2016 IAU Consortium Audit Plan

Transcription

1 Revision 1, 1 April 2016 CB IAU Consortium Audit Plan Purpose: This paper sets out, for Audit and Risk Management Committee endorsement and recommendation to the Consortium Board for approval, the proposed 2016 IAU Work Plan for engagements to be provided to the Consortium. Management accepts the Audit Plan with the following understandings: 1. The plan will provide: assurance on CRP s financial reporting reliability; Fraud and IT risk assessment advisories; assurance on the appropriate use of funds allocated to the ICARDA Investment plan, and; interim financial audit as of 30 June 2016, providing assurance that the Consortium books are in good order for an orderly transition 2. The budget of the plan is $800,000 not to be exceeded, and all work will be delivered in The current income from other Center-based audit activities is confirmed and that all efforts will be undertaken to collect the fees for such services 4. The IAU will not require additional funds at the end of 2016 from the System Office, assuming that the overall IAU plan will remain as presented 5. The IAU has a balanced budget for Decision: 1. The Consortium Board endorses, on the recommendation of the Audit and Risk Management Committee, the 2016 IAU Consortium Audit Plan. CGIAR Consortium Board Twenty-Fourth Meeting CB24-06 Virtual, 29 March 2016 Page 1 of 1

2 1 April 2016 Timing of field work Designation Total USD to invoice Number (850/day) of days March-May Fraud risk assessment (Advisory) May-July IT Risk assessment (Advisory) July-August accounts interim August ICARDA Investment Plan (Assurance) August CRP1 - ICARDA (Assurance) August CRP1 - WorldFish (Assurance) September-November CRP1 - AfricaRice (Assurance) September-November CRP1 - CIFOR (Assurance) September-November CRP1 - CIMMYT (Assurance) September-November CRP1 - CIP (Assurance) September-November CRP1 - ICRAF (Assurance) September-November CRP1 - IFPRI (Assurance) September-November CRP1 - ILRI (Assurance) September-November CRP1 - IRRI (Assurance) September-November CRP1 - IWMI (Assurance) September-November CRP Consolidation (Assurance) Total for

3 Engagement title Fraud Risk Assessment Advisory The objectives of the assignment are to identify the inherent fraud risks relevant to Centers and the System Organization; to draft an assessment of the residual level of risk on the basis of information volunteered by Centers; To prioritize action at Center and System levels. Scope definition and exclusions Specifics (timing, skills) The exercise will focus on the following: Defining fraud for each of the processes and identifying fraud risks/schemes for each process. Drafting for each process a maturity model for fraud preventative and detective controls based on our assessment of fraud risks and best practice across similar organizations Designing a questionnaire to be sent to Centers to enable them to perform their own self-assessment against the maturity model On the basis of the questionnaire and interviews, identifying gaps in the key fraud risk management processes in place. The assignment will identify fraud risks across the following processes: Governance, Executive, Finance, Human Resources, Research & Development and Operational support. Risks of potential violations of relevant laws will also be identified. Unintentional non-compliance will be excluded from the scope The audit is scheduled for May 2016, with some planning activities in March Experience in fraud investigation and knowledge of key fraud drivers and techniques is required. At least one CFE (Certified Fraud Examiner) is required to participate. 80 days 2

4 Engagement title IT Risk Assessment Advisory The review, building from previous assurance and advisory audits (performed at Centers and the ) and from a high-level analysis, will consist in Identifying and mapping the critical systems supporting the Centers key processes; Understanding related governance and support activities; Assessing challenges created by technological and organizational changes or by the action of third parties. Scope definition and exclusions Specifics (timing, skills) The main deliverables will be the provision to Centers and the System of a roadmap to address significant gaps identified and to plan a more detailed assessment through the Centers internal controls initiatives and future internal audit activities across the System. Information systems that are either mission-critical to Centers, broadly implemented (as OCS) and/or supporting system-wide processes (such as active directory, website(s) and network) Specific risks to the hardware will not be reviewed unless related to logical access or loss of data The audit will not provide an opinion on the adequacy of the IT strategy or key controls The audit is scheduled for two phases (May and July) 2016, with initial planning activities in March 80 days Support from the IT CoP (community of practice) will be requested Certified Information Systems Auditors (CISA) are required 3

5 Engagement Title Accounts Interim Assurance Assist the Audit Committee in discharging its responsibilities for the review of the interim statement: Review processes and systems contributing to the production of accounts; Verify that no material modifications to the financial statements are required to be in compliance with the applicable framework; Review management accounts and reports to assess whether they faithfully and accurately reflect the reality of expenses, incomes and commitments. Scope definition and exclusions Actual expenditure and income recorded for the period January 1 st to June 30 th, 2016 Accruals and receivables as of June 30 th, 2016 Off Balance-sheet commitments Specifics (timing, skills) Requires supervision by a Chartered accountant Conducted in July and August 30 days Engagement Title ICARDA Investment Plan Assurance The objective of the audit is to provide assurance that funds allocated by the Consortium Board and disbursed over 2014 and 2015 as part of the ICARDA Investment Plan (USD 5,981K) have been effectively utilized, according to the initial intent. Scope definition and exclusions Management accounting and other procedures used by ICARDA to track and report dedicated use of the investment plan Material existence of expenditure and relation to the intended use of funds Adequacy of reports provided to the Consortium Board Specifics (timing, skills) Generalist auditor with accounting and financial reporting experience To be conducted in parallel with CRP audit (August) in Morocco and Lebanon/Jordan 30 days 4

6 Center/body Engagement title CRP financial reporting Assurance The audit objectives are Scope definition and exclusions To evaluate, for each Center, the reliability of the financial reporting process pertaining to CRPs; As a result, on a consolidated basis, to ensure that processes reviewed produce complete and accurate outputs i.e. CRP financial reports. As lead center, the accuracy of the CRP financial reports (L-series) will be verified by agreeing that the consolidated CRP financial report reconciles with the Participating Centers L-series for the financial year The following reports are included in the scope: - L101 - CRP Cumulative Financial Summary; - L106 - CRP Annual Funding Summary; - L111 - CRP Annual Financial Summary; - L121 - CRP Expenditure by Natural Classification Report; - L131 - CRP Flagship Projects Report; - L136 - Gender Expenditure by Flagship; - L141 - CRP Cluster of Activities Report; - L211 - CRP Partnerships Report. As both lead center and participating center, the accuracy of the CRP financial reports will be verified by reconciling the CRP financial reports with the general ledger (financial accounting system) and the plan of work and budget (POWB) for the financial year The following reports are included in the scope: - L121 - CRP Expenditure by Natural Classification Report; - L131 - CRP Flagship Projects Report; - L211 - CRP Partnerships Report. The adequacy of the information supporting cost incurred for the different cost categories specified on report L121 CRP - Expenditure by Natural Classification Report will also be checked. Adequacy here means that: 5

7 - Costs are actually incurred; - Costs are properly documented and justified; - Costs are properly accounted and recorded; - Costs are classified under the appropriate cost heading. Specifics (timing, skills) The audits are scheduled to take place between September and November 2016, except for ICARDA and WorldFish (August) Centers concerned are: - AfricaRice - CIFOR - CIMMYT - CIP - ICARDA* - IFPRI - ILRI - IRRI - IWMI - ICRAF - WorldFish* 720 days, i.e. 60 days on average per Center * + 15 additional days for WorldFish and ICARDA each, related to the closing of CRPs 1.3 (AAS) and 1.1 (DS) + 30 days for consolidating the overview at CRP level and on an overall scale. 6