COMPETENCIAS

Practice Advisory 2010-1, Linking the audit plan to risk and exposures, indicates that CAEs use the audit universe to develop the audit plan. The audit universe is a list of all the possible audits that could be performed and includes all components of the organisation’s strategic plan, from the micro level to the overall business objectives (IIA, 2010b). Since the audit universe includes the wider business environment in which the organisation operates, it also assists the IAF to gain knowledge of the business. Such knowledge helps the IAF to identify and assess the risks to the IAF customer that are present in the business environment.

150

a) Category 3: programme and operating managers

Nevertheless, one of the programme and operating managers participants stated the following:

... so they ask us “what are the risks?” (P7:6, 30:30) and then they write it down as if it were their findings … Then you give it to them and they write it down and [say] “[we] recommend the following” as if it was their findings. So that results, if you are an experienced Government Official [you know that] they have got to have something in their report, some recommendation… [So] then you feed them with the recommendations which you will do next year. So it is missing the whole purpose (P7:7, 34:34).

The above view indicates a lack of understanding on the part of the IAF that it has a responsibility to ask for management’s input so that it can use management’s risk information to develop its own risk-based plan. Hence it could be argued that management needs to understand that the IAF is not the process owner, but management’s tool for making recommendations drawn from the knowledge they have of the organisations’ systems, risk management and governance processes.

Recommendation

Since risk management is the responsibility of each and every manager in the organisation (IIA, 2009a), it is recommended that there should be some form of interaction between the IAF and the programme and operating managers in the National Treasury. This interaction would help the IAF to gain an understanding of the risks faced by the department. It is further recommended that the IAF should educate management about its responsibilities in risk management.

5.3.2.9 Training

Given the rapid rate of change being experienced in the business environment, ongoing training is vital for IAF staff in order to keep up with developments, let alone enhance their mastery of the skills required in the workplace.

151 a) Category 4: external auditors

In the discussion of customer expectations, one participant stated the following:

The [IAF needs] training on financial reporting also because it hasn’t been part of their plans on the training side (P4:25, 167:167). Actually it should be part of their responsibilities to audit controls on financial information. Yes they must be able to review the controls around it and be able to give some inputs on how to improve it. So I haven’t seen anything in that case so far. Because I remember even in the past (I think two years ago) the Director was preparing the financial information at National Treasury level and gave it to internal audit but it came back with no indicator of reviews … (P4:11, 165:165).

The key point made by the AGSA participant is that the IAF should make every effort to gain an understanding of the system of internal controls in order to provide assurance on the financial controls. The expectations of the AGSA participants are that the IAF should equip itself with current knowledge of key aspects of financial information which could assist the IAF to examine the financial controls and recommend appropriate improvements. However, the attest function (to determine whether the financial information prepared by management has been presented fairly and in accordance with the mandated reporting framework), remains the responsibility of the AGSA.

A further observation regarding the need for improving the training and education of the IAF identifies the following:

In fact they can be trained because most of them are from Technikons, those who are staffed at National Treasury, be trained … [in] financial accounting at the third [year] level, thus a basic knowledge that one should have to be able to examine or assess the financial information. So the background plays a big role. One needs to be exposed [to work-place realities] on this level and also [to formal] training. Training should be [ongoing], because there are regular updates on financial information. Regular updates where there are statements

152

being prescribed on how to treat a certain account or a certain line in the financial [statements]… (P4:26, 191:191).

From the above observation it is clear that there are some reservations about the knowledge levels on financial information reporting amongst the IAF staff at National Treasury.

Recommendation

It is recommended that the IAF staff attend refresher courses on financial information reporting and also expand their knowledge of the latest developments and requirements in this arena. An understanding of contemporary financial controls could also help IAF staff to understand the risks to the effectiveness of financial controls faced by the National Treasury. Another way of addressing the lack of training would be to allocate additional resources to the National Treasury IAF to enable them to appoint staff members already equipped with appropriate experience and knowledge.