August 2011

1

14th PASAI CongressISSAI Workshop

Sarah Lineham

Assistant Secretary-General – PASAI, Sector Manager NZ OAG

Image here

August 2011

August 2011

2Background

ISSAI = International Standard of Supreme Audit Institutions

• ISSAIs are the professional standards governing public sector auditing

• Developed by the INTOSAI Professional Standards Committee• Endorsed at XX INCOSAI in South Africa in 2010• Based on the framework for SAIs and the purpose of public sector

auditing set out in the Lima Declaration of Guidelines on Auditing Precepts 1977

August 2011

3The ISSAI Framework

Level 1 – Founding Principles

Level 2 – Prerequisites for the Functioning of SAIs

Level 3 – Fundamental Auditing Principles

Level 4 – Auditing Guidelines

August 2011

4Level 2 – Prerequisites for the Functioning of SAIs

ISSAI 10 – Mexico Declaration on SAI independence

ISSAI 11 – Guidelines and Good Practices related to SAI Independence

ISSAI 20 – Principles of transparency and accountability

ISSAI 21 – Principles of transparency and accountability – Principles and Good Practices

ISSAI 30 – Code of Ethics

ISSAI 40 – Quality Control for SAIs

August 2011

5ISSAI 10 – Mexico Declaration on Independence

• Based on the Auditing Principles of the Lima Declaration

• Contains eight core principles recognised to be essential requirements of proper public sector auditing

• Requires SAIs to protect the value of their work by adding proper safeguards and removing real and perceived barriers to their independence

• ISSAI 11 provides good practice examples to support the 8 principles of ISSAI 10 shared as a means of increasing and improving SAI independence

August 2011

6ISSAI 10 – Mexico Declaration on Independence

Summary of the eight core Principles

1 An appropriate and effective constitutional/statutory/legal framework

2 Independence of SAI heads and members

3 Sufficiently broad mandate and discretion to discharge functions

4 Unrestricted access to information

5 The right and obligation to report on work

6 The freedom to decide content and timing of audit reports and to publish and disseminate them

7 Existence of effective follow up mechanisms on SAI recommendations

8 Financial and administrative autonomy and availability of appropriate resources

August 2011

7ISSAI 10 – Mexico Declaration on Independence

ISSAI 10 Checklist

Legislation spells out the extent of SAI independence required by ISSAI 10.

If legislative framework does not establish sufficient independence to meet this standard, have you developed practices to ensure as much distance as possible is maintained between the SAI and the Executive.

Legislation specifies conditions of appointment, re-appointment, removal and retirement.

Legislation includes immunity from prosecution in relation to acts in the normal discharge of duties.

YES/NO

YES/NO

YES/NO

YES/NO

August 2011

8ISSAI 10 – Mexico Declaration on Independence

ISSAI 10 Checklist

Your SAI has an approved broad mandate and full discretion to discharge functions.

Your SAI is not involved or appearing to be involved in the management of the organisations you audit.

Do you have systems in place to ensure personnel do not develop too close a relationship with the entities they audit such as rotation policies and personnel independence declaration systems.

Does the SAI complete an annual activity report to the Legislature that is also made public.

YES/NO

YES/NO

YES/NO

YES/NO

August 2011

9ISSAI 10 – Mexico Declaration on Independence

ISSAI 10 Checklist

Is the importance of independence emphasised to SAI staff through training courses and other mechanisms that embed its importance into the organisation’s culture.

Does the SAI have adequate powers to obtain timely, unfettered, direct and free access to all necessary documents and information.

There are no restrictions on the reporting of the results of the SAI’s audit work.

Are the results of audits required by law to be reported at least once a year.

YES/NO

YES/NO

YES/NO

YES/NO

August 2011

10ISSAI 10 – Mexico Declaration on Independence

ISSAI 10 Checklist

Is the SAI free to decide the content and timing of audit reports.

Is the SAI free to publish and disseminate their reports once they have been tabled.

Does the Legislature have a review and follow up system for audit recommendations.

Does the SAI have a review and follow up system to ensure audited entities properly address recommendations.

Does the SAI have the necessary resources and ability to control its own budget.

YES/NO

YES/NO

YES/NO

YES/NO

YES/NO

August 2011

11ISSAI 20 – Principles of Transparency and Accountability

• The purpose of ISSAI 20 is to advance principles of transparency and accountability by leading by example in their own governance and practices.

• Contains nine principles recognised to be essential requirements of proper public sector auditing.

• A major challenge facing SAIs is to promote better understanding of their roles in society, to achieve this work practices, activities and products should be transparent, communicated openly and visible in the public arena.

• ISSAI 21 provides good practice examples to support the nine principles of ISSAI 20 shared as a means of leading SAIs towards the goal of transparency and accountability.

August 2011

12ISSAI 20 – Principles of Transparency and Accountability

Summary of the nine Principles1 SAIs perform their duties under a legal framework that provides for

accountability and transparency2 The mandate, responsibilities, mission and strategy of the SAI are made

public3 SAIs adopt audit standards, processes and methods that are objective and

transparent4 SAIs apply a high standard of integrity and ethics for staff at all levels5 Principles of accountability and transparency are also applied for outsourced

activity6 SAIs manage their operations economically, efficiently, effectively and in

accordance with laws and regulations and reports publicly7 SAIs report publicly on the results of their audits and on conclusions

regarding overall government activities8 SAIs communicate timely and widely on their activities9 SAIs make use of external and independent advice to enhance their quality

and credibility

August 2011

13ISSAI 20 – Principles of Transparency and Accountability

ISSAI 20 Checklist

Does the legislation and regulation guiding your SAI include terms on which you can be held responsible and accountable.

Does the SAI make publicly available the legislation under which it operates, such as on your website.

Does the SAI make publicly available details of mandate, responsibilities, mission and current strategy.

Has the SAI adopted audit standards, processes and methods that align to INTOSAI standards.

Does the SAI routinely communicate the scope of audit activities, the basis of their risk assessment and planning processes, audit objectives, methodologies, and findings to audit entities.

YES/NO

YES/NO

YES/NO

YES/NO

YES/NO

August 2011

14ISSAI 20 – Principles of Transparency and Accountability

ISSAI 20 Checklist

Does the SAI provide audit findings and recommendations to the entity for comment and discussion.

Does the SAI have effective follow up mechanisms to assess action taken in response to recommendations including entity explanation of corrective actions.

Does the SAI have an appropriate system of quality assurance over audit activities, is this system subject to periodic independent review.

Are the results of periodic independent practice reviews published.

Does the SAI have processes in place to maintain alignment of audit methodologies and internal auditing guidance with INTOSAI standards.

YES/NO

YES/NO

YES/NO

YES/NO

YES/NO

August 2011

15ISSAI 20 – Principles of Transparency and Accountability

ISSAI 20 Checklist

Does the SAI have ethical codes, policies and practices in place.

Does the SAI have a system in place to monitor and document potential conflicts of interest between staff and audited entities.

If the SAI outsources any work does it have contracting rules to ensure principles of accountability and transparency are maintained.

Does the SAI have sound internal management practices in place, including internal controls over its financial management and operations.

Are your SAI financial statements audited in a timely manner, do you measure and report on SAI operational efficiency and effectiveness.

YES/NO

YES/NO

YES/NO

YES/NO

YES/NO

August 2011

16ISSAI 20 – Principles of Transparency and Accountability

ISSAI 20 Checklist

Does the SAI make public their conclusions and results from audits.

Does the SAI maintain a strong relationship with relevant parliamentary committees, such as through regular formal and informal meetings with chairs.

Does the SAI have a process to communicate openly with the media and other interested parties on their operations and audit results.

Are SAI reports available on SAI website.

Does the SAI use external experts to provide independent expert advice on technical matters, for reviews of its operations/peer reviews.

YES/NO

YES/NO

YES/NO

YES/NO

YES/NO

August 2011

17ISSAI 30 – Code of Ethics

• The Code of Ethics is a comprehensive statement of the values and principles that should guide the daily work of auditors.

• The Lima Declaration of Guidelines on Auditing Precepts is the foundation of the Code of Ethics.

• Each SAI must develop its own Code of Ethics which best fits its environment.

• Contains five chapters covering the key concepts of fundamental importance for ethical behaviour.

August 2011

18ISSAI 30 – Code of Ethics

Summary of the five Chapters of the Code of Ethics

1 Trust, confidence and Credibility

2 Integrity

3 Independence, Objectivity and Impartiality, including political neutrality and conflicts of interest

4 Professional Secrecy

5 Competence, including Professional Development

August 2011

19ISSAI 30 – Code of Ethics

ISSAI 30 Checklist

Has the SAI adopted a Code of Ethics.

Is the SAI confident that all staff are acquainted with the adopted Code of Ethics and are held accountable for acting accordingly.

Does the SAI have systems in place to act on breaches of the Code of Ethics.

Has training on the behaviours and cultures required by the Code of Ethics been provided to all staff within the past year.

Do SAI staff understand the importance of independence and impartiality, not only in fact, but also in appearance.

YES/NO

YES/NO

YES/NO

YES/NO

YES/NO

August 2011

20ISSAI 30 – Code of Ethics

ISSAI 30 Checklist

Are all staff of the SAI maintaining both actual and perceived political neutrality.

Does the SAI have a system to monitor the receipt of gifts and gratuities.

Does the SAI have a system to manage any relationships between staff and audited entities.

Have staff been trained on the importance of protecting the confidentiality of information obtained in the auditing process.

Do SAI staff have a good understanding of the legal, constitutional, legal and institutional principles and standards governing the operations of all audited entities.

Are all SAI staff meeting the continuous obligation to update and improve the skills required to discharge their professional responsibilities.

YES/NO

YES/NO

YES/NO

YES/NO

YES/NO

YES/NO

August 2011

21ISSAI 40 – Quality Control for SAIs

• ISSAI 40 is designed to assist SAIs to establish and maintain an appropriate system of quality control which covers all their work

• For a system of quality control to be effective it must be part of a SAI’s strategy, culture and policy and procedures, so that quality is built into all the work the SAI does

• Based on the key principles of the International Standard on Quality Control ISQC 1 adapted for SAIs as necessary

• Guidelines on quality control at an individual engagement level are contained in the Level 4 ISSAIs

• ISSAI 40 sets out 6 elements of a quality control system

August 2011

22ISSAI 40 – Quality Control for SAIs

Summary of the six elements of the Quality Control Framework

1 Leadership responsibilities for quality within the SAI

2 Relevant ethical requirements

3 Acceptance and continuance

4 Human resources

5 Performance of audits and other work

6 Monitoring

August 2011

23ISSAI 40 – Quality Control for SAIs

ISSAI 40 Checklist

Does the SAI have a documented formal system of quality control that has been communicated to all staff.

Does the SAI have policies and procedures designed to promote an internal culture that recognises quality is essential in performing all of its work.

Have you as Head of the SAI taken specific steps to set a “tone at the top” that emphasises the importance of quality.

Does the SAI have sufficient resources to maintain the system of quality control within the SAI.

Does the SAI have procedures in place which emphasise the importance of meeting ethical requirements, are these requirements being demonstrated by senior staff in particular.

YES/NO

YES/NO

YES/NO

YES/NO

YES/NO

August 2011

24ISSAI 40 – Quality Control for SAIs

ISSAI 40 Checklist

Does the SAI have systems to consider the risks to quality which arise from carrying out particular work.

Does the SAI have a system to prioritise work in a way that takes into account the need to maintain quality.

Does the SAI have procedures for the acceptance and continuance of discretionary work.

Does the SAI have a regular process that it uses to assess whether it has sufficient competent and capable staff, with commitment to ethical principles to carry out its work to relevant standards.

Is the SAI active in promoting the importance of learning and training to encourage staff professional development.

YES/NO

YES/NO

YES/NO

YES/NO

YES/NO

August 2011

25ISSAI 40 – Quality Control for SAIs

ISSAI 40 Checklist

Does the SAI have policies and procedures in place that provide reasonable assurance that work is carried out in accordance with relevant standards.

Are supervision and review responsibilities clearly documented.

Are audits completed and documented in a timely manner.

Are documents retained for the periods specified in laws, regulations, professional standards and guidelines.

Does the SAI have a system to monitor the effectiveness of the system of quality control.

Has an independent review of the overall system of quality control been completed recently.

Does the SAI have procedures for dealing with complaints or allegations about the quality of work performed by the SAI.

YES/NO

YES/NO

YES/NO

YES/NO

YES/NO

YES/NO

YES/NO

August 2011

26Time for reflection

What are your SAI’s areas of strength?

How can you share your strengths to assist the development of other PASAI members?

What are the areas of weakness for your SAI?

What are your priorities for addressing areas of weakness?