ATTACHMENT J.4_4. Public Internal Audit Analysis Report.pdf

STATE-OWNED ENTERPRISES REFORM ACTIVITY IN

UKRAINE, TASK ORDER 1

PUBLIC INTERNAL AUDIT ANALYSIS REPORT

Version 1.0 submitted on October 3, 2023

This document was produced for review by the United States Agency for International Development. It was prepared under Task Order No. 720-121-21-F00002 SOE Reform Activity in Ukraine, Task Order 1 of the SOE Reform Activity in Ukraine Indefinite Delivery, Indefinite Quantity (IDIQ) Contract No. 720-121-21-D00001 implemented by Deloitte Consulting, LLP.

This report is made possible by the support of the American People through the United States Agency for International Development (USAID.) The contents of this report are the sole responsibility of Deloitte Consulting LLP and do not necessarily reflect the views of USAID or the United States Government.

Leave page blank

PUBLIC INTERNAL AUDIT ANALYSIS USAID.GOV | 2

TABLE OF CONTENTS

I. Acronyms and Abbreviations 3

II. Executive Summary 5

III. Introduction and Background 6

IV. Importance of Internal Audit 7

V. Legislative Frameworks and Standards 9

VI. Summary of Areas of Improvement for Consideration 10

VII. Proposed Next Steps 14

VIII. Compendium – Detailed Findings on Areas of Improvement for Consideration 15

1. IA Standards 15

2. Independence and Objectivity 17

3. Audit Committees Role 20

4. Internal Audit Types 23

5. Functional Coverage 24

6. Collaboration with Other Controlling Bodies 26

7. Access to Information 29

8. IA Transparency 30

9. IA Function Management 32

10. Public Sector IT Audit 34

11. Information Technology Tools 36

12. Consulting Activities 38

13. Follow-up and Continuous Monitoring 40

14. Financial and Non-Financial Motivation 42

15. IA Staff Utilization 44

16. Performance Measurement 46

IX. Appendix I 48

PUBLIC INTERNAL AUDIT ANALYSIS USAID.GOV | 5

II. Executive Summary

The State-Owned Enterprises Reform Activity (SOERA) conducted a comprehensive analysis of the Government of Ukraine’s (GOU) Internal Audit (IA) capabilities to provide a thorough assessment and analysis of the existing IA framework.

SOERA’s analysis of the GOU’s IA systems revealed several strengths, but also revealed 16 key observations of areas where the GOU’s IA function and systems can be improved.

The majority of these 16 key observations can be attributed to four primary root causes. These include

(1) the absence of well-defined legislative guidelines, regulations, and standards; (2) the absence of a standardized approach to IA; (3) constraints on professional resources encompassing personnel, tools, and training; and (4) constricted budgetary support1. Considering these critical factors, SOERA provides a summary below of the findings and the underlying common causes. For comprehensive details of these issues, please see the dedicated sections on areas for improvement located within the compendium section of this report which contains additional information on each observation, the root causes of the issue, and risks of not remediating the observation. SOERA provided the compendium to the Ministry of Finance for their consideration.

Absence of Legislative Guidelines, Regulations, and Standards

The analysis identified multiple findings that stemmed from the absence of clear legislative guidelines and standards within the GOU’s IA sector. Notably, SOERA observed an absence of legislative mandate that requires internal audit units to properly execute follow-up procedures for overseeing the remediation efforts associated with findings and recommendations originating from prior audits. The absence of regulatory requirements mandating proper follow-up procedures poses multiple challenges. Among these are the non-implementation of recommendations, persistent weaknesses and deficiencies in controls, and an increased burden on the capacity of public institutions to identify and mitigate risk effectively. These challenges can impede the efficiency of the internal audit function and, consequently, the institution's performance.

Absence of a Standardized Approach

The analysis identified several key areas for enhancement in the GOU IA sector, primarily stemming from the absence of a standardized approach for implementing the IA function throughout the government.

For example, SOERA observed an absence of a standardized system for managing efficiency and effectiveness in their internal audit activities. The absence of a standardized system can lead to several disadvantages, including inconsistency in practices, an absence of clearly defined reporting requirements, ambiguity surrounding roles and responsibilities in the audit process, and more. These challenges have the potential to hinder the effectiveness, efficiency, and credibility of the internal audit function.

1 Please see Appendix I, Table 2 – Areas of Improvement and Associated Root Causes which directly attributes the 16 findings to their related root causes.

PUBLIC INTERNAL AUDIT ANALYSIS USAID.GOV | 6

Limited Professional Resources

The analysis indicated that there are a limited number of skilled professionals with proper internal audit expertise essential for the integration of modern audit tools and resources to undertake continuous improvement within the GOU’s IA audit sector. Notably, there is a deficiency in skilled Information Technology (IT) audit specialists proficient in IT audit methodologies. Furthermore, SOERA identified constraints with IT infrastructure, encompassing hardware and software components, that fall short of meeting the demands of modern IT auditing. The absence of IT audits and the accompanying IT audit skillset within the GOU IA sector gives rise to several challenges. These challenges, coupled with the limited budgetary support discussed next, have far-reaching implications, affecting the IA sector's overall performance, security posture, and adherence to compliance standards.

Limited Budgetary Support

SOERA’s analysis underscores the prevailing issues of inadequate financial support for IA institutions. The insufficient funding allocation to IA functions poses significant challenges for the GOU to perform IA efforts . This financial constraint often results in lower levels of maturity within IA institutions, a heightened rate of staff attrition, and restricted IA coverage across GOU programs and expenditures. These limitations substantially elevate the risk of encountering fraudulent activities, wasteful practices, abuse, and corruption in the management and allocation of public resources. Ensuring adequate funding for IA institutions is crucial for upholding the principles of transparency, accountability, and the effective utilization of public funds.

This report intends to serve as a resource for both USAID and GOU by presenting critical observations of the IA functions and practices of the GOU. These observations identify the limitations within in the IA sector, and addressing these limitations is pivotal to enhancing the GOU’s practices pertaining to processes, controls, transparency, and accountability safeguards. Addressing and taking action on these findings will help improve the GOU’s ability to ensure public funds are accounted for and used as intended, with standard practices and measurable results.

To that end, SOERA will continue to build on this work in Year 4, including conducting an additional workshop to collaborate with relevant stakeholders for generating feedback on research findings, along with drafting a methodology with suggested approaches to support the areas for improvement identified in this report. With both GOU and Central Harmonization Units (CHU) feedback, SOERA will produce additional in-depth recommendations for USAID regarding how GOU can enhance its IA laws, policies, and procedures, coupled with a roadmap of actionable steps for each recommendation. These recommendations and actionable steps will ultimately assist the GOU in strengthening its IA capacity, ensuring long-term oversight and accountability of public funds.

III. Introduction and Background

PUBLIC INTERNAL AUDIT ANALYSIS USAID.GOV | 7

Based on the findings of an initial Gap Assessment submitted to USAID in September 2022, SOERA supports the GOU in enhancing its capacity to implement processes and controls in several areas of transparency and accountability. These areas include:

• FA 1: Strengthened IA capacity of the GOU in the intermediate term and support planning to improve capacity in the future.

• FA 2: Improved ability of the executive leadership and Heads of Budget Institutions to confirm the status of the Internal Control (IC) environment and press for needed changes through the establishment of self-certification and evaluation practices for IC

• FA 3: Establish proper processes and procedures to assess the extent of improper payments for pilot budget programs and draft legislation to support the new reporting requirement.

This report highlights observations from a comprehensive analysis on the current state of IA capacity in the following GOU ministries and institutions:

• Ministry of Finance (MoF)

• Ministry of Education and Science (MoES)

• National Health Service of Ukraine (NHSU)

• Ministry of Social Policy (MoSP)

• State Treasury Service of Ukraine (STU)

• Pension Fund of Ukraine (PFU)

IV. Importance of Internal Audit

PUBLIC INTERNAL AUDIT ANALYSIS USAID.GOV | 8

In essence, the reinforcement of internal audit capabilities within budget institutions serves as a pivotal safeguard mechanism, guaranteeing that funds are directed toward their intended objectives and contributing to the overall transparency, accountability, and efficiency of the GOU’s financial management processes. This alignment of efforts between the GOU and the United States underscores a shared commitment to the welfare and well-being of Ukraine’s citizens, ultimately facilitating the provision of essential services and the advancement of the nation’s development goals.

Specifically, a strong IA function can enhance multiple essential aspects of internal auditing:

• Governance and Accountability: Internal audit helps ensure that the ministry’s operations and activities are aligned with its mission, goals, and objectives. It evaluates whether the ministry’s actions adhere to relevant laws, regulations, and policies. This promotes transparency, ethical behavior, and accountability within the ministry.

• Risk Management: Ministries often deal with complex and sensitive matters that involve various risks. Internal auditors assess these risks and identify areas where the ministry might be vulnerable. By providing recommendations to manage and mitigate these risks, internal audit helps the ministry safeguard its assets and reputation.

• Fraud Prevention and Detection: Internal auditors actively look for signs of fraud, corruption, and financial mismanagement. By conducting regular audits and assessments, they can identify irregularities and anomalies that might otherwise go unnoticed. This helps prevent and detect fraudulent activities within the ministry.

• Operational Efficiency: Through their reviews of processes and procedures, internal auditors identify inefficiencies and areas for improvement. By optimizing operational processes, the ministry can achieve cost savings, improve service delivery, and enhance overall efficiency.

• Financial Accuracy and Reporting: Ministries often handle public funds, and accurate financial reporting is crucial. Internal audit verifies the accuracy of financial records and ensures compliance with accounting standards. This instills confidence in stakeholders, including the public, donors, and government agencies.

• Continuous Improvement: Internal audit provides valuable insights into the ministry’s strengths and weaknesses. By offering recommendations for improvement, internal auditors contribute to a culture of continuous improvement and learning within the public institutions.

• Objective Assessment: Internal auditors are independent and unbiased evaluators. This objectivity allows them to assess the ministry’s activities impartially and provide accurate insights to decision-makers.

• Compliance and Regulation: Ministries are subject to various laws, regulations, and policies.

Internal auditors help ensure that the ministry is complying with these requirements, reducing the risk of legal and regulatory violations.

PUBLIC INTERNAL AUDIT ANALYSIS USAID.GOV | 9

• Management Support: Internal audit provides management with relevant and timely information about the public institutions’ operations. This enables informed decision-making and strategic planning.

• Stakeholder Confidence: When internal audit functions effectively, it enhances stakeholders’ confidence in the ministry’s operations. This includes government agencies, citizens, donors, and other interested parties.

In summary, internal audit is essential for promoting good governance, managing risks, improving efficiency, and ensuring compliance within a ministry. It helps the ministry achieve its objectives while maintaining transparency and accountability in its actions.

The team’s engagement with the IA departments involved a thorough assessment of their existing audit practices, methodologies, and resources. Through this interactive assessment, the team was able to bring attention to several key areas where enhancements were necessary. These areas encompass audit planning, risk assessment, testing procedures, reporting formats, and the overall quality assurance framework. By collaborating closely with the IA departments, SOERA established a constructive dialogue that will allow the team to work together in addressing these identified gaps, which will result in the development tailored strategies and initiatives aimed at building internal audit capabilities and improving the oversight of funds.

V. Legislative Frameworks and Standards

The following legislative frameworks and standards were used as a guideline during the current state assessment of GOU's internal audit capacity and the basis for identifying the 16 key observations of areas where the GOU’s IA could be improved.

• International Professional Practices Framework (IPPF) (also known as Red Book) – This conceptual framework organizes authoritative guidance promulgated by the Institute of Internal Auditor (IIA). The IPPF outlines the International Standards for the Professional Practice of Internal Auditing (ISPPIA). These standards are principle-focused and provide a framework for performing and promoting internal auditing and consist of the following:

o Statements of basic requirements for the professional practice of internal auditing and for evaluating the effectiveness of its performance. The requirements are internationally applicable at organizational and individual levels.

o Interpretations, which clarify terms or concepts within the statements.

o Glossary terms.

• International Organization of Supreme Audit Institutions (INTOSAI) – The INTOSAI operates as an umbrella organization for the external government audit community. It is a non-governmental organization with special consultative status with the Economic and Social Council (ECOSOC) of the United Nations. While INTOSAI primarily deals with external audit practices conducted by Supreme Audit Institutions (SAIs), it also provides guidance and standards related to internal audit. For example, the INTOSAI Framework for Professional Pronouncements (IFPP)

PUBLIC INTERNAL AUDIT ANALYSIS USAID.GOV | 10

provides a comprehensive framework for professional standards, guidance, and best practices for the work of SAIs, including internal audit functions. It covers topics such as audit standards, ethics, and quality control.

• U.S. Government Auditing Standards (also known as the Yellow Book) – This is a framework for performing high-quality audit work with competence, integrity, objectivity, and independence to provide accountability and to help improve government operations and services. These standards are commonly referred to as generally accepted government auditing standards (GAGAS), and they provide the foundation for government auditors to lead by example in the areas of independence, transparency, accountability, and quality through the audit process.

VI. Summary of Areas of Improvement for Consideration

SOERA identified 16 areas of improvement based on our analytical reviews and interviews with MoF, MoES, NHSU, MoSP, STU, and PFU. SOERA presented all 16 observations to the CHU and MoF during a Workshop held on September 26, 2023, during which SOERA received valuable feedback from the CHU and MOF regarding the 16 observations. The CHU classified each of the 16 identified areas into the three categories listed in Table 1. The observations consist of green (12 observations), yellow (3 observations), and red (1 observation).

l : Agreed to be a relevant area for further TA support l : Further analysis is relevant before proceeding to resolve the observation with further TA support l : No further support is needed as part of TA because the topic is either included in other MoF initiatives or can be closed w/o further TA involvement

TABLE 11: CHU FEEDBACK CRITERIA

Observation Summary of Cause CHU Response

1. IA Standards: GOU National IA Standards approved by the MOF are not sufficiently synchronized with the ISPPIA issued by IIA.

There are established provisions within GOU IA standards that essentially contradict the ISPPIA.

For example, the GOU local standards require that the Internal Audit Program must be approved by the head of the institution. However, the ISPPIA Standard №1110.A1 requires that the internal audit should be free from the interference of third parties in the process of determining the scope of the internal audit, performing the work, and reporting on the results.

l

2. Independence and Objectivity: GOU IA practices only partially adhere to the fundamental principles of independence

The reporting structure and functional responsibilities of IA functions create conflicts of interest that limit the independence and l

PUBLIC INTERNAL AUDIT ANALYSIS USAID.GOV | 11

Response and objectivity as articulated in the IIA’s International Standards for the Professional Practice of Internal Auditing.

objectivity of internal audit functions. For example, the heads of public institutions can dictate the level of resources allocated to IA functions, and IA resources are involved in management activities that they are responsible for providing assurance over.

3. Audit Committee (AC) Role: The AC role is defined as consultative and advisory.

The GOU IA unit is not subordinated (not accountable) to the AC, and independent members of Audit Committees are working on a free basis (no remuneration).

The AC role and functionality, as defined in the Cabinet of Ministers of Ukraine's (CMU) Resolution №1001, does not fully comply with international practice and internal audit standards (ISPPIA Standard 1110 “Organizational Independence”). For instance, The National IA Standards approved by the MOF regulate organizational independence, saying that it is ensured via the sign-off of the IA Declaration between the IA head and the head of institution, approval of the IA Charter by the head of institution, approval of Internal Audit Plan by head of institution, direct reporting by IA head to head of institution on internal audit results. As a result, this does not correspond to international practice where organizational independence is ensured by the assignment of these activities to the board, which is independent of management.

l

4. Internal Audit Types: GOU IA lacks a strong legal foundation governing various types of public internal audits, including financial, compliance and performance audits.

The IA units reported that the CMU's Resolution № 1001, IA Standards and other MOF guidance insufficiently defined the parameters of such audits, including their objectives, scope, research methodologies, and effectiveness assessment approaches.

l

5. Functional Coverage: A misalignment was identified between the structure of the internal audit unit and the expansive scope of its functional coverage.

The misalignment is due to the absence of regulatory requirements regarding the optimal number of IA employees, which would connect them with factors that affect the quality of the implementation of the IA function in a separate central executive body. Additionally, current Ukrainian legislation does not have the options on modality for how IA function might be set up in state bodies.

PUBLIC INTERNAL AUDIT ANALYSIS USAID.GOV | 12

Response

6. Collaboration with Other Controlling Bodies: GOU IA function and the State Audit Service, as well as the Accounting Chamber of Ukraine, are not efficiently collaborating and coordinating with one another.

The IA units indicated that the lack of collaboration and coordination effort is due to the absence of legislative and regulatory frameworks that define the mechanisms for such interaction. l

7. Access to Information: GOU IA personnel have an insufficient level of access to government databases as well as insufficient legislative power to request necessary information from counterparties of state bodies being audited.

The IA units indicated that access to government databases is limited due to the absence of a legislative and regulatory framework for granting IA access to external information or databases for audit proposes. Furthermore, some IA units struggle to receive responses from counterparties as there is no established obligation to provide information to IA teams.

l

8. IA Transparency: There is limited transparency of vital internal audit documents required under regulatory requirements.

Internal audit units exhibit widely varying practices in terms of making internal audit information public due to the lack of standardized approaches.

For example, The NHSU has published the internal audit plan, but the State Tax Service (STS) and the PFU generally do not disclose any information concerning internal audit activities.

Some internal audit units argue that internal audit documents are meant solely for internal use and see no necessity to share information about their internal audit activities publicly.

l

9. IA Function Management: There is an absence of standardized guidelines for the vertically integrated management of the Internal Audit function.

Currently, there are various approaches to managing the internal audit function in practice, which are directly influenced by the structure of the specific institution due to the lack of standardized protocols for proper management of the IA function.

l

10. Public Sector IT Audit: There are insufficient IT audits and the associated audit capabilities within the GOU IA sector.

The lack of IT audits and audit capability is due to the shortage of dedicated IT audit professionals within the IA team, insufficient IT infrastructure, and the absence of guidance and frameworks specifically tailored to IT audit activities.

l

11. Information Technology Tools: GOU IA lacks access to essential IT tools such as

The IA units indicated that the limitation to IT tools is due to budget constraints. l

PUBLIC INTERNAL AUDIT ANALYSIS USAID.GOV | 13

Response

TeamMate+, iAuditor, Audit Workstation, AuditBoard, Audit NET IA, etc.

12. Consulting Activities: There is an issue concerning the development of consulting services within the internal audit function, indicating a misalignment with the International Standards for the Professional Practice of Internal Auditing.

The IA units indicated that there is a lack of consistent standards for conducting consulting activities, formalizing their processes, and reporting outcomes. For example, some internal audit divisions document their consulting services, others deliver them verbally without proper documentation. Reporting on consulting services is also absent.

l

13. Continuous Monitoring and Follow- Up: The current procedures for tracking the implementation of IA recommendations are partially sufficient, as they have a monitoring procedure but not the recommended follow-up controls to ensure that recommendations are implemented and effective.

The IA units indicated that there is an absence of legislative mandates requiring IA units to effectively implement follow-up procedures for monitoring the remediation efforts linked to recommendations stemming from previous audits. l

14. Financial and Non-Financial Motivation: There is inadequate financial and non-financial motivation within the internal audit field, which can result in various disadvantages that affect the performance, job satisfaction, and overall effectiveness of internal auditors.

The IA units indicated a misalignment between the existing motivation (financial and non-financial) of IA employees and the level of qualification requirements for IA specialists. An example of inadequate financial motivation is how the distinct category for internal audit does not exist within the public service structure. Consequently, internal auditors cannot receive equitable compensation as their roles are considered equivalent to others under the existing legislation.

As for the lack of non-financial motivation, there are limited training opportunities for internal auditors to study international best practices in internal audit.

l

15. IA Staff Utilization Targets: There are no clear guidelines to delineate the expected levels of engagement for the internal audit employees across different positions when executing audit assignments.

Currently, different units employ widely varying coefficients (% of time an internal auditor spends on the audit engagement, also known as utilization rate). This inconsistency stems from the absence of target-level guidelines.

PUBLIC INTERNAL AUDIT ANALYSIS USAID.GOV | 14

Response

16. Performance Measurement: There is an absence of a standardized system for managing efficiency and effectiveness in their internal audit activities.

The IA functions indicated that there is a lack of consistency in terms of key performance indicators (KPIs) across different internal audit divisions, with various methods for their establishment. This inconsistency is due to the absence of a standardized system in place to properly manage the IA function’s IA activities.

l

For more detailed information on each area of improvement, please refer to the Compendium.

VII. Proposed Next Steps

The CHU’s feedback indicated that 15 of the 16 observations were relevant to the Technical Assistance workstream (consisting of 12 green and 3 yellow ranked observations). The CHU indicated that the MOF would benefit from further analysis and/or work by the SOERA Technical Assistance workstream in these 15 areas. Our report compendium contains all originally identified 16 observations.

SOERA will provide a supplemental report summarizing the key observations and the associated recommendations, with actionable implementation steps, supported by comprehensive research and analysis of the European Union and United States IA regulations and leading practices. The supplemental report will advise the GOU to consider developing specific guidance for the CHU relating to the recommendations. The guidance can help lay the foundation for strengthening the GOU IA capabilities and enable the CHU to solidify uniform standards before requiring budget institutions and ministries to comply with the new concepts. SOERA will collaborate closely with CHU, MoF, MoES, NHSU, MoSP, STU, and PFU when selecting the appropriate recommendations and methodologies to address the findings that are best tailored for GOU.

After guidance is developed, the GOU can begin to implement changes within legislation and communicate new requirements downwards through budget institutions and ministries

. SOERA will continue to provide GOU with IA capacity-building support on the execution of these implementations in year 4 and onward and furnish GOU with quarterly implementation reports to monitor progress, outcomes, and results.

PUBLIC INTERNAL AUDIT ANALYSIS USAID.GOV | 15

VIII. Compendium – Detailed Findings on Areas of Improvement for Consideration

This compendium presents information and insights that hold particular relevance for the benefit of the GOU. The findings and effects contained herein offer valuable information and guidance that can assist the GOU in identifying areas for improvement within its current IA institutions, ultimately contributing in the enhancement of GOU IA capabilities.

SOERA identified 16 areas of improvement based on the analytical reviews and interviews with the MoF, MoES, NHSU, MoSP, STU, and PFU. SOERA presented all 16 observations to the CHU and MoF during a Workshop held on September 26, 2023. SOERA will review and analyze the feedback and incorporate it into an addendum to this report.

1. IA Standards Condition: SOERA identified insufficient consistency of the national IA Standards with the ISPPIA. The lack of proper synchronization of local IA Standards with the International Standards of Professional Practice of Internal Audit may slow down the development of the internal audit function in the public sector of Ukraine, as well as lead to the limitation of the basic principles of the internal audit function and the reduction of the effectiveness of the internal audit function as a whole.

Cause: National IA Standards approved by the MOF are not sufficiently synchronized with the ISPPIA issued by IIA; this may affect the quality of the internal audit function, namely:

• The level of detail and the extent of clarifications in these standards differ from the International Standards for the Professional Practice of Internal Auditing, which, in contrast, provide more comprehensive instructions and clarifications.

• Internal audit services are not disclosed in full, which is due to the lack of internal audit consulting services, principles of consulting activities, and reservations about objectivity and independence.

• IA functional independence is not sufficiently ensured due to the direct subordination of the head of IA to the head of institution, which is the object of auditing.

• IA Standards establish provisions that essentially contradict the International Standards for the Professional Practice of Internal Auditing. In accordance with local standards, the Internal Audit Program must be approved by the head of the institution. At the same time, the ISPPIA Standard №1110.A1 requires that the internal audit should be free from the interference of third parties in the process of determining the scope of the internal audit, performing the work and reporting on the results.

• IA Standards do not reveal the role of the Audit Committee in terms of ensuring the independence and objectivity of the IA function. Moreover, IA Standards do not require functional accountability of the internal audit unit to the Audit Committee. It is necessary to note that in international practice, the presence of such functional accountability is an important basis for effective IA`s operation.

Effect: A lack of internal audit standards within an internal audit agency can lead to various issues that affect the consistency, quality, and effectiveness of internal audit activities. Internal audit standards provide a framework and guidelines for conducting audits, ensuring that the audit function operates with

PUBLIC INTERNAL AUDIT ANALYSIS USAID.GOV | 16

objectivity, integrity, and professionalism. Potential internal audit issues that can arise from a deficiency in internal audit standards:

• Inconsistent Audit Practices: The absence of internal audit standards can result in inconsistent audit methodologies, practices, and reporting formats across different audit engagements. This lack of uniformity can make it difficult to compare results, share best practices, and ensure a consistent approach to auditing.

• Risk of Subjectivity: Without standardized internal audit standards, audit processes may be more susceptible to subjectivity and bias, potentially compromising the objectivity and impartiality of audit findings.

• Lack of Guidance: Internal auditors may lack clear guidance on audit planning, risk assessment, testing procedures, and reporting requirements. This can lead to confusion and uncertainty in audit engagements.

• Difficulty in Benchmarking: The absence of internal audit standards makes it challenging to benchmark the performance of the internal audit function against industry best practices and recognized standards, hindering efforts to improve audit quality.

• Inefficient Resource Allocation: The lack of standardized audit processes can result in inefficient resource allocation, potentially leading to overallocation or under allocation of audit resources.

• Limited Accountability: A lack of internal audit standards can make it difficult to hold auditors and responsible parties accountable for following established audit processes and addressing identified issues.

• Ineffective Follow-Up: Without standards for follow-up and monitoring of audit recommendations, there may be challenges in tracking and ensuring the implementation of corrective actions.

• Loss of Stakeholder Confidence: Stakeholders, including management, governing bodies, and external parties, may have reduced confidence in the internal audit function's ability to provide reliable and consistent assurance without established standards.

• Missed Opportunities for Improvement: Internal audit standards often include best practices and guidelines for process improvement. The absence of such standards may result in missed opportunities for optimizing agency processes.

• Difficulty in Compliance Reporting: Agencies may struggle to demonstrate compliance with internal audit standards, industry-specific regulations, or recognized audit frameworks without established standards.

• Risk of Non-Compliance: The absence of internal audit standards can lead to non-compliance with regulatory and industry-specific requirements, potentially exposing the agency to legal and regulatory risks.

• Resource Management Challenges: Inefficient resource management within the internal audit function can occur without standardized audit practices, potentially leading to resource misallocation and missed opportunities for efficiency.

PUBLIC INTERNAL AUDIT ANALYSIS USAID.GOV | 17

• Ineffective Risk Assessment: A lack of standardized risk assessment methodologies may result in inadequate identification and prioritization of risks in audit planning.

To address these potential issues, GOU and the supporting public institutions should consider adopting recognized internal audit standards or developing their own internal standards that align with industry best practices and regulatory requirements. These standards should encompass audit planning, risk assessment, testing methodologies, reporting formats, follow-up procedures, and quality assurance processes. By implementing standardized audit practices, internal audit functions can enhance their consistency, professionalism, and ability to provide reliable assurance to stakeholders.

2. Independence and Objectivity Condition: SOERA identified that the operational practices of the IA units partially adhere to the fundamental principles of independence and objectivity as articulated in the IIA’s International Standards for the Professional Practice of Internal Auditing, Standard 1110 “Organizational Independence,” and there is room for improvement. In the current structure, the IA institutions-related audit programs and activities are able to be influenced by the heads of governing institutions, creating an audit environment subject to leadership intervention and prioritization of activities. This section will discuss the international standards and the primary causes of this current condition in detail below.

The ISPPIA Standard 1110.A1 underscores the pivotal role of independence in ensuring the integrity and effectiveness of internal audit activities. It states that "the internal audit activity must be free from interference in determining the scope of internal auditing, performing work, and communicating results."

This standard sets forth the expectation that internal audit functions should operate with a high degree of autonomy, shielding them from any undue influence or pressure that could compromise their ability to objectively assess and report on organizational activities. Independence ensures that internal auditors can conduct their work without bias or constraints, thereby enabling them to provide accurate and unbiased insights into public institutions’ operations.

INTOSAI-P 1 “The Lima Declaration” recognizes that Internal audit services are necessarily subordinate to the head of the department within which they have been established. Nevertheless, they shall be functionally and organizationally independent as far as possible within their respective constitutional framework. Also, INTOSAI GOV 9140 “Internal Audit Independence in the Public Sector” provides additional guidance about addressing concerns related to independence and objectivity of internal audit in the public sector, namely:

• Legal and Organizational Framework: GOV 9140 outlines the importance of establishing a clear legal and organizational framework that supports internal audit independence. It highlights the need for legislation or regulations that explicitly define the role, authority, and reporting relationships of internal auditors.

• Reporting Line and Authority: The guidance discusses the reporting line of internal audit, suggesting that the head of the internal audit function should report directly to a high-level authority, such as the board of directors, audit committee, or an equivalent body. Where practicable, those charged with governance (oversight body) should exercise discretion and at least be consulted regarding the appointment, removal, and compensation considerations of the head of the internal audit function. Consideration may also be given to appointing an appropriately organized, independent body to appoint the head of the internal audit function.

PUBLIC INTERNAL AUDIT ANALYSIS USAID.GOV | 18

Moreover, the head of the internal audit function should be equal in rank to senior management of the organization (to avoid possible conflicts of interest). This helps insulate auditors from undue management influence.

• Conflict of Interest Management: The document addresses the importance of identifying and managing conflicts of interest among internal auditors and their responsibilities. It suggests mechanisms for disclosing and mitigating conflicts to maintain objectivity.

• Prohibition of Auditing One's Own Work: The guidance underscores the principle that internal auditors should not audit their own work or areas where they have direct involvement. This practice helps maintain objectivity and impartiality.

• Audit Planning and Execution: INTOSAI GOV 9140 discusses how internal audit planning and execution should be conducted in an independent and objective manner. It emphasizes the need for risk-based audit planning, adherence to audit standards, and unbiased reporting of findings.

The internal audit activity must be free from interference in determining the scope of internal auditing, performing work, and communicating results.

• Communication and Reporting: The document highlights the importance of transparent communication and reporting of audit findings and recommendations to relevant stakeholders. It emphasizes the role of internal auditors in providing unbiased, fact-based assessments.

Also, INTOSAI GOV 9140 defines the following criteria for assessing the independence of the internal audit function in the public sector:

• Clear and formally defined responsibilities and authorities of internal auditing in an audit charter;

• Functional and personal segregation of internal auditing from responsibilities for management tasks and decisions (e.g., as heads of operational working groups in administrative reform projects);

• Adequate freedom for the head of the internal audit function in establishing audit plans;

• Adequate payment and grading within the salary scale according to the responsibility and significance of internal auditing and;

• Involvement and participation of the head of the internal audit function in the recruitment of audit staff.

Cause: The IA units in GOU have limited independence and objectivity due to the following elements:

• The IA unit is directly placed under the administrative and functional control of the head of the institution. Simultaneously, the actions and decisions of the head of the institution, including management decisions, fall within the scope of internal audit scrutiny. This structure grants the institution's head authority to dictate the required resources for internal audit, as well as to allocate allowances and bonuses to internal audit staff. This setup presents a tangible conflict of interest.

• The head of the institution possesses the power to modify the Audit Program for particular audit assignments.

PUBLIC INTERNAL AUDIT ANALYSIS USAID.GOV | 19

• Internal audit units are occasionally engaged in the operational and management functions of the institution. For example, some are members of the receivables management committee, procurement commission, and risk management committee, which have the right to participate in decision-making with voting rights. Additionally, there are some members involved in performing tasks related to the internal control implementation. Such circumstances may adversely affect objectivity and impartiality and might be viewed as having a potential negative impact, including the perception of a conflict of interest since these individuals are in a position to test their own implementation of internal controls. Note that IIA ISPPIA 1120 – Personal Objectivity covers this in more detail.

• IA function is involved in the stream of process optimization, established by the "Methodology for the analysis and optimization of work processes and procedures in the bodies of executive power" approved by the Cabinet of Ministers of Ukraine’s Coordinating Council on the issues of reforming public administration on June 20, 2019. In accordance with this Methodology, the head of IA is appointed as the head of the process optimization group. The following actions are carried out within the framework of this project: identification of the process for optimization, an "as is" scheme is established, weaknesses are identified and a process scheme "as it should be" is developed, the goal is determined, and a process optimization plan is formed. Such a situation can lead to a potential limitation of the independence and objectivity of the IA due to the involvement of the IA in operational activities for the implementation of regulatory legal acts containing requirements that contradict the relevant legislation on the IA.

• Both the head of the Internal Audit and the CHU lack the authority to influence the structure of the internal audit function in central executive bodies. These powers belong to the competence of the head of IA, and practical decisions depend on the decisions of the Human Resource (HR) department of the relevant institution, which, in turn, can finance the function of the IA on a residual basis, considering this function as a normative part of the institution.

Effect: A lack of independence of internal auditors can give rise to a range of issues that compromise the integrity, objectivity, and effectiveness of the internal audit function. Independence is essential for auditors to provide unbiased assessments and valuable insights that help public institutions achieve their goals while maintaining transparency and accountability. Potential issues that can arise from a lack of independence of internal auditors:

• Bias and Influence: When internal auditors lack independence, there's a risk that their judgments and recommendations might be influenced by personal or organizational biases. This can lead to skewed findings and recommendations that do not accurately reflect the organization's actual risks and controls.

• Inaccurate Reporting: A lack of independence can result in inaccurate or incomplete reporting.

Auditors may be pressured to downplay or ignore significant issues, leading to a false sense of security for management and stakeholders.

• Loss of Credibility: Independence is a cornerstone of audit credibility. If auditors are perceived as not being independent, their findings and recommendations may be questioned, leading to a loss of trust from management, governing bodies, and other stakeholders.

PUBLIC INTERNAL AUDIT ANALYSIS USAID.GOV | 20

• Reduced Objectivity: Independent auditors are able to objectively assess situations without undue influence. A lack of independence can compromise their objectivity and lead to compromised assessments.

• Ineffective Controls Assessment: If internal auditors are not independent, they might be reluctant to identify control weaknesses, non-compliance, or ethical breaches. This can result in the organization's inability to effectively address these issues.

• Underreporting of Risks: Auditors without independence might shy away from reporting high-risk areas or potential issues to avoid conflict with management. This can lead to an incomplete understanding of the organization's risk landscape.

• Inhibited Whistleblower Reporting: Employees may be less likely to report concerns to internal auditors if they perceive a lack of independence. This can prevent the early identification of problems that require attention.

• Compromised Governance: The lack of independent audit findings can negatively impact the governing body's ability to exercise oversight and make informed decisions based on accurate information.

• Misalignment with Objectives: Auditors without independence might be pressured to tailor their findings and recommendations to align with management's objectives, even if those objectives don't prioritize organizational integrity and risk management.

• Limited Value Added: An internal audit function lacking independence may not provide valuable insights and recommendations that drive positive change and improvements within the organization.

• Impaired Trust and Transparency: Lack of independence erodes trust in the internal audit function and undermines transparency in assessing risks, controls, and compliance.

• Regulatory and Legal Risks: Lack of independent audit reporting can expose the organization to regulatory violations and legal liabilities if non-compliance or unethical practices are not accurately identified and reported.

• Conflict of Interest: A lack of independence can result in conflicts of interest when auditors are involved in both advisory and operational roles. This can compromise their ability to provide objective assessments.

In conclusion, independence is fundamental to the credibility and effectiveness of the internal audit function. GOU and the supporting public institutions must ensure that internal auditors have the autonomy to assess risks and controls objectively, without interference or bias, to deliver accurate and impactful findings and recommendations. The GOU should continue to foster an environment where internal auditors can carry out their duties with the highest level of professionalism and impartiality, ultimately contributing to the public institutions’ success and accountability.

3. Audit Committees Role

PUBLIC INTERNAL AUDIT ANALYSIS USAID.GOV | 21

SOERA identified that in cases where they are established, their role is defined as consultative and advisory. Moreover, the IA unit is not subordinated (not accountable) to the Audit Committee, and independent members of Audit Committees are working on a free basis (no remuneration).

Cause: According to the CMU`s Resolution №1001, the Audit Committee can be optionally formed as a consultative and advisory function in a state body to conduct professional consultations and consider issues related to the implementation of IA activities and preparation of recommendations for its improvement. Thus, the defined functionality of the Audit Committee does not fully comply with international practice and internal audit standards (ISPPIA Standard 1110 “Organizational Independence”), according to which organizational independence is effectively achieved when the head of IA reports functionally to the governing body and the governing body in turn assumes important functional oversight duties. These might be realized through the following:

• Approval of the internal audit charter;

• Approval of the risk-oriented annual audit plan;

• Approval of resource planning and internal audit budget;

• Receiving reports from the head of internal audit on internal audit activities related to the plan and on other issues;

• Approval of decisions regarding the appointment and dismissal of the head of internal audit;

• Approval of the salary of the head of internal audit;

• Forms requests to the executive management and the head of internal audit to identify unacceptable limitations in the scope of work and resources;

• Review reporting to assess how effectively recommendations are being implemented, and ensure timely monitoring and responsive action to address issues that arise during the implementation process;

PUBLIC INTERNAL AUDIT ANALYSIS USAID.GOV | 22

• Initiation of unscheduled audits and/or internal investigations;

• Consideration of cases regarding conflict of interests (real and potential) on the part of IA employees.

In accordance with the best international practice and ISPPIA, the independence of internal audit is achieved via dual accountability, when the head of IA is administratively subordinate to the head of the institution and functionally to the Audit Committee. This accountability model ensures the effective performance of the IA function’s duties, as the head of the IA has direct and unlimited access to senior executive management and Audit Committee.

The National IA Standards approved by the MOF regulate organizational independence, saying that it is ensured via the sign-off of the IA Declaration between the IA head and head of institution, approval of the IA Charter by the head…