October 2015

INTERNAL AUDIT AGENCY (IAA)

THEME: INTERNAL AUDITING: AN EFFECTIVE MANAGEMENT TOOL FOR GOOD GOVERNANCE

10TH ANNUAL INTERNAL AUDIT FORUM

PRESENTATION BY:R. KWAME ASANTE

ON:IMPLEMENTING AUDIT RECOMMENDATIONS:

CHALLENGES AND WAY FORWARD

© RKA 2015

OUTLINE OF PRESENTATION

0.0 OBJECTIVE OF PRESENTATION

1.0 INTRODUCTION

2.0 AUDIT REPORT IMPLEMENTATION COMMITTEE (ARIC)

3.0 PUBLIC ACCOUNTS COMMITTEE (PAC)

4.0 CHALLENGES

5.0 THE WAY FORWARD

6.0 CONCLUSION2

© RKA 2015

0.0 OBJECTIVE OF PRESENTATION

Ladies and Gentlemen, I have been tasked to do a presentation on the topic“Implementing Audit Recommendations: Challenges and the way forward, withinthe overall theme: Internal Audit; An Effective Management Tool for GoodGovernance.

I believe that the reference to Audit Recommendations will cover both Internal AuditWork and Reviews and, the Recommendations arising out of the work of theAuditor-General in relation to the public sector organizations (i.e. MDAs andMMDAs, Independent Constitutional Bodies, Government Business Enterprises,Public Corporations, Organizations, Institutions and Entities subsisting on PublicFunds).

The presentation will seek to highlight the audit operational framework and contextand the challenges therein and drawing on the practice and experiences within ourPublic Sector.

3

© RKA 2015

1.0 INTRODUCTION

1.1 Governance/Stakeholders

Just to throw in some context for our discussion today, I will definegovernance as “describing the role of the persons and institutions entrustedwith the supervision, control and direction of an entity.” So depending onjurisdiction different bodies have different responsibilities forCorporate/Institutional governance.

Thus in Ghana, the following could be involved in the process of preparing accounts, audit, investigations and reviews and the implementation of audit recommendations and subsequent follow up actions.

Executive Management of various Government Agencies

Boards/Board Committees

Internal Audit Units

4

© RKA 2015

1.0 INTRODUCTION (Cont’d)

Audit Report Implementation Committee (ARIC)

Internal Audit Agency

Auditor-General’s Department

Institute of Chartered Accountants/Members

Parliament/Public Accounts Committee

Attorney-General’s Department

The Judiciary/Public Tribunals

Institute of Internal Auditors and their members

Association of Internal Auditors of Metropolitan, Municipal and District Assemblies (MMDAs)

Sector Ministers/Ministries

Office of the President

5

© RKA 2015

1.0 INTRODUCTION (Cont’d)

1.2 Role of Audit in Corporate Governance

Risk is inherent in the decisions that an organization takes to manageand run its business and in the business processes established to assistin the achievement of its business objectives. The economicslowdown in recent years; and the various fraud, related bankruptcyand poor performance of Institutions have led Board and AuditCommittees to leverage the internal audit function to mitigate a widearray of risks that businesses and institutions face.

The Institute of Internal Auditors (IIA) describes internal audit as anindependent, objective assurance and consulting activity designed toadd value and improve an organization’s operations.

6

© RKA 2015

1.0 INTRODUCTION (Cont’d)

1.2 Role of Audit in Corporate Governance (Cont’d)

The Institute of Internal Auditors (IIA) describes internal audit as an independent,objective assurance and consulting activity designed to add value and improve anorganization’s operations.

The scope of internal auditing within an organization is broad and covers anorganization's governance; risk management and management controls;efficiency/effectiveness of operations (including safeguarding of assets); thereliability of financial and management reporting; and compliance with laws andregulations. Internal auditing may also involve conducting proactive fraud audits toidentify potentially fraudulent acts; participating in fraud investigations under thedirection of fraud investigation professionals, and conducting post investigation fraudaudits to identify control breakdowns and establish financial loss.

7

© RKA 2015

1.0 INTRODUCTION (Cont’d)

1.2 Role of Audit in Corporate Governance (Cont’d)

Consistent with its mission, the Internal Audit Unit provides management withinformation, appraisals, recommendations, and counsel regarding the activitiesexamined and other significant issues.

Internal auditors typically issue reports at the end of each audit that summarizetheir findings, recommendations, and any responses or action plans frommanagement.

The internal audit activity helps an organization accomplish its objectives bybringing a systematic, disciplined approach to evaluate and improve theeffectiveness of risk management, control and governance processes.

8

© RKA 2015

1.0 INTRODUCTION (Cont’d)

1.2 Role of Audit in Corporate Governance (Cont’d)

1.2.1 Quality of Internal Audit Report

I will want us to take some time to look at what a good audit report should have as this affect the final implementation.

a) Objectivity - The comments and opinions expressed in the Report should be objective and unbiased.

b) Clarity - The language used should be simple and straightforward.

c) Accuracy - The information contained in the report should be accurate and factual.

d) Brevity - The report should be concise.

e) Timeliness - The report should be released promptly immediately after the audit is concluded, within a month.

9

© RKA 2015

1.0 INTRODUCTION (Cont’d)

1.3 Audit Recommendations/Implementation

Basic to effective audit work are recommendations that, which when adequatelyimplemented will accomplish defined and worthwhile results. AuditRecommendations must state a clear convincing and workable basis forimplementation. The utility and continued relevance of recommendations should becontinuously re-evaluated as follow up actions progress.

The recommendations in an internal audit report are designed to help anorganization achieve effective and efficient governance.

Audit findings and recommendations tend to relate to particular assertions abouttransactions, such as whether the transactions audited were valid or authorized,completely processed, accurately valued, processed in the correct time period, andproperly disclosed in financial or operational reporting, among other elements.

10

© RKA 2015

1.0 INTRODUCTION (Cont’d)

1.3 Audit Recommendations/Implementation (Cont’d)

It is an entity’s responsibility to manage the implementation of auditrecommendations to which it has agreed, including determining an appropriatestrategy to help achieve timely and effective implementation. Primary responsibilityfor implementing audit recommendations lies with senior Management in theorganization and also the business unit subject to the audit.

While the implementation of audit recommendations is a managementresponsibility, the internal audit function is well placed to monitor the progress ofimplementation. Effective monitoring requires a system that accurately tracksprogress and records the actions of program managers responsible for progressingaction against timeframes.

11

© RKA 2015

1.0 INTRODUCTION (Cont’d)

1.4 Audit Institutions

1.4.1 The Internal Audit Agency (IAA)

The Internal Audit Agency, Act 2003 (Act 658) established the Internal AuditAgency (IAA) as an oversight body with a mandate to co-ordinate, facilitate andprovide quality assurance for internal audit activities in Ministries, Departments andAgencies (MDAs) and Metropolitan, Municipal and District Assemblies (MMDAs).

As required by the Act, IAA provides a means for keeping the MDAs and MMDAsfully and currently informed about problems and deficiencies related to theadministration of their programmes and operations and the necessity for appropriatecorrective action.

Upon carrying out its mandate, the IAA reports to the Head of the various publicorganizations and agencies and makes recommendations on how to improve theirinternal processes and adhere to best standards and practices.

12

© RKA 2015

1.0 INTRODUCTION (Cont’d)

1.4 Audit Institutions (Cont’d)

1.4.2 The Ghana Audit Service (GAS)

(a) Under existing governance arrangements, the assurance-seeking activity of citizens hasexclusively been conferred on the Office of the Auditor-General. In Ghana’s case, thisfunction has not only been provided for in the Constitution but has also been entrenchedby the Constitution. The Auditor-General is thus required by the Constitution to auditannually the public accounts of Ghana and of all public offices including the Courts,Central and local government administrations, the Universities, public institutions,corporations and companies or any body or organization established with public funds, inother words, the funds of the people or citizens.

(b) The Auditor-General is to report his findings and recommendations from auditsundertaken by his Office to Parliament, which is expected to debate this on behalf ofcitizens, as received and presented by the Public Accounts Committee and appoint,where necessary, in the public interest, a Committee to deal with matters raised.

13

© RKA 2015

1.0 INTRODUCTION (Cont’d)

1.4 Audit Institutions (Cont’d)

1.4.2 The Ghana Audit Service (GAS)

(c) An Audit Report Implementation Committee for each audited body ororganization established under the Audit Service Act, 2000, Act 584, isrequired to follow up on recommendations of the Auditor-General endorsedby Parliament and provide information, through the relevant sector Minister,to the Office of the President, Parliament and the Auditor-General, actiontaken on the report of the Auditor-General.

(d) In subsequent reports to Parliament, the Auditor-General is required to statewhether appropriate action has been undertaken to his satisfaction.

14

© RKA 2015

2.0 AUDIT REPORT IMPLEMENTATION COMMITTEE (ARIC)

This entity is so key and impacts the ability to effectively implement audit findingsand recommendations.

A corporate governance practice common in the private sector is the use of auditcommittees which have greatly strengthened the independence, integrity, andeffectiveness of audit activities by providing independent oversight of the internaland external audit work plans and results, assessing audit resource needs, andmediating the auditors’ relationship with the organization.

It is as a result of the above coupled with the attestation that Audit Committeescould be used as an Effective Management Tool for Good Governance that led tovarious Bodies and Governments across the Globe insisting on the establishment ofAudit Committees to play a similar role in the Public Sector.

Thus the framers of the Ghana Audit Service Act, 2000 (Act 584) introduced AuditReport Implementation Committee (ARIC) into the Public Service to perform therole of Audit Committees in the Private Sector.

15

© RKA 2015

2.0 AUDIT REPORT IMPLEMENTATION COMMITTEE (ARIC) (Cont’d)

2.1 What is ARIC?

Section 30 (1) of the Ghana Audit Service Act, 2000 (Act 584) mandates aninstitution, body or organization which is subject to auditing by the Auditor-General to establish an ARIC. Section 16 (8) of the Internal Audit AgencyAct, 2003 (Act 658) also highlights the need for all MDAs and MMDAs toset up ARICs. This is to augment the call by the Institute of InternalAuditors, International Frame work for Professional Practice (IPPF) ofinternal auditing requiring organizations to have effective AuditCommittees.

The composition of various ARICs is defined in an operating guidedeveloped by the IAA and the Audit Service, which is typically a minimumof five (5) members.

16

© RKA 2015

2.0 AUDIT REPORT IMPLEMENTATION COMMITTEE (ARIC)

2.2 Roles/Duties of ARIC

The role of the Audit Report Implementation Committee (ARIC) as defined bySection 30 (2) is that “It shall be the duty of the Audit Report ImplementationCommittee to ensure that the head of an institution, body or organization to whichsubsection (1) applies”:

a) pursues the implementation of matters in all audit reports as well as the Auditor-General's reports endorsed by Parliament as well as financial matters raised inthe reports of internal monitoring units in the institution, body or organization;and

b) annually prepares a statement showing the status of implementation ofrecommendation made in all audit reports as well as the Auditor-General'sreports which have been accepted by Parliament and any other related directivesof Parliament.

17

© RKA 2015

2.0 AUDIT REPORT IMPLEMENTATION COMMITTEE (ARIC)

2.2 Roles/Duties of ARIC (Cont’d)

The above duties are complimented by Section 30 (3)-(4) of the Ghana Audit ServiceAct, 2000, which requires that the above statement shall show remedial action taken orproposed to be taken to avoid or minimize the recurrence of undesirable features in theaccounts and operations of the institution, body or organization and the time frame foraction to be completed, whiles Section 30 (4) of the Ghana Audit Service Act, 2000requires that the statement referred to in sub section (3) shall be endorsed by therelevant Minister and forwarded to Parliament, Office of the President and theAuditor-General within six months after Parliamentary decisions on the Auditor-General's report.

2.3 Evaluation of ARICs

The Auditor-General is to evaluate the performance of the ARIC annually to ensurethat they perform effectively and that MDAs and MMDAs benefit from the work ofARICs.

18

© RKA 2015

3.0 PUBLIC ACCOUNTS COMMITTEE (PAC)

This discussion will not be complete without discussing the role of PAC in theimplementation of Audit Recommendations.

The evolution of the proceedings of the PAC to a point where PAC opened itsproceedings to the public significantly boosted Parliament’s effort to promoteaccountability, combat corruption, strengthen budgetary oversight and improveresource allocation.

The primary function of the Committee according to Order 165(2) is to examine theaudited accounts of government showing sums granted by Parliament to meet publicexpenditure and of such other accounts laid before Parliament.

The Public Accounts Committee (PAC) is thus one of the key accountabilityCommittees of Parliament.

19

© RKA 2015

3.0 PUBLIC ACCOUNTS COMMITTEE (PAC) (Cont’d)

The recommendations of the PAC which after the adoption of theCommittee’s Report by Parliament becomes the recommendations ofthe House are then forwarded to the Auditees for implementationthrough the ARICs.

It appears from the provisions of the Constitution and the StandingOrders of Parliament that the Committee’s work is limited toexamining only reports presented by the Auditor-General (A-G).However, many have questioned if it will not be proper for the PAC tocarry out pre-emptive investigations in the performance of its functionas a watchdog Committee of Parliament in matters of public finance.That debate rages on.

20

© RKA 2015

4.0 CHALLENGES IN IMPLEMENTATION OF AUDIT RECOMMENDATIONS

4.1 Tone at the Top

The benefits of an audit and the successful implementation of auditrecommendations can best be achieved with Management support.

(a) The Management of MDAs and MMDAs in Ghana however, are so constrainedand by their action or inaction impede the successful implementation of Auditrecommendations. There is sometimes:

Lack of appreciation of the Internal Audit function resulting in weaksupport by Management.

Lack of commitment and political will.

Conflict of Interest issues

Delays due to their divided attention on numerous activities

21

© RKA 2015

4.0 CHALLENGES IN IMPLEMENTATION OF AUDIT RECOMMENDATIONS (Cont’d)

4.1 Tone at the Top (Cont’d)

Lack of understanding of the requisite standards and the resources required to implement process improvements.

Lack of effective monitoring systems (Non performance appears not to be a big issue in the public/civil service).

Untimely preparation and submission of Audit Reports (over 3 to 6 months reporting after end of audit period).

Lack of cooperation among key stakeholders.

(b) In the first place, poor record keeping and late submission of financial statements to theAuditor-General for Audits to be conducted renders most recommendations arisingtherefrom meaningless and impractical.

(c) Thus, the reports to Parliament by the Auditor-General are usually far back in time tomake findings of PAC relevant to minimizing the losses to the State in some cases.

22

© RKA 2015

4.0 CHALLENGES IN IMPLEMENTATION OF AUDIT RECOMMENDATIONS (Cont’d)

4.2 Quality of Audit Recommendations

Poor quality reporting such that the audit findings gets disputed and auditrecommendations do not get implemented. These may arise as a result of thefollowing:

a) Inexperience of auditors/poor skills and training of Inter Audit staff.

b) Lack of auditors knowledge of the MDAs/MMDAs practical workingenvironment

c) Unclear audit objective at the planning stage of the assignment

d) Lack of report writing skills

e) Unmotivated/Demotivated Auditors

f) Recommendations do not address the weaknesses reported in the factualfindings.

23

© RKA 2015

4.0 CHALLENGES IN IMPLEMENTATION OF AUDIT RECOMMENDATIONS (Cont’d)

4.3 ARIC’s Role in the Implementation of Recommendations

(a) For some institutions, the ARICs do not take their mandate from the Board of Directors.Nor do they report back to the Board Directors. This undermines the implementation ofaudit recommendations and undermines governance.

(b) Lack of adequate knowledge and skills among members of ARIC

(c) Independence of members of ARIC may be compromised

The independence to instruct either the Chief Director or the Honourable Minister ondelicate issues in their presence for obvious reasons.

(d) Lack of proper understanding of the role of ARIC

(e) Non-performance of the assigned role and responsibilities

Some Members sometimes may not be committed to the course in terms of dedicatingsufficient time to the work of the ARIC.

24

© RKA 2015

4.0 CHALLENGES IN IMPLEMENTATION OF AUDIT RECOMMENDATIONS (Cont’d)

4.5 Commitment of Established Accountable Institutions

Some established Accountable Institutions like, the office of the President,Parliament, Judiciary, Internal Audit Agency and the Auditor General, may not haveshown any sign of their commitment to the activities of the ARIC as follows:

a) ARIC annual reports sent to them may not even be acknowledged, let alone bereviewed.

b) Evaluation of the ARIC which is backed by Section Act 584 may not have beendone by the Auditor General.

25

© RKA 2015

4.0 CHALLENGES IN IMPLEMENTATION OF AUDIT RECOMMENDATIONS (Cont’d)

4.6 Lack of Resources to Finance the Implementation Process

a) The ARIC itself depends on management to call meetings to discuss theimplementation status of some recommendations. Unsupportive managementmay only call for a meeting only when it suits them.

b) The Audit Committees are sometimes starved of resources to the extent thatmeetings are not held and follow up on audit recommendations becomes aproblem (this happens in most of the Assemblies).

c) Allowances and logistic to organize meetings are provided by managementwhich could easily affect the Committees independence.

26

© RKA 2015

5.0 THE WAY FORWARD

5.1 Tone at the Top

Firstly, Management accountability must be improved and the GoverningBoards and Management Support to implement recommendations must beforthcoming.

The necessary resources and tools should be available.

The implementation of audit recommendations is a managementresponsibility and effectively supervised and monitored by the Board.Government Agencies cannot refuse to implement the recommendations inthe Auditor-General’s reports. It is not a matter of choice.

27

© RKA 2015

5.0 THE WAY FORWARD (Cont’d)

5.2 Quality Recommendations/Reporting

Auditors can do a great deal to improve the likelihood that audit recommendationswill be appropriately implemented through the quality of the recommendations.

Basic to effective audit work are recommendations that, when adequatelyimplemented, accomplish a defined and worthwhile result. They must state a clear,convincing, and workable basis for implementation. Their utility and continuedrelevance should be re-evaluated as follow-up actions progress.

Whether audit objectives are achieved depends on the quality of therecommendation. A recommendation that is not convincing may not beimplemented. A recommendation that does not correct the basic cause of adeficiency may not achieve the intended result.

28

© RKA 2015

5.0 THE WAY FORWARD (Cont’d)

5.2.1 Properly Directed Recommendations

Recommendations should be directed to those who have responsibility and authorityto act on them. They must be clear about who the action person is. For example,“We recommend that the Director of Finance should……’’. The purpose of this is toensure that responsibility for the recommendation is properly laid on the door stepof the responsible officer.

5.2.2 Management Response

Response such as “Noted” is not a good enough management response. It is noncommittal. Auditors should request for responses that demonstrate managementacceptance of the change recommendation.

29

© RKA 2015

5.0 THE WAY FORWARD (Cont’d)

5.3 Aggressive Monitoring and Follow-ups

Acceptance of a recommendation does not ensure results; effective implementationdoes. Continued attention is required until results are achieved.

The audit organization should have a system that provides the structure anddiscipline needed to promote action on audit recommendations. It should ensurethat recommendations are aggressively pursued until they have been resolved andsuccessfully implemented. Also, auditors should assess whether the agencies theyaudit have a follow-up system that adequately meets their basic responsibility forresolving and implementing audit recommendations.

Institutions entrusted with additional monitoring responsibilities should also get towork.

30

© RKA 2015

5.0 THE WAY FORWARD (Cont’d)

5.4 Special Attention to Key Recommendations

While all recommendations require follow-up, some deal with particularly fraud, andother serious or scandalous matters. They should receive special attention.

Auditors should follow up to ensure that key recommendations are fairly andtimeously implemented. They should reassess strategies to get positive action onthose recommendations. Outside intervention should be considered when it wouldhelp to get necessary action on key recommendations of great significance.

5.5 Hard-Hitting Recommendations

There should be no doubt that a recommendation has been made. Recommendationsshould be clearly labelled as such, not hidden, or obscured by text. They should bereadily identifiable and stand out in the report.

31

© RKA 2015

5.0 THE WAY FORWARD (Cont’d)

5.6 The Role of ARIC

(a) ARICs must be empowered to have a legal mandate and authority to perform theirduties, and also the sanctioning process in the public sector needs to be reviewed andstrengthened. Fraud cases should be quickly referred to the established Tribunal fortrial.

(b) Composition of ARIC membership should focus on persons with extensiveknowledge and understanding of the MDA/MMDAs risks, control and governanceprocesses and with good financial and auditing background.

ARIC members must be motivated enough to elicit their full commitment.

Adequate Resources to finance audit recommendations implementation must beensured, and this should include servicing of ARIC meetings.

Full commitment from the Accountable Institutions like the Office of thePresident, Parliament, Judiciary, Internal Audit Agency and the Auditor-General’s Department is needed.

32

© RKA 2015

5.0 THE WAY FORWARD (Cont’d)

5.7 Punitive actions should be meted out to institutions which fail toeffectively carry out significant portions of recommendations madeto them. For instance, money appropriated to the institutions couldbe withheld until they effectively implement the recommendations.Management promotions, rewards and continued appointment asManagers may be tied to the successful implementation of auditrecommendations as a key performance indicator.

5.8 Timeframe to Complete the Audit/Implementation Process

With all the good intentions of the various Stakeholders, I estimatethe timeframe to complete the process from the end of a financialyear to full implementation as follows:

33

© RKA 2015

5.0 THE WAY FORWARD (Cont’d)

This timeframe has the potential of affecting the implementation ofrecommendations and must be shortened.

Action Timeframe

1. End of the Financial Year 0

2. Institutions Present/Submit Accounts for Audit 3 Months

3. Audit completed by the Auditor-General’s Dept 2 – 3 Months

4. Report Submitted by the Auditor-General to Parliament 2 – 3 Months

5. Parliament completes its processes and endorses the Recommendations 2 – 3 months

6. Work of ARICARIC completes its review work

ARIC prepares reports, endorsed by Sector Minister and forwarded toParliament, Office of President and Auditor-General’s Department

6 Months

7. Follow-up/Monitoring of Recommendations 6 Months

34

© RKA 2015

6.0 CONCLUSION

6.1 In concluding ladies and gentlemen, I will entreat us as professionalauditors to ensure that as we carry out our mandates as enshrined in thelaw and as citizens of our dear nation Ghana not to compromise on thequality of our audit, upholding our integrity and applying professionalismin carrying out our work, so that those who are entrusted with the publicpurse are made to account.

6.2 Implementing audit recommendations is the responsibility of the Boardsand the Management of the various MDAs and MMDAs.

6.3 I will also like to pose the following questions for further discussions:

(a) Should the Auditor-General go beyond his statutory and constitutionalmandate to actively go after those cited for infractions in his AuditReport to Parliament?

35

© RKA 2015

6.0 CONCLUSION (Cont’d)

(b) What should be done to ensure that financial statements are presented on timeto close the gaps between the date accounts are presented by the institution foraudit and the time taken to audit, the submission of reports to Parliament andsubsequent work done thereon, and when the implementation of therecommendations by ARICs actually kick-in?

(c) How do we deal with the backlog of unpresented accounts to the Auditor-General for audit and the many recommendations seemingly not implemented?The MMDAs/MDAs must be compelled to prepare and submit their financialstatements for Audit within a specific time or face sanctions.

(d) How does the Auditor-General ensure the full implementation of itsrecommendations? Immediately, it should.

Ensure the establishment of ARICs in all the Government Agencies itconducts audits

36

© RKA 2015

6.0 CONCLUSION (Cont’d)

Review the reports of the ARICs which have completed their work

Undertake the evaluation of all ARICs as contained in the Act.

6.4 What should be the role of PAC?

(a) Should it extend beyond the naming and shaming platform offered bythe public hearings to monitoring and ensuring the implementation ofthe recommendations?

(b) Should PAC carry out pre-emptive investigations in the performance ofits functions as a Watchdog Committee of Parliament in matters ofPublic Finance?

.

37

© RKA 2015

6.0 CONCLUSION (Cont’d)

6.5 What sanctions should be applied to Heads of Institutions who refuse toimplement audit recommendations?

6.6 Collaboration between Auditor-General, PAC and the Executive

Set up special Task Force(s) to ensure the implementation of the manyrecommendations still pending, at least those endorsed by Parliament.

38

© RKA 2015

THANK YOU

39