Many weaknesses have been reported in the functioning of the Internal Audit Units, IAU, and Audit Committees in an analysis conducted about their functioning, within various Kosovo institutions, BIRN reports.

The Ministry of Finance, MF, Ministry of Agriculture, Forestry and Rural Development, MAFRD, Ministry of Education, Science and Technology, MEST, Radio Television of Kosovo, and the Independent Commission for Mines and Minerals Commission, ICMM, have all been included in the investigation.

The implementation of audit recommendations and the actions undertaken by the management to improve existing processes and controls are the best indicators of an effective governance. However, the level of fulfilment of recommendations was low, in the majority of the institutions. This happens due to lack of plans for their full implementation.

The lack of implementation and inadequate treatment of internal auditor reports has negatively affected the effective functioning of controls, thus enabling mistakes and shortcomings to be repeated year after year.

In the first part of 2018, the Public Internal Financial Control Law was adopted and the Ministry of Finance adopted the “Book on processes in managing public expenditures,” a document that identifies risks and provides guidance on how to manage them.

In some cases, lack of effective cooperation between the management, auditing committees and internal audit units has been noted in identifying the causes for weaknesses and in undertaking concrete action.

Due to the flaws, the government is in the process of adopting the Draft Regulation QRK 0 No. 00/2018 on the Establishment and Implementation of Internal Audit Functions in Public Sector Entities. The documents is currently undergoing the public consultation phase.

This draft regulation sets new criteria for the establishment of internal audit units in public sector entities.

This document enables entities at the central and local level to choose one of four forms of implementation for internal audit units’ functions, or to simply deal with internal auditing through outsourcing or upon the request of the Ministry of Finance and up to the established internal audit units.

Additionally, this regulation creates conditions for an internal audit unit to be established with two or more auditors, compared to the previous instruction that required one auditor only.

This has been deemed insufficient, as one single auditor cannot be fully objective, transparent and independent in providing recommendations. According to this regulation, the internal audit function, through contracting services, is performed by a professional company that uses the internal audit methodology approved by the Ministry of Finance.

Hence, it has been deemed crucial for the auditing committees to strengthen their role by keeping the management accountable for the implementation of recommendations. This has not only not happened in practice but these committees have not been functional at all in some institutions.

The Ministry of Finance has a functional internal auditing system, which is organized in two divisions – the one on internal auditing at the Ministry of Finance and the Division for Audits outside of the MF dedicated to institutions that have not established the internal audit units.

The Cupola of Internal Auditing

The Ministry of Finance is one of the key institutions in regards to internal audits. This institution has an internal audit unit composed of the director and seven officials. The Internal Audit Unit is organized in two division: one for audits within the MF and the Division for Audits outside the MF, in entities that have not established Internal Audit Units.

The IAU had planned to conduct 18 audits during 2017, while it actually did 22. According to the plan, within the Ministry 10 audits were foreseen to be conducted, outside of the MF eight audits while another four audits were conducted based on “ad-hoc” requests. Although these audits resulted in findings and recommendations, nevertheless the scope of the audits treated activities and operations systems of the previous year in about 70% of the cases. This approach decreases security or the opportunity to undertake preventive measures which can be used by the management in strengthening internal controls.

For this reason, the National Audit Office recommended the Minister and the Audit Committee to ensure that the IAU plan is considerably based on current scope of activities of the current year.

“A proactive approach would increase the benefits from IAU and enable addressing of potential irregularities/deviances in the control systems timely and adequately”.

Although the management has implemented a number of internal controls to ensure that the systems are functioning properly, it was suggested that the MF should pay more attention to the scale of implementation of the budget, processes and developments in the fields of procurement and personnel.

In regards to the Auditing Committee, the latter was active and held four meetings where the reports of the Internal Audit Units were discussed together with the recommendations that came out of these reports as well as the recommendations of the NAO reports for the 2016 year.

“We are forwarding you the records from the Internal Audit Department of the Ministry of Finances and at the same time we inform you that we have completed the annual plan for 2017 and surpassed it with 6 pilot audits while also for 2018 we are implementing the plan and we have completed two additional pilot audits (National Training Program and the Certification of Internal Auditors at the public sector)” says the written response of the Ministry of Finances.

Amongst the challenges, this ministry mentioned raising the internal controls in line with the organization structure and functions.

“…the functioning of internal control systems in line with legislation, rules and accompanying instructions, budget planning, processes, planning, realisation of the budget and the human resources engaged in managing expenditures” states their response.

Ministry of Agriculture with a non-functional Auditing Committee

The Internal Audit Unit, IAU, at the Ministry of Agriculture, Forestry and Rural Development operates with four staff members – the director of IAU and three auditors.

The IAU has approved the annual audit plan, based on the strategic plan. This division had planned to conduct ten audits during 2017 while majority of them were of high risk scopes. By the end of the year, the IAU had completed all the planned audits.

However, the National Audit Office found a number of weaknesses related to the current operations of the IAU. During 2017, the Audit Committee was not functional as it is required by the 11/2010 for the Establishment and Functioning of these Committees.

Low productivity was also noted in terms of implementation of recommendations of the Internal Audit. 54% or only 42 out of 77 recommendations provided to the management were implemented. 30 are in the process of being implemented and five remain completely not implemented. The situation is almost the same for 2017, in terms of implementation of recommendations.

This Ministry had weaknesses also in terms of the Audit Committees (AC), the latter being responsible to ensure that the management complies with the recommendations of the Internal Audit Unit. During 2016, the Audit Committee held two meetings, while their quality and contribution was not at the proper level overall and did not add value to improvements in governance and internal controls of the organisation.

NAO has recommended this Ministry to ensure the functioning of the Audit Committee, to review the results of the internal audit and the actions that should be undertaken from the management in terms of the recommendations.

MEST does not treat the “high risk” fields

The Internal Audit Division of the Ministry of Education, Science and Technology is defined as an independent unit that aims to ensure objective security and advising the management in order to improve the work of the institution.

The IAU operates with two staff members – the director of the IAU and one auditor. Referring to the National Audit Office, in the annual audit plan for 2017, IAU had planned to conduct nine audits. Out the planned number, the IAU achieved to complete six of them and another two audits upon the request of the management. The auditing activities had primarily covered 2016, which was evidenced in the five completed reports. This had the effect in the management not having a clear view of the security level and the functioning of the internal controls. Thus, the audits that were not completed were the one on the Department of the Budget and Finances, of the Students Centre and the audit of the Institute of History. In regards to the Students Centre, MEST justified this by stating that this audit was planned for October-November but “on September 29, 2017, we had a request for an extraordinary audit in the Administration by the Minister of MEST hence the Students Centre was audited in January 2018.”

The audit unit of MEST said that the audits start from January of the current year “and in the first audits we cannot audit the current period as it is the beginning of the year and we cannot audit the first week of January or to conduct one-month or two-moth audits.”

The IAU justified this by saying that it is their practice to audit three-monthly or six-monthly or even nine-month reports or the entire year covering January-December for the audits conducted in the end of the year. Hence, IAU had asked the NAO to suggest if they have any recommendations how to audit the current period for the first months of the year.

But, according to NAO, this is only a justification without providing any proof and that the Student Centre was neither audited in 2016 and nor 2017. Further, NAO had concluded that the high risk fields should be the main priority of the internal audits.

According to the National Auditor, the work of this unit was primarily focused in auditing activities of 2016, while the focus should have been in 2017, as it is described in the findings.

“We gave them the necessary recommendations on what should be done while if it is not clear to you and you need training please address the Central Harmonisation Unit” says the opinion of the NAO.

Another recommendation remains not implemented by MEST which related to the University of Prizren. The requirement was for the Rector and the General Secretary of this university to find an immediate solution for the internal audit staff and the staff of the official for assets. The internal auditor at this university continues to be paid without conducting any audits.

Irregularities have also been noted in the reports that MEST had provided to the National Audit Office while it was being audited. The revised action plans from the audited units were not attached.

In regards to the Audit Committee, MEST had provided an annual report of the Audit Committee with a delay, precisely after the field work was completed while the report was not signed. Furthermore, this report mentions audit reports that were completed for 2016 but not all the reports of the year 2017.

For this reason, the General Auditor did not rely on the work of IAU due to the mere fact that their objectives were not the same and five audit reports had the focus in 2016.

There are also other weaknesses in MEST related to the work of the Internal Audit Unit. The revisions of the internal audit have not treated the capital investment for the current year. Out of the eight completed report, only three of them had focused on 2017.

Another weakness identified was the lack of preparation of the action plan by the units that had been audited by the internal audit. Meanwhile, the Audit Committee had held three regular meeting but they had not compiled a final report with general conclusion about the internal audit reports.

These results reflect on the lack of responsibility of the management in recognizing and maximizing on the benefit of the internal audit and to demand security of the effective functioning of internal controls. This also shows weak quality of planning in the internal audit.

The internal audit has not provided the adequate security in regards to the effectiveness of the internal controls neither. According to NAO, the lack of the anticipated contribution from IAU increases the risk that the internal controls will not improve.

Hence, it was recommended that in order to reach maximal benefit from the internal audit, the Minister should ensure that the IAU plan is based in the fields at risk that help the operational activities continuously.  On the other hand, the Audit Committee should review the results of the internal audit and the actions undertaken by the management in regards to the internal audit recommendations.

Low productivity in implementing recommendations was also concluded for 2016. The internal audit reports were not treated seriously by the management. Although there were 40 recommendations provided, monitoring of the process of their implementation was lacking. Consequently, there is not accurate information as to how many recommendations were implemented.

At the same time, the Audit Committee held three meetings but without giving meaningful contribution in improving internal controls, because based on the conclusions of the National Audit Office, no actions were undertaken by the AC to push forward the recommendations of the IAU.

MEST provided a generalized response in regards to the findings concluded. The spokesperson of this institution, Valmir Gashi said that the Internal Audit Unit for the past two years had a positive performance from the Management.

“The number of audits conducted by the Audit Unit is realized in accordance with the annual plan which is signed by the Management and the Audit Committee, for each year it is planned for 8-9 audit to be implemented”, said Gashi. According to him, during 2017, 8 audits were completed and more than 80% of the recommendations were implemented.

“The Audit Committee functions according to the Statute of the Committee and for 2017 there were four meetings held”, stated Gashi.

Internal Audits in RTK, not mentioned in the Audit Reports

The Radio Television of Kosovo is a public broadcaster. Until 2012, RTK was audited by an external auditor, but with the entry into force of the new law, an external audit is selected through a tender. This year, RTK will be audited by an external auditor for the first time. RTK was continuously criticised that it could not establish a functional environment of internal controls.

A new law has been initiated for the Public Broadcaster. But, in November this year, the law failed to be adopted at Kosovo Assembly. A problematic issue is its financing, with two main sources being proposed – one in the form of prepayment and the second from the state budget. Electricity bills was proposed as a criteria, but this was rejected by the opposition.

The Independent Audit Report concluded that the financial statements give a true and fair view of the state of the company as of December 31, 2016, and its financial performance and income for the year ended in accordance with the International Financial Reporting Standards (IRSF)”. The issues have been treated in the context of auditing financial statements as a whole but the Independent Auditor did not provide a specific opinion on these matters. In the audit report of RTK, the functioning of the Internal Auditor is not mentioned at all.

RTK has established the Internal Audit Unit (IAU) on June 2016, which is composed of three auditors. This unit exercises its functions in accordance with the Law and the Statute of RTK, the Law on Internal Audit and the International Internal Auditing Standards.

The IAU reports to the Board through the Audit Committee (AC), the latter being composed of fine members. According to their defined duties, the IAU aims to help RTK in fulfilling the objectives through provision of high quality services, by ensuring implementation of legality, improving the corporate governance and by encouraging implementation of risk management and economic, efficient and effective usage of human and financial resources.

According to what is written in the RTK report for 2016, IAU has completed four planned audit and one accompanying report of following up the implementation of recommendations. The fields covered based on the risk analysis were: procurement, finances, administration and marketing.

During 2017, the IAU provided 21 recommendations, out of which 16 recommendations or about 76 per cent were immediately implemented, 5 recommendations or 24 per cent are in the process of implementation with the justification that time is needed until some processes are repeated. For all the recommendations provided by the IAU, the responsible units and persons who will implement the recommendations during 2018 have been identified.

A Performance Audit for the RTK will be conducted by the National Audit Office, NAO, as a result of the recommendation of the Public Finance Oversight Commission made on March 1, 2017.

The Chairwoman of the Board of RTK, Aferdita Maliqi spoke about the work of the Internal Audit Unit of the Radio Television of Kosova. IAU RTK, until now.

According to her, the mission of this Unit is to provide independent, objective, ensuring and advisory services, designed to add value to and improve the services of RTK.

“The IAU helps RTK in reaching its objective by bringing a systematic and disciplined approach in assessing and improving the effectiveness of processes of risk management, internal control and governance,” said Maliqi.

She added that the Internal Audit verifies the functioning of the internal control mechanisms and provides recommendations on their improvement.

“This is done through preparation of internal reports for parties involved in decision-making. In the case of the RTK, the IAU operates independently from the Management and reports to the Board.”

The activity of the IAU for the period of 2016-2018 according to Maliqi was primarily focused on topics such as: employment, salaries, asset management, expenditures for different economic categories, public procurement income from Marketing, information technology system etc.

“For your information, the activity of IAU was presented in the annual reports of RTK for the said period, which were delivered to the Assembly of the Republic of Kosovo’, she stated.

Some of the activities implemented by IAU during 2016 were: providing input on compiling the Internal Audit Regulation; providing input in compiling the Code of Ethics of the IAU, Compiling the Strategic Plan of the Internal Audit for the period of 2016-2018; Compiling the Annual Plan of Audit for 2016; Compiling five audit reports; Compiling one accompanying report on following up implementation of recommendations; Quarterly report of IAU to the Audit Committee.

Maliqi said that during 2016 there 36 recommendations provided “out of which 20 recommendations have been implemented or 55.5 per cent while in the process of implementation are another 16 recommendations or 44.4 per cent”.

Meanwhile during 2017, the Compilation of the Annual Audit Plan for 2018 was done; Compilation of four audit reports; Compilation of one follow up report to see the implementation of recommendations; Quarterly report of IAU to the Audit Committee; Active participation in the Internal Auditor Groups of the European Broadcaster Union, EBU.

According to the statistics made available by the Board, during 2017, 21 recommendations were provided out of which 16 recommendations were fulfilled or 80.95 per cent while five recommendations or 19.04 per cent are in the process of implementation of recommendations.

On the other hand, during 2018 the Compilation of the Action Plan of the audit for 2018 was conducted; Compilation of three audit reports and one audit which is ongoing; the Compilation of the Strategic Plan for the Internal Audit 2019-2021; Compilation of the Annual Action Plan of the Audit for 2019; Quarterly report of UAI to the Audit Committee; Active participation in the Internal Auditor Groups of the European Broadcaster Union, EBU.

“As per the set practice for the third year now, with the completion of the last foreseen audit for 2018, UAI will assess the implementation of all the recommendations provided during the current year” said the Chairwoman of the RTK board.

According to her through the years, the operation of RTK have seen significant improvements “where the number of recommendations has seen a decreasing trend while the percentage of their implementation has increased.”

With the new draft law, the board reviews the budget of RTK, which is a public document and after the revision of the Board, the budget undergoes an audit from the National Audit Office. The Board also reviews and published the annual financial reports of income and expenditures for the previous year which is done latest by March 31, while the budget is prepared by the RTK management and undergoes auditing by the NAO.

ICMM: Continued illegal operations

The Independent Commission for Mines and Mineral – ICMM is an Independent Agency that regulates the mineral activities in Kosovo in accordance with the law No. 03/L-163 for Mines and Minerals.

The IAU is composed of one auditor only who is also the director of this Unit. The IAU had planned and completed five regular audits during 2017. The conducted audits cover the joint department for mines and minerals (scope of work 2016/2017), financial department (2017) and the department of procurement (scope of work 2017.)

Additionally, the IAU reported every three months to the Central Harmonisation Unit of the Ministry of Finances.

The Audit Committee held four meetings. The issues raised by the audit reports were assessed and treated by them and conclusions and recommendations for the management were generated.

But the internal audit reports have not been properly dealt with by the management as only a relatively small number of recommendations were implemented. Out of 62 analytical recommendations provided in the six audit report, 47 or 75 per cent were not implemented. The recommendations that were not implemented were related to lack of reports about the bearers of licences, continuation of illegal operations and the increase of receivables year by year.

The ICMM also talked about the implementation of recommendations which were not included in the Report of the National Auditor. According to them “the Audit Report of the Financial Statements of the Independent Commission for Mines and Minerals for the year ended on 31.12.2017”, there are no findings on the Internal Audit Systems at the ICMM.

But, according to the clarifications provided, it was an issue treated in the scope of the report in the form of a special chapter – Good Governance (that meant that the Internal Audit System is a special sub-issue there). About it, there was only one conclusion based on the results of the analysis and assessments made according to the work methodology, but there are no recommendations there.

Sokol Boqolli is the director of the Internal Audit Unit at the ICMM. In regards to the level of implementation of the recommendations he says that the situation has improved significantly since the moment of publication of this report and it still continues improving.

“The management has addressed the findings and the recommendations through its official and in cooperation with the IAU have undertaken all the required actions foreseen in the approved documents (The Action Plans of the Management,” said Boqolli.

According to him, the ICMM Board was informed on a monthly and quarterly basis on the state and respectively the level of implementation of recommendations “while for all the shortcomings and eventual obstacles faces in the process of the implementation, through cooperation with the Director and the responsible officials all the necessary actions to implement the recommendations were undertaken, in the scope of their rights and responsibilities,”

In the Internal Audit reports there were 53 recommendations provided. According to the National Audit Office, out of the 53, 30 were implemented, five were in the process of implementation while 8 recommendations have been implemented at all.

But, at the ICMM they say that the current situation with the recommendations is that 45 have been implemented, six are in the process of implementation and two have not been implemented.

Boqolli emphasized that for the two last recommendations that remain unimplemented, one has a deadline until the end of this year while the second was affected by the Law on Mines and Minerals that is currently under the amending process and its adoption by the Assembly of Kosovo is expected to happen soon. He added that for the 6 recommendations that are in process either there is still time left for implementation or that the responsible parties for its implementation are outside the ICMM itself.

“These are the main causes and reasons primarily that affected the lack of implementation in due time,” he said.

The findings of the previous year on the Annual Financial Statements 2016, according to Begolli, have positively contributed in improving the situation for the upcoming years, “which may be proved in the upcoming report for the year you are referring to (year 2017) which has been treated as an issue but not as a finding.”