1

Portfolio Committee on Home Affairs

Presentation on Internal Audit

19 April 2013

Building a New Home Affairs

2

Content of the presentation

•Legislative Mandate

•Internal Audit Budget

•Internal Audit Establishment

•Compliance with International Standards

•Key actions taken to comply with ISPPIA

•Findings of the Auditor-General

•Audit of foreign missions

•Current challenges

•Remedial steps

3

Ref Description Compliance Comments

PFMA 38(1)(A)(I)

The Accounting Officer of a department must ensure that the department has and maintains effective, efficient and transparent systems of financial and risk management and internal audit”.

TR 3.2.5 The purpose, authority and responsibility of the internal audit function must, in consultation with the audit committee, be formally defined in an audit charter and be consistent with the Institute of Internal Auditors (“IIA”) definition of internal auditing

TR 3.2.6 Internal audit must be conducted in accordance with the standards set by the Institute of Internal Auditors.

Partially compliant according to the review conducted during 2010/11

Legislative Mandate

4

Ref Description Compliance Comments

TR 3.2.7 An internal audit function must prepare, in consultation with and for approval by the audit committee -

•a rolling three-year strategic internal audit plan based on its assessment of key areas of risk for the institution, having regard to its current operations, those proposed in its strategic plan and its risk management strategy.

•An annual internal audit plan for the first year of the rolling three year strategic internal audit plan.

•Plans indicating the proposed scope of each audit in the annual internal audit plan.

•A quarterly report to the audit committee detailing its performance against the annual internal audit plan, to allow effective monitoring.

Legislative Mandate

5

Ref Description Compliance Comments

TR 3.2.9 An internal audit function must report directly to the accounting officer and shall report at all audit committee meetings. The function must be independent of activities that are audited, with no limitation on its access to information.an internal audit function must prepare, in consultation with and for approval by he audit committee-

TR 3.2.10 The internal audit function must co-ordinate with other internal and external providers of assurance to ensure proper coverage and to minimize duplication of effort.

Legislative Mandate

6

Ref Description Compliance Comments

TR 3.2.11. The internal audit function must assist the accounting officer in maintaining efficient and effective controls by evaluating those controls to determine their effectiveness and efficiency, and by developing recommendations for enhancement or improvement. The controls subject to evaluation should encompass the following-

(a) the information systems environment;(b) the reliability and integrity of financial and operational information;(c) the effectiveness of operations;(d) safeguarding of assets; and(e) compliance with laws, regulations and controls.

The Auditor-General has reported that there is insufficient auditing of information systems audit, performance information as well as monthly management accounts and interim financial statements

Legislative Mandate

7

Ref Description Compliance Comments

TR 3.2.12. The internal audit function must assist the accounting officer in achieving the objectives of the institution by evaluating and developing recommendations for the enhancement or improvement of the processes through which -

(a) objectives and values are established and communicated;(b) the accomplishment of objectives is monitored;(c) accountability is ensured; and(d) corporate values are preserved.

Legislative Mandate

8

Details Total Budget Compensation Goods and Services

TOTAL 20 792 000 11 543 000 9 249 000

Internal Audit Budget

9

No of funded posts 22

No of filled posts 17

Employment offers made

•Director: IT and Continuous Audit

•Deputy Director: IT and Continuous Audit

•Office Manager

3

Current vacancies

•2 x Senior Internal Auditors

2

Internal Audit Establishment

10

34

15

Fully implemented Not Implemented No Action to be Taken

28

11

1

High Medium Low Unrated

An external quality assurance review was done in 2010. The state of play at that point compared to now is as follows:

April 2013July 2011

Compliance with the International Standards for the Professional Practice of Internal Auditing (ISPPIA)

13

• Extensively revised the Internal Audit Methodology to bring it in line with a risk-based audit approach

• Introduced checklists at critical points in the audit process to improve quality control

• Trained Internal Audit staff in the application of the Internal Audit Methodology

• Improved the systems for documenting and tracking management’s implementation of audit recommendations

• Enhanced the time management system

• Enhanced reporting to the Audit Committee

Key actions taken to comply with ISPPIA

14

• Took steps to bring in IT audit capacity

• Took steps to bring in an Office Manager to assist in monitoring of time and project management

• Took steps to reorganise internally to improve productivity

• Expanded the use of computer assisted auditing techniques (CAATs), however, there is still more room to improve the use of CAATs

• With regard to the audit of the foreign missions closer collaboration has been fostered with DIRCO Internal Audit to establish synergies

Key actions taken to comply with ISPPIA

15

No Findings Status

1 The internal audit function did not submit reports, detailing the performance against the annual internal audit plan, to the audit committee every quarter, as required by Treasury Regulation 3.2.7(d).

Resolved

2 The internal audit function did not have a three year rolling strategic plan in place, as required by Treasury Regulation 3.2.7(a).

Resolved

3 The purpose, authority and responsibility of the internal audit function were not formally defined in an audit charter, as required by Treasury Regulation 3.2.5.

Resolved

Findings of the Auditor-General

16

Findings of the Auditor-General (Continued)

No Findings Status

4 The internal audit function did not have an annual internal audit plan for the first year of the rolling three year strategic internal audit plan, as required by Treasury Regulation 3.2.7(b)

Resolved

5 The internal audit function did not evaluate the reliability and integrity of financial and operational information, as required by Treasury Regulation 3.2.11(b).

Partially resolved. As IA did not manage to execute 100% of the audit plan some of the projects related to these matters were not completed.

17

• 54 foreign missions have DHA staff performing DHA functions and are audited by DHA Internal Audit

• All other missions have DIRCO staff performing DHA functions and are audited by DIRCO Internal Audit

• Steps have been taken recently to ensure that DHA receives reports from DIRCO on the audits that they have done with regard to the DHA functions

• A risk ranking matrix for foreign missions has been implemented to inform which missions must be audited

• The following foreign missions were audited in 2010 /11: Luanda, Angola and Kinshasa, DRC

• The following foreign missions were audited in 2011 /12: Accra, Ghana; New Delhi, India and Nairobi, Kenya

• No foreign missions were audited in 2012/13 and the following audits are planned for 2013/14: Windhoek, Namibia; Maputo, Mozambique; Sao Paolo, Brazil; Canberra, Australia; Toronto, Canada and Mbabane, Swaziland.

• Asmara, Eritrea and 1 other mission to be agreed upon will be audited jointly with DIRCO Internal Audit

Audit of the foreign missions

18

• Situation of the Chief Audit Executive

• Capability of Internal Audit staff

• Quality of internal audits

• Long delays in finalising internal audit projects

• Operating model of Internal Audit

Current Challenges

19

• A process is underway to appoint an Acting Chief Audit Executive on a full time basis pending resolution of the labour relations process against the incumbent CAE

• Greater attention is being given to improve the implementation of quality assurance, time keeping and project management tools

• On going staff development programmes

• There is an increased focus on staff performance management. The Audit Committee and Executive have instructed that serial non-performers must be performance managed out of Internal Audit and possibly the department.

Remedial Steps

20

• A strategic co-sourcing model has been agreed upon. A pool of service providers will be established to supplement the internal capacity. The SCM process to give effect to this has commenced.

• The priority task of the incoming IT Audit specialists will be to design and implement a system of continuous auditing

Remedial Steps

21

THANK YOU

Questions?

Comments?

Suggestions?