This site uses cookies to provide you with a more responsive and personalized service. By using this site you agree to our use of cookies. Please read our cookie notice for more information on the cookies we use and how to delete or block them.

Bookmark Email Print page

Internal audit in the public sector

The quiet revolution


Internal audit in the public sectorIt used to be that internal auditing in the public sector served as a simple administrative procedure comprised mainly of checking accuracy of transactions, pre-payment verification and control, counting assets and reporting on past events to various types of management. But in recent times, a combination of forces has led to a quiet revolution in the profession. Governments moving toward higher levels of transparency must demonstrate accountability in the use of public money and efficiency in the delivery of services. Larger and more complex operations demand greater competency and professionalism from internal auditors to minimize and manage risk.

The role of internal auditing can be identified as involving three main elements evaluation and improvement of risk management, control and governance processes. Auditors use tools such as financial audits, performance audits and investigative and advisory services to fulfill each of these roles.

In recent years, the aim has been to reach a stage whereby public sector auditing provides the required services to their organizations and ultimately, to the public (see box). This requires a shift in focus by internal auditors to review management procedures for improved efficiency and effectiveness, a change in emphasis which will require time – typically 3 to 5 years.

So how should governments proceed?

There is much room for improvement in the internal audit functions in developing economies. There is lack of qualified internal auditors, as well as insufficient opportunities for internal auditors to become qualified. Although there is a general awareness of internal audit standards among audit practitioners, for the most part these standards are not applied. To make the transition from merely ensuring compliance with rules and regulations to truly delivering added value requires more than just organizational changes. A substantial shift in culture is required. In many settings, public sector staff is poorly paid and unmotivated, work ethics are weak and governance practices are ineffective. Additionally, many organizations lack the support from senior management and regulatory bodies, and the internal audit function is often not as independent as desired.

There are five main pillars that are considered critical for building an effective internal audit function in the public sector. These are: perception and ownership, improved processes and governance, legislative support, improved incentives and a commitment to change.

Perception and ownership

A more professional internal audit function will be able to establish priorities for effective and efficient service delivery, assist management in decision-making and thus fill a more proactive and forward-looking role. The organization's leadership can set the tone by establishing governance, risk management and control systems and consistently applying sanctions in the case of non-compliance. Internal audit functions need to work on raising awareness of internal auditing in the public sector by establishing specific marketing plans. These plans, however, must be accompanied by improved internal audit service delivery and the introduction of a quality assurance program. The establishment of a professional body to communicate internal audit matters would raise awareness of the internal audit function and could also serve to sanction members who fail to meet professional standards.

Improved processes and governance

There are several key elements essential to helping the internal audit function become more organized and better structure its processes. 

  • Annual audit coverage planning through risk assessment: as there is usually a host of audit assignments, different views and needs, management and the internal audit function need to establish priorities, based on a risk assessment, and obtain the audit committee's formal approval for the plan. To increase audit efficiency, internal auditors should concentrate on areas that carry the highest degree of risk. The ability to establish a reliable risk profile is crucial to audit effectiveness.  The internal audit function also needs to consider which effectiveness/efficiency reviews ("value for money") would improve the service delivery of the organization and thus could raise awareness of the added value of internal auditing.
  • Assignment planning: auditors should develop an assignment planning memo by performing a preliminary review of the audit area and determining the assignment scope and objectives.
  • Testing and reporting: establish, test, monitor and assess controls. The key finding of the audit and subsequent recommendations should be in harmony with the risk profile.


The effectiveness of the internal audit function depends upon several factors:

  • True independence: a formal mandate from the board or audit committee would give the internal audit function the authority to audit anything that, in its professional opinion, impacts the effectiveness of governance, risk management and control processes. Does internal auditing have its own budget? Who appoints the internal audit manager?
  • A good understanding of issues facing the organization: internal auditing needs to function effectively as a member of the organizational team. It must understand the daily challenges faced by management and structure its coverage accordingly. Unless internal auditing can consistently show that its work contributes to better service delivery, it will be difficult to ensure management backing for investment in the audit function. A non-value-added audit organization in the public sector could also hamper any attempts at increased transparency and accountability in governance.
  • Responsiveness to management's needs: the ability to respond to management follows from an understanding of organizational challenges. Ad hoc assignments are one way of responding to management's needs.
  • Proactive communication with management: to ensure continued audit effectiveness, internal audit leaders should follow events in the organization closely and maintain a running dialogue with management.
  • Implementation of recommendations: the number of recommendations implemented is a highly relevant measure of audit effectiveness. A high proportion of recommendations implemented suggests that management is convinced of the audit function's usefulness.

Matching of skills set to needs: does the audit manager have the authority to fire and recruit staff? Can he plan and implement a training program and allow funds for certification?

Use of technology to work more effectively: technology must actively contribute to audit efficiency and effectiveness. Computerization without planning can be counter-productive, cementing existing problems instead of helping to solve them.

Legislative backbone

Internal auditing in the public sector should be written into Law. The legislation should clearly set out the requirement for internal auditing and the appropriate governance arrangements to support effective internal auditing, such as an audit committee and its role and operations. In support of the aforementioned, there is also a need to fully integrate internal auditing into ongoing public finance management reforms. The head of internal auditing should be required to hold the appropriate professional designation (IIA member or CPA) with appropriate academic qualifications. The audit function should formally adopt The IIA's International Standards for the Professional Practice of Internal Auditing.

Improved incentives

Civil service has been, and still is in some places, a lifetime occupation, where set advancement is based on the number of years in service, not merit, achievement, or education. Change is likely to be resisted by staff, if it will only mean additional work, without any possibility of merit-based advancement. Most public sector organizations, whether in developed or developing countries, cannot compete with private sector salaries. Non-financial motivators take on even greater importance in public sector environments and must be targeted to the individual. There are several suggestions for motivating staff: 

  • Create tailored development plans, including training opportunities and career progression.
  • Include praise for recommendations made. 
  • Allow the staff member to represent the internal audit function at meetings and conferences. 
  • Recognize the staff member with awards. 
  • Praise the staff member's work in audit publications.
  • Offer a choice of assignments and travel opportunities.
  • Allow the staff member to participate in exchange programs, spending time in other work areas.
Commitment to change

Countries just beginning to make the change to valueadded internal auditing may benefit from studying the experiences of those that have recently made the transition. Crucial elements that should be examined include leadership ethics, government support, a proactive focus and staff development. Bringing about the necessary changes in culture, perception, or even internal audit services themselves demands a long-range commitment from leadership at the highest level. Strong, active leadership support to improve governance is the over-whelming prerequisite for successful reform of internal auditing in the public sector. For sustained change, internal cooperation is not enough. External stakeholders and policy- and decision-makers need to be supportive and must be kept aware of changes, reforms and improvements in internal auditing, so they will take into account the contributions internal auditing can offer.


Material on this website is © 2014 Deloitte Global Services Limited, or a member firm of Deloitte Touche Tohmatsu Limited, or one of their affiliates. See Legal for copyright and other legal information.

Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee (“DTTL”), its network of member firms, and their related entities. DTTL and each of its member firms are legally separate and independent entities. DTTL (also referred to as “Deloitte Global”) does not provide services to clients. Please see “About Deloitte” for a more detailed description of DTTL and its member firms.

Get connected
Share your comments


More on Deloitte
Learn about our site