ATTACHMENT J.4_1. Recommended Methodology and Guidance for Internal Controls and Self-Certification.pdf

STATE-OWNED ENTERPRISES REFORM ACTIVITY IN

UKRAINE, TASK ORDER 1

REPORT WITH INTERNAL CONTROL ASSESSMENT AND

CERTIFICATION ANALYSIS, RECOMMENDED

METHODOLOGY AND GUIDANCE FOR INTERNAL

CONTROL SELF-CERTIFICATION AND EVALUATION

Version 1.0 was submitted on July 7, 2023 This document was produced for review by the United States Agency for International Development. It was prepared under Task Order No.

720-121-21-F00002, Task Order 1 of the State-Owned Enterprises Reform Activity (SOERA) in Ukraine Indefinite Delivery, Indefinite Quantity (IDIQ) Contract No. 720-121-21-D00001 implemented by Deloitte Consulting LLP.

This report is made possible by the support of the American People through the United States Agency for International Development (USAID) and the United Kingdom Foreign, Commonwealth & Development Office (UKaid). The contents of this report are the sole responsibility of Deloitte Consulting LLP and do not necessarily reflect the views of USAID, the United States Government, Ukaid, or the Government of the United Kingdom.

RECCOMENDED METHODOLOGY AND GUIDANCE USAID.GOV | 6

of the effectiveness of internal control and the development of methodology and framework they should follow to complete such assessments will increase executive accountability in developing and maintaining internal sound controls.”

By presenting these observations and recommendations, the report aims to assist the GOU in improving its practice regarding the transparency and accountability . SOERA assessed and documented the current GOU IC environment, performing an in-depth gap analysis of the GOU’s current practices against international standards, procedures, and systems. SOERA’s research yielded 17 key observations of areas where the GOU’s ICS could be improved. Following a workshop conducted with the MOF, SOERA produced broad recommendations for USAID regarding how the GOU can enhance its IC laws, policies, and procedures. Finally, SOERA narrowed these recommendations to specific, actionable steps after further GOU feedback. These recommendations and actionable steps will ultimately assist the GOU in building and administering an ICS that meets international standards and can effectively deploy self-certification.

Based on discussions with the MOF, four themes warrant additional capacity building to enhance transparency and accountability regarding IC and self-certifications. Specifically, the GOU’s MOF agrees on continuing to focus on improving the following:

• Methodology for use in researching leading and peer country practices to gather more data-rich information on the effectiveness of the internal control system by expanding the range of subjects covered and how data is collected.

• Transparency and accountability of ICS’s effectiveness through developing a self-certification statement to be completed by the heads of budget institutions.

• Content of the consolidated annual report that the Central Harmonization Unit prepares annually to provide a government-wide view of the state of internal controls.

• Technological capabilities to centrally communicate, store, manage, analyze, and report on IC assessments and self-certifications.

Please refer to sections VII and VIII for additional information on these topics.

IV. Definitions and Concepts Shaping Recommendations

Our recommendations to the MOF are based on the following definitions and concepts that are central and thereby form the core of this report:

A. The Definition of Internal Control and Internal Control Systems

Generally, an IC is a process by management to help an entity achieve an objective. In public finance, these objectives typically relate to financial reporting reliability, operational efficiency and effectiveness, and compliance with instituted laws, regulations, and other requirements. An ICS is a collaborative network of ICs, the purpose of which is to create assurance regarding achieving objectives. In public finance, an ICS comprises ICs related to public finance objectives, namely those previously stated.

RECCOMENDED METHODOLOGY AND GUIDANCE USAID.GOV | 7

A public entity’s ICS enables accountability, independence, and long-term sustainability. Specifically, ICS promotes the proper use and distribution of public and donor funds and is designed to supply reasonable assurance that the financial entity’s financial, operational, compliance, and reporting standards.2 An effective ICS helps to ensure that public funds are allocated according to predefined priorities and objectives, thereby promoting the efficient use of resources and avoiding fraud, waste, abuse, and error (FWAE). An ICS is developed to control a public entity's financial and operational procedures properly.

Well-designed and effective IC help to provide reasonable assurance that public and donor funds are safeguarded and that transactions are proper, authorized, and properly recorded in a way that allows for prevention and timely identification and mitigation of material errors. They are based on a management information system, financial regulations, administrative procedures, accountability, and strong formal management. A strong ICS is vital to promoting the proper management of resources and supporting accountability.

B. The Definition of Self-Certification Self-certification is a process within the ICS that effectuates transparency and accountability. Specifically, managers are responsible for verifying and documenting the effectiveness of ICs within their areas of responsibility.3 Self-certification leads to a culture of accountability and provides valuable feedback to improve the effectiveness of the ICS. Further, self-certification offers transparency to the public and other stakeholders on the effectiveness of the actions management takes to enhance and evolve their accountability and other safeguarding mechanisms. While often an integral component in a broader IC framework, self-certification by IC managers is inherently subjective and vulnerable to bias. It should be used in the context of a strong, general IC framework.

V. Importance of Internal Control and Self Certification

The GOU requires strengthened transparency around the management of funds as the GOU to provide critical services to its citizens.

The GOU requires the Ukrainian public finance system entities to comply with existing IC frameworks for budget institutions. Additionally, the Public Internal Financial Control (PIFC) framework provides the foundation for the GOU to establish the appropriate processes, controls, accountability, and transparency safeguards to help ensure that spending is made appropriately. these controls help confirm that USG funds are going to eligible expenses.

Thus, strengthening IC within budget institutions reinforces oversight and accountability of the GOU’s management funds. Specifically, a strong ICS can help reduce the risk to funding from FWAE, partly by providing checks and balances against the inherent subjectivity of self-certification. Implementing self-certification across the GOU without a strong ICS may result in decreased transparency and cause

2 https://www.coso.org/Shared%20Documents/COSO-FAQs-May-2013-branded.pdf 3 https://www.nao.org.uk/wp-content/uploads/2010/01/statement_internal_control.pdf

RECCOMENDED METHODOLOGY AND GUIDANCE USAID.GOV | 8

harm by giving an inaccurate representation of the ICS. Therefore, the GOU should strengthen IC before implementing self-certification practices.

Further, a strong ICS helps identify and prevent instances of FWAE in the fund distribution process in several ways, including requiring additional authorization to disburse funds, recording transactions, and routinely testing controls in place to prevent FWAE. ICs safeguard against the misappropriation or misuse of public funds, help provide the appropriate support to the intended beneficiaries, and are important to prevent FWAE. An ICS streamlines the identification of discrepancies that may arise and enables proper mitigation strategies to be deployed. Therefore, strong ICs supply a layer of assurance from the GOU to the USG that they are preventing, detecting, and remedying potential errors in fund distribution.

As referenced in Section II, SOERA supports USAID to help strengthen the GOU’s safeguards for the oversight and use of funds. Specifically, SOERA is providing this support through two distinct yet complementary workstreams:

• Technical Assistance: Focuses on supporting the GOU in enhancing their capacity, including the processes and controls

Each workstream independently and collaboratively identifies potential gaps related to processes and controls, transparency, and accountability safeguards that altogether help strengthen the GOU’s ability to report on and monitor funds and their proper use.

VI. Approach and Methodology to Developing Recommendations

To determine the recommendations for USAID and the GOU regarding how the latter can better implement self-certification and strengthen its overall ICS, SOERA conducted a global analysis of IC leading practices. Specifically, SOERA researched and considered the following several international IC standards and frameworks to identify important areas of ICs to frame the observations and potential areas for improvement:

• The Committee of Sponsoring Organizations of the Treadway Commission (COSO) Framework is globally recognized for designing, implementing, conducting, and assessing IC. It is the foundation for many countries’ ICS, including the United States and the European Union.

• Support for Improvement in Governance and Management (SIGMA) № 59 is an EU-financed initiative to strengthen governance systems and administration within its partner countries.

• Public Internal and Financial Control (PIFC) is an EU-developed framework for guiding governments in establishing ICS.

RECCOMENDED METHODOLOGY AND GUIDANCE USAID.GOV | 13

primary ICS legislation in Ukraine is Resolution № 1062, and the primary IC legislation is Article 26.

However, Resolution № 1062 uses the definition of IC from Article 26, where a broader ICS is needed.

Regarding Managerial Accountability, the legislation provides an extensive list of areas of responsibility of Heads of Budget Institutions, including legal matters, many of which are too broad for IC but could be applicable within an extensive ICS context. Resolution № 1062 states:

During the organization and functioning of IC, managerial responsibility and accountability of the heads and employees of the budget institution is ensured, which is based on the requirements of the law and applies to all activities of the institution.

The head of the institution is responsible and accountable for the proper management and development of the institution; achievement of defined goals (missions), strategic and other goals, objectives, plans, and requirements for the institution's activities; ensuring legal, economical, efficient, effective, and transparent management of budget funds.

Further, Resolution № 1062 states that implementing IC properly requires managerial responsibility and accountability. However, the Resolution does not explicitly define Managerial Accountability within a broader ICS context. For example, Resolution № 1062 states:

By the procedure established by law, the head of the institution reports on the effectiveness and effectiveness of the institution's activities, the achievement of certain goals (specific), and strategic and other goals, including implementing internal control.8

As established in 2.1.1, Resolution № 1062 focuses on ICS instead of IC. If Resolution № 1062 adequately defined IC and ICS with the proper scope, then this ambiguity could be mitigated. Additionally, according to SIGMA Paper № 58, “Managerial Accountability in the Western Balkans,” Managerial Accountability consists of both conformity to rules and procedures (compliance) and a clear focus on results (performance).9 Managerial Accountability, per SIGMA, entails holding managers accountable for results by assigning them responsibility and delegating decision-making, giving them the autonomy and resources required to achieve public entity objectives. According to SIGMA, Western Balkan governments will fail to achieve the reforms needed for EU accession without properly implementing Managerial Accountability. As Managerial Accountability helps promote the achievement of reforms necessary for EU accession and is a PIFC concept, the term should be outlined in detail within applicable FMC-related laws and bylaws.

Global Analysis: Croatian law explicitly defines Managerial Accountability as “the responsibility of managers for their decisions and actions in business, including the management of funds, and that they are accountable to the same to the person who appointed them or transferred the powers and responsibilities to them.”10 This is consistent with SIGMA Paper № 58’s definition of Managerial Accountability in the context of Western Balkan countries. Croatian law focuses on the role of managers in public entities, explicitly calling out the management of funds and mandates that they will be held accountable by whoever appointed them.

8 https://zakon.rada.gov.ua/laws/show/1062-2018-%D0%BF#Text 9 https://www.oecd-ilibrary.org/governance/managerial-accountability-in-the-western-balkans_88be2112-en 10 https://narodne-novine.nn.hr/clanci/sluzbeni/2015_07_78_1492.html

RECCOMENDED METHODOLOGY AND GUIDANCE USAID.GOV | 16

2.2.1 Broaden the Scope of Risk Assessment

Observation: The current scope of risk assessment activities within Ukraine focuses primarily on rooting out corruption, as opposed to a broad range of IC vulnerabilities. Risk assessment activities within the GOU should be more comprehensive than a single-issue area and encompass risks related to ICS. Risk Management is one of the five elements the Heads of Budget Institutions are obligated to oversee.

Specifically, Resolution № 1062 indicates that the ICS in a budget institution consists of (1) Internal Environment, (2) Risk Management, (3) Control Measures, (4) Information and Communication, and

(5) Monitoring.

The second component, Risk Management, is defined as:

The activities of management and employees of the institution to identify risks, assess them, determine ways to respond to identified and assessed risks, and review identified and assessed risks to identify new and changed ones.

Within Risk Management, the activities are outlined as follows:

• Identifying responsible officials for the coordination of risk management.

• Identifying risks in the institution and each structural unit.

• Determining the procedure and approaches to assessing identified risks according to the probability of their occurrence and the materiality of the impact on the institution’s ability to perform the tasks and functions defined by legislative acts to achieve specific goals.

• Choosing ways to respond to identified and assessed risks (reduction, acceptance, separation, or avoidance).

• Determining the procedure for informing the institution’s management about the risk assessment and the risky areas of activity to decide on taking control measures.

• Establishing the frequency of reviewing identified and assessed risks to identify new and changed ones.

• Documenting risk management.

During the analysis of the flow of funds, processes, controls, and interviews with state bodies in Phase I, it was discovered that the scope of Risk Management in Ukraine primarily focuses on corruption risks. A separate GOU law drives this focus. Specifically, according to the Law "On Prevention of Corruption,”13

13 https://www.venice.coe.int/webforms/documents/default.aspx?pdffile=CDL-REF(2020)079-e

RECCOMENDED METHODOLOGY AND GUIDANCE USAID.GOV | 29

• 2.1.2 Define Managerial Accountability

• 2.4.1 Introduce and Implement an IT Infrastructure for PIFC

• 2.5.1 Define and Formalize the Self-Assessment Process, Including Self-Certification

• 2.5.2 Formalize the Role of the Questionnaire

• 2.5.3 Improve Questionnaire Coverage and Content

• 2.5.4 Introduce an Internal Control Statement

• 2.6.3 Improve Annual Reporting Coverage and Content

SOERA divided these seven observations marked as green or yellow aligned into four categories. These four categories are listed in the table below, along with discrete steps the GOU may consider taking.

Recommendation Category

Recommended Steps

Questionnaire Improvement • Clearly define the purpose of the questionnaire

• Clearly explain the relationship between self-assessment and the questionnaire

• Guide the CHU regarding how to improve questions in annual updates

• Provide examples of improved questions and the types of responses expected of budget institutions

Self-Certification • Define the IC Statement

• Explain how IC Statements lead to Self-Certification

• Provide a format for an IC Statement

• Provide examples and explanations of how the CHU can communicate the need to self-certify to budget institutions

CHU CAR Improvement • Provide steps for how the CHU can leverage an improved questionnaire to generate better CARs on an annual basis

• Provide a framework for how the CHU can collect data on risks and retain information on an annual basis

PIFC IT Infrastructure • Assist in the development of a centralized IT portal to be managed by the CHU and used for the submission of risk assessment, Self-Certification statements, self-assessment questionnaires, and other applicable data

TABLE4: RECOMMENDATIONS BY CATEGORY

RECCOMENDED METHODOLOGY AND GUIDANCE USAID.GOV | 30

Moving forward, SOERA advises the GOU to consider developing specific guidance for the CHU relating to the recommendations in the table above. The guidance can help lay the foundation of a strong ICS and enable the CHU to solidify uniform standards before requiring budget institutions to comply with the new concepts. After guidance is developed, the GOU can begin to implement changes within legislation and communicate new requirements downwards through budget institutions.

RECCOMENDED METHODOLOGY AND GUIDANCE USAID.GOV | 31

X. Appendix A

A. Research Approach SOERA primarily used the COSO Framework as its primary comparison point for the global analysis, supplemented by the Support for Improvement in Governance and Management (SIGMA) Paper № 59 and the Public Internal Financial Control (PIFC) model. The COSO Framework is the global standard for ICs and is the foundation for many countries’ IC legislation and guidance. For example, in the United States, the COSO Frame is the foundation of the GAO Greenbook, which governs the ICS within each US government agency. The COSO Framework also serves as the foundation of the Guidelines for Assessing Internal Control as outlined in SIGMA Paper № 59,30 and the PIFC model captures similar components as the COSO Framework.

1. COSO

COSO is an advisory group that seeks to help organizations improve performance by enhancing IC, risk management, governance, and fraud deterrence. COSO was organized in 1985 to sponsor the National Commission on Fraudulent Financial Reporting, an independent, private-sector initiative that studied the causal factors that lead to fraudulent financial reporting. The National Commission was sponsored jointly by five professional associations headquartered in the United States:

• The American Accounting Association (AAA)

• The American Institute of Certified Public Accountants (AICPA)

• Financial Executives International (FEI)

• The Institute of Internal Auditors (IIA)

• The National Association of Accountants, currently referred to as Institute of Management Accountants (IMA)

The Commission acted independently of each sponsoring organization, including representatives from industry, public accounting, and investment firms. COSO’s primary goal is to provide thought leadership dealing with three primary subjects: enterprise risk management (ERM), internal control, and fraud deterrence.31

The COSO Framework was initially published in 1992, with a revised edition to be issued in May 2013.32 Since its publication, the COSO Framework has been a globally recognized framework for designing, implementing, conducting, and assessing IC.

30 https://read.oecd-ilibrary.org/governance/guidelines-for-assessing-the-quality-of-internal-control-systems_2a38a1d9-en#page2 31 https://www.coso.org/SitePages/About-Us.aspx 32 https://www.coso.org/Shared%20Documents/Framework-Executive-Summary.pdf

RECCOMENDED METHODOLOGY AND GUIDANCE USAID.GOV | 32

The COSO Framework is depicted in the COSO cube in Figure

1. The cube visualizes how each concept works together and complements one another. The cube depicts the following components of the COSO Framework:

• Three Objective Categories: Operations, Reporting, and Compliance.

• Four Layers of an Organization: Entity Level, Division, Operating Unit, and Function.

• Five Components: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring Activities.

The Objective Categories are displayed on the top of the cube.

Each of the three Objective Categories is detailed below:

• Operations: The operations objectives refer to the entity’s business processes, goals, and protection of assets.

• Reporting: The reporting objectives refer to the reliability of both external and internal financial non-financial reporting.

• Compliance: The compliance objectives refer to the laws and regulations the entity is subject to.

The right side of the COSO cube displays the four layers within a typical organizational structure. The organizational structure ties the objectives and components of IC to the specific location where the control is taking place within the public entity. Each of the four organizational structures is detailed below:

• Entity Level: The entity level refers to the whole public entity.

• Division: The division refers to the specific segment separated by service line.

• Operating Unit: The operating unit refers to a specific group within the division.

• Function: The function refers to a specific job within the operating unit.

The five Components serve as the essential components of the COSO Framework. The 2013 framework revision introduced seventeen principles that expand and clarify the five Components. The COSO Framework states that practical ICS requires each of the five components and 17 principles to be present to support achieving an organization’s mission, strategies, and related business objectives. The five components are as follows:

• Component #1: Control Environment. The control environment serves as a set of standards, processes, and structures that provide the basis for carrying out IC across the organization.

• Component #2: Risk Assessment. The risk assessment forms the basis for determining how risks will be managed. It involves a dynamic and iterative process for identifying and assessing risks to achieving objectives. Risk assessment aims to gauge the probability that an event will

FIGURE 2: COSO CUBE

RECCOMENDED METHODOLOGY AND GUIDANCE USAID.GOV | 33

occur and adversely affect the achievement and the degree of consequences should the event happen.

• Component #3: Control Activities. The control activities component ensures that Management’s directives to mitigate risks to achieving objectives are carried out. This component is generally written into policies and procedures and may be preventive or detective.

• Component #4: Information and Communication. The information and communication component focuses on generating relevant and quality information to support the functioning of the other components. This generation is a continuous iterative process of providing, sharing, ad obtaining the necessary information. This is necessary to enable businesses to carry out IC responsibilities to achieve their objectives.

• Component #5: Monitoring Activities. The monitoring activities component serves to ascertain whether each of the IC components is present and functioning. Monitoring activities include conducting ongoing evaluations, separate evaluations, or a combination of both.

The five components and associated 17 principles can be found in Table 2 below:

Component Principles

Control environment 1. Demonstrates commitment to integrity and ethical values

2. Exercises oversight responsibility

3. Establishes structure, authority, and responsibility

4. Demonstrates commitment to competence

5. Enforces accountability

Risk assessment 6. Specifies suitable, specific objectives

7. Identifies and analyzes risks

8. Assesses fraud risk

9. Identifies and analyzes significant changes

Control activities 10. Selects and develop control activities that help mitigate risks

11. Selects and develops general controls over technology

12. Deploys controls on thorough policies and procedures

Information and communication

13. Uses relevant, high-quality information

14. Communicates internally to support controls

15. Communicates externally

Monitoring 16. Conducts ongoing and/or separate evaluations

17. Evaluates and communicates deficiencies

TABLE5: COSO COMPONENTS AND PRINCIPLES

2. SIGMA № 59

SIGMA is an EU-financed initiative to strengthen governance systems and administration within its partner countries. Ultimately, SIGMA aims to enable partner countries to fulfill requirements for EU membership or develop a relationship with the EU. The identified partner counties include (but are not limited to)

RECCOMENDED METHODOLOGY AND GUIDANCE USAID.GOV | 34

Albania, Bosnia and Herzegovina, Kosovo, the Republic of Moldova, Montenegro, the Republic of North Macedonia, Serbia, Turkey, and Ukraine (as EU candidate countries and potential candidates), Algeria, Armenia, Azerbaijan, Egypt, Georgia, Jordan, Lebanon, Morocco, and Tunisia (as EU Neighborhood countries). The six areas SIGMA supports include a strategic framework of public administration reform, policy development and coordination, public service and human resource management, accountability, service delivery, public financial management, public procurement, and external audit. SIGMA Papers are prepared as contributions to SIGMA's work with its beneficiaries and focus on specific issues in governance and management. SIGMA Papers provide insight into leading practices within EU Neighborhood and EU candidate countries.

SIGMA № 59, Guidelines for Assessing the Quality of Internal Control Systems, was published in 2019 to provide guidelines for assessing IC quality in different states. This paper aims to assist Ministries of Finance and public sector managers in EU candidate countries and potential EU candidates in assessing the quality of their ICS. SOERA analyzed SIGMA Paper № 59, finding that the European Commission analyzes EU candidate countries’ ICS in their applications for accession. SIGMA № 59 indicates, among other things, that an ICS within EU-candidate countries should be based upon the COSO Framework.

SIGMA № 59 also indicates that IC and PIFC are applicable across the public sector, with both being applicable for the management and implementation of national and EU funds. SIGMA № 59 encourages the heads of public organizations and managers to leverage the COSO Framework components and principles for improving and assessing the IC systems in their organizations.33

3. PIFC

PIFC is an EU-developed framework for guiding governments in establishing ICS. PIFC focuses on developing an ICS to give reasonable assurance that transactions comply with the principles of financial management, transparency, efficiency, effectiveness, and economy. The PIFC framework consists of three pillars: the Central Harmonization Unit (CHU), Internal Audit (IA), and the Financial Management and Control (FMC) system. This model aims to strengthen managers' responsibility over budget institutions' operation and development. The PIFC model is integral to European Public Finance Management and Public Administration Reforms.34

• CHU: The CHU is a policy unit attached and directly reporting to a given country’s Minister of Finance on the status of IC in the public sector. The CHU is responsible for redesigning, updating, and maintaining the quality of the ICS across the government. The CHU develops and promotes

33 https://www.oecd-ilibrary.org/governance/guidelines-for-assessing-the-quality-of-internal-control-systems 34 https://ms.hmb.gov.tr/uploads/sites/2/2019/09/brochure_pifc_en.pdf

FIGURE 3: PIFC MODEL

RECCOMENDED METHODOLOGY AND GUIDANCE USAID.GOV | 35

internal control and audit methodologies based on leading international practices. While no placement is required, the MOF typically serves as the CHU.

• IA: The IA is an independent and objective assurance activity designed to add value and improve a public entity’s operations. The function brings a systematic, disciplined approach to evaluating and improving the effectiveness of risk management, control, and governance processes within a given organization.

• FMC: The FMC is a system that supports the planning, use, and control of financial resources to effectively and efficiently achieve the goals set for the institution.

According to the European Commission, EU-candidate countries should effectively implement a PIFC model before EU accession. This requirement comes from Chapter 32 of the Acquis Communautaire, which serves as the accumulated legislation, legal acts, and court decisions constituting the body of EU law.35 This requirement helps provide that once countries join the EU, they are equipped to effectively manage and control the use of EU funds and their national public finances, maintain the principles of sound financial management, and prevent and combat fraud, corruption, and illegal activities affecting the financial interests of the EU. However, while the EU provides guidelines and standards for implementing the PIFC framework, it does not prescribe a specific model to be implemented. Therefore, each country has the flexibility to develop a PIFC system that suits its circumstances if it adheres to the overall general principles and standards set forth by the EU.

4. Relevance to Ukraine: Safeguarding Funds Provides Framework for EU Membership

SOERA developed the outlined recommendations to deploy self-certification across Ukrainian budget institutions and promote transparency and accountability

. However, able IC is also integral to Ukraine’s EU membership prospects. The GOU applied for EU membership on February 28, 2022, five days after Russia invaded Ukraine. On June 17, 2022, the European Commission granted Ukraine candidate status by unanimous agreement between the leaders of the 27 EU Member States. The EU requires applicant countries to implement EU rules and regulations after meeting the conditions for membership. Ukraine’s candidate status came with a mutual understanding that the GOU should take steps toward implementing actions put forth by the Commission. While accession negotiations last up to five years on average, the timeframe for an individual country is influenced by the country’s ability to achieve the required reforms. While the process can move efficiently, as it was in the accession of Austria, Finland, and Sweden, the process can be longer.

For example, Croatia’s accession process took over seven and a half years.36 The GOU should consider strengthening its IC framework and structure to comply with EU accession requirements.

Upon obtaining EU-candidate status, the European Commission and the GOU agreed that the GOU would fully implement a modern public administration as a prerequisite for EU accession.37 To this end, the Joint Organization for Economic Co-Operation and Development (OECD) and EU SIGMA Program are aiding Ukraine in improving many aspects of its public governance system, including drafting the 2022-

35 https://neighbourhood-enlargement.ec.europa.eu/enlargement-policy/conditions-membership/chapters-acquis_en 36 https://ukandeu.ac.uk/explainers/how-new-member-states-join-the-eu-all-you-need-to-know/ 37 https://neighbourhood-enlargement.ec.europa.eu/system/files/2022-06/Ukraine Opinion and Annex.pdf

RECCOMENDED METHODOLOGY AND GUIDANCE USAID.GOV | 36

2025 Public Administration Reform (PAR) Strategy and its Action Plan.38 This joint effort developed the PAR per the Association Agreement between the European Union and the GOU.39 The 2022-2025 Public Finance Management (PFM) Strategy and Action Plan was adopted in December 2021 and, according to the EU Commission, is in line with the Public Expenditure and Financial Accountability (PEFA) methodology, EU, and international standards.

The European Commission recognized, in their opinion, Ukraine’s strategic framework for the 2022- 2025 PAR Strategy and the 2022-2025 PFM Strategy and Action Plan on Ukraine’s application for EU membership. However, the Commission noted that the GOU should demonstrate further improvement despite progress; specifically, further efforts by Ukraine are needed to promote the administrative capacity to implement and enforce legislation, especially regarding inspection. The implementation of self-certification will assist the GOU in achieving these standards. Additionally, the EU Commission noted that oversight of the off-budget accounts and the use of international standards in the Accounting Chamber of Ukraine should undergo further improvement.

According to the MOF, the PIFC system is currently being reformed in accordance with the European PIFC model. Currently, the GOU identifies IC as an element of the PIFC model. For example, the MOF promotes the formation and implementation of IC and determines the basic organizational and methodological principles. The MOF operates as the CHU described in the PIFC, assessing the functioning of IC and IA systems. The MOF’s responsibility as the CHU is detailed in Article 111 of the BCU and the CMU Resolution № 375.

SOERA analyzed both SIGMA № 59 and the European Commission’s Opinion on Ukraine’s application for EU membership and found that the GOU’s ICS will likely be analyzed through the lens of the COSO Framework before accession into the EU. Further, the GOU’s implementation of the PIFC model will also be scrutinized for EU accession. As the PIFC model incorporates the COSO Framework into its structure, SOERA centered its global analysis around the COSO Framework. Centering the global analysis around the COSO Framework enabled SOERA to make tailored recommendations that further boe GOU’s goal of obtaining EU membership and USAID’s goal of obtaining reasonable assurance over US funding going to the GOU.

Strong IC is a cornerstone of effective and compliant management of budgetary resources, continuing to strengthen the ICS within the GOU to achieve two goals. First, strengthening Ukraine’s ICS strengthens the management of budgetary resources. Second, strengthening Ukraine’s ICS also helps the GOU work towards meeting the European Commission’s standards for EU accession. Therefore, ICS improvement and a stout self-certification process will enhance transparency and accountability of DBS funds and help move Ukraine towards EU accession. Section VIII section further details these improvements and how they might be made.

38 https://www.oecd.org/eurasia/countries/Global-Relations-Brief-Ukraine- ENG.pdf#:~:text=The%20joint%20OECD- EU%20SIGMA%20Programme%20assists%20Ukraine%20in,help%20improve%20overall%20policy%20design%20and %20service%20delivery.

39 https://www.kmu.gov.ua/storage/app/sites/1/reforms/pars-2022-2025-eng.pdf

RECCOMENDED METHODOLOGY AND GUIDANCE USAID.GOV | 37

B. Country Selection

SOERA conducted a global analysis of leading IC practices, selecting ten countries across a broad range of ICS maturity levels, government structures, population sizes, and EU membership status to benchmark against the GOU’s ICS. The selected countries included Albania, Croatia, the Netherlands, Poland, Serbia, Slovenia, Spain, Ukraine, the United Kingdom, and the United States. At the same time, neither an EU member nor a candidate, the United States is a close ally and trading partner of the EU and has a democratic government and mature public ICS. As such, SOERA saw fit to include the United States in its research and assessment. SOERA analyzed the ICS of each country using the five components and seventeen principles detailed in the COSO Framework.

SOERA removed Spain from further mapping after preliminary research due to the differences in the approach and setup of the PIFC model in the Public Financial Management (PFM) system. SOERA also removed the United Kingdom after preliminary findings yielded little different insight into IC. The United Kingdom left the EU in 2020, and the current ICS observations did not provide additional insights that other countries could not ascertain. SOERA found the United States and the Netherlands to have a mature ICS, selecting them to benchmark against Ukraine’s. SOERA recognizes that implementing an ICS as advanced as those in the USA and the Netherlands is presently unrealistic. However, SOERA translated valuable insight from these two countries into recommendations for the GOU for implementing similar ICS within Ukraine. SOERA also used EU member countries and EU candidate countries as other research points, further helping to develop recommendations.

Upon completing its research, SOERA grouped the remaining seven countries, excluding Ukraine, into the three categories outlined in Table 3 below. SOERA created the first two categories based on EU candidate status and IC maturity. The first category includes EU candidates, while the second includes EU members.

The third category consists of the two countries-The United States and the Netherlands-with the “advanced” ICS models. The three categories enabled SOERA to gather a broad insight into the current global state of ICS and develop tailored recommendations for the GOU.

The category, description, and countries in each of the three groupings are outlined in Table 3 below:

Category Description Countries

EU Candidates Developing ICS: Establish a baseline for the GOU based on prospective EU candidates’ status of their ICS.

Recommendations leverage the lessons learned and mistakes made by these countries.

-Serbia (candidate since 2012)

-Albania (candidate since 2014)

EU Members Established ICS: Analyzed the ICS of recent admittees to EU membership to develop recommendations based on countries already in accordance with EU standards.

-Poland (member since 2003)

-Slovenia (member since 2004)

-Croatia (member since 2011)

Advanced Model

Mature Model: These mature models provide insight into the components of a mature ICS. While the models

-United States

-Netherlands (member since 1958)

RECCOMENDED METHODOLOGY AND GUIDANCE USAID.GOV | 38

depicted in these categories are too advanced for Ukraine currently, they provide a goal for what the ICS in the GOU can eventually attain. The strong public ICS in the US and the Netherlands serve as advanced ICS frameworks that can be used as models for the GOU.

TABLE6: GLOBAL ANALYSIS RESEARCH CATEGORIES

RECCOMENDED METHODOLOGY AND GUIDANCE USAID.GOV | 40

RECCOMENDED METHODOLOGY AND GUIDANCE USAID.GOV | 41

Introductory comment

Below is a list of identified possible improvements based on the analysis.

Only one example was used to demonstrate an example from another country (in most cases, relevant examples were also identified from other countries).

Element of SVC No. 1: Control environment

1. Certainty legislative basis

According to clause 2 of PCMU No. 1062:

• CSI - policies, rules, and measures implemented by the head of the institution, which ensure the functioning, interconnection, and support of all elements of internal control and are aimed at achieving the defined goals (missions), strategic and other goals, tasks, plans and requirements for the institution's activities

• The terms " internal control” "and internal audit" are used in the meanings used in BKU.

According to Clause 4 of PCMU No. 1062: the head of the institution organizes and ensures the implementation of internal control in accordance with these Basic principles and acts of legislation that regulate the planning of the institution's activities, the budget process, management of budget funds, state-owned objects and other resources, organizations and accounting, preparation and submission of reports, provision of administrative services...

According to clause 5 of the PCMU No. 1062: the SMC consists of elements, including " control measures - a set of management actions implemented in the institution..."

Article 26 of the BCU states, " Control and audit in the budget process."

• Internal control is a set of measures applied by the manager to ensure compliance with the legality and efficiency of the use of budget funds, achieving results in accordance with the established goal, tasks, plans, and requirements for the activities of the manager of budget funds and enterprises, institutions, and organizations belonging to the sphere of his management.

• Internal audit is an activity aimed at improving the management system, and internal control, preventing the facts of illegal, inefficient, and ineffective use of budget funds, the occurrence of errors or other deficiencies in the activities of the manager of budget funds and enterprises, institutions, and organizations belonging to the sphere of his management, and which provides for the provision of independent conclusions and recommendations. To carry out an internal audit, the manager of budget funds in the person of the manager forms an independent structural division of internal audit, which is subordinated and accountable directly to this manager.

Possible directions for strengthening

A clear legislative definition of key terms (DVFK, VC, VA, SVK) and the connection between them as an important component of the DFVK, including:

1) Legislative definition of the key terms of DVFK as VC+BA+CVG.

2) Definition of VC as a system, as currently Article 26 of the BCU defines VC as a complex of measures

(one of the elements of the system), and clause 5 of the PCMU No. 1062 defines the responsibility of the head of the institution for VC, that is, not for the system of VC.

3) Improving the definition of VA by: a) specifying the characteristics of the activity ( independent and objective activity ) and b) clarifying the purpose of the activity (direction, including the improvement of the VC (SVC) system ).

4) Expand VC and VA to include the budget process, but are not formally limited to it, within the limits of Art.

26 BKU " Control and audit in the budget process. “According to the BKU, the budget process is drawing

RECCOMENDED METHODOLOGY AND GUIDANCE USAID.GOV | 42

up, reviewing, approving, implementing budgets, reporting on their implementation, and monitoring compliance with budget legislation, regulated by budget legislation.

5) A clear indication of the conceptual basis of the COSO in PCMU No. 1062.

One of the examples from the analyzed countries

In the practice of the studied countries, these issues are more clearly defined and agreed upon at the level of special laws or sub-legal NPAs regarding the FDFC. For example, the Law "On Financial Management and Control" of Albania Law " On the budget system" of Serbia. Croatia's Law "On CSI in the public sector" clearly mentions COSO as a conceptual basis of SVC.

2. Managerial accountability and responsibility: legislative definition and content

According to clause 7 of PCMU No. 1062:

• During the organization and functioning of internal control, management responsibility and accountability of the head and employees of the institution is ensured, which is based on the requirements of the law and applies to the entire activity of the institution.

• The head of the institution is responsible and accountable for:

1. Proper management and development of the institution;

2. Achievement of defined goals (missions), strategic and other goals, objectives, plans, and requirements for the institution's activities;

3. Ensuring legal, economic, efficient, effective, and transparent management of budget funds, state-owned objects, and other resources;

4. The organization and implementation of internal control in the institution (including the formation of an appropriate internal control structure, supervision of the implementation of internal control, and risk management).

• In accordance with the procedure established by law, the head of the institution reports on the effectiveness and efficiency of the institution's activities, the achievement of defined goals (missions), and strategic and other goals, including the implementation of internal control.

• The head of the institution ensures a clear distribution of duties, powers, and responsibilities between the deputy heads of the institution, lower-level managers, and employees of the institution.

• Heads of structural subdivisions and employees of the institution are responsible and accountable for the performance of tasks and duties assigned to them in accordance with legislative acts and internal documents of the institution.

In accordance with Article 7 of the BCU "Principles of the Budgetary System of Ukraine,” the principle of efficiency and effectiveness - when drawing up and implementing budgets, all participants in the budget process must strive to achieve goals planned based on the national system of values and tasks of innovative economic development, by ensuring the quality provision of public services when attracting the minimum amount of budget funds and achieving the maximum result when using the amount of funds determined by the budget.

Possible directions for strengthening

1. Add a legal definition of managerial responsibility ( responsibility ) and accountability ( accountability ); reveal the connection between management responsibility, accountability, and management authority.

2. Regulate the content of managerial responsibility and accountability, including regarding the SMC.

3. Improve the legal definition of "3E s " ( economy, efficiency and effectiveness – economy, efficiency, and effectiveness) and consistency of Article 7 of the PCMU No. 1062 (which states the principle of the economy) and Article 7 of the BCU (which does not clearly identify it)

RECCOMENDED METHODOLOGY AND GUIDANCE USAID.GOV | 43

One of the examples from the analyzed countries

In the practice of the analyzed countries, these issues are more clearly defined and agreed upon at the level of special laws or sub-legal NPAs regarding the FDFC. For example, the Law "On Financial Management and Control" of Albania, the Law " On the budget system" of Serbia, and others. Chapter 2 of the Law "On Financial Management and Control" (art. 8-art. 18) of Albania provides more detailed content on the concept of managerial responsibility and accountability.

3. Delegation of powers regarding the development and support of SSC in institutions to a separate function

The analysis showed that to ensure the effective development of ICS, it is stipulated that the budget institution appoints a special function/person responsible for ICS issues in many countries.

Possible directions for strengthening

Addition of the existing legislation regarding the consolidation of the main issues of development and support of the SMC in institutions according to a specially defined function (department, department, person below the level of the manager, etc.).

One of the examples from the analyzed countries

The Law "On ICS in the Public Sector" of Croatia defines the unique role of the ICS development coordinator, who is a person who carries out coordination activities related to the development of ICS; prepares reports on the functioning of the SSC. In general, the coordination role of the CSI is entrusted to the financial unit of the budget institution, which in its structure defines either a separate unit responsible for the CSI or a separate person (the coordinator of the CSI).

4. Definition of the Self-Assessment regarding the CSI and the Statement/Declaration about the state of the CSI

According to PKMU No. 1062:

8. Internal documents of the institution should regulate the following issues regarding the implementation of monitoring, namely:

• implementation of constant monitoring during the current activity of the institution (management and supervisory measures of managers and employees of the institution during the performance of their duties to identify and correct deviations);

• carrying out a periodic assessment of the performance of individual tasks and functions (in particular, by employees who are not responsible for their performance and/or the institution's internal audit unit) to analyze the effectiveness of the internal control system;

• informing the institution’s management about deficiencies in the internal control system revealed as a result of monitoring.

The monitoring implemented in the institution should ensure the detection and assessment of deviations in the functioning of the internal control system and/or its individual elements and the taking of measures to eliminate such deviations.

9. In the institution's internal administrative documents, other internal control issues, requirements for its organization, and implementation taking into account the peculiarities of the institution's activities may be established.

10. The main managers of state budget funds, central executive authorities, the Council of Ministers of the Autonomous Republic of Crimea, regional, Kyiv, and Sevastopol city state administrations every year starting from 2020 until February 1, submit to the Ministry of Finance a report on the state of the organization and implementation of internal control in terms of elements of internal control over in the form established by the Ministry of Finance.

Possible directions for strengthening

RECCOMENDED METHODOLOGY AND GUIDANCE USAID.GOV | 44

Improvement of the legislation regarding the clear recognition of the evaluation of the ICS (as a system, not as "separate tasks and functions") as a part of the monitoring component, self-assessment as one of the methods of evaluation of the ICS, and the certification of the ICS as a means of realizing the accountability of the management regarding the ongoing ICS based on the annual evaluation of the SVC…