Questions/Answers

CGDF had participated, in November 2015, of an IA-CM training offered by the World Bank (Brasília, Brazil). So, IA-CM was oficially adopted by CGDF. Sponsorship of senior management and CGDF's risk management project contributed to the achievement of capacity level 2. The World Bank issued a preliminary report, in September 2016, and CGDF´s capacity was at level 1 and did not have internal audit work, there were oly inspections work. It was then necessary to deal with professional and cultural changes at CGDF. A coordinator for the project was necessary, and IA-CM was included in the CGDF Strategic Plan with indicators and targets established. The work plans were elaborated for each level of the model. To deal with the lack of financial resources, a multidisciplinary team was created to support the coordination of the project and to the monitoring of the action plan execution for level 2; still the identification of auditors profile to do inspections works and internal audit works was essential . Also a lot of meetings, workshops and training classes have been realized to disseminate these practices internally and externally; a code of ethics for internal auditors, a communication plan and a business plan and a quality assessment program. In May / 2017, the World Bank recognized CGDF capacity as level 2. Results obtained: higher credibility in public sector, better attendance to internal audit recommendations; leader in the IA-CM project in Brazil; harmonization with public administration since the work has been recognized as more effective and understandable. Team integration provided a better organizational climate. CGDF has more management information for decisions. Guidelines for moving forward are cleared and defined. The level 3 action plan is being implemented and CGDF is interacting with other countries, doing a cost and risk project analysis and developing capacity to seek funding sources either in Federal District, Brazil and internacional organizations.

One of the objectives of the adoption of the Internal Audit Capability Model - IA-CM is to make CGDF deliver a better internal audit work to all the steakholders that are in charge of the organizations of the Federal District in Brasília, Brazil.The overall objectives are registered in the CGDF strategic plan 2016-2019 and it includes the advance in capacity level of the IA-CM to reach level 4. IA-CM has been seen as an universal framework that identifies the fundamentals needed for effective internal auditing. This level 4 of maturity means that the internal audit and the key stakeholders’ expectations are in alignment; performance metrics are in place to measure and monitor Internal Audit processes and results; Internal Audit is recognized as delivering significant contributions to the organization; Internal Audit functions as an integral part of the organization’s governance and risk management and Internal Audt is a well-managed business unit. Also risks are measured and managed quantitatively and requisite skills and competencies are in place with a capacity for renewal and knowledge sharing (within internal audit and across the organization).

The Internal Audit Capability Model is a framework that identifies the fundamentals needed for effective internal auditing in the public sector. In Brazil, it hasn´s still been officially addopted and included in the strategic plans to be developed and reach the maturity level 4. So it´s an innovative structure for the public sector in Brazil. This framework promotes people management and includes processes to identify and attract people with the necessary competencies and relevant skills to carry out the work of the internal audit activity. Also it requires that internal auditors continuously maintain and enhance their professional capabilities. The model aims for the building and the improvement of the internal control systems and also the mechanisms that enable the country, the state or the Federal District to advance economically and socially, bringing public sector close to the citizens. When the internal audit delivers significant contributions to the organization, the ones in charge of the organization reach its objectives delivering better public services. And that´s the case that happens in Federal District, since CGDF has adopted the IA-CM. CGDF has been working and developing advisory services that had really added value to the audited organizations.

The model includes the key process area named "value-for-money/performance audit", which means that the internal auditors must assess and report on the efficiency, effectiveness, and economy of operations, activities, or programs; or conduct engagements on governance, risk management, and control. Performance/value for money auditing covers the full spectrum of operating and business processes, the associated management controls and the results achieved. Also, IA-CM includes advisory services, these are directed toward facilitation rather than assurance and include training, systems development reviews, performance and control self-assessment, counseling, and advice. Internal auditors work more closely than ever with their customers. By doing so, they are more insightful in their recommendations and help the organization better achieve its objectives in a way that they deliver better public services. As a valuable resource who provides insight into internal processes and operations, the internal auditor continues to provide value in analyzing organizational operations. This means today’s internal audit professional can vastly impact the efficiency and effectiveness of operations throughout the organization.

Until 2015, there were not clear guidelines at CGDF to the strengthening of the internal control system and not even the concern for the achievement of results. The Internal Audit Capability Model (IA-CM), includes the professional practices of the Institute of Internal Auditors. So, Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization's operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes. Since the adoption of the IA-CM, internal audit works have been more effective, with a closer approach to management, in a way that internal audit would protect the value of public organizations by helping managers to achieve their objectives. CGDF also began to provide consultancy and training for managers. Concurrent and preventive action has become a priority to avoid the occurrence of losses. For this reason, the IA-CM model, besides bringing several challenges to CGDF's internal audit professionals, has brought the position of the internal auditor as a true agent of governance that conveys trust and credibility.

Since the adoption of the IA-CM, internal audit works have been more effective, with a closer approach to management, in a way that internal audit would protect the value of public organizations by helping managers to achieve their objectives. These public administrators were able to benefit from CGDF's consultancy work, since based on these works they were able to carry out contractual renegotiations, map management risks, map processes, identify improvement points, carry out internal restructurings; actions that had repercussions on procedural and financial economies. In addition, training has been performed for the employees of public sector of the Federal District to help them understand, identify risks and manage risks and processes.

The Internal Audit Capability Model - IA-CM is a framework that identifies the fundamentals needed for effective internal auditing in the public sector. In Brazil, it hasn´s still been officially addopted and included in the strategic plans to be developed and reach the maturity level 4. So it´s an innovative structure for the public sector in Brazil. Also, no internal control public body in Brazil had the level 2 capability of this IA-CM model recognized by the World Bank and the National Internal Control Council. The initiative is also considered innovative due to the adoption in a Brazilian public organization of all the concepts defined by the model mainly with regard to the definition of internal audit and inspection that were adopted in a well segregated way by the CGDF. In addition, the official adoption of the model is a project included in CGDF's institutional strategic planning and is monitored by CGDF's strategic planning advisory.

It´s an innovation to addopt it officially in Brazil. CGDF decided to addopt this capability model because it was developed to be used globally as a basis for implementing and institutionalizing effective internal auditing in the public sector. The model was reviewed and confirmed by focus groups and workshops from over 50 internal audit professionals from over 20 countries. Some countries addopted it officially. In CGDF the model is being used as original. Some customization are necessary to put the model in place due to the specific particularities of the countries.

An exclusive coordinator for the project and a multidisciplinary team with the ability to deal with all the other departmnents of the organization; financial resources for learning events about the complex subjects that are required by the model; human resources for internal audit and to develop computerized systems; certifications for auditors.

Yes

The Government of Indonesia (GoI) is committed to improving internal audit capabilities in the public sector. Recognizing the value of the IA-CM, in 2010, the Badan Pengawasan Keuangan dan Pembangunan (BPKP, the GoI’s internal audit institution) used the IA-CM to carry out an assessment survey of the strengths and weaknesses of all GoI’s Inspectorates General (IGs). This was one of several initiatives that BPKP has undertaken and is undertaking to encourage IGs to upgrade their skills, capacity and capability. This is further to Presidential Instruction no. 4/2011 to support and ensure that IGs play a significant forward role in governance and oversight. The IIA Netherlands used the IA-CM as a starting point and developed an Internal Audit Ambition Model (IAAM), which was published in June 2016. This adaptation is based on the IA-CM. But a Dutch application of the IA-CM was needed to align it with the current state of internal auditing in the Netherlands. Northern Health, British Columbia, Canada has also applied the IA-CM and since 2010, the IA activity at Northern Health has facilitated the performance of its Quality Assurance and Improvement Program, through a periodic Quality Assurance Review (QAR), further to Standard 1311–Internal Assessments.

IA-CM was developed to be used globally as a basis for implementing and institutionalizing effective internal auditing in the public sector. The model was reviewed and confirmed by focus groups and workshops from over 50 internal audit professionals from over 20 countries. It illustrates the levels and stages through which an Internal audit activity can evolve as it defines, implements, measures, controls, and improves its processes and practices. It describes an evolutionary path for public sector organizations to follow in developing effective internal auditing to meet the organization’s needs and professional expectations. The IA-CM is intended as a universal model with comparability around principles, practices, and processes that can be applied globally to improve the effectiveness of internal auditing. In line with the principle-based nature of internal auditing, this model is not intended to be prescriptive in terms of how a process should be carried out. More important is its use in assessing whether the Internal Audit activity is established to realize its desired capability level.

It´s important to mention that the adoption of the model requires certain prerequisites in the environment, such as maturing governance structures and financial management, control, and accountability frameworks, along with government stability, a receptive organizational culture, and central drivers for internal auditing. Upward movement through the levels is dependent upon three variables—the capacity of the IA activity, the organization, and the overall public sector environment within which the organization operates. Specifically, to move from Level 1 to Level 2, certain prerequisites must exist in the environment and the organization to support the establishment of an IA activity: Government commitment to the importance of internal auditing; Legislation or government policy assuring the organizational independence of the IA activity and the personal objectivity of the internal auditors; Government culture supporting transparency, openness, and accountability for results; Strong financial management and control systems—such that there is an appropriate internal control framework within which internal audit can contribute.Mature corporate governance and risk management processes—where the benefits of oversight are recognized; History and tradition of external auditing—such that the concept of auditing is understood and the relationship between external and internal auditing can be appreciated.

Yes

The initiative has been evaluated by CGDF's strategic planning advisory. The CGDF strategic plan 2016-2019 includes strategic objectives. And for the perspective of Client and Society there is objective number 1. Intensify control actions with a view to improve the effectiveness of public management. It aims to ensure the performance oriented towards greater effectiveness in public sector through preventive and continuous audits, aligned with internationally recognized technical benchmarks as good practices. This objective has 3 indicators that are used to evaluate it. Also there is the objective number 4 Encourage the improvement of internal controls and the induction of public administration risk management. It aims to ensure greater speed and rationality of control processes, optimize the use of resources, induce monitoring and risk management, increase the reach of results and collaborate in the adoption of more effective mechanisms for the improvement and strengthening of the system of control. This objective has 5 indicators that are most related to a key process area of the model.

The outcomes of the project are: clear guidelines for the performance of the technical staff in the internal audit works; compatibility of actions with the guidelines; achievement of objectives established in strategic planning; greater effectiveness of the work; recognition of quality jobs by the public sector managers of the Federal District; more credibility for the audit work of CGDF; CGDF became reference as a level 2 capacity for the World Bank and other control bodies of hte national council of internal control of Brazil; CGDF has been demanding for dissemination of good internal audit practices in other states throughout the country as an internal audit activity, greater rapprochement with the public sector management. Internal audit with maturity level 2 is able to establish and maintain repeatability of processes and Internal Audit practices and procedures are sustainable and repeatable. Internal Audit reporting relationships, management and administrative infrastructures, and professional practices and processes are being established (Internal Audit guidance, processes, and procedures); Audit planning is based principally on management priorities; there is partial compliance with the Standards. The objective is to reach of what difference it transpired and the value that internal audit added to the organization and its stakeholders.

The first strategic objective has 3 indicators: 1) level of classification of the CGDF in the IA-CM. It measures the CGDF classification level in the model. The goal is to achieve classification level 4 until December, 2019; 2) percentage of satisfactory attendance for the internal audit recommendations resulting of critical audit issues - It measures the percentage of effective implementation of the audit recommendations that are being monitored by CGDF. The goal is to achieve the effective implementation of 45% of audit recommendations resulting of critical audit issues by December, 2019. 3) the percentage of avoidable losses /savings from audit recommendations of critical audit issues. It measures the total resources materialized as avoidable loss / savings in relation of the total resources classified as avoidable loss / savings in the recommendations of critical audit issues identified by CGDF. The goal is to achieve up to 45% of avoidable losses / savings resulting from recommendations arising from serious auditing failures until December 2019.

The Brazilian National Council of Internal Control (CONACI) and The World Bank in Brasília, Brazil were the main actors engaged in this iniciative. CGDF had the chance to participate, in November 2015, of a training program that was established to train auditors on using the IA-CM as a self-assessment tool offered by the World Bank in Brasilia Office. This was decisive to have the official adoption of IA-CM at CGDF. Since this, a great technical partnership between these actors has started. After this CGDF performed a self-assessment, which was validated by a peer review. So, the financial specialist of the World Bank issued a prelimiary report that identified the actions, activities, and components necessary to strenghten the internal control system in The Federal District. Further to its capacity building efforts, in March 2016, the World Bank organized a Brazil – Croatia and Bulgaria Knowledge Exchange Visit with financial support of Nacional Internal Control Council -CONACI. Twelve Brazilian government officials participated and were hosted by government teams in Croatia and Bulgaria. Through this knowledge exchange, participants increased their understanding of the reform implementation issues faced in Croatia and Bulgaria and the strategies used to overcome those challenges, and had a better appreciation of the reforms/changes required, in order to improve the internal control system and internal audit function in the Brazil public sector. This partnership continues with a lot of technical support.and also some financial support to realize internal control seminars that were held in the states of some of the members of the CONACI, and a videoconference held at the World Bank in Brasilia office with the representatives of CGDF and the Republic of Indonesia.

Most of the Key Processes Area - KPA´s of level 2 relate primarily to the management and practices of the internal audit activity itself. It means that the internal audit activity has the opportunity to independently create and institucionalize these KPA’s of level 2 and others of level 3. The internal auditors have expertise and qualification enough to provide appropriate development and institutionalize most of the KPA’s. The work plans were elaborated and revised by level of the model, with the detail of products to be delivered to fulfill the macroprocesses. Due to the quantity and complexity of the KPA´s, it was necessary to set up a multidisciplinary team to support the coordination of the project. The main actions that contributed for this were: operationalization of the action plan by the level of capacity; the segregation of the auditors that could carry out inspections works and the ones to carry out internal audit works; a lot of communication meetings, workshops and training classes have been realized to disseminate these good practices internally and externally, a code of ethics for internal auditors was put in place, a communication plan, a business plan and CGDF budget were elaborated, as well as a quality assessment program was created.