|
|
|
3. Policy Objective and Results
7. Treasury Board Secretariat Centre of Excellence for Internal Audit
Appendix A - Definition of Assurance Services
Appendix B - Internal Auditing Standards for the Government of Canada
Appendix C - Guidelines for Departmental Internal Audit Committees
Appendix D - Guidelines for Departmental Internal Audit Management Practices
This document contains the entire text of the Policy as revised on April 1, 2001. This policy replaces Chapters 1 and 2 of the "Review" volume of the Treasury Board Manual dated July 31, 1994.
The tabling in March 2000 of "Results for Canadians: A Management Framework for the Government of Canada" reinforced the Government's commitment to continuous management improvement and accountability for results. In this context, it identified the need for a better-positioned and strengthened internal audit function. An effective internal audit function across government will contribute significantly to the achievement of the government's management framework and support key objectives such as the implementation of modern comptrollership and results-based management.
Historically, the internal audit function in the federal government has primarily focused on reporting on identified problems and providing recommendations for remedial action. While these will continue to be important elements of internal audit, this Policy affirms the repositioning of the function as a provider of assurance services to departmental senior management. Essentially, assurance services are objective examinations of evidence for the purpose of providing an independent assessment of the soundness of risk management strategies and practices, management control frameworks and practices, and information used for decision-making and reporting. Internal audit differs from evaluation, which focuses on helping managers track and report on actual performance, and on helping decision-makers objectively assess program or policy results.
Assurances provided by the internal auditor, through audit engagements, provide management confidence on the soundness of management processes within the organization. They will also guide management in determining where the organization is most exposed to risk, and what remedial actions are available and appropriate. As the relevance of assurances provided are dependant on their timeliness, areas of higher risk and fundamental departmental financial and management systems need careful consideration in the department's risk assessment processes to ensure that assurances provided in these areas are still relevant.
The provision of assurance services by internal audit can only be properly implemented over time, as the capacity to meet the objectives and standards contained in this policy is developed and as departmental management practices and performance information improve. To be effective in this regard, the internal audit function requires the active involvement and support of senior management.
Within the context of "Results for Canadians", Treasury Board Secretariat has a responsibility to actively monitor the soundness of the government-wide management and control frameworks. In this regard, the Secretariat will rely heavily on the assurance work performed by departmental internal audit groups. This active monitoring process will also require the Secretariat to work closely with departments to ensure that Treasury Board is aware of significant issues of risk or other problems in a timely manner, and that appropriate remedial action plans are developed and successfully implemented.
To provide departmental management with objective assessments about the design and operation of management practices, control systems, and information, in keeping with modern comptrollership principles and thereby contributing to the government's continuous management improvement program and accountability for results.
It is government policy that departments:
This policy applies to organizations considered to be departments within the meaning of section 2 of the Financial Administration Act.
Deputy heads are accountable for establishing an appropriately resourced internal audit function that operates in accordance with this policy, including the standards contained in Appendix B. Deputy heads must also:
Deputy heads must also ensure that the Treasury Board Secretariat is:
The Treasury Board Secretariat, through its Centre of Excellence for Internal Audit and following a horizontal management process with departments will:
Deputy heads are responsible for monitoring the performance of their department in respect to this policy.
In monitoring the effectiveness of this policy, the Treasury Board Secretariat will be guided by the requirements of the Internal Auditing Standards for the Government of Canada (Appendix B) and guidelines for departmental internal audit committees and departmental internal audit management practices (Appendices C and D respectively).
An internal audit advisory committee comprised of government and private-sector senior executives will be established to provide advice to the Treasury Board Secretariat on internal audit policy, standards, community development strategies and benchmarks to be used in examining government-wide performance in meeting the objectives of this policy.
This policy will be evaluated and reviewed within 5 years. The Treasury Board Secretariat Centre of Excellence for Internal Audit is to establish the framework that will guide the evaluation of the policy.
This policy is issued pursuant to paragraph 7(1)(a) of the Financial Administration Act.
Official Languages Act
Access to Information Act
Privacy Act
Institute of Internal Auditors (IIA). Standards for the Professional Practice of Internal Auditing
Canadian Institute of Chartered Accountants (CICA) Handbook
Results for Canadians: A Management Framework for the Government of Canada
Study of Internal Audit in the Federal Government, January 2000
Report of the Independent Panel on Modernization of Comptrollership in the Government of Canada
Enquiries about this policy should be directed to:
Centre of Excellence for Internal Audit
Comptrollership Branch
Treasury Board of Canada Secretariat
L'Esplanade Laurier
140 O'Connor Street
Ottawa, Ontario
K1A OR5
e-mail: ias-svi@tbs-sct.gc.ca
facsimile: (613) 952-3247
This policy identifies the prime role and responsibility of the internal audit function in the Government of Canada, as the provider of professional assurance services to departmental senior management. Assurance services are objective examinations of evidence for the purpose of providing an independent assessment of risk management strategies and practices, management control frameworks and practices, and information used for decision-making and reporting.
Assurance services are provided through audit engagements, where the internal auditor is mandated to issue a report that contains an overall conclusion in relation to specific and suitable criteria. Generally, there are two types of audit engagement:
Audit engagements performed by departmental internal audit functions have in the past been mostly to identify problems and recommend corrective action. In providing assurance services, the provision of specific findings and recommendations continue to be an important part of the overall internal audit report.
Audit engagements should be structured to the specific needs of the organization, as determined through risk assessment analysis and consultation with senior management. The deputy head of the organization should be recognized as the principal user of the audit engagement, although central agencies, Parliament, and the general public should also be recognized as potential users.
A number of prerequisites must be met before an audit engagement can be properly provided by the internal auditor, including:
It would not be cost-effective to undertake an audit engagement to provide assurance where it is clear at the outset that it is highly unlikely that the expected conclusion, in relation to appropriate criteria for the engagement, can be provided. In such cases a consulting engagement focused specifically on identifying problems and deficiencies that need to be corrected, and making appropriate recommendations to raise the capacity of operations to the appropriate level, would be a better use of internal audit resources.
Over time, as the capacity of departmental and agency operations and the capacity of the internal audit function increases, it is expected that most audit engagements would include a statement of assurance by the internal auditor.
In theory, the internal audit practitioner is able to vary infinitely the level of assurance being provided in an audit. Absolute assurance is not attainable as a result of factors such as the use of judgement, the use of testing, the inherent limitations of control and the fact that much of the evidence available to the internal auditor may be persuasive rather than conclusive in nature. Assurance will also be influenced by the degree of precision associated with the subject matter itself.
In order to help the users better understand the level of assurance being provided, it is suggested that assurance be provided at one of two levels of assurance, a higher level and a more moderate level.
A higher, though not absolute, level of assurance is provided by designing procedures so that in the internal auditor's professional judgement, the risk of an inappropriate conclusion is reduced to a lower level through procedures such as inspection, observation, enquiry, confirmation, computation, analysis and discussion.
A more moderate level of assurance is provided by designing procedures so that, in the internal auditor's professional judgement, the risk of an inappropriate conclusion is reduced to a more moderate level through procedures which are normally limited to enquiry, analysis and discussion.
Both types of audit engagements can be completed with either a higher or a more moderate level of assurance. The level of assurance appropriate for a particular engagement will depend on the needs of departmental or agency management, and the nature of the subject matter.
In an audit engagement, in order for meaningful conclusions to be reached, they need to be made in relation to a set of suitable criteria. Criteria are benchmarks against which the subject matter can be assessed.
The internal auditor should always attempt to identify criteria that yield useful information to departmental or agency management. The lack of suitable criteria may result in inappropriate conclusions being drawn by the internal auditor. When examining possible criteria for an audit engagement, the internal auditor is to assess the reliability, neutrality, understandability, and completeness of the criteria. Preference is to be given to the use of generally accepted criteria when they are consistent with the objective of the audit engagement. In the federal government environment, generally accepted criteria could be those established by:
When there are no generally accepted criteria consistent with the objective of the audit engagement, and criteria from other sources are identified, then the internal auditor should obtain from departmental or agency management an acknowledgement that the criteria are suitable for the engagement.
In some circumstances, the internal auditor may not be able to provide the desired level of assurance, without reservation, in an audit engagement. When in the professional judgement of the internal auditor there is insufficient appropriate evidence to provide assurance or there is evidence that one or more of the audit criteria are not met, then a reservation is to be included in the audit report. In all other regards the report should respect the reporting standard as described in Appendix B of this policy.
If, in the professional judgement of the internal auditor, the level of assurance originally planned in an audit engagement cannot be provided or it is not cost-effective to do so, then the internal auditor should advise the departmental or agency audit committee. The internal auditor should provide the internal audit committee with and explanation of why the planned level of assurance cannot be provided and indicate if another level of assurance or another type of engagement is more appropriate.
There will continue to be engagements undertaken by internal audit, that are planned and conducted for reasons other than providing assurance. Examples are control self-assessment activities, forensic auditing, and other management assistance engagements.
Internal audit consulting engagements that do not provide an overall conclusion, should clearly state that fact in the report that is issued.
The following are the internal auditing standards to be met by each department. Deputy heads are accountable for ensuring that their department's internal audit function accomplishes its responsibilities and:
The following are the reporting standards to be met by each department. Deputy heads are accountable for ensuring that departmental internal audit reports:
Completed internal audit reports are ones that have been approved by the internal audit committee, and have the required management action plans if such are required. In any situation where a management action plan is not forthcoming, the reports are to be presented without further delay to the audit committee for timely approval as a completed report, and to the deputy head to ensure that necessary actions are taken. All completed reports are to be made easily accessible to the public in a timely manner and in both official languages.
The Institute of Internal Auditors maintains and continually updates Standards for the Professional Practice of Internal Auditing. These standards are recognised internationally as containing sound guidance for internal auditors. Internal auditors in the Canadian Government are to utilise these standards in carrying out their internal auditing responsibilities, wherever these standards are not in conflict with this policy and any related guidelines or other guidance provided by TBS.
The internal audit policy requirements call for an active audit committee that is chaired by a senior departmental executive.
The role of the departmental internal audit committee includes:
The responsibilities of each internal audit committee need to be determined by each department. Within the department these responsibilities could include:
The deputy head has the responsibility for deciding who will be the chair of the audit committee. In most departments, the deputy head or associate deputy head chairs the committee. It is important that the chair bring as much independence and objectivity to the committee as possible, and not be an individual whose direct responsibilities include department-wide functional activities subject to frequent audit.
Committee members should generally be at the assistant deputy head level or equivalent, and are selected, on the basis of their individual abilities, experiences and interest, as being most able to effectively contribute to the activities of the committee. An audit committee composed of members below these levels risks the perception that there is little support for internal audit by senior management and the likelihood that internal audit will be focused on matters of little interest to the deputy head.
The size of an effective internal audit committee varies, from three to five members plus the chair, depending on the size of the department.
As required, the Treasury Board Secretariat and the Office of the Auditor General are to be provided with access to the audit committee to address matters of mutual interest or concern.
In addition to meeting the requirements of this policy, including the standards contained in Appendix B, departments should consider developping their own departmental internal audit policy. The departmental internal audit policy should set out the mandate of the internal audit function and identify the:
The departmental internal audit annual plans that outline the planned activities for the year should:
