Response to Question 10 and its addendumFirstly, to be formal, here are two definitions form our
Role of the Head of Internal Audit document
http://www.cipfa.org.uk/roleoftheHIA/download/Role_of_the_HIA.pdf:
Internal auditAn assurance function that provides an independent and objective opinion to the organisation on the control environment, by evaluating its effectiveness in achieving the organisation’s objectives. It objectively examines, evaluates and reports on the adequacy of the control environment as a contribution to the proper, economic, efficient and effective use of resources.
Control environmentComprises the systems of governance, risk management and internal control. The key elements include: establishing and monitoring the achievement of the organisation’s objectives;
the facilitation of policy and decision-making ensuring compliance with established policies, procedures, laws and regulations – including how risk management is embedded;
ensuring the economical, effective and efficient use of resources and for securing continuous improvement; the financial management of the organisation and the reporting of financial management; and, the performance management of the organisation and the reporting of performance management.
NB these definitions came about before our recent moves to collaborate with the IIA, but are broadly in the same territory.
What they do point to is a developed view of Internal Audit and Internal Control (IA and IC from now on) that clearly differentiated between internal control (as a management environment) and internal audit (that provides assurance on how well that environemnt is being maintained). This viewpoint is present in the PIFC agenda (Robert de Koning for the EC) that has been widely promulagated as part of the EU accession process (though it appears less visible once that process is completed,
discuss).
A key factor in my opinion is the recognition that IC is a management function and for it to operate successully and to be properly monitored by an independent IA unit requires a pretty well-developed management infrastructure the like of which is unlikely to exist in many transition or developing countries. Such a structure would have levels of delegation of trust and responsibility as well as idividual managers (financial and otherwise) with devolved scope to make decisions and to manage effectively. In many of the places we are talking about this freedom simply does not exist or is restricted to mayors and ministers who exert what they consider as
internal control with unyielding vigour. Internal control can become the new vocaulary for authoritarian inspection regimes whose main ambition is to punish the guilty rather than bring about improvements to systems. By the way, it may not always a great idea for inspectors to be recruited to the audit ranks (but sometomes it cannot be avoided). I am grateful to Noel Helpworth for reminding me of all these basics recently in relation to South East Europe.
In designing reform programmes (and evaluating progress) it is necessary consider where the country has started from and move forward accordingly (whether using platforms or not). It is a good idea to evauate the management and public administration context and progress before setting up more demanding structures (like IA) that have little chance of survival without a favourable management environment. DFID have been through phases of fixation with
Political Economy but in the case of IC and IA some understanding of the political context is justified. A notable Auditor General from Southern Europe has been vocal in his emphasis on the need for Parliaments to be considered in reform programmes - this would certainly help in informing these key stakeholders about the destinctions between IC and IA and the outcomes to expected from them.
So to get back to the question(s) in hand - we need to get closer to the broad public administration and public management agendas (recognising that PFM reforms may have to tread water to let these others catch up) to make a case for IC and then IA as being more appropriate to the second or third platforms (or phases); with only scene setting of the basics taking place initially. This is all very locally contextual and there have been examples where IA has developed more effectively than others (e.g. Slovenia). IA
is a relatively new phenomenon and it has resonated well in the western (particulary Anglo-Saxon) world but it might not suit every circumstance or be the panecea for every form of management. For example, in the UK, audit committees are the norm for public sector bodies but they have found much less traction elsewhere.
I would conclude by pointing out that the IC/IA area is far richer than one might expect at first sight and coping with it in the field requires an appreciation of cultural and political context in addition to good PFM skills. I wonder if contributors to this Board have any really good examples of the successful implementation of IC environments with commensurate quality of IA review and opinion?
