Attachment K Questionnaire for Stage 2 - PMFRAF--.pdf

Stage 2 Risk Assessment Questionnaire

PUBLIC FINANCIAL MANAGEMENT RISK ASSESSMENT (PFMRAF) STAGE 2

QUESTIONNAIRE VERSION 2 (3-12-2014)

INDEX

Overview and Instructions 2

Section 1: Entity Features 4

Section 2: Budget 7

Section 3: Procurement 16

Section 4: Cash Management and Treasury 29

Section 5: Accounting and Reporting 36

Section 6: Human Resources and Payroll 45

Section 7: Internal Control 52

Section 8: Information Technology 58

Section 9: Audit and Compliance 70

OVERVIEW AND

INSTRUCTIONS

Overview:

The Stage 2 Risk Assessment is designed to identify the fiduciary risk(s) US government funds may be exposed to when administering a program/project/activity using the partner government public financial management system(s). The Stage 2 Questionnaire is a tool to help risk assessment teams conduct this assessment. The questionnaire consists of a comprehensive list of illustrative questions by functional area, evaluation criteria/questions and sub-criteria that help to evaluate adherence to common PFM best practices, standards and internal controls.

The Stage 2 Questionnaire is a starting point from which to develop the relevant questions that will address the scope of areas to be reviewed in a Stage 2 Risk Assessment. There is no requirement to use the questionnaire in its entirety; rather, focus on those functional areas and questions that are considered relevant for the specific assessment. It is also appropriate to draw upon other relevant professional guidelines or checklists (i.e., AICPA or IIA questionnaires or AICPA checklists) to develop a customized questionnaire.

Completion of a customized Stage 2 questionnaire will become the primary source of evidence for the Stage 2 Risk Assessment. The existing format can be logically cross-walked or referenced to support information in a Stage 2 Risk Assessment report.

Navigation Tools:

To guide risk assessment teams, this document has two navigation tools to help users:

1. The Navigation Pane – The pane can be activated by using the “Control” and “F” key. The navigation pane lists the various sections of the document and can used by users to move around the document.

2. The Index – Page 1 of the document contains an index with links to the various pages in the document. To move around the document, users can use the “Control” key and click on the page numbers listed on the index.

Format and Instructions:

There are nine PFM sections covered in the questionnaire as described further below. Within each section the opportunity to evaluate specific criteria/questions and identify related fiduciary risk is provided:

Column I – Criteria/Questions - Identifies the criteria or questions to be evaluated. Although some questions may appear to generate “Yes/No” responses, the intent is for the assessor to understand and describe what was found or observed in response to the question posed and to assess whether such findings might pose a fiduciary risk. Doing so will evidence the rigor applied in conducting the assessment.

Column II – Observations & Assessment – Used to describe the assessor’s observation and assessment relative to criteria/question evaluated. Inputs to this determination include interviews conducted, results of tests conducted, documents reviewed and other observations. Assessments that result in absence of or deviation from the criteria and which pose an issue or risk can also reference appropriate mitigation strategies.

Column III – Reference – Used to identify sources of information that support the basis for Observations and Assessment in Column II. For example, date of meeting(s) held with specific government officials; tests conducted; and names of documents referenced to gather data.

Column IV – Issues/Risk Indicator - Used to indicate whether information in Column II poses an issue or potential risk, by indicating “Yes,” “No,” or “Maybe.”

Column V - Risk Identification – This appears at the end of every section and should be used to determine and list fiduciary risk identified. Utilizing “Yes” and “Maybe” responses indicated in Column IV and revisiting related assessment information from Column II in the preceding section, a determination can be made as to whether these findings, individually or in combination with other findings pose a fiduciary risk. The risk(s) should be identified in this section.

Please note that once risks have been identified they will need to be evaluated for “Probability” and “Impact” to arrive at an overall risk rating; and appropriate risk mitigation strategy.

Questionnaire Sections:

1. Entity Features: This section helps the assessor obtain a general understanding of the entity, its environment, and organization structure. Overarching relevant laws and regulations, key functions and decision making processes are also covered.

2. Budget: This section covers functional budget formulation and planning, including processes for developing a budget to achieve entity and/or program objectives, tracking of expenditures against the budget, and other related areas.

3. Procurement: This section covers the acquisition of goods and services life cycle, including procurement specific laws and regulations, bidding process, technical requirements, contracts management and oversight mechanisms.

4. Cash Management and Treasury: This section covers functional processes and controls, including cash planning and management to meet existing obligations and programmatic objectives and banking practices.

5. Accounting and Reporting: This section covers remaining functional processes related to budget execution, including accounting, payment processing, asset management, and reporting.

6. Human Resources and Payroll: This section covers broad functional practices and controls related to human resources and payroll, including strategic resource planning, hiring practices, timekeeping and fraud prevention.

7. Internal Control: This section covers the general internal or management control of an entity, including control environment, risk assessment, information and communication, and monitoring activities. Control activities, the wide range of diverse activities, such as policies, approvals, verifications, and reconciliations applied, have been interspersed within each of the functional areas.

8. Information Technology: This section is specific to management practices over information systems and applications within the PFM context. It includes general controls, disaster recovery and backup procedures, physical security and application controls.

9. Audit and Compliance: This section addresses oversight entities, including related audit reports to gain insights on reported entity weaknesses and challenges. Entity compliance with donor and other administrative requirements are also covered.

Section 1: Entity

Features

Date: Auth(s):

Section 1: Entity Features

I II III IV

Evaluation Criteria/Questions Observations & Assessment Reference Issue/Risk Indicator

(Yes/No/Maybe)

1 Organization and Functions

1.1 Organization

Obtain and briefly describe understanding of the entity and its environment, including:

• Nature of the entity, legal corporate status (i.e. line ministry, state-owned corporation or enterprise, etc.) origin, mission

• Legal, regulatory, and procedural framework

• Entity owners, organizational structure, lines of reporting

• Delegation of authority and responsibility

• Relationship with oversight entities

1.2 Operations and Functions

▪ Obtain and briefly describe entity operations, and functions, particularly those related to public financial management (PFM) and government-to-government (G2G) initiatives, including:

• Key functions, business processes

• Internal factors affecting entity operations, such as size of entity, number of locations, centralized or decentralized structure, complexity of operations, qualification s of key personnel, turnover of key personnel

• External factors affecting entity operations, such as current political climate, seasonal fluctuations, source(s) of funds, relevant legislation

▪ Obtain a high-level understanding of the entity’s use of information systems within the PFM life cycle.

V. Risk Identification (Entity Features)

Review information gathered above, utilizing column IV as an indicator and related assessment data in column II, to determine if findings pose an individual risk or a category of risks and identify below.

[Note: Risk identified below will need to be evaluated for probability and impact to arrive at an overall risk rating/classification of low, medium, high or critical. Also, mitigation measures/strategies will need to be determined consistent with the level of risk identified. These should be included in your Stage 2 Risk Assessment report.]

# Risk Name Risk Description

Section 2: Budget

Date: Author(s):

I II III IV

Evaluation Criteria/Questions Observations & Assessment Reference Issue/Risk Indicator

(Yes/No/Maybe)

1. BUDGET CREDIBILITY

1.1 Budget Formulation and Control

Policies and Procedures. Obtain an understanding of the budget process.

Determine whether the entity has policies and procedures for budget formulation, planning and control (e.g. manuals, approvals process) and confirm that:

• There is a process for formulating budgets

• Duties and responsibilities are defined and segregated relative to preparation, supervision and approval of budget.

Budget is broken down by main categories (i.e. personnel)

The process for approvals, changes, deadlines, etc. is defined.

The budget planning process includes a participatory process

Key functions are assigned and duly staffed

Budget staff have sufficient technical capability for the tasks

There are procedures in place to train personnel on proper budgeting

Information Systems. Determine if information technology is used for budget formulation and planning.

• How is the system used? And by whom? Is there adequate segregation of duties?

Budget Calendar. Determine whether there is a budget calendar. If so:

• How closely is it followed?

• Select the most recent budget for a program and confirm that the entity follows the budget calendar and submits the budget on a timely basis

▪ Communication and Control. Determine the extent of communication between the ministry/entity and Ministry of Finance (MOF)/finance department regarding budgetary control:

Is there a requirement for such?

Does the MOF/finance department notify the ministry/entity when expenditures approach or exceed budget? Only when certain limits are reached?

Is over/under spending reported to the responsible minister/entity head?

▪ Budgetary Control. Confirm that the government/entity has controls to ensure that they only use funds as intended (i.e. achieve objectives), including:

• The government/entity has controls to prevent misuse, misappropriation, and fraud

• Project specific budgets are restricted from other use

Evaluation Criteria/Questions Observations & Assessment Reference Issue/Risk Indicator

(Yes/No/Maybe)

1.2 Budget vs. Actual Spending. Determine whether the budget typically reconciles favorably with planned expenditures.

Are there are any problems related to poor planning? For example, “bunching” - rushing to spend any available funds at the end of the year to avoid “losing” (and receiving less funds in the next year.) If so, how are problems addressed, and might this impact a potential G2G program/project/activity?

Does the MOF/finance department have a regular process for analyzing the variance between budget and actual spending and mitigating risks associated with variance?

If actual vs. budget analyses are prepared, determine whether o Variances or deviations from the original budget were documented, approved and tracked, consistent with policy or procedure.

o Are deviations indicative of a problem with the forecasts?

o Describe general reasons for deviations o Do deviations indicate an institutional problem?

1.3 Validation of Budget Policies & Procedures

Select a budget for a recent year including one to two project budgets and confirm that:

Budgets were approved on a timely basis

Approvals are consistent with defined requirements for the budget process

Project specific budgets are restricted from other use

Actual vs. budget analyses are prepared according to policies and procedures

Evaluation Criteria/Questions Observations & Assessment Reference Issue/Risk Indicator

(Yes/No/Maybe)

1.4 Extent of Budget Transfers

Is there a policy/provision for budget transfers? Select a sample of budget transfers from the entity and confirm that:

Transfers were documented

Transfers were approved and approval was documented according to policy

Transfers did not violate any agreement, earmarking, etc.

Limits are established on transfers (e.g. 10%)

2. Budget Comprehensiveness and Transparency

2.1 Budget Coverage

Discuss the budget process with the entity, briefly describe, and confirm that it covers all revenues and expenditures and:

It includes capital and development expenditures, including its cost implications and constructions

It includes all institutions and programs

If exclusions exist, document the reasons for them and consider their impact.

Exceptions are spelled out in the budget notes

2.2 Supplementary Budgets

Inquire if financial regulations provide for additions to budgets during the year. Describe briefly and confirm that:

Policies and procedures are defined and followed Approval levels are properly established

Evaluation Criteria/Questions Observations & Assessment Reference Issue/Risk Indicator

(Yes/No/Maybe)

2.3 Off-Budget Spending

Confirm whether off-budget spending is allowed. If it is allowed, select a sample and confirm that:

The entity has appropriate controls to approve it Off-budget spending is monitored and reported

2.4 State-Owned Enterprise (SOE) Investments

Inquire if the entity has state-owned enterprise (SOE)/parastatal investments in the budget and understand the controls used to account for them and to ensure that they are incorporated into the central government budget.

2.5 Reserves Requirements

Inquire about the requirements to maintain reserves and confirm that: The entity reports on its reserves

Reserves are monitored

2.6 Special Expenditure Categories

Inquire if regulations allow for special expenditure category approval(s), outside the normal budgetary approval process. If so, confirm that:

Financial regulations specify which categories of expenditure should be subject to the submission of a financial implications report

A financial implications report on revenue costs is required for proposed capital projects

Evaluation Criteria/Questions Observations & Assessment Reference Issue/Risk Indicator

(Yes/No/Maybe)

2.7 Intergovernmental Fiscal Relations

Determine how the entity budget process relates and interfaces with the national budget process, Consider any potential impact to the G2G program/project/activity.

Does the national budget process consider policy objectives, priorities and plans of sub-national governments and/or decentralized units of the central government (e.g. social assistance, education, health and agriculture spending)?

2.8 Budgeting for Donor Funds

Confirm that the entity has policies and procedures to account for donor funds (i.e. budgeting and tracking of funds from international donor agencies such as USAID)

Describe how funds from donors are incorporated into the general fund or accounted for separately; and any potential impact to a G2G program/project/activity.

3. POLICY-BASED BUDGETING

3.1 Connection Between Funding Levels and Results

Review controls by the entity/government to review achievement of the program objectives over the life of the program (e.g. use a medium-term expenditure framework (MTEF), medium-term financial framework (MTFF), etc. Obtain sample selections and confirm the effectiveness of these controls.

Confirm that entity utilizes a control to achieve results based on expected results (i.e. performance based budgeting)

3.2 Quality of the Budget Narrative

Confirm that the budget document includes a narrative. Make sample selections and confirm it:

Articulates the government’s policy, priorities and how they will be achieved

Addresses policy changes and performance implications

Performance information on the effectiveness of programs

V. Risk Identification (Budget)

Review information gathered above, utilizing column IV as an indicator and related assessment data in column II, to determine if findings pose an individual risk or a category of risks and identify below.

[Note: Risk identified below will need to be evaluated for probability and impact to arrive at an overall risk rating/classification of low, medium, high or critical. Also, mitigation measures/strategies will need to be determined consistent with the level of risk identified. These should be included in your Stage 2 Risk Assessment report.]

Section 3:

Procurement

Section 3: Procurement

Evaluation Criteria/Questions Observations & Assessment Reference Issue/Risk Indicator

(Yes/No/Maybe)

1. General Features and Functions

1.1 What is the legal, regulatory, and procedural framework for the entity’s procurement (and related) function?

▪ What procurement laws and regulations apply to the entity?

▪ Is the functional framework clear, comprehensive, consistent, and well-coordinated?

▪ Does it include procurement specific oversight entities?

▪ Explain and provide context.

1.2 Describe the typical procurement cycle (from planning to bid advertisement to award to implementation to closeout) phases or functions.

▪ Who has to approve different steps along the procurement cycle, (from advertisement to award to acceptance to final payment)?

▪ Explain and provide context.

1.3 Are key functions assigned and duly staffed (e.g. planning, bid documentation preparation, bid process management, bid opening and evaluation, contract management and oversight, audit, etc.)?

Explain and provide context.

1.4 Does the agency have a clear system of accountability with clearly defined responsibilities and delegation of authority on who has control of procurement decisions?

Is the system effective (i.e. is authority delegated "on paper" and/or applied consistently "in practice")?

1.5 Is the decision making process "formalized" and described in a procurement manual or other guidance/instructions and known to staff?

Evaluation Criteria/Questions Observations & Assessment Reference Issue/Risk Indicator

(Yes/No/Maybe)

2. Internal Manuals and Clarity of the Procurement Process

2.1 Does the agency have a well-documented set of implementation regulations and/or a procurement manual applicable to procurement under the project and is it accessible to staff?

2.2 Do the regulations and/or manual provide comprehensive and clear instructions for all steps of the procurement process (i.e.

planning, evaluation, award, methods, review thresholds, record keeping, etc.)?

2.3 Does agency staff understand the instructions and are they confident in their actual application of such instructions?

2.4 Are manuals and policy documents well-disseminated to and consulted by staff?

3. Record Keeping & Document Management Systems

3.1 Does the agency maintain adequate written records of all

procurement documents (both pre-award and post-award)?

3.2 Does a system (manual or electronic) exist to easily locate relevant records?

3.3 Are records protected from loss and unauthorized access?

Explain and provide context

Evaluation Criteria/Questions Observations & Assessment Reference Issue/Risk Indicator

(Yes/No/Maybe)

4. Staffing

4.1 Does the agency have key staff with knowledge, experience and a satisfactory track record in procurement in general and on donor-funded projects specifically?

4.2 Does the agency have access to contract management expertise and a track record of quality and timely delivery?

4.3 Does management ensure that staff takes quality training for continuous skill development in procurement and contract management?

4.4 Is staff selected on an open and competitive basis and offered a competitive compensation that allows attracting high-caliber staff?

5. Procurement Planning

5.1 Are realistic procurement plans prepared as a matter of course in the agency (based on the objectives of the project, justifiable quantities, realistic market prices, timing of delivery, storage, funding availability, etc.) and approved formally?

5.2 Are contracts packaged such that they will maximize interest by reputable bidders?

5.3 Will contract packages challenge the capabilities of the entity in terms of size, complexity, and timing (e.g., multi-stage bidding, turnkey, concessions, IT, etc.)?

Evaluation Criteria/Questions Observations & Assessment Reference Issue/Risk Indicator

(Yes/No/Maybe)

5.4 Is there a track record of adhering to and updating and executing procurement plans, taking into account cost, timing, sequencing, methods, cash flow, etc.?

5.5 Has the entity assessed sector risks (related to collusion, supply constraints) and taken them into account in the procurement plan?

5.6 Does the entity routinely conduct market surveys to update their knowledge on prevailing prices and the availability of vendors for goods, works, and services?

5.7 Are conditions for use of various procurement methods clearly established and are there explicit requirements that open competitive bidding is the preferred or default method?

6. Bidding Documents, Prequalification, Shortlisting, and Evaluation Criteria

6.1 Does the entity have capable staff to prepare bidding documents?

6.2 Is prequalification (if applicable) based on objective pass-fail criteria, clearly listed in the documents, and appropriate for the project?

6.3 Are shortlists balanced and are highly qualified firms who have expressed interest generally included?

Evaluation Criteria/Questions Observations & Assessment Reference Issue/Risk Indicator

(Yes/No/Maybe)

6.4 Does the entity use SBDs which are standardized for the agency, country, or sector?

6.5 Does the entity produce technical specifications/terms of reference/bid documents of good quality?

6.6 Does the entity use national competitive bidding vs. international competitive bidding? If so, what are the thresholds?

7. Advertisement, Pre-bid/Proposal Conference and Bid/Proposal Submission

7.1 Are bids/proposals consistently advertised in media of wide circulation and easily accessible to potential bidders?

7.2 Is the content of the advertisements sufficient to enable a potential participant to determine its interest in competing?

7.3 Is sufficient time allowed for bid or proposal preparation appropriate to the complexity of the procurement?

7.4 Are qualifications for bidders fair and appropriate?

7.5 Are timely and non-ambiguous clarifications to bidding/proposal documents provided to all potential bidders?

Evaluation Criteria/Questions Observations & Assessment Reference Issue/Risk Indicator

(Yes/No/Maybe)

7.6 For open competitive bidding, are bids opened in public in the presence of bidders/representatives and immediately following the deadline for bid submission?

7.7 For negotiated procurements, do rules provide for a fair and transparent bid/proposal and evaluation process?

7.8 Is the number of bids received reasonable as compared to the number of pre-qualified bids?

8. Evaluation and Award of Contract

8.1 Are evaluations conducted professionally and by members with technical expertise in the items/services being procured?

8.2 Are evaluations and qualifications carried out thoroughly and on the basis of the criteria specified in the documents?

8.3 Are there any indicators that the bidding/selection process are manipulated/have been manipulated to favor a certain bidder or are there unusual bid patterns?

8.4 In reviewing the bids, are red flags of corruption identified?

8.5 Is due diligence conducted on the winning bidder to ensure that it is a legitimate, reputable, and technically and financially capable company?

Evaluation Criteria/Questions Observations & Assessment Reference Issue/Risk Indicator

(Yes/No/Maybe)

8.6 Are additional government approvals required before contracts can be executed? To what degree is the procurement decision-making function insulated/shielded from politics?

8.7 Do evaluation reports contain all essential information necessary for approvals, including adequate justification for decisions taken during evaluation such as rejection of bids?

8.8 Is there a protocol in place to ensure safekeeping of information during the evaluation process?

8.9 Are contracts awarded and made effective in a reasonable amount of time and substantially with the same scope as in the bidding documents?

8.10 Does the entity have a disclosure policy in place (notice of award decisions, right to obtain a debriefing, access to contract award information)?

9. Review of Procurement Decisions and Resolution of Complaints

9.1 Are there serious/frequent informal or formal complaints by disappointed bidders, civil society organizations, or others on evaluations?

9.2 Does the entity have a formal system known to the bidding community to review and resolve complaints from bidders at different stages of the procurement cycle up to contract award?

Evaluation Criteria/Questions Observations & Assessment Reference Issue/Risk Indicator

(Yes/No/Maybe)

9.3 Does the system in place allow a complaint to be disposed of administratively prior to or in lieu of judicial review?

9.4 Does the agency keep data on volume of complaints and nature of complaints and report on them?

9.5 Is the system effective and does it ensures timely and fair decision making that protects against retaliation?

10. Contract Management and Administration

10.1 Does a manual or computerized procurement monitoring

system exist?

10.2 Are invoices from vendors generally paid within the contractual terms?

10.3 Do procedures exist to monitor delivery of goods, and services to verify quantity, quality and timeliness, and to control inventories of goods?

10.4 Are contracts generally implemented according to specifications, on time and without excessive changes in scope or price, and are variations justified?

10.5 Are contract amendments generally processed diligently and in a reasonable time?

Evaluation Criteria/Questions Observations & Assessment Reference Issue/Risk Indicator

(Yes/No/Maybe)

10.6 Are completion schedules generally met? If not, what is the major cause of slippage?

10.7 Are final acceptance procedures used and certificates issued in a timely fashion as a part of contract close-out?

10.8 Is there a backlog of unresolved contractual claims (e.g.

payments, variations)?

10.9 Is there a track record of implementing an alternative dispute resolution procedure besides the judicial avenue?

11. Procurement Oversight

11.1 Are the entity’s procurement operations subject to

regular internal and external audits?

11.2 Are external audits carried out by an independent body (such as an SAI)?

11.3 Is the scope and quality of the procurement audits satisfactory and do they include physical inspections and compliance checks?

11.4 Are audit reports issued in a timely manner and are

recommendations related to procurement generally implemented promptly?

Evaluation Criteria/Questions Observations & Assessment Reference Issue/Risk Indicator

(Yes/No/Maybe)

11.5 Does the entity have access to quality legal advice?

11.6 Is there any other form of oversight of procurement exercised by other external independent organization like civil society groups, an anti-corruption agency, etc.?

11.7 Does the entity hold regular meetings with the business

community to discuss procurement issues?

12. Integrity

12.1 Do opportunities exist for government officials to exercise undue influence into the procurement process?

12.2 Is there a published and known code of ethics that describes inappropriate behavior related to procurement?

12.3 Is it easy for individuals (including agency officials) to report allegations of corruption related to procurement?

12.4 Do measures exist at the entity level to curb/control corruption?

12.5 In the past five years, has the agency faced any allegations of corruption relating to procurement? If so, explain the circumstances and how/whether the agency dealt with such allegations. (check w/ other development partners, CSOs, etc.).

Evaluation Criteria/Questions Observations & Assessment Reference Issue/Risk Indicator

(Yes/No/Maybe)

12.6 Do contractors have any legal requirements relating to

procurement integrity, including mandatory self-disclosures, establishment of codes of ethics, certifications accompanying bids and invoices, etc.?

V. Risk Identification (Procurement)

Review information gathered above, utilizing column IV as an indicator and related assessment data in column II, to determine if findings pose an individual risk or a category of risks and identify below.

[Note: Risk identified below will need to be evaluated for probability and impact to arrive at an overall risk rating/classification of low, medium, high or critical. Also, mitigation measures/strategies will need to be determined consistent with the level of risk identified. These should be included in your Stage 2 Risk Assessment report.]

Section 4:

Cash Management and Treasury

Section 4: Cash Management and Treasury

1. Cash Management

1.1 General

▪ Policies and Procedures. Determine whether the entity has written policies, procedures and practices governing cash management. including:

• Are the policies available and up to date?

• Do they include planning, cash collection, deposit, disbursement, forecasting and investment?

• Do they include controls over access to cash and checks, reconciliation of bank accounts, use of petty cash funds, segregation of duties?

• Is there effective cash flow planning, management and monitoring

• Is there an annual cash plan, updated regularly, setting out monthly cash inflows, outflows and borrowing requirements? How accurate has this been?

• Does the annual budget implementation plan take into account the timing of payments, and payment obligations arising from the commitments during the year?

• Is there a daily calculation and consolidation of cash flow balances?

▪ Cash Management Unit. Is there a cash management unit within the MOF (or finance department) with assigned roles, responsibilities and duties?

• Do they have sufficient technical capability for the tasks?

• Is the staff supported by adequate information and communication technology?

Information Systems. Determine if information technology is used for cash management.

• How is the system used?

• And by whom? Is there adequate segregation of duties?

1.2 MANAGING CASH SHORTFALLS & USE OF FORECASTS

▪ What guidance and controls exist to manage short term fiscal imbalances (e.g., tax anticipation n or bond anticipation notes)?

• Have cash limits or cash rationing been imposed?

▪ What are practices over use of cash forecasts?

• Are they used?

• Is borrowing planned on the basis of reliable cash forecasts?

• How accurate and timely are forecasts of anticipated revenue and expenditures?

1.3 Short-term Investments

▪ What is the practice over short-term investments?

• Are timely records kept of each short-term investment transaction including: date, name of seller amount, maturity, account number, duplicate copies, signatures of authorizing officials, investment yields, prices and discount rates?

• Are investments reconciled with cash balances and cash accounting records on at least a monthly basis?

1.4 Cash Availability & Response to Cash Flow Problems

▪ Is there evidence that cash is made available to cover obligations, including, e.g., discounts for early payments?

▪ Are there sufficient reporting and accountability arrangements in force for proper management response to cash flow problems?

1.5 Cash Management Governance

▪ What are the oversight mechanisms for cash management?

• Is there a whole-of-government Cash Management Committee in existence? Who comprises this committee?

• How effective is this oversight mechanism in practice?

2. Treasury and Banking Operations

2. 1 Centralization of Bank Balances (Treasury Single Account)

Discuss with government officials the utilization of a Treasury Single Account (TSA). Obtain supporting documentation related to the TSA and determine that:

• All bank accounts, including commercial accounts, and central government accounts are controlled by the MOF and/or Treasury

• All bank accounts are centralized in one bank

• Cash is managed centrally efficiently to cut down on financing costs and bank balances are analyzed for efficiency and effectiveness.

▪ If a TSA is not used, describe how cash is managed, the number of bank accounts; consider impact to G2G program/project/activity.

2.2 Evaluating Banking Services

Confirm that the entity/government has procedures and methods in place for selecting and evaluating banks.

• Does the entity have a procedure for selecting banks?

• Are there regular and effective cash management and investment relations between the government and commercial banks?

• Does the cash management unit evaluate the effectiveness of standard banking services, e.g., deposits and direct deposits, and account reconciliations?

2.3 Controls Over Bank Accounts

Obtain an understanding of existing controls over bank accounts:

• Monthly bank reconciliations, including resolution of discrepancies, signed management review,

• Check signing for each bank account requires more than one signature based on the value of the payment

• Payments exceeding a certain threshold (e.g. $100K) require additional approvals

• There is proper segregation of duties established to deter fraud (e.g. person doing the bank reconciliation does not sign checks, checks above a certain value require two signatures, approver of purchases is not a signer of checks, etc.)

• Background checks are current for people in charge of managing the bank account(s)

• Bond amounts of people signing for checks is sufficient to cover the value of the account balances in case of fraud

• Any fraud specific controls over bank accounts

2.4 Bank Reconciliations

Obtain a sample of bank accounts reconciliations for various types of accounts for the entity (e.g. one program, one general account, etc.) over a few months and confirm that:

• Bank reconciliations are prepared on a timely and regular basis

• Reconciling items are resolved timely (they are not carried from month to month)

• Reconciliations were reviewed and review is documented

• Reconciliations were accurate (they reconciled to the general ledger to the bank statement and no errors were noted)

• Reconciling items are properly supported

V. Risk Identification (Cash Management and Treasury)

Review information gathered above, utilizing column IV as an indicator and related assessment data in column II, to determine if findings pose an individual risk or a category of risks and identify below.

[Note: Risk identified below will need to be evaluated for probability and impact to arrive at an overall risk rating/classification of low, medium, high or critical. Also, mitigation measures/strategies will need to be determined consistent with the level of risk identified. These should be included in your Stage 2 Risk Assessment report.]

Section 5: Accounting and

Reporting

Section 5: Accounting and Reporting

Evaluation Criteria/Questions Observations & Assessment Reference Issue/Risk Indicator

(Yes/No/Maybe)

1. Accounting Operations

1.1 Accounting System

Develop an understanding of the accounting and reporting system:

• Is it an integrated financial management information system?

• What modules or applications (general ledger, accounts payable, etc.) are included or operative?

• Is there a procedure manual for using the accounting system?

• Is there a subsidiary ledger or system?

Was the system developed in house or it is packaged software (e.g.

Microsoft, other) and determine whether:

• All government entities utilize the same software system

• Any modules that are not integrated (e.g.: asset management) are reconciled to ensure that all data is input timely and correctly

• All modules are maintained in the system.

o If some modules are kept using Excel or manually, make sample selections of reconciliations and confirm that all data is integrated into the financial statements via confirmation of reconciliation procedures. If this is not done, document issues and potential impact to the envisioned G2G program/project/activity.

▪ Do systems provide the information to enable source documents to be traced to financial statements and vice versa?

▪ How does the accounting information system generate reports?

1.2 Compliance with Accounting Standards

Review the basis of accounting used by the government (e.g.

cash, modified accrual, accrual) and determine that it follows the requirements per local regulations and determine that:

• The local accounting is consistent with Generally Accepted Accounting Principles(GAAP), International Public Sector Accounting Standards (IPSAS), or other international accounting standards; are differences in standards accounted for by the by the government?

• The accounting basis is consistent across different governmental entities (e.g. autonomous enterprises, general fund agencies, local governments, special funds and city enterprises); if not, determine why not.

• If accounting is not reconciled or consistent to GAAP or IPSAS, determine potential impact to the envisioned G2G project/program/activity.

1.3 Accounting and Reporting Policies and Procedures

Determine whether the entity has established appropriate accounting policies and procedures. Obtain the procedures manual and/or policies and procedures and review such to determine that the following are addressed:

• Processing of accounting data either electronically or manually. If any data is processed manually that it is reconciled to the recipient system to ensure that it is transferred completely and on a timely basis

• Reporting procedures and timeframes (e.g.

accounting deadlines) are well defined

• Policies are complete and address all reporting requirements (e.g. timeframes and deadlines, reports that are required, data that needs to be processed, etc.)

• Required qualifications of personnel using the system are well defined

• Defined approvals for changes to the chart of accounts

• Appropriate segregation of duties between authorizing transactions, processing transactions, recording transactions, custody of assets, and reviewing transactions

• A defined process for approving and posting journal entries

• National regulations that guide accounting standards, policies and procedures; or rules that require specific accounting for funds, programs, or projects

1.4 Controls over Journal Entries

▪ Select a sample of journal entries to confirm:

• Duties of preparing and posting journal entries are segregated

• Journal entries are reviewed for accuracy

• Access to the accounting system is segregated

• Journal entries are properly supported with documentation

1.5 Financial Reporting

Determine that accounting data is regularly compiled into financial statements (e.g. balance sheets, activity/ income/ operating statements and cash flow statements). Obtain a sample selection of financial statements and determine:

• Financial statements are reviewed for accuracy

• They are prepared on a timely basis in accordance with a financial reporting calendar or entity policy

• The basis of accounting (i.e. cash, accrual, modified accrual, etc.) is clearly indicated

• They are audited

• They provide enough details for users (e.g. enough breakdown of categories) to make informed decisions

• They are comprehensive and understandable

• Finance staff can produce and deliver timely financial reports to management and donors.

1.6 Reconciliation of Subsidiary Ledgers:

Obtain the general ledger and balances for subsidiary ledgers and reconciliations between the ledgers and determine that:

• The subsidiary and the general ledgers are reconciled timely

• Differences are explained and supported

• Differences are resolved on a timely basis

• Reconciliation is reviewed and approved and documented in writing

1.7 Chart of Accounts

Is there a common chart of accounts utilized across the government (ministry, local government, etc.)?

Obtain a listing of changes to the chart of accounts. Select a sample of changes to the chart of accounts and determine that:

• Changes were documented in writing

• Changes were approved by a supervisor

• Changes are properly justified (e.g. not fraudulent)

2. PAYMENT PROCEDURES AND CONTROLS

2.1 POLICIES AND PROCEDURES

▪ Describe policies, procedures, and controls for processing payments/payment vouchers (less payroll):

• Do written policies and procedures exist?

• Are they applied in practice? Are they frequently bypassed?

• What approvals are required?

• Is there appropriate segregation of duties between reviewing, authorizing, processing, and recording payments?

• Is there a procedure for dealing with urgent payments?

• Is there a procedure for avoiding duplicate payments?

• Is the payment process electronic or manual?

▪ Select a sample of payments

• How well are policies and procedures followed?

• Are internal controls consistently applied? If not, explain

3. ASSET MANAGEMENT

3.1 Policies and Procedures

Obtain policies and procedures regarding safeguarding of assets and determine that:

• The policies separate access to the assets from other functions

• There are adequate preventive controls in place (for example a separate treasury function, double signature systems on the bank accounts, system of earmarked bank accounts for specific actions)

• Assets are regularly inventoried (e.g. physical inventory, confirmations)

3.2 Physical Controls Over Assets

Obtain an understanding of physical controls over assets and perform a physical verification of controls and determine that:

• Assets are tagged (marked appropriately)

• There are physical controls (e.g. security guards, alarms, locks, etc.)

• Effectiveness of physical controls is evaluated by the entity

• There are adequate measures for assets with high susceptibility of loss (e.g. lock box for cash, special checks for laptops, etc.)

3.3 Physical Count of Assets

• Review procedures that check for the existence of assets at least annually such as a physical inventory count. Request the last two asset counts, the registry of assets from the system, support documentation (e.g. count sheets), and determine that:

• Asset registry was reconciled to the physical inventory count of assets

• Assets per the count sheets agreed to the physical inventory count taken

• Inventory count of assets was done timely in accordance with the policy

• Inventory counts are done at least annually

• Inventory counts of assets are reviewed and approved by a supervisor

• Any physical differences are accounted for on a timely basis

• Any assets not accounted for are adjusted in the accounting records

V. Risk Identification (Accounting and Reporting)

Review information gathered above, utilizing column IV as an indicator and related assessment data in column II, to determine if findings pose an individual risk or a category of risks and identify below.

[Note: Risk identified below will need to be evaluated for probability and impact to arrive at an overall risk rating/classification of low, medium, high or critical. Also, mitigation measures/strategies will need to be determined consistent with the level of risk identified. These should be included in your Stage 2 Risk Assessment report.]

Section 6:

HUMAN RESOURCES AND PAYROLL

Section 6: Human Resources and Payroll

1. HUMAN RESOURCES

1.1 Policies and Procedures

Obtain copies of the human resource policies and procedures and determine:

• They are complete in addressing compliance with ethical standards, use of government assets, compliance with anti-corruption laws, procedures for grievance, forms to be used by employees, advances, travel and entertainment, leave and sick time, benefits, evaluations (salary increases) and process for reporting fraud, including whistle blower protection

• They apply to all entities under review

• They include time and attendance policies

1.2 Monitoring Tools

Obtain an understanding of the monitoring tools used by the entity to manage the human resources process (e.g.: turnover ratio, resource allocation, efficiency and effectiveness, job satisfaction, etc.) and determine:

• The entity has an effective process to manage resources

• There are sufficient and qualified employees to carry out their work

• Time allocated by employees is tracked by project

• The names of approved employees are verified annually

1.3 Competitive and Appropriate Hiring Practices

Obtain a listing of recently hired employees and contractors since the new government/administration, minister, or entity official was elected.

Make a sample selection of newly hired employees and contractors.

Then, obtain supporting documentation from the human resources department (e.g. hiring file, resume or curriculum vitae (CV), review committee, etc.) and determine that:

• Employees/contractors were hired using competitive procedures and job descriptions were used

• Personnel/contractors hired had the proper qualifications and experience and were not hired due to favoritism

• Approvals for hiring employees/contractors were documented in writing

• Ministry officials did not influence the hiring process (e.g. officials had discretion to determine hiring without any competitive process)

• Salaries of hired employees/contractors are equitable compared to similar personnel working for the entity

• Entity has a salary scale or policy that addresses salaries and salary increases.

1.4 Training Practices

Review the entity’s strategy to develop train employees based on their job requirements and across all relevant PFM areas (procurement, budgeting, etc.):

• Review the type of ongoing training that is provided to address any employee weaknesses

• Review all trainings that are provided for all employees during the year

• Determine that the entity allocates a certain portion of the budget to train employees

• Determine the impact of any lack of training and develop recommendations to mitigate any risk.

2 PAYROLL

2.1 Policies and Procedures:

Obtain an understanding of policies, procedures and controls governing payroll, including:

• Who is responsible for processing payroll?

• Is payroll processed locally or centralized at the national level?

• How are employees paid (manually, electronically, etc.)?

• Controls over timeliness (records are recorded timely)

• Accuracy (payroll records are recorded accurately in the accounting system)

• Validity (payroll records and any changes thereto are approved)

2.2 Payroll and Time Records

Confirm that the payroll system is linked to the time and attendance system. Sample selections from the payroll for a period and determine that:

• Records from payroll are reconciled to the time and attendance system every payroll period

• Records are reviewed and approved

• Payments were made to employees (e.g. employees signed off)

• Confirm that the employees receiving payment had a personnel file from human resources and they are real employees (test to check for validity)

• Time records have been signed off by employee (this could be a system control such as a fingerprint)

2.3 Payroll Fraud Controls

Review payroll controls intended to prevent fraud, waste, and abuse and assess their effectiveness. This should include:

• Access controls and segregation of duties

• Review of validity of employees shown on the payroll

• Review of personnel records for employee showing rates of pay, sick leave, allowances, references, contracts, etc.

• Maintaining the confidentiality of the records

• Existence of time and attendance records (e.g. timesheets)

2.4 Calculation of Payroll Payments

Obtain the payroll records to test a sample of payment periods.

Make sample selections of payments to employees, request supporting documentation and determine that:

• Payroll was calculated accurately, including applicable deductions and/or taxes

• Payroll calculation was reconciled to the time and attendance records and it is accurate

• Payroll was recorded accurately and timely in the accounting system

• Control totals per the payroll records are accurate (re-calculate to confirm accuracy)

• Batch processing was used

• Payroll was approved by a person with authority and independent from the payroll preparation

• Payroll preparation, approval and payment are segregated functions

• Employees are identified before receiving payment

• There is confirmation that employees received their pay

V. Risk Identification (Human Resources and Payroll)

Review information gathered above, utilizing column IV as an indicator and related assessment data in column II, to determine if findings pose an individual risk or a category of risks and identify below.

[Note: Risk identified below will need to be evaluated for probability and impact to arrive at an overall risk rating/classification of low, medium, high or critical. Also, mitigation measures/strategies will need to be determined consistent with the level of risk identified. These should be included in your Stage 2 Risk Assessment report.]

Section 7: Internal

Control

Section 7: Internal Control

1 Management Control

1.1 Codes of Conduct and Policies

Determine whether there is a code of conduct and/or other policies regarding acceptable business practice, conflicts of interest, or expected standards of ethical and moral behavior:

• Are the codes comprehensive, addressing conflicts of interest, illegal or other improper payments and anti-competitive guidelines?

• Are codes periodically acknowledged by all employees?

• Are codes enforceable and supported by regulation?

Do employees understand what behavior is acceptable or unacceptable, and know what to do if they encounter improper behavior?

Does an independent oversight mechanism exist to hold management accountable for enforcing integrity and ethical behavior?

Are there adequate policies and procedures (i.e. sufficiently detailed financial regulations and rules, implementation guidelines, etc.) governing the control of activities to ensure the correct application of internal rules and an effective fulfillment of objectives?

• Codes are enforceable and supported by regulation

• Independent oversight mechanisms exist to hold management accountable for enforcing integrity and ethical behavior.

1.2 Management Commitment to Integrity and Ethics

Does management culture emphasize the importance of integrity and…