|
Definition |
Activity Based Management (ABM) |
ABM is part of a wider strategic decision-making process that starts with the setting of political priorities through management planning and performance - taking into account the objectives and available resources of the organisation – right to the benchmarking of the programme achievements. |
Accounting Control System |
A series of actions, which are part of the total internal control system concerned with realising the accounting goals of the entity. This includes compliance with accounting and financial policies and procedures, safeguarding the entity’s resources and preparing reliable financial reports. |
Administrative Control System |
A series of actions, which are part of the internal control system, concerned with administrative procedures needed to make managerial decisions; realise the highest possible economic and administrative efficiency and ensure the implementation of administrative policies, whether related to financial affairs or otherwise. |
Audit |
In its most generic sense this can mean any examination ex-post of a transaction, procedure or report with a view to verifying any aspect of it – its accuracy, its efficiency, etc. The word usually needs to be qualified more narrowly to be useful. |
Audit Evidence |
Information, which supports the opinions, conclusions or reports of the auditors, internal audit services or SAI.
It should be:
· Competent: information that is quantitatively sufficient and appropriate to achieve the auditing results; and is qualitatively impartial such as to inspire confidence and reliability.
· Relevant: information that is pertinent to the audit objectives.
· Reasonable: information that is economical in that the cost of gathering it is commensurate with the result, which the auditor or, the internal audit service or the SAI is trying to achieve. |
Audit Mandate |
The auditing responsibilities, powers, discretion and duties conferred on any audit body (e.g. the SAI) under the constitution or other lawful authority of a country (as set out in primary or secondary national legislation). |
Audit Objective |
A precise statement of what the audit intends to accomplish and/or the question the audit will answer. This may include financial, regularity or performance issues. |
Audit Procedures |
Tests, instructions and details included in the audit programme to be carried out systematically and reasonably. |
Audit Scope |
The framework or limits and subjects of the audit. |
Audit Trail
|
The phrase has a rather imprecise general meaning in general audit usage. However, annex 1 of Council Regulation 2064/97 has provided a specific detailed description of the requirements of ‘a sufficient audit trail’ for the purposes of the structural funds managed by the Member States on behalf of the Commission. In brief, it requires the maintenance of records giving the full documentation and justification at all stages of the life of a transaction together with the ability to trace transactions from summarised totals down to the individual details and vice versa.
The overriding objective of the audit trail is to ensure a ‘satisfactory audit from the summary amounts certified to the Commission to the individual expenditure items and the supporting documents at the final beneficiary’.
The phrase 'audit trail' in the Regular Reports and the Accession Partnerships is to be understood in the light of the above definition which should be applied in the context of all Pre-Accession Funds to Candidate countries. |
Audited Entity |
The organisation, programme, activity or functions subject to audit by the SAI or the (internal) audit service. |
Auditing Standards |
Auditing standards provide minimum guidance for the auditor that helps determine the extent of audit steps and procedures that should be applied to fulfil the audit objective. They are the criteria or yardsticks against which the quality of the audit results is evaluated. |
Central Harmonisation Unit |
A policy unit attached and directly reporting to the Minister of Finance on the status of internal control in the entire public sector, responsible for redesigning, updating and maintaining the quality of the internal control systems, for harmonising and co-ordinating definitions, standards and methodologies, for networking between all actors (managers, financial officers, internal auditors), for the establishment and co-ordination of sustainable training facilities, including the setting of criteria for the certification of public internal auditors and for all other actions to improve public internal control systems.
A CHU can cover both areas of Financial Management and Control systems and Internal Audit in one Directorate with each area to be developed independently (two sub-directorates). Alternatively a country may decide to establish a special CHU for the development of Internal Audit, directly reporting to the MoF and a special CHU for FMC-systems that could be attached to the Treasury or the Budget Department. |
Charter
(Internal Audit Charter) |
Also called Internal Audit Mission Statement. The Charter/Mission Statement of the internal audit activity is a formal document that defines the internal audit activity's purpose, scope, and responsibility. It aims to ensure that the internal audit is looked upon with trust, confidence and credibility.
The charter should:
· Ensure the functional independence including specification of the position of the internal audit activity within the organisation;
· Permit unrestricted access to records, personnel, and physical properties relevant to the performance of engagements;
· Define the scope of internal audit activities;
· Define reporting requirements to auditees and, where necessary, to judiciary institutions and
· State the relationship with the State Audit Office. |
Compliance Audits |
See Regularity Audits |
Conflict of Interest
(Conflict of Roles) |
There is a conflict of interests where the impartial and objective exercise of the functions of a player in the implementation of the budget or an internal auditor is compromised for reasons involving family, emotional life, political or national affinity, economic interest or any other shared interest with the beneficiary. |
Constitutional |
A matter which is permitted or authorised by, the constitution of fundamental law of a country. |
Controls |
Any kind of control on an organisation or beneficiaries of public funds, whether internal or external |
Due Care |
The appropriate element of care and skill which a trained auditor would be expected to apply having regard to the complexity of the audit task, including careful attention to planning, gathering and evaluating evidence, and forming opinions, conclusions and making recommendations. |
Economy |
Minimising the cost of resources used to achieve given planned outputs or outcomes of an activity (including having regard to the appropriate quality of such outputs or outcomes). |
Effectiveness |
The extent to which objectives of an activity are achieved i.e. the relationship between the planned impact and the actual impact of an activity. |
Efficiency |
Maximising the outputs or outcomes of an activity relative to the given inputs. |
Ethics
|
Ethics in the public sector cover four main areas: setting public service roles and values as well as responsibilities and levels of authority and accountability; measures to prevent conflicts of interest and ways of resolving them; setting the rules (standards) of conduct of public servants; setting rules for dealing with serious irregularities and fraud. Management responsible for the FMC system is expected to make use of tools promoting and raising awareness of ethical values in management and control.
For internal auditors in particular, ethics imply the four principles of integrity, objectivity, confidentiality and competency. |
Evaluation |
Can mean
(a) The evaluation of tenders as part of the contracting process; or
(b) Specific reviews designed to examine the overall performance of a programme or project. Its scope may vary. Its core should be setting out, obtaining or calculating the outcomes of the programme or project and considering their economy, effectiveness and efficiency, but it usually covers a much wider range of issues including the appropriateness and achievement of output objectives as well. It may be carried out before, during or after the programme or project has been completed (usually known as ex-ante, mid-term or ex-post). It shares many characteristics with performance audit |
Ex ante financial control (EAFC) |
Ex ante financial control (EAFC) is the set of control activities prior to carrying out financial decisions relating to appropriations, commitments, tender procedures, contracts (secondary commitments), and related disbursements and recovery of unduly paid amounts. Such decisions can only be made on the basis of and taken after the explicit approval of the ex ante financial controller.
EAFC is sometimes also called "preventive control". This is the narrower meaning of financial control. If described as EAFC there can be no ambiguity. |
Ex post internal audit (EPIA) |
The set of audit activities that take place ex-post i.e. in this context, after financial decisions have been made by the management. EPIA can be carried out by centralised government audit bodies, responsible and reporting to the highest levels of government (Ministry of Finance or even the Cabinet of Ministers) or decentralised audit bodies (Internal Audit Units in government budget implementation spending units, like Ministries or Agencies). |
Ex-post |
When referring to audit, "ex post" usually means an audit performed after the initial legal commitment of a transaction. When referring to evaluation, "ex post" usually means an evaluation performed after the transaction has been fully completed. |
External audit |
Any audit carried out by an auditor who is independent of the management being audited. In public finance, it means audit external to the Government financial management and control policy. This is carried out by the national Courts of Auditors or the Supreme Audit Office and aims to objectively ensure that such management and control systems are compliant with the definition of PIFC above. |
Field Standards |
The framework for the auditor to systematically fulfil the audit objective, including a) planning and supervision of the audit, b) gathering of audit evidence which is competent, relevant and reasonable, and c) an appropriate study and evaluation of internal controls. |
Financial Audits |
Cover the examination and reporting on financial statements and examine the accounting statements upon which those statements are based |
Financial controller
|
The function of the financial controller may mean different things in different organisations e.g.;
(a) the role which gives ex-ante approval to individual transactions that they are in conformity with regulations and procedures; or.
(b) the same as auditor; or
(c) the management role which combines responsibility for the recording and processing of transactions (financial accounting) with the preparation of and reporting against budget targets (management accounting).
In the Commission, Financial Control was originally (1973) defined as ex ante approval of any kind of financial decisions. Later the internal audit function was added to the functions of the Finance Controller. Recently the trend is to split the two functions and the term "financial control" refers again only to ex ante approval.
In the framework of Enlargement the term is used for the ex ante approval function. |
Financial controls |
The phrase has a wide meaning in some organisations and a narrow meaning in others.
The wide meaning follows the meaning of internal controls except that it refers to controls, which have a specific financial component. In practice, in this context, there are few controls, which do not have a financial component and the phrase financial control can often be virtually interchangeable with internal control.
The narrower meaning follows the narrower meaning of financial controller and refers to the specific review of the conformity of transactions with regulations and procedures described in ex-ante financial control. |
Financial management (FM)
|
In the framework of Enlargement the term is understood to be the set of responsibilities of the management (which is responsible for carrying out the tasks of government budget handling units) to establish and implement a set of rules aiming at an efficient, effective and economic use of available funds (comprising income, expenditure and assets). It refers to planning, budgeting, accounting, reporting and some form of ex ante financial control. FM is subject to internal and external audit. |
Financial Systems |
The procedures for preparing, recording and reporting reliable information concerning financial transactions. |
Findings, Conclusions and Recommend-ations |
Findings are the specific evidence gathered by the auditor to satisfy the audit objectives; conclusions are statements deduced by the auditor from those findings; recommendations are courses of action suggested by the auditor relating to the audit objectives. |
Functional Independence (FI) |
The special status of a financial controller (narrow sense) or an internal auditor (whether central or decentralised), providing him/her with the power of maintaining a free professional judgement vis-à-vis his superior of the organisation in matters of control and audit. This concept requires the maintenance of a balance between those who are responsible for managing the organisation and those who are controlling/auditing the organisation. FI should be embodied in relevant legislation. Another way to ensure FI is to have the central control/audit organisation nominate a delegate Internal Auditor into the organisation to be audited or to allow the Internal Auditor (in case of conflict of interests) to report his findings freely to the central audit body. |
Fundamental |
A matter becomes fundamental (sufficiently material) rather than material when its impact on the financial statements is so great as to render them misleading as a whole.
See also Significant Control Weakness |
General Standards |
The qualifications and competence, the necessary independence and objectivity, and the exercise of due care, which shall be required of the auditor to carry out the tasks related to the fields and reporting standards in a competent, efficient and effective manner. |
Impact |
The same as result or outcome. |
Independence |
For an external audit it means the freedom of the national Courts of Auditors or similar institutions in auditing matters to act in accordance with its audit mandate without external direction or interference of any kind.
From an internal audit viewpoint it means that the internal audit service should be organised directly under the top management. Nevertheless, the internal audit service should be free to audit any area that it considers to be an area of risk for material errors, even when management might not think so. (see also functional independence) |
Internal Audit
Centralised internal audit (CIA)
Decentralised internal audit (DIA) |
The Institute of Internal Auditors definition is:
Internal audit is an independent, objective assurance and consulting activity designed to add value and improve an organisation's operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.
More concretely, it is the functional means by which the managers of an entity receive an assurance from internal sources (including internally subcontracted sources) that the internal controls are achieving their internal control objectives. It will cover, inter alia, Financial Audits, System Based Audits, Performance Audits, IT-Audits It has most of the characteristics of external audit except that it finally reports to the management and therefore can never have the same level of independence as external audit.
In public finance a distinction is made between centralised internal audit and decentralised internal audit as follows:
CIA is public ex post internal audit performed by a centralised body (e.g. the Ministry of Finance or another Internal Audit body (like the Government Control Office in Hungary or the Internal Audit Board in Malta)) on systems
DIA is the internal audit performed by specialised Internal Audit Units located inside government or lower public budget implementation spending centres (Ministries or Agencies) |
Internal Auditor (IA) |
The Internal Auditor (IA) (whether located outside or inside the organisation of the Managing Director) is responsible for carrying out all relevant kinds of ex post internal audit. In public finance terms, Internal Auditors should be subject to a special "statute" (preferably written in the Internal Audit Law governing the PIFC-system in a given country) allowing them an adequate degree of functional independence. The IA can report to the MD or be assigned by a central Public Internal Audit Service, like the Ministry of Finance or an Internal Audit Board responsible to the Prime Minister of the Cabinet of Ministers |
Internal Control |
The whole system of financial and other controls, including the organisational structure, methods, procedures and internal audit, established by management within its corporate goals, to assist in conducting the business of the audited entity in a regular, economic, efficient and effective manner.
Internal control relates to the following categories: Control environment; Risk assessment; Information and Communication; Control activities and Monitoring of controls |
Internal Control Objective |
The primary objectives of internal control are to ensure:
· The reliability and integrity of information.
· Compliance with policies, plans, procedures, laws, and regulations.
· The safeguarding of assets.
· The economical, efficient and effective use of resources.
Each organisation should design its own system of internal control to meet the needs and environment of the organisation. |
International Organisation of Supreme Audit Institutions (INTOSAI) |
An international and independent body which aims at promoting the exchange of ideas and experience between Supreme Audit Institutions in the sphere of public financial control. |
IT systems audits |
Examine the sufficiency and adequacy of the protection of the security of the systems of IT applications in order to guarantee the confidentiality, integrity and availability of information and IT systems |
Managerial Accountability |
Represents the obligation to be accountable for a given task. Accountability covers issues like separation of duties (authorising officer, accountant, ex ante financial controller); development of Financial Management and Control manuals (powers, responsibilities, reporting and risk management), all financial transactions (commitments, contracts, disbursements, recovery of unduly paid amounts), links with the central harmonisation facilities, and evaluation and reporting on FC systems |
Management control |
Control by management: the same as internal control, including financial control |
Management Information System (MIS) |
Centralised data base collecting and processing information to be timely and accurately given to managers at all levels for decision making, planning, programme implementation and control. |
Managing Director (MD) |
The Managing Director (MD) can be a Minister or his delegates, responsible for the implementation of Programmes/projects relating to national or lower budget income or expenditure. The MD is responsible for setting up financial management and control systems inside his organisation and the development of financial management and control manuals. The MD and the Accountant should create a double signature system (DSS) to provide for the highest degree of transparency in financial management. |
Materiality and Significance (Material) |
In general terms, a matter may be judged material if knowledge of it would be likely to influence the user of the financial statements or the performance audit report. Materiality is often considered in terms of value but the inherent nature or characteristics of an item or group of items may also render a matter material - for example, where the law or some other regulation requires it to be disclosed separately regardless of the amount involved. In addition to materiality by value and by nature, a matter may be material because of the context in which it occurs. Audit evidence plays an important part in the auditor’s decision concerning the selection of issues and areas for audit and the nature, timing and extent of audit tests and procedures. |
Mission Statement |
See Charter (Internal audit Charter) |
Monitoring by the Internal Audit |
The internal auditor establishes and maintains a system to monitor the follow-up by management of the audit recommendations communicated to management. This system may include periodic internal and external quality assessments and ongoing internal monitoring by management.
The internal auditor should also develop and maintain a quality assurance and improvement programme that covers all aspects of internal audit activity and continuously monitors its effectiveness. |
Opinion |
The auditor’s written conclusions on a set of financial statements as the result of a financial or regularity audit. |
Organic Budget Law |
A law specifying the schedule and procedures by which the budget should be prepared, approved, executed, accounted for and final accounts submitted for approval. Objectives of the organic budget law are:
· Creating a legal framework regulating the budget process
· Adjusting budget procedures legal, cultural and political conditions of the country
· Strengthening the transparency of budget information
· Clearly indicating division of responsibilities |
Outcomes |
The effects of a programme or project measured at the highest meaningful level in proportion to the programme or project (e.g. jobs created). In practice there are always at least some external non-controllable elements, which influence whether outcomes are achieved or not. |
Outputs |
The directly tangible deliverables of a programme or project insofar as they are, for practical purposes, completely under the control of the implementers of the project (e.g. training seminar executed). |
Passer-outre |
PO is the procedure whereby the opinion of the ex ante financial controller (refusal to approve) can be overridden by the body that is ultimately responsible for the management of government budget implementation (e.g. Council of Ministers). A reasoned and extensive request by the MD should be the basis for such a decision, while the MD remains responsible for his acts. |
Performance Audit |
An audit of the economy, efficiency and effectiveness with which the audited entity uses its resources in carrying out its responsibilities. In practice there can be difficulty distinguishing Performance Audit from Evaluation. Sometimes Performance Audits are limited to consideration of outputs but this considerably limits the value of the audit. Also, evaluation may create data, particularly on outcomes, whilst Performance Audit would usually be limited to a review of data which was available (and if necessary identification of missing data). Performance Audit is usually concerned with testing performance against some given standards. |
Planning |
Defining the objectives, setting policies and determining the nature, scope, extent and timing of the procedures and tests needed to achieve the objectives. |
Postulates |
Basic assumptions, consistent premises, logical principles and requirements which represent the general framework for developing auditing standards. |
Public Accountability |
The obligations of persons or entities, including public enterprises and corporations, entrusted with public resources to be answerable for the fiscal, managerial and programme responsibilities that have been conferred on the manager, and to report to those that have conferred these responsibilities. |
Public Internal Financial Control (PIFC) |
PIFC is the overall financial control system performed internally by a Government or by its delegated organisations, aiming to ensure that the financial management and control of its national budget spending centres (including foreign funds) complies with the relevant legislation, budget descriptions, and the principles of sound financial management, transparency, efficiency, effectiveness and economy. PIFC comprises all measures to control all government income, expenditure, assets and liabilities. It represents the wide sense of internal control. It includes but is not limited to ex ante financial control (EAFC) and ex-post internal audit (EPIA) |
Reasonable Assurance
|
Internal control, no matter how well designed and operated, can provide only reasonable assurance to management regarding the achievement of an entity's objectives. The likelihood of achievement is affected by limitations inherent in all internal control systems. These limitations may include faulty decision-making with respect to the establishment or design of controls, the need to consider costs as well as benefits, management override, the defeat of controls through collusion and simple errors or mistakes. Additionally, controls can be circumvented by collusion of two or more people. Finally, management may be able to override elements of the internal control system.
Reasonable assurance is provided when cost-effective actions are taken to restrict deviations to a tolerable level. This implies, for example, that material errors and improper or illegal acts will be prevented or detected and corrected within a timely period by employees in the normal course of performing their assigned duties. Management during the design of systems considers the cost-benefit relationship. The potential loss associated with any risk is weighed against the cost to control it. |
Regularity Audit |
Attestation of financial accountability of accountable entities, involving examination and evaluation of financial records and expression of opinions on financial statements; attestation of financial accountability of the government administration as a whole; audit of financial systems and transactions, including an evaluation of compliance with applicable statutes and regulations; audit of internal control and internal audit functions; audit of the probity and propriety of administrative decisions taken within the audited entity; and reporting of any other matters arising from or relating to the audit that the SAI considers should be disclosed. This is normally not applicable to Internal Audit Services. |
Report |
The auditor’s written opinion and other remarks on a set of financial statements as the result of a financial or regularity audit or the auditor’s findings on completion of a performance audit. |
Reporting Standards |
The framework for the auditor to report the results of the audit, including guidance on the form and content of the auditor’s report. |
Results |
The same as outcomes or impacts |
Risk |
An event which can result in an undesirable or negative outcome. It is characterised by the probability or likelihood of the event occurring and the resulting impact or consequence if it does occur. These two factors combine to result in a level of risk exposure. |
Risk Assessment |
Auditor’s tool to help identify audit projects offering the highest added value to the organisation. Risk assessment is the identification of all local financial management and control (FMC) systems and of their associated risks according to a number of risk factors (IIA).
The risk assessment approach has to be used at, at least two levels:
(2) for the establishment of the annual audit programme, selecting projects of highest expected return, and
(3) in the planning phases of the individual audit itself.
Risk factors are: assessment of volume, sensitivity and materiality of data, the control environment, confidence in management, complexity of activities and Information Systems, geographical diversity, and prior audit knowledge. |
Risk Management (RM) |
The overall process of identifying, assessing and monitoring risks and implementing the necessary controls in order to keep the risk exposure to an acceptable level. Best practice suggests that it should be an embedded part of the management process rather than something, which is added at a later stage.
RM acts as awareness raising exercise and as a forum for sharing views at all levels in organisations; it informs and trains management and staff and increases the likelihood for success in the achievement of the objectives.
Management creates the conditions and establishes tools necessary to evaluate, prioritise and decide before carrying out an activity to allow it to obtain a reasonable assurance of achieving the objectives with reasonable value for money. The internal control system ensures that management protects itself from unacceptable risks.
Processes need to be developed to identify these risks and conceive and implement a system to control the most significant risks. A success factor for implementing the risk management system throughout the organisation is the management’s general interest in the exercise. RM should be put on the agenda for the development of its own system for assessing the risks to which the organisation is subject. |
Significant Control Weakness |
Significant is the level of importance or magnitude assigned to an item, event, information, or problem by the internal auditor. Significant audit findings are those conditions that, in the judgement of the director of internal auditing, could adversely affect the organisation. Significant audit findings (as well as weaknesses cited from other sources) may include conditions dealing with irregularities, illegal acts, fraud, errors, inefficiency, waste, ineffectiveness, conflicts of interest, and control weaknesses |
Supervision |
An essential requirement in auditing which entails proper leadership, direction and control at all stages to ensure a competent, effective link between the activities, procedures and tests that are carried out and the aims to be achieved. |
Supreme Audit Institution (SAI) |
The public body of a State which, however designated, constituted or organised, exercises by virtue of law, the highest public auditing function of that State. |
Systems based Audit |
Systems based audit refers to an in-depth evaluation of the internal control system with the objective to assess the extent to which the controls are functioning effectively. It is designed to assess the accuracy and completeness of financial statements, the legality and regularity of underlying transactions and the economy, efficiency and effectiveness of operations.
A systems based audit should be followed-up through substantive testing of a number of transactions, account balances, etc. to determine whether the financial statements of the auditee are accurate and complete, the underlying transactions legal and regular and/or the criteria for economy, efficiency and effectiveness have been achieved. |
Tone at the top |
See ethics. Management should promote ethical values throughout the entity they manage, especially by giving/leading by good example. |