Operational Manual for Internal Audit in Central Ministries

The Pr. CCA / CCA / CA, in their capacity as CAE, perform all activities of the head of the wing:

• 📋Planning the internal audit.
• ✅Communication and approval of the plans.
• 🤝Resource management for the wing.
• 📝Laying down policies and procedures for the IAW.
• 📤Coordination and reporting to senior management and the Audit Committee.
• 🎯Quality assurance across the wing.

Four hard reporting obligations sit on the CAE — three quarterly, one annual:

An Internal Audit Team headed by the CAE should comprise at least five officials:

• 📝Develop and document an audit plan (including RBIA) for each engagement — objective, scope, quantum, timing, resource allocation.
• ✅Ensure assignments are initiated per the approved plan and established notification, standards, policies and procedures.
• 🔍Ensure the team obtains all relevant information to fix objective, scope, methodology and resources.
• 🏢Understand the entity's mandates, risks, structure, internal control and ongoing issues — and brief the team before the assignment.
• 📊Maintain and update Risk Registers for all audit units, schemes, programmes and projects based on findings and feedback.
• 🎓Continuously review team performance; provide training on schemes, programmes and audit tools.
• 📄Finalise standard report templates; maintain records of reports/findings; ensure timely action by audit units.
• 📤Share important findings with other teams and with the IAD in O/o CGA for cross-Ministry learning.
• 📅Compile the wing's year-end performance into an annual review report for the Chief Accounting Authority / Audit Committee, then to O/o CGA.
• 📧Start every assignment with an Audit Memorandum drafted by the wing.

1. Issue the audit memorandum at least one month before the planned audit, so the entity can prepare.
2. Discuss the plan with members; finalise audit strategy (objectives, scope, quantum).
3. Attend the entry conference on day one — introduce the team, discuss issues, learn the entity's functions, status of past findings and high-risk areas.
4. Guide staff in developing the plan and a checklist of questions; personally audit key activities / risk areas.
5. Assign each member specific responsibilities in writing; supervise every phase; review and approve working papers and primary observations; ensure sufficient evidence.
6. Conduct a formal exit conference; brief the entity head on objectives, findings, recommendations; consider the entity's views and additional facts.
7. Ensure the draft report uses the prescribed template, is presented to the CAE with working papers and evidence on time, and that the approved report is issued within the prescribed timeline.

• 📝Carry out duties assigned in writing, verified fully per audit methodology.
• 📖Verify that prescribed records, books and ledgers are accurately maintained, compiled and reconciled; scrutinise sanctioning and purchase procedures for defects.
• 💰Verify payments are correct per rules, and that deductions and recoveries are timely accounted for.
• ⚙️Verify general office-management procedures with financial/accounting implications; suggest tightening of controls and streamlining of accounting.
• 📋Review scheme/programme implementation against notified guidelines; record observations within scope.
• 📁Maintain working papers, collect relevant evidence, and develop observations under the Team Head's guidance.

Checklist 1 makes sure the team has answered the foundational questions before fieldwork. The key planning considerations:

1. Categorise & risk-rate units. Have audit units been identified by category, with audit plans per category, and a risk rating/register driving selection of units, processes and areas?
2. Document each engagement. Is there a well-developed, documented plan per engagement including objectives, scope, timing and resource allocation?
3. Map objectives, controls, risks. Have the program's objectives, the controls ensuring achievement, and the significant risks (to the activity, its objectives, resources and operations) been assessed — including whether governance, risk management and control are adequate and working?
4. Preliminary survey & risk assessment. Was a preliminary survey conducted and its results used to find areas of emphasis? Was a preliminary risk assessment of the scheme/program done in the planning stage?
5. Engagement objective covers all risks. Does the engagement objective include every significant risk found in the preliminary risk assessment?
6. Working-paper file ready. Before fieldwork, does the file contain the Audit Planning Memo (APM), Preliminary Survey findings (with the Risk Assessment Report), Engagement Terms of Reference (TOR), and the Engagement Program?

The CAE builds a risk-based Annual Audit Plan on an understanding of the auditable unit's strategies, objectives and risk framework — then supplements it with a 3-Year Rolling Audit Programme. Key features:

When developing the plan, the CAE weighs these factors:

• ⚠️Inherent risks — identified and assessed?
• 🛡️Residual risks — identified and assessed (after controls)?
• 🔗Mitigating controls, contingency plans, monitoring — linked to individual events/risks?
• 📊Risk registers — systematic, complete and accurate?
• 📄Documentation — are the risks and activities documented?

A documented engagement work program must include:

A sound internal control framework helps a Ministry meet its compliance, financial-reporting and operational goals, minimise surprises, and deal with change. During evaluation the auditor checks that controls achieve six objectives:

The wing evaluates internal controls through four means — questionnaires/checklists, flow charts/narratives, facilitated workshops, and control self-assessment (Checklist 3 supports this; a sample self-assessment is Exhibit II).

Before conducting RBIA, the wing must be able to answer: what is the Ministry's risk maturity? Has risk profiling been done and to what extent can it be relied on for planning? Do individual audits assure that all inherent risks above the risk appetite are managed down to within it?

Judgemental vs Statistical Sampling

Common statistical sampling techniques

As Government operations computerise, huge volumes of electronic data accumulate that are impractical to extract manually. CAATs are computer-based tools that run tests on data or IT systems — especially useful when significant data is electronic.

• ⚡CAATs permit 100% testing of data in a short span, repeated tests on different files, and standardisation of audit activity.
• 🧮Two broad categories: add-on tools used inside existing programs (Excel, MS Access); and general-purpose audit software built off-the-shelf for auditors.
• 💻Commonly used general-purpose software: IDEA (Interactive Data Extraction and Analysis) and ACL (Audit Command Language).
• 🎓Wings should train staff to use these tools in engagements.

A Commencement Letter, addressed to the highest individual responsible for the Ministry/Department/Scheme, must include:

• 🎯Objective of the audit.
• 📐Scope and the period it covers.
• ⏱️Estimated duration.
• 👥Names of auditors — especially the Team Leader.
• 📅Information on entry and exit conferences.
• 📄Request for necessary information and documents.

The engagement normally starts with an entry conference with the Head of Department/Office. Points to cover: proposed objectives and scope; the entity's risk-management practices; areas of special concern; logistics (a nodal officer for space, records, meetings); the principal risks being audited; processes included and excluded; special considerations (C&AG findings, recent frauds, major system changes); the approach and testing plan; the communication/reporting strategy; and the auditee representative who will coordinate management action plans.

Field work begins with an approved Audit Programme and standardised checklists for recurring schemes. The CAE ensures: staff interviews identifying detailed objectives, risks and high-risk areas; an agreed audit scope (reasons, objectives, main stages, staff and time, client contact, timetable with draft/final report dates); sufficient and appropriate evidence; adequate supervision scaled to proficiency and complexity; objective sampling at desired confidence; and minuted meetings kept as working papers.

Evidence must be relevant to the audit objectives, drawn from appropriate sources, and free of unacceptable risk of improper findings, significant limitations, or an inadequate basis. The manual's hierarchy of reliability:

• 🌐Evidence from external sources is more reliable.
• ✅Evidence obtained directly by the auditor is more reliable.
• 📄Original documents are more reliable than copies.
• 📊Larger samples are more reliable than smaller ones.
• 🔗Reliability rises when accounting and internal-control systems operate effectively.

The auditor performs walkthrough tests to confirm processes, surfaces any new risks, and identifies the controls that should operate to manage them plus the monitoring management uses. Tests of control effectiveness are defined and run, with special attention to controls carrying a high control score. The standard: documentation must let an experienced auditor with no prior connection understand the nature, timing, extent and results of procedures, the evidence obtained, its source, and the conclusions reached.

Working papers must be indexed, referenced and cross-referenced to the relevant observations. They split into two files:

A formal exit conference concludes field work. With key officials, the team discusses the Draft Audit Report, obtains their views and any additional facts, and records any disagreements with reasons. The exit conference is minuted, the minutes go into the working papers, and a copy is given to the Department.

• ⏱️Results must be communicated in a timely manner.
• 📝Final communication must contain an opinion and/or conclusions; an overall opinion must account for the Ministry's expectations and be supported by sufficient, reliable, relevant, useful information.
• ⚠️The reason for an unfavourable overall opinion must be stated.

Every audit observation is developed with reference to engagement objectives using five C's. They form a logical chain — from what was expected, to what happened, to what should be done:

1. Criteria — "What should exist?" The benchmarks or expectations audit evidence is compared against (policy, SOP, norm).
2. Condition — "What exists?" The factual evidence found, stating the nature and extent of the observation — the result of comparing actual evidence with criteria.
3. Consequence / Effect / Impact — "What effect did it have?" The risk or exposure from the gap between criteria and condition; often expressed quantitatively. The effect must be serious enough to justify the cost of correction.
4. Cause — "Why did it happen?" The likely reason for the gap. Similar causes across observations may reveal an underlying theme; identifying the cause is a prerequisite to a meaningful recommendation.
5. Corrective Action / Recommendation — "What should be done?" Actions to correct the situation and prevent recurrence — within the client's scope, addressing the cause not just the symptoms, and at least intuitively viable.

Follow-up closes the loop. The CAE conducts follow-up of previous reports and communicates the findings. For the current report there must be a defined time-frame for Action Taken Reports (ATRs), and those timelines must be adhered to.

• 🎯A QAIP evaluates the wing's conformance with the IPPF Standards and whether auditors apply the Code of Ethics.
• 📈It assesses the efficiency and effectiveness of the activity and identifies improvement opportunities.
• 📝The CAE must develop and maintain a QAIP covering all aspects of the internal audit activity (IIA Standard 1300), and it must include both internal and external assessments (IIA Standard 1310).

The CAE must approve a documentation policy — consistent with organisational guidelines and regulatory requirements — governing custody, retention and release of engagement records. It must cover:

• 📄Sufficient, reliable, relevant documentation to support engagement results and conclusions.
• 🔒Controlled access to records — and approval of senior management and/or legal counsel before releasing records to external parties.
• 🗓️Retention requirements for records (regardless of storage medium), consistent with organisational and regulatory rules.

Reports are issued in the format prescribed by O/o CGA. To be effective they must be complete, concise, accurate and objective, issued timely, fact-based, free of personal criticism, constructively worded, with recommendations focused on achieving objectives.

What the quality check verifies

• 📑Cover page states "Internal Audit Report of ____ for the period ____", plus date of issue.
• ⚖️Clearly states the responsibility split: management owns internal controls and financial statements; the auditor's job is to express an opinion on the efficiency of internal controls in achieving management objectives.
• ✅Approved by competent authority, signed by the designated authority, and addressed per the Internal Audit Charter.
• 📊Supplemented by an Executive Summary (objectives, scope, summary of observations).
• 🔴Uses colour coding (Red, Orange, Green) for significance/risk; develops observations via the 5-C framework; uses photographs where useful.
• ✅Acknowledges satisfactory performance and best practices; brings out any scope limitation.

This checklist lets O/o CGA evaluate a wing's performance. Highlights worth remembering:

A gender audit examines two sets of dimensions — what the programmes do, and how the organisation is set up.

The CAE assesses whether the audit plan covers the Ministry's governance processes and their risks — so the wing helps the Ministry be accountable and transparent while achieving objectives effectively, efficiently, economically and ethically. Three core questions drive it:

• 📝Has the policy been implemented as intended?
• 💰Are funds being spent for the intended purpose?
• 🛡️Are managers implementing effective controls to minimise risks?

Scheme audit works from two angles — the beneficiary's experience and the auditor's verification.

The Exhibits are full worked samples an auditor can adapt directly. Knowing what each contains is enough for revision:

The RKVY register is the clearest illustration of how risk is recorded. Each row carries the following columns — worth memorising as the standard structure:

1. Sub-process — the activity (e.g. "Approval", "Release of funds").
2. Inherent risk description — what could go wrong (e.g. "delay in approval of projects by States").
3. Risk assessment — Impact and Likelihood, each scored L / M / H.
4. Identification & listing of controls — split into existing controls and required controls.
5. Residual risk — Impact and Likelihood again (L/M/H) after existing controls.
6. Frequency of control, control owner, timeline — how often the control runs, who owns it (e.g. P.D — Programme Division), and the implementation date.