Handbook on Internal Audit in Central Civil Ministries/Departments

Each IAW articulates its own Mission; the model wording is: "To enhance and protect organizational value by providing risk-based and objective assurance, advice, and insight." The need for the function stems from the need for objective feedback to Government through periodic review of risks, internal controls and governance.

Taken as a whole, these articulate an effective internal audit. All should be present and operating — failure on any one implies the activity is not as effective as it could be in achieving its mission.

The CGA's Internal Audit Guidelines exist to decrease Audit Risk. There are 32 guidelines in 4 Sections, mandatory and principle-based. The word "professional" is read to include the "function" of internal audit from the Civil Ministries' perspective.

Under Guideline 8 the three engagement procedures differ sharply: an examination forms an opinion on conformance with criteria in all material respects (used for controls/compliance); a review does sufficient testing to express a conclusion on whether anything came to attention showing non-conformity; an agreed-upon procedure engagement expresses no opinion or conclusion — it only reports the findings of the applied procedure.

Performance Audit is assessed from five angles: Effectiveness (program accomplishments — gender-disaggregated data is a pre-requisite to measuring it), Efficiency (productivity, unit cost, utilisation), Economy (minimising input use consistent with quality), Data reliability (controls over non-financial reporting), and Risk assessment (including the political and societal risks unique to Government).

Implementation has three stages (detailed in Exhibit IV) — the CAE shall:

Residual risk remaining after controls may be tolerated if elimination costs are high and it is within acceptable limits. Acceptable risk is one understood and tolerated because the cost/difficulty of a countermeasure exceeds the expected loss — a judgement for the Ministry. The benefits of risk reduction must exceed the cost of controls; the target is bringing risk within the Ministry's risk appetite.

Types of control — with representative examples of each.

Internal control is most effective when controls are "built in" and not "superimposed." Internal Audit is itself a critical component of the internal control system — entrusted with the review function — and, being a control, also entails costs, so must be run with due regard to economy, efficiency and effectiveness.

• 📢Be advocates for formal risk management and help expedite and sustain it.
• 🎯Provide assurance on risk management as a whole, not just on individual risks.
• 🔗When conducting a risk-based audit, link the audit scope to specific risks faced by the Ministry's objectives.
• 🔄Update the risk assessment as and when risks arise, not on a fixed periodicity.
• ⚠️Be cautious that Ministry requests don't divert resources from higher-risk areas; never assume a management role.

The CGA has a direct relationship with the Secretary (Expenditure), M/o Finance, and submits the Annual Review — a consolidation of the Annual Reviews received from line Ministries. The IAD compiles an "Annual Review at a Glance" summarising important observations and reflecting financial implications above Rupees One Crore.

The requirements are detailed in a clearly defined Audit Mandate, which the Internal Audit Charter formally documents. An Audit Committee is constituted in each Ministry for oversight, with this composition:

The Charter is the reference point for internal audit at the Ministry — it defines purpose, authority & responsibility, sets functional & administrative reporting lines, establishes the IAW's position, authorises access to records/personnel/property, and is the foundation for the Annual Audit Plan. It must be gender inclusive and approved by the Audit Committee. The 2006 revised charter moved audit beyond compliance to:

1. Appraisal, monitoring & evaluation of individual schemes.
2. Assessment of adequacy & effectiveness of internal controls and soundness of financial systems.
3. Identification & monitoring of risk factors (including those in the Outcome Budget).
4. Critical assessment of economy, efficiency & effectiveness of service delivery — value for money.
5. Providing an effective monitoring system to facilitate mid-course corrections.

Reporting lines under the Charter: the IAW is headed by a Pr.CCA/CCA/CA acting as CAE; administratively the CAE reports to the Secretary through the Financial Advisor, while functionally the IAW reports to the Audit Committee. The IAD in O/o CGA is structured in three sections — (i) Centre of Excellence, (ii) Planning & Coordination, (iii) Inspection Wing. Each Ministry also has an Internal Audit Management Team headed by the CAE for closer supervision & quality assurance.

To add value, the CAE (per IIA Standards 2000–2060): establishes a risk-based plan; communicates plans & resource needs (Std 2020); ensures resources are appropriate, sufficient & effectively deployed (Std 2030); establishes guidelines & procedures (Std 2040); shares information & relies on other assurance providers (Std 2050) — while remaining accountable for the conclusions; and reports periodically (Std 2060) on purpose, authority, responsibility & performance, including any risk management deems unacceptable.

KPIs are organised around the six elements of the Internal Audit Capability Model for the public sector:

Mandate — Gender Audit is inclusive in two of the audit types.

The expected output is three-fold: an insight into the status of gender mainstreaming in the scheme; a pool of information on gender mainstreaming for discussion & analysis; and a participatory process that builds organisational ownership of the gender-equality objective.

The IAW supports three governance roles — oversight, insight, foresight.

Beyond these, the chapter distinguishes Detection (identifying inappropriate/illegal/fraudulent acts already transpired — e.g. payroll, accounts-payable, IS-security audits) from Deterrence (reducing the conditions that allow corruption — assessing controls, reviewing contracts for conflicts of interest). Auditors may give advisory, assistance or investigative services, but may not make management decisions or assume a management role, and must keep independence for subsequent audits — in short, they should not audit their own work.

QA matters because audit engagements review the use of public money and must be done with due regard for ethics, economy, efficiency & effectiveness. Its benefits: consistent application of processes, standardisation & completeness of documentation, adequate linkage of recommendations to working papers, and enhanced credibility — increasing the effectiveness of supervisory elements and the reliability of reports.

Internal audit must develop synergy with statutory audit, the two complementing each other. The Audit Committee reviews statutory observations too; the IAW maintains a DDO-wise count of outstanding objections from the Test Audit Notes issued by statutory audit, and monitors settlement. Auditors must respect the confidentiality of information — used only for the purpose obtained, disclosed only with proper authorisation.

The two working-paper files — same split that appears in the Manual.

Richard Chambers' reflections, embedded in the Handbook as a reporting-quality aid:

1. Don't say "Management should consider…" — offer solid, specific recommendations, not a nebulous call to action.
2. Don't use "weasel words" ("it seems that," "our impression is," "there appears to be") — they make solid recommendations sound like hunches.
3. Use "intensifiers" sparingly ("clearly," "significant," "very large") — numbers like 23% or $3 billion tell a story; vague intensifiers don't.
4. The problem is rarely universal — avoid "everything," "nothing," "never," "always."
5. Avoid the "blame game" — get to the root cause, not "it was Fred's fault."
6. Don't say "management failed" — state the condition without assigning blame.
7. "Auditee" is old-school — prefer "audit client" / "audit customer"; audit is collaborative.
8. Avoid unnecessary technical jargon ("asynchronous transfer mode," "stratified sampling methodology").
9. Avoid taking all the credit — "internal audit found / we found" can sound like throwing management under the bus.
10. If it sounds impressive, you probably need a re-write — apply the "fifth-grader test": if a middle-schooler can't understand it, it's too complicated.

Each Department must have a dedicated IAW staffed by auditors & supervisors at Group A, B and C levels in adequate numbers, assessed rationally and scientifically. Parameters for setting staffing requirements:

• UNITSNumber of audit units, and number of employees in each unit.
• BUDGETBudget of each audit unit, and the inherent risks in its functioning.
• TIMETime to complete an engagement (incl. travel) and for report writing.
• CPETime reserved for training & continuous professional education, and the period spent on leave.
• EXTRANature & length of assignments, plus additional special audits; staff requirement reviewed at periodic intervals.

Manpower is worked out from these parameters plus the number of auditee units identified for annual, biennial and triennial audit, the audit man-days required, and the available working days in a calendar year. The numbers vary by Ministry; only generic parameters are given, and forming the team is the CAE's responsibility.

With RBIA, computerisation, governance thrust and Big Data, auditors must be trained extensively in seven areas:

Auditors are encouraged to pursue certifications — the Certified Internal Auditor (CIA) and CGAP designations — and must continue their education (CPE) to stay current with the IIA's IPPF guidance. The internal audit activity must collectively possess the necessary knowledge, skills & competencies — an annual analysis identifies gaps to fill by development, recruiting or co-sourcing. Maintaining proficiency also covers the knowledge to identify indicators of fraud, knowledge of key IT risks/controls, understanding of Government rules for assessing materiality of deviations, and strong people & communication skills.

The five stages of competency planning.

1. Establish the vision & desired capability level of the Internal Audit Department.
2. Develop a strategic competency plan.
3. Identify existing competencies.
4. Identify competency gaps.
5. Develop an action plan to fill the gaps — "buy, build, retain" people strategies.

The four steps to establish the Professional Development Plan (a strategic driver presented to the Audit Committee):

Time-tested methods for developing & retaining quality professionals: challenging, varied assignments; quality supervision; participation across audit phases; opportunities to lead; involvement in QA-review prep & Departmental task forces; rotation through teams/programs; and participation in annual risk-assessment activities.

Before commencing RBIA, the CAE presents the benefits and challenges to the Ministry and prepares a register of significant risks and audit activities — the Risk and Audit Universe (RAU). The three stages:

The five levels of risk maturity (IIA position statement) — they depend on the design & effectiveness of the ERM system.

The Handbook's glossary supplies the precise wording of the key terms used throughout. The principal terms: