“We’re here to help” – Audit and Oversight in the Life of the Public Service

1. “We’re here to help” – Audit and Oversight in the Life of the Public Service Andrew Graham School of Policy Studies Queens University

2. “Whenever the advance of civilization brought about the necessity of one man being entrusted to some extent with the property of another, the advisability of some kind of check upon the fidelity of the former would become apparent.” Richard Brown, The History of Accounting and Accountants, 1905

3. Audit is “ the independent objective assessment of the fairness of management’s representations on performance or the assessment of management’s systems and practices, against criteria, reporting to a governing body or other with similar responsibilities.” CCAF: “Comprehensive Auditing” What Audit is……

4. What Audit is…… • No uniform definition because it evolves even now • Four key elements of any audit: • A set of actors: managers, auditors, higher officials, oversight bodies • An accountability relationship • Maintenance of independence between auditors and subordinates • Auditors review and examination of subordinates’ execution of delegated duties and responsibilities

5. Audit as a tool in monitoring the performance of accounting • Efficacy of internal control processes – Internal Audit • Financial statements – External Audit • Ongoing quality of processes and development – GAAP and related standards • Integrity of financial information

6. Authority, Power, Resources, Goals Individuals or Organizations Accepting Accountability: Towards Whom Audit is directed Individuals or Organizations Conferring Accountability: For whom audit is performed Accountability for Performance, Results and Efficiency Auditors: responsible for auditing units/organizations on behalf of the conferring authorities Audit in the Accountability Relationships

7. The Independence of Auditors • Cornerstone of the profession but also of the function • Independence does not mean total separation – there must be degrees of separation depending on the nature of the audit relationship: internal or external auditors, process auditors versus corporate

8. The Independence of Auditors • Mixing managerial functions and auditing functions impairs objectivity • Creating boundaries often a challenge, e.g. risk assessments for development of the audit universe

9. Managers are responsible to prevent fraud and error….. • Errors are unintentional mistakes: • Clerical mistakes • Misapplication of accounting principles • Misinterpretation of information • Intentionally committed errors is fraud leading to loss of assets generally detectable by an objective or third party review of financial records

10. Managers are responsible to prevent fraud and error….. • Distortion fraud is a misrepresentation of a financial position or results not resulting in lost of assets

11. The evolution of auditing • Main purpose of auditing in public sector has been to detect fraud or misuse of public funds – either before or after the expenditure

12. The evolution of auditing • This has evolved towards more attestation to the fair representation of the organization's financial conditions and detect technical errors and errors of accounting • This has evolved into the value for money approach which calls upon auditors to assess the efficacy of programs

13. Both a systems and a transaction focus • Auditing can focus on a single transaction – either before or after it takes place – this is a probity and compliance focus based on materiality

14. Both a systems and a transaction focus • Auditing can also focus on a system to ensure that controls are in place and working thereby giving some assurance that the individual transactions are being made properly • Auditing can also focus on accounting policies to ensure that they provide the greatest transparency and reliability

15. Types of Audits • Time focus: • Pre-audit: not visible, based on risk, can be automated, closely linked to operations • Post-Audit: extensive use of sampling, higher visibility, more linked to results including compliance

16. Types of Audits • Internal: organization is the client, usually the CEO or Board, but can be at a lower level, secure checks and balances within the organization, senior management’s eyes and ears

17. Types of Audits • External: reporting to the legislature or board of the organization, high degree of independence, generally highly transparent, will have greater focus on overall results and value for money

18. External Audit in the Pubic Sector

19. Scope or Purpose of the Audit • Financial and compliance audits: focuses on the proper conduct of financial operations, either pre or post: • Validity of an individual transaction against criteria for eligibility • Individual transactions that contain exceptions that should be reported or forwarded to a higher authority for authorization • Errors, error rates and risk • Adequacy of controls • Fraud, misrepresentation or distortion of financial information • Adequacy of the security procedures

20. The Start of Value for Money Scope or Purpose of the Audit • Economy: looks at whether the organization is using the resources that it has in the best possible manner to achieve its objectives • Efficiency: were the objectives of the organization reached at the lowest cost?

21. Still in the World of Value for Money Scope or Purpose of the Audit • Effectiveness: were the results obtained consistent with stated goals? • Sustainability: have the organizations actions and use of resources put it at risk of carrying on or being able to function effectively in the future: also called stewardship

23. What is an operational audit and where does it fit in? • An operational audit is really a set of audits but focused on a unit within the organization which is • Designed to provide either senior management or the responsible manager with a full picture on the operational compliance and effectiveness of the unit

24. What is an operational audit and where does it fit in? • More inclusive than a performance audit which focuses on economy and efficiency but also focuses on other issues: financial, staff morale, infrastructure • Designed to provide a full picture of the health, strengths and weaknesses of the unit

25. What is an operational audit and where does it fit in? • Often conducted on a cyclical basis with large decentralized organizations to provide central management with ongoing picture of health of operational units • Also conducted on the assumption of a new unit head • Helpful in facilitating decentralized management of units with some degree of review and oversight from the centre • More difficult to conduct in that it is often interdisciplinary and not strictly financial

26. The Role of Risk in Auditing • Determining what gets auditing and by whom can be driven by many factors: • Public concern • Key stakeholder concerns • Specific senior management or board direction • Materiality • Sums being spent • Size of the program in terms of people affected or consequences of error • Inherent risks

27. Types of Risk • Inherent risks of the program: potential for error, complexity of calculations • Control risks: extent to which controls are in place to mitigate inherent risk and the extent to which they actually work • Detection risks: use of audits to detect possibility of overlooking a potential error or flaw, even though the evidence of one is not strong

28. The Role of Risk in Auditing • The emergence of strategic risk tools in setting audit priorities • Previous types of risk are essentially bottom-up and transaction focused with an emphasis on the accuracy of financial statements

29. The Role of Risk in Auditing • As well, they are auditor-centric in that they focus on concerns for auditors to be able to attest to the validity of financial statements, the existence of working control systems and the general absence of fraud

30. The Role of Risk in Auditing • This focuses both the auditor and management on accounting mechanisms • Strategic risk tools focus on the organization as a whole and involve all of management in determining the risk factors to the organization of not achieving its goals

31. The Role of Risk in Auditing • Internal auditors derive their work agenda from a global view of the risks in the organization that need special or continuing focus • Generally there will be a link with business planning within the organization

32. External Audit • External auditors also generally use a strategic risk approach in focusing their audit plans – this will be much more complex involving not simply what the government sets as its highest risks, but also the views of the external auditor’s own boss – the legislature and the external auditors own view

33. External Audit • This approach demands a more sophisticated use of risk assessment tools • This approach also leads to broader concerns about whether the investment is not simply accurate, but also reasonable – can lead to value for money approaches which invite auditors into the realm of program evaluation, an area where their expertise may be called into question.

34. The Role of Risk in Auditing • Benchmarks for achieving a risk focus for both internal audit and management: • • internal audit solicits line management’s perspective and concerns on the operation of key business processes; • • internal audit obtains line management view of the level of key business risks; and • • clear linkages are established between internal audit’s risk assessment and its audit plan.

35. External Review • Legislative Auditors: reporting directly to the legislature, they manage the auditor general function of the government: Auditor General, Provincial Auditor, City Auditor

36. External Review • Inspection and Monitoring Units: e.g. Best Value Inspectorate, UK, MPMP, Ontario, Vermont Social Wellbeing Index • External Audit Firms

37. External Review • Not part of the government or organizational hierarchy – accountable to the legislature/city council or board of directors

38. External Review • Roles: • Reliability of financial statements • Adequacy of management systems and practices • Legal compliance for procedures • Value for money • Specific audits as directed by the legislature

39. Third Party Accountability • Contracting for services is hardly new, just more prolific now • While challenges exist to establishing both accountability and audit requirements, they are not insurmountable.

40. Third Party Accountability • They are not negotiable in the public sector accountability context. • Need to be built into the contracting process.

41. Third Party Accountability • Have to assume that contractors will take a different perspective on accountability than a public sector organization • Similarly, public sector accountability is not costless to contracting organizations – in fact, it can be quite burdensome.

42. Third Party Accountability • Many governments are in suck and blow mode on this issue: favoring more outsourcing arrangements, but wanting risk-free, highly detailed accounting procedures

43. Third Party Accountability • Ultimately, governments and contractors need to meet the public accountability needs, but with some important features to the relationship: • Clear statements and agreements on the desired outcomes or deliverables • Clear definitions of accountability of all parties involved • Good costing and costing methodology to respond to changes • Good contract design and contract administration • Clear reporting protocols • Effective contract governance • Post-contract evaluation

44. A Word of Caution “Books and auditing of accounts, instead of exposing frauds, only conceal them; for prudence is never so ready to conceive new precautions as knavery is to elude them.”[1] [1] Rousseau, J.J., The Social Contract and Discourses (ed. G.H. Cole), 1993, London, Dent, p. 154

45. Finis