tanzania2009_kishimba

7/25/2019 Tanzania2009_Kishimba

1/22

CCAF-FCVI Fellow

2009/2010

Strategic Paper by

Levina Rusk Kishimba

A Risk-based Approach toPerformance Auditing

TANZANIA CANADA


2/22


3/22

iii

Table of Contents

Page

Acknowledgements v

Executive Summary vii

Introduction 1

Background 1

Objective 1

A Risk-based Approach to Performance Auditing 2

Context 2

Problems to be addressed 2

Rationale for using one-pass planning in the office 2

Challenges ahead 3

Description of the Strategy 4

Phase 1Create awareness and share knowledge 4Phase 2Train performance auditors 4

Phase 3Develop OPP approach 4Phase 4Learn by doing 5

Proposed Approach 5

Phase 1Briefing sessions with management and staff 5

Phase 2In-house training 5Phase 3Workshops 6

Phase 4Pilot project for the selected entity 6

Evaluation of the Strategy and Next Steps 6

Conclusion 7

Appendix AProject Implementation Schedule 9

Appendix BSteps to Preparing a One-Pass Plan 11

Bibliography 14


4/22


5/22

v

Acknowledgements

Praise is to the Lord God who always guides my every step and keeps me in the centre

of his will.

This strategy paper is the result of a nine-month International Fellowship ProgramI attended in Canada from August 2009 to May 2010. The fellowship was awarded bythe Canadian Comprehensive Auditing Foundation (CCAF) with funding provided bythe Canadian International Development Agency (CIDA).

Special thanks and appreciation to CCAF; CIDA; the Auditor General of Canada,Ms. Sheila Fraser; and the staff of the Office of the Auditor General of Canada(OAG Canada) for organizing and running the program.

I would also like to express my gratitude to OAG Canadas Canada Revenue Agency

Performance Audit Team (Group 7, Team 8), the people who ran the Offices trainingprogram, and International Relations staff for the support they gave me in developingmy strategy paper and gaining a lot of knowledge in performance auditing.

My participation in this fellowship program would not have been possible without thevision of the Controller and Auditor General of the United Republic of Tanzania,Mr. Ludovick Utouh, in improving the knowledge and skills of his staff.

I sincerely thank my mentor, Mr. Ronald Bergin, Principal of Strategic Planning atOAG Canada, for sharing his time and insight throughout the development of mystrategy paper.

I am very grateful to my darling husband, Timothy, who was always there to supportand encourage me during my stay in Canada.

Many thanks also to all 20092010 CCAF International Fellows for their friendship.It was nice spending time with them.

Finally, I wish to extend my deep and lasting appreciation to all who, in one way oranother, helped me throughout the fellowship program.

Levina Rusk Kishimba

May 2010


6/22


7/22

vii

Executive Summary

This strategy paper proposes how the National Audit Office of Tanzania (NAOT) willadapt and implement the Office of the Auditor General of Canadas one-pass planning

approach to selecting performance audits. One-pass planning(OPP) is a risk-basedaudit planning approach which focuses on how well an entity is managing its major risksrather than on areas of suspected weakness.

Preparing one-pass plans for performance audits will provide assurance to Parliamentand other stakeholders that NAOT is following a systematic and independent, risk-basedand objective approach to selecting the areas for audit. This will demonstrate that it isefficiently using the available resources. In addition, this approach will ensure that anyentity deemed to be significant has a current, multi-year plan based on a high level ofrisk analysis.

This approach will be implemented incrementally. It will begin with a briefing for

management and staff, followed by training for an initial core of staff on preparing andapplying an OPP approach to audit selection. Current audit structures will be adopted tosuit the OPP process, and then a pilot survey will be carried out. The new approach willbe monitored, evaluated, and adjusted throughout the implementation process.


8/22


9/22

Introduction

Background

1. In the past, long-term entity planning in the Office of the Auditor General ofCanada (OAG Canada) focussed on determining the value-for-money audit priorities.Planning was carried out from the perspective of making a difference for Canadians byidentifying areas that likely needed improvement. As a result of a project entitledAdvancing Audit Practices, approved in June 2001, OAG Canada implemented a moresystematic, integrated, and risk-based approach to long-range entity planning, referredto as one-pass planning (OPP).

2. The term one-passsignifies that the knowledge of both performance andfinancial auditors is brought together in one analysisat the beginning of the process tohelp document the auditors understanding of the risks that a particular entity is facing

and how well it manages those risks. Near the end of the process, the auditors againconsider a combined analysis to determine to what extent they will use financial auditsand performance audits to address the issues they wish to audit.

3. The National Audit Office of Tanzania (NAOT) has not yet established a strategicplanning process to ensure that only relevant matters involving significant risks areselected for performance audits. Resources allocated for performance audits are alwayslimited, which makes selecting entities or areas to be audited a key issue. Putting intoplace a process which allows the preparation of one-pass plans for the audit entitieswould enable the Office to focus its limited resources on areas of greatest risk.

Objective

4. This strategy paper proposes the integration of a risk-based approach toselecting potential performance auditsin the office of the Controller and AuditorGeneral (CAG) of the United Republic of Tanzania, namely, one-pass planning (OPP).OPP will assist with the selection of audits based on significance and business risks (i.e.risks to the achievement of the entity's objectives). It will use resources more effectivelyand reduce the time and cost of conducting an audit. This will therefore help NAOTimprove efficiency in the planning phase of its performance audits.

5. The main objective of this paper is to provide a strategy which will enable NAOTto implement an OPP approach as a tool for selecting performance audit topics and tointegrate the preparation of one-pass plans into the strategic planning process of the

office by July 2012.

1


10/22

A Risk-based Approach to Performance Auditing

Context

Problems to be addressed

6. The National Audit Office of Tanzania (NAOT) does not have a formal way toselect its performance audits. The audits are selected based on complaints from thepublic and problems identified by the media. There are various risks associated with thisapproach, including:

choosing topics that are sensational but not fundamental to a governmentdepartments mandate;

choosing topics that are sometimes hard to audit, for example, due to a lack ofbackground, difficulty determining scope, or risk of missing important areas; and

risking the Offices credibility by picking irrelevant topics for political reasons (notbeing independent of the political process of the day).

7. Other problems include limited resources allocated for performance audits and alack of cooperation from auditees.

Rationale for using one-pass planning in the office

8. A risk-based approach offers what may be the best way for NAOT todemonstrate independence and objectivity in addressing the problem of deciding whatareas, entities, or themes should be chosen for performance audit.

9. As used by the Office of the Auditor General of Canada (OAG Canada), the one-pass planning (OPP) approach emphasizes that planning at the entity level shouldaddress all mandate areasof OAG Canada simultaneously. It applies to audit planningfor programs and functional areas within and across federal departments and agencies.By focusing on areas of greatest risk to entities, OAG Canada is moving toward anassurance-based perspective. This reinforces its goal of addressing the areas ofgreatest significance to entities and the expectation that its audits can result in a positiveopinion about the management systems and practices it examines. Applied to NAOT,this approach could also improve its relationships with auditees.

10. Further, since adopting OPP, OAG Canada is in a better position to assureParliament that audit efforts have been devoted to areas of highest importance, and that

OAG Canada is achieving an appropriate balance of effort with the limited resourcesavailable for the audit. It is in a better position to respond when questions are askedabout why it did or did not audit certain areas. Similarly, adopting an OPP approach forthe audit entities would enable NAOT to focus its limited resources only on areas ofgreatest risks.

2


11/22

Challenges ahead

11. Performance Audit is a small division of NAOT, with only 11 auditors. Success inimplementing the approach will involve some challenges that can be overcome indifferent ways by the implementation committee. The committee will includeperformance auditors, the selected financial auditors, Development Plans Unit officials,

the Controller and Auditor General and the Assistant Auditor General, Value for Money.Its worth noting that the success of the whole process is highly dependent on thesupport and involvement of NAOT management. The following sections describeexpected challenges.

12. Performance auditors are not familiar with risk-based approaches toperformance auditing.Identifying and assessing risks areactivities central to OPP.None of the performance auditors at NAOT has technical expertise, experience, ortraining on using risk-based approaches to selecting matters for performance auditing.Making such a fundamental change will be a challenge, and therefore someperformance auditors may be reluctant to adopt this new approach. This challenge canbe addressed byexplaining the benefits of using OPP and training the auditors on how

to prepare and use the approach.

13. Ministries, departments, and agencies (MDAs) as well as local governmentauthorities do not identify and assess risks that would prevent them from delivering theirprograms. OAG Canada uses the auditees own identification of risks as a check in itsOPP approach. In Tanzania, MDAs do not identify and assess their risks. To addressthis challenge, the NAOT performance auditors, with the assistance of MDA officials, willidentify and assess the entities risks.

14. Relations between auditees and NAOT performance auditors are strainedand currently not conducive to good collaboration.Sharing information and acollaborative spirit are very important to the success of a one-pass plan. Lack of

cooperation has been identified as an issue and is being addressed by another Fellowfrom NAOT. Both projects are running at the same time, which could have representedeither another challenge or an advantage. In this case, the Fellow who will beimplementing his strategy paper Developing an Auditees Guide to the PerformanceAudit Process, will be helpful because his paper will help inform the selected pilotproject entity about what NAOT will be doing before the pilot project begins.

15. The NAOT does not have expertise yet to train its performance auditors toconduct OPP.The key players at OAG Canada who use OPP are the principals anddirectors of audit teams, the Strategic Planning and Professional Practices group, andthe consultants. To address NAOTs lack of expertise, I will transfer the knowledge Ihave gained from OAG Canada effectively to all performance auditors. Further, an OPP

Team will conduct a pilot study as a training project. In addition, consultations andadvice will be applied whenever required.

3


12/22

16. OPP takes time and resources.OAG Canada uses between 500 and 600 hoursto prepare a one-pass plan for a single department. In addition, it has a total of103 performance auditors. The NAOT performance auditors represent a tiny portion ofthe office operations (11 performance auditors out of around 600 employees), whichcould prompt some there to wonder why the auditors should get the money required toput the OPP approach into place. Also, OPP does not produce visible results in the short

term, a condition which usually makes it harder to get funds and resources in light ofcompeting priorities.

17. Nevertheless, NAOT has accepted the implementation of the risk-basedapproach (OPP) in selecting its performance audit topics, and so funding will not be afundamental issue. Since the office has a limited number of performance auditors, theapproach will be adapted to suit our local conditions.

Description of the Strategy

18. The one-pass planning (OPP) approach will be implemented in four phases,

each including a number of supporting activities.

Phase 1Create awareness and share knowledge

1. Submit the strategy paper to the Controller and Auditor General (CAG) and theAssistant Auditor General, Value for Money (AAG-VFM) for review and approval.

2. Prepare agenda for the meetings to be conducted.

3. Select financial auditors for the implementation committee.

4. Hold briefings with management, all performance auditors, selected financialauditors, and Development Plans Unit officials, about the approach and the costinvolved(human resources, financial, and time).

Phase 2Train performance auditors

1. Prepare and review presentations and other material.

2. Deliver training to performance auditors on preparing an entitys one-pass plan.

Phase 3Develop OPP approach

1. Conduct workshops with the CAG, the AAG-VFM, and all performance auditorsto develop the OPP approach for the Office.

2. Form the team of at least three performance auditors (OPP Team) to prepare a

one-pass plan for a small entity to be determined.3. Develop the approach (the one-pass plan format to be used in the Office).

4. Submit the prepared approach to the CAG for approval.

4


13/22

Phase 4Learn by doing

1. Plan a pilot one-pass plan for the selected entity.

2. Prepare and conduct the one-pass plan for the entity.

3. Write the one-pass plan report.

4. Present the one-pass plan report to NAOT management.

5. Finalize the one-pass plan report and submit it to the CAG for approval.

6. Introduce results of the one-pass plan to NAOT management and theimplementation committee.

7. Present the approved one-pass plan report to the management of the entity.

8. Prepare for the audit (select the risks to base it on).

9. Undertake a full performance audit for the selected entity based on the selectedrisks.

10. Integrate the OPP approach into the Offices strategic planning process.

Proposed Approach

19. Since its inception in 2005, the NAOT Value for Money Audit Division has beenworking hard to build capacity and achieve intended objectives through workablebudgets and action plans. To ensure that this strategy is smoothly implemented, theOPP Team will frequently consult with NAOT management and hold a number ofmeetings with them during the project planning stage.

Phase 1Briefing sessions with management and staff

20. I will hold a briefing with the CAG and AAG-VFM to discuss the strategy and itsobjectives. Then, they will review the implementation schedule and provide theirfeedback and approval. The AAG-VFM will select financial auditors to be involved duringthe briefing session and on the implementation committee. I will then review OPPdiscussion papers and other related material obtained from OAG Canada beforepreparing an agenda for the coming briefing session. The session will includemanagement and other staff and focus on OPP, its related concepts, and the rationalefor adopting and implementing OPP as a risk-based approach to selecting our audits.

Phase 2In-house training

21. I will refer to the knowledge Ive gained and reading material Ive obtained from

OAG Canada when preparing presentations on how to conduct OPP. I will review thepresentations before starting the in-house training with the auditors.

5


14/22

Phase 3Workshops

22. All performance auditors will be involved in developing the OPP approach to beused in the office. The CAG and the AAG-VFM will also participate in developing theapproach. Then, we will hold workshops to develop a simplified approach which will suitour local conditions. We will review and discuss the Integrated Risk Management

process and OAG Canadas OPP process to determine what will apply to developing aone-pass plan format for the office.

Phase 4Pilot project for the selected entity

23. The pilot one-pass plan will be used as a training project for learning how toconduct them. Further, it will be helpful in determining whether the developed approach(the adapted OPP process) works, and hence in identifying what adjustments need to bemade before integrating it into the Offices strategic planning process and putting it intopractice across NAOT.

24. The performance auditors selected to develop the Offices OPP approach (OPP

Team) will conduct a pilot one-pass plan using the agreed upon format. Once the pilotproject is complete, the team will hold a lessons learned session with management andother staff to identify what worked well and what could be improved. The team will thenwrite an OPP report and forward it to both NAOT management and the surveyed entity.Based on the results of the report, NAOT management and performance auditors candecide on a list of possible audits to be conducted for that particular entity over the nextthree years, as well as the timing for the audits.

25. Through this exercise, the implementation committee will become familiar withthe approach. The approach will then be introduced to other entities (at all levels of thegovernment) to reinforce the understanding of the government-wide audit issues and therole of all players.

Evaluation of the Strategy and Next Steps

26. The successful implementation of this strategy will be measured by

the completion of a one-pass plan for the selected entity as a pilot project byJuly 2011;

the integration of OPP into the strategic planning process of the office byJuly 2012; and

the number of performance audits that will successfully be completed on timeand within budget as well as the quality of performance audit products of theoffice, effective July 2012.

27. This success will also depend on the support of other stakeholders inside andoutside NAOT. Therefore, the Office must ensure that all of its stakeholders are aware ofthis new approach to its performance audit work.

6


15/22

7

28. Further, efforts will be made to ensure that all activities in each phase of thestrategy are completed within two years (from July 2010 to July 2012).

29. The newly developed approach will then be monitored, evaluated, and adjustedon a periodic basis to ensure continuous learning and improve performance auditreporting.

Conclusion

30. The National Audit Office of the United Republic of Tanzania faces a complexchallenge in selecting its performance audit topics. This makes the Office inefficientduring the planning phase of an audit. The huge number of audit entities and the limitedresources available for performance audit work makes the task of choosing priority areasto audit very critical. The introduction of one-pass planning as a risk-based approach toselecting matters for audit will enable the office to make optimal use of its resources andprovide assurance to the parliamentarians, central and local governments, and the

public that the office is fulfilling its responsibilities.


16/22


17/22

Appendix AProject Implementation Schedule

Activity Time frame Key player(s)

Phase 1Create awareness and share knowledge

1. Submit the strategy paperto the CAG and AAG-VFM forreview and approval

June 2010

(3rd and 4th week)

Levina R. Kishimba

Vacation July 2010 Levina R. Kishimba

2. Prepare agenda formeetings

August 2010 Levina R. Kishimba

3. Select financial auditors forthe implementationcommittee

September 2010

(1st week)

The AAG-VFM

4. Hold briefings withmanagement, allperformance auditors,selected financial auditors,and Development Plans Unitofficials

September 2010

(2nd, 3rd and 4th week)

Levina R. Kishimba

Phase 2Train performance auditors

1. Prepare and reviewpresentations and othermaterial

October 2010 Levina R. Kishimba

2. Deliver training toperformance auditors onpreparing an entitys one-pass plan

October 2010 Levina R. Kishimba

Phase 3Develop OPP approach

1. Conduct workshops todevelop the OPP approachfor the office

November 2010

(1st to 3rd week)

The CAG, the AAG-VFM, andall performance auditors

2. Identify the entity and OPPteam

November 2010

(4th week)

The CAG and the AAG-VFM

3. Develop the one-pass plan December 2010

(1st and 2nd week)

All performance auditors, theCAG and the AAG-VFM

4. Submit the preparedapproach to the CAG forapproval

December 2010

(3rd week)

Levina R. Kishimba

9


18/22

10

Activity Time frame Key player(s)

Phase 4Learn by doing

1. Plan a pilot one-pass planfor the selected entity

January to April 2011 OPP Team

2. Prepare and conduct theone-pass plan for the entity

January to April 2011 OPP Team

3. Write the one-pass planreport

May 2011 OPP Team

4. Present the OPP report toNAOT management

June 2011

(1st week)

Levina R. Kishimba

5. Finalize the one-pass planreport and submit it to theCAG for approval

June 2011

(1st week)

Levina R. Kishimba

6. Introduce results of one-pass plan to NAOTmanagement andimplementation committee

June 2011

(2nd week)

Levina R. Kishimba

7. Present the approved one-pass plan report to themanagement of the entity

June 2011

(3rd week)

Levina R. Kishimba

8. Prepare for the audit(select the risks to base it on)

June 2011

(4th week)

OPP Team and otherperformance auditors

9. Undertake a fullperformance audit for theselected entity based on theselected risks

July 2011 to June 2012 OPP Team and otherperformance auditors

10. Integrate the OPPapproach into strategicplanning process of the office

July 2012 OPP Team


19/22

Appendix BSteps to Preparing a One-Pass Plan

The OAG Canada audit teams consistently follow a series of steps in analysing businessrisks that are critical to the entitys success and reporting the results of the analysis to

both the executive committee and the entity.

1. Conduct interviews and review documents

This step involves interviewing key officials of the entity and the officials who arecharged with its stewardship responsibilities to identify its objectives. Further, the auditteam interviews OAG Canada personnel with experience auditing the entity. The auditteam then reviews all key documents needed to assist in analysing the risks facing theentity.

2. Document knowledge of the entity

The second step in the OPP process involves documenting knowledge of the entity. Theaudit team records a description of the entitys objectives, responsibilities, and expectedresults. The team also prepares a summary of the following:

interviews completed,

the entitys enabling legislation,

its other key mandates and financial authorities,

its mission and objectives,

its strategies to achieve objectives, and

its plans for business and operational structure.

3. Prepare the entity risk profile

In conducting the risk analysis, the audit team uses a generic government risk modelto help identify the most significant internal and external risk factors believed to exist ingovernment. In using the model, attempts are made to capture the most common factors

liable to result in hazards or risks that will prevent the entity from achieving its mandatealong with risks to good governance and operations. Having identified the significantinternal and external risks, the audit team prepares an entity risk profile that includes:

a brief description of the risk and its impact on the entitys mandate, governance,and operations;

a brief description of how internal and external risks to the entity affect the entity;

11


20/22

an assessment of the impact of the risk, as well as its likelihood (categorized asHigh, Medium, or Low); and

a description of any previous audit work conducted by OAG Canada to addressthe risk identified.

4. Prepare the control profile

The audit team prepares an entity control profile to document the assessment andconsideration of the key controls within the entity. This profile helps to determinewhether the controls are adequate for addressing the risks identified in the entity riskprofile and for supporting the conclusion on the overall control environment. The entitycontrol profile has two main components:

Summary assessment of key controls:This provides an overview of the keycontrols that make up the overall control environment within the entity. Eachcontrol is assessed to determine its presence in a given area and its importance

in responding to the risk identified in the entity risk profile. The audit team mustalso document the strengths and weaknesses of each of the controls.

Consideration and assessment of key controls:A description of the keyfeatures of each control objective is documented, along with the strengths andweaknesses of the control objective and any factors that may mitigate theweaknesses identified.

5. Identify potential products and assign priorities

Potential audit products for the next three to five years are identified and assigned

priority using the following key procedures:

Identify possible products:The audit products identified will depend on thefocus of the Auditor General and will usually address multiple risks facing theentity. Care is exercised to limit the products to the risks that were given higherpriority.

Respond to entity risks:The proposed product is aligned to the risks that wereidentified.

Assess relative priority:This procedure is undertaken after consideringwhether the product supports the Auditor Generals focus areas and whether

there has been previous audit coverage or other independent reviews of thesubject matter.

Document risks to the office:These are the risks of delivering (auditability)ornot delivering (credibility)the proposed product.

12


21/22

6. Report to the Executive Committee

The final step in the OPP process is to prepare and present a report to the ExecutiveCommittee of OAG Canada. The discussions during the presentation are kept at a highlevel, with attention only to key risks facing the entity that have not been mitigated. The

report is checked by a quality reviewer, who provides feedback on its completeness. It isthen presented to the Executive Committee.

13


22/22

Bibliography

Bergin, Ron. Strategic Planning in the Office of the Auditor General of Canada,Presentation to the Canadian Comprehensive Audit Foundation Fellows, October 2009.

Hopwood, Tom and Wiltshire, Collin. OAG Risk Strategies for the Next Decade.Discussion paper on use of risk concepts in OAG planning, auditing, and management,September 2001.

Office of the Auditor General of Canada, Strategic Planning and Professional Practices.One-Pass Planning Guidance to the Entity Team, March 2002.

_____. Update on our Strategic Plan Challenges, PowerPoint presentation,October 2003. Linked to the following document:http://notes.oag-bvg.gc.ca/intranet/intranet_menus.nsf/html/e_index.htm

_____. Performance Audit Manual, June 2004.

_____. Guidance on Preparing One-Pass Plans, September 2004. Available from:http://notes.oag-bvg.gc.ca/intranet/intranet_menus.nsf/html/e_index.htm

_____. One Pass Plan for the Canada Revenue Agency, 2007.

_____. One Pass Plan for the Government of Nunavut, 2007.

Treasury Board of Canada Secretariat. Integrated Risk Management Framework, 2001.Available from: http://www.tbs-sct.gc.ca/pol/doc-eng.aspx?id=12254

_____. Integrated Risk Management Framework: A Report on Implementation Progress,

March 2003. Available from: http://www.tbs-sct.gc.ca/rm-gr/irmf-cgir/2003-03-rprt01_e.asp

tanzania2009_kishimba

Documents