Interaction between the External Auditor

and Internal Auditors: The Canadian Experience

David Rattray, Senior Associate, Parliamentary Centre, Canada

Presentation to a Roundtable on State Financial Control

Hosted by the Russian Federation Council within the framework of the IX
St. Petersburg International Economic Forum

Moscow, Russia, June 2005

Introduction

Thank you for those kind words of introduction. And thank you for inviting me to
talk to you today about the relations between the functions of the Office of the
Auditor General of Canada and those of internal audit.

Let me first say that “audit is audit”. It doesn’t matter whether it is done by
external auditors or by internal auditors. The same kind of professionalism is
required.

The policies regarding the conduct and examination of the audit should be the
same. These include among others:

ƒ exercising due care

ƒ demonstrating professional competency
ƒ having an audit team that is objective and independent of the program or
activity being audited.
ƒ Having clear audit objectives that can be concluded against; and
ƒ Having sufficient and appropriate evidence to support observations and
conclusions.

So let us put behind us that internal audit is something different from external
audit. The quality and the methodology should not be.

One point of clarification I feel I need to make at this point in my remarks is to

define what we mean in Canada by external versus internal audit. My experience
here in Russia over the past three years is that we have similar yet in some
instances very different set of definitions we each operate under.
By external audit I mean a body of auditors clearly outside or external to a
reporting entity. To understand this we must first define the reporting entity. In the
Canadian private sector this reporting entity would be a legally constituted
corporation, with an external auditor appointed by the shareholders to conduct
work and report back to the shareholders on how well management is managing
the corporation. Quite straight forward and fairly universal in its application.

The external auditor concept and reporting entity is carried over to the public
sector in the Westminster model. The Legislative Branch of elected officials ( or
shareholders ) engage their auditor or an SAI in this case, to conduct an audit
and report back to them via report tablings in the Legislature how well the
Executive, or management is operating the government.

We in Canada look at the collectivity of government ministries and its agencies,

boards and commissions as a single, large reporting entity. All these entities are
internal to the government as a whole. Most of the entities, certainly all the large
ministries, each have their own internal audit organizations. They can range from

Page 2
Prepared under the Accountability Strengthening Program: a project funded by the
Canadian International Development Agency
half a dozen persons to over 100 staff members. All of these organizations are
what I will be referring to as internal audit today. I trust this helps in clarifying my
remarks which follow. I would also welcome any questions of further clarification
at the conclusion of my remarks.

What I will now talk about are three things:

First, the role of the Auditor General of Canada in the Canadian budget process;

Second, the respective roles of the Auditor General of Canada and those of the
internal audit function in the government of Canada.

Third, a discussion about what constitutes an effective internal audit function.

Role of the Auditor General of Canada in the Budget Process

I would like to cover two elements of budget making – the preparation and audit
of the summary numbers and of the detailed departmental information.

The Summary numbers

In Canada when we speak about the budget process, we include all the elements
that make up the financial cycle.

This runs from the planning of annual spending and revenues for the coming
year through to the reporting of the financial results and related financial position.

The Auditor General’s formal duties come only at the end of the whole process –
after the accounts for the past year have been prepared describing the financial
activity for the past year.

That is when the Auditor General conducts her audit and gives an opinion on the
fairness of the reporting of the summary financial statements of the government
of Canada.

But the Auditor General does a lot more.

With regard to the accounting policies for the government, which form the basis
for preparing the numbers, they have made a number of comments over the
years.

Page 3
Prepared under the Accountability Strengthening Program: a project funded by the
Canadian International Development Agency
Specifically, they have encouraged the adoption of more appropriate accounting
policies befitting a government of the size and complexity as the government of
Canada.

In addition to major changes in accounting policies, the audit office has

developed over the years a good working arrangement with the government of
Canada regarding the use of accounting policies.

There have been many instances where the government is considering whether
to go ahead with an economic event that involves the receipt of revenues or the
spending of money.

In doing so, there may be options for the accounting of such transactions that
can have an influence on the decision to proceed.

By consulting with the Auditor General, to get her Office’s views on what she
would consider appropriate accounting, the audit office reduces the chance of
disagreement that might otherwise arise during the audit.

In addition to accounting issues, the government has also consulted the Auditor
General regarding the amendment of laws that relate to the financial
management as well as ways to make the disclosure of summary financial
information more understandable and useful.

Please understand that that this kind of consultation only works if the government
knows that the auditor is truly objective, independent, and above reproach.
Because at the end of the day, it is consultation only – the government does not
have to take the Auditor General’s advice and she has the right to change her
mind if, after auditing the information, needs to draw a different conclusion.

The Departmental information

At the departmental or ministry level in Canada, each entity prepares and
publishes an annual Report on its plans and priorities for the coming year.

Eighteen months later, it produces a performance Report indicating how it did

against its plans and priorities.

This kind of disclosure is very important because it not only specifies clearly what
heads of entities plan to spend, but how they expect to be held accountable for
the resources entrusted to them.

This means going beyond reporting on the use of inputs – how many dollars you
were authorized to spend or how many people you employed.

Page 4
Prepared under the Accountability Strengthening Program: a project funded by the
Canadian International Development Agency
It also means going beyond outputs like the number of meetings that were held;
the Auditor General expects heads of entities to start explaining results – how
they made a difference to Canadian citizens.

For example, if the audit office were auditing health, it would expect the entity
deputy head to be able to talk about the health of Canadians - Was their health
better? And if they can’t say that, what milestones have been achieved that
would suggest that health will be better - Are there more hospital beds in place;
are there more doctors and nurses readily available?

We also expect that the deputy head will provide a statement of assurance that
all the financial information in the performance report is both fair and reliable.

Periodically the Auditor General will conduct audits on the quality of the
performance information contained in the reports. They will on occasion,
examine and make recommendations on the clarity and usefulness of the reports
themselves. They do this because they believe that good accountability begins
with good reporting.

This kind of audit work, is reported to their “master” the parliament of Canada.
This is where external audit parts company with internal audit. While the
methodology for audit may be the same, the two categories of auditors have
different masters – The Auditor General reports to Parliament while internal audit
reports to the entity deputy head.

Before I move to the 2nd part of my presentation, I would like to talk briefly about
internal audit and how and why it came about.

Brief History of Internal Audit

Internal audit is a relatively new idea. In the beginning of the 20th century in the
private sector, the proliferation of large, dispersed, and complex corporations,
spurred on the need for an internal audit function.

In the public sector, at least in Canada, beginning in the late 1940’s, government
organizations began to take on the same form and complexity as private sector
companies.

Along with that, the capacity of elected Ministers to be able to oversee and be
accountable for the administration of their ministries became increasingly difficult.
Consequently, deputy heads took on a greater responsibility for the smooth
running of their organizations.

Page 5
Prepared under the Accountability Strengthening Program: a project funded by the
Canadian International Development Agency
In 1966, the government of Canada created an internal audit function to be part
of the internal management of ministries. It argued that as control becomes
more decentralized, departmental heads and the executive branch needs audits
designed specifically to inform them whether resources were being used “legally
and effectively”.

The new government policy went on to say that the audit function "has an
important place in all departments to review and appraise the soundness,
adequacy and application of all accounting, financial and operating controls".

Auditor General versus Internal Audit

But why an internal audit function and not rely solely on the Auditor General of
Canada?

There are lots of reasons, but four stand out;

One – The Auditor General is independent of management and reports to

parliament directly.

The Auditor General does not need approval or acceptance from those they
audit. Their “master” is parliament and its members, who are the
representatives of the Canadian people – the real shareholders.

And that leads me to my 2nd point

Two – Like Parliament, management has the right and the need to know what is
working and not working so that they make corrections as they go.

Government ministries, like many corporations are large, complex and very
widely dispersed. No deputy head can know first hand every aspect of the
running of the business.

Of course, deputy heads have executive committees, but they also need to have
an internal audit function that reports directly to them on the workings of the
organization.

This should not be seen as a kind of policing exercise, but rather as a positive
way of proving assurance within the ministry that everything is working in the
best interests of the citizens. And the deputy head should know what’s going on
while there is still time to make corrections before problems get out of hand.

And that leads to the 3rd point.

Page 6
Prepared under the Accountability Strengthening Program: a project funded by the
Canadian International Development Agency
Three - The Auditor General of Canada comes in usually after the fact, not while
activities are ongoing. That is the way it works in the financial audit and the way it
normally works in performance audits.

This is the way the Auditor General believes it has to be. If they come in while
an activity is ongoing and offer advice, they weaken and jeopardize their capacity
to remain independent. That is, they cannot audit in an objective and
independent way, something they may have helped develop themselves. And
independence and objectivity are key to a successful legislative audit function.

The internal audit function, on the other hand, often operates while activities are
ongoing.

There is a strong requirement for both the external auditor, the Auditor General in
this case, and ministry internal auditors to co-ordinate their audit plans in order to
avoid inefficiencies and to maximize opportunities for reliance on each others
work.

What constitutes a good internal audit function

In 1976, the Auditor General conducted an audit on the financial management

and control practices in the federal government, and the Office reported that
internal audit, where established, was largely ineffective.

In response to these and many other challenges, the government created a

special group, the Financial Administration Branch within the Treasury Board
Secretariat to strengthen financial administration, including internal audit.

In 1996, the Office conducted another audit of the internal control mechanisms in
place for the federal government.

They concluded there was a great deal of variability in the effectiveness of

internal audit in government departments and agencies and proposed a number
of things the federal government could do to bring about more effective internal
audit.

In November 2004 the Auditor General once again examined internal audit in the
federal government. Her Office assessed the extent to which internal audit
groups in six federal organizations had met professional standards and complied
with the then Treasury Board Policy on Internal Audit. The Audit Office found that
it varied considerably across these organizations.

In two organizations (Public Works and Government Services Canada and

the Royal Canadian Mounted Police), the internal audit group generally

Page 7
Prepared under the Accountability Strengthening Program: a project funded by the
Canadian International Development Agency
 met the International Standards for the Professional Practice of Internal
Auditing.
Three departments partially met the standards (Foreign Affairs and
International Trade, Human Resources Development Canada, and Natural
Resources Canada).
One agency did not meet many of the standards (Canadian International
Development Agency).

The audit report identified a number of important factors that, if implemented,

could have a positive influence on the quality of internal audit across
government:

a consistent understanding on the part of senior management of the role

that internal audit can and should play;
a departmental audit committee with external members who are
independent of management;
a clear human resource strategy at the department, central agency, and
government level that sets out the qualifications and appropriate number
of staff for the internal audit community;
a focus on assurance services; and
a strategy to ensure appropriate internal audit coverage and capacity in
small entities.

But even with interested and willing deputy heads, these senior officials needed
support from the centre government. To this end in 2003, the government
created a Centre of Excellence for Internal Audit at the Treasury Board, which is
a Cabinet Committee of senior elected officials. This Centre was created to
support the internal audit community in a number of ways including policy
guidance, methodology development, and help in recruiting internal auditors.

A Comptroller General of Canada position was created in 2004 with primary

responsibility for strengthening internal audit and financial management. There is
a new internal audit policy as of this month that will drive several initiatives to
strengthen internal audit. One of the main policy initiatives is that all internal audit
organizations in government will have to comply with international internal audit
standards of the Institute of Internal Auditors by January, 2007. There is currently
a great deal of effort being expended on modernizing and capacity building of the
internal audit function.

Conclusion

Page 8
Prepared under the Accountability Strengthening Program: a project funded by the
Canadian International Development Agency
In conclusion, let me repeat what I started with – audit is audit. The issue of
external versus internal audit has nothing to do with methodology; it has
everything to do with different roles.

The external auditor gives assurance to the shareholders – the owners of the
organization – that the managers are managing in the best interests of the
owners.

And the internal auditors give assurance to senior management that they can rely
on the management controls that are in place and that the risks are being
managed as they relate to financial control, regularity and performance.

But both serve good accountability.

The need for an independent and credible legislative auditor arose with the birth
and development of democratic parliamentary institutions. Elected officials
needed someone who could provide them with credible financial and
performance information to help them hold the unelected officials to account.

And the need for an internal audit function grew out of the development and
growth of large complex and dispersed government organizations.

Both functions come together under the rubric of accountability – accountability

of unelected officials to legislators for the responsibilities entrusted to them. And
accountability of elected officials to those that elected them.

I do hope that my remarks have been of interest to you and relevant to your
proceedings today.

If there is time, I would be very pleased to answer any questions that you may
have.

Thank you very much.

Page 9
Prepared under the Accountability Strengthening Program: a project funded by the
Canadian International Development Agency