SEACEN Seminar on “INTERNAL AUDIT OF CENTRAL BANKS” Taipei, Taiwan, R. O. C. 14 -17 September 2004 Presented by Shamsul Islam Junior Joint Director Audit Department 1
SEACEN Seminar ØOrganized ØFinanced ØHosted by: South East Asian Central Bank Research & Training Centre (SEACEN Centre) Malaysia. Bank of Japan (BOJ) The Central Bank of China (CBC)Taiwan. 2
Central Bank of China 3
Seminar Participants 30 participants from the following 15 Central Banks/Monetary Authorities/Ministry of Finance. 1. 2. 3. 4. 5. 6. 7. 8. Royal Monetary Authority of Bhutan Ministry of Finance, Brunei. Reserve Bank of Fiji. Bank Indonesia The Bank of Korea Bank Negara Malaysia The Bank of Mangolia. Nepal Rastra Bank 9. 10. 11. 12. 13. 14. 15. State Bank of Pakistan. Bank of Papua New Guinea. Bangko Sentral ng Pilipinas. Central Bank of Sri Lanka. The Central Bank of China, Taipei. Bank of Thailand. Banking and Payments Authority of Tinor – Leste. 4
Resource Persons. 1. Mr. John Graham Joscelyna CA(SA) CIA Director International Services UHY Advisers Inc. 2. Mr. Noriyuki Tomioka Director Internal Auditors’ Office Bank of Japan. 3. Dr. JIIN – FENG CHEN Associate Professor Department of Accounting, College of Commerce, National Chengchi University. 5
ISSUES FOR DISCUSSION IN THE SEMINAR. 1. 2. 3. 4. 5. 6. 7. Role of Internal Audit in Governance. Identification of gaps in the Internal Audit Function and Opportunities for Improvement. Internal Audit in the Risk Management Process. Leveraging on Automation and Information Technology in Audit Engagements. Impact of Regulations on Internal Audit. Outsourcing of the Internal Audit Function. Industry’s Best Practices in Internal Audit. 6
1. Role of Internal Audit in Governance • Entire audit process directly or indirectly linked with Governance Process. • Audit is an on going Governance Process through evaluation of the System of internal controls. 7
What should Governance mean to Audit. 1. Process of oversight at board level. 1. Relationship between board and management. 2. Organization of executive functions 3. Information flow 2. Key Control Process. 1. Transparency 2. Authority 3. Accountability 3. Impacts the Bank from top to bottom. 1. Determines the control environment. 2. Influences the bank’s culture. 8
Pre-requisite for Auditors in relation to Governance Authority in Internal Audit Charter/IA Mandate. l Competence on the part of Auditors. l Real desire of Board and Management to include Auditors. l 9
What should be auditor’s relationship with his auditees. Facilitator Picking up on their issues. q Questioning them on their needs. q Educator Verification Checklist Sharing best practices q Sharing movement in Governance practice. q Listener q Listen more from auditee so that auditor may educate and facilitate them. 10
What can Auditor do? Share Professional Best Practices § § § § What reporting works best. Usefulness of an independent audit Usefulness of audit to the auditee. How value is added to the performance of auditee. Agree Audit Charter with the Board and Management. Reporting of Audit activities to the Board. Share International Internal Audit Standards and what they mean. 11
Objectives of these activities Auditor has a voice in the Governance arena. l Auditor adds value to the views of the auditee. l Auditor is professional. l Auditor has an independent voice. l 12
Increase understanding with regard to: Code of Ethics. l Control Framework in the Bank. l Agreement on auditor’s work. l Agreement on the risks taken by the Bank. l l Agreement on what auditor can and should do. 13
Reliance is also sought from other players. Risk Managers. l Compliance Officer. l External Auditor. l 14
Auditor’s leadership in Governance Process. Adding value at the highest level. l Working at a strategic level. l Facilitating. l Enabling. l 15
2) Identification of Gaps in the Internal Audit Function and opportunities for improvement. Gaps l IIAs standards. l Negative conception with regard to Auditors. l Level of competence in risk based auditing. l Auditor as “watchdog” and “faultfinder”. l Less emphasis on scientific audit programs. l Designing and implementing of flow charts in audit process. l Preparation of check list and their applications. l Designing of questionnaire for the auditee. 16
Gaps Cont……… l Central Bank experience – Professional qualifications. l Professional qualifications – Central Bank experience. l I. T. experts - Experience of Central Bank working. l Central Bank working experience - I. T. expertise. l Lack of coordination and understanding between Internal and External Auditors. 17
Opportunities for improvement: l l l l Adoption of IIAs Standards. To further educate the auditee with patience behavior. To increase the level of competency in risk based auditing through training and by changing audit methodology. To switch over in role of auditor from “watchdog” and “faultfinder” to the educator/facilitator/mentor. To prepare scientific audit programs To design and implement flow charting. To use check list and questionnaire during the audit process. 18
Opportunities for improvement: cont’d…. . To arrange short courses/training for the officials who have a handsome experience but far behind the professional qualifications regarding audit. l Auditors other than I. T. should impart the I. T. training. l Top level management/Audit Committee should ensure the coordination and better understanding between Internal and External auditors. l 19
3. Internal Audit in the Risk Management Process. Change in the role of Audit. l Watchdog/Faultfinder – Risk identifier/educator. Change in Audit Methodology. l Compliance based audit/Financial audit – Risk Based audit. 20
Risk Based Audit Process l Understanding of risks faced. l Assessing the exposures. 21
Risk Based Audit Process Ø Gather l l l Cont’d…… information and plan. Knowledge of departments/segments/objectives. Understanding of operations and procedures. Prior year’s audit results. Regulatory statutes, approved policies. Identifying risk associated with segment/process. 22
Risk Based Audit Process Cont’d…… Ø Obtain understanding of Internal Control environment. l Control procedures. l Matches of associated risks with controls. 23
Risk Based Audit Process Ø Perform l Cont’d…… Audit Tests Test effectiveness of controls and other substantive audit procedures. 24
Risk Based Audit Process Ø Conclude Cont’d…… the Audit Analyse the audit findings. l Discuss with departmental heads and draw conclusion. l Recommendation for improvements. l Draft Report. l 25
Risk Evaluation Family Internal Auditor Risk Manager External Auditor Compliance Officer or Unit 26
Risk Based Audit Process Ø Auditor’s l l l Cont’d…… own Risks. Explicit Audit. Delivering the right audit product. Assuring the quality of work. Maintaining professional reputation Managing Human Resources. 27
4. Leveraging on Automation and Information Technology in Audit Engagements. 1. Why the automation is need of the time? 2. 3. 4. 5. 6. 7. 8. To increase in efficiency & productivity of Audit. To increase in accuracy. To eliminate storage of work papers. To enable instantaneous communications. To permit access of information via Internet. To lower audit cost. To faster the audit process. 28
Ø Overall l l l status of automation. Initial / middle stage. Working is being automated. Designing of software. Parallel Runs. Partially live working. Complete live working. 29
Ø Usage of Software Tools. In-house development. l Outsourcing the computerization. l Readymade Softwares. l 30
Automation status in other Central Banks SRILANKA l Payment System with - Real Time Gross Settlement (RTGS) l Government Debt Security Management with Scriptless Securities Settlement System (SSSS). l Treasury and International Reserve Management with – Treasury Dealing Room Management System (TDRMS). Ø 31
Computer Assisted Audit Tools and Techniques (CAATTs). Ø Readymade Softwares l l l l Audit Command Language (ACL). Sarbox Portal (SP) Risk and Control Tracking System (RCTS). Control Assessment Template (CAT). Risk Navigator (RN). Team Mate (TM). Office-Suite Software. 32
Sarbanes – Oxley Software 10 th Annual Survey of Internal Audit Utilization of Software Tools Ø Why are you not using Sarbanes – Oxley Software? Ø Our Company is not subject to Sarbanes – Oxley – 79%. l Another Department in our organization handles Sarbanes – Oxley compliance 5%, l Sarbanes – Oxley compliance is outsource at our Organization – 1%. l These types of tools are too expensive – 8%. l Others – 10%. l 33
Summary of the Survey Results. Category % of Most Popular Tools. usage Sarbanese – Oxley Compliance. 22% Risk and Control Tracking System. Data Extraction 86% ACL, Excel Data Analysis 94% Excel, ACL Fraud Detection/Prevention 50% ACL, Excel Network Security/Assessment. 28% ISS Internet Scanner Audit Management 78% Excel, Auto Audit Risk Management/Analysis 96% Excel, Word. Control Self-assessment 33% Excel, Word. Continuous Monitoring 38% ACL, Excel 34
5. Impact of Regulations on Internal Audit Rules and Regulations may be National or International. l Evaluate how does it impact the Bank? l What about its stakeholders? l 35
Rules and Regulations may relate to: l l l Best practices. Leading Central Bank practices. IMF suggestions or demands. Money Laundering Reserve Management. Electronic Banking. Generally Accepted Accounting Principles. International Accounting Standards. International standards of Auditing. Income Tax Laws. Rules and Regulations framed by SEC. Corporate Governance Rules. 36
Impact on audit due to compliance of rules and Regulations l Cost. l Responsibility l Control Establishment l Scope. 37
Compliance of Regulations is every one’s business, therefore: l Is it in the risk assessment? l Is it understood in the Bank’s control environment? l Is it in the control activities of the Bank? l How does management see and acts? l How are regulatory issues communicated? 38
In compliance of the Regulations, information, communicated to the regulators: Fair l Complete. l Transparent. l Independently verifiable by the Internal and External Auditor. l 39
Impact of Incorrect information communicated to the regulators: Lack of Trust l Disbelief l Lack of credibility. l 40
6. Outsourcing of the Internal Audit Function Ø l l Kinds of outsourcing. Special Project outsourcing. Partial outsourcing. Temporary staffing. Full outsourcing. 41
ØDetermining factors if the Internal Auditing be outsourced: l Will the outsourcing of Internal Audit effect the effectiveness of corporate governance? l What are the advantages and disadvantages of internal audit outsourcing? 42
ØArguments in favour of Outsourcing: l Allows management to focus on core competencies. l Cost saving resulting from economies of scale. l Flexible access to expertise. l Access to leading practices. 43
ØArguments against outsourcing: l l l l l By the lapse of time outsourcing provider will demand an ever greater premium for their services. An external provider will not know the business as well, as the internal personnel do. A valuable training ground is lost. Morale of the personnel will be seriously impaired. Individual Employee allegiance is to the outsourcing provider, not to the client. Corporate governance is a management function which can not be outsourced. Independence of external auditor will be impaired when the outsourcing provider is also external auditor. Confidentiality is potentially lost. Management and the audit committee lose an objective source of information. 44
ØAdvantages of Outsourcing: l l l Smaller Organizations’ access to a broader set of skills. Information systems audit skills – highly effective. Innovative approaches – knowledge of “Best Practices”. Integrated audit approach – Internal + External. Active Management Participation – Provide direction and oversight. 45
ØDisadvantages of Outsourcing: l l l l Loss of a second set of eyes and ears. Confidentiality could not be maintained. Outsource provider might be an auditor of commercial bank(s) to which central bank is monitoring. Expertise leave the Organization. Outsourcing does not build new managers. Outsourcing does not have to live with the decisions or recommendations made – but still have pressure to retain the contract. Difficult to rebuild internal auditing department, if outsourcing is not successful – dependency on one outside provider. External Auditor may be lacking internal audit knowledge – material differences in perspective and execution: 46
Central Banks– Outsourced Internal Audit function of the Reserve Bank of Fiji is outsourced. Ø Justifications for outsourcing put forth by the representative of Reserve Bank of Fiji: l Cost effective. l Provides more independence and autonomy to the auditor. l Outsourcing addresses the problem of resource constraints. l Staff can be engaged in the core areas of the Bank. l Expertise in the field of audit were lacking. l Career paths and opportunities of audit personnel is limited as only one central bank in the country. l Skills required for auditing are readily available in the market. 47
Central Banks– Outsourced Cont’d…… A few audit functions have been co-sourced by Central Bank of Srilanka. Ø The functions out sourced: Ø l l l Ø l General Review of Information System. Pay Role System. Real Time Gross Settlement System (RTGS). Justification for co-sourcing put forth by the representatives of Sri Lanka. Early retirement of staff and the absence of expertise to special audit functions. 48
7. Industry Best Practices in Internal Audit Principles of Internal Audit. Ø Independence, objectivity and impartiality. l l l Audit should exercise their assignment without interference and are free to report their findings and appraisals. Audit charter should be approved by the Board of Directors and should be communicated to all staff within the Bank. Rotation of staff assignments within the audit department. No involvement in the operations of the bank. Recognition of the auditors’ independence in the audit charter. Official internally transferred to audit department should not involve in the audit of his previous activity for a certain period. 49
Principles of Internal Audit Cont’d…. Ø Maintenance of professional competence: l On the job training. l Formal internal and external training. l Staff rotation within the Department. l Incentives to become a Certified Internal Auditor. 50
Working methods and types of Audit Ø Working methods: Drawing up a risk-based audit plan. l Examining and assessing the available information. l Communicating the results. l Follow up of recommendations. l Ø Types of audit: l Financial Audit. Compliance Audit. Operational Audit. Management Audit. Risk-based Audit. I. T. Audit. l l l 51
Audit Procedure: Prepare audit program and document audit procedures in working papers. l Distribute audit reports to auditees and senior management. l Follow up the audit recommendations to see whether they are implemented. l Inform senior management about the status of the said implementation. l 52
Management of the Internal Audit Department Ø The head of the Internal Audit Department is responsible for: l Ensuring the use of sound internal audit standards by the internal audit staff. Existence of upto-date audit charter. Existence of upto-date written policies and procedures for audit staff. Appropriate professional competence and training of the audit staff. To regularly send report to appropriate management level for discussion. l l 53
IIA’s International Standards for the Professional Practice of Internal Auditing The purpose, authority and responsibility of the internal audit activity should be formally defined in a charter, consistent with the standards, and approved by the board. l Internal auditors should be objective in performing their work. l Internal auditors should have impartial, unbiased attitude and avoid conflicts of interest. l Engagements should be performed with proficiency and due professional care. l 54
IIA’s International Standards for the Professional Practice of Internal Auditing Cont’d…. . Ø Quality Assurance and Improvement Program Chief Audit Executive (CAE) should develop and maintain a quality assurance and improvement program which should cover: – All aspects of the internal audit actively and continuously monitoring its effectiveness. – Periodic internal and external quality assessments and ongoing internal monitoring. – Assurance that the internal audit activity is in conformity with the Standards and the Code of Ethics. 55
IIA’s International Standards for the Professional Practice of Internal Auditing Cont’d…. . Ø Disclosure of non-compliance. – Internal audit actively should achieve full compliance with the Standards and internal auditors with Code of Ethics. – In case of full compliance not achieved, disclosure should be made to senior management and the board. 56
IIA’s International Standards for the Professional Practice of Internal Auditing Cont’d…. . Ø Governance: l IIA’s Internal Standards for the Professional Practice of Internal Auditing. Internal audit actively should assess and make appropriate recommendations for improving the governance process for: Promoting appropriate ethics and values within the organization. Ensuring effective organizational performance management and accountability. Effectively communicating risk and control information to appropriate areas of the organization. Effectively coordinating the activities and communicating information among the board, external auditors and management. l l 57
58
September 17 Post Seminar City Tour - - Yingo Ceramics Museum - - Lin Family Mansion and Garden. 59
Thank You 60
Скачать презентацию SEACEN Seminar on INTERNAL AUDIT OF CENTRAL BANKS
0b4b297308a099493ccac599ac1bb739.ppt