Two new ministries created by the outgoing government of Kosovo, the Ministry of Regional Development and the Ministry of Innovation and Entrepreneurship, have been working without an Internal Audit Unit, IAU, for months.

The Ministry of Regional Development was established at the end of 2017 but is still yet to set up an IAU. The ministry told BIRN that it was able to secure the assistance of the Ministry of Finance to conduct internal audits while the Unit was being established, but that the dissolution of the government resulted in the recruitment process to staff the IAU being suspended. 

Meanwhile, the Ministry of Innovation and Entrepreneurship conducted the recruitment procedure for its IAU through an internal vacancy but the positions were not filled. Later, the Ministry of Public Administration requested that recruiting for all vacancies at the Ministry of Innovation and Entrepreneurship be suspended as a result of the dissolution of the government.

On the other hand, long established institutions, including ministries, municipalities, and public enterprises, which contain IAUs have often not implemented all of the recommendations provided. 

In its 2018 report on the Ministry of Diaspora and Strategic Investment, the National Audit Office, NAO, highlighted the partial implementation of IAU recommendations. Out of a total of 17 recommendations provided by the internal auditor, only seven were implemented, another seven were in the process of being implemented, whereas three were not implemented at all.

The Municipality of Prishtina has also faced challenges in applying internal audits. Six internal audits were foreseen in its IAU’s annual plan, however only one report on the management of assets of the municipality was finalized during this period. The five other audits that were planned have not been finalized.

Meanwhile, in its findings on Kosovo Post, the NAO assessed that the reports conducted by the IAU at the public enterprise were of good quality and concrete recommendations had been provided for further improvements. However, according to the NAO’s report, the finalized audits did not cover the current year, but were focused only on 2017’s activities, and that while the IAU had completed the majority of the planned audits, it had not completed its plan entirely. 

The NAO has stated that a lack of internal auditing results in a failure to identify possible flaws, and a lack of security for the management in regards to the functioning and the efficiency of internal controls.

Ministry of Regional Development without an Internal Audit Unit 

In Administrative Instruction no. 23/2009 on the establishment and functioning of Internal Audit Units in the public sector, article 3 emphasizes that the senior management of a public body should establish an Internal Audit Unit, IAU, upon meeting any of the following criteria: the annual budget exceeds 1 million euros, the number of full-time equivalent staff exceeds 50, and in special cases of high risk, with the consent of the relevant institutions. 

The Ministry of Regional Development, despite fulfilling the first criterion as its annual budget for 2018 was more than 4 million euros, has not been able to establish an IAU. A 2018 report from the National Audit Office, NAO, states that “this was a result of two officials from the ministry, who had undergone internal audit training, not being able to obtain certification.”

However, in the report the NAO also emphasize that, despite not establishing an IAU, the Ministry had taken steps to perform an internal audit by addressing the Ministry of Finance with a request for assistance. “In regards to 2018, it did not receive a response from the Ministry of Finance, specifically the internal audit department, regarding the provision of internal auditing services to the ministry,” the report states.

But in a response provided to BIRN, the Ministry of Regional Development stated that it had been able to secure the assistance of the Ministry of Finance for its internal audit, and the audit is currently being conducted.

“In regards to the establishment of an Internal Audit Unit, the Ministry of Regional Development has delegated one official for certification, who has already completed the training and is awaiting certification, upon which the Internal Audit Unit will be consolidated,” the ministry said. 

However, according to the ministry, the recruitment process is currently suspended based on the recommendations of the EU Office in Kosovo and the Ministry of Public Administration. 

The shortcomings of the Ministry of Innovation and Entrepreneurship 

The NAO also highlighted that the Ministry of Innovation and Entrepreneurship, despite fulfilling the first criteria for establishing an IAU, having had an annual budget of more than 9 million euros, has also not been able to do so. 

“This happened due to the Ministry not having opened a regular vacancy to fill the position of internal auditor,” the 2018 NAO report reads.

Nevertheless, according to the ministry, it has undertaken steps to address the issue by requesting the Ministry of Finance to assist them with internal auditing for the year 2018, and by signing a memorandum of understanding with another institution. 

Regarding 2018, the ministry says it did not receive a response either from the Ministry of Finance’s Internal Auditing Department or external organizations. “This year, the Ministry of Innovation and Entrepreneurship did not request assistance from the Ministry of Finance to conduct an internal audit. We requested support from the ministry in 2018, but received no response,” the ministry told BIRN.

The Ministry of Innovation and Entrepreneurship also told BIRN that efforts had been made to recruit the staff required for an IAU. “After conducting the recruitment procedures through an internal search and the position remaining vacant, we opened an external call for an internal auditor, before Law No. 06/L-114 for Public Officials entered into force,” Lulzim Ahemti, Head of Communications at the ministry told BIRN. “Eight of the candidates who applied for the vacancy that was open between September 2-16, 2019, entered a written exam.”

However, according to Ahmeti, at the request of the Ministry of Public Administration, recruitment processes were suspended at the Ministry of Innovation and Entrepreneurship after the dissolution of the government, including for the position of internal auditor. 

Trouble in implementing recommendations

According to the NAO, the Ministry of Diaspora and Strategic Investments, which was run by Minister Dardan Gashi for the last two years, has not implemented all of the recommendations provided by the ministry’s Internal Audit Unit, IAU. 

Out of a total of 17 recommendations provided by the internal auditor, seven have been fully implemented, seven are in the process of being implemented, whereas three have not been implemented at all. This is also stated in the annual report that the IAU submitted to the Central Harmonisation Unit at the Ministry of Finance. 

According to the NAO report on the financial statements for the year ending on December 31, 2018, which was addressed to Minister Gashi, “the reason for the lack of full implementation of the recommendations was the insufficient engagement of the responsible staff.” 

According to the Law on Public Internal Financial Control, the Chief Administrative Officer, amongst others, must undertake steps to improve systems in accordance with the recommendations of the internal audit. Additionally, according to the rules on the Functioning of Audit Committees in the Public Sector, it is emphasized that the audit committee should hold at least four meetings a year. 

The Ministry told BIRN that between January and June 2019, the IAU undertook regular monitoring and reporting on the implementation of the recommendations provided, in line with its duties and responsibilities.

“According to the report on the first six months of 2019, there are improvements in the process, and consequently the first recommendation provided by the National Audit Office has been implemented,” Qendresa Fazliu from the ministry’s public communication department told BIRN. “Out of 17 recommendations given for 2018, 14 have been fully implemented, two are in the process of implementation, while one recommendation, relating to advance payments, has not been implemented.” 

Fazliu further noted that for some of the recommendations provided either by the IAU or the NAO, a longer period of time is needed for their implementation as some require the redesigning of control systems. “Hence, even at the suggestion of the IAU, it may be noted that recommendations that are ‘in the process of implementation’ mean that actions have been taken, or they are in the process of their full implementation. Thus, they are not seen as recommendations that were not implemented,” she added.

According to the NAO, the IAU at this ministry operates only with one auditor, who is also the director of the Unit. However, the work foreseen was largely completed. The NAO report on the ministry emphasized that “all planned audits were completed,” and goes on to say that “audit reports were of good quality and adequately proven, they contained the identified flaws in internal control systems as well as recommendations on addressing the identified issues.”

An Audit Committee was established at the ministry, whose mandate ran until July 27, 2018. It held three meetings where the Committee reviewed the findings and recommendations of the IAU, as well as discussing the NAO report. However, according to the NAO, during this period, there was a gap in the operations of the Audit Committee until March 13, 2019, when the new composition of the Audit Committee was established.

The Ministry has also successfully established an IAU. The audit report on the financial statement of the Ministry of Diaspora and Strategic Investments for 2017 states that on July 19, 2017, the ministry established its IAU in line with Administrative Instruction no. 23/2009 on the establishment and functioning of Internal Audit Units in the public sector.

The assessment of the auditor is that although this unit was established only in the second half of the year, the two completed reports were of good quality and provided the management with a clear overview on the manner of operation of internal controls in the audited areas, as well as providing concrete recommendations for further improvements.

Challenges in internal auditing at the Municipality of Prishtina 

According to the NAO’s 2018 report, the Municipality of Prishtina has faced many challenges in conducting internal audits. Six audits were foreseen in the IAU’s annual plan but only one report, which dealt with the management of assets at the municipality, was completed. 

“This came as a consequence of poor management of the audit plan by the IAU,” the NAO report states. “Additionally, the Audit Committee, which was established for the first time, did not undertake any actions. The reason for the IAU not functioning according to the plan were the challenges that the manager of the Unit faced.”

The NAO warned that the issues highlighted demonstrates a lack of readiness to acknowledge and maximize the benefits of internal auditing, or to demand security for the efficient functioning of internal controls.

BIRN submitted questions regarding these issues to the Municipality of Prishtina. However, no response was received by the time of the publication of this article. The IAU at this municipality functions with four staff members, a director (currently an acting director) and three auditors. 

The 2017 report on the Municipality of Prishtina showed a low level of implementation of recommendations compared to the previous year or the year before that. According to the NAO, the lack of formal monitoring of the manner of implementation of recommendations from the General Auditor resulted in a small number of recommendations being fully implemented, whereas the majority are in the process of implementation or remain unimplemented, including recommendations from previous years. 

Unimplemented recommendations, which are repeated continuously, relate to: low level of budget execution, bad classification of expenses, incomplete registration of assets, lack of risk registry, poor performance of the IAU, lack of completion of duties from users of municipal apartments (rent-collectors), incomplete reporting of obligations and a lack of verification of one third of municipal property. 

The NAO further note that continuous weaknesses in management controls and other controls in key financial systems resulted in: irregularities in executing payments and the classification of expenses, a dysfunctional IAU, and weaknesses in managing income and debts.  

Amongst other things, in the 2017 report, it is noted that a number of weaknesses related to current operations of the IAU also exist. “Despite the recommendation provided and the commitments of the management to the functionalization of the IAU, this unit is almost non-functional during 2017 as well,” it states.

According to the NAO, during the whole of 2018, the municipality finalized only one audit report related to the process of income management at the Hivzi Sylejmani Library, while three more audits were ongoing and were initiated with the request of the management. The ongoing audits had the same focus, and dealt with the “Dodona Theatre”, the “Municipal Archives” and the “Cultural Centre for Children in the Municipality of Prishtina”.

Additionally, the auditor emphasized that the IAU had not compiled its statute while the Strategic Plan and the Annual Work Plan were drafted, but were not approved or signed by the Chief Administrative Officer.

Lack of implementation of concrete recommendations of the auditor at Kosovo Post 

In its findings for 2018 for Kosovo Post, the NAO assessed that the public enterprise’s IAU reports were of good quality and concrete recommendations for further improvements were provided. Nevertheless, according to the NAO, the finalized audits did not cover the current year, but were mainly focused on activities from 2017. The report also emphasized that while the IAU has implemented the majority of planned audits, it did not implement its annual plan entirely. 

“The lack of IAU audits for the current period decrease the security provided to the management in regards to the functioning of financial systems,” the report notes. “Additionally, an incomplete IAU program decreases the security provided to the management in regards to the functioning of controls in the enterprise. This may result in unidentified weaknesses and in the continuation of ineffective practices that may result in financial losses for Kosovo Post.”

In regards to this issue, Arsim Mehmeti, Media Relations Officer for Kosovo Post, told BIRN that the issues emphasized in the NAO report had no basis. “In terms of the internal audit, we discussed this with their staff in the meetings we had,” Mehmeti said. “We objected to these conclusions and we explained that they are not relevant to the issues included in the report.” 

Mehmeti also defended the quality of the audits and the decision to focus on 2017’s activities. “The audits were conducted in line with processes of the enterprise and the relevant legislation, regulations and other rules. They provided useful audit reports which help the management to understand the risks as well as practical recommendations on improving control procedures, processes and decisions to address the risks which the enterprise faces,” he said. “In order to do this, together with the Audit Committee we have assessed that our activities for the first part of 2018, should be focused more on the period of 2017, without avoiding activities in the period of 2018. In the second part of 2018, the audits covered 2018 as well, and the reports are proof of this.” 

Despite this, Chairperson of the Board of Kosovo Post, Halit Isufi said that he agreed with the findings and recommendations of the General Auditor in a letter sent to the NAO, and committed to addressing them based on a plan which was to be prepared. 

However, the enterprise emphasized that, according to its Annual Plan, nine audits and three activities were planned. “Out of these, only one audit was not completed although it was in process of completion,” Mehmeti told BIRN. “Thus, the Work Plan in terms of the activities was completely finished, while 90 per cent of the audits were also completed. For the last audit that was not completed, the Audit Committee was informed and this happened due to being engaged in many activities that were deemed to be a priority, and the audit committee has the right to change the Annual Work Plan.”

According to the NAO, the IAU at Kosovo Post operates with two staff members – the IAU director and one auditor. The NAO also states that in order to complete an effective audit a comprehensive work plan is needed which reflects financial risks and other risks of the company as well as providing necessary security on the efficiency of internal controls. 

It further noted that the IAU had prepared an annual plan in which nine audits and three activities were included. “Out of these, eight were implemented during 2018. Through its reports, the IAU provided information to the management on how effective are internal controls and functioning. The internal audit approach was based on the risks and events in the company,” the report stated.