© 2017 International Bank for Reconstruction and Development / The World Bank 1818 H Street NW Washington DC 20433 Telephone: 202-473-1000 Internet: www.worldbank.org This work is a product of the staff of The World Bank with external contributions. The findings, interpretations, and conclusions expressed in this work do not necessarily reflect the views of The World Bank, its Board of Executive Directors, or the governments they represent. The World Bank does not guarantee the accuracy of the data included in this work. The boundaries, colors, denominations, and other information shown on any map in this work do not imply any judgment on the part of The World Bank concerning the legal status of any territory or the endorsement or acceptance of such boundaries. Rights and Permissions The material in this work is subject to copyright. Because The World Bank encourages dissemination of its knowledge, this work may be reproduced, in whole or in part, for noncommercial purposes as long as full attribution to this work is given. Any queries on rights and licenses, including subsidiary rights, should be addressed to World Bank Publications, The World Bank Group, 1818 H Street NW, Washington, DC 20433, USA; fax: 202-522-2625; e-mail: pubrights@worldbank.org. Acknowledgments The internal audit simulation case study was developed by a team of World Bank experts jointly led by Arman Vatyan, Senior Financial Management Specialist, the World Bank, and Kalina Shukarova – Savovska, Senior Financial Management Specialist, CFRR, the World Bank, and including Piotr Pyziak and Jean-Pierre Garitte, Consultants, to facilitate Internal Audit Training of Trainers (IA ToT) workshops. The team expresses its appreciation to the participants of the SAFE funded IA ToT Community of Practice for their participation and contribution in delivering the IA ToT program, and their valuable input to this case study. i Contents INTRODUCTION ................................................................................................................ 1 SECTION I: AUDIT SIMULATION ......................................................................................... 2 Background Information ........................................................................................................ 2 Orotavia ...................................................................................................................... 2 Planning the Internal Audit Engagement ............................................................................... 5 System of Paid Parking................................................................................................ 5 Refugee Crisis .............................................................................................................. 5 Public Private Partnership (PPP) ................................................................................. 7 Planned Visit of Representatives from the EU Institutions ........................................ 7 Major Reform of IT Systems and Infrastructure ......................................................... 8 Improving Orotavia’s Touristic Appeal ....................................................................... 9 Managing Winter Snowfall ....................................................................................... 11 Assignments .............................................................................................................. 11 Executing the Internal Audit Engagement ........................................................................... 12 Finance ...................................................................................................................... 12 Asset Management ................................................................................................... 13 Procurement and Contracting .................................................................................. 14 Human Resources ..................................................................................................... 17 IT General Controls ................................................................................................... 18 Sampling Guidance ................................................................................................... 19 Assignments .............................................................................................................. 20 Reporting on the Internal Audit Engagement ...................................................................... 21 Closing Meeting ........................................................................................................ 21 Management Action Plan and Follow up.................................................................. 21 Satisfaction Survey .................................................................................................... 21 Assignments .............................................................................................................. 22 SECTION II: DOCUMENTATION TEMPLATES AND EXAMPLES ............................................ 23 Template 1: Identified Risks and Related Auditable Processes ........................................... 23 ii Template 2: Detailed Audit Program ................................................................................... 24 Example 3: Kick-Off Meeting ................................................................................................ 25 Template 4: Sampling ........................................................................................................... 26 Template 5: Review the Design of Controls and Select Controls for Further Testing ......... 28 Template 6: Summary of Recommendations ...................................................................... 29 iii Introduction The IA ToT workshops focus on developing the capacity of public sector internal auditors to deliver high-quality internal audit training within their countries/institutions, based on the International Standards for the Professional Practice of Internal Auditing (ISPPIA) and international good practices in public sector internal auditing. The Case Study “Orotavia - Capital City Municipality” is a core teaching resource for the IA ToT workshops. Its objective is to provide an opportunity to bridge the gap between theory and the practical application of the ISPPIA by simulating a small audit client scenario. Audit documentation templates and examples form part of the case study and allow the audience to go through a real life situation, and tackle and solve some real life problems. The Case Study is structured into three sections, used simultaneously: • Section I – Audit Simulation This section summarizes the “Orotavia - Capital City Municipality” scenario and provides background information about the case. It also includes references to the assignments that participants are expected to work through during the training sessions. • Section II – Documentation Templates and Examples Section II is a collection of documentation templates to be used by participants when completing the internal audit simulation assignments. It also provides examples to assist participants work through the Case Study. • Section III – Trainers Guide Section III is the trainers guide, outlining possible solutions and examples based on the IA ToT Community of Practice discussions and exchanges. Of course, all internal audit engagements are unique and subject to the exercise of professional judgment of the internal auditor in the specific circumstances. The approach and examples in this case study illustrate just one way to approach challenges related to performing an effective internal audit, it nonetheless offers a useful opportunity to “learn by doing” and encourage wider discussion of issues that arise. 1 Section I: Audit Simulation Background Information Orotavia is the capital city of Ramovia, a middle-income country located in Central Europe of 4 million people. Approximately 500 thousand people live in the capital city Orotavia, or about 1/8 of the country’s population. The country is divided into 7 regions, one of which is the capital city municipality Orotavia. Regions are the first level of public administration (followed by districts and counties). Orotavia The capital city municipality (“Orotavia” or “the Capital”) has been run by the same Mayor – Mr. Big - for almost 10 years. He is currently in his 3rd term as Mayor, it is 2 years since the last local elections and he has 2 years remaining in office. Although Mr. Big is officially a nonpartisan candidate, he used to be a member of the political party “League for Citizens Prosperity” which has ruled the country for the last 6 years. Mr. Big received the strong support of politicians from this party in his last two elections. The governing body of Orotavia is the City Council, an elected body comprising 30 members. Mr. Big is Chair of the City Council and responsible for running the daily operations of Orotavia. The reputation of the Mayor and the municipality is generally quite good. There has, however, been occasional criticism from a small section of the independent media that the Capital is dominated by politicians, supporters, or family and friends of the ruling “League for Citizens Prosperity” party. The Orotavia spokesperson’s usual response to such accusations is that positions are filled based on individual merit and for each position there was a competitive selection process with an independent evaluation of candidates. The departments of the Orotavia municipality include: Finance Department, Budgeting Department, Asset Management and Maintenance, Investment Planning Department, Education, Culture and Museums, Human Resources, Legal and IT. All departments are supervised by department heads and their deputies. Department heads report directly to the Mayor of Orotavia, Mr. Big, and his two deputies: Mr. Munko and Mrs. Galusha. The Internal Audit Department is an independent unit of the Orotavia municipality established almost a decade ago through a major reform in the country introducing modern principles of financial control in the public sector. After struggling for a number of years with capacity, the Internal Audit Department is now adequately staffed with three junior auditors, two senior internal auditors, and a department head – Mr. Sveto, who is quite new (appointed 6 months ago) but very well experienced and qualified. The internal auditors are appointed 2 by, and report to, the Council of the Municipality but in practice there is a close relationship with the Mayor who relies on the internal audit department for daily advice and support. The capital city municipality Orotavia is currently running its activities at 2% of annual deficit. The level of accumulated debt amounts to 40% of its annual budgeted revenues. The revenues and expenditures of the city were balanced until approximately 9 years, but since then the situation started to worsen with gradually increasing annual accumulating deficits. The Capital’s revenue is largely generated from: local taxes (mostly property tax) and local fees (for collection of waste from individuals and businesses, for water supply and collection of black water, city public transportation, parking, etc.). Orotavia owns some assets (land, buildings, structures, roads, bridges, city infrastructure), which, in many cases, generate no revenue, or the revenue generated is below expectations. Orotavia is gradually selling some of these assets to cover current and investment expenditures of the city and is also engaged in developing solutions so that the assets can be utilized more effectively and for income generation purposes. To finance its activities, Orotavia is issuing subordinated bonds, utilizing the possibility of recently changed legislation which allows this kind of activity provided the issue is offered to domestic bond buyers (both institutional and private investors). Orotavia issued its first ever municipal bonds last year with mediocre success, i.e. 55% of offered bonds were purchased. But the process has been seen as a good initial step to develop the market for this type of financing in the years to come. The funds generated through the bond issue were used for financing the city’s capital and investment needs. Some revenue is redistributed from the central government budget in the form of subsidies, backed by a 15 percent share of personal income tax collected from citizens registered as resident in Orotavia. To maximize the government subsidy, the city is fighting with “illegals” – people who migrated to the capital city and who live, work, and utilize Orotavia’s infrastructure, but are still registered as resident in other regions. The share of personal income tax collected for these citizens is transferred to the regions of registration, rather than the place of living in Orotavia. “Illegals” are currently identified through verification on the streets and through controls in various businesses and construction sites, and are penalized with fines and tickets. The city has not yet found a more effective solution for the “illegals” and is open to proposals of how to improve the situation. The Finance Department of Orotavia is dealing with issues relating to finance, accounting, reporting, and cash flow management. The capacity of the Finance Department is still developing to deal with more complex finance issues such as municipal bond issues, management of cash, fiscal discipline of planning expenditures and revenues, etc. Although capacity has improved in the past 3 years, the Finance Department has a high staff turnover rate. 3 The Capital has more than 50 bank accounts in various banks – some privately owned, others fully or partly state owned. The Capital has opened several overdraft lines with those banks which are used to meet the demand for funds in the instances of shortfall. Some banks use electronic banking, but each has its own system. Some bank statements cannot be obtained online and they are sent by post to the Finance Department of the Capital once a week. In other cases, authorized individual(s) from the Finance Department collect the bank statements every day in person from bank branches (although in reality this is not always possible). Orotavia has never performed an analysis of whether all these bank accounts are needed and if there are possible ways of streamlining the banking services; or there are benefits of consolidating the providers of banking services; or upgrading the technology to more reliable and customer-friendly IT solutions. Orotavia’s operating and capital expenditures relate to supplying services to its inhabitants: such as education (kindergartens, primary, and secondary school levels), providing the technical infrastructure of the city (building new and maintenance of existing: roads, bridges, pavements, transportation system, etc.), improving health services of hospitals and nursing homes, etc. The Capital is facing many challenges, including a growing population of immigrants from rural areas of the country and services are lagging behind. The transportation system requires major upgrades of the infrastructure (new roads, new tram lines, replacement of old trams and buses, and adding more of them to the existing transport fleet) to meet the growing demand and expanding territory of the Capital. Ramovia is situated on one of the routes connecting lower income countries with wealthier income countries in the west. Many political and economic refugees use Orotavia as a route to cross to wealthier countries, however recently the border crossing out of Ramovia was blocked preventing them from leaving the country. As a result, the government was forced to create camps for the many refugees temporarily situated in Ramovia until their status is more clearly defined. One such camp was established in Orotavia and although the majority of the costs for running the refugee camp are covered by the state, the capital city municipality had to cope with increased costs of utilities for running the camp: water, electricity, transportation, sewage, costs of waste management, basic education, etc. In the last couple of years, the trust of the public towards the police force of the Capital has been declining. Citizens perceive a reduction in protection and safety and some areas of the city have become quite dangerous for the public. Another issue is the lack of discipline in traffic control, police officers are accused of not appropriately dealing with speeding violations or penalties for parking in forbidden areas. The Chief of the Police in Orotavia is appointed directly by the Mayor based on special rights granted by the Ministry of Internal Affairs. The Ministry’s justification is that as the Mayor is non-partisan, his appointment of the Head of Police in the Capital guarantees a non-biased and politically neutral police force. 4 There are many different, unconnected, IT systems supporting Orotavia’s operations. Largely inherited from the past many of these systems are based on old-fashioned technology, although developed and changed over the years. There is an urgent need to reform the IT in order to make operations more reliable and efficient. Planning the Internal Audit Engagement Since settling into his new role 6 months ago, one of the key activities undertaken by Mr. Sveto, Head of the Internal Audit Department, is the development of a risk based strategic and annual planning process. This has proven to be a time consuming task. Orotavia does not have a risk management policy assessing the municipality risks to the achievement of its objectives. Mr. Sveto needs to apply his own judgements about determining the risk within the organization. Further, Mr. Sveto could not find a well-documented strategic and annual plan in past internal audit files. He called a staff meeting to discuss the ongoing planning process and the following information becomes available to Mr. Sveto during his discussions: System of Paid Parking In order to generate additional revenues, Orotavia decided to introduce a new system of obligatory paid parking in several zones of the Capital. Paid parking would apply initially only in the very center of the Capital, then would be extended further in the future. The step-by- step approach to implementation was to avoid major dissatisfaction among residents of the Capital. Introducing paid parking zones requires major capital investment in appropriate equipment – including parking machines and employing parking controllers – but it has not yet been decided how to finance the system (leasing, purchasing of equipment, etc.). The property, plant, and equipment investment in new technical and IT equipment is planned based on analysis prepared by the city. A return on investment is calculated considering the projected revenues and costs of the new project. The proposal looks very attractive on paper and a decision has been made to go ahead with an international competitive tender for acquisition of new parking technical and IT infrastructure. Refugee Crisis Many refugees, seeking to transit Ramovia but denied access to neighboring countries for administrative or other reasons, remain in Ramovia. The government of Ramovia has created several transit camps for refugees, including one in Orotavia. 5 The majority of the costs for running the refugee camp are covered by the central government but the capital city municipality has to cope with increased costs of utilities for running the camp: water, electricity, transportation, sewage, costs of waste management, basic education, medical services, etc. As the budget situation at both central government of Ramovia and at the local level of Orotavia city are very tight, the central government of Ramovia has approached the Institutions of the European Union (EU) for funds directly targeting maintaining the refugee camps. The EU institutions have agreed to provide a grant of euro 250,000 that would fund the specific needs for the refugee camp in Orotavia. Since Ramovia is outside the European single market, the EU institutions demanded implementation of certain procedures and policies strengthening the system of internal control in public financial management of the receiving institution, i.e. Orotavia capital city municipality. The grant covers the following spending: (i) costs of utilities for running the camp - water, electricity, transportation, sewage, costs of waste management; (ii) cost of food and beverages for refugees; (iii) cost of tents, mattresses, duvets, rugs; (iv) cost of clothes and toys for children; (v) cost of training in basic trade skills – sewing, cooking, etc.; (vi) cost of basic education for children. A portion of the budget was also allocated to minor repairs, road maintenance, and fence maintenance. The grant is managed by the Accounting Department of Orotavia, who must make sure that the stricter system of internal controls over the spending of funds is implemented in line with the donor requirements. All purchase documents must be registered in the central registry of documents received. All purchases/payments must be documented with all purchase-related documents (invoices/cash-till slips/purchase contracts, etc.). All purchase documents must be physically authorized (signed with the date) on the purchase document by the individual responsible for ordering goods or services or negotiating the conditions of the service/goods delivery and by the respective director or vice-director of the relevant ordering department. Physical payments must be approved in the banking system by the director or the vice- director of the relevant purchasing department, by the accountant making the payment (from Accounting Department), and by the director or vice-director of the Accounting Department. For purchases greater than euro 5,000, it is required to organize an open bidding process with at least 3 independent suppliers. For purchases greater than euro 5,000 it is required to sign a purchase contract as a basis for the purchase transactions and purchase invoices. European donors require periodic reporting of spending with a brief explanation of what the funds were spent on by expenditure categories and providing some brief cost estimation for the following reporting period. These additional requirements of the European donors increase administrative costs for the Capital and the additional procedures imposed extend and complicate the approval and reporting process. To address these issues, the Capital employs an additional accountant to support the existing staff, the cost of employing the additional person (salaries, wages, social charges, etc.) are covered by the European funds. 6 Public Private Partnership (PPP) The Capital is located on two sides of the biggest river in the country – the Vianka. There are only two bridges connecting the two shores on opposite sides of the river. Due to high congestion in the city center and increasing traffic, the city has decided that the right time has come to construct a third bridge in the Capital. In the existing fiscal climate Orotavia cannot finance the major capital investment using internally generated funds. The Mayor therefore proposes establishing a Public Private Partnership (PPP) to achieve construction of the bridge. The concept is relatively new in the country and the City Council lacks experience with PPPs and the elements of this type of agreement. The Mayor is promoting the use of PPP because: • the city would benefit immediately from having a new bridge; • PPP projects are widely used world-wide; financial development agencies and institutions are promoting these solutions as an alternative for regions and communities with little access to finance. The concept is that construction of the new bridge would be financed by a private investor who then operates the new bridge, collecting a small toll from users, for an agreed number years. The Mayor requested a feasibility study and budget projection to be prepared by the Budget Department of the Municipality and a special task force was created under the leadership of the Mayor including representatives of selected departments from Orotavia: Budget Department, Finance Department, Asset Management, and Investment Planning Department. Planned Visit of Representatives from the EU Institutions The Minister of Development of Ramovia is hosting a visit by the EU institutions who have expressed their willingness to support the development of the country by (co)financing some pilot programs in Orotavia. The atmosphere in the Municipality is quite tense, because the Mayor is putting a lot of pressure on departmental directors of the Capital to make sure the city and potential projects are presented in a good light to the European delegation visitors. Much work is underway to develop projects to present to the EU institutions that are relevant and needed, especially in areas that have been historically neglected given limited budget availability . A tour for the European delegation is planned to visit selected schools, kindergartens, the university, and one of the biggest and the most modern hospitals in the capital. Proposed projects include: • Full interior renovation of 10 kindergartens, including replacement of engineering and household infrastructure. A further 10 kindergartens, which do not require a major upgrade of their interiors, would get new playgrounds. 7 • Supporting improved dental hygiene of primary school pupils and financing a one-year program of providing fluoridation in all primary schools in Orotavia. • Constructing new sport facilities in two selected secondary schools – to build completely new gymnasium in those schools. • Equipping the university library with modern IT infrastructure (computers, IT network, wifi internet access for users of the library) and to purchase foreign books and pay for subscription of selected relevant magazines and newspapers. • A proposed project for the main hospital in Orotavia involves three main pilot activities: (i) purchasing CTR equipment (including the cost of servicing the equipment for 3 years); (ii) sending a selected team of doctors to a leading university hospital in Switzerland to train them in recent methods of artificial knee and hip replacement; and (iii) implementing measures to undertake preventive actions against outbreaks of vicious bacteria (sepsis). The Mayor has approved all proposed projects for presentation to the delegation during their visit. He hopes that the cooperation in establishing and operating a refugee camp will be a good starting point for future cooperation. The outcome of the visit remains to be seen. Major Reform of IT Systems and Infrastructure A major reform of the Capital’s IT infrastructure is underway. A task force team was organized a few months ago under the leadership of the Director of the IT Department with the direct oversight of the Mayor. The main purpose of the task force was to: (i) take stock of all IT systems currently in use; (ii) evaluate whether each system should be further developed, scrapped, or replaced with new consolidated solutions; (iii) develop an IT strategy. The expertise and knowledge of an independent IT consultant will be utilized during this exercise. Mr. Placheta, who is also founder and manager of his own IT development company – “Professional IT Solutions Ltd”, has been selected through a tender. The task force team identified that the Municipality is using more than 20 different IT programs and solutions. There is duplication and different public institutions are using different programs to perform the same function. Different systems are being used for internal purposes (e.g. accounting program, payroll program, program for management of fixed assets and calculation of depreciation, couple of different warehouse management programs – one used by the administration of Orotavia, different solutions used by waste management, water, public transport, etc.). A range of other systems are being used for the purpose of operating the functions of the city (e.g. different billing systems used by city utilities). Mr. Placheta is working closely with the IT task force and helping with the assessment of current IT outlook and is involved in directing the IT strategy for the future. 8 Many companies and IT consultants were interested in getting involved in the project. The Capital obtained bids from more than 10 smaller local companies and larger IT consultants. Most bidders had experience of public sector IT work; there were no material differences in the financial offers provided. The task force, under the strong influence of the Mayor, decided that “it would be better if they select somebody with good knowledge and understanding of the local IT market and local needs, requirements, and limitations”. In the preceding 3 years Mr. Placheta’s company developed or was involved in upgrading three IT systems used by the Capital which gave him an additional “edge” during selection. What also helped was the perception of Mr. Placheta as a philanthropist who is involved in the life of the local community - his IT company recently sponsored a trip abroad for students of a private school in Orotavia. It seems not to have been mentioned, or to have impacted the decision, that two of Mr. Placheta’s children attend this school, as do two of Mr. Big’s children who took part in the trip. The Capital recently launched a project to consolidate banking services, decreasing the number of bank accounts and banks used, and as a result to also consolidate IT banking solutions. Orotavia has decided that all paper based bank transactions should be eliminated. A task force responsible for the assessment of current banking offers and for negotiation of terms has been established from employees of the Finance Department. The team is managed by the Director of Finance Department with direct supervision of the Mayor and one of his deputies, Mrs. Galusha. The process of consolidating banking services is still in progress and the final outcome is not yet known. Countless and repetitive meetings with representatives of the banks are a clear sign to the team that management is negotiating the best deal for the City. The outcomes of the meetings must be kept secret – in order not to leak the details of negotiations to other competing banks – therefore members of the task force are not allowed to attend. However, task force members are thrilled to see management’s deep commitment to reducing costs (both monetary and operational) by running leaner banking services. Improving Orotavia’s Touristic Appeal In order to attract more visitors, both foreign and citizens of Ramovia, the Capital is considering implementing several projects which would improve its attractiveness and hopefully bring many new visitors. A local City tax on tourists currently provides only a small portion of the revenue of the Capital, but the plan is to increase visitor numbers and increase this revenue. Each tourist pays an equivalent of 1 EUR for each night spent in hotel facilities in Ramovia. The tax is collected from hotels, pensions, bed & breakfasts, hostels, youth hostels, etc. and redistributed to local authorities. Collection of the tax has been imperfect, but Orotavia is working on ways of strengthening this. 9 The city has selected several projects to improve the attractiveness of the Capital. One of them is the elimination of vehicle traffic from key historical streets of Orotavia and the introduction of pedestrian only areas. The concept was presented to the city council and was approved in a transparent voting process. Proposed adjustments to city transport networks were made public through local media outlets, with a short deadline for implementation of 2 months from the date of approval. The new pedestrian zone includes two major historical streets, which are a popular area for shopping. Local shop owners immediately protested against the proposal. They argued that removing traffic would discourage shoppers from visiting this traditional shopping area – unable to use their cars in the center they would instead move to shopping malls on the outskirts of the city, owned by big-multinational retail chains. This would not be good for the local economy and would damage the business of family owned shops in the center, for decades the main source of income to many families. The local shop owners claimed that the shopping malls that would benefit from the change had been exempt from many local taxes for years as a result of investment deals with the Capital. The shop owners protested that the pedestrianization decision was taken without any consultation with the local community, who might have had their own ideas on solutions beneficial for the Capital, and that the timeframe for implementation of the pedestrian zone was very short. Small shop owners from the affected area created a trade organization – “The Union of Family Shop Owners of Orotavia”, which gathered people interested in keeping the current status quo and protested in front of the city hall. As a result of the opposition, City representatives began negotiations with the new trade organization. One agreed solution was to provide new parking in the vicinity of the pedestrian zone, which would improve the shopping experience after implementation of a pedestrian zone. The funds to build the new facility were granted by central government as a way to calm down angry citizens of Oratavia. Completely new, several stories high (including some underground levels) the parking building is being built in the center of the Capital, behind the planned pedestrian zone. The construction works started last week by preparing the site for setting the building foundations. During the preparatory works workers discovered the remains of old brick walls underground, which indicated that these could be the remains of old historical buildings. They stopped digging and the management of the construction company reported the discovery to the authorities. The archeological team from the University of Orotavia investigated and confirmed it as a finding of historical importance. The works are still in progress, but the first conclusions indicate the discovery of an old merchant house from the 16th century with some interesting artifacts: items made of glass, porcelain, even some valuable coins and pieces of jewelry. The current time frame of the archeological work is still unknown, as is its impact on construction of the planned new parking facility. 10 Managing Winter Snowfall A major issue in Orotavia is managing the winter snow fall and how to improve street clearing. The winters in Orotavia are short but can be severe. Given the relatively short duration of snow it hasn’t been economically justifiable for the Capital to purchase any heavy snow clearing equipment. Alternative solutions have been used, but are never effective. Every year issues with heavy snowfall causes chaos in the city, which affects its residents. The transportation system does not work properly during these periods of heavy snowfall, causing serious economic problems. Due to climate change, winters in the Capital are lasting one-two weeks longer than in the 70’s and 80’s and they are more severe. The city is working on alternative solutions to clearing the streets in winter which would not require investment in equipment. One idea is to outsource the service to private companies. However, there are currently no companies in Orotavia with the necessary equipment. Another idea is for communities to use existing equipment that, although not specifically designed for clearing snow from streets, could be used after some small and inexpensive modifications. This proposal was made by the local farmers’ association and approved by Orotavia. The community of farmers from surrounding villages and farms will provide snow clearing services and in return local farmers will receive an additional source of revenue during the low season, when they cannot anyway work in the fields. They will not become full time employees of the City but be paid only for the hours actually worked (fixed fee per hour). The farmers’ existing tractors and other transport vehicles should be relatively easily modified for snow removal. It has been estimated that the cost of installing these additional pieces of equipment would vary between euro 2,000 and 4,000 in local currency, with these costs borne by the farmers. As this is a significant amount for many of them the Capital negotiated a beneficial deal with one of the state owned banks. The farmers would be granted 4-6 years of lower than market interest rate loans for the value of the installation, guaranteed by the Capital. The loans would be repaid from the revenue for snow removal. Based on the conditions of the last 3 winters it is estimated that the loans should be repaid fully within 3-4 years (taking into account all estimated costs, including running, maintenance, technical check-ups, etc.). However, the weather conditions are not predictable – there is a chance of milder weather conditions. Assignments For the assignments below, please refer to Section II – Documentation Templates and Examples: (i) Using Template 1, document your team’s understanding of the risks and the related auditable areas / processes (ii) Using Template 2, develop the detailed internal audit program for the following processes: Finance, Asset Management, Procurement, Contracting, Human Resources, IT General Controls 11 Executing the Internal Audit Engagement Through inquiry and inspection procedures you will become familiar with the Capital City Processes and Systems, as described in the following sections. Finance The Finance Department of Orotavia deals with issues relating to finance management, banking (both manual and electronic), accounting (recording additions and disposals of fixed assets, calculation of depreciation, posting salaries, posting other transactions - including petty cash, accounting estimates, changing accounting and reporting policies based on the changes in legislation and regulatory environment), financial and other reporting (obligatory by law and required by other regulations), and cash flow management. The Department also deals with the annual budgeting process and is involved in all issues of asset management in the Capital. The roles and responsibilities of Finance Department staff are clearly defined and they are supported by job descriptions. Due to the relatively big team working in this department, it is possible to achieve appropriate division of duties. During staff absences, such as vacations, system access rights exist to replace another user, but the replication is only temporary and specific software tracks such temporary access based on formal requests of the Head of Finance Department (or his Deputy). This also applies to authorization of transactions and the making of payments. There are limits established within Finance Department for payments of transactions. Clerks are allowed to make payments for transactions not exceeding a value equivalent to euro 50 if the invoice is authorized by the relevant staff of the department initiating the order. Invoices with value between euro 50 – 1,000 must be additionally authorized by the Head of Finance Department or his Deputy. These invoices must also be authorized by relevant staff of the department they relate to. Invoices with a value above euro 1,000 must be additionally authorized by the Mayor or one of his Deputies. Again, these invoices must be approved before payment. The Finance Department is currently leading the process of modernizing and streamlining the banking services used by the Capital. The capacity of the Finance Department is still developing to deal with more complex finance issues such as municipal bond issues, management of cash, fiscal discipline of planning expenditures and revenues, etc. Although capacity has improved in the past 3 years, the Finance Department still has a high staff turnover rate. Currently, the Finance Department comprises of 8 people plus the Department Head, who reports directly to the Mayor of Orotavia and his two deputies. The Finance Department initiates ad hoc meetings with key personnel, including the Mayor, if there are any major issues to be discussed or if deviations from budget and key performance indicators are observed. There are also more formal meetings organized every quarter with key personnel in order to discuss the performance indicators and realization of the budget. 12 The Finance Department managed the process of issuing subordinated bonds last year. These were the first ever municipal bonds to be issued by Orotavia, and 55% of the offered bonds were purchased. The process has been seen as a good initial step to develop the market for this type of financing in the years to come. The funds generated through the bond issue were used for financing capital and investment needs of the city. The Finance Department lacks skills related to valuation and proper tracking of gains and losses on bonds issued and they are counting on the expertise of the Internal Audit Department to guide them in this more complex area. During their review of petty cash and business trip costs settlement, the audit team discovered that some costs related to business trips to visit the refugee camp in the neighboring country were settled in cash. The terms of the donor financing stated that no costs related to business trips are eligible to be covered by the grant. The costs in question included per diems. The Capital has many bank accounts in various banks and there are several open overdraft lines in those banks which are used to meet demand for funds in instances of shortfall. Some banks use electronic banking, some don’t. Some bank statements are available online, others are not and are sent by post to the Finance Department of the Capital once a week or they are collected from the bank by authorized individual(s) from the Finance Department. The Finance Department will lead the process of modernizing and streamlining banking services used by the Capital. Key controls of the Finance Department include: • Appropriate segregation of duties in the Finance Department is achieved • Temporary replaced access rights are based on formal requests. The same applies to authorization of transactions and making of payments. • Payment limits are introduced (clerks up to euro 50; clerks and Head of Finance or his Deputy between euro 50 – 1,000; and clerks and Head of Finance or his Deputy and the Mayor for payments above euro 1,000) • Verification of authorizations of costs by Department Heads – checking invoices for proper authorization. • Monitoring key performance indicators and realization of the budget. • Reconciliation and approval of settlements of business trips. Asset Management The Asset Management Department plays a major role when planning any major projects affecting the assets of the Capital – such as additions, renovation, or disposals. The Department comprises of 5 full time employees – people with technical backgrounds, mostly 13 engineers, led by the Head of the Department. The Department engages ad hoc external consultants with specific specialisms as necessary, remunerated on a daily basis. The Asset Management Department maintains complete documentation of the Capital’s existing assets in an asset register. The Asset Management Department periodically reviews the depreciation rates used by the Municipality and makes estimates for depreciation rates of asset additions. Members of the team are responsible for conducting periodical physical verification of assets and are involved in any projects affecting the asset portfolio of the Capital. It is common practice for teams from other departments (e.g. Procurement, Finance, Budget) to cooperate closely with the Asset Management Department on various projects. There are currently two major projects involving the Asset Management Department: construction of a third bridge in the Capital; and introduction of a system of paid parking. The bridge would be built using a PPP, with the private partner financing the construction of the facility. Introducing the paid parking system would require investment in appropriate equipment as well as employing parking controllers. The project would be financed by the Capital’s own resources, but it has not yet been decided if it will be through leasing, capital investment (purchasing of equipment), or by other means. Project preparation costs incurred (e.g. feasibility study, salaries, and other costs) are recorded in the accounting system to be reflected in the value of the project. However, there is currently no clarity if all these costs could be capitalized. Initial control procedures have already identified costs being posted to incorrect codes in the accounting software. Key controls of Asset Management include: • The Asset Management Department keeps records and documentation of the existing assets of the Capital (asset register) • Conducting periodical physical verification of assets recorded in the asset register. Any variations are identified and recorded promptly in the records. • Identification of asset condition during physical verifications and proposals for write-off and disposals documented. • The Asset Management Department reviews periodically the depreciation rates used and assigns new depreciation rates for asset additions Procurement and Contracting The Procurement process in Orotavia is usually a team effort, including representatives of all relevant departments of the Capital. These teams deal with specific procurement processes if the total value of the investment exceeds the equivalent in local currency of euro 10,000. Procurement processes below this value are concluded within the relevant requisition departments (i.e. the department that will be the recipient of the goods or services). For all procurements, at least three competing offers should be obtained for the bid, which are 14 assessed taking into account elements like: the price, payment conditions, the reputation or experience of the supplier, assessment of prior cooperation with the suppliers, etc. In such cases the selection of the supplier is suggested by the relevant requisition Department and must be authorized by the Department Head and by the Mayor or one of his deputies. For procurements exceeding euro 10,000 a special procurement team is being created. The Capital does not have an IT solution for managing the approval of procurement – approvals are done on paper. Entering into a contractual obligation involves key officials of the Capital. Contracts are negotiated according to the conditions set forth in the procurement selections and all contracts are reviewed by the Capital’s lawyers. Contracts are signed by appropriate officials of Orotavia and similar contract value conditions apply as for procurements: contracts with a value exceeding euro 10,000 are signed by Departmental Heads in charge of the purchase and by the Mayor or Deputy Mayor (paper approval); contracts with a value below euro 10,000 are signed by Department Heads (paper approval). All contract conditions are reviewed and approved internally by Orotavia’s Lawyers and by the Finance Department for potential risk of breaching laws or regulations, or for potential hidden legal exposures. The Internal Audit Team examined the procurement process for the new paid parking system and contracting of a private company to construct the new 3rd bridge through PPP. In order to select the best supplier for the equipment and to establish fair bidding procedures, a dedicated task force was formed led by Orotavia’s Mayor and representatives of the Budget Department, Asset Management and Maintenance Department, and the Investment Planning Department of Orotavia. A delegation from the Capital travelled to a relevant trade fair in Frankfurt, Germany to undertake research and encourage producers of parking machines to take part in the international bidding process. The Mayor and two departmental representatives (Directors and/or Deputy Directors) from the task force participated in the one week-long business trip. Upon return from the trip, the task force prepared the selection criteria for the bidding process, which initially included: the price of the equipment, cost of maintenance of the equipment, the length and conditions of technical support and conditions of post-purchase guarantee of the equipment, and user friendliness of the parking machines. Following the preliminary presentation and discussion of the selection criteria among the task force, one additional criteria was included, based on personal comments from the Mayor. These criteria included the importance of having a color touch screen on each parking device, rather than only buttons for making payments. The Mayor justified the need for this feature, as it would make the payment process easier for the people, who were not used to toll parking equipment, to read what is on the screen. The Mayor’s proposal was accepted by the task force and the selection criteria were updated accordingly by adding the criteria “color touch screen included”. 15 The bidding process was announced with the opening and closing dates. The selection criteria were publicly announced, but the scoring system and percentage impact of each particular selection criteria on the total score was kept secret from the public and the bidders. The timeframe for the bidding process lasted one week and bids were obtained in closed envelopes. The task force analyzed the results and it turned out the winning German company proposed the most technically advanced model, with high resolution color touch screen. The conditions of post guarantee were similar to other bidders, however the purchase price of the equipment and related maintenance costs were 60% higher than the prices of the cheapest solution and 20% higher than the price of the second most expensive equipment. A contract was signed for the purchase of an initial 40 units, combined with obligatory maintenance performed by the supplier company within the timeframe of the equipment guarantee of 3 years. The Legal Department has recently been very busy, involved in negotiating a large PPP contract for a private partner to finance construction of the new bridge in the Capital. Following the preparation stage (e.g. defining location and architectural design of the bridge), the Capital invited companies to officially show their interest in investing through a PPP project. The process was not a success, with no companies expressing an interest in participating. The main reason stated was that the city and the country have no experience in this type of project, which is relatively big in scope and in value. It was also stated that the assumptions of the investment and revenue projections are prone to errors as the final outcome is absolutely unclear. The project seemed to be doomed, until representatives of the Ministry of Development started encouraging talks with the investment bank Rich Brothers. Some project conditions had to be modified by Orotavia. The length of the PPP, originally planned for 20 years assuming breakeven after 15 years, had to be extended, for example, with Rich Brothers obtaining the rights to run the program for 30 years before the rights and obligations would return to Orotavia. The agreement specified adherence to architectural and technical specification, but did not impose any obligatory financial burden of adjustments made to equip the bridge with tram infrastructure. Such decisions would need to be made with the mutual consent of both Orotavia and Rich Brothers. Given the Ministry of Development’s role in securing the final (and only) company selected, the Deputy Minister of Ministry of Development signed the contract. The ongoing major reform of the Capital’s IT infrastructure is managed by an independent IT consultant, Mr. Placheta, selected through a tender process. Mr. Placheta, founder and manager of his own IT development company – “Professional IT Solutions Ltd”, works closely with the IT task team, is helping assess the current IT outlook, and is involved in directing IT strategy for the future. Key controls of Procurement and Contracting Process include: • Predefined process that requires at least three competing offers for all selections. 16 • Consultations with lawyers and any relevant departments within the Municipality (including obligatory with Finance Department), • Formal process for authorization in place: o Procurements and contracts below euro 10,000 require authorization of Department Head and by Mayor or one of his deputies o For procurements and contracts exceeding euro 10,000 the same applies plus a special procurement team is being created. Human Resources The municipality staff of Orotavia is dominated by supporters or family and friends of the ruling party - League for Citizens Prosperity. The Human Resources function in Orotavia is responsible for hiring, training, and developing the staff of Capital and some of its related ventures, e.g. office issuing ID cards, city parking controllers, and municipal police. The City public transport company, utility companies, and most schools and city hospitals have their own HR functions. Department heads have the best understanding of the workload and future changes in their units, which require new hiring. Department heads request hiring of new staff as required, informing HR of the role and outline responsibilities of the new hires. The HR department drafts in detail the range of responsibilities, describes expectations from the candidates (including formal education requirements), and describes the conditions of hiring. This set of documents is then sent back to department heads for final review. Department heads update the documents if needed (and send back to HR for changes). If no further changes are required, department heads give their go ahead and the HR Department seeks approval for the new position/replacement from the Mayor (or his Deputy in the Mayor’s absence). When the Mayor (or Deputy) is satisfied with the justification obtained from the department head, he/she sends back the signed request to the HR Department (paper approval). Based on this formal approval, HR starts the hiring process: the job announcement is posted on Orotavia’s web page with clear requirements of the job, expectations from the candidates, and giving the final deadline for applications. The information regarding expected salary is not disclosed openly on the web-page. The final job contract with the new hire is signed by HR, and the head of the relevant department. Many employees are hired on the basis of short-term contracts, often renewed many times. This approach was adopted to save money on social charges for these types of employees. Labor law is changing in the country, requiring hiring such employees full time after the 4th extension of a short-term contract. HR and lawyers are currently investigating the impact and magnitude of the law change on the Capital. There have been three options identified: (i) hire new people every 6 months – this option would make the costs of retraining staff quite high; (ii) do nothing and continue the current practice – this option is favored by the Mayor, but 17 opposed by HR and lawyers; (iii) consider opening permanent staff positions – this option is recommended by HR and lawyers, but opposed by the Mayor. In the last year, the Capital has hired several new people, including two in the Finance Department, one in the IT Department and one in the Asset Management Department. Another important role of the HR department is staff development and career planning for staff. Employees of Orotavia have the right to develop their technical skills according to a plan agreed with their management. This development plan is discussed at annual development meetings. During these meetings, staff performance is evaluated and they are encouraged to discuss career development including possible changes to their responsibilities, including changes of department when the opportunity or interest arises. There is a formal code of conduct with ethical values, developed some time ago and still in effect. The code of conduct describes several ethical dilemmas and addresses issues of corruption, fraud, equal opportunities for staff, fair treatment, and empowering the work environment. Key controls of Human Resources include: • HR cannot initiate the need for new employees (except from their own department), Department heads request new staff recruitment. • HR does not decide conditions of the contract and job responsibilities, but refines the descriptions of responsibilities, expectations (including formal education requirements), and conditions of hiring. Department heads review and update the documents if needed and send back to HR for further changes. • Independent approval of new hires - approval for new position/replacement from the Mayor or his Deputy (in the absence of the Mayor). • The Mayor (or Deputy) sends back the signed request to HR Department (paper approval). • The final job contract with new person is signed by HR, and the head of the relevant department. IT General Controls The IT unit is responsible for generic IT related issues of the Capital (such as IT infrastructure modernization and maintenance, access rights, periodic reviews of these rights, and security and reliability of IT structures) and for some cross-departmental functions within Orotavia (e.g. providing assistance during maintenance of accounting software, banking systems, etc.) The IT team comprises the Head of Unit and 3 IT specialists . The Head of the IT Unit reports to the Head of Finance Department. 18 The IT unit is responsible for managing systems access rights. Each employee with an employment contract (full-time or part-time) of the Capital has a specific ID with its password allowing access to the network. There is a requirement to change the passwords every 90 days and systems controls prompt users to make this change. Some employees have access to other specific software according to their role and function in the Capital. For example, employees from the Finance Department have access to accounting software, some also to the banking payment systems of various banks; employees of the Asset Management Department have read-only access to the fixed asset register; HR has access to the payroll system and HR database, etc. These are all different IT systems developed by different companies and require different access IDs and passwords. Access to banking systems is also restricted by using specific banking security tokens. Approvals of transactions and contracts as well as approving HR related matters have not been digitalized and everything is currently approved on paper. The code of conduct is discussed during the orientation training for all new employees and their signature confirms their agreement to comply. It is expected that the internal auditors would report any weaknesses in the system and would suggest improvements to the existing procedures and processes. Key controls within General IT Controls include: • A specific ID and password for each employee connected to the network changing every 90 days • The IT system, including access rights and passwords, is centrally managed by the IT Department • Access to online banking systems is also restricted by ID and passport and some of them require the use of specific banking security tokens Sampling Guidance The Internal Audit Team is planning to use audit sampling to test the effectiveness of internal controls and as substantive tests for compliance. The audit methodology followed by the Internal Audit Team recognizes that an auditor may choose between a statistical and a non-statistical approach to audit sampling. Most often auditors are required to utilize a randomly selected sample to gain comfort over the population, however when the auditor aims to conclude on a population in monetary amounts, rather than the rate of occurrence, then monetary unit sampling (MUS) is used. The MUS sample is selected based on each item having a chance of selection proportional to its size and is most often used when sampling to test accounts payables, salaries, etc. 19 Attribute sampling is applied when testing internal controls over compliance, as the auditor is primarily concerned about the rates of deviations from a prescribed control or, in tests of compliance, about whether there is evidence of compliance. Attribute sampling involves selecting a small number of transactions and making assumptions about how their characteristics represent the full population of which the selected items are a part. The tables below provide suggested minimum sample sizes for control testing mainly used by external auditors: Table 1: Large Sample Size (population above 250 items) and “0” deviations expected Inherent Risk Significance Likelihood Minimum Sample Size High High 60 High Medium 40 Medium High 40 Medium Small 25 Table 2: Small Sample Size (population below 250 items) and “0” deviations expected Frequency Minimum Sample Size Quarterly 2 Monthly 2-4 Semi-monthly 3-8 Weekly 5-9 Assignments For the assignments below, please refer to Section II – Documentation Templates and Examples: (i) Refer to Template 3 and review the Team Kick off Meeting Notes (ii) Using information in Template 4, calculate a sample for further testing (iii) Using the Template 5, document your team’s approach to review the design of controls and select further controls to test 20 Reporting on the Internal Audit Engagement The internal audit team is preparing for a Closing meeting and is currently developing the recommendations / drafting the report. The following areas are being considered: Closing Meeting Mr Sveto called a closing meeting, the main areas discussed are below. The Audit Team reviewed the existing design of controls for finance, asset management, procurement, contracting, human resources, and IT general controls. The documentation, testing, results, and observations and recommendations, were presented to the Mayor and his operational team during the closing meeting. The meeting was an opportunity for the Capital’s management team to clarify the findings and comment on issues they were not sure about. It was also an opportunity to address comments which they strongly opposed. Discussion about the findings is beneficial for the Capital, it alerts the management team to issues they could not have been aware of. They are informed of procedures that could be strengthened and improved to address deficiencies of the present system. The Internal Audit Team is helpful in designing specific procedures to mitigate the risks identified and its communications to the management team are highly valued. Management Action Plan and Follow up Based on the findings of the internal audit, management has developed an action plan that has been reviewed by the Internal Auditors and appropriate monitoring procedures are established and agreed. The internal audit team will perform a periodical (monthly) follow-up on progress of action plan implementation. Satisfaction Survey Mr. Sveto is introducing an internal audit client satisfaction survey for the first time. Considered good practice in internal audit, this survey gathers feedback from audit subjects and management regarding the performance of the internal audit team and the benefits of their engagement, for consideration in future internal audits. A questionnaire was sent to the auditees asking them to give their opinion on e.g. the team’s understanding of the business specificities and risks related to the activity, the relevance of observations, and the benefits of the recommendations made. 21 Assignments For the assignments below, please refer to Section II – Documentation Templates and Examples: (i) Using Template 7 to develop and draft a set of recommendations for Orotavia to be included in the final report 22 Section II: Documentation Templates and Examples Template 1: Identified Risks and Related Auditable Processes Entity Name: Orotavia Capital City Year end: 31 December Prepared by: Reviewed by: Date: Place: Ref. Identified Risk Related Auditable Process(es) 23 Template 2: Detailed Audit Program Entity Name: Orotavia Capital City Year end: 31 December Objective: Develop the detailed internal audit program for the following processes: Finance, Asset Management, Procurement and Contracting, Human Resources, IT General Controls. Prepared by: Reviewed by: Date: Place: Anticipating Budgeted Ref. Scope of Work timing Hours 24 Example 3: Kick-Off Meeting Entity Name: Orotavia Capital City Year end: 31 December Objective: Kick-off meeting notes Prepared by: Senior Internal Auditor Reviewed by: Mr. Sveto Date: today Place: Orotavia, Ramovia An internal audit kick off meeting was held and the following items discussed: Purpose: The purpose of the kick off meeting is to introduce the audit team, explain the scope and approach of the audit, establish communication protocols, communicate time lines for the project, and inform the counterparts about the role of internal auditing and the value of a well-conducted audit. The team used a visual power point presentation during the meeting. Internal Audit Team: Head of the Internal Audit Department Mr. Sveto plus 4 members of the internal audit team. Other Participants: Mr Big., Mr. Munko and Mrs. Galusha; Department Heads and deputies of the Finance Department, Procurement, Asset Management and Maintenance, Human Resources, Legal, and IT. Purpose and approach of the audit: The audit will be carried out in the premises of the Municipality. Audit procedures would include interviews with the staff of the municipality, inspection of documents, investigation of procedures, applying analytical procedures, recalculating figures, and confirming selected balances. The internal audit team was not made aware of any special security measures. The auditee’s expectations are that auditors will provide assistance through guidance to the finance department regarding the recording and valuation of municipality bonds. Communication protocols Direct communication of the audit team to relevant officers from Orotavia. Communication of findings to the municipality Heads through the Head of the Internal Audit Department Mr. Sveto. Time lines for the project The field work of the project would be conducted over 4 weeks starting 6 March. The final report is expected in the first week of May. 25 Template 4: Sampling Entity Name: Orotavia Capital City Year end: 31 December Objective: Sample calculation: Accounts Payable verification based on volume of transactions. Information sources: Accounts Payable Ledger of Orotavia Prepared by: Reviewed by: Date: Place: Table 3: Sampling Parameters Population book value 100.000 EUR Number of items 30 Sampling Interval (Population book value / Number of Items) 8.450 EUR / 3 = 2,8 Random number 2 Table 4: Accounts Payable as of 31 December Reference Balance Cumulative Balance Sampling item 1 0,1 0,1 2 0,1 0,2 3 0,1 0,3 4 0,3 0,6 5 0,3 0,9 6 0,3 1,2 7 0,4 1,6 8 0,4 2 9 0,6 2,6 10 0,6 3,2 11 0,7 3,9 12 0,9 4,8 26 Reference Balance Cumulative Balance Sampling item 13 1 5,8 14 1,1 6,9 15 1,4 8,3 16 1,5 9,8 17 1,6 11,4 18 1,6 13 19 2 15 20 2 17 21 2 19 22 2,5 21,5 23 3 24,5 24 3 27,5 25 4 31,5 26 4,5 36 27 8 44 28 11 55 29 20 75 30 25 100 Total 100 Sampled % of 27 Template 5: Review the Design of Controls and Select Controls for Further Testing Company Name: Orotavia Capital City Year end: 31 December Objective: To review and document the design of controls within the Finance, Asset Management, Procurement and Contracting, Human Resources, and IT General Controls and select controls for further testing. Process: _____________________ Prepared by: Date: Reviewed by: Place: Management’s objectives Risk Control response to Risk Mitigating Controls Assessment of controls (strong or not strong) Test Description 28 Template 6: Summary of Recommendations Company Name: Orotavia Capital City Year end: 31 December Objective: Summarizing findings of internal control testing, develop recommendations and document client response. Prepared by: Reviewed by: Date: Finding Management Response Observation/ Finding Recommendation Ref # & Treatment 29