Internal audit and corporate risk management

The Office identified specific risk areas by carrying out a risk management review when compiling the audit workplan.

Given the role internal audit should play in evaluating and improving risk management and control systems the UNHCR Audit Service embarked, in late 2004, on a risk management pilot project.

At the operational level, the Office of Audit and Performance Review has already started adopting a preliminary risk based audit planning methodology with the purpose of improving the country office audit coverage (para.

Also, the Office of Audit and Performance Review has been reviewing its audit planning methodology with a view to adopting a more formal risk based approach.

Urges UNDP and UNFPA to base their oversight and accountability activities on a corporate risk model and develop risk assessment functions in their audit offices

A key change had been the adoption of a risk assessment methodology in the audit planning process.

With regard to the regularity audit, detailed risk assessments have been completed to ensure that in performing the financial and compliance audit work, our resources will be appropriately focused.

The Office of Audit and Performance Review will continue to expedite the filling of vacancies in the Office (para. 419), align resource levels according to audit risk assessments (para.

71. The internal audit coverage of UNHCR country programmes should be enhanced to aim at a shorter audit cycle and to cover activities with high risk ratings more frequently.

The Audit Services Branch has established a risk based database which will be updated on a regular basis.

Peacekeeping United Nations peacekeeping activities continued to be a significant risk area covered by internal audit (see paras.

During the reporting period, UNHCR's Audit Service had embarked on a risk management pilot project in collaboration with PricewaterhouseCoopers which aimed to develop a culture of risk awareness and active risk management within the Office.

Expressing approval for the comprehensive risk assessment exercise, delegations requested detailed information on measures to implement audit recommendations in country offices, and pointed to the need for an audit tracking system and for training national staff in international audit standards.

Other key initiatives included strengthening the roles of the MROC (paragraphs 212 and 229) the planned training of managers in corporate risk management building risk management principles into the programme management system audit planning and outcome reporting the implementation of an audit report tracking system to better monitor compliance with audit recommendations and reasons for delay, if any (paragraph 246) and the progressive rollout of audit exception reports (paragraph 193).

As part of its risk based approach to planning its audit coverage of the Pension Fund, OIOS has contracted a major international accounting firm to conduct an enterprise wide risk assessment to identify and categorize risks in order to focus internal audit activities for 2006 and 2007.

A concerted effort had been made when developing the 2005 audit workplan to implement the risk methodology in all missions.

He noted that defining a risk universe was difficult, and concurred that audit analysis should not be restricted to financial impact.

14. UNFPA has, in consultation with the Board of Auditors, established a strategy for improving the extent of audit coverage and the timing of receipt of the audit reports, that involves each country office establishing an annual audit plan in which high value and high risk projects are targeted for audit coverage monitoring implementation of the plans and reviewing the quality of the audit reports.

95. According to the draft medium term audit plan, risk rates have been assigned to UNHCR field offices and country programmes. An audit cycle and budget in terms of number of days have been planned for each office programme. The regular audit cycle is every four years. For most regional offices, the audit cycle is two years.

The UNHCR Audit Service and the Inspector General's Office conducted a joint risk assessment of the 2005 tsunami relief project in Sri Lanka.

(c) Audit coverage will aim at an average cycle of three years. The major and higher risk operations will be audited more frequently, while low risk and low volume operations will be covered less frequently

Underlining the need for sound financial management, there was an appeal to analyze audit shortcomings in future reports enhance internal control mechanisms step up audit coverage at headquarters and conduct high risk profiling exercises, especially in country offices.

This group includes recommendations relating to internal audit management (11), non governmental organization national execution (NGO NEX) audits (five), and corporate risk management (four).

C. Audit reports (departments audit subject)

In paragraph 290 of the report, UNDP agreed with the Board's recommendation that it (a) perform adequate internal audit reviews based on the outcome of a treasury risk assessment and bearing in mind specialist areas (b) involve internal audit in assessing the overall adequacy of the information technology and risk management systems of the UNDP Treasury and (c) require internal audit to report regularly to the Investment Committee on matters relating to Treasury.

The audit identified a series of problems relating to such matters as risk management, competitive bidding, asset valuation and the Insurance Section s resources and organizational placement.

The audit identified a series of problems relating to such matters as risk management, competitive bidding, asset valuation and the Insurance Section s resources and organizational placement.

The audit confirmed that poor internal controls in UNCTAD and the United Nations Office at Geneva exposed the Organization s funds to risk of misuse and fraud.

Crosswalk between audit observation initiatives and audit observation

Audit procedures and results of the additional audit scope

In addition, OAPR is exploring enhancements of the existing comprehensive audit database system to be used by project staff for NEX audit recommendations in 2006 (paragraph 103) and the inclusion of risk assessment and priority rating of the outcomes of NEX audits (paragraph 111).

The new policy required that every audit assignment result in a final audit communication, normally an audit report.

As an illustration of this, the limited resources provided for internal audit coverage of the capital master plan constitute a significant risk to the management of the Organization.

She assured delegations of UNDP commitment to follow up on recommendations conduct training incorporate analysis of audit issues into risk assessment methods and collaborate with United Nations organizations.

Audit opinion

Audit process

Audit opinion

External audit

Internal audit

Audit costs

Audit Division

Audit opinion

Internal audit

Audit Division