Improving the Effectiveness of Internal Audit Departments Within Public Sector Entities
by Dr. Fahdah S. Alsudairi, Consultant, General Court of Audit of the Kingdom of Saudi Arabia
Over the last five years, agencies in the Kingdom of Saudi Arabia’s public sector have undergone fundamental transformations—including restructuring, implementing governance mechanisms, and activating control requirements—aimed at improving their performance. The General Court of Audit (GCA), the country’s Supreme Audit Institution (SAI), has sought to contribute to these efforts by taking steps to enhance the internal audit function of the public sector. GCA has expanded the scope of its performance auditing, allowing it to focus on higher-level cross-government audits, while internal audit departments (IADs) provide more accountability within government agencies.
GCA’s work in this area reflects its new identity, launched in September 2020, which includes cooperation with all organizations subject to its audit. This principle is represented by the integral symbol (∫) in GCA’s new logo, as the SAI seeks to strike the root of a real partnership with auditees and further enhance the value it adds in serving the public interest. By sharing its experience improving the performance of IADs while maintaining its independence, GCA aims to assist other SAIs undertaking similar efforts.
GCA has worked to strengthen the public sector’s internal audit function in three stages: establishing IADs, evaluating and training employees, and developing a competency framework (figure 1). These efforts have helped governmental agencies build reliable control systems, develop strong compliance management, enhance the accuracy of financial records, and efficiently implement projects and initiatives.
Stage 1: Establishing Internal Audit Departments
GCA first worked with all organizations subject to its audit to identify and understand their internal audit functions. This collaboration included annual forums, the first of which was held in 2003 and resulted in a recommendation for the establishment of IADs, with a direct link to the organizations’ heads. Consequently, the Council of Ministers issued a resolution requiring all organizations subject to audit by GCA to establish an IAD.
GCA then collaborated with the Institute of Public Administration to establish practical guidelines related to the concepts, principles, and standards of internal auditing; requirements for establishing an IAD; responsibilities of the head of an IAD; and procedures for implementing an IAD. This exercise led to the issuance of a resolution approving “The Standard Regulation for Internal Audit Departments in Governmental Agencies and Public Organizations” (figure 2).
These guidelines, requirements, and procedures are consistent with the National Transformation Program—part of Saudi Arabia’s national vision 2030—which aims to achieve governmental operational excellence, improve economic enablers, and enhance living standards. In particular, according to the public sector IAD guidelines, these departments should empower entities to achieve their mission by ensuring they achieve their goals. In doing so, IADs also help ensure that the objectives of the public sector—and of the state as a whole—are achieved.
However, despite the importance of the internal audit function, evidence suggests that public sector IADs are performing poorly, for a variety of reasons—including organizational, administrative, and technical issues. According to a survey of the Saudi public sector, one of the greatest obstacles to improving performance is a lack of competence on the part of IAD employees.
For example, the regulation dealing with IADs states that their employees should be selected based on practical experience and professional qualifications in accounting or an equivalent field. However, a recent survey, conducted in collaboration with GCA, indicated that 92 percent of IAD employees were not professionally qualified in auditing, and that 60 percent were academically qualified in fields unrelated to auditing or accounting.1
Stage 2: Evaluating and Training Employees
These findings led to the second stage of GCA’s efforts to enhance the internal audit function of the public sector, which GCA initiated in 2018—evaluating and providing the necessary training to IAD and other employees. To that end, GCA established the Saudi Center for Financial and Performance Auditing (SCFPA), which offers training to employees of various government and public sector entities, including IADs, with the aim of improving their financial performance and optimizing their use of economic resources.
SCFPA issues publications and organizes annual forums, programs, conferences, workshops, and training courses. The center trained 1,000 participants annually in its first few years, and in 2020, due to the COVID-19 pandemic, it switched to a virtual format and trained 3,000 participants through distance learning (figure 3).
Stage 3: Developing a Competency Framework
GCA recognized that suitable training to develop the technical, professional, and behavioral skills of internal auditors was essential to helping them keep pace with the continuous changes in their field. To identify future training needs, it was necessary for GCA to identify the competencies required of IAD employees.
Several professional bodies have developed competency models. However, these models do not completely apply to internal auditing in the public sector. For example, the Institute of Internal Auditors’ (IIA) “Global Internal Audit Competency Framework” is designed for the private sector, and INTOSAI’s “Competency Framework for Public Sector Audit Professionals at Supreme Audit Institutions” is for SAI auditors, who conduct external audits.
The need for a specialized framework was therefore evident—one that was compatible with both the work requirements of public sector IADs and Saudi government regulations and systems. To achieve this, GCA developed a new competency model based on the content analysis of four documents: the IIA and INTOSAI frameworks, as well as the two governmental resolutions laying out “The Standard Regulation for Internal Audit Departments in Governmental Agencies and Public Organizations.”2
The resulting framework identified 97 indicators—in five categories of competencies (figure 4)—each of which addresses specific professional and governmental requirements that can collectively serve to improve the performance of internal auditors.
Knowledge Competencies. Thirteen indicators, including internal audit standards and their applications, professional conduct rules, independence, objectivity, professional commitment, responsibility, confidentiality, public interest, and determining the financial and non-financial scope of the internal audit.
Functional Competencies. Thirty-two indicators, including audit planning, evaluating internal control systems, determining materiality, professional skepticism, accounting in the public sector, cost accounting, fraud mechanisms, measuring performance, evaluating risk management practices, and collecting and evaluating evidence.
Technical Competencies. Sixteen indicators, including public sector governance, effective supervision, collecting and analyzing financial and non-financial information, writing and implementing interview questions, preparing survey lists, using technological knowledge to review automated systems, and providing effective feedback.
Soft Competencies. Sixteen indicators, including critical thinking, diplomacy and logic, creativity and development, successful cooperation and teamwork, presentation and persuasion, selection of appropriate communication media, verbal and non-verbal skills, visual and written communication skills, body language, time management, and respect for diversity.
Managerial Competencies. Twenty-two indicators, including leadership skills, thinking and strategic planning, empowering and motivating, development and innovation, problem-solving, decision-making, conflict management, conflict resolution, selection and employment, human resource development, performance evaluation of department employees, department resource management, and building effective partnerships with stakeholders.
It should be noted that IAD competency requirements—although comparable for some general tasks—differ for auditors, audit managers, and department managers. These differences are reflected in the distribution of competencies and their indicators, which may help in directing training to the appropriate administrative level.
The proposed framework aims to assist GCA in providing more comprehensive future training for IAD employees. However, this is a continuous process that requires constant updates to align with changes in the internal audit function and related governmental regulations. Moreover, the framework is intended to support cooperation between GCA and the organizations subject to its audit, without interfering with the core work of their IADs. GCA will continue to provide tailored training and support that meets the needs of IADs by directing its future efforts and research toward identified gaps.
For more details about the competency framework for public sector internal auditors, please contact the author at ird@gca.gov.sa.
1 Alsudairi, F. S. (2021). “Evaluation of employee competencies in internal audit units in the Saudi public sector: Empirical study.” General Auditing Journal, Vol.1, No, 1.
2 Alsudairi, F. S. (2021). “Competencies of the employees of the internal audit units in the public sector of Saudi Arabia: An analytical study.” General Auditing Journal, Vol.1, No, 2.
Cover image: HuHu Lin/stock.adobe.com
