Methods of obtaining Audit Evidence

Audit evidence is one of the basic principles that govern an audit. There are
various methods that can be adopted to obtain audit evidence. The most common
ones include:
i. Inspection
This is the most efficient method of obtaining audit evidence. Inspection refers to
checking all the documents, records, and physical assets. The reliability of these
documents and records depends upon the nature and effectiveness of internal
control.

40
 ii. Observation
Another important method of obtaining audit evidence is observation. This method
involves the auditor to look at a process of procedure being executed by others.
This method can be exemplified by the auditors’ presence at the clients’ physical
stock count.
iii. Inquiry and confirmation
The two aspects of this method include searching about the info from a
knowledgeable person inside or outside the company, and responding to any
inquiry to substantiate information in the accounting records. These responses
might provide the auditor with info which is not previously possessed by him or
even with corroborative evidence.
iv. Computation
This method of obtaining evidence involves the examination of arithmetical
accuracy of source documents and accounting records. The method might also
involve performing individual calculations.
v. Analytical review
This method involves conducting a study of important ratios and trends and
examining unusual fluctuations and items.

3.3.5 Processing of findings

As deficiencies are identified during the audit, they will be discussed with the
auditee to verify the facts before any audit report is drafted. If these discussions
confirm that a deficiency exist, the internal auditor will draft a preliminary finding.
All findings will be considered preliminary unless (and until) they are included in
the final audit report.

41
 3.3.6 Effective supervision
To assist in maintaining high-quality standards, it is important that audit teams are
properly supervised. Supervision needs will vary according to the skill and
experience of the team but will generally involve:

i. providing suitable directions or guidance at the start of an audit;

ii. regularly monitoring audit progress;
iii. ensuring compliance with professional standards and the internal audit manual;
iv. ensuring that audit findings, conclusions and recommendations are adequately
supported by the evidence; and
v. ensuring that reports are accurate, objective, clear and concise.

Audit quality is further strengthened where the management of the audit and the
emerging findings are reviewed periodically by someone at a distance from the
detail of the audit.

3.3.7 The closing conference

The closing conference of each audit will be scheduled for the last day of
fieldwork, that is, the last day of the conducting stage.

During the closing conference the internal auditor will present his preliminary
findings to the auditee and the auditor will seek the auditee’s input where
appropriate.

3.4 AUDIT COMMUNICATIONS

3.4.1 Introduction
The reporting stage begins upon completion of the closing conference and ends
where the final audit report is issued. The activities completed during this stage
include preparing a draft audit report, discussing proposed changes with the
appropriate level of management, preparing a final audit report and distributing the

42
final audit report to Management, Accountant General and Auditor General. The
final audit report is designed to assist the Ministry in measuring its own
performance, particularly with respect to the reliability of established internal
controls

3.4.2 Review of draft reports

To provide confidence in the quality of audit reports, it is important that a draft of
the report is reviewed by the Chief Internal Auditor or a Principal Auditor or
Senior Auditor appointed for the task, prior to the draft report being discussed with
the business area being audited. This helps to ensure that the:

i. report covers the objectives and scope of the audit;

ii. report demonstrates a good understanding of the area under review;
iii. audit findings are placed in context and the report is balanced;
iv. audit findings and conclusions can be supported by the evidence and
analysis;
v. report is logically structured and the final report can be understood by a
reader who may not have a detailed understanding of the topic or area
subject to review; and
vi. proposed recommendations are action-orientated, practical and cost-effective
to implement and address the underlying issue identified by the audit.
3.4.3 Characteristics of a Good Audit Report
i. Indicates Objectivity

ii. Complies with IIA Standards

iii. Relevance

iv. Clarity and Conciseness

43
 v. Disclosure

vi. Recommendations

3.4.4 Content and format of audit reports

Audit report should at least contain the purpose, scope, and results of the audit.

(a) Purpose statements should describe the audit objectives and may, where
necessary, inform the reader why the audit was conducted and what it was
expected to achieve.
(b) Scope statements should identify the audit activities and include, where
appropriate, supportive information such as time – period audited. Related
activities not audited should be identified, if necessary, to delineate the
boundaries of the audit. The nature and extent of auditing performed should
also be described.
(c) Results may include findings, conclusions and recommendations.
(d) Findings are pertinent statements of fact. Those findings which are
necessary to support or prevent misunderstanding of the internal auditor's
conclusions and recommendations should be included in the final audit
report. Less significant information or findings may be communicated
orally or through informal correspondence. Findings should be based on the
following attributes:-
(i) Criteria - The policies, procedures, directives, regulations, laws,
standards, measures, or expectations used in making an evaluation
and/or verification (i.e. what should exist).
(ii) Condition - The factual evidence which the internal auditor found in
the course of the examination (i.e. what does exist). If there is a
difference between the expected and actual conditions.

44
 (iii) Cause - The reason for the difference between the expected and
actual conditions (i.e. why the difference exists).
(iv) Effect - The risk or exposure the auditee organization and/or
others encounter because the condition is not the same as the criteria
(i.e. the impact of the difference).
(e) Conclusions (opinions) are the internal auditor's evaluations of the effects of
the findings on the activities reviewed. They usually put the findings in
perspective based upon their overall implications. Audit conclusions, if
included in the audit report, should be clearly identified as such.
Conclusions may encompass the entire scope of an audit or specific aspects.
They may cover but are not limited to whether operating or program
objectives and goals conform with those of the public body, whether the
public body's objectives and goals are being met, and whether the activity
under review is functioning as intended.
(f) Recommendations are based on the internal auditor's findings and
conclusions.
i. They call for action to correct existing conditions or improve
operations.
ii. Recommendations may suggest approaches to correcting or
enhancing performance as a guide for management in achieving
desired result.
iii. Recommendations may be general or specific. For example, under
some circumstances, it may be desirable to recommend a general
course of action and specific suggestions for implementation. In other
circumstances, it may be appropriate only to suggest further
investigation or study

45
 (g) An Executive Summary shall be included at the beginning of the audit
report highlighting the important findings and conclusion of the report. The
report shall also include comments by the Auditee on the reported findings.
(h) Satisfactory performance and improvements by auditees shall also be
mentioned in the report
3.4.5 Disseminating Results
The Chief Internal Auditor must communicate results to the appropriate parties
who can ensure that the results are given due consideration.

The purpose of communication is:

a. To inform potential readers of the conditions found during the audit

and the criteria against which the conditions were evaluated

b. To persuade Management of the validity of the conditions and their

actual or potential effect; and

c. To provide constructive and practical means to Management to take

adequate corrective action to address issues that need improvement.

If not otherwise mandated by legal, statutory, or regulatory requirements, prior to

releasing results to parties outside the organization the Chief Internal Auditor must:

i. Assess the potential risk to the Ministry.

ii. Consult with senior management and/or legal counsel as appropriate; and

iii. Control dissemination by restricting the use of the results.

The contents of the major reports issued by Internal Audit can be summarised as
follows;

Reports To When Content

46
Audit Reports  Responsible  Audit objective
management
 Scope
 Permanent Secretary The end of each
and Executive  Executive summary of major
audit findings and recommendations
Management –
 Audit Committee  Detailed Observations/Findings

CC.  Detailed recommendations

 External Auditor  Management responses

 Treasury  Agreed actions

Interim Status  Executive Committee  Progress against, and

Reports significant amendments to,
 Audit Committee Quarterly
current annual audit plan
CC
 Summary of major
 External auditor recommendations
 Treasury
Annual Report  Executive Committee  Achievement of annual audit
plans, staffing plans, and
 Audit Committee Annually
budgets
CC.
 Summary of major Findings
 External Auditor and recommendations
 Treasury  offers a holistic opinion on
controls, governance and risk
management
 Amendments to strategic plan

3.4.6 Errors in Reports

If a final communication contains a significant error or omission, the Chief Internal
Auditor must communicate corrected information to all parties who received the
original communication.

3.4.7 Response to Audits

Every auditee shall provide substantive responses to any internal or external audit
report within 30 working days of submission of such report. Failure to comply with
the above requirement without justifiable cause shall constitute an act of financial
misconduct as defined in the Principal Act.

47
3.5 AUDIT FOLLOW UP
3.5.1 Monitoring Implementation of Audit Results
(a) The Chief Internal Auditor must establish and maintain a system to monitor
the disposition of results communicated to management.
(b) The Chief Internal Auditor must establish a follow-up process to monitor
and ensure that management actions have been effectively implemented or
that senior management has accepted the risk of not taking action.
(c) The internal audit activity must monitor the disposition of results of
consulting engagements to the extent agreed upon with the auditee.
3.5.2 Resolution of Senior Management’s Acceptance of Risks
When the Chief Internal Auditor believes that senior management has accepted a
level of residual risk that may be unacceptable to the Ministry or department, the
Chief Internal Auditor must discuss the matter with senior management. If the
decision regarding residual risk is not resolved, the Chief Internal Auditor must
report the matter to the Audit Committee.

CHAPTER 4

48
 PROCEDURAL GUIDANCE ON FINANCIAL AUDITS

4.1 INTRODUCTION
This part of the Manual includes procedural guidance for financial and compliance
audits. Internal auditors should carry out these activities by taking into account the
basic concepts and principles explained in the first three chapters. The audit
procedures provided in this part should only be used as guidance for the internal
auditor to design an audit program, which specifically meets the requirements of
the public body under audit. The internal auditor should select audit procedures,
which are materially related to risk, feasible to the audit and likely to generate
useful findings.
Not all auditable areas are covered as government operations are many and diverse
to be covered in this Manual. Only critical areas of operation that apply to all
Ministries and their departments are covered.

4.2 AUDITING OF REVENUE

Revenue generated by Government is the means to the achievement of projects
approved in the annual budgets and development plans. Adequate controls are
required to secure revenues generated by Government.

4.2.1 Some of the sources of revenue to the State include the following:
a) Statutory Funding from Government, which includes: Statutory Allocation,
Share of VAT Account, Special Grants, Reimbursements, etc.
b) Internally Generated Revenue (IGR) which includes: Taxes, Fines, Fees,
Licenses, Earnings, Sales, Rent of Government Properties, Interests,
Dividends, Reimbursements, Hospital Licenses Renewal, Tuition Fees from
Schools of Health Technologies, External Auditors’ Registration Fees, Audit

49
 Fees, Registration of Company Premises, Registration of Contractors,
Income and Road Taxes, Tender Fees, Power of Attorney Fees, Stamp Duty,
Sale of Assets, Registration of Private Schools and Miscellaneous
Classification.
c) Other Sources includes: Internal Loans, External Loans, Grants from Local
and Foreign Agencies, Donations, etc.
4.2.2 Role of Internal Audit
a) Ensure that there are procedures and practices in place, consistent with
guidelines provided by the Ministry of Finance and adapted for the entity to
collect, receive, hold, issue, control, bank and account for public money and

b) Ensure that there are appropriate independent systems of internal check and
control in respect of all public moneys for which they are responsible.

c) Ensure that full and proper accounts are kept of all transactions related to public
money

4.2.3 Audit Objectives

a) To ensure that all collections are in compliance with the law.
b) To ensure that all revenue is recorded on official government receipts and
date stamped.
c) To ascertain that all receipts to Ministerial Exchequer Account or other fund
account are deposited within twenty four (24) hours.
d) To ensure that all receipts are properly recorded in the books of accounts.
e) Ascertaining that all SSB deductions are properly recorded and accounted.
f) Ensure that financial reports are in accordance with the books of accounts.
4.2.4 Audit Procedures
a) Check that the receipts books in use are recorded in the security items
register.

50
 b) Check whether receipts books are being issued sequentially and
signed.
c) Establish spaceman signature for receipting offices and see whether the
center maintains a register for the same.
d) Check whether amount received is entered in both words and figures.
e) Check that revenue received through SSB is recorded.
f) Check whether revenue is classified correctly.
g) Establish whether there is segregation of duties i.e. the receipting officer is
not the banking officer and that there is proper handover – takeover of cash.
h) Check whether cash is being deposited in the proper account within 24hours
as required by the Treasury Instruction and check if the accountant is posting
receipts to the cash book timeously.
i) Check whether reconciliations are being done monthly.
j) Check if the head of center or department or delegated officer is checking
and signing in the various books accounts.
4.3 AUDITING GRANTS AND CONTRACTS
4.3.1 Definition
 Grants are non – repayable funds given for a specific purpose.

 Contracts are legally – binding agreements, between two or more parties, to

deliver a goods or services. The contract states the obligations for each
party.

4.3.2 Audit Objectives

To verify whether funds are used for intended purposes

4.3.3 Audit Procedures

There should be an approved budget by the authorising entity, which is usually
Ministry of Finance. Internal Audit should verify whether:

51
 i. there was authority for the beneficiary to get the grant;
ii. the correct amount was released to the beneficiary;
iii. the amount was receipted;
iv. separate set of records are kept, that is Receipts, cashbook, payment
vouchers;
v. all payments were authorised, that is, do they have the receipts and
invoices;
vi. tender procedures were followed according to SSB;
vii. funds were used during the year as per budget, otherwise the
organization should reimburse;
viii. period of contract and delivery time was adhered to;
ix. the amount was paid according to contract;
x. stage forms and certificate were issued on building contracts;
xi. procedures were followed when entering the contract e.g. right person to
sign the contract, organization or department, amounts;
xii. site verification versus stage forms and certificates was done;
xiii. with regards to residual disposal e.g. vehicles and other material, whether
it was given to the right organization; and
xiv. if there is a breach of contract, the contract is cancelled or actioned in
accordance with contract i.e. terms and conditions.

4.4 AUDITING OF RECEIVABLES

4.4.1 Audit Procedures
The audit of receivables includes but is not limited to:
1. Checking that a schedule of receivables is regularly and accurately prepared.
Schedule must incorporate an age analysis and must be reported to
management.
52
 2. Examining the nature, age and amount of receivables.
3. Ascertaining that proper and updated general (control) and subsidiary
ledgers are maintained. Also ensure that the total subsidiary ledger balances
agree with that of the control ledger balance.
4. Check schedule balances against ledgers.
5. Ascertaining that there is a proper register of sums charged, money received
in settlement and amounts outstanding.
6. Ensuring that all necessary measures are taken to collect debts.
7. Seeing that there is a strong follow up mechanism for collecting from
overdue debtors in particular regarding delinquent cases already reported to
court
8. Ensuring that debts which cannot be collected after repeated attempts, are
written off in accordance with official procedures and that the write-off of
debts is properly controlled and authorized.
9. Ascertaining that the cash collected from debtors is properly accounted for
and recorded in individual ledger corresponding to each debtor.
10. Ascertaining whether statement of accounts of receivable balances are
exchanged with major debtors.
11.Sending request of confirmation for major receivable balances, depending
on materiality and risk involved. Review responses received.
12.Ascertaining compliance with directives in respect to both short and long
term loans to staff.

4.5 AUDITING CASH AND BANK

4.5.1 Introduction
Of all assets, cash is the most susceptible to misappropriation, theft and loss. The
implementation and follow-up of control procedures is the responsibility of all
53
eligible staff of the public body. The internal auditor should frequently check the
extent of compliance with established policies and procedures for proper use of
cash and bank accounts. The audit of cash and bank balances is commenced by a
surprise cash count. The accuracy of the cash balance is determined by examining
records and supporting documents kept by the public body for the collection of
receipts, effecting of payments and banking of money. The audit of cash and bank
balances verifies cash and bank balances at a specific date.

4.5.2 Audit Procedure

i. Cash should be counted to agree with receipts.
ii. There is need to check the security items register to check that all
receipt books at the station are recorded.
iii. Verify that the subsidiary receipt books at the station are recorded.
iv. Check the subsidiary receipt books and the master receipt books.
v. Check if all receipt have been recorded.
vi. Check that all cash receipts are banked intact the same day.
vii. Check that cash handling is done according to Treasury Instructions.
viii. Check that all cash is kept in a lockable safe.
ix. All receipts not yet in use should be locked somewhere by another
person who is not the cashier.
x. The one who receipts should not be the one who does the banking.
xi. Petty cash balance should be ascertained.
xii. Also ascertain cash on hand vis-a-vis imprest balance.
xiii. Documents such as invoices should be attached to the vouchers.
xiv. Periodic supervisory checks should be done according to the Treasury
Instructions.

54
 xv. When there is cash deficiency the cashier should acknowledge the
deficiency or the cash count form and the cashier should make good
the deficiency.
xvi. If fraud is suspected a report should be made to senior management
for them to take action.
xvii. No personal cash should be kept in the safe by the cashier. Extra cash
found in the safe should receipted and be banked to revenue according
to Treasury Instruction.
xviii. Signatories to the bank account should be ascertained and verify that
these are the ones giving authority to the bank.
xix. Ensure that collection and payment of cash are made on legal receipt
and payment vouchers, respectively.
xx. Ascertain that cash collected by the public body is deposited intact
into bank in a timely manner as directed by the Ministry of Finance
(within 24 hours) using the electronic clearing facilities of the banking
system and when electronic clearing facilities are not available,
remittances shall be made at least once a week.
xxi. Ascertain that every cash and bank transaction is properly registered
in the books of account.
xxii. Verify that bank accounts opened for particular purposes are used for
those purposes and that no unauthorised bank accounts exist.
xxiii. No bank accounts shall be opened without the written approval of the
Ministry of Finance or other competent authority.
xxiv. Ensure that proper actions are taken with regard to safeguarding of
cash.

55
4.5.3 Procedure to be taken when there is a cash deficiency
i. Cashier shall acknowledge the deficiency.
ii. Cashier shall sign cash count form.
4.5.4 Bank Balance
i. Identify all bank accounts held in the name of the public body.
ii. Check bank balances with the bank by obtaining a current statement
from the bank.
iii. Check whether all deposits are recorded in the cashbook.
iv. Check whether all payment are recorded in the cashbook.
v. Ascertain the accuracy of the bank reconciliation statement prepared by
the accounts section of the public body.
vi. Check that outstanding cheques shown in the bank reconciliation
statement for the current month are included in the bank statements of
the public body for the following month(s).
vii. Ascertain whether there are no cheques outstanding for more than six
months.
viii. If there are long outstanding cheques, ask accounting staff to make the
necessary adjustments in respect of them (for instance make write-back
entries in cash book to cancel the overdue cheques).
ix. Ascertain that the cashier does not present dishonoured cheques during
the cash count in order to prevent means of covering defalcation.
x. Ascertain the inclusion in the following month’s bank statement of
deposits in transit shown in the cash book in the previous month (by
checking their accuracy against bank deposit slips) to prevent their use
for covering misappropriation.

56
 xi. Make further investigation when uncommon and high value adjustments
appear in the bank reconciliation. Check also unusual high value
withdrawals appearing in the bank statement.
xii. Ensure that bank reconciliation statements are prepared monthly.
xiii. Ensure that errors made by bank are notified to the bank as soon as
possible.
Check that all banks account shall be opened with the approval of the
treasury.

4.6 AUDITING PROCUREMENT.

4.6.1 Audit Objectives
i. Ensure there is maximum economy and efficiency in the procurement
of goods and services ;
ii. Encourage as wide as possible a solicitation of proposals to promote
competition, and to secure the best least price;
iii. Encourage local producers and tax payers to bid for tenders;
iv. Promote integrity, fairness and transparency of the procurement
process; and
v. Ensuring that all procurements have complied strictly with existing
Government’s laws and regulations.
4.6.2 Audit Procedures
The internal Auditor should undertake the following procedures:
i. Identify the officer responsible for procurement to determine the system
in place.
ii. Verify the composition of the Procurement Tender Committee (PTC).
iii. Request for all procurement documents i.e. Purchase Plan, Initial Request
forms, and invitations to treaty, quotations, and comparative schedules

57
 register for bidders, receipt books, PTC adjudication minutes and
Tradesman requisitions.
iv. Check existence of tender box, its location and custody of the keys.
v. Check whether:
a) Purchases are as per plan.
b) Request forms are being authorised at the right level.
c) Invitations to treat have detailed information pertaining to
specification.
d) Tender adverts are being flighted in specified media.
e) Register for bidders are being maintained. Verify receipts.
f) Quotations are being signed by the Procurement Committee
members on receipt.
g) Comparative schedules are being compiled and forwarded to
the Procurement Committee for adjudication and signing.
h) Adjudication minutes are being written for Tender Adjudication
proceedings.
i) Check Management of price variations for soundness.
j) Invoiced prices, quantity and specifications are as per quotation.
vi. Verify receipts of goods or items (or service provided) by ministry and
user department together through Goods Received Registers and Stock
Control Cards.
vii. Evaluate the system of internal check and control in the procurement
process.
viii. Confirm the physical existence of the items.

4.7 AUDITING OF PAYMENTS

58
 Government expenditure represents payments made from the revenue generated to
settle bills for goods and services benefitted. Some of the expenditure already
identified in State Government includes:
Payment to Contractors for executed Projects, payment to suppliers, payment of
expenses claims, remittances of proceeds to third parties, donations, payment to
parastatals, repayment of loans to banks, etc.

4.7.1 Audit objectives

To check whether the payment
i. is a proper charge to the vote, i.e. legitimate charge;
ii. is adequately supported by appropriate documents such as internal requisition,
purchase order invoices, goods received voucher, comparative schedules,
delivery notes and authorities of the payment voucher; and
iii. is according to tariffs, regulations.

4.7.2 Audit Procedures

The Internal Auditor shall check for the following –
That the payment:
i. is a proper charge against public funds;
ii. is according to regulations, tariff or agreement, or alternatively is
fair and reasonable;
iii. is covered by competent authority;
iv. is correct in regard to date and period of service;
v. is correct in regard to computations;
vi. is supported by the relative requisitions or an explanation for their
absence given;
vii. is properly certified;

59
 viii. is made at the correct rate;
ix. is not made before the due date, or duly delayed-especially at the
end of the financial year;
x. has not been previously paid;
xi. is made against invoices and not statements;
xii. is allocated to the correct vote –sub-head item; and
xiii. is not made by one person.
The internal auditor should also check that:
a) requisition was issued prior to receipt of goods;
b) a certificate required have been included on the voucher;
c) a duplicate requisition has not been issued;
d) the name on the invoices agrees with the name on the voucher;
e) what is paid for is actually received;
f) any discount allowed has been claimed;
g) the payment has been noted for department assets where necessary;
h) the payment is supported by relevant documents;
i) supporting documents are stamped ‘supporting voucher’ only;
j) where necessary, that payments are noted for income tax purposes;
k) that accounts rendered are not paid;
l) where grants are being paid, that the payments are supported by evidence
that any conditions attached to the grants have been fulfilled;
m) in the case of stores purchases, that the stores have been received in order
and brought on charge;
n) goods are (wherever possible), purchased from state service departments;
o) all claims against the state are paid promptly;
p) the face of the voucher reflects the full history of the payment;
q) a commitment register is maintained;
60
 r) a system of internal checks and control has been instituted;
s) vouchers have relevant authorisation field in department and reference
not entered on voucher face;
t) payments apply to statutory funds unless specific authority to exempt the
fund has been given; and
u) vouchers are in sequence.

4.8 AUDITING STORES

4.8.1 Audit objectives
The Internal Auditor should ensure proper accountability of Stock received into
stores.

4.8.2 Audit Procedures

i. Ensure that store items are properly classified for easy identification and
grouping.
ii. Check that all stock received is accurately recorded in the Store Register.
iii. Carry out inspection to ensure that Stock supplied are the type, quantity and
quality ordered.
iv. Check whether stock issued to users are accurately recorded and
acknowledged by the receiving officer or department.
v. Check to ensure that Stock Account Balances agree with the physical counts.
vi. Participate in Stocktaking to ensure that actual counts are correctly recorded
and carried in the books.
vii. Check to ensure that stock items recorded in the Bin Cards/system are
correct.

61
viii. Check the Stores Received Voucher to ensure that information contained is
accurate.
ix. Confirm that the Storekeeper adheres to the Stock Management Policy of the
Ministry. He or she should review observance of the Policy to ensure that
Minimum Stock Level, Maximum Stock Level, Reorder Level, Reorder
Quantity, etc. are maintained by the Storekeeper.

The following additional steps are also important

a) Examine all security measures against burglary, fire etc. Are these
adequate? Also check when fire extinguishers were last serviced this should
be done annually.
b) Are there written job descriptions for all officers responsible for stock
control?
c) Is staff aware of these descriptions and are they able to understand them?
d) Are any officers handling a transaction from beginning to end?
e) Are items received into stock checked against delivery notes before
acknowledging receipt?
f) Quantity, correctness and damage must be assessed before signing.
g) Segregation of duties between receiving and issuing.
h) Are frequent stock checks carried out?
i) Is there excess wastage, spoilage etc.?
j) Is the register of losses and damages kept showing the following:
 date of loss/damage
 nature of loss/damage
 value of loss/damage
 value of any recoveries and

62
  resultant loss to government funds
k) Is a return of losses and damages submitted to Head Office annually?
l) Is storage space and accommodation adequate?
m) Are precaution against fire, burglary and pilferage adequate?

4.9 AUDITING HUMAN RESOURCESAND SALARIES

4.9.1 Audit Procedures
The Internal Auditor shall:

a) check that no public officer was paid from budget allocations until the
public officer’s appointment and scale of pay have been authorized;

b) check that no public officer received an increment, allowance or increase

in salary until such increment, allowance or increase in salary has been
authorized according to Regulations issued by the Civil Service
Commission or other relevant authority;

c) Check for existence of records for each employee for proof of engagement,
dismissal, changes in rates of pay. Any changes in these details should be
evidenced in writing by a responsible official;

d) Check or reconcile the payroll records on months by month basis so that an

unexplained deviations are identified;
e) Check all time – records and overtime for approval by responsible
officials;

f) Check that wages and salaries are compared for the clients employees only
in accordance with authorized rates of pay and conditions;

63
 g) Check whether wages and salaries computed is in agreement with recorded
of work performed i.e. overtime claims, bonus calculations, e.t.c.;

h) Check that payroll is correctly computed and paid appropriate employees;

and

i) Verify establishment per cost centre. Check whether Head count is done
and make comparisons with organogram and pay sheet

Verification of vacant returns

Verify:

i. appointments versus changes in payroll (pay sheet)

ii. output from line ministries by responsible offices before submission to

Salary Services Bureau (SSB)

iii. check that all records of transactions are accurately maintained within the
accounting system

iv. Check that there are controls to ensure that all payroll deductions (income
tax, pension e.t.c.) are computed and paid over on due dates.

v. Verification of invoices from SSB and comparisons with pay sheet and
current establishment before requests for actual payments from Treasury to
SSB.

vi. Check gross pay, deductions and net pay calculated on pay sheets from SSB
before actual payment

vii. Check amendments to pay sheets, payments versus circulars approving(eg

compliance)

64
viii. Check gross pay, deductions outside Treasury approval(surcharge,
disallowances)

ix. Check pay sheets from SSB before the actual payment

x. Check whether no deductions from the gross salaries, wages and allowances
was made except for such purposes and under such conditions as approved
by the Ministry of Finance and Economic Development; and

xi. invoices for payment of salaries and allowances was processed through the
Ministry of Finance and payments made electronically to the designated
bank accounts of Ministries or other entities.

xii. that the deductions made from the salaries are paid over to the recipients
expeditiously.

xiii. Check whether instructions from the Ministry of Finance and Economic
Development regarding the calculation, payment dates, recording of and
accounting for salaries, wages and allowances are being adhered to.

4.10 AUDITING SUSPENCE ACCOUNTS – ADVANCES

Examples

i. Travelling and Subsistence

ii. Surcharges
iii. Disallowances
iv. Salary advances
v. Miscellaneous
vi. Temporary deposits
4.10.1 Audit objectives
a) To ensure that advances are properly recorded.

65
 b) To ascertain/verify whether the advance was properly authorised.
c) To verify whether the advances was acquitted within 30 days from return to
home station.
d) To establish whether advances are cleared before another is cleared.
e) To verify whether pay sheets were fully acquitted.
f) To verify whether the block grant was not exceeded.
g) To establish whether advance registers are in existence and properly
maintained.
h) To verify whether requisite returns statutory are transmitted to treasury and
Auditor General within stipulated time frames.
4.10.2 Audit procedures
a) Verify the existence of advances register.
b) Check whether the budget is available.
c) Check existence of ledger cards.
d) Check T&S application forms were properly authorized and completed.
e) Verify whether members are acquitting their advances within the stipulated
time.
f) Check the reasonableness of the amounts advanced in relation to the
requirements.
g) Carry out recalculations.
h) Post a sample of advanced amounts to the ledgers.
i) Verify if statutory returns are being compiled.
j) Request alpha deduction sheets and post figures to relevant ledger accounts.
k) Verify supporting documents.
l) On foreign trips verify:
i. invitation letters;
ii. authorisation by way of cabinet authority; and

66
 iii. per- dium rates.

Temporary deposits

a) Verify that all receipts have been allocated to their appropriate revenue
codes and that any unallocated receipts are credited to the temporary deposit
accounts.
b) Check that all amounts in the temporary deposit accounts are cleared within
6 months.
c) Verify that all un-cleared amounts are receipted to the exchequer account
after 6 months.
d) Report on what was done during the trip.
e) Check whether the passport is stamped on entry and departure.

4.11 INFORMATION TECHNOLOGY (IT) AUDITING

This involves examining the internal control environment of automated
information possessing systems and how people use those systems.

IT audits typically evaluate system input, output and processing controls: backup
and recovery plan; system security and computer facility reviews. IT auditing
projects can focus on existing systems as well as systems in the development stage.

4.11.1 General controls

These comprise the Electronic Data Processing (EDP) environment and all EDP
activities, thus these controls are pervasive in their effect and are generally viewed
as administrative controls over the EDP department. Although they are
administrative in nature they bear directly on the effectiveness of the entire system

67
weaknesses if these controls are serious because they affect all phases of the
process, these controls include:

1. Organisational controls within the department – segregation of duties.

2. Designated procedures for testing and approving systems or programmes,
these procedures should be in a written manual of systems documentation.
3. Controls built into the equipment by the manufacturer called hardware
controls.
4. Controls over access to the equipment and data.
5. Backup and recovery plans.

4.11.2 Application controls

Application controls related to specific tasks performed by EDP. Their function is
to provide reasonable assurance that the recording, processing and reporting of
data are properly performed. There is considerable choice in the particular
procedures and records used to effect application controls.

They include:

1. Preventing errors from happening.

2. Detecting errors should they happen.
3. Correcting errors when they happen.

4.11.3 Testing the system

The system must go through major testing to determine if it is working as designed
and controls functioning as intended. Types of tests are:

1. Test data approach – this is where dummy data is inputted into the
system to determine if the controls to keep bad things from happening
are functioning.

68
 2. Integrated test facility – dummy data is integrated with real data and
processed to determine if the system processes good information properly.
3. Parallel simulation – a programme is prepared to run besides the existing
programme and compares the results to determine if they are exactly the
same.

4.12 ASSET MANAGEMENT AUDIT PROCEDURES

4.12.1 Audit objectives
The objective of the audit is to ensure that proper internal controls exist for the
custody and use of assets and that:

(a) assets are acquired in accordance with provisions of the Procurement Act,
Procurement Regulations and Ministry of Finance instructions or other applicable
framework;

(b) preventive mechanisms are in place to minimise theft, losses, wastage and
misuse; and assets bought during the period were recorded in the assets register,
exist and are in good working order.

4.12.2 Audit Procedures

i.Examine a sample of invoices and contracts to ensure that:-
a) Purchases of fixed assets are supported by budget;
b) Relevant supporting documents such as purchase requisitions,
purchase orders, goods receiving reports, etc. are in order;
c) Acquisition is authorized;
ii.Check the existence of the assets register.

Such asset registers shall record the following information-

69
 a) physical features of the assets including asset class, location,
quantity, size, useful life, and value;
b) legal features including the identification of asset owners, managers,
and users; and economic features such as economic features, that
is,whether the assets are tradable or non-tradable and cost benefit
estimations.
iii.Carry out physical inspection of fixed assets periodically and/or annually and
compare this against fixed assets register.
iv.Compare inventory list to the assets.
v.Take note of any discrepancies.
vi.Check whether the discrepancies are noted in assets register.
vii.To confirm Existence and Maintenance:
a) Ascertain that all registered assets are given identification numbers
(fixed with tag number);
b) Where there are various agents and/or projects which are located far
from the Head Office, inspection visits should be made on a sample
basis in such a way that the sampling would enable you to visit all
numbers of the group at least within five year plan of government;
and
c) Verify any discrepancies.
viii.Ask for donations register and confirm its existence.
ix.Confirm the existence of the donated assets.
x. Where donations exist confirm the existence of treasury authority to accept the
same.
xi.Ask for a losses and damages of assets register and confirm its existence
xii.Check whether the losses and damages were recorded in the register
xiii.Verify unrecorded losses and damages.
70
 xiv.Ask for a board of inquiry register and confirm its existence
xv.Verify the status of the board of inquiry matters
xvi.Take note of delays between the constituting of the boards and their sitting
xvii.To establish the functionality of property, plant and equipment
a) Check with users
b) Physically inspect to confirm
c) Inspect maintenance of Property Plant and Equipment and assess
sustainability
xviii. To Confirm disposals and write-offs; Obtain schedule for fixed assets
disposed of and written off during the year and ensure that:
a) Senior management has approved the disposal and the writing off;
b) Assets have been disposed of in a manner that maximize public
benefit and best serve the public interest.
c) Disposal of a movable asset has been made at a market-related
value or by way of price quotations, competitive bids or auction,
whichever is most advantageous to the State.
d) Whether management has properly evaluated other factors
including alternative uses of the fixed assets prior to disposal;
e) The procedure applied in disposing of and writing off fixed assets
is consistent with the directives and regulations of the government.

The Protection and Handling of Government Vehicles

a) Ensure that the public body acquires and disposes vehicles on the basis of
relevant directives of the Government;
b) Check whether all vehicles are recorded in the asset register and trace back
the details from vehicle registration books and individual vehicle files;

71
c) Check that all private plated vehicles are not registered under individuals’
names.
d) Inspect all the vehicles at the station for existence and assess the condition.
Record a report on the condition of the vehicle. For non- running and
unserviceable vehicles, check if board of surveys and auctions are carried
out on time.
e) Examine the accessories register to see whether all items bought are
recorded and signed for issues. Check on the frequency of issuing
parts/accessories to the same vehicle.
f)Check whether parts are being moved from one vehicle to another and for any
such movements’ authority has been sought from the Accounting Officer, to
deter cannibalization.
g) Ascertain that there is a senior manager who controls all aspects of vehicle
management;
h) Ascertain the existence of control mechanisms (driver’s log books; checks
on mileage readings etc.) to ensure that the vehicles of the public body are
only used for government duties;
i) Ascertain that the vehicles of the public body are only driven by
authorized persons;
j) Make sure that all eligible officials and drivers are using government vehicles
with due care as per relevant guidelines;
k) Ascertain the accident reporting procedures in principle and compare to see
if in practice when drivers and eligible officials are involved in accidents
causing damage to government vehicles follow them;
l) Make sure that drivers and eligible officials who damage government vehicles
as a result of their own carelessness or negligence, are held responsible for

72
 the cost of repairs by checking on the board of investigation report and the
treasury decision;
m) Request for all payments for repairs and maintenance to check whether:
I. Payments tally with actual service carried out

For accident related repairs a board of investigation was done and the
action taken is in sync with decisions passed.

II. Ensure that vehicles of the public body are serviced at regular
intervals. Check to see if this information is maintained and
updated in a file or service register with reconciliations being made
before payment.
III. Ensure that those who receive transport allowances are not at the
same time utilizing a vehicle of the public body as required by PSC
Circular No.3 of 2011.

5.1 PROCEDURAL GUIDANCE ON SPECIAL AUDITS

5.1.1 FRAUD INVESTIGATION PROCEDURES
5.1.1.1 Introduction
These are designed to verify the existence and magnitude of suspected fraud and
financial irregularities. Fraud and financial irregularities audit may be conducted
at the request of management as a result of a tip off from a whistle blower or at the

73
discretion of an internal auditor. The internal auditor shall utilise the highest level
of discretion when undertaking a final irregularity or fraud audit. The internal
auditor shall promptly notify management of any significant findings, which result
from a fraud and financial irregularity audit.

An Auditor may be required to carry out investigation due to his professional

training and experience. He could be commissioned to carry out this assignment
alone or work as a member of a group appointed to do the investigation. He may as
well be required to provide information to the Investigators. Depending on the
situation, the Auditor is expected to co-operate as long as he is directed by
Management or his boss. Such directive should be preferably in writing as
Investigators may require the provision of sensitive documents or information.

5.1.1.2 Terms of Reference

Investigators must be given terms of reference by those who appointed them. The
terms of reference should be clear and specific to enable the investigators to focus
on important issues. Terms of reference carefully determined should contain the
following information:

a. Type of irregularity.

b. The type of irregularity to be investigated. For instance, is it Cash,

Bank, Convertible Assets, Reporting, e.t.c.

c. Who are the likely participants? Those mentioned along the line, in
the process of carrying out the suspected action should be investigated
to determine their roles.

74
 d. What method is applied in carrying out the irregularity? Is it manual
or IT assisted? Internal or external parties? Documented or
undocumented?

e. Recommendation of measures to forestall future occurrence: This is

based on the findings and facts gathered during the investigation.

5.1.1.3 Investigation Procedure

It is not practical to devise a set of rules that can be applied in every circumstance,
but a framework for carrying out investigations could be provided. Therefore, the
recommended procedure that should be considered during investigation would
include the following steps:

i. Plan the Investigation Assignment: The Internal Auditor should draw up a plan
of action on the investigation assignment. He should obtain the resources
required and open a Case File for information and documents to be generated
during the exercise.

ii. Identify the Departments Involved: The department where the incident being
investigated is traced to have originated should be identified and noted as the
commencement point of the investigation.

iii. Identify the Officers or Staff Involved: The key staff mentioned in the process
chain and their roles should be identified and noted.

iv. Identify the Officers’ Schedules: The job functions of the staff mentioned in the
process chain should be identified. Their job description should be obtained and
analysed to understand their roles in the organisation and specifically relating to
the incident being investigated.

75
 v. Identify Relevant Records and Documents: The Investigator should identify and
request for relevant records and documents used in the transactions for reviews
during the assignment. The records may include computer tapes, personal files
and documents in the archives. He should also make a list of information
required but beyond his reach, such as bank statement, paid cheques, etc. Make
photocopies of documents obtained and keep safely in the Case File.

vi. Draw a flow chart of the internal control system and document trail relating to
the area being investigated. He should establish the normal procedure and
identify the point where the incident occurred.

vii. Ask Officers to make Statements: Staff identified to have participated in the
process should be requested to make voluntary statements in writing. The
Auditor may prescribe a particular format to guide the staff in supplying only
relevant information.

viii. Conduct Interviews: The staff should be relaxed to remove fears so that vital
information would not be withheld. Clear and clever questions that would
extract relevant information should be asked. Micro Recorders or Videos should
be used to record proceedings where available. Notes should also be taken.

ix. Verification of Facts Obtained. This is done through review of:

a) Information extracted from Statements made by staff

b) Information generated from outside the organisation: Banks,
Treasury Office, Individuals, etc.
c) Information generated from evidences gathered during the
exercise. The Auditor should exercise some care and carry out
some tests to determine the extent of reliance to place on them

76
 d) Information from previous reports may also provide a lead on
current incident
e) General observations made by the Auditor based on experience
5.1.1.4 Investigation Findings-Reporting the results of a fraud investigating
a) The objective of internal auditor during fraud investigation is to
obtain sufficient evidence which enables him to draw reasonable
conclusions and recommendations and to report to the Head of
public body whether fraud has occurred or not. The internal auditor
should use the guidance for writing a report in in this manual.
b) It is important that reports on fraud investigation are clearly written,
have conclusions and recommendations that are justified by the
evidence used. The structure that should be used is similar to that
for normal audit report, except the following points.

The investigation report should disclose:-

(i) The reasons for investigation:- The investigation will either be the result of
other routine work of the internal auditor or due to an allegation made by an
individual inside or outside of the public body.

(ii) The objectives of investigation:- The objective of investigation is to establish

whether there is sufficient evidence for the suspected fraud occurrences to
substantiate legal action and to report findings to the public body.

(iii) The work carried out:- Documents scrutinized, locations visited, timing and
staffing, interviews held and other relevant documents which were inspected.

(iv) Conclusions and recommendations:- The report should include all findings,

conclusions, recommendations and corrective actions to be taken.

77
 (v) Finally, a draft of a proposed report on fraud should be submitted to legal
departments for review in order to obtain opinion in respect of legal matters
and to take further necessary action.

Moreover, the auditor should follow whether appropriate action has been taken on
findings she/he reported on the perpetrator of fraud. If such action has not been
taken it should be reported to the next higher public body till it reaches the
Ministry of Finance and Economic Development. In addition, the internal auditor
shall pass the report to the Auditor General.

5.2 VALUE FOR MONEY AUDITS

Value for money auditing describes reviews of economy, efficiency and
effectiveness with which the Ministry has used its resources in discharging its
functions.

Economy is concerned with spending less by minimising the cost of resources of a

given quality.

Efficiency is concerned with spending well by minimising resources used for a

given output.

Effectiveness is concerned with spending wisely by ensuring that the outputs

achieved match the policy or operational objective.

5.2.1 Audit objectives

a) To consider controls as well as results.
b) To judge whether good value for money has been achieved.
c) To identify instances of waste.
d) To identify ways of improving value for money.

78
Value for money (performance) audit undertaken by the internal auditor involves
three basic phases:

a) Planning
b) Examination
c) Reporting

The precise timing and depth of procedures may vary from one audit to the next,
but all VFM audits have the three basic phases.

5.2.2 Planning
The purpose of this phase is to provide focus and direction for the detailed
examination phase by identifying what the audit objectives will be and the
procedures required to be performed to achieve the stated objectives. This focus is
based on having an appropriate understanding of the areas in which VFM is to be
conducted

5.2.3 The examination phase

This consists of conducting tests, evaluating controls and collecting sufficient and
appropriate evidence to conclude whether or not the matters originally identified
during the planning phase are potentially significant for reporting purposes.

The examination phase includes the following major activities:

a) Selecting or preparing detailed audit programme.

b) Conducting tests and documenting audit findings.
c) Analysing the associated causes(s) and effect(s).
d) Preparing project report/fact sheets.
e) Developing conclusions and recommendations.
f) Completing and reviewing audit files.

79
5.2.3 Reporting the Results of Value for Money Audit

The objective of internal auditors during value for money audit is to obtain
sufficient audit evidence to evaluate the accomplishment of established objectives
and goals and to report any findings and recommendations.

The audit report should be well structured and well written. The report should be
reader – based and the language should not be suggestive and ambiguous.
Performance audit reports should be objective and fair in their presentations. This
might for instance require that:

a) There are separate presentations of findings and conclusions;

b) Facts are presented and interpreted in neutral terms;
c) Different perspectives and view-points are represented;
d) All relevant findings, arguments and evidences are included;
e) Reports are constructive and positive conclusions are also presented.
5.2.3.1 Reports arising from Value for Money audits often include the
following elements:
a) A summary of context in which the activities under scrutiny took place
including the historical context;
b) The objectives for those activities, a description of the activities and
analysis of the prospects for achieving economy, efficiency and
effectiveness, leading to a statement of the objectives of the audit;
c) A description or summary of audit methodologies used for collecting
and analysing data and presentation of the sources of data;
d) An explanation of the criteria used (to verify the hypothesis or to
interpret and assess the findings);
e) The audit findings and all arguments that are considered material; and
f) Conclusions relating to the audit objectives.

80
5.3 DEPARTMENTAL AUDITS
This can be an example of an Operational Audit. Departmental audits are designed
to review and evaluate the activities and operations of Ministries, activity,
department or unit under review. Departmental audits will evaluate accounting
controls and ensure compliance with Ministry’s policies and procedures, applicable
laws and regulations and validate the record and account balances of the auditee.

Departmental audits will utilise a complete battery of audit tests and procedures,
including, but not limited to, functional tests, transaction reviews, substantive test,
and analytical reviews

5.4 FORENSIC AUDITING

Forensic auditing is the application of auditing skills to situations that have legal
consequences.

5.4.1 Role of forensic auditing

The basic role of forensic audit component is to facilitate the prevention, detection
and investigation of economic crime in the public sector. This includes the
following aspects:

• The initiation of an economic crime awareness programme with a view to

highlighting the existence of potential risks and the need for an economic crime
strategy in each public institution;

• A review of the criminal justice system as it pertains to economic crime in the

public sector and of all the relevant legislation with a view to identifying any
material deficiencies and reporting appropriately thereon;

81
 • The development of the necessary policy and guidelines, including an
appropriate risk assessment model for audit and other purposes.

5.4.2 Applications of forensic audit

An obvious example of forensic auditing is the investigation of a fraud or
presumptive fraud with a view to gathering evidence that could be presented in a
court of law. However, there is an increasing use of auditing skills to prevent fraud
by identifying and rectifying situations that could lead to fraud being perpetrated
(i.e. risks). It might be useful, therefore, to discuss forensic auditing as either
“reactive or proactive”.

Proactive forensic auditing

Forensic auditing in this sense could be viewed from different aspects depending
on its application: some of which are discussed below:

5.4.3 STATUTORY AUDIT/REGULATORY COMPLIANCE

Forensic audit methodologies can be used to obtain a more detailed understanding
of the entity and its activities to identify areas of risk both in determining the
direction of the audit and expressing an opinion.

Government departments could themselves use the technique of forensic auditing

to assess compliance with regulations governing payments of grants and subsidies
performance auditors could also use these techniques while auditing such
governmental programmes.

Diagnostic tool

Forensic auditing can be used either by management or by auditors to carryout

general reviews of activities to highlight risks arising either out of fraud or any

82
other source with the purpose of initiating focused reviews of particular areas
targeting specific threats to the organisation.

Investigation of allegations

Complains, allegations in the press or in parliament, unanimous tips from

employees or others could all in their separate ways require to be investigated. The
techniques of forensic auditing are useful in such cases.

Reactive forensic auditing

The objective in case of reactive forensic audit is to investigate cases of suspected

fraud so as to prove or disprove the suspicions, and if the suspicions are proven, to
identify the persons involved support the findings by the evidence and to present
the evidence in an acceptable format in any subsequent disciplinary or criminal
proceedings.

5.5 AUDITING PROJECT FUNDED BY GRANTS AND LOANS

5.5.1 Introduction
Donations and loans are resources secured by the Government or the public body
for the support of projects as per agreements with donors or lenders. The proceeds
from the loans and donations are used by the implementing agency (public body)
as per relevant agreements in undertaking various activities within the recurrent
and capital expenditure budgets as well as other special socio-economic projects of
the government. Counter – part funds are created by means of payments into a
special account. They are recorded in the budgetary accounts as receipts and are
used to finance capital projects and recurrent budget as well. A public body has
now also incorporated additional function, i.e. it acts as a disbursing agent
(implementing agent) for the loans obtained from lenders (like World Bank, IDA,
ADB) for the health and education sectors.

83
5.5.2 Audit objectives
The audit objectives with respect to the counter- part funds in particular and donor
funds in general are as follows:

5.5.2.1 General objectives

• To assure the proper receipt and use of funds designated for a specific purpose
andto ensure satisfactory compliance with relevant agreement,

5.5.2.2 Specific objectives

 To assure proper compliance with bilateral/multilateral agreement.

 To assure proper collection of funds.

 To verify that disbursements are made for the purposes designated and are in

agreement with the budget.

 To ensure proper record maintenance.

 To provide adequate stewardship over grants and loans.

 To ensure the economic and efficient use of funds.

5.5.3 Audit procedures

Though it is difficult to stipulate detailed procedures with regard to each
agreement, some generalized issues can be raised.

a) Compliance with agreement

Check the details of the agreement and make sure that the points raised are adhered
to. This is concerning general and specific responsibilities, requirements,
conditions, covenants, etc.

b) Collection from donors/lenders

84
  Check correspondence file in relation to donation/loan advice of payment of
donors/lenders.

 Check that official cash receipts are issued for collections of cash of the
grant/loan from donors/lenders.

 Proper acknowledgements are made (if required).

 Ascertain that goods receiving vouchers are issued for receipt of commodities.

 Check whether stock cards are used to record receipts and issues of
commodities by the public body.

 Ensure the receipts are as per agreement or budget.

 Ascertain that the collections are properly registered and recorded in the

books of account.

 Other relevant procedures as mentioned in 'receipt and receivables' and 'cash

and bank balances' sections can be used

Payments

 Ensure that payments are approved.

 Ensure that payments are made as per plan/program/budget and agreement

 Check relevant supporting documents with respect to the payments.

 Ensure that payments are made for the designated purposes.

 Check the actual expenditure against budget.

 Check interest rate computations and loan status (for credit agreements).

85
  Ensure the proper recording of expenditure to the right account/ledgers.

 Other relevant procedures as mentioned in the 'Expenditure' and 'Procurement'

sections can be applied here.

Cash and Bank Balances

 Check that an imprest system is maintained and • Check that any cash in hand
is regularly counted.

ANNEXURE A
ROLES AND RESPONSIBILITIES OF THE AUDIT COMMITTEE

The audit committee has non-executive status in an advisory capacity to the

Accounting Officer. In no circumstances should the audit committee have
executive powers with regard to its findings and recommendations on any
operational functions of the management and control of the Ministry. Its role is
that of an independent monitor of activities within the Ministry.

86
Section 84 of the Public Finance Management Act provides that;

1. Every Ministry, statutory fund, constitutional entity and public entity shall
establish an audit committee.

2. The responsibilities of an audit committee shall include the following:-

(a) to review internal controls, including the scope of the internal audit
programme, the internal audit findings and to recommend appropriate action to
be taken by the responsible authorities;

(b) to ensure that accounts, are prepared in a timely and accurate manner and to
ensure the prompt publication of the annual accounts;

(c) to review with the Comptroller and Auditor-General or other external

auditors as may be appropriate, the scope of their audit plan, the system of
internal audit reports and assistance given by officers or staff to the auditors and
any findings and action to be taken.

3. The audit committee :

(a) Shall consist of at least three persons of whom, in the case of a Ministry-

(i)one shall be from outside the Public Service;

(ii) the majority may not be persons in the employ of that Ministry, except with
the approval of the appropriate Minister; and

(iii)the chairperson shall not be a member of the Public Service employed by

the Ministry;

(b) Shall meet at least twice a year; and

87
 (c) May be established for two or more Ministries or Institutions if the Treasury
considers it to be more economical.

4. The Comptroller and Auditor-General, external and internal auditors shall

have access to audit committees.

5. Upon the request of any auditors, the Chairman of the audit committee shall
convene a meeting to consider any matter that the auditors believe should be
brought to the attention of the responsible authorities.

The Chairman of the audit committee shall send or cause to be sent to the
Accountant General, Comptroller and Auditor-General, internal auditors and
external auditors where appropriate:

(a) notices of audit committee meetings; and

(b) minutes of audit committee meetings.

The role of an Audit Committee

• Consider internal audit plans and activities of internal audit department with
regard to risk management, control and good governance.

• Provides one of the channels of communication between management, internal

auditors and also the Office of the Comptroller and Auditor-General.

• It enhances independence of internal audit department.

• Evaluation and approval of the audit policy.

• Evaluation of internal control and risk management system.

Reporting Channels

88
The audit committee must report and make recommendations to the Accounting
Officer, by the Accounting Officer retains responsibility for implementing such
recommendations. Copies of all the IA reports should be made available to the
Accounting Officer, Accountant General, and the Comptroller and Auditor
General.

Should a report to an audit committee, whether from the IA function or any other
source, implicate the Accounting Officer in fraud, corruption or gross negligence
the chairperson of the committee must promptly report this to Treasury or Auditor
General.

The committee should have direct and unobstructed lines of communication to the
Accounting Officer, Senior Management, Treasury and the Internal and External
audit.

Operations of Audit Committee

There are several steps that will contribute to the effectiveness of an Audit
Committee, these include:

(a) Establishing written charter/terms of reference.

(b) Selecting qualified committee members.

(c) Considering the independence and objectivity of committee members.

(d) Determining the term of office of committee members.

(e) Appropriately scheduling meetings.

Establishing an internal audit committee charter

89
Audit committees should have documented terms of reference from Accounting
Officer and these should be stated in a formal, written charter or equivalent.

The charter should clearly state the responsibilities and structure of the audit
committee and these include:

• Mission and scope of the committee.

• The size, frequency and timing of meetings.

• Role and responsibilities of the committee.

• Term of office of committee members.

• Remuneration of members.

• Authority of the committee and the authority to conduct special investigations.

Constitution of audit committee

Audit committees should be large enough to represent a balance of views and

experiences yet small enough to operate efficiently and effectively.

The PFM Act provides that an audit committee may be made up of at least 3
members.

Members and Chairperson of the committee shall be appointed by the Accounting

Officer in concurrence with the Minister and shall perform their duties for a period
of three years from the date of appointment.

Members should at least have adequate mix of expertise in finance, management,

law and any of the fields relating to the activities of the Ministry. They should
possess the following qualifications for starters, integrity, understanding of the

90
entity, its products and services, independent judgement and ability to offer new or
different perspective and constructive suggestions.

The Chief Internal Auditor, Finance Directors and representatives of Treasury have
standing invitations to the Audit Committee meetings.

Independence and objectivity of committee members

Critical to the effectiveness of the audit committees is its independence and

objectivity and hence its membership. It is generally agreed that the audit
committee should be made up of individuals who are independent of the day-to-
day management of the Ministry and who have necessary management expertise to
perform their review function effectively.

The primary reason for this independence is to ensure an unbiased perspective on

reports and recommendations brought to the committee.

ANNEXURE B
ESSENTIAL ELEMENTS OF AN INTERNAL AUDIT CHARTER

91
The internal audit function is established in pursuance to section 80(1) of the
Public Finance Management Act, which provides that internal auditors be
appointed:

“to assist the Treasury in carrying out the duties referred to in section 6, the
Public Service Commission may appoint an officer of the public service as an
internal auditor to any ministry or to any department of a ministry.”

The purpose of the charter is to set out the nature, role, responsibility, status
and authority of internal auditors within an institution and to outline the scope
of the internal audit work. The internal audit charter should be developed for
each internal audit function, approved by the Audit Committee and accepted
by management. An internal audit charter should cover the following topics:

(a) The purpose and mandate of internal audit.

(b) The mission, objective and scope of work.

(c) The accountability of internal auditor.

(d) Independence of internal auditor.

(e) Authority of internal auditor; and

(f) Quality assurance matters.

As a minimum requirement the IA charter should give IA function free and

unrestricted access to all information, records, documentation, data and
employees of the entity from both internal and external sources.

The head of internal audit should periodically assess whether the purpose
authority and responsibility as defined in the charter continue to adequate to

92
enable the IA unit to accomplish its objectives. The result of this assessment
should be communicated to senior management and audit committee.

Mission objective and scope of work

The IA function will assist the government in fulfilling its vision, mission,
strategic initiatives, and objectives while adhering to its core value by
bringing a systematic, disciplined approach to evaluate and improve the
effectiveness of the enterprise – wide risk management, internal control
systems and governance processes.

Ultimately, the internal audit function will help ensure:

• Risks are appropriately identified and managed;

• Significant financial, managerial and operating information is accurate,

reliable and timely;

• Employees’ actions are in compliance with government policies, standards,

procedures and applicable laws and regulations;

• Government resources are acquired economically, used efficiently and

adequately safeguarded;

• Government operations are transacted in accordance with sufficient internal

controls, good business judgement and high ethical standards;

• Quality and continuous improvement are fostered in the government’s

internal control processes; and

• Significant legislative or regulatory issues impacting the government are

recognised and addressed appropriately.

93
Opportunities for improving the Ministries internal controls and operating
efficiency may be identified during internal audits. These opportunities will
be shared with the audit committee and management.

Accountability

The Head of internal audit must report directly to the Accounting Officer with
sufficient authority to promote independence and to ensure broad coverage,
adequate consideration of engagement communications and appropriate action
on engagement recommendations. The Head of internal audit should report
operationally to the Audit Committee, and administratively to the Accounting
Officer of the entity to:

• Assist Accounting Officers by providing periodical assessments on the

adequacy and effectiveness of the entities process for controlling its activities;

• Report significant issues related to the processes for controlling the activities
of the entity, including potential improvements to those processes; and

• Periodically provide information on the status and results of the annual audit
plan and the sufficiency of the IA resources.

ANNEXURE C
INTERNAL AUDIT ENGAGEMENT LETTER

94
To Head Of Division
Cc Permanent Secretary
Audit Committee Chairperson
From Chief Internal Auditor
Date xxxxxx
Subject ENGAGEMENT LETTER – xxxxxxxxx
audit

Introduction

In accordance with the (Year xxx) Audit Work Plan approved by the Audit and
Compliance Committee, the Internal Audit Team will be conducting an audit of
[Audit Process, i.e. Procurement] in your department for the period starting
(DATE) and ending (DATE). .

Objectives

Our objective in performing this review is to assess whether (LIST ACTUAL

OBJECTIVES HERE]

For example:
 Reliability and Integrity of Financial and Operational Information,
 Compliance with Laws, Regulations, and Contracts,
 Safeguarding of Assets, and
 Effectiveness and Efficiency of Operations of the [AUDIT AREA], and to
follow-up on recommendations included in prior audit reports

Scope of Work

The audit program will involve a review of the xxxxx.

Specific areas to be covered include:

95
 General (which covers major issues reported at last audit, and related matters
raised in recent External Audit management letters)
 Xxxxx
 Xxxxx

Our Approach

1. Obtain, through existing procedural documentation, and discussions with

management and staff, necessary information required to produce a risk
focused program of audit work

2. Conduct field audit work, which will involve compliance testing of controls
and substantive testing to evaluate the effectiveness of these controls.

3. Discuss recommendations for improvement with management at an exit

interview upon conclusion of our field work.

5. Issue a draft audit report to management with our documented findings and
recommendations, and request a formal response to the recommendations.

6. Include the formal management response to each recommendation in the draft

report, and then issue the final signed report, which will include our overall
audit opinion.

The Audit Team

The audit team will comprise the following members:

[NAME OF TEAM LEADER}

[NAMES OF AUDITORS}

Management’s Responsibilities

An initial list of items and information required to commence our audit is attached
to this memo. We would appreciate it if this information could be provided to us as

96
soon as possible, as this will minimise the need for disruption to staff. Further
requests for information will be made as and when required.

Please note that any delays in providing us with the information required to
perform our audit work, in meeting with management and staff or in responding to
our draft audit report, will adversely impact on our ability to meet the deadlines
described in the Timing section below.
It is also your duty to take the necessary remedial action on the issues raised by
Internal Audit or provide reasons why action will not be taken on some areas
reported. Your action plan will be reported to the Audit Committee at its next
meeting.

Timing

Subject to any unexpected/unplanned delays (on your part or ours), we will

endeavour to meet the following timelines:

 Audit Commencement: We wish to advise that we will commence this audit on

([DATE]. The Audit is expected to take [NUMBER OF WEEKS] to complete.
At the beginning of our audit, we would like the opportunity to meet with you
to discuss our audit objectives and solicit your input as our goal is to perform an
effective and efficient audit

 Issue of final draft audit report for consideration: Before the audit team
leaves site at the end of the fieldwork phase; a meeting will be held with you to
discuss preliminary findings raised, any outstanding information and your
initial comments to the audit findings. The draft audit report will be completed
by the audit staff and reviewed by me within a week after fieldwork. You are
then expected to provide a response to the draft report within two weeks
including your action plans on the issues raised in the report
 Issue of final signed report. Within five working days of receipt of your
management comments to the draft audit report

Conclusion

97
I would appreciate if you could inform me, at any time, of any particular concerns
you may have concerning the subject of this audit. These matters will certainly be
taken into consideration while performing the audit work.

Thank you and we look forward to working with you on this audit review.

Name and Signature

Chief Internal Auditor

ANNEXURE D
INTERNAL AUDIT STRATEGY AND RISK BASED PLANS

98
The internal audit strategy describes the role of internal audit within the entity’s
overall assurance processes and provides an important link between the internal
audit charter and the detailed internal audit work plan. It is expected that the
strategy will set out:
i. the organisation’s assurance requirements;
ii. the contribution of the internal audit function to that assurance over the period
covered by the strategy;
iii. the broad details of the audit; and
iv. the resources that will be devoted to the different types of activities that will be
undertaken.
The period covered by the strategy can vary, but would normally cover a three‑
year period and be reviewed at least annually.
Strategic, risk-based plans are designed to ensure that audit resources are allocated
to areas that will help achieve strategic outcomes and reduce the possibility that the
Ministry or department will be exposed to significant risks.

99
 ANNEXURE E
Model of a Strategic Risk Based Plan

100
4.2.1 Identification of the Audit Universe
All mandates, authorities, programs, corporate functions, organizational units,
systems, assets, resources and processes of Ministry are identified that are
within the potential scope of internal audit.
4.2.2 Grouping of Universe into Manageable Auditable Units
All the potential universe entities and elements are grouped into units that
would likely produce meaningful findings for senior departmental
management and that would be of such size and scope that an audit
engagement could be practically conducted within a reasonable timeframe or
cycle of coverage.
4.2.3 Risk Assessment of Manageable Auditable Units
Each auditable unit is assessed, using a scale of 1 to 5 where 1 is low and 5 is
high, in terms of risk related to its significance to achievement of Ministry
objectives, its complexity in terms of ensuring that intended outcomes are
achieved, and its sensitivity in terms of the public or the intended
beneficiaries.
4.2.4 Selection of Significant Audit Engagements
Audit projects are proposed that would be most appropriate to address the
highest risk areas of the manageable audit units on a priority basis.
4.2.5 The Three Year Audit Plan
The annual plan outlines a prioritised list of proposed engagements including
the initial objectives and scope for each engagement, an estimate of required
resources and an identification of the most suitable timing for specific
engagements.

101
 ANNEXURE F
RISK BASED ANNUAL PLANNING
Steps in Annual audit Planning
i. Define the audit universe
ii. Identify and weight risk factors
iii. Establish a mechanism and score risk factors for auditable
units
iv. Sort the auditable units by total risk score
v. Develop the annual risk based plan basing on the ranked audit
universe

Step 1: Defining the Audit Universe

 Distinct units or functions of the enterprise (For example
Human Resources Department (HR) Finance Department and
Technical Department)
 Business or organizational processes
 Requests from senior management
 Requests from the Board of Directors
 Regulatory or statutory requirements
 Potential audits based on experience or instincts
Step 2 and 3: Identifying and Weighting Risk Factors;
Establish a Mechanism and Score Risk Factors
Should address impact and probability
Design and apply objective criteria for assigning scores
Ensure consistency of application

102
Risk factor Scale of Rating Weighting Rating
measurement Points (A) Factor (B)
Value of $1-10000 1
Transactions $10001-20000 2 2
20001-40 000 3
40 001- 60000 4
0ver 60 000 5
Impact to Very High 5
organisational High 4
objectives Medium 3 5
Low 2
Very low 1

Complexity Very simple 1

of Simple 2
Transactions Average 3 3
Complex 4
Very complex 5

Step 4 and 5 Sort Units by Scores and determine audit priorities.

Develop the plan

103
 Rating Weighting Rating Audit
Points Factor Total Auditable Points Priority
Score (B) (AxB) Unit Total explanati
(A) ons
Human Value of 20001-40

Resources Transactions 3 2 6 27 000 3

Department Impact to 5 5 15 Very

business High

objectives
Complexity of 2 3 6
transactions Simple

Value of Over

Finance Transactions 5 2 10 60 000

Department Impact to 5 5 25 47 1
business Very

objectives High

Complexity of 4 3 12
transactions Complex

Technical Value of 4 2 8 40001-

Department Transactions 60 000

Impact to 5 5 25 45 Very 2
business High

objectives
Complexity of 4 3 12 Complex

transactions

104
 ANNEXURE G
THE AUDIT RISK MODEL

This model is used to identify and quantify the elements making up overall audit
risks. For an Auditor to effectively manage the risks, he should measure the
associated risks attached to the audit subject and define a tolerable limit to arrive at
favourable conclusion.

The audit risk model is defined as follows;

AR = IR x CR x DR

IR = Inherent Risk
CR = Control Risk
DR = Detection Risk

Inherent Risk
This is the risk that items may be misstated as a result of their peculiar
characteristics. Inherent risk may result from:
i. Nature of the items: For instance, estimated items are inherently risky
because their measurement is not precise but based on assumptions.
ii. Nature of the operation: For example, purchase of materials is volatile and
has the high risk of being over invoiced
Inherent risk operates independently of controls. The Auditor should accept that
such risks exist and may not be eliminated

105
Control Risk
This is the risk that a misstatement would not be prevented or detected by the
internal control systems in operation. It is not likely that control risk would be zero
because of some limitations of internal control system. However, control risk could
be reduced by introducing new or better controls

Detection Risk
This is a risk that audit testing procedure would fail to detect a misstatement in a
transaction or account balance. For example, if detection risk is 10%, then there is
a 10% probability that the audit tests will fail to detect a material misstatement.
Therefore, increase inthe ratio of test carried out would reduce the detection risk.

106
 ANNEXURE H
TYPES OF AUDIT TESTING
Test Description Advantages Disadvantages
1 Interviewing Direct interface with Issues conveyed may be
Inquiry procedure involves the personnel involved in the merely a one-sided perception
discussions with process owners, business process - facilitates of management and not actual
process staff, including key greater understanding of the business practice.
stakeholders who operate the process business.
obtain, organise and analyse.
chance to probe for further
details. trained to elicit valuable
information - this involves the
opinions, causes and possible use of open-ended questioning
solutions to problems. versus closed ended
arification of questioning
is possible before
2 Observation and Inspection Tends to provide a greater Tests typically need to be
Observing involves a careful, understanding of the business corroborated with other
knowledgeable look at documents through audit involvement procedures.
processed, activities and assets. It with operational personnel.
means a visual examination with a
purpose, a mental comparison with reflects actual behaviour. observe large numbers of
standards. people or activities.
current, not retrospective.
not provide an adequate
evaluation of the process due
to fluctuations in volume or
activity.

behaviour if they know their

107
 work is being reviewed.
3 Documentation Review Unobtrusive. A skilled auditor is needed to
This involves a review of existing apply historical documents to
reports and documents to identify quantifiable, historical and the current situation and to
controls, to understand the business or objective. identify areas where
process, and to provide evidence in interpretation is required of
supporting audit conclusion. questioning upon the document.

misinterpreted without
involving client personnel in
the review or corroborating
the results through other types
of tests.
4 Confirmation/Representation Sound basis for determining Lack of availability of
A confirmation or representation is the reasonableness of appropriate and reliable data
frequently prepared by the Auditor, historical or forecast data. may limit the ability to
completed by the relevant party, then develop effective analytical
delivered directly back to the Auditor. understanding of business procedures.
Confirmations and representations may activities and relationships Unstable operating
be obtained either externally or and provides a structured environments create
internally. basis for identification of increasing difficulties in
areas requiring further predicting relationships.
analysis.

an audit test to assess the

need for more detailed audit
testing.
Can be used in initial stages
of the audit to identify
problem areas to focus audit
reviews/testing

108
5 Analytical Review: Sound basis for determining Lack of availability of
Comparison of inter-relationships the reasonableness of appropriate and reliable data
among sets of data, and the comparison historical or forecast data. may limit the ability to
of these relationships with some pre- develop effective analytical
defined expected relationship may be understanding of business procedures.
referred to as analytical testing activities and relationships Unstable operating
and provides a structured environments create
basis for identification of increasing difficulties in
areas requiring further predicting relationships
analysis.

an audit test to assess the

need for more detailed audit
testing.
Can be used in initial stages
of the audit to identify
problem areas to focus audit
reviews/testing.
Data Analysis and Exception Tests: Provides a more scientific Significance of exception
Analysis and query of historical and rigorous approach than items identified needs to be
data files to identify trends, scanning type procedures. evaluated in the overall
- Used effectively to quantify business context.
problem areas, exceptions, etc
the significance or incidence
of a certain event or non- available in a readily usable
event. format and may become costly
- Data analysis can be used to to "manipulate."
understand the volume or
magnitude of certain events
or values, which may assist in
further refining and limiting

109
 audit testing.
- Sample file can be selected
automatically.
- Efficient, accurate method
of analyzing a large amount
of data.
- Ideal application for
statistical sampling.
Vouching and Verifying May be the most efficient and Method and reasonableness of
Tests to prove that recorded events or effective audit procedure to sample selection of items to
values took place through examination verify a particular vouch has a significant
of supporting documents or systems management assertion. bearing on the appropriateness
it of conclusions which may be
evidence of certain drawn. Particular
infractions or errors. consideration must be made of
whether to select vouching
evidence that stated controls samples based on a statistical
are operating effectively selection of sample sizes and
items or to judgmentally select
items for review.
Process Mapping Provides a clear May be difficult to determine
Process mapping analysis may be used documentation trail to the proper level of detail to
as a test of business practices. In support an evaluation of process map.
particular, where the completeness of controls or processes.
controls or logic of business procedures if a structured detailed
is being assessed, process mapping technique for assessing a flowchart is required.
provides a tool to identify weaknesses process.
or inefficiencies. can be time consuming.
client.
Walk Through Process tracing may be used Workers may alter their
Tracing procedures beginning with to verify that controls exist to behaviour if they know their

110
original documents and following their ensure transactions are work is being reviewed.
lifecycle through process. complete. Sample selected for testing
may be too subjective and not
errors not identified through reflective of trends in the
other audit steps. business process.

process understanding gained

through process mapping.
Reconciliation May provide valuable insight Time consuming.
A specific purpose audit test designed as to business issues and risks
to analyse variances between two sets underlying the process. For necessarily be identified.
of similar information. example, a detailed book to
physical analysis may
identify problems in goods
dispatch and inventory
production recording and
monitoring processes. It may
disclose incidence of fraud.
Recalculation and Valuation Tests: May provide the most Important to view the
Amounts or values are recalculated by efficient method to evaluate calculation in terms of total
the Auditor to verify their accuracy or the outcome of a certain audit risk - for example,
to assess the reasonableness of the final process recalculation of interest
valuation. income may not be useful if
one-third of loans will never
be collected.

complex and time consuming.

Consultants, particularly
where a valuation is being
assessed – E.g. Property value.

111
 ANNEXURE I
INTERNAL AUDIT PLANNING CHECKLIST
Initials Date
Prepared By
Reviewed By

Name of Public Body____________________________

Audit Area Audit Planning Checkist
Period: ____________________________

Yes No Initials
PRIOR YEARS AUDIT REPORTS
1. Have you reviewed with the in-charge auditor (Senior
Auditor), re:-
• Changes in presentation of disclosure?
• Points to which special attention should be paid?
• Improvements to the content and style of the audit
findings and recommendations report?
PRIOR YEARS WORKING PAPERS
2. Have you reviewed with the in-charge auditor, re:-
• Points for attention at next audit, if any?
• Unnecessary schedules?
• Inadequate or excessive work?
• Changes in procedure or scope of examination?
NARRATIVE SYSTEM NOTES AND/OR FLOW CHARTS
3. Are you satisfied that narrative system notes and/or flow
charts and updates cover all aspects of the accounting and
other relevant systems and explain the significance of any
systems weaknesses?

112
INTERNAL CONTROL EVALUATIONS
4. Are you satisfied that the ICEQ’s have been properly
completed and evaluated and the audit implications of
weaknesses fully disclosed?
AUDIT PROGRAMMES
5. Are you satisfied that the audit programmes fit the particular
circumstances and that the scope and extent of the tests
adequately cover the implications of systems and control
weaknesses disclosed by the narrative system notes/flow charts
and ICEQs?
TIME BUDGET
6. Have you reviewed and approved the time budget ensuring that
total time is within the limit for the type of audit to be carried
out?
STAFF ASSIGNMENTS
7. Have you reviewed with the in-charge auditor and agreed
his provisional assignment of staff to the various audit
responsibilities?
PLANNING MEETING
8. Have you held a planning meeting with the staff assigned to
discuss all aspects of the audit work to be undertaken?

113
 ANNEXURE J
OUTLINE OF A MODEL INTERNAL AUDIT REPORT

1. Covering Memo
This should show at minimum
1) Date and addressees of the audit
2) Audit objective and scope of audit
3) Conclusion from the audit findings
4) Signature of the Chief Internal Auditor or person delegated to sign
2. Executive Summary
(May not be required when reports can be kept short)
The executive summary should reiterate the objectives and scope of the
engagement, the rationale for the audit, and the criteria and approach employed
including references to professional standards. A conclusion is required for each
objective, and a summative conclusion may be provided. Key findings and
recommendations may also be included. Above all, management should be able to
readily focus on and understand the important issues being reported.

3. Objectives
•Reason for the engagement and the specific objectives
Scope
Context of the subject matter (e.g. a description of the program, activity, issue,
organization, or system examined, its place within the department, and its
importance or a description of exclusions)
• Timing (the period covered by the evidence examined)

114
4. Approach or Methodology
•Criteria (against which the observations and assessments were made and
conclusions were drawn)
• Work conducted
•Standards used (any professional standards, e.g. IIA, governing how the work was
done)
•Timing (the period during which the work was done)
5. Observations and Recommendations
 Start by acknowledging improvements from last audit
For each area of observation:
 (A topic sentence may be employed to introduce the essence of the
observation)
 Condition
 Criteria
 Cause
 Impact and Exposure to Risk
 Recommendation (action required and responsibility)

6. Management Action Plan

 Action to be taken for each recommendation
 Timing

7. Conclusions
 Conclusions on objectives
 Compliance with relevant laws, regulations, policies, and standards
 A summative conclusion may be desirable

115
  A statement of assurance may be included or may be referenced if it is
addressed in a covering memorandum
 Other higher level results relative to engagement objectives

8. Overal Recommendation
 Recommendation on the conclusions made above on item 7
 May be general or specific. For example, the recommendation may call for
management to take compliance seriously or the recommendtion may call
for disciplinary measures against a Manager for gross negligence.

116
 ANNEXURE K
CHECKLIST FOR REVIEWING AUDIT REPORTS

The Substance of the Report

Sufficient background information is provided to understand the context and
significance of the audit report.
�The audit objectives and the related criteria used to arrive at observations and
conclusions are stated.
�The audit scope states what was and was not included in the examination and
specifies the period of time represented by the activities examined.
�The timing of the audit, the methodology employed, and the professional
standards followed are described. If appropriate, disclosure is made if any parts of
the engagement were affected by non-compliance with professional standards.
�Detailed audit observations relate to the stated objectives and criteria and
logically support overall opinions and conclusions.
�Each observation contains a statement of the condition (the situation supported
by audit evidence), the criterion, the cause, the effect, and a recommendation.
�Convincing or persuasive evidence is presented in support of each audit
observation.
�The impact of negative observations is quantified where possible but otherwise
presented in a compelling argument, including an analysis of potential risks.
�Recommendations flow logically from observations and causes, are specific and
cost-effective, and are directed to specific positions or individuals with the
authority to act upon them.
�A conclusion, or a statement of inability to conclude, is provided for each audit
objective and is supported by convincing evidence and analysis.
�As appropriate, a statement of assurance is provided.

117
�Positive observations and conclusions are provided where warranted.
�Appendices included in the report add value in understanding the engagement
results

The Style of the Report

The table of contents establishes the layout and structure of the report and correctly
represents headings and page numbers in the body of the report.
�Headings and text styles (e.g. italics, boldface, font size) are used effectively and
consistently to draw the reader's attention, e.g. topic or lead sentences, highlighted
recommendations.
�Charts and other exhibits are referenced in the report and appropriately labelled.
�Paragraph and sentence structure support understanding, e.g. single topic or
issue, concise, logical.
�Initialisms and acronyms are explained or defined upon their first use.
�Language usage and terminology is appropriate to the intended audience(s), e.g.
the active voice is used and jargon and overly technical terminology are avoided or
clearly explained.
�A balanced tone is maintained.
�Grammar and spelling are correct.
�Appendices are presented in a uniform format and are referenced in the body of
the report.
�Overall, the report is clear and concise - the important findings,
recommendations, and conclusions are evident.

118
 GLOSSARY OF TERMS

Accountability
The obligation to answer for a responsibility that has been conferred. It presumes
the existence of at least two parties: one who allocates responsibility and one who
accepts it with the undertaking to report upon the manner in which it has been
discharged.
Add value
Value is provided by improving opportunities to achieve organizational objectives,
identifying operational improvement, and/or reducing risk exposure through both
assurance and consulting services.
Assurance services
An objective examination of evidence for the purpose of providing an independent
assessment on risk management, control, or governance processes for the
organization. Examples may include financial, performance, compliance, system
security, and due diligence engagements.
Chief Internal Auditor
Top position within the Ministry responsible for internal audit activities. Normally,
this would be the internal audit director. (IIA International Standards for the
Professional Practice of Internal Auditing)
Compliance
Conformity and adherence to policies, plans, procedures, laws, regulations,
contracts, or other requirements. (IIA International Standards for the Professional
Practice of Internal Auditing)
Consulting services
Advisory and related client service activities, the nature and scope of which are
agreed with the client and which are intended to add value and improve an

119
organization's governance, risk management, and control processes without the
internal auditor assuming management responsibility. Examples include counsel,
advice, facilitation and training. (IIA International Standards for the Professional
Practice of Internal Auditing)
Control
Any action taken by management and other parties to manage risk and increase the
likelihood that established objectives and goals will be achieved. Management
plans, organizes, and directs the performance of sufficient actions to provide
reasonable assurance that objectives and goals will be achieved. (IIA International
Standards for the Professional Practice of Internal Auditing)
Control environment
The attitude and actions of the the Audit Committee and management regarding
the significance of control within the organization. The control environment
provides the discipline and structure for the achievement of the primaryobjectives
of the system of internal control.
Economy
Thrifty and efficient use of material resources: frugality in expenditures.
Effectiveness
Production of a decided, decisive or desired effect.
Engagement
A specific internal audit assignment, task, or review activity, such as an internal
audit, Control Self-Assessment review, fraud examination, or consultancy. An
engagement may include multiple tasks or activities designed to accomplish a
specific set of related objectives. (IIA International Standards for the Professional
Practice of Internal Auditing)

120
Engagement objectives
Broad statements developed by internal auditors that define intended engagement
accomplishments. (IIA International Standards for the Professional Practice of
Internal Auditing)
Engagement work program
A document that lists the procedures to be followed during an engagement,
designed to achieve the engagement plan. (IIA International Standards for the
Professional Practice of Internal Auditing)
Evidence
Something that is intended to prove or to provide support for some belief.
(Dictionary definition from Sawyer, Internal Audit Techniques and Practices, p.
139)
Finding
In auditing, it is used to describe the result of comparison between a criterion and
an actual situation, control or circumstance to which this criterion was applied.
(Manual on Value-for-Money Audit)
Governance
The combination of processes and structures implemented by the board in order to
inform, direct, manage and monitor the activities of the organization toward the
achievement of its objectives. (IIA International Standards for the Professional
Practice of Internal Auditing)
Independence
The freedom from conditions that threaten objectivity or the appearance of
objectivity. Such threats to objectivity must be managed at the individual auditor,
engagement, functional and organizational levels. (IIA International Standards for
the Professional Practice of Internal Auditing)

121
Internal audit activity
A department, division or team of consultants,) that provides independent,
objective assurance and consulting services designed to add value and improve an
organization's operations. The internal audit activity helps an organization
accomplish its objectives by bringing a systematic, disciplined approach to
evaluate and improve the effectiveness of risk management, control, and
governance processes. (IIA International Standards for the Professional Practice of
Internal Auditing)
Internal audit charter
An internal audit charter formally outlines internal audit’s role, responsibilities,
authority, standards and accountabilities and formalises the position of internal
audit in the entity’s governance framework.
Objectivity
An unbiased mental attitude that allows internal auditors to perform engagements
in such a manner that they have an honest belief in their work product and that no
significant quality compromises are made. Objectivity requires internal auditors
not to subordinate their judgment on audit matters to that of others. (IIA
International Standards for the Professional Practice of Internal Auditing)
Risk
The possibility of an event occurring that will have an impact on the achievement
of objectives. Risk is measured in terms of impact and likelihood. (IIA
International Standards for the Professional Practice of Internal Auditing)
Risk management
A process to identify, assess, manage, and control potential events or situations, to
provide reasonable assurance regarding the achievement of the organization's
objectives. (IIA International Standards for the Professional Practice of Internal
Auditing)
122