TIAPS Module 1 Audit and Assurance workbook

A. Internal Auditing’s Contribution to Good Governance
On completion of this section, students will be better able to:
• Identify factors impacting governance in the public sector.
• Define governance with reference to various models.
• Identify requirements for good governance in public sector environments.
• Describe how internal audit contributes to organizational governance.
A.1 Public Sector Environment
Internal auditors operating in a public sector environment face a range of conditions not
generally experienced by their private sector counterparts. The following features represent
a generalization not found in every public entity but are characteristic of many.
• High importance. Governments hold significant power. They impact the lives of all
citizens in many ways. They have access to a vast array of information and
resources. Consequently, the risks of errors, wastage, fraud, and corruption can be
hugely consequential, including the potential for abuses of privacy and misuse of
data, despoilation of environments, depletion of natural resources, economic and
social deprivation, military conflict, inadequate supply of energy and other utilities,
and weaknesses in the rule of law. The work of internal auditors in helping
administrations improve governance, risk management, and control could not be
more important.
• Limited resources. Resources tend to be limited because of continuous pressures on
public spending. Everyone is expected to do more with less. This is often particularly
true of unseen “back office” functions like internal audit whose overheads may be
regarded by many budget holders and uninformed members of the public as
inconsequential or unnecessary. Specialist skills for areas such as IT, cybersecurity,
and data analytics are often in short supply, especially when the private sector can
lure individuals away from the public sector with offers of higher rewards.
• Immature risk management processes. Risk management may be relatively
immature with fewer resources applied to risk and compliance functions. Awareness
and understanding of risk and control may also be relatively limited. In such
circumstances, internal audit may be expected to play a greater role in supporting
management to develop effective internal control or even to act as a quasi-second
line function (see section A.3.2 for consideration of the Three Lines Model.) In its
advisory capacity, supporting the development of public internal financial control is
an important internal audit service but care must be taken to safeguard
independence and objectivity (see section B).
6