## 8. The IAD should develop an internal audit charter based on the example provided by the mission team

## Source details

**Canonical URL:** [8. The IAD should develop an internal audit charter based on the example provided by the mission team](https://www.imf.org/-/media/files/publications/cr/2018/cr18293.pdf)

## Other formats

- [Markdown version](/-/media/files/publications/cr/2018/cr18293.pdf.md)
- [Structured JSON version](/-/media/files/publications/cr/2018/cr18293.pdf.json)

---

### Mission context and purpose
- At the request of the Central Bank of Somalia (CBS) a Monetary and Capital Markets (MCM) Department mission visited Kampala, Uganda from September 24 to October 5, 2017 to assist CBS develop frameworks for internal auditing and accounting and bring them towards international accepted norms.
- Mission objectives included:
  - Assist CBS develop formal frameworks and professional practices for internal audit and accounting.
  - Deliver training on accounting and internal audit topics to help CBS staff maintain proper accounting records, prepare financial statements, and develop an effective internal audit framework.
  - Use group exercises with real data and agree assignments for completion prior to the next mission.
- Next mission scheduled for first quarter 2018, dependent on homework completion.
- Training sessions agenda dates: Central Bank of Somalia, September 24 – October 5, 2017 (Serena Hotel – Kampala, Uganda).

### Internal Audit Charter — findings and required actions
- Findings about current draft charter:
  - Drafted charter is not in line with mandatory requirements of the International Professional Practice Framework (IPPF).
  - Draft defines internal audit narrowly as "independent appraisal function" rather than IPPF definition.
  - Draft states IAD reports to the governor administratively and to the BoD functionally but lacks clear definitions/explanations of administrative and functional reporting lines.
  - Draft inadequately assigns responsibility and ownership of risk management to the IAD; responsibility should belong to management of the CBS.
- Proposed charter (Appendix IV) characteristics (model endorsed by the IIA and aligned with IPPF mandatory requirements):
  - Defines the IAD to provide “independent and objective assurance and consulting services.”
  - Authorizes IAD “full, free, and unrestricted access to any and all of the CBS records, physical properties, and personnel pertinent to carrying out any engagements.”
  - Substantiates dual-reporting lines: reporting to the governor administratively and to the Audit and Governance Committee (AGC) functionally.
  - Explicitly states management owns the risk management function; internal audit may provide assurance and consulting services on risk management in accordance with the charter.
- Action required:
  - IAD should modify a few terms to reflect CBS circumstances and submit the charter to the AGC and CBS governor for approval.

### Audit Committee Charter — status and recommendations
- Status:
  - IAD has prepared a draft audit committee charter; it has not been discussed and approved by the AGC and the BoD.
  - Current communication between IAD and AGC mainly relies on periodic reporting from the IAD to the BoD because AGC members are also non-executive BoD members.
- Recommendations:
  - Formalize AGC roles and responsibilities in oversight of financial reporting, internal control, risk management, and internal auditing, including the functional reporting from the IAD to AGC.
  - Use the example audit committee charter (Appendix V) to enrich CBS’s draft with best practices.

### Organizational structure of the IAD: findings and recommendations
- Current situation:
  - IAD established over one year ago; three internal auditors operate without an appointed lead or departmental head.
  - No formal and direct reporting line from IAD to AGC; AGC receives IAD periodic reports to the BoD.
  - Main activity: "surprise cash counting" to safeguard custody of physical currency.
  - No internal audit manual or equivalent guidance.
- Findings on organizational chart:
  - Current draft organizational chart appears too hierarchical for small staff size.
  - Proposed structure divides department into three levels and segregates auditors into different sections despite current size of three auditors and anticipated future size of six–seven auditors.
- Recommendations:
  - Hire a qualified individual to be the head of IAD on a timely basis. Ideal qualifications include:
    - Certified Internal Auditor (CIA) certification or equivalent (e.g., Certified Public Accountant, Chartered Accountant)
    - Substantial experience in risk-based auditing methodology
    - Management skills
  - Transitional hiring option: hire conditional on requirement to obtain equivalent certifications in one or two years.
  - Adopt a flatter structure organizing auditing staff into a professional pool rather than segregated divisions to:
    - Maximize limited resources
    - Expose staff to different auditing experiences
    - Enable staff to gain management skills and fungibility across audit types
  - Create job grades within the professional pool based on seniority and merits.
  - Encourage staff certifications/skills development:
    - At least one staff pursue expertise in risk management and reserve management.
    - At least one staff pursue Certified Information System Auditor (CISA).
    - Consider hiring consultants for IT audits with knowledge transfer to staff over time.

### Risk management unit: staging and independence safeguards
- Observation:
  - Draft organizational chart includes a risk management unit, which may create the perception that ownership of risk management belongs to internal audit.
- Recommendation and staging:
  - Management should ultimately own risk management.
  - Foster risk management capacity within the IAD initially; when capacity matures in three or five years, form a separate risk management unit separated from IAD so IAD can audit the risk management process as required by IIA Standards.
- Role of IAD in fostering risk management (conditional on safeguards):
  - Advise on risk management and share risk assessments of CBS business processes as part of annual audit planning.
  - Provide consulting services such as coaching management in risk identification and assessment as capacity matures.
- Safeguards to ensure IAD independence and objectivity when advising on risk management:
  - (i) Issue a memo on the IAD’s roles and responsibilities for each consulting engagement relating to risk management.
  - (ii) The person who consults on risk management engagements will not be the one to audit risk management.
  - (iii) Discuss with AGC at least once a year the overall independence and objectivity of the IAD.

### Internal audit manual, strategy note, and near-term objectives
- Finding:
  - No procedural manual to guide auditing work; current activities mainly include “surprise cash counting” and occasional observation of cash reconciliation.
- Recommendation:
  - Adopt the internal audit manual proposed by the mission team to establish professional, repeatable auditing practices. The manual guidance includes:
    - Develop an annual audit plan
    - Conduct auditing and consulting engagements
    - Follow up on implementation of audit recommendations
    - Establish a quality assurance and improvement program
  - Use Chapter 5 of the proposed manual to complete risk assessments of all CBS auditable processes.
- Strategy note action:
  - Update the three-year strategy note to focus on near-term objectives for the next 12 months while using the internal audit manual for procedures.
  - Specific near-term aims for the next 12 months:
    - (i) develop its first risk-based annual plan;
    - (ii) have at least 1 staff sit for the CIA exam; and
    - (iii) adopt an internal audit manual in line with IPPF requirements.

### Risk-based auditing, audit universe, and capacity constraints
- Core principle:
  - Modern internal auditing should add value via risk-based auditing rather than compliance-based auditing.
- Progress and next steps:
  - Under mission guidance, CBS staff developed the first audit universe containing about 18 major business processes (Appendix X).
  - Complete the risk assessment of the auditable entities in the audit universe with full awareness of potential fraud risks.
  - Mission assisted with risk assessments of two business processes: the travel claim process and the payroll process.
- Capacity constraints:
  - Meaningful risk assessment requires deep knowledge of CBS business; all IAD staff are relatively new and full implementation of risk-based auditing will take a few years.
- Anticipated IAD growth: current size three auditors; anticipated future size six–seven auditors.

### Related accounting, systems, and timing considerations affecting the IAD
- Accounting and systems context relevant to internal audit planning:
  - Accounting capacity limited; transactions recorded on cash basis across PeachTree, QuickBooks, and Excel work papers; trial balance does not balance.
  - Financial statements for 2015–2017 have not been prepared or audited; mission recommended focusing on ensuring balances at December 31, 2017 are accurate and that Oracle ERP reflects accurate balances as of January 1, 2018.
  - New accounting system (Oracle ERP) projected “go live” date in November 2017; vendor advised currency should be the Somalian shilling; mission advised system should record transactions in the functional currency which currently is the U.S. dollar.
- Timelines and assignments (selected deadlines preserved exactly as in source):
  - Internal Audit homework deadlines:
    - Update the proposed internal audit charter and submit for discussion and approval. — December 31
    - Update and submit the drafted audit committee charter. — December 31
    - Update organizational chart to reflect a flatter structure. — December 31
    - Update and adopt the proposed internal audit manual. — December 31
    - Update strategy note to set specific objectives for next 12 months including develop first risk-based annual audit plan and at least one staff sits for the CIA exam. — December 31
    - Select one auditable entity and complete the risk assessment. — October 15
    - Continue and finish the risk assessment of all remaining auditable entities in the audit universe. — December 31
    - Download and read the Institute of Internal Auditors (IIA) Standards. — December 31
  - Training schedule for future missions:
    - Mission #2: First Quarter 2018
    - Mission #3: Second Quarter 2018
    - Future Missions: Depends on level of activities conducted by CBS and progress on IFRS implementation

*Source: cr18293 - 8. The IAD should develop an internal audit charter based on the example provided by the mission team.*

### Preface.................................................................................................................

### Preface

### Preface: mission context and acknowledgements
- At the request of the Central Bank of Somalia (CBS) a Monetary and Capital Markets (MCM) Department mission visited Kampala, Uganda from September 24 to October 5, 2017 to assist the authorities in developing proper frameworks for internal auditing and accounting to bring them towards international accepted norms.
- Training sessions were conducted on relevant topics.
- The mission met with members of the internal audit and accounting teams.
- The mission thanks the CBS for cooperation, productive discussions, and enthusiasm to learn new topics and apply new skills.
- The mission acknowledges logistical support provided by the Somalia Resident Representative office located in Nairobi, Kenya.
- This report has been reviewed in IMF Headquarters and comments have been incorporated.

*Executive Summary (overview provided in the source follows in detail below).*

### Executive Summary: key findings and agreed follow-up
- Purpose of mission:
  - First mission in a series to assist CBS develop formal frameworks and professional practices for internal audit and accounting and bring them toward international norms.
  - Training sessions covered accounting and internal audit topics to assist CBS staff in maintaining proper accounting records, preparing proper financial statements, and developing and implementing an effective and modern internal audit framework.
  - Group exercises used real data and information.
  - Assignments were agreed with each team to be completed prior to the next mission.

- Internal Audit Department (IAD) assessment:
  - IAD is "unstructured and in its initial stages of maturity" and needs infrastructure to make practices sustainable, repeatable, and professional.
  - Required infrastructure items:
    - Proper internal audit charter.
    - Audit committee charter.
    - Internal auditing manual.
  - Management actions recommended:
    - Appoint a head for the IAD to lead establishment of the internal audit function.
    - Consider a flatter organizational structure so IAD can mobilize resources more efficiently.
  - IAD tasks and near-term actions:
    - Continue and complete risk assessments of all remaining business processes included in the audit universe.
    - Use results of risk assessment to develop a risk-based annual audit plan.
    - Update strategy note to focus more on near-term objectives.
    - Familiarize with the International Professional Practice Framework (IPPF) for internal audit by downloading and reading relevant international internal auditing standards before the next mission.

- Accounting assessment:
  - Draft trial balance sheets for 2015 and 2016 have not been prepared consistent with International Financial Reporting Standards (IFRS) and inaccurate balances exist due to prolonged use of inadequate accounting systems, application of improper accounting procedures, and lost knowledge.
  - The balance sheet does not include the IMF accounts and for the financial statements to be IFRS compliant, the accounts must be presented. Overdue debt obligations to the Fund would increase the CBS’ liabilities by approximately SDR 240 million or about US$340 million.
  - The mission recommended CBS not spend additional time attempting to identify past source documents and journal entries.
  - Agreed process: focus on ensuring balances at December 31, 2017 are accurate so computerized system (Oracle ERP) reflects accurate balances as of January 1, 2018.
  - Accountants should have a role in the IT project and guide the vendor in developing proper configurations.

- IFRS gap analysis and accounting practice issues:
  - Mission spent 40 percent of the training conducting a gap analysis for major balance sheet and income statement accounts to explain IFRS concepts.
  - Topics included characteristics of IFRS principles, impact on income of changing accounting policies, applying accrual method of accounting (IAS 1), and applying IAS 16 by charging depreciation to buildings and developing and maintaining a proper fixed asset registry.
  - 2013/2014 audited financial statements (issued October 2016) carry a qualified opinion.
  - Disagreement between CBS management and external auditor regarding revaluation of property, plant and equipment needs resolution to move forward with 2015/2016 financial statements and to produce the 2017 financial statements in a timely manner.
  - Suggested that the accounting team meet with the Director of Accounting and propose the disagreement be presented to the Audit Committee for resolution.

- Communication and support:
  - Specific assignments were agreed with CBS staff (see Table 1 in source).
  - Ongoing communication will be maintained via emails and conference calls to provide timely guidance.

### Assignments for Internal Auditing and Accounting (summary of agreed actions and timelines)
Internal Audit
- 1 Update the proposed internal audit charter with CBS circumstances and submit it to governor and Audit and Governance Committee or the Board of Directors (BoD) for discussion and approval. — December 31
- 2 Update and submit the drafted audit committee charter to the governor and the Audit and Governance Committee (or the BoD) for discussion and approval. — December 31
- 3 Update the organizational chart to reflect a flatter structure to mobilize the limited resources. — December 31
- 4 Update and adopt the proposed internal audit manual. — December 31
- 5 Update the strategy note to set specific objectives for next 12 months: (i) develop the first risk-based annual audit plan; (ii) at least one staff sits for the Certified Internal Auditor (CIA) exam. — December 31
- 6 Selected one auditable entity from the audit universe, complete the risk assessment in line with proposed internal auditing manual (Chapter V). — October 15
- 7 Upon the feedback of the first risk assessment, continue and finish the risk assessment of all the remaining auditable entities in the audit universe. — December 31
- 8 Download and read the Institute of Internal Auditors (IIA) Standards. — December 31

Accounting
- 1 Reconcile all bank statements and SWIFT notifications as of September 30, 2017 to the cash accounts and prepare and post adjusting entries if necessary to achieve accurate balances consistent with bank balances. Continue to reconcile cash accounts monthly. — November 15
- 2 Resolve disagreement regarding the Property, Plant, and Equipment revaluation between external auditor and management by proposing to senior management that the issue is taken to the Audit Committee. Consider obtaining a new appraisal for land and buildings for 2017. — December 31
- 3 Calculate the impact on income of adopting IFRS by completing the IFRS gap analysis. — December 31
- 4 Prepare proper Note for the financial statements for Property, Plant, and Equipment that includes a roll forward of the balance from January 1, 2015 to December 31, 2017. Separate land and buildings, calculate depreciation for relevant assets, and determine net value. Prepare and post any adjusting entries to reflect proper values and depreciation expense. — December 31
- 5 Set up Fixed Asset Register based on information provided by Administration Department or other relevant departments. — December 31
- 6 Ensure the Chart of Accounts are designed to allow for future needs (6 levels of accounts not 5):
  - Update list based on financial statement presentational preferences.
  - Update list based on IFRS analysis and any changes in accounting policy (e.g., depreciation for buildings). — November 1
- 7 Develop sufficient number of accounting test scenarios (e.g., add fixed asset revaluation; verify whether a report can be produced that can be included in financial statements). Obtain feedback from users on interface and gaps in data entry. — November 15
- 8 Draft accounting policies for the Accounting Manual related to the following areas and submit for review to IMF:
  - Cash and Cash Equivalents.
  - Property, Plant, and Equipment.
  - Salary Expenses. — Next mission date
- 9 Complete organizational chart and allocate 12 resources to various functions and define tasks. — Next mission date

### I. Introduction: context within IMF programs and CBS operations
- Somalia is a fragile country under a 12-month Staff Monitoring Program (SMP) designed to rebuild economic institutions; part of the program includes commitments to enhance governance of the CBS.
- Capacity to be rebuilt is weak and technical assistance is critical to achieve SMP targets.
- Two financial sector reforms focus on improving accounting and reporting standards of the CBS, involving implementing new accounting and financial reporting systems in line with IFRS and strengthening CBS internal oversight including establishing an Executive Committee and Audit Committee.
- Current CBS operations:
  - Carries out very limited central bank functions; functional, or de facto, currency is the U.S. dollar.
  - Does not conduct monetary policy or manage foreign reserves.
  - Main activity: provide cash and bill paying services to the government.
  - Main revenue source: cash handling fees.
  - Main expenditure: staff wages and salaries.
  - Accounting for activities is not complex and the auditing universe is limited.
- Mission activities:
  - Met with newly staffed internal audit and accounting teams in Kampala.
  - Training focused on theory and application of international standards and principles related to internal audit and accounting applicable to CBS.
  - Training over two-week period; materials included in Appendices VI–IX; matrix for future missions in Appendix III.

### II. Internal Audit — Background and institutional gaps
- IAD capacity and practice:
  - IAD at the initial level in capacity maturity.
  - Function is unstructured, conducts isolated single audits of transactions for accuracy or compliance, and has not established professional practices.
  - Established over one year ago; lacks organizational structure and formal reporting lines.
  - Three internal auditors operate without an appointed lead or departmental head; meet with the governor as needed for funding and reporting.
  - No formal and direct reporting line from IAD to the Audit and Governance Committee (AGC); AGC receives IAD periodic reports to the Board of Directors (BoD) since AGC members are non-executive BoD members.
  - Main activity: "surprise cash counting" to safeguard custody of physical currency (mainly U.S. dollars and a small portion of Somalia shillings) in vaults and branches.
  - No internal audit manual or equivalent guidance to standardize internal audit work.
- IAD needs:
  - Establish infrastructure so internal audit practices are sustainable, repeatable, and professional.
  - Infrastructure includes:
    - Formal dual reporting lines established through an internal audit charter and an audit committee charter.
    - Organizational structure suitable for existing capacity.
    - Internal auditing manual based on the International Professional Practice Framework (IPPF).
- Internal Audit Charter issues:
  - Drafted charter is not in line with mandatory requirements of IPPF:
    - Draft defines internal audit as "independent appraisal function" with purpose to "assist(ing) the board and the management to discharge their responsibilities effectively." This definition is considered narrowly focused and not compliant with IPPF which defines internal audit as "an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations."
    - Draft states IAD reports to the governor administratively and to the BoD functionally, but lacks definition/explanation of the administrative and functional reporting lines, making implementation difficult.
    - Draft inadequately assigns responsibility and ownership of risk management to the IAD; responsibility should belong to management of the CBS.

*IMF MCM mission report: "Internal Audit and Accounting" (Preface and selected sections).*

### 8. The IAD should develop an internal audit charter based on the example

### 8. The IAD should develop an internal audit charter based on the example provided by the mission team and submit it to the AGC and CBS governor for approval

### Internal audit charter: findings and required actions
- The proposed charter (Appendix IV) is based on a model endorsed by the IIA and is aligned with IPPF mandatory requirements.
- The proposed charter defines the IAD to provide “independent and objective assurance and consulting services.”
- The proposed charter authorizes the IAD “full, free, and unrestricted access to any and all of the CBS records, physical properties, and personnel pertinent to carrying out any engagements.”
- The proposed charter includes details to substantiate the IAD’s dual-reporting lines in alignment with IIA Standards: reporting to the governor administratively and to the AGC functionally.
- The internal audit charter explicitly states that management owns the risk management function and internal audit can provide assurance and consulting services on risk management in accordance with the charter.
- Action: IAD should modify a few terms to reflect CBS circumstances and submit the charter to the AGC and CBS governor for approval.

### Audit committee charter: status and recommendations
- The IAD has prepared a draft audit committee charter; however, it has not been discussed and approved by the AGC and the BoD.
- Current communication between the IAD and AGC mainly relies on periodic reporting from the IAD to the BoD because AGC members are also non-executive BoD members.
- An audit committee charter would formalize AGC roles and responsibilities in oversight of CBS’ financial reporting, internal control, risk management, and internal auditing, including the functional reporting from the IAD to AGC.
- An example audit committee charter (Appendix V) was shared with CBS staff to enrich their draft with best practices.

### Organizational structure of the IAD: findings and recommendations
- Finding: The IAD is without a department head; no one is responsible for managing staff and work of internal audit.
- Consequences: Auditing staff lack a “go-to-person” for daily guidance; the lack of a department head may jeopardize regular communication with other department heads and senior management.
- Recommendation: CBS should hire a qualified individual to be the head of IAD on a timely basis. Ideal qualifications include:
  - Certified Internal Auditor (CIA) certification or equivalent qualifications (e.g., Certified Public Accountant, Chartered Accountant)
  - Substantial experience in risk-based auditing methodology
  - Management skills
- Transitional hiring option: If local talents are limited, a selected candidate could be hired conditional on the requirement to obtain the equivalent certifications in one or two years.
- Current draft organizational chart issues:
  - Appears too hierarchical for its small staff size (Figure 2).
  - Proposed structure divides the department into three levels and segregates auditors into different sections by audit type despite current size of three auditors and anticipated future size of six–seven auditors.
  - Maintaining that structure may limit resource flexibility and staff development.

### Recommended flatter structure and staff development
- Recommendation: Adopt a flatter structure organizing auditing staff into a professional pool rather than segregated divisions.
- Benefits:
  - Maximize limited resources
  - Expose staff to different auditing experiences
  - Enable staff to gain management skills and fungibility across audit types
- Career progression: Create job grades within the professional pool based on seniority and merits.
- Skills development recommendations:
  - At least one staff should be encouraged to pursue expertise in risk management and reserve management.
  - At least one staff should be encouraged to pursue certificates such as Certified Information System Auditor (CISA).
  - While acquiring IT auditing skills, the IAD could consider hiring consultants to conduct IT audits with knowledge transfer to staff over time.

### Risk management unit: staging and independence safeguards
- Observation: Draft organizational chart includes a risk management unit, which may create the perception that ownership of risk management belongs to internal audit.
- Recommendation:
  - Because CBS management should be ultimately responsible, and CBS lacks a separate risk management unit, it is practical to foster risk management capacity within the IAD initially.
  - When risk management capacity matures in three or five years, form a separate risk management unit separated from the IAD so IAD can audit the risk management process as required by IIA Standards.
- Role of IAD in fostering risk management (conditional on safeguards):
  - IAD could advise on risk management and share their risk assessment of CBS business processes as part of annual audit planning.
  - As capacity matures, IAD can provide consulting services such as coaching management in risk identification and assessment, and sharing risk assessment tools and techniques.
- Safeguards to ensure IAD independence and objectivity when advising on risk management:
  - (i) A memo on the IAD’s roles and responsibilities for each consulting engagement relating to risk management to remove possible perceived impairment on independence and objectivity.
  - (ii) The person who consults on risk management engagements will not be the one to audit risk management.
  - (iii) Discuss with AGC at least once a year on the overall independence and objectivity of the IAD.
- Reference: Figure 3 illustrates activities appropriate and not appropriate for internal audit (source: The Institute of Internal Auditors Position Paper: The Role of Internal Auditing in Enterprise-wide Risk Management).

### Internal audit manual, strategy note, and near-term objectives
- Finding: The IAD does not have any procedural manual to guide auditing work. Current activities mainly include “surprise cash counting” and occasional observation of cash reconciliation — tasks that should be gradually transferred to business departments.
- Recommendation: IAD should adopt the internal audit manual proposed by the mission team to establish professional, repeatable auditing practices.
  - The proposed internal audit manual contains guidance to:
    - Develop an annual audit plan
    - Conduct auditing and consulting engagements
    - Follow up on implementation of audit recommendations
    - Establish a quality assurance and improvement program
  - The IAD staff should use Chapter 5 of the proposed manual to complete risk assessments of all CBS auditable processes as recommended in Section E.
- Strategy note:
  - The IAD has developed a three-year strategy note that mingles with procedural content.
  - Action: Update the strategy note to focus on near-term objectives for the next 12 months while using the internal audit manual for procedures.
  - Specific near-term aims for the next 12 months:
    - (i) develop its first risk-based annual plan;
    - (ii) have at least 1 staff sit for the CIA exam; and
    - (iii) adopt an internal audit manual in line with IPPF requirements.

### Risk-based auditing: recommendations and current progress
- Core principle: Modern internal auditing should add value via risk-based auditing rather than compliance-based auditing.
- Audit universe:
  - Under mission guidance, CBS staff developed the first audit universe containing about 18 major business processes (Appendix X).
- Next steps:
  - Complete the risk assessment of the auditable entities in the audit universe with full awareness of potential fraud risks.
  - The mission team guided CBS staff through the risk assessment method (illustrated in Appendix V Somalia-III and Chapter 5 of the proposed Internal Audit Manual).
  - The mission team assisted with risk assessments of two business processes: the travel claim process and the payroll process.
- Capacity constraints:
  - Meaningful risk assessment requires deep knowledge of CBS business; all IAD staff are relatively new to the CBS and it will take a few years before fully implementing risk-based auditing methodology.

### Accounting, financial statements, and related items (summary of linked sections)
- Accounting capacity:
  - Limited accounting capacity; no accounting standards or frameworks adopted.
  - Transactions are recorded based on cash inflows and outflows.
  - Accounting data maintained in two sources (PeachTree and QuickBooks) and loaded into Excel-based work papers.
  - Result: Trial balance does not balance and cannot be reconciled to support financial statements.
- Financial statements:
  - Financial statements for 2015–2017 have not been prepared or audited.
  - The mission recommended focusing on 2017 and ensuring balances at year’s end are accurate.
- IFRS and systems:
  - The mission presented the IFRS conceptual framework and IAS 1 – Presentation of Financial Statements.
  - The mission prepared an IFRS gap analysis template and reviewed major asset and liability accounts, including IAS 16 given PP&E comprises about 75 percent of the balance sheet.
  - A new accounting system (Oracle ERP) is being installed with a projected “go live” date in November 2017.
  - Vendor advised currency should be the Somalian shilling; mission advised system should record transactions in the functional currency which currently is the U.S. dollar.
  - Action: Ensure accurate balances of all accounts on January 1, 2018; develop accounting test scenarios and obtain user feedback.
- Chart of accounts and accounting manual:
  - A tentative chart of accounts has been developed for the new Oracle system; mission suggested additions for preferred presentation.
  - The accounting team has not drafted an accounting manual; homework includes drafting sections for cash, PP&E, and salary expenses and submitting to the IMF for review.
- Finance department structure:
  - Revised organizational chart anticipates 12 staff dedicated to accounting, budgeting, and IT accounting systems; homework includes allocating the 12 resources and defining associated tasks.

### Timelines and capacity notes
- Anticipated IAD growth: current size three auditors; anticipated future size six–seven auditors.
- Maturation period for risk management capacity: three or five years (mature capacity expected in three or five years).
- Next mission scheduled for first quarter 2018, dependent on homework completion.
- Training sessions agenda dates: Central Bank of Somalia, September 24 – October 5, 2017 (Serena Hotel – Kampala, Uganda).

*Source: cr18293 - 8. The IAD should develop an internal audit charter based on the example provided by the mission team.*

### Appendix II. Training Participants

### Appendix II. Training Participants

### Finance and Internal Audit Department: Participants
- Internal Audit: 3 members comprising the internal audit team.
- Accounting: 3 members of the accounting team.

### Summary of Topics to be Covered in Training Missions (Assumes one week training sessions for each stream)
- Mission schedule:
  - Mission #1: September/Oct 2017
  - Mission #2: First Quarter 2018
  - Mission #3: Second Quarter 2018
  - Future Missions: Depends on level of activities conducted by CBS and progress on IFRS implementation

#### Internal Auditing Stream
- Mission #1 topics:
  - Basic concepts of internal control, risk management, and internal audit
  - Internal Audit Infrastructure (internal audit charter, audit committee charter, internal audit organizational chart, and strategy note)
  - Introduction on the macro-level risk assessment methodology
  - Risk assessment of business processes
  - Development of an audit universe
- Mission #2 topics:
  - Issues from Homework, including the results of risk assessment conducted by CBS of the business processes included in the audit universe
  - Identification of potential audits for next audit year based on the results of risk assessment
  - Introduction on the micro-level risk assessment methodology
  - Development of an audit program for a specific audit project
- Mission #3 topics:
  - Issues from Homework assignments
  - Review of the implementation of the audit program for the specific audit project, including audit objectives, scope, findings, and reporting
  - Review of the implementation of the annual audit plan
  - Walk-through of IIA standards and audit manual relevant to audit engagement planning, fieldwork, documentation, and report
- Future Missions topics:
  - Issues from Homework assignments
  - Review of the implementation of the annual audit plan and major auditing findings
  - Walk-through of IIA Standards and audit manual relevant to staff proficiency and quality assurance and improvement program

#### Accounting Stream
- Mission #1 topics:
  - IFRS Application for Central Banks
  - IFRS Conceptual Framework
  - Accounting Manuals
  - Chart of Accounts
  - IAS 1
  - IAS 16
  - IFRS gap analysis
  - Obtaining accurate year-end balances for 2017
  - Organizational Structure Review
- Mission #2 topics:
  - Issues from Homework Assignments
  - Accounting Manuals continued
  - IMF accounts
  - Notes to Financial Statements
  - IAS 21
  - Cash Flow Statements
  - Retained Earnings and Distributions to Government
  - Other current accounting issues
- Mission #3 topics:
  - Key Requirements for IFRS 1
  - Role of Audit Committee
  - Issues from Homework Assignments
  - Review financial statements and notes for 2017
  - IFRS 1 – First Time Adoption of IFRS: How to prepare and establish formal adoption date
- Future Missions topics (examples listed):
  - IFRS 9
  - IAS 7

### Internal Audit Charter (Example) — Major Provisions
- Purpose:
  - The Internal Audit Department (IAD) of XXX provides independent and objective assurance and consulting activity designed to add value and improve the operations of XXX; evaluate and improve the effectiveness of XXX’s risk management, control, and governance processes.
- Authority:
  - IAD is authorized full, free, and unrestricted access to any and all of XXX records, physical properties, and personnel pertinent to carrying out any engagements.
  - IAD has direct and unrestricted access to XXX management and the Audit Committee.
- Professionalism:
  - IAD follows the mandatory guidance of the International Professional Practice Framework (IPPF) issued by the Institute of Internal Auditors (IIA), including Core Principles, definition of Internal Audit, Code of Ethics, and the International Standards for the Professional Practice of Internal Auditing (Standards).
- Organization:
  - Head of the IAD reports functionally to the Audit Committee and administratively to the Governor of XXX.
  - Audit Committee responsibilities include:
    - Approve the Internal Audit Charter.
    - Approve all decisions regarding the appointment, replacement, and removal of the Head of Internal Audit, including performance evaluation and remuneration.
    - Approve the risk-based annual audit plan and all major changes to the plan; review internal audit activity’s performance relative to its plan.
    - Review and concur with the Governor of XXX on budget, resource plan, and organizational structure of the IAD.
    - Receive communications from the Head of the IAD on results and implementation of audit recommendations.
    - At least once per year, meet privately with the Head of the IAD without management present to discuss matters including independence of IAD.
  - Governor of XXX responsibilities include:
    - Approve IAD’s budget and resource administration sufficient for IAD to fulfill responsibilities and maintain professional development.
    - Invite the Head of the IAD to management meetings required for other department heads and include Head of IAD in internal communications and information flows.
    - Refrain from engaging the Head of the IAD in making management decisions and owning operational responsibilities and risk management responsibilities other than managing IAD.
- Independence and Objectivity:
  - IAD shall remain free from any interference in carrying out its internal audit responsibilities in an unbiased manner, including audit selection, scope, procedures, frequency, timing, sample selection, and report content.
  - Internal auditors and personnel working for IAD shall maintain unbiased mental attitude and shall not subordinate their judgment on audit matters to others.
- Responsibilities:
  - Develop risk-based annual audit plan to prioritize audit selections and resource deployment to cover all activities.
  - Conduct financial, operational, compliance, and IT audits.
  - Perform advisory or consulting services upon request of XXX management or Audit Committee.
  - Perform inspection and investigations upon request of XXX management and under authorization of Audit Committee.
  - Coordinate and share information with other internal oversight functions and external parties under guidance of Audit Committee.
  - Follow up, monitor, and evaluate management’s implementation of action plans in response to audits.
  - Develop and maintain a quality assurance and improvement program (QAIP) that includes an external quality assessment once every five years.
  - Develop and maintain a continuous professional development and education plan.
  - Report to XXX management and Audit Committee on results of audits, advisory engagements, and QAIP.
  - Confirm to the Audit Committee, at least annually, the organizational independence of the internal audit activity.
  - Play the secretariat role for the Audit Committee and perform other activities upon request.
  - The IAD shall not participate in the risk management of CBS.

### Audit Committee Charter — Major Provisions
- Purpose:
  - Assist the board of directors in oversight of the financial reporting process, the system of internal control, the audit process, and CBS’ compliance monitoring and code of conduct.
- Authority:
  - Empowered to appoint, compensate, and oversee the work of any registered public accounting firm employed by the CBS or the statutory external auditor.
  - Resolve disagreements between management and the auditor regarding financial reporting and accounting.
  - Pre-approve all auditing and non-audit services.
  - Retain independent counsel, accountants, or others to advise the committee or assist in investigations.
  - Seek any information from employees or external parties and meet with CBS officials, auditors, or outside counsel as necessary.
- Composition:
  - The audit committee will consist of at least three independent members, selected from the external board of directors or appointed by the board from outside CBS.
  - Each committee member will be independent and financially literate; at least one member shall be designated as the “financial expert.”
- Meetings:
  - The committee will meet at least four times a year, with authority to convene additional meetings.
  - All committee members are expected to attend each meeting in person or via tele- or video-conference.
  - The committee will invite management, auditors, or others as necessary and will hold private meetings with auditors and executive sessions. Agendas and minutes will be prepared.
- Duties and Responsibilities — Financial Statements:
  - Review significant accounting and reporting issues, including complex or unusual transactions and highly judgmental areas.
  - Review with management and the external auditors the results of the audit, including difficulties encountered.
  - Review annual financial statements for completeness and appropriate accounting principles.
  - Review other sections of annual report and regulatory filings before release.
  - Review matters required to be communicated under International Financial Accounting Standards.
  - Understand how management develops interim financial information and auditor involvement.
  - Review interim financial reports before filing with regulators.
  - Review and approve accounting policies and procedures annually.
- Duties and Responsibilities — Internal Control and Risk Management:
  - Consider effectiveness of CBS' internal control system, including IT security and control.
  - Understand scope of auditors' review of internal control over financial reporting and obtain reports on significant findings with management responses.
  - Discuss CBS’ policies on risk assessment and risk management, including risk of fraud and major financial exposures, and review antifraud programs and controls as needed.
- Duties and Responsibilities — Internal Audit:
  - Approve the Internal Audit Charter.
  - Concur with management on appointment, replacement, and removal of the Head of Internal Audit, including performance evaluation and remuneration.
  - Approve the risk-based annual audit plan and major changes; review internal audit activity’s performance.
  - Review and concur with the Governor on budget, resource plan, and organizational structure of the IAD and inquire about scope or budget limitations.
  - Receive communications from the Head of IAD on results and implementation of audit recommendations and make inquiries to determine whether management has taken actions.
  - Meet privately at least once per year with Head of IAD to discuss matters including independence of the IAD.
  - Require an external quality assessment (EQA) of internal audit at least once every five years; select or concur in selection of EQA provider, review results, and approve and follow up on action plans.
- Duties and Responsibilities — External Audit:
  - Review external auditors' proposed audit scope and approach, including coordination with internal audit.
  - Review performance of external auditors and exercise final approval on selection, appointment, and discharge of external auditors.
  - Review and confirm independence of external auditors by obtaining statements on relationships and discussing relationships with auditors.
  - Meet separately with external auditors on a regular basis as needed.
- Duties and Responsibilities — Compliance:
  - Review effectiveness of system for monitoring compliance with laws and regulations and results of management's investigations and follow-up.
  - Review findings of regulatory examinations and auditor observations.
  - Review process for communicating code of conduct and monitoring compliance.
  - Obtain regular updates from management and CBS legal counsel regarding compliance matters.
- Reporting Responsibilities:
  - Regularly report to the board of directors about committee activities, issues, and recommendations.
  - Provide open communication between internal audit, external auditors, and the board of directors.
  - Review any other reports CBS issues that relate to committee responsibilities.
- Other Responsibilities:
  - Perform other activities related to the charter as requested by the board.
  - Institute and oversee special investigations as needed.
  - Review and assess adequacy of the committee charter annually and request board approval for changes.
  - Confirm annually that all responsibilities have been carried out and evaluate the committee's and individual members' performance on a regular basis.

*Source: Mission Team Working Paper*

---


_Source: https://www.imf.org/-/media/files/publications/cr/2018/cr18293.pdf_