of a practitioner based case study that will cover the

1 CASE STUDY AUDIT PLANNING & RISK ASSESSMENT 1. INTRODUCTION The objective of this case study is to reinforce the messages contained in the Audit Planning & Risk Assessment Guide through the completion of a practitioner based case study that will cover the following key stages in the audit planning and risk assessment cycle:  Identification of the Audit Universe and related objectives;  Identification of specific risks, the measurement of these risks and how this can be used to focus audit activities on high risk areas;  Using the risk assessment to enhance audit resource planning and allocation;  How risk assessment impacts on overall annual audit planning. 2. BACKGROUND INFORMATION & THE AUDIT UNIVERSE The table below provides information on the entities that comprise the audit universe that your internal audit unit is mandated to audit annually. However, due to a lack of resources and in recognition that not all account areas need to be audited annually you need as a first-step to critically analyse, assess and select those account areas that will be included in your annual audit implementation plan. The assumption for this case study is that the internal audit department is located in the Ministry of Transport and Roads and has the scope to engage in internal audit activities in all areas of the Ministry of Transport and Roads. Decentralised internal audit is a relatively new function in the public administration. The service was established by a Government decision in 2009 and has been operational since 2010. The year you are planning 2014 will be the fifth-year of internal audit operations.2 The decentralised internal audit department has a team of 2-auditors (one Audit Manager and one audit trainee). The Audit Manager is a member of the Institute of Internal Auditors and the other team member has a degree in economics. The internal audit department has historically concentrated its activities applying inspection and control methodologies and has limited experience of risk based audit planning and specialist audit topics. In 2014 you have a potential audit universe or scope of X processes in the Ministry of Transport and Roads. . The total expenditure budget for your Ministry for 2014 is Euro 100 m and the revenue budget is Euro 10 m. 60% (Euro 60 m) is planned to be spent on personnel costs, Euro 10 m (10%) on other nonpersonnel recurrent expenditure and the balance of Euro 30 m (30%) on capital expenditure. The income is derived from licences for personal and road haulage vehicles.3 Structure of the Ministry of Transport and Roads Minister State Secretary Secretary General Economies and Planning Department Administration and Human Recourse Department Internal Audit Department International Relation and Security Department General Directorates Air Transportation Directorate Roads Transportation Directorate Water Transportation Directorate4 Table 1: The Audit Universe Institution Budgeted Expenditure Budgeted Revenue Other Relevant Information 1. Ministry of Transport & Roads Euro 100 m Euro 10 m This Ministry is responsible for managing the government policy to upgrade the national highways to international standards. After 20-years of neglect the highway system is in poor condition and starting from 2010 the Government published plans to completely upgrade the 300 km of national highway by the end of 2015. In 2013 the Minister of Transport and Roads was dismissed by the Prime Minister and he was referred to the Anti-Corruption Commission after being accused of attempting to influence the award of road construction projects to a single contractor. The case is still being investigated and the new Minister has publicly pledged that he will ensure that all future tender processes for road construction will be transparent, fair and provide value for money. Euro 60 m (60%) has been budgeted as expenditure for personnel costs. The salaries and other emoluments are managed through a centralised agency that has responsibility for all payments for public administration employees. In previous years the payroll for this Ministry was found to contain a number of ‘ghost’ workers. However this was at a time when each line Ministry had the sole responsibility for payroll management. Since the introduction of a centralised information technology based5 Institution Budgeted Expenditure Budgeted Revenue Other Relevant Information personnel and payroll management system the controls over the entire range of personnel and payment management processes have been more effective in preventing and detecting attempts to manipulate the payroll processes. The most recent report of the Auditor General on the payroll control arrangements confirmed that the security and access controls provided a high degree of assurance in its ability to prevent and detect material fraud or other manipulations of the payroll. Non-payroll recurrent expenditure is budgeted as Euro 10 m (10%) for 2014. This amount is broken down as follows:  Fuel for Ministry transport: Euro 1 m  Utilities (Electricity, Gas, Water, Telephone and Internet: Euro 3 m  Office Supplies: Euro 4 m  Repairs and Maintenance of Ministry Transport: Euro 0.25 m  Cost of Local Travel: Euro 0.10 m  Costs of International Travel: Euro 0.25 m  Maintenance of IT Equipment: Euro 0.40 m  Subsidy to Staff Restaurant: Euro 0.10 m  Training: Euro 0.50 m  Hiring Specialist Services: Euro 0.40 m Issues relating to non-payroll recurrent expenditure from previous internal audits and reports of the Auditor General include:  The record keeping and recording of use of Ministry vehicles was6 Institution Budgeted Expenditure Budgeted Revenue Other Relevant Information poor. Most drivers did not complete the required vehicle logbooks. The amount of fuel being purchased appeared to be excessive in relation to the use of the vehicles.  The Ministry hires consultants to assist in evaluating specialist road construction tenders. The selection of the consultancy company was non-competitive and they contract was awarded for 5-years.  There were multiple instances where advances provided for local and international training were not cancelled through proof of expenditure (invoices, hotel bills air tickets etc)  There is no central procurement service in the Ministry and each division makes its own purchases. This could lead to additional costs through not taking advantage of discounts from bulk purchasing.  Many Ministry employees are provided with a mobile telephone. It was reported that monthly bills were being paid with no meaningful checks on whether the calls made were in fact official or private.  For the past 5-years, the Ministry has been using the same company to repair and maintain its vehicles.  There is no methodology for calculating the subsidy to the staff restaurant. For the past three-years the level of subsidy has been decided on an arbitrary basis by the Deputy Minister. It is rumoured that the company running the restaurant is owned by the sister of the Deputy Minister.  In 2013 the Auditor General published a performance audit report on the activities of this Ministry in respect of its effectiveness in7 Institution Budgeted Expenditure Budgeted Revenue Other Relevant Information supporting the establishment and maintenance of a standard and robust set of internal control arrangements. One of the key findings from this performance audit report was that whilst the Ministry has issued international level internal control standards it does not fully exercise an oversight role to ensure that these are being applied. The report went on to say that they found little evidence that the principles of the COSO risk management model were being fully applied. Capital expenditure is budgeted as Euro 30 m (30%) for 2014 and this is broken down as follows:  Repair of national highways: Euro 20 m  Maintenance of the road network: Euro 5 m  Purchase of 50 buses for the public transport network: Euro 5
m Issues relating to capital expenditure from previous internal audits and reports of the Auditor General include:  The Ministry has the responsibility for managing the contractors who are repairing the national highways. These management responsibilities include ensuring the quality of the repairs and that the time taken to complete the work is in-line with the contract. The Auditor General reported that due to technical capacity constraints the Ministry was ineffective in this management and supervision role.  In previous years the Ministry has been awarding highway repair8 Institution Budgeted Expenditure Budgeted Revenue Other Relevant Information contracts on a single-source basis to a local company. This company has historically been awarded 90% by value of all highway repair contracts.  The Ministry has no multi-annual plans showing a prioritized programme for road maintenance.  There is no business plan or rationale for the planned purchase of 50 buses Revenue is derived from the following sources:  Licence fees from commercial vehicles: Euro 6 m  Licence fees from private vehicles: Euro 2 m  Income from tolls on national highways: Euro 2 m Issues reported in previous years reports from internal audit and the Auditor General include:  The Ministry does not have a complete record of all private companies who have commercial vehicles and as a result the Ministry does not know how many commercial vehicles there are in the country.  The tolls for national highways are collected from drivers in cash and simple analysis appears to show that this source of income is lower than expected based on the statistics for the number and type of vehicle using the national highways.9 CASE STUDY STEP ONE: From the information above and using the ‘horizontal’ or ‘cross-cutting’ approach, identify areas that you believe could be objects of audits. In addition: try to formulate the related policy and/or operational objectives that are related to these areas. Note that you are already aware that you will not have the resources in 2014 to audit the entire audit universe. You have 30 minutes to complete this step of the case study. You can use the template below to assist in meeting this objective: REASON FOR SELECTION FOR AUDIT 2014 AREA Objective FINANCIAL RISK REPUTATIONAL RISK OPERATIONAL RISK REGULATORY OR COMPLIANCE RISK STEP TWO: You have already in Step One identified the objects from your audit universe. The next step is to identify the specific events in each of the selected areas that may generate risks to the achievement of the policy and operational objectives provided in the information above. Once you have identified the specific events that can give rise to the emergence of risk that will have an adverse effect on the achievement of an objective, you will need to assess these for impact and probability. Therefore in no more than 30 minutes and applying the requirements of the Planning and Risk Assessment Guide identify those events that may pose risks to the achievement of objectives; assess these in terms of impact and probability; and, describe the findings in a matrix that will clearly show those risks that pose the highest threat to the achievement of objectives. For assessing the impact and probability use scoring criteria as described in the Risk Assessment Guide.10 STEP THREE: Risk assessment can enhance audit resource planning and allocation. Risk assessment also has a direct impact on overall audit planning. From the information available and the outcomes of Steps One and Two, identify those generic risk factors that will help you to prioritise the areas of highest risk. This will ultimately help you to deploy audit resources to the areas of highest risk identified in your organisation. From the following list of ‘risk or selection factors’ identify the types and cycles of audits that need to be undertaken for the objects in the audit universe:  Financial materiality.  Complexity of activities.  Control environment (as defined in COSO).  Reputational sensitivity  Impact of change  Confidence in management  Exposure to fraud  Time since the last audit The outcome of this assessment may well result in you ‘correcting’ the areas selected at Step One of the case study. You have 30 minutes to complete this Step STEP FOUR: In this final step the assumption is made that a longer-term internal audit strategic plan is in place and using this translate this into an annual audit plan showing the audit assignments to be carried out in the next financial year. Applying the following principles prepare an annual audit plan for 2014 for the audits you have identified in the previous Steps of this Case Study:  The title or purpose of the audit  The length or duration of each audit  When the audit will start and when it will finish (this will include all elements of the audit cycle from planning to issuing the final report)  Resources (human and others)  Assumptions You have 45 minutes to complete this Step

Leave a Reply

Your email address will not be published. Required fields are marked *