Internal Audit
Mini How To
Twinning Contract MT 2003 / IB / AG/ 01/TL
3 August 2004 STE Benini
General AUDIT process in Paying Agencies
Process Mapping Risk Mapping Risk Evaluation Definition of PA`s Risk Portfolio
Audit planning
Negotiate with management The risk level accepted
Audit Executions Audit Reports Audit Summaries
Negotiate Risk Level Expectations With PA`s Management
• • Assess maximum risk level which is objective to propose as acceptable In the case of a PA, this level will be probably a risk level compatible with the preservation of the PA`s accreditation by EU Risk level compatible with the mantainment of accreditation can be found in the ten EU`s guidelines for the relevant elements necessary for the accreditation process to be succesfully performed Internal Audit Manager (IAM) has the responisbility of the negotiation with the PA`s management IAM has to arrange some meeting with PA`s management IAM`s target is to define a written paper professionally known as “mandate”
•
•
• •
IAM`s Mandate
The ability of the IAM is to find a common area between three different needings (see below)
maximum Risk Level Acceptable
Internal Audit Service Skills and resources
Management`s Risk Expectations
Internal Audit Manager behaviour should be as follows:
• To obtain a mandate which is located in the central overlap of the previous slide; To obtain a mandate which is realistic, considering the skills and the resources (goods and personell) of the Internal Audit Service (IAS) To match, if possible, the risk level expectations of the PA`s management To match, at any costs, the maximum risk level acceptable for the PA`s If the former target shows too difficult to be obtained, IAM should ask PA`s managing to acquire the necessary resources or decline its responsibility
•
• • •
Control Risk and Self Assessment process
• • • • Why a CRSA? Is CRSA the best way to do it? How I can perform a good CRSA? How many time I need to update my CRSA in the five years of the planning? • CRSA is the last fashion of Internal Auditing, it is fast, effective and reasonably easy to do, it offers some advantages over the traditional approaches It depends on the level of detail you have to get in your risk mapping You have to be very methodical and to use standard forms for your relevations. Use Excel sheets, avoid Word. I suggest to build a risk database, starting from the Excel Sheets Generally It will be sufficient to do it yearly
•
•
•
CRSA structure:
Familiarization with auditated structure
Processes individuation and description
Summarize and report your conclusion
Building the excel sheets to be filled in
Conduct the interviews
Familiarization
• • • • • • • • • Go and find manuals, procedures, integrative papers Conduct pre-mapping interviews Find and study every relevant rule which governs the process Get the organigrams Try to figure some workflows out Cross verify two or more manuals, procedures and integrative papers Make preparatory summaries of you findings Design a Processes Map After you have done it all, look for confirmation of your doubts by competent people into the auditated structure
What I shall be looking for to describe a process?
• • • • • • • Who is responsible for the process? Where do it start? Where do it end? How many are the steps of the process? Which are the relations between this process and other relevant processes? Which type of process is this (Main Horizontal Process, Vertical Process, Support Process)? How may I design the form for process description?
Example of Processes Map
Maltese Paying System Processes Map
Vertical Scheme (Authorization Function – various delegated bodies)
IACS (IACS office at MRAE) Delegated body
Protocol and Folder Managing
Distribution of Withdrawal Aid of Operative Programmes in the Fisheries Sector
Technical Service (performed by separate unit into every authorization unit)
Technical Service (performed by separate unit into every authorization unit)
Execution of payments (Paying Agency) Accounting To EU (Paying Agency)
Distribution of Carry Over Aid in the Fisheries Sector
Technical Service (performed by separate unit into every authorization unit)
Production and Marketing of Honey
Technical Service (performed by separate unit into every authorization unit)
Processed Products from Fruit and Vegetables
Technical Service (performed by separate unit into every authorization unit)
Area-Related Rural Development Measures: Less-Favoured Area
Technical Service (performed by separate unit into every authorization unit)
Management of Guarantees, Debtors and Sanctions (some parts) Management of Guarantees, Debtors and Sanctions (other parts)
Rural Development Measures
Technical Service (performed by separate unit into every authorization unit)
Area-Related Rural Development Measures: Agri-Environment
Technical Service (performed by separate unit into every authorization unit)
Alimentary Aid for the Poor
Technical Service (performed by separate unit into every authorization unit)
Bovine and Ovine Aid Schemes (partially area related)
Technical Service (performed by separate unit into every authorization unit)
Market Arrangements in the Sector of Fresh Fruits and Vegetable Products
IT department IT manager (MITTS)
Delegated body
Internal Audit (It Auditor)
Support Processes
What is a risk?
• • • • • • Risk is everything can prevent you from doing something you have to do Risk can be actions, not actions, actions performed not so well, action based on misunderstanding Risk can be an unwanted heritage of your predecessors in this office Risk can be a consequency of somebody`s action outside an office (external risk) If you have a risk you have to put a control on it IAS has to map processes, then to map risks on processes, then to assess if the process owner known his risks and how he deals with them
What is a control?
• • • • • • • Something that can prevent a risk to do its job on your work Something that you can afford to put in place Something effective and efficient Something that should be multipurpose (if one control covers more than one risks it`s a better thing) Something that isn`t redundant Something of reliable Something that can be: preventive, successive, on course
Example of form for mapping
Summarize and planning
• • • • • After you have done your job you will have to classify and count your risks Find your way to classify your risks (high, medium, low or 3,2,1 level risk ecc.) Count the risks for every processes and do a media between them Obtain for each process the risk level Summarize your results with graphs and a formal paper
25 20 15 10 5 0 1st 2nd levele level risks risks 3rd level risks Process 1 Process 2 Process 3
How I can measure the weight of my risks
RISK WEIGHT=
RISK MEASUREMENT MATRIX
PROBABILITY+IMPACT
m(2)
PROBABILITY OF RISKS
h(3)
h(3)
l(1)
m(2)
h(3)
l(1)
l(1)
IMPACT OF RISK
m(2)
P 1 1 2 2 3 1 2 3 3
I 1 2 2 1 1 3 3 2 3
W 1 1 2 1 2 2 3 3 3