CM(2010)51 rev1 8 July 20102
1096 Meeting, 20 October 2010
11 Administration and logistics
11.5 Annual Report 2009 of the Directorate of Internal Audit
Item to be considered by the GR-PBA at its meeting 23 September 2010
1. The mission of Internal Audit is to provide oversight, objective assurance and consulting services designed to add value and improve the Organisation’s operations. In 2010 Internal Audit has been integrated into the newly established Directorate of Internal Oversight together with the Evaluation Function and therefore its future reports will also provide information on evaluation-related activities.
2. The role of Internal Audit includes making appropriate recommendations to improve the governance process, promote appropriate ethics and values within the Organisation, ensure effective organisational performance management and accountability, and to enhance the effective communication of risk and control information within the Organisation.
3. Internal Audit has helped to strengthen the climate of accountability and sound management in the Organisation through a variety of activities, including through its many audit recommendations. During 2009, Internal Audit continued to work on the Fraud Awareness Raising and Prevention Policy. The Organisation-wide Risk Assessment tool developed by Internal Audit was successfully tested by an independent expert with an operational programme, Internal Audit also provided training to staff members on financial management and internal control. It participated in various committees as an observer, gave ad-hoc advice on various issues and assisted the External Auditor, as appropriate.
4. In 2009, Internal Audit continued to maintain its international relations, notably with the Internal Oversight Services of other International Organisations and with International Investigators. The Internal Auditor is a member of the Audit Committee at the OSCE and the European Patent Organisation.
Audits and their results
5. The annual work programme is based on an analysis of inherent risks and is discussed with the External Auditor. It takes into consideration contributions from senior management and discussions of the Ministers’ Deputies. The work plan is approved by the Secretary General. In the course of the year it may be revised as needs change.
6. We issued 10 audit reports in 2009 on the following subjects:
- Human Resources Management (4 comprehensive reports)
- Follow-up to the audit of the European Roma and travellers Forum (ERTF)
- Receipts of the Organisation
- Two Joint Programmes run from the Directorate General of Human Rights and Legal Affairs (DGHL) Kyiv office
- Payment Processing Times
- Database Integrity
- IT-equipment purchased by Major Administrative Entities (MAE)
7. In 2009 we had also to investigate 2 cases of alleged fraud. One case was unfounded and in the other case the fraud was confirmed and the contract of the staff member under investigation was not renewed.
8. Internal Audit also prepared 2 reports on the activities of the Tenders Board and the opening of tenders and 4 follow-up reports on the implementation of audit recommendations. The latter showed the following:
In the period 2006-2008 we issued 28 reports with altogether 502 recommendations. 88% of the recommendations were accepted, and 66% were implemented; others were in progress (17%) still under consideration (4%) or obsolete because circumstances had changed (4%). Only 7% of the recommendations were rejected.
9. During the year some general issues were identified. They need to be addressed in 2010 and subsequent years:
- we have reason to stress the importance of good communication within Major Administrative Entities. In one case fraudulent behaviour remained undetected for several months because of a breakdown of communication in that administrative entity. Smooth communication helps fighting fraud and addresses weaknesses in internal control.
- we have concerns that, in some cases, individuals for whom consultants contracts had been issued may well have been employees, a status which would have obliged the Organisation to declare them as employees, and to pay social security contributions. Ambiguous wording of such contracts could be potentially damaging to the reputation of the Council and may involve financial cost and other obligations. The issue is being addressed by the Directorate General for Administration and Logistics.(DGAL)
- during our follow-up work on fixed assets, we noticed that the loan of small IT equipment (Blackberrys or similar PDAs, laptops, personal organisers, digital cameras) is, in some case, managed directly by MAEs. In order to ensure that the IT equipment is used for official purposes, we recommend that all MAEs reconsider on an annual basis whether the exclusive use of such items by a given staff member is justified by checking the actual use of the item.
- during our audit on Human Resources Management, we noticed some flaws in the monitoring of annual leave and special leave. The system currently in place does not ensure systematic registration of each absence.
10. The main audit findings, recommendations and results of the individual reports are shown in Appendix 1.
11. Internal Audit is required by its mandate to facilitate the promotion of best practices. The aim is to increase the efficiency and effectiveness of working methods. In 2009 we identified best practices with regard to, for example, delegation of financial authority and processing and recording invoices. These best practices are published on the Intranet.
12. According to the Internal Audit Charter, the Director of Internal Audit reports to the Secretary General on the performance of the Internal Audit function against agreed key performance indicators. The indicators and respective achievements for 2009 are as follows:
At least 10 audits conducted and 10 reports issued
10 audit reports including 2 investigation reports were issued; in addition 2 reports on tendering processes and 4 follow-up reports.
Contribute to improvements of the Organisation’s operations, with two thirds of recommendations accepted
88% of the recommendations were accepted (see paragraph 5 above)
Human Resources procedures were streamlined by delegating to the Director of Human Resources authority and responsibility for temporary recruitments, permanent recruitments of grades A1-4, staff movements, and for the approval and extension of reserve list.
Recruitment procedure was shortened by respecting deadlines and enforcing target days.
Processing of payments was shortened by setting target dates for MAEs for the transmission of payment files.
Provide reasonable assurance that internal controls are applied to financial transactions by checking compliance of financial operations (at least 500 checked)
542 Transactions were checked
Increase the in-house awareness and capacity on Internal Control by providing a relevant training course to 30 staff members
30 staff members trained.
88% of participants who evaluated the training rated the training as being relevant for their work.
13. The Directorate of Internal Audit developed the Quality Assurance and Improvement Programme, which is designed to ensure compliance with the Internal Audit Standards, and to enable an assessment of whether internal auditors are applying the Code of Ethics. The programme also assesses the efficiency and effectiveness of the internal audit activity and identifies opportunities for improvement. The programme includes such elements as ongoing monitoring of the performance of the internal audit activity, periodic reviews performed through self-assessment and periodic external assessments. The Directorate of Internal Audit performed a self-assessment in 2004 and an external quality review in 2006. In order to comply with the requirement of International Standards of the profession to carry out quality assessments every 5 years, another self-assessment will be conducted in 2010 and an external quality review will be performed in 2011.
Outlook for future activities of Internal Audit and Evaluation
14. For 2010, we have identified the following priorities for our work plan:
Review of communication functions across the Secretariat.
Processes for producing publications
Financial management Audits
Sale of the old EDQM building (if sale materialises)
European Roma and Travellers Forum (ERTF)
Financial management in the Congress
Two joint programmes
EU/CoE Joint Programmes concerning efficient prison management in Bosnia and Herzegovina and census observation and monitoring in Kosovo*
Ordinary Budget Programme on Migration
Guidelines for managing independent evaluation
Guidelines for monitoring of projects
Organising a CoE Training Programme on Evaluation in co-operation with DHR
* * *
Main Audit Findings and Results
Human Resources Management (4 comprehensive reports)
1. Human Resources capital is the most valuable asset of the Council of Europe. Therefore, the management of Human Resources (HR) is one of the most critical functions of the Organisation.
2. Internal Audit performed an operational audit on HR management as a part of its 2009 Audit Plan. The objective of the audit was to verify the adequacy of policies in Human Resources Management, and to verify its effectiveness, based on a sample of procedures. The audit covered HR strategy and policies, recruitment, selection, the nomination of candidates, and the administrative management of staff.
3. During the audit we noted that significant progress had been made in the reform of HR management and administration. We also noted that the Directorate of Human Resources (DHR) continued to make efforts aimed at streamlining procedures and working methods, and at improving rules. Several improvements have been implemented during the course of the audit. We encourage these initiatives, in particular the DHR proposal to review the rules on leave without pay and on job classification, and the proposal to examine ways of rewarding the exceptional performance of staff.
4. We found that the HR function across the organisation was lacking a clear and formalised assignment of roles and responsibilities of the different actors, and that the delegation of authority was inefficient regarding procedures including temporary recruitments, permanent recruitments to grades A1-4, staff movements, and the approval and extension of reserve lists.
5. We also found that there was a lack of Organisation-wide medium and long-term workforce planning.
6. Some rules require revision, in particular those on allowances, special leave, flexible working hours, additional steps granted at the time of permanent recruitment, rules on “light” competitions, internal competitions, and grade banding.
7. There is room for improvement in the communication practices of the DHR – in particular with regard to internal information sharing and consultation with MAEs when developing new tools.
8. As regards the crucial IT system for HR management, PeopleSoft, current system administration causes a significant risk of a lack of controls over actions performed by some users, due to them having access to several functions within the system. There were also issues regarding separation of duties.
9. Our audit resulted in an immediate saving of around € 30,000 to be reimbursed to the Organisation by 2 staff members due to an error in awarding expatriation allowance. In addition, the annual saving will be around € 18,000 in subsequent years. Furthermore, implementation of some recommendations may lead to significant annual savings.
10. Our main recommendations include:
a) clear assignment of roles and responsibilities in HR management, and delegation of authority and responsibility to the Director of Human Resources for temporary recruitments, permanent recruitments to grades A1-4, staff movements, and for the approval and extension of reserve lists;
b) establishing of an Organisation-wide medium- and long-term workforce planning;
c) widening the PeopleSoft accesses of HR Correspondents;
d) rationalisation of information sharing practices;
e) shortening of the recruitment procedure by respecting deadlines and enforcing target days;
f) clarify the rules on internal competitions – whether or not they should systematically be organised prior to launching an external recruitment procedure;
g) externalise the preparation of exam papers for general and specific competitions;
h) simplifying of the rules on “light” competitions;
i) documentation of forecasts of training needs by MAEs;
j) introduction of measures aimed at decreasing the training non-attendance rate;
k) increasing “SMARTness” and coherence of objectives by defining core objectives for job references;
l) informing staff about the new mobility guidelines;
m) modifying the rules on internal competitions for A grade;
n) introducing grade banding for grades other than A1/2/3;
o) reorganise accesses in PeopleSoft in order to ensure an adequate segregation of duties;
p) modifying the Rules on the granting of additional steps at the time of permanent recruitment;
q) following up of amounts paid for each type of allowance;
r) revising rules governing expatriation allowance, education allowance, settling-in allowance;
s) clarifying rules on granting special allowance;
t) widening flexible working hours;
u) modifying rules on special leave.
Follow-up to the audit of the European Roma and travellers Forum (ERTF)
11. Upon request of the Ministers’ Deputies Internal Audit prepared a report on “…the proper use of the financial contribution to the ERTF granted by the Council of Europe in 2005 and 2006.” (CM(2008)73). The report identified room for improvement in internal control, which could be addressed by the implementation of six recommendations. It was decided that the ERTF should give immediate effect to the recommendations contained in the report, and the Internal Auditor should submit by the end of April 2009 a report on the implementation, by the Forum, of the recommendations. This report was produced in May 2009. It concluded that one recommendation has been implemented, two have not been implemented, and three have been partially implemented (CM(2009)73 of 30 April 2009). A further follow-up report is programmed for 2010.
12. In 2008 receipts for the Organisation totalled approximately €325M. 99% of them were contributions and income from the European Directorate for the Quality of Medicines (EDQM). There are however various other activities which generate additional resources for the Organisation, amounting to €2.4M in 2008. Due to their smaller size these activities are less visible. They are thus likely to be less controlled and more risky than the processes used for dealing with larger and more visible receipts.
13. The audit examined a sample of receipts transactions relating to these activities, namely, Interpretation, Publications, the European Youth Centres and the rental of parking places. We also paid particular attention to procedures and to organisational arrangements. The audit tested the internal controls in place at the invoicing, recording, collections, and year-end procedures stages.
14. For all types of receipts, the transactions we examined were, in general, correctly recorded and accounted for. No major compliance anomalies were found in the course of the audit work.
15. We found evidence, however, of some significant weaknesses in internal control, where a real improvement is required: the absence of substitutes for key functions in the process, the absence of documented procedures and of access restrictions to IT tools, insufficient inventory (stocks) management.
16. We also identified minor issues related to cash receipts and the existence of time-consuming procedures.
17. Our main recommendations include :
a) the naming of substitutes for receipts activities in the Finance Directorate, Interpretation Department and Publication Division;
b) the drawing-up of brief procedures by DGAL (Finance and Interpretation) and DC (Publications) so that the steps to be followed and the controls to be applied when processing receipts are clearly defined;
c) DGIV (European Youth Centre) and DC (Publications) implement access restrictions to their respective applications for receipts processing;
d) DC implement a documented and adequate inventory management policy;
e) DC (Publications) and DGIV (EYCS) improve the monitoring of their receipts activities by producing and acting upon analytical information;
f) DC simplify the procedures in place, in particular regarding invoicing in dollars and the means of payment;
g) DGIV (EYCs) improve their cash receipts management by adding appropriate instructions into existing written procedures.
18. In total, 18 recommendations were made, of which 17 were accepted and 1 became obsolete because of a change in IT system. 11 recommendations are now implemented, and the remaining 6 are in progress or under consideration for 2010.
Two Joint Programmes run from the DG-HL Kyiv office
19. In 2009 the Council of Europe ran approximately 40 Joint Programmes, with planned total expenditure in excess of € 62M. Due to the scale of expenditure, the partial devolution of administration to local offices, and the requirement to demonstrate to partner organisations the presence of adequate controls, an audit was conducted of two Joint Programmes in Kyiv: the “Transparency and Efficiency of the Judicial System of Ukraine” and the “Promotion of European standards in the Ukrainian Media Environment.” They have combined multiannual budgets of € 7.2M.
20. We tested the controls in the local DG-HL Kyiv office, and in Strasbourg, by examining a sample of transactions representing 57% of expenditure to date (excluding salaries).
21. The only transactions carried out at local level are a range (including office expenses and utilities) from Petty Cash. We found all transactions were properly carried out and recorded.
22. As regards the transactions actioned through Strasbourg we found some areas which could be improved:
- the nature of consultant (“resident expert”) contracts which currently have too many similarities to contracts of employment;
- invoices submitted for consultancy work often did not conform to some contractual or fiscal requirements;
- the approval process for payments and especially commitments was very long and time consuming, although the DG-HL has informed us that this has now been shortened.
23. Our main recommendations include:
a) a review of consultant contracts to ensure conformity with legal requirements;
b) ensuring that invoices accepted for payment conform to legal/fiscal requirements;
c) a review of commitments and payments approvals procedures with a view to shortening them by means of appropriate delegation. The DG-HL has informed us that action on this point has already been taken;
d) consideration of paying routine expenses, such as for telephones, by for example standing order, rather than from Petty Cash.
Payment Processing Times
24. Internal Audit performed an audit on Payment processing times in response to the recommendations of the External Auditors made during the audit on the Council of Europe Annual Accounts for the year 2007. The objective of the audit was to ensure that DGAL had taken sufficient sustainable action to reduce payment processing times in the Directorate of Finance to acceptable levels, as defined by RBB targets, whilst maintaining adequate internal controls to safeguard funds.
25. During the audit we noted that the Payments Division had undertaken some steps towards streamlining of procedures. These measures were either being tested or being developed. We also noted the information on payment processing times at the disposal of the Payments Division is not always complete and contained errors and inconsistencies. Therefore, it was difficult to estimate accurately payment processing times.
26. We found that in the first six months of 2009 payment processing times were the shortest compared to 2007 and in particular to 2008. This was most likely achieved due to more stable staffing as staff members became fully operational and there was no need for significant training. Another factor was a decreased workload as regards manual transactions, which represent the most time-consuming activity in the Payments Division. Enhanced managerial involvement at A5 level in 2009 could also have had an effect on payment processing times.
27. We also noted that internal controls performed during processing of payments were insufficient as a number of payments were made without proper authorisation. A substantial number of payments were made after the deadline fixed by suppliers. Delays in the processing of payment requests occurred in MAEs. However, the data available to measure this is very limited.
28. Our recommendations include:
a) DFIN improve the completeness and accuracy of the data on the basis of which Results-Based Budgeting and Balanced Score Card results for the Payments Division are estimated;
b) DFIN proceed with a payment only if the payment is properly authorised;
c) MAEs set target dates for the transmission of payment files in order to help speed up processing;
d) MAEs identify when invoices are received in order to facilitate the calculation of processing times.
29. Altogether we made 5 recommendations, all of them were accepted. DFIN uses our analysis of the volume of work and productivity when reviewing the functioning of the Payments Division.
30. The results of the audits on Database Integrity and IT-equipment purchased by MAEs will be reported on in the 2010 annual report.
Note 1 Modifications have been made to paragraph 14 only.
Note 2 This document has been classified restricted at the date of issue; it will be declassified in accordance with Resolution Res(2001)6 on access to Council of Europe documents.
Note * All reference to Kosovo, whether the territory, institutions or population, in this text shall be understood in full compliance with United Nations Security Council Resolution 1244 and without prejudice to the status of Kosovo.