The 2019 Audit report from the National Audit Office (NAO) has revealed a number of flaws in internal auditing at Kosovo’s institutions, stressing that internal control systems are still not yet at a satisfactory level. 

The report states that, despite improvements compared to last year, internal audits are still more oriented towards ensuring financial regularity rather than assessing performance. Furthermore there are still many institutions without a complete Internal Audit Unit, IAU, while some have not established one at all. 

Luljeta Morina, the lead auditor at the department for municipalities at the NAO, outlined to BIRN the legal infrastructure that regulates the criteria for establishing IAUs.

“Budget institutions with a less than 3 million euro budget are not required to establish IAUs – instead they receive auditing services through another public institution that has an established internal audit unit,” she explained. “This must be done with the approval of the Ministry of Finance, although they can also hire a professional internal auditing company, again with approval from the Ministry of Finance, or jointly establish an IAU with another institution, also with the approval of the Ministry of Finance.”

There are currently 70 public institutions that fulfil the criteria for establishing IAUs, as required by Regulation 01/2019 on the Establishment and Implementation of Internal Audit. Of this total, five have still not yet established an IAU, with this failure put down to either a lack of budget, negligence or issues with the recruitment process. 

Meanwhile, Article 5 of Regulation 01/2019 states that a public institution with a budget of 3-7 million euros must have at least two internal auditors, whereas institutions with a budget exceeding 7 million euros must have at least three internal auditors. However, of the institutions that have established an IAU, more than half have a lower number of auditors than envisaged by the Regulation. 

A failure to establish Audit Committees is also an ongoing issue, with the NAO report revealing that “of the 65 institutions monitored, Audit Committees were not established at six in 2019: The Municipalities of South Mitrovica and Ranilug, the Property Comparison and Verification Agency, the Central Election Commission, the Ombudsperson Institution and the Ministry of Education and Science.” 

Furthermore, of the 57 institutions in which Audit Committees were operational, at 15 there were fewer than the four annual meetings required by the Administrative Instruction held. In addition to this, 28 Audit Committees have not submitted their annual report as required by Article 10 of the Administrative Instruction, which, according to the NAO, demonstrates the fact that Audit Committees are not yet fully effective in supporting IAUs. 

Accountability and challenges faced by internal auditors 

In terms of accountability, Luljeta Morina explained to BIRN the chain of command regarding who internal auditors report to. “At the local level, they directly report to the Mayor, who also approves their annual work plan,” she said. “If there are any requests for extraordinary audits not foreseen in the annual plan, then the audit is performed at the request of the Mayor.” 

Morina added that at Kosovo’s ministries internal auditors report to the Minister, while in public enterprises they report to the company’s Board, which establishes an Internal Audit Committee made up of the Board of Directors. 

Meanwhile, the new Law on Salaries foresees salaries for internal auditors at Kosovo’s institutions being equivalent to those of staff at the NAO. However, this Law has not yet come into force due to negligence and issues surrounding the Law that have not been regulated yet, meaning that salaries of internal auditors are still regulated through the old law. 

Morina told BIRN that, under the old law, salaries are vastly different depending on where an internal auditor is hired. Within ministries, salaries are set so that a director of an IAU is equivalent to that of a permanent secretary, while other officials’ salaries work around a coefficient of roughly 700 euros. 

However, the auditor explained that at public enterprises the situation is different, as salaries are set based on the budget available meaning there is no uniform pay rate. She added that a key problem for staffing IAUs at public enterprises is a lack of budget, as well as a lack of properly qualified applicants, with the new Law requiring a licence as an internal auditor.

Morina says that when the NAO starts auditing an institution, the first thing they are obliged to do is examine reports from the IAU, and assess their quality. According to Morina, from interviews the Office has conducted with IAU officials as part of this process, they have not stated that they lack independence.

“As an audit technique, we conduct interviews with internal auditors, and, at least in the statements given to us, none of them have mentioned a lack of independence. In fact, they are happy to at least be independent,” she said. 

However, the auditor believes it is possible, at least based on previous experience, that some internal auditors are not very professionally developed. She stated that while most auditing officials are well prepared, there are some officials at municipalities that lack specialist knowledge due to an absence of training.

Asked whether internal auditors face pressure, Morina said that she has received no reports of this nature. “I have no information that they have such hindrances,” she said. “But I would like to raise the issue of Audit Committees, which are responsible for controlling the quality of [the IAU’s] work and recommendations, as well as pressuring the management to implement the recommendations.” 

Morina added that an Audit Committee is the one body that could push a Mayor or a minister to implement recommendations of the internal audit unit. 

Vacant positions and dismissals at Public Enterprises 

Kosovo’s public enterprises continue to have many flaws in financial management and controls, and essential improvements are needed. Due to the poor quality of financial systems presented in Annual Financial Statements by Public Enterprises, the NAO gave an Unmodified Opinion on 13 of the 14 public enterprises audited, while it was also highlighted that individual financial statements from some enterprises contained material mistakes. 

At Stacioni i Autobusëve Sh.A, the public enterprise operating the main bus station in Prishtina, the NAO found that the position of internal auditor was left vacant until April 2020. Despite the enterprise carrying out a recruitment procedure to fill the position, they were not able to successfully recruit someone due to a lack of applicants, and therefore had to relaunch the vacancy. 

NAO auditor Luljeta Morina confirmed that the public enterprise did not have an IAU established, but said that the situation was addressed this year. 

“The National Audit Office audited 14 public enterprises last year, with two of them lacking an Internal Audit Unit,” Morina said. “Stacioni i Autobusëve in Prishtina confirmed during the reporting stage of the final meeting that they have implemented this recommendation in 2020. Therefore, according to the information provided by the directors there, they have established an IAU.” 

However, Morina added that at the other public enterprise identified, KRM “Uniteti”, no IAU had been established, even in 2020. 

While some public enterprises had vacant positions for internal auditors, others removed auditors from their staff. In May, BIRN reported that the Board of the Regional Water Company in Prishtina, KRU Prishtina, had dismissed its internal auditor, reports confirmed by the head of the Board, Mentor Hyseni. 

According to Hyseni, the reason for the dismissal was a lack of auditing in high risk areas. “The Committee informed me that the reason was the lack of audits in risky areas. Even as the head of the Board, the only body with authority over [the IAU] is the Audit Committee,” he said.

The same fate fell upon the internal auditor at Kosovo Post, Blerim Krasniqi, whose dismissal was made public through a press release, although no further details were provided. Mimoza Vila was appointed as the acting internal auditor. 

The announcement stated that “the Audit Committee of the public enterprise Kosovo Post held a meeting today and issued the following decisions: Mr. Blerim Krasniqi is dismissed from the position of Internal Audit Official at the Kosovo Post public enterprise. Mrs. Mimoza Vila has been appointed as the acting Internal Audit Official.”

In the report for 2019, no recommendations were provided to the Hekurudhat e Kosovës Sh.A public enterprise, but similar problems related to hiring auditors were flagged up in the reports for 2017 and 2018. Meanwhile, the report on the Bifurkacioni public enterprise states that the company has not fully implemented its working plan due to the inefficient functioning of the IAU and a lack of oversight from the Audit Committee. 

Organized disorganisation of internal auditing in municipalities 

Examining the audit reports for Kosovo’s Municipalities reveals various reasons provided for the shortcomings and weaknesses in the functioning of internal auditing. 

For example, the Municipalities of Drenas, Kacanik and Skenderaj all state that their IAUs were not completed according to the criteria due to a lack of approval on recruiting new staff, an issue highlighted by other municipalities as well. 

Meanwhile, at the Municipality of Gjakova, the head of the Audit Committee also held the position of the head of the economic directorate, which is in contradiction with the administrative instruction, leading to the non-functioning of the committee.

The problems in Gjakova occurred due to carelessness by the management when replacing the head of the Audit Committee. Meanwhile a similar case happened in the Municipality of Shtime, where the Audit Committee was completely composed of internal members, again due to insufficient attention paid by the Mayor. Another Audit Committee, this time at the Municipality of Mitrovica, was not established due to an apparent failure to find external individuals to sit on the committee.

Unlike KRU Prishtina, who dismissed its internal auditor for not auditing high risk areas, according to its audit report, the Municipality of Fushe Kosove failed to follow suit. The report for the municipality noted that the internal audit did not cover high risk areas such as own source revenue, expenditures through public procurement, and subsidies. 

Meanwhile, the inability to compensate members of the Committee for their work meant that no meetings were held by the Internal Audit Committee at the Municipality of Ferizaj throughout 2019. 

Speaking to BIRN, Luljeta Morina explained Kosovo’s northern and Serb-majority municipalities’ obligations in regards to the establishment of internal audit units, revealing that the municipalities of Zubin Potok, North Mitrovica, Leposavic, Kllokot and Partesh have not established IAUs. 

However, she added that with the new Law and regulation, only the municipalities of North Mitrovica and Leposavic are obliged to have an IAU, as their budget exceeds 3 million euros, whereas the other municipalities have no such obligation. 

According to Morina, the Municipality of North Mitrovica has not established an IAU as, despite attempting to recruit for the Unit, the vacancy received only one applicant and was later annulled due to unclarities over the level of salary. 

The auditor added that, based on her information, the municipality of Zvecan used the internal auditing services of the Ministry of Finance last year in order to conduct its obligatory annual internal audit. The municipality of Mamusha also requested similar services from the Ministry of Finance, however, as they made their request late, they did not receive the service. 

Meanwhile, ministries continue to ignore internal auditing, while a large proportion of Ministries have not completed the establishment of either an IAU or an Audit Committee. The Ministry of Local Government and the Ministry of Labour and Social Welfare have fully functional Internal Audit Units, and implement recommendations at a satisfactory level. However, most other ministries have not completed establishing an IAU or an Audit Committee, while some do not take into account recommendations given by internal auditors. 

The Ministry of Public Administration and the Ministry of Justice had an especially low level of implementation of recommendations, having implemented less than half of them at 48%. Problems have also been noted in other ministries, including those responsible for education, rural development and internal affairs. 

Chronology of the Law

After being decreed by former President Hashim Thaci, the Law on Internal Control of Public Finances entered into force in April 2018. This was followed by the Administrative Instruction on the Establishment of Audit Committees and the Regulation on Establishing and Implementing Internal Audit, which started to be implemented at the beginning of 2019. 

The new Law, composed of six chapters and 36 articles, aims to regulate internal controls on public finances, including financial management and controls and internal auditing. Internal auditing is covered in chapter three of the Law, with nine articles regulating the functioning and principles of internal auditing, recruitment, rights and responsibilities, limitations and conflicts of interest. 

Advancing internal auditing was also listed as one of the objectives of the Strategy on Internal Controls on Public Finances 2015-2019, which aimed to implement a program of professional development, quality and compliance alongside the legal framework, in order for internal auditors to have the necessary professional qualifications. 

Before the new law entered into force, many debates were held on how to realise the Strategy. In October 2016, the draft-Law on Internal Controls on Public Finances was presented to the Parliamentary Committee on Public Finance Oversight, which was led by former MP, Faton Topalli. 

In the discussions held during the Parliamentary Committee, former MP Ali Sadriu identified the issue of public enterprises not having been included in the law, whereas a former member of the Committee, MP Synavere Rysha stated the corruption cannot be fought by degrading auditors.