Generic Internal Audit Manual for Central Civil Ministries

Some activities are inherently more risk-prone than others — procurement, for instance, carries more risk than routine accounting for expenditure. A change in circumstances can also shift the risk structure: year-end expenditure, driven by the urge to avoid lapse of budget, needs closer monitoring of controls. When analysing risk, three questions are asked:

• ❓What can go wrong?
• 🎲What is the probability of it going wrong?
• ⚠️What are the consequences?

After identifying and evaluating risks, the Ministry develops a response to eliminate the risk or contain it within acceptable limits. Four options exist:

The Committee of Sponsoring Organizations (COSO) developed the internal control framework now accepted worldwide. Its five key concepts:

The manual lists common control activities worth memorising:

• ⚖️Segregation of duties — separating authorisation, custody and record-keeping roles.
• ✅Authorisation of transactions — review by an appropriate person.
• 📄Retention of records — documentation that substantiates transactions.
• 👁️Supervision or monitoring of operations.
• 🔒Physical safeguards — cameras, locks, physical barriers to protect property.
• 📊Top-level reviews — actual results vs goals/plans, periodic operational reviews, metrics and KPIs.
• 🔑IT security controls — restrict system/data access to authorised personnel (passwords, access-log review).
• 💻IT application controls — edit checks to validate data entry, numerical-sequence accounting, comparing file totals with control accounts.

To meet widely accepted norms, the manual cites four bodies' definitions of internal audit:

In government, internal audit may conduct several types of audit. The main ones:

1. Regularity Audit (audit against rules & orders) — verifies that expenditure conforms to the laws, rules and orders governing the power to sanction/incur expenditure, and that rules on service conditions, pay, allowances and pensions are followed. The auditor flags deviations and suggests remedies; further action rests with Management.
2. Propriety Audit — focuses on improper expenditure or waste even where it conforms to rules. Per Hallam, it "extends beyond the formality of the expenditure to its wisdom, faithfulness and economy." Catches improper or infructuous spending not caught by regularity audit.
3. Performance (Value-for-Money) Audit — checks whether stated objectives are achieved with due regard to economy and efficiency. Examines the relationship between inputs, outputs and outcomes against the 3 E's (see callout below).
4. Information Systems / IT Audit — determines whether IT systems are designed to achieve organisational goals; focuses on attributes of data (correct, consistent, reliable), assets (hardware & software) and resources (technological, physical, human).
5. Financial Audit — provides reasonable assurance the financial statements show a true and fair view. For government accounts, this is performed by the C&AG.
6. Grant or Contract Audits — evaluate compliance with grant conditions, the contracting process and third-party contractual performance.
7. Fraud & Financial Irregularity Audits — verify the existence and magnitude of suspected fraud/irregularities, usually triggered by discovery or suspicion.

Judgemental vs Statistical Sampling

Four common statistical sampling techniques

As government operations computerise, vast volumes of electronic data accumulate that are impractical to extract manually — and manual audit limits how much data can be audited in a given time. CAATs are computer-based tools that run tests on data or IT systems, especially useful when significant data is electronic.

• ⚡CAATs permit 100% testing of data in a short span, repeated tests on different files, and standardisation of audit activity.
• 🧮Two broad categories: add-on tools used inside already-installed programs (Excel, MS Access); and general-purpose audit software built off-the-shelf for auditors.
• 💻Commonly used general-purpose software: IDEA (Interactive Data Extraction and Analysis) and ACL (Audit Command Language).
• 🎓Internal Audit Wings should train staff to use these tools in engagements.

To provide oversight of the IAW, an Audit Committee should be constituted in each Ministry (or the mandate of an existing Standing Audit Committee enlarged). Its composition:

Rule 64 of GFR 2005 places the responsibility for sound financial management on the Secretary as Chief Accounting Authority, who must ensure full and proper records and systems affording better internal controls. The revised charter of Financial Advisers (2006) stipulates that IAWs move beyond compliance/regulatory audit to the four focus areas (assessment of controls, monitoring risk factors, value-for-money assessment, mid-course-correction monitoring). Each Ministry's manual should contain an Internal Audit Charter approved by the Audit Committee. A model charter covers:

1. Role of the function — internal audit as an independent, objective assurance and consulting activity adding value, concerned with controls that ensure: reliability/integrity of information; effectiveness/efficiency of operations; safeguarding of assets; compliance with laws, regulations and contracts.
2. Responsibilities — Programme divisions own the system of internal controls; internal audit provides assurance on the adequacy of those controls (and may consult, but never assumes the role of management).
3. Annual Audit Programme — submitted by 15 January each year through the Financial Adviser to the Audit Committee, based on the Divisions' risk assessments (or the CAE's own assessment where these don't exist).
4. Reports — issued within one week of CAE approval; significant-issue reports circulated with the Vice-Chairman's approval; an Annual Audit Review goes to the Committee Chairperson and to O/o CGA by 31 May (Annexure I).
5. Access — internal audit has unfettered access to all officers, buildings, information and documentation.
6. Independence — objective service per the Guidelines and Code of Ethics issued by O/o CGA, whose performance is periodically reviewed by O/o CGA, with results shared with the Audit Committee.

The internal audit process comprises five main phases. They can be compressed into three (planning, execution, reporting) for ease of understanding:

A typical internal audit assignment runs through seven steps (many are iterative and may not occur strictly in sequence):

1. Establish and communicate the scope and objectives to appropriate management.
2. Develop an understanding of the operational area — objectives, measurements, key transaction types — via document review and interviews (flowcharts/narratives if needed).
3. Describe the key risks facing the business activities within scope.
4. Identify the control procedures ensuring each key risk and transaction type is controlled and monitored.
5. Develop and execute a risk-based sampling and testing approach to check whether the most important controls operate as intended.
6. Report problems identified and negotiate action plans with management.
7. Follow up on reported findings at appropriate intervals (maintaining a follow-up database).

Audit planning has two levels: the macro plan (Annual Audit Programme) and plans for specific assignments. The annual programme is developed in consultation with Management, finalised by 15 January each year, communicated to auditee units with sufficient notice, with a copy to O/o CGA.

Because audit itself spends public funds, each engagement must be economical, efficient and effective. Planning an individual engagement follows a logical chain:

1. Background study & research — understand the unit's business operations, objectives, processes, policies, environment, and any significant or recent/proposed changes.
2. Preliminary analysis of key controls & risks — consider entity-wide risks identified at the institutional level; for each activity/process/system, identify control objectives and the key controls that mitigate the risks, then evaluate their design effectiveness.
3. Develop engagement objectives, scope, criteria and approach — the objective is a broad statement, often a question the auditor seeks to answer, with a conclusion drawn for each objective. The work must yield sufficient evidence to meet the objectives.
4. Finalise the audit plan — a detailed scope statement describing the areas/processes/systems covered, the time period and locations, and any areas excluded from scope.

Once the programme is finalised, it is communicated to auditee units 30 days before commencement (a questionnaire may accompany it).

A Commencement Letter, addressed to the highest individual responsible for the function/department, is sent at least a month before the audit. It includes:

• 🎯Objective of the audit.
• 📐Scope and the period it covers.
• ⏱️Estimated duration.
• 👥Names of auditors — especially the Team Leader.
• 📅Information on entry and exit conferences.
• 📄Request for necessary information and documents.

The engagement normally starts with an entry conference between the auditors and the Head of Department/Office. Its purpose is to establish an appropriate environment: auditors communicate the proposed objectives and scope, seek to understand the organisation's objectives and risk-management practices, learn of areas of special concern, and settle logistics (a nodal officer for space, records, meetings). The conference validates information gathered during planning and gauges attitudes toward controls.

Reliability is influenced by source (internal or external) and nature (visual, documentary or oral). The manual's reliability hierarchy:

• 🌐Evidence from external sources (e.g. third-party confirmation) is more reliable than from the entity's records.
• 🔗Evidence from the entity's records is more reliable when the related accounting and internal-control systems operate effectively.
• ✅Evidence obtained directly by the auditor is more reliable than that obtained by or from the entity.
• 📄Documents and written representations are more reliable than oral representations.
• 📑Original documents are more reliable than photocopies, telexes or facsimiles.
• 📊Large samples are more reliable than smaller ones; statistical samples more persuasive than non-statistical.

Working papers are the supporting documents for the whole engagement — they provide a complete audit trail, demonstrate how the audit was performed, and contain the evidence behind the Summary of Observations and the final report. They must be indexed, referenced and cross-referenced to the relevant observations. They sit in two files:

Audit reports are the end products. They must be accurate, objective, clear, concise and complete and issued timely (normally within a fortnight of completing the engagement). Satisfactory performance of the auditee should also be acknowledged. Key formal requirements:

• 📑Cover page legend: "Internal Audit Report of ___ for the period ___", plus the date of issue.
• ⚖️States the responsibility split: management owns internal controls & financial statements; the auditor's job is to express an opinion on the efficiency of internal controls in achieving management objectives.
• ✅Approved by competent authority, signed by the designated authority, addressed per the Internal Audit Charter.
• 📊Carries an Executive Summary — objectives, scope, summary of observations, highlighting those needing immediate senior-management action.
• 📝Issued in the format prescribed by O/o CGA (Annexure II); fact-based, free of personal criticism, constructively worded.

Every observation is developed with the 5-C framework — a logical chain from what was expected, through what happened, to what should be done:

1. Criteria — "What should exist?" The benchmarks or expectations against which audit evidence is compared (policy, norm, SOP).
2. Condition — "What exists?" The factual evidence found; identifies the nature and extent of the observation — the result of comparing actual evidence with criteria.
3. Consequence / Effect / Impact — "What effect did it have?" The risk or exposure from the gap between criteria and condition; often quantitative. The effect must be serious enough to justify the cost of correction.
4. Cause — "Why did it happen?" The likely reason for the gap. Similar causes across observations may reveal an underlying theme; identifying the cause is a prerequisite to a meaningful recommendation.
5. Corrective Action / Recommendation — "What should be done?" Actions to correct and prevent recurrence — within the client's scope, addressing the cause not the symptoms, and at least intuitively viable.

The true achievement of an audit is reflected in implementation of its recommendations and an improved control system — this phase must not be underestimated. There must be a defined time-frame for Action Taken Reports (ATRs). The IAW examines ATRs and offers comments to the administrative division; monitoring of audit paras also aims to resolve old paras, watched closely by the Pr.CCA/CCA/CA.

Quality assurance operates at four levels, each with its own control objective, the party responsible, and the level that receives assurance:

Performance can be evaluated on several key areas (a balanced scorecard approach helps, supplemented by customer surveys to managers after each engagement and an annual survey to the Audit Committee):

Eight parameters drive the staffing requirement of an IAW (worked out into man-days against available working days — Annexure III):

1. Number of audit units.
2. Number of employees in each audit unit.
3. Budget of each audit unit.
4. Inherent risks in the functioning of each audit unit.
5. Time required to complete an engagement (including travel).
6. Time required for report writing.
7. Time reserved for training and continuous professional education.
8. Period that may be spent on leave etc.

The Annual Review highlights important irregularities (each ≥ Rs. 1 lakh) under ten distinct headings — a useful checklist of what internal audit looks for:

1. Non-recovery of Government dues (from Central/State Govt., Govt. bodies, private parties).
2. Overpayments.
3. Idle machinery / surplus stores.
4. Loss / infructuous expenditure.
5. Irregular expenditure.
6. Irregular purchase.
7. Non-adjustment of advances (Contingency, TA, LTC advances).
8. Blocking of Government money.
9. Non-accountal of costly stores / Government money.
10. Any other item of special nature.

A memorable box (by Richard Chambers of the IIA) on report-writing craft — worth internalising for the principle that reports must drive action, not impress: