Based on best practices, the internal audit unit starts working on the three-year strategic plan from two to three months before the end of the budget year.

 

In the process of preparing the strategic plan, it is advisable to establish a team of internal auditors working on the strategic plan under the coordination of the head of the internal audit unit- as the person responsible for this process. Preferably, the team should have analytical skills, experience in working in electronic programs, as well as experience in processing statistical materials and comparative analysis.

 

The process of preparing a strategic plan includes:

 

• Defining the internal audit universe;

 

• Identifying risk factors;

 

• Assessment of the audit universe with defined risk factors;

 

• Ranking of auditees according to the total score of risk based on the assessment. The following measures are important for the effective management of the strategic planning process:

 

1. The team created during the preparation of the strategic plan should search, analyze the following information / documents (if any):

 

• Institutional strategy, goals and indicators of their implementation; • Risk registers of the institution;

 

• Organizational structure and functions of the institution;

 

• Charter of the institution;

 

• Documents, rules, procedures regulating the structural units of the institution;

 

• Budget;

 

• Previous internal audit reports, inspection findings;

 

• State Audit Office reports, media monitoring, etc.

 

2. Obtain information about the strategic vision of the management of the institution, goals, existing / possible risks and expectations. For this purpose, interviews and meetings with relevant individuals should be scheduled.

 

3. Obtain information about the activities planned by the Central Harmonisation Unit to coordinate activities.

 

4. Consider the plan of the State Audit Office to prevent overlaps.

 

The head of the internal audit unit, together with the working team, develops once every three years and submits the strategic plan of the internal audit to the head of the institution for approval before the beginning of the planned period. The approved strategic plan is sent to the Central harmonization Unit and in the case of municipalities - at will.

The success of an internal audit activity is largely due to the effective planning of its activities. The internal audit unit carries out strategic and annual planning during the implementation of strategic and annual planning. The internal audit unit examines the system of the institution, including objectives, structure, key processes, and develops a strategic and annual plan based on risk analysis. In the conditions of these limited resources, it ensures the correct redistribution of priorities and coverage of the highest risk areas in the system of the institution. As a result, the internal audit entity independently selects the objects to be audited, which creates a positive internal audit reputation and high credibility. For this, it is important to ensure the independence of the internal audit unit by the head of the institution. In addition, during strategic and annual planning, the head of the internal audit unit conducts a needs analysis, formulates a vision for the development of the internal audit unit, develops a specific action plan and communicates these plans with the head of the institution.

The plan includes activities in the following areas: building and developing the structure, strengthening the knowledge and competencies of auditors, developing and implementing procedures, developing and implementing a quality assurance and improvement program, periodic review of regulations, etc.

Although most public institutions today do not have long-term strategic development documents, the internal audit unit is still required to carry out strategic planning for a period of 3 years. This issue is regulated by the Law of Georgia on Public Internal Financial Control as well as international standards.

See also Annex №3 Strategic Plan and Annex №4 Annual Plan of the Internal Audit Methodology.

The principles set out in the Code of Ethics apply to both assurance and consulting activities. Consequently, the functional independence of the unit and the objectivity of the auditor are fundamental in the implementation of consulting activities by the internal audit unit.

 

Consulting activities in the definition of internal audit have been around the world since 1999, although they aim to provide added-value advice or suggestions on future-oriented decisions within an extended mandate. As long as the internal auditor does not make a decision and only gives advice or suggestions, she/he does not violate the principle of independence.

 

 

The following key approaches should be taken into account when carrying out consulting activities:

 

The request should come from the client of the consultation (from the head of the structural unit or a group of persons who need consultation and receive advice);

 

parties must participate - internal auditor and client;

 

The objectives, scope and techniques of the consultation should be agreed in advance with the client of the consultation;

 

The objectives of the consultation should be agreed with the client of the consultation related to the governance, risk management and control processes; At the same time, it should be in line with the values, strategy and goals of the institution;

 

The consultation should be provided by an internal auditor with appropriate knowledge and skills. In the absence of such a resource, the head of the internal audit unit should ensure that the appropriate resource is obtained or refuse to consult.

 

 

What should be considered when consulting to ensure that the internal auditor avoids conflicts of interest??

 

The internal auditor should provide qualified and well-reasoned consultation, client is responsible on taking into account the consultation. In addition, it is necessary for the internal audit unit to explain to the client the essence, approach, responsibilities of the parties and the results.

Assurance and consulting activities have both common features and differences.

 

Similarities between assurance and consulting activities:

 

1. The charter of the internal audit unit should specify both assurance and consulting activities;

 

2. Objectivity and independence are important supporting principles in the implementation of both cases;

 

3. To comply with these principles, the internal auditor should not assume managerial responsibility.

 

However, there are significant and clear differences between assurance and consulting activities, namely:

 

 

Although the International Standard clearly distinguishes between assurance and consulting activities, it does not preclude the possibility of their joint implementation. For example, the need for valuable advice may arise during the assurance activity.

 

In accordance with the International Professional Practice Framework of the Institute of Internal Auditors:

 

▪ An assurance activity is an independent assessment of an institution's governance, risk management, control measures and processes through objective examination of evidence.

 

▪ Consulting activity is an action, the essence and scope of which agrees with the object and is aimed at creating added value; It also aims to improve the governance, risk management and control processes of the institution, however, it does not take on managerial responsibilities. It can, for example, give advice, facilitate and conduct training.

Until today, we face the confusion of the internal audit function with the inspection, misconduct or financial monitoring functions, which is a wrong practice and does not meet the standards. Moreover, this practice hinders the development of internal audit activities in the public sector. Even when these functions are confused, it is not appropriate to add inspection, monitoring, control or any other word in the name.

The internal auditor has no right to perform other functions in the institution, except for the functions defined by the Law of Georgia on Public Internal Financial Control and its legal acts. For example, this implies that an internal auditor should not perform:

 

1. Tasks and functions of other structural units;

 

2. Official and thematic supervision;

 

3. Control of employee appearances;

 

4. The functions of a member of the tender commission;

 

5. Establishment of an internal control system;

 

6. Disciplinary and / or inspection investigation;

 

7. Discuss the issue of disciplinary punishment of the employee;

 

8. Other "additional" features.

 

This violates the principle of independence and objectivity.

Understanding and segregation in the activities of internal audit and inspection is the responsibility of the head of the internal audit unit. Accordingly, it is recommended that the head of the internal audit unit:

 

▪ Understand the requirements of internal audit standards, understand the fundamental differences between the objectives and approaches of internal audit and inspection;

 

▪ Analyze the need and importance of the inspection function, prepare relevant arguments for submission to the head of the institution; Ensure that appropriate steps are taken in the event of cancellation of the inspection;

 

▪ Carry out proper communication with the head of the institution on the functional and structural arrangement of the internal audit unit, as the head is directly responsible for the establishment of internal audit in the institution;

 

▪ According to the transitional provision of the law, to separate the activities of internal audit and inspection at least as a functionally independent structural subdivision / unit; This separation should be reflected in the charters, job descriptions and also implemented in practice;

 

▪ Develop appropriate internal procedures and instructions for both functions;

 

▪ Select appropriately qualified internal audit and inspection staff, explain the relevant requirements, methods and approaches for each function, which will be separated into practice. If the internal audit unit consists of two or three people, then the separation is practically impossible and formal. In such a case, the inspection function should be completely removed from the internal audit entity.

According to the existing and international practice, the existence of an inspection function in the internal audit unit is not advisable, as this approach hinders the proper formation and development of the internal audit function. In addition, it leads auditee’s unclear, wrong understanding of the role and essence of the internal audit unit.

 

According to the Central harmonization Unit’s and international evaluators’ observations, one of the reasons for the low rate of development of internal audit across the country is the combination of internal audit and inspection functions. This hinders the concentration of the head of the internal audit unit on the introduction of internal audit standards and methodology, ensuring adequate quality, as well as the improvement of internal audit activities. In addition, internal audit is still associated with the punitive and delays control unit, which is not at all the purpose and function of internal audit.

 

It is true that at the present stage, according to the transitional provision of the law, the existence of a structural subdivision / unit of inspection is allowed, which is functionally separated from the internal audit activity, however, according to the recommendation of the Central Harmonization Unit, the internal audit unit should be not only functionally, but also structurally separate and independent from inspection.

Internal audit and inspection are significantly different from each other. The goals of the activities, their tasks, approaches, implementation processes and results are different.

The main differences between internal audit and inspection are presented in the table:

 

 

The examples in the table are just some of the differences between internal audit and inspection, although the examples clearly show why internal audit and inspection functions should be separated. The confusion of the above may lead to the limitation of the principles of objectivity and independence of the internal audit function, which will lead to a loss of confidence in the internal audit entity.