8/3/2019 Fixing Internal Audit

1/3

24 FMI JOURNAL VOLUME 17, NO. 3

On April 1, 2006 the Treasury BoardSecretariats (TBS) new InternalAudit Policy came into effect. As

the 40 year history of well-intentioned, butfailed attempts to establish an effectiveinternal audit sector in the federal govern-ment indicates successfully implementingthe policy will be difficult. In this light, per-haps, a less inauspicious date for the policyto come into effect could have been cho-

sen. The obvious questions are why havepast efforts failed so conspicuously and dothe new policy and internal audit provi-sions of the proposed Federal AccountabilityActhave a better chance of succeeding.

To tackle these questions we need to goback at least to the 1962 Report of theRoyal Commission on Government Orga-nization (better known as the GlasscoCommission.) There was little departmen-tal internal auditing prior to the GlasscoReport. Most auditing was done from the

centre by the Comptroller of the Treasury.Managers believed that the Comptrollerpatrolled departments to ensure financialrectitude. Glassco, however, was not a fanof central control. In fact, he recommendedthe creation of departmental audit groupsas a corollary to his famous slogan let themanagers, manage. In response to Glasscothe TBS, in 1966, introduced a plan whichwas supposed to lead to the establishmentof internal audit functions in departments.In 1969 the Comptroller of the Treasurywas disbanded leaving central agencies with

little information on how well their policieswere being implemented.

The state of the internal audit sector wasnot reviewed again until 1975. The AuditorGenerals 1975 Financial Management andControl Study found that some depart-ments had no internal audit function, somehad diverted auditors to other projects andauditors were not well trained or knowl-edgeable about their responsibilities. Threeyears later the 1978 Auditor General report

found that internal audit across govern-ment was in disarray. Although depart-ments were spending about $50 million onauditing, there was little to show for it.Specifically, several groups in a department were

involved in uncoordinated audit activi-ties

the responsibilities of most audit groupswere not defined

few departments paid more than lip serviceto determining priorities based on materi-ality and risk there was a tendency tochoose the easiest matters to audit

the low organizational importance placedon internal audit meant they were nei-ther independent nor objective

there was no assurance audits had beenproperly carried out

audit reports were issued long after com-pletion of audits reducing the value ofthe process and reports never reached

managers who could take correctiveaction some departments had not appointed

audit committees and where committeeshad been appointed they were not meet-ing their responsibilities

the prevailing attitude toward audit wasone of resentment resulting in the depar-ture of better auditors

central agency support for internal audithad been spasmodic and often divisiveSixteen years after the Glassco Commis-

sion, in 1978, the newly created Office of

the Comptroller General (OCG) launchedan initiative to improve internal audit. Forexample, in 1980 it established an InternalAudit and Special Studies Division to assistdepartments. In 1982 it issued standardsfor internal audit. By 1984 the AuditorGeneral was able to report that the gov-ernment [had] made significant progressovercoming most of the deficiencies inorganizational structure identified in 1978with the major exception of audit commit-

tees. Some committee meetings were littlemore than a formality and some commit-tee members did not appear to clearlyunderstand their roles and responsibilities.

Fifteen years later, in 1993, the AuditorGeneral reported that internal audit hadfailed to live up to its expectations. A scaledback OCG had reduced its leadership rolePerformance of internal audit groups varied

greatly. Very little work was carried out toidentify risks and in some departments onlyareas suggested by managers were reviewedIn addition, internal audit was being toooften used [by departments] as a place torelocate people without potential foradvancement in other areas.

In addition, management attitudestoward internal audit had not changedDespite more than 30 years of preachingthe value of internal audit, senior managersstill told the Auditor General that theywould not have an internal audit group in

their organizations if the Treasury Boarddid not require them to do so. Frustrated with this lack of appreciation for internaaudit, the Auditor General lectured thatdeputy heads and senior managers mustunderstand the potential benefits of effec-tive internal auditing. If they do not, hesaid, there is little prospect [that they] willbe able to realize the benefits of internalaudit that their colleagues outside the fed-eral government enjoy.

Fixing Internal Audit:One More Try

Alan Gilmore

Alan GilmoreAlan Gilmore, Ph.D. is a former senior principal inthe Office of the Auditor General of Canada. He hasextensive experience reviewing values and ethics ini-tiatives, and governance and regulatory frameworksHe was responsible for the Auditor Generals recentreports to Parliament on the Costs of Implementingthe Canadian Firearms Program and Accountabilityand Ethics in Government. He is professor in Public

Affairs Ethics in the Faculty of Philosophy at Sain

Paul University, Ottawa, and he is an Associate withthe strategic policy and management consulting firmSussex Circle.

8/3/2019 Fixing Internal Audit

2/3

The 1996 Report of the Auditor Generaldocumented the effects of restructuring anddownsizing on internal audit. Compared to1993, expenditures on internal audit haddropped to $48 million from $56.6 millionand the number of internal auditors haddecreased to 590 from 700. In addition, the

Auditor General concluded that the newlyintroduced TBS Review Policy was nothelping because its various statements onthe role of internal audit had at the mostfundamental level... introduced confusionas to what internal audit should be doing.

By 2000, the TBS Study of InternalAudit in the Federal Government estimatedthat as a result of downsizing there are nomore than 300 internal auditors, and thattotal expenditures for internal audit in thefederal government [was about] $30 mil-lion. Thus, over a seven year period, the

expenditures on internal audit haddecreased by $26.6 million and the numberof auditors had declined by 400. These areballpark estimates. Its likely that the expen-ditures and the number of auditors indepartments were much lower than the fig-ures suggest since the numbers include thelarge internal audit function that RevenueCanada continued to maintain.

In 2001 the TBS estimated that therewere only 240 auditors. It issued a revisedpolicy on internal audit and allocated new

funds so that by 2002-03 expenditures hadrisen to $54 million nominally about thesame as was being spent in 1975 but muchless after taking inflation into account. The2003 TBS evaluation of the policys imple-mentation reported that the internal auditsector was under-resourced by 162 full timeequivalent staff and $18.3 million.

After reporting on the problems inHuman Resources Development Canadasgrants and contribution program (2000),the Canadian Firearms Program (2002) andthe Sponsorship Program (2003), the Audi-

tor General issued a sixth report on internalaudit (2004). This report assessed theextent to which internal audit in six depart-ments and agencies met international stan-dards for the professional practice of inter-nal auditing. The Auditor General foundthat internal audit was in much the samestate as it was two decades earlier. For exam-ple, two departments generally met the pro-

fessional standards, while three partially

met them and one did not meet many ofthe standards

while the primary role of internal audit was to provide assurance that manage-ment control systems were effective, lim-ited assurance work was being done

the quality of internal audit varied wide-

ly and audit reports were not timely three of six deputy ministers did not

strongly support their audit functions departmental audit committees lacked

independence and audit committeemembers did not fully understand theirresponsibilities

there was insufficient funding for inter-nal audit and departments had difficultyattracting and retaining qualified staff

there was no capacity to provide auditservices to small agenciesIs there any hope that the new 2006 TBS

Internal Audit Policy will fare better thanits predecessors? Some of the features of thepolicy give it a better chance of working,particularly the key innovation of creatingan Independent Audit Committee toactively oversee departmental governancesystems. According to the policy, the objec-tive of internal audit is to provide deputyheads and the Comptroller General, respec-tively, with added assurance, independent ofline management, on risk management,control and governance processes [emphasis

added]. The cornerstone of the new policyis the creation of an Independent AuditCommittee (IAC) to play an active over-sight role and provide the added assur-ance on a departments risk management,management control framework and gover-nance processes, including accountabilityreporting and arrangements to foster soundpublic service values and ethics.

In contrast to the 2001 policy whichcalled for audit committees chaired by thedeputy or associate deputy minister with amembership of assistant deputy ministers,

the 2006 policy requires that a majority ofthe three to five member IAC, and prefer-ably its Chair, be from outside the govern-ment. While the IAC provides its advice todeputy head in the first instance, the policyalso provides for IAC reports to be for-warded to the Comptroller General and forthe IAC to meet with the responsible min-ister.

The IAC is required to report annually tothe deputy head the results of its review of:

internal and external audit reports management representations on risk

management, management controlframeworks, and governance processes

accountability reports, e.g., departmentaperformance reports

financial statements

management action plans to addressaudit recommendations and implemen-tation progress

the performance of internal and externaauditorsThe IAC has the authority to obtain

advice and services from outside a depart-ment. But in most instances it will likelyrely, like its counterparts in Crown corpora-tions and the private sector, on internaaudit to provide the information to developits assurances. A small Secretariat, probablylocated in the internal audit function, will

be needed to support the IAC by coordi-nating meetings and agenda, obtaininginformation, providing reports, and writingdraft IAC reports. Implicit in the policy isthe expectation that responsible managerswill provide the IAC with reports (manage-ment representations) on the state ofdepartmental and program risk manage-ment procedures, management controframework and governance processes andmeet with the IAC to discuss these reports.

Predictably, these innovations have raised

concerns. There are concerns about the cost.Clearly, accountability cannot be boughtcheaply. The government will have to pro-vide sufficient funding or the policy will failThere are suggestions that people with therequired expertise will not be willing to takeon IAC member responsibilities for fouryears with, perhaps, an annual workload of20 or more days at current government perdiems. This may not be a major issue sincethe government does not seem to have anyproblem staffing its many boards and com-missions at current per diems. There are also

concerns that the IAC may not be sufficient-ly independent because the policy allowsdeputy ministers to be Chairs or members ofthe Committee and other senior managers tobe members. Such an arrangement appearsto conflict with the IACs purpose to provideadded independent assurance to the deputyminister. It would be wise to revise the poli-cy to avoid this perceived or real conflict ofinterest which could compromise the credi-bility of the IAC.

SPRING/SUMMER 2006 FMI JOURNAL 25

FIXING INTERNAL AUDIT

8/3/2019 Fixing Internal Audit

3/3

26 FMI JOURNAL VOLUME 17, NO. 3

The resistance of senior managementcould be a major obstacle. Some seniormanagers may view the establishment ofthe IAC as a threat to the deputy ministersand their authority and to the deputys andtheir relationship with the minister. Theymay fear the IAC will take over direction of

key areas of departmental governance or, atthe very least, overwhelm the departmentwith requests for information and action onrecommendations from internal audit, theComptroller General and the Auditor Gen-eral. This is unlikely. While the IAC isinnovative its role is much less intrusivethan audit committees in Crown corpora-tions or the private sector. For example, theTBS guidelines for Crown corporationaudit committees state that the committeeon behalf of the board of directors, holdsmanagement accountable for the corpora-

tions standards of behavior, its financialreporting, and its business systems andpractices [emphasis added]. In contrast,the IAC does not hold anyone accountablebut rather provides added assurances to thedeputy minister that departmental gover-nance systems are working.

Passage of the proposed Federal Account-ability Actwill help bring internal audit outof the cold. The Act reinforces the policy bymaking the deputy head of a departmentresponsible for establishing an internal

audit capacity and an audit committee(albeit not an independent audit commit-tee.) It also makes the deputy head anaccounting officer accountable to theappropriate parliamentary committee for:using departmental resources to deliver pro-grams in compliance with government poli-cies; taking measures to maintain effectiveinternal control systems; and signingdepartmental financial statements. In addi-tion, the Act obligates the deputy head toappear before the appropriate parliamen-tary committee to answer questions on how

these responsibilities were carried out.In this regard, the IACs could be the

deputy ministers best friend. Establishingan effective internal audit function and acredible independent audit committee would allow an accounting officer todemonstrate to parliamentary committees

that assigned responsibilities are being pru-dently carried out and that the informationbeing provided in accountability reports isaccurate and comprehensive. In practice,deputy heads could rely on the IAC to dothe leg work to ensure that departmentalmanagement processes are operating well,and, protect the ministers, themselves andthe department from unnecessary criticism.

Ministers and senior central agency man-agers responsible for the legislation and pol-icy can try to persuade their colleagues indepartments that the policy will be benefi-

cial. However, given the history of internalaudit initiatives this could be difficult tosell. Whats necessary is a major change inthe reward system and government andmedia culture.

The appraisal, reward and promotionsystem of senior managers will need toexplicitly include such factors as: their degree of co-operation with internal

audit and the IAC whether they seek internal audits to

ensure that programs are operating well

whether they insist on tell it like it isaudit reports whether audit reports indicate that

departmental and program risk manage-ment, management control frameworksand governance systems are operatingwell

the speed with which they act on auditrecommendations

the accuracy of their management repre-sentations on their stewardship of theirprograms to the IAC and to Parliamentin accountability documents such as the

departmental performance reportWhile changing the reward system is nec-

essary, it is not sufficient. Major culturalchanges will be needed for the legislationand policy to work. Departmental internaaudit reports are generally made public. Ifthe new approach to internal audit is going

to work, the gotcha culture of Ottawa willneed to change. Establishing an effectiveinternal audit function and an IAC, pro-ducing quality audits and fixing the prob-lem have to become as newsworthy as theproblems audits identify.

Of equal, if not more importance, will bethe need for parliamentary committees torecognize that taking a partisan approach toaccounting officers may not only politi-cize deputy ministers but also underminethe new internal audit policy. Establishingan effective and credible IAC could help

provide the objective assurances to parlia-mentary committees needed to sustain thenon-partisan role of the accounting offi-cer and internal audit.

Suggesting that the media take a morebalanced approach to audit reports or thatparliamentary committees act in a morenon-partisan manner may be unrealisticHowever, these realities have to be recog-nized as key factors affecting the success ofthe policy.

A lot of pieces will have to fall into place

if the new policy is going to work: the TBS will have to provide sufficient fundingcredible IACs will have to be established;senior managers will have to be supportive;the quality of audit reports will have to behigh, and hopefully, the media will givemore balanced reports of internal auditfindings and parliamentary committees willdeal with accounting officers in a non-partisan manner. Clearly, implementingand sustaining this policy will not be easy.

FIXING INTERNAL AUDIT