Keeping on Track:
Internal Control and Internal Audit
Budget Execution & Implementation for
Public Expenditure & Financial Accountability Course
Washington, DC: January 17, 2003
The World Bank
Presented by:
Richard Allen,
PEFA Program
Internal Control and Internal Audit
Control systems involve:
Internal Control
& Audit
Identification of Risk
Development of of
Internal Audit
Development of
Internal Controls
The World Bank
2
Risks
Going off the rail -- risks
Misuse and waste
of financial, human
and technical
resources,
including external
aid
Fraud and error
The World Bank
Lack of timely and
reliable financial
and resource
management
information
Unsatisfactory
accounting
records
3
Internal Control & Internal Audit: Professional Standards
1
INTOSAI
Guidelines for Internal Control Standards
2
Standards for the Professional Practice of Internal Auditing
See: INTOSAI at
http://www.intosai.org/ and IIA at
http://www.theiia.org/
The World Bank
4
Definition of Internal Control
A process within an
organization to provide
reasonable assurance
regarding the following
primary objectives:

The reliability and
integrity of information

Compliance with
policies, plans,
procedures, laws and
regulations

The safeguarding of
assets

The economical and
efficient use of
resources

The accomplishment of
established objectives
and goals of operations
and programs
Definition of Internal Control:
“Internal control is a management tool … the
organization, policies and procedures used to help
ensure that government programs achieve their
intended results; that the resources used to deliver
these programs are consistent with the stated aims
and objectives of the organizations concerned; that
programs are protected from waste, fraud and
mismanagement; and that reliable and timely
information is obtained, maintained, reported and
used for decision making.”
-- INTOSAI, Guidelines for Internal Control, June 1992
The World Bank
Source: The Institute of Internal
Auditors
5
Key Concepts of Internal Control
Internal control is …
… a process
The World Bank
… affected by
people. It’s not
merely policy
manuals and
procedures, but
people at every
level of the
organization
… can be expected
to provide only
reasonable
assurance, not
absolute
assurance to an
entities’
management &
stakeholders
Source: Committee of Sponsoring
Organizations of the Treadway
Commission (COSO)
… geared to the
achievement of
objectives
6
Importance of Internal Control in Government
The average Ministry has a number of responsibilities (committing funds,
recruiting staff, contracting for supplies and services, approving actions,
registering transactions and events, deploying resources and controlling,
supervising and reporting on implementation of policies).
If these responsibilities are fulfilled properly, the
result will be effective control over resources,
decisions and activities and the achievement of
ministry objectives.
Ministries
If not, abuses will proliferate and efficiency decline.
The World Bank
7
Two Principles of Internal Control
Governing
bodies of
public sector
entities need
to ensure that
a framework
of control is
established
and operates
in practice
and that a
statement on
its
effectiveness
is included in
the entity’s
annual report.
The World Bank
Governing
bodies of
public
bodies need
to ensure
that effective
systems of
risk
management
are
established
as part of the
framework
of internal
control.
Source: IFAC, Corporate Governance
in the Public Sector, 2000
8
Three Approaches to Internal Control
A. Emphasis on
controls that are
exercised by a
third party
organization, at the
center of
government, often
an agency of the
Ministry of Finance
or the MOF itself
(“Napoleonic”
tradition)
The World Bank
B. Emphasis on
responsibility for control
being decentralized to line
ministries and other
government agencies
(Anglo-Saxon,
Scandinavian tradition)
C. Mixed
approaches
(e.g., transition
countries)
9
Control Procedures

Clear instructions to staff and appropriate training on
the objectives, policies and code of conduct of the
ministry or agency

An unambiguous definition of the responsibilities of
staff

Clear separation of function and duties between staff
members in handling financial transactions or
resources issues, e.g., contracts

Development of an “open” culture to encourage staff at
all levels to draw attention to non-compliance and
irregularity

Requirements that staff at all levels are aware of and
apply all relevant instructions

Support from effective internal audit procedures
Procedures
The World Bank
10
Categories of Internal Control
Physical:
e.g., security
procedures intended
to control access to
documents and
records
Accounting Controls:
e.g., requirement for all
cash receipts to be
deposited daily in a
bank, internal
procedures to detect
and report anomalies
Process Controls:
e.g., issuance of a purchase order or the
approval of a sizeable contract may require
documentation from the requesting official,
review by a purchasing clerk, and approval
by a supervisor
The World Bank
Procurement
Controls:
e.g., rules for
advertising and
tendering major
contracts
Separation of Duties:
Both a control measure and
an indispensable element of
many control systems – at
least two officials should be
involved in any transaction to
avoid risk of improper actions
Management of
Financial & Other
Records:
Essential to establish
audit trail
11
Limitations of Internal Control
No system of internal control can
provide an absolute guarantee
against the risk of wronging or
error. The proper goal of internal
control is to provide “reasonable
assurance” that improprieties will
not occur, or if they do occur, they
will be revealed, reported and
appropriate action taken.
Wrongdoing by top
managers
Collusion
Poor response to
reported anomalies
Poor
implementation
Design flaws
The World Bank
12
Definition of Internal Audit
Internal Audit
Definition of Internal Audit:
“Internal auditing is an independent, objective,
assurance and consulting activity designed to
add value and improve an organization’s
operations. It helps an organization accomplish
its objectives by bringing a systematic,
disciplined approach to evaluate and improve
effectiveness of risk management, control, and
governance processes.”
Source: The Institute of Internal
Auditors
The World Bank
13
Internal Audit – Different Approaches
 Many countries of the
Court of Accounts tradition
have a central
(independent) internal
control agency located
within the Ministry of
Finance
 In the Auditor-General tradition,
internal audit is usually
reflected in internal audit units
of individual ministries or
agencies, reporting directly to
top management
 In some cases these have
an extensive pre-audit role
 Such internal audit units may
also exist in the Court of
Accounts tradition
 Generally wide powers of
inspection and review, and
in many cases a
prosecutorial role
 Other variations – US Inspector
General of each agency reports
to agency management and to
the Congress
 The external auditor (SAI) may
use the work of the internal
auditor
The World Bank
14
What does the Internal Auditor Look For?
Procurement
Systems &
Procedures
How well do the
systems and
procedures of
internal control
function?
Resource use
Objectives’
Achievement
Are the systems
and procedures
in place to ensure
that resources
are used in
accordance with
the relevant rules
and regulations?
The World Bank
Have programs
and actions
achieved their
intended
objectives?
In the procurement
field, has there
been adequate
publicity for calls to
tender, are there
satisfactory
procedures for
receiving and
evaluating tenders,
is the justification
for contract awards
in accordance with
national
requirements?
15
Independence of the Internal Auditor
Source: The Institute of Internal
Auditors
The World Bank

Not equivalent to the independence of the Auditor
General or President of the Audit court. The
internal auditor is responsible to the head of a
ministry or agency and is part of the staff of that
organization.

“Internal auditors are independent when they carry
out their work freely and objectively. Independence
permits internal auditors to render their impartial
and unbiased judgments essential to the proper
conducts of audits. It is achieved through
organizational status and objectivity.”

Status and “weight” of internal auditor can be
enhanced by having an audit committee chaired by
the head of the ministry or agency.

The internal auditor should not be involved in the
internal control process which he is required to
assess and judge.
16
Audit Trail

An audit trail is necessary to keep under review the timely and adequate flow of funds
and the procedures for efficient accounting and the reconciliation of expenditure
reports with funds received or claimed. It is necessary to trace or check:
To trace the
budget
provision
that
authorized
payment
The World Bank
To check the
transfer of
funds
authorized by
the treasury to
the line ministry
or agency
To trace and evaluate
the systems and
procedures through
which approval for
payment to the
contractor or
beneficiary will be
required to pass
To locate
completed
payment files with
evidence that
payment has, or
has not, been
made in
accordance with
rules and
regulations
17
Internal Audit – Issues
The World Bank

Who is in charge of internal auditing and what
are their responsibilities?

What is the desired relationship between
external and internal auditors? What information
should they share? Should they coordinate their
work programs?

How should the internal auditor fulfill his
responsibilities to senior management? What
are the limits on instructions that management
may give to the auditor?

Who should be the recipients of internal audit
reports, other than senior management?

What basic documents should the internal
auditor produce, e.g., an annual audit plan, an
annual audit report, etc.?

Should the government follow the internal audit
standards of the IIA or guidance from INTOSAI?
18
Q&A
&
Discussion
The World Bank