RISK-BASED AUDIT PLAN

Transcription

1 RISK-BASED AUDIT PLAN Executive Summary Audit Branch June 2010

2 Executive Summary Natural Resources Canada s three year risk-based audit plan has been prepared in accordance with the applicable requirements of the revised July 2009 Treasury Board Policy on Internal Audit and related directives and guidelines, and the professional standards of the Institute of Internal Auditors. The risk-based audit plan includes internal audit projects for a 3 year period from to The Planning Context The Audit Branch is in its third year of formalizing a more systematic and transparent approach to risk-based audit planning since the adoption of the 2006 Treasury Board Policy on Internal Audit. In preparing the Audit Plan 1, planning principles were applied in a consistent manner with the prior two years. Building on previous work, the Audit Branch has continued to refine its approach each year with further improvements consistent with Treasury Board guidance to Chief Audit Executives (CAE). The Audit Branch uses a similar audit planning approach as the Office of the Comptroller General, which is based on the planning guidance provided by its Internal Audit Sector. All audit projects were discussed with senior management and the Audit Committee, with particular emphasis on the projects planned for (first year of the three-year Audit Plan), given that future year projects are re-assessed on an annual basis. Government and departmental priorities were validated with senior management and the Audit Committee to ensure greater alignment of planned audits to the key and highest priority areas. Opportunities for improvement were identified regarding the Audit Plan in the 2009 Management Accountability Framework (MAF) assessment (Round VII) provided in April The Audit Plan was assessed as not clearly demonstrating the results of its risk assessment process, not providing additional resourcing information and was received by the Office of the Comptroller General (OCG) in an untimely manner. The Audit Branch believes it has addressed all three matters in this year s report. A quality review process was applied throughout the planning cycle, to ensure that the Audit Plan: Is risk-based; Covers audit and management priorities; Is reviewed by senior management and the audit committee; Is focused predominantly on the provision of assurance on risk management, control and governance processes; Has a multi-year horizon; Addresses risks and internal audits identified by the Comptroller General as part of government-wide coverage; and Supports annual assurance reporting by the Chief Audit Executive on departmental risk management, control and governance processes. 1 The risk-based audit plan (RBAP) prepared by the Audit Branch of Natural Resources Canada (NRCan) is also referred to as the Audit Plan within this document. June 2010 Executive Summary Only 1

3 The Planning Process The starting point for the risk-based selection process is NRCan s internal audit universe. The audit universe represents a potential range of all audit activities and is comprised of a number of auditable entities. The Audit Branch uses the departmental Program Activity Architecture (PAA) to help assess completeness of the audit universe. The next stage is to prioritize the audit universe based on a risk assessment. This is a two step process and involves preliminary and final prioritization. This includes management consultations, review and consideration of available departmental risk information, including the Corporate Risk Profile (CRP), the latest Management Accountability Framework assessment, strategic review, business planning, the Report on Plans and Priorities (RPP), departmental and government priorities, the most recent tabled financial statements, and other considerations such as previous audit results (both internal and external). Consideration is given to other factors such as senior management requests; the Departmental Audit Committee (DAC) advice and recommendations; mandated audits such as Office of the Comptroller General s horizontal directed audits; audits resulting from the Budget 2009 Economic Action Plan; planned audits by other assurance providers. Finally the draft audit plan is distributed to Departmental Audit Committee for review and recommended to the Deputy Minister for approval. The following diagram highlights the four key phases used in the selection process for the development of a robust risk-based audit plan. AUDIT UNIVERSE (Represen ts po tential range of aud ita ble co mpon ents p rog rams, activities, processes, structures and in itiative s) 38 area s base d o n P AA a nd Se ctors Almo st 10 0 a ud it able entit ies Core Audits Grants & Contributions Financ ial IM/IT Othe r AUDIT RISK ASSESSMENT Impact x Likelihood 30 highest priority audit projects covering 3 years AUD IT RANK ING: PROPOSED AUDIT PROJECTS Environmental Scanning G overnment Priorities Departmental Priorities Corporate Risks Strategic Review Business Planning M AF A s sess m ent Consultations with management Other Considerations Core audit requirements CAE annual assurance perspective Mandated priorities Central Agencies audits Previous NRCan internal audits Time since last audit Audit Branch capacity Pr ioritizatio n Final discussions with senior management Senior management requests Audit Committee requests Focus on first year proposed audit projects June 2010 Executive Summary Only 2

4 The Planning Results In total, almost 30 new highest priority internal audit projects are planned for the next three years. The following table summarized the number of new internal audit projects selected for each year along with the number of special advisory projects, carry-forward audits from and scheduled Office of the Comptroller General horizontal directed audits. Type of Audit Project Core grant and contribution (G&C) programs Core financial Core information management and technology (IM/IT) Other audit projects NEW INTERNAL AUDIT PROJECTS SUB-TOTAL Special advisory projects Carry-forward audits from OCG Horizontal directed audits TOTAL The following four tables provide a listing of audit projects being carried forward from and the new highest priority internal audit projects for fiscal years , and ecoenergy for Biofuels Carry Forward Financial Statement Preparation and Reporting Accounts Receivable and Revenue Management Physical Security Horizontal Audit of Transfer Payments (G&C Programs) Pulp and Paper Green Transformation Program (PPGTP) - Black Liquor Production Clean Energy Fund Financial Statement Reporting (Asset) - Investments Payroll and Benefits Overtime, Vacation and Other Benefits Asset Management Real Property and Fleet Professional Services Operating Expenditures SAP System (Felix Project Planning & Delivery) Accelerated Infrastructure Program (Phase II - Delivery) 2 2 Modernizing Federal Labs & Invasive Species Research Centre (project #63) has been included in the Accelerated Infrastructure Program (AIP) Phase II audit for June 2010 Executive Summary Only 3

5 Expenditure Management (Strategic Review Reallocations) Felix Implementation ecoenergy Technology Initiative Business Continuity Management Management of Information Holdings CANMET - Materials Technology Lab: Relocation United Nations Convention on the Law of the Sea (UNCLOS) Geo-Mapping for Energy & Minerals (GEM) Environmental Liabilities Strategic Planning Operating Expenditures (Transportation, Information, Rentals, and Repairs and Maintenance) ecoenergy Renewable Power Identity and Access Management (Privacy/Access Acts, User Identification /Password Controls) Budgeting and Forecasting Servers Administration and Security Systems and Application Controls (HR / Payroll / Procurement) Interest / Transfer Payments (Offshore) Natural Hazards Information and Response Loans and Advance Receivables IT Infrastructure and Governance In preparation of the Audit Plan, an estimate of total resource capacity available was determined and allocated to all Branch activities using metrics based from prior experience. Taking into account the budget available for internal and external resources, a total of approximately 4,700 person days of capacity for 26 professional positions was estimated for (i.e., direct audit time, excluding leave provisions and time for administration, professional development and language training). June 2010 Executive Summary Only 4