Governance and Internal Audit

1
Governance and Internal Audit

• Financial Management Institute of Canada
• The State of Internal Audit in the Public Sector
  - the Provincial Experience
• November 24, 2005
• Fred J. Dunn, FCA
• Auditor General of Alberta

2
Introduction

• Recent work of Office of the Auditor General
• Recruiting, evaluating and training board members
• Assessment of audit committees
• Internal audit in the government of Alberta
• Observations about internal audit in Alberta
• OAG and internal audit

3
Recruiting, Evaluating and Training Board Members

• Report summarized in 2005 Annual Report
• Full report on our website
• Examined the practices of 20 departments and
  provincial agencies, boards and commissions

4
Audit Process

• Developed and agreed audit criteria these were
  based on best practice
• Focused on sample of Alberta governing boards
• Conducted survey, interviews and examined
  documentation

5
Recruiting, Evaluating and Training Audit -
Background

• Expectation to improve governance in public
  sector is increasing
• Members of boards want to do a better job have
  experienced changes in the private sector
• Increasing expectations for improved performance
  by internal audit

6
Recruiting, Evaluating and Training - General
Observations

• Solid base of directives and guidance on
  governance principles in Alberta public sector
• However, governance principles and practices have
  changed in the last few years
• One change in the private sector is for boards to
  publicly report on their governance practices
• Public sector boards evaluation of performance of
  the board as a whole and each member varied
• Public sector boards training varied - no central
  source of training information

7
Recruiting, Evaluating and Training Findings

• Recruiting - Some organizations were not
  following important elements of the existing
  directive.
• Evaluating - In cases, processes were deficient
  or were not implemented.
• Training - Orientation was good continuous
  training was inconsistent.
• Limited external reporting on boards performance
  against governance principles.

8
Recommendations

• Two key
• Update governance principle and guidance for
  Alberta boards
• Boards publicly report their performance against
  principles

9
Supplemental Recommendations

• Update recruitment directive and commit to follow
  it
• Publicly report recruitment process
• Government should provide guidance on board
  evaluations
• Boards should look at their evaluation systems in
  light of guidance
• Boards should establish independence policy and
  annual signoff
• Boards should carry out evaluation and report
  results to Minister
• Government needs help with boards training
  opportunities and best practices
• Boards should follow best practice in training

10
Assessment of Audit Committees

• In 2003, we reported that public sector audit
  committees needed to improve
• Full report on our website well received across
  public sector
• Improvements have been made mandates, skills,
  questioning, assessments
• Audit committee is the key stakeholder of
  internal audit
• Key observation in our report on internal audit
  performance focuses on audit committee

11
Assessment of Audit Committees

• Recommended that guidance be provided by
  government
• Recommendation was accepted
• Proposed Guidance for Audit Committees of the
  Government of Alberta Agencies, Boards and
  Commissions (CCAF Publication)

12
Internal Audit in the Government of Alberta

• Report summarized in 2005 Annual Report
• Full report on our website
• Examined 11 public sector internal audit
  departments (all of them)
• Examination included
• 11 organizations surveyed (Audit, Audit
  Committees, Management)
• 9 Departments in-depth examinations
• 3 Departments in-depth and audit file
  examinations
• Used IIA standards as basis for examinations
• Separate report to each organization

13
Criteria Established

• Formally document and communicate expectations of
  audit committee
• Terms of of reference exist for internal audit
• Organizational independent
• Audit committee/internal audit relationship
  formally set out
• Managements internal audit relationship
  formalized
• Risk based plans annual and long-term
• Internal audit should examine risk management,
  controls and governance processes
• Accurate, objective complete and timely reports
• Code of conduct exists
• Sufficient capacity
• Follow standards in executing work
• Have quality assurance programs

14
Audit Process

• Criteria sent to internal auditors for comment
• Sector wide assessment
• Surveys
• Interviews
• Examination of documents
• File reviews
• Discuss and report findings

15
Internal Audit - General Observations

• Key observation Audit Committees need to
• be explicit about their expectations of internal
  audit. e.g.
• identify which systems they want assurance on
• state the type and frequency assurance
• demand value for money
• ensure internal audit independence
• support internal audit recommendations and
  observations/concerns
• ensure internal audit has the resources needed
• ensure that terms of reference and mandate are
  complete and consistent with expectations

16
Internal Audit Expectations

• Internal auditors must respond to audit
  committees expectations, by
• recognizing their role as advisors to the
  committee
• focusing on key risk of organization
• providing focused plans and reports
• acting independently and critically of management
• ensuring that their practice meets professional
  standards

17
Internal Audit - Findings

• IA charters were ambitious
• Situations existed that may impair auditor
  independence and objectivity
• Some committees and key executives expected more
  value
• Many organizations were recruiting IA resources
  but were not able to find qualified applicants
• Deficiencies existed in audit approaches, however
  IA recommendations were still valued

18
Recommendation

• Government to provide guidance to audit
  committees on oversight of internal audit
• Guidance to include related training opportunities

19
Internal Audit History

• Created a number of internal audit departments in
  70s and 80s
• Varying quality
• Some were places to warehouse employees
• Some were progressive
• Serviced management
• Little role for audit committees
• Early 90s saw sharp reduction in number
  general cost cutting
• Renewal of internal audit in last couple of years
• Office is encouraging renewal
• Major pressure is private sector changes moving
  to public sector

20
Observations about Internal Audit in Alberta

• Strength of departments vary, but all are
  interested in doing better job
• Real issue is adapting to changing standards and
  guidance no substantive external force like
  private sector thus change is internally
  motivated
• Somewhat of a culture shift for management
  adjust to more independent audit
• New departments opening up more demand in an
  already difficult market to obtain internal
  auditors
• Some innovation in resource sharing emerging
  more needed
• I see unsatisfied need for internal audit in
  medium sized organizations

21
OAG and Internal Audit

• Review all final internal audit reports
• Rely on the work of internal auditors
• Can publicly report results of internal audit
• if we audit an area and as part of the audit
  choose to rely on internal audit
• internal audit recommendations are not being
  acted on by management

22
Case Study OAG and OCIA Collaboration

• Persons with developmental disabilities
  authorities (PDD Boards)
• Boards governed organizations
• Deliver serviced through contracted agencies
• Issue was that service providers were not
  complying with contracts
• Using funds for services to clients for other
  purposes
• Joint project teams
• We provided forensic expertise
• OCIA provided audit staff
• Used opportunity to develop investigation skills
  in OCIA
• Major report item in Offices 2004 Annual Report

23
Case Studies of Reliance

• Large Post-secondary
• Has outsourced computer services
• Internal audit carries out examination of service
  providers controls
• We rely on the work
• Also, we rely on detailed audit of research
  expenditures
• Financial Instruction
• Branch based services deliver model
• Internal audit examines branches compliance with
  policies
• Rely on this work
• Also rely on internal audit work on loan files
• Reliance not new telecom in the 80s

24
Summary

• Covered
• Board Recruitment, evaluation and training audit
• Audit committee report
• Examination of internal audit
• My Office and its relationship with internal
  audit
• In my opinion internal audit is an important
  mechanism for audit committees to meet their
  mandate
• Internal audit is important to senior management
  as well
• If internal audit does not or is not allowed to
  operate consistent with the IIA standards then
  its value impaired
• We work with internal auditors when ever possible
• I am open to questions

25
Questions?