State of The Internal Audit Profession in Africa PDF
State of The Internal Audit Profession in Africa PDF
State of The Internal Audit Profession in Africa PDF
ACKNOWLEDGMENT
The IIA would like to thank the leaders of the local IIA affiliates for Botswana, Ethiopia, Ghana, Kenya,
Malawi, Nigeria, Rwanda, Tanzania, Uganda, Zambia, and Zimbabwe for their participation in this
research. Their contribution and support with necessary contacts and documents was invaluable.
The IIA also acknowledges the significant contributions from all the respondents to the survey
questionnaire including:
nn Supreme Auditors General for Ghana, Kenya, Malawi, Uganda, Zambia, and Zimbabwe.
nn Heads of Government Internal Audit for Botswana, Kenya, Malawi, Rwanda, Tanzania,
Uganda, and Zambia.
nn Deloitte Ghana and Zimbabwe.
nn KPMG Ghana, Kenya, and Nigeria.
nn PwC Botswana, Ghana, Kenya, Malawi, Uganda, Zambia, and Zimbabwe.
nn Accounting associations/bodies in Ethiopia, Ghana, and Nigeria.
nn Heads of reserve/central banks for Rwanda and Tanzania.
nn Heads of Capital Markets Authority/Stock Exchanges for Rwanda, Uganda, and Zambia.
The author would like to thank Francis Nicholson, at The IIA, for his direction, guidance, and support
throughout the research period. The author is also particularly grateful to the World Bank’s internal
audit staff, namely Grace Verances and Muhammad Sadiq Ismail who assisted with the graphs and
Graham Colin-Jones, who edited the report.
The IIA is responsible for the contents of this report including the analytical approaches utilized. This report does not
represent the views of the World Bank Group.
International Professional
This research takes account of the current state of the
IPPF® internal audit profession in 11 sub-Saharan countries1.
Practices Framework®
Japan International The assessment of the current state was completed using
JICA an internal audit national maturity model. The model
Cooperation Agency
Public Expenditure focuses on elements that have most relevance to internal
PEFA
Financial Accountability audit maturity, grouped together under four indicators:
PwC PricewaterhouseCoopers nn National Context: This indicator looks at country
macro factors which include professionalism,
United States Agency for
USAID
International Development
1
These are English-speaking sub-Saharan countries where there is an established
IIA affiliate (excluding South Africa), namely Botswana, Ethiopia, Ghana, Kenya,
Malawi, Nigeria, Rwanda, Tanzania, Uganda, Zambia, and Zimbabwe.
nn Active collaboration of government with a Chart II shows the maturity levels of the four
number of development agencies in building indicators of the internal audit national maturity
the capacity of the internal audit profession. model in the private sector for each country in
the study.
nn Active advocacy for the internal audit
function in organizations by the stock
exchange and the central bank. Chart II: Private Sector Internal Audit
National Maturity Levels
nn Active participation of the Big Four accounting
firms in the marketing of the profession in their
provision of internal audit services.
Internal auditing in the private sector
generally demonstrates faster growth towards
“Established” maturity in the indicators of
Governance and Quality, compared with
the public sector. This is mainly because
organizations are adopting internal audit best
practices that comply with modern internal
auditing, as follows:
Elements Sub-elements BW ET GH KE MW NG RW TZ UG ZM ZW
nn Ineffective audit committees that lack capacity to execute their duties and have little
understanding of internal audit.
nn Public entities with no formal risk management frameworks.
nn The positioning and status of internal audit, which places the head of internal audit at a junior level
of management and largely performing a control monitoring role instead of an assurance role.
In addition to these factors, Nigeria does not have audit committees in the public sector and the
internal audit function lacks any true independence.
Table 2: Governance Indicator (Public Sector) – Sub-element Level of Maturity (by Country)
Elements Sub-elements BW ET GH KE MW NG RW TZ UG ZM ZW
Table 3: Quality Indicator (Public Sector) – Sub-element Level of Maturity (by Country)
Elements Sub-elements BW ET GH KE MW NG RW TZ UG ZM ZW
nn Shortage of professional practitioners in internal audit (membership of The IIA and the number of
practitioners holding the CIA designation from these countries are very low).
nn Limited access to internal audit training.
nn Limited use of computerized automated auditing tools and techniques.
The maturity level is an average of the maturities of the six sub-elements of this indicator. Some sub-
elements are at a more mature level on the spectrum of maturity than others, as depicted in Table 4
below. The maturity levels of the sub-elements range from “Initial” to “Established.” None of the
sub-elements was found to be at the “Integrated” or “Optimizing” levels.
Table 4: Resources Indicator (Public Sector) – Sub-element Level of Maturity (by Country)
Elements Sub-elements BW ET GH KE MW NG RW TZ UG ZM ZW
A. Adequacy of
staffing resources, 1. Adequacy of staffing resources
including structure
1. Competency and experience
B. Skills 2. Internal audit specific certifications held
3. Highest educational level
C. CPE and training 1. Access to and frequency of training
D. Technology 1. Use of CAATTs
nn Appropriate positioning of internal audit in organizations, where the head of internal audit is
recognized as being part of senior management and internal audit is positioned as a third line of
defense.
nn Audit committees that are effective in providing oversight of internal audit functions, thus
promoting their independence.
nn Organizations having a consistent approach to managing risk.
Table 5: Governance Indicator (Private Sector) – Sub-element Level of Maturity (by Country)
Elements Sub-elements BW ET GH KE MW NG RW TZ UG ZM ZW
nn Internal audit functions are adopting the principles and standards of the IPPF in having charters
and strategies, and in conducting risk-based audit planning and regular risk assessments.
nn The scope of internal audit work is broad, audit reports are of good quality, and there is systematic
follow-up of audit recommendations.
Ethiopia and Zambia lag behind because their internal audit functions:
Table 6: Quality Indicator (Private Sector) – Sub-element Level of Maturity (by Country)
Elements Sub-elements BW ET GH KE MW NG RW TZ UG ZM ZW
As evidenced by low IIA membership and CIA certifications, these countries are experiencing a
shortage of skilled or qualified internal auditors. In addition, internal auditors have limited access to
internal audit training mainly due to lack of funding, and the use of computerized automated auditing
tools and techniques is at an early stage. Two of the 11 countries (Tanzania and Zimbabwe) are tending
towards “Established” maturity mainly because (i) the local IIA affiliates are actively providing internal
audit training, and (ii) the accounting bodies are active in internal audit and also internal audit functions
leverage co-sourcing and outsourcing of internal audit services to the public accounting firms.
The maturity level is an average of the maturities of the six sub-elements of this indicator. Some sub-
elements are at a more mature level on the spectrum of maturity than others, as depicted in Table 7.
The maturity levels of the sub-elements range from “Initial” to “Established.” None of the sub-
elements was found to be at the “Integrated” or “Optimizing” levels.
Table 7: Resources Indicator (Private Sector) – Sub-element Level of Maturity (by Country)
Elements Sub-elements BW ET GH KE MW NG RW TZ UG ZM ZW
A. Adequacy of
staffing resources, 1. Adequacy of staffing resources
including structure
1. Competency and experience
3.2.2. Ethiopia
Ethiopia is the second-most populous country
Public Sector: Similar to the National Context
in Sub-Saharan Africa with a population of 99.4
indicator, the Governance, Quality, and Resources
million and a GDP of $61.537 billion in 2015. With
indicators are at the “Emerging” level of maturity.
a GDP per capita of $619, Ethiopia is a low income
country3. Internal audit in Ethiopia is regulated by nn The Governance indicator is at the
the Financial Administration Council of Ministers “Emerging” maturity level because internal
Regulation No. 190/2010 for public organizations audit functions are positioned as a second
and the National Bank of Ethiopia for financial line of defense, audit committees lack
institutions4. Other private sector organizations independence and relevant internal audit
follow best-practice corporate governance. skills, and organizations lack comprehensive
risk management frameworks.
Based on the current state of internal audit in
Ethiopia, the National Context indicator is at nn The Quality indicator is also at the
the “Emerging” maturity stage. There is limited “Emerging” level of maturity mainly because
understanding of the role and value of internal internal audit functions have no formal
audit, but the new directives5 in the banking and charters and strategies, audit planning
insurance industry issued by the National Bank is not risk-based, and quality assurance
3
http://data.worldbank.org/country/ethiopia
4
Licensing and Supervision of Banking Business, Bank Corporate Governance Directives No.SBB/62/2015; Licensing and Supervision of
Insurance Business, Corporate Governance Directives No. SIB/…./2015
5
Ibid.
3.2.3. Ghana
In 2015, Ghana’s population was 27.41 million
and its GDP was $37.86 billion. With a GDP per
capita of $1,381, Ghana is a lower middle income
country6. Internal audit is regulated in Ghana by
6
http://data.worldbank.org/country/ghana
7
Banking and Financial Laws of Ghana 1998-2006
8
SEC Corporate Governance guidelines on best practices, 2010
nn The Quality indicator is also “Emerging” nn The Quality indicator is also increasingly
because: “Established” in maturity mainly as internal
audit functions are adopting practices
»» Internal audit functions have only basic
aligned to IIA standards such as:
charters and strategies.
»» Having internal audit charters and
»» Audit planning is only partially risk- strategies.
based.
»» Conducting regular risk assessments
»» The scope of internal audit function and risk-based audit planning.
work is narrow (mainly financial controls
and compliance). »» Producing good quality audit reports
with effective follow-up processes.
»» Formal quality assurance arrangements
are limited. nn Similar to the public sector, the Resource
indicator is at the “Emerging: stage because:
nn The Resources indicator is “Emerging” in
»» There is a shortage of qualified staff with
maturity because:
relevant skills.
»» There is a shortage of qualified staff with
relevant internal audit skills. »» Internal auditors have limited access to
internal audit training.
»» Internal auditors have limited access to
internal audit training. »» Internal audit functions’ use of
computerized automated auditing tools
»» Internal audit functions’ use of and techniques is limited.
computerized automated auditing tools
and techniques is very limited.
9
Anchoring High Growth, Can Manufacturing Contribute More? Kenya Economic Update, Edition No. 11, World Bank Report, December
2104
10
http://data.worldbank.org/country/kenya
11
Gazette Notice No. 1420, The Capital Markets Act, (Cap. 485A) the Code of Corporate Governance Practices for Issuers of Securities to
the Public 2015; Principles for Corporate Governance in Kenya and a Sample Code of Best Practice for Corporate Governance, Private Sector
Corporate Governance Trust Report
12
Public Expenditure Financial Accountability Report, August 2012
13
http://data.worldbank.org/country/malawi
14
Malawi Code II: Code of Best Practice for Corporate Governance in Malawi, Overarching Provisions, June 2010
15
Corporate Governance Guidelines, Reserve Bank of Malawi, 2010
16
Corruptions Perceptions Index 2015, Transparency International, 2015
17
http://data.worldbank.org/country/nigeria
18
Public Finance (management and control) bill, 2009
19
Corruptions Perceptions Index 2015, Transparency International, 2015
20
http://data.worldbank.org/country/rwanda
21
Regulation n°11/2011 on minimum internal control and audit standards in banks
22
Rwanda: Transformation of Agriculture Sector Phase 3 Program-for-Results, Integrated Fiduciary Assessment Report, 2014; Public Sector
Governance Program-for-Results, Fiduciary Assessment Report, 2014
23
http://data.worldbank.org/country/tanzania
24
Tanzania Public Expenditure Financial Accountability Report, 2013
nn The Governance indicator is “Established” Based on the current state of internal audit
in maturity mainly because internal audit in Uganda, the National Context indicator is
is appropriately positioned to promote becoming “Established” in maturity. There is
its independence and audit committees a general appreciation of the role and value of
effectively provide oversight to internal audit internal audit as the government is jointly working
functions. with development agencies to build internal audit
capacity. There is also increasing demand for
nn The Quality indicator is also at “Established”
internal audit services as big audit firms outsource
maturity as internal audit functions
and/or co-source their internal audit services, and
have charters and strategies aligned to
the accounting associations provide support to
organization strategies, have adopted annual
the profession through training. In addition to
risk assessments for audit planning, and have
development agencies supporting internal audit
a broad scope of work beyond compliance
capacity building, the Capital Markets Authority
and financial controls. In addition, audit
and Bank of Uganda are actively advocating for
reports are of good quality and follow-up of
internal audit through their listing and supervision
audit recommendations is methodical.
requirements, respectively. Chart XVIII shows the
nn The Resource indicator is “Established” internal audit national maturity levels for both the
mainly because the local IIA affiliate is private and public sectors.
actively providing internal audit training, and
the accounting bodies are active in internal Chart XVIII: Uganda Internal Audit National
audit services promotion. In addition, the Big Maturity Indicators
Four public accounting firms are providing
co-sourcing and outsourcing internal audit
resources.
3.2.9. Uganda
Uganda has an estimated population of 39.03
million and a GDP of $26.369 billion as of 2015. With
a GDP per capita of $675, Uganda is a low income
country25. Internal audit in Uganda’s public sector is
regulated by the Public Finance and Management
Act, 2015. In the private sector, the Bank of
Uganda26 and the Capital Markets Authority27
25
http://data.worldbank.org/country/uganda
26
The Financial Institutions (Corporate Governance) Regulations, 2005
27
The Capital Markets Corporate Governance Guidelines, 2003
28
Uganda Public Expenditure Financial Accountability Report 2012; Uganda support to municipal infrastructure development program,
Fiduciary Systems Assessment, 2012
29
http://data.worldbank.org/country/zambia
30
Banking and Financial Services Act, Cap 387 of the Laws of Zambia
31
http://data.worldbank.org/country/zimbabwe
32
Zimbabwe Country Integrated Fiduciary Assessment, World Bank, 2012
nn Low levels of advocacy for the internal nn Formalizing quality assurance arrangements
audit profession by key stakeholders in in the public sector.
government and the private sector, and by
other professional bodies.
nn Raising the level of awareness and understanding of the role and value of internal auditing.
This is necessary to increase the appetite and demand for internal audit among key stakeholders
(governments, investors, and the public at large). It may include working with governments and
their leaders, supreme auditors general, heads of central banks and stock exchanges, and internal
auditors general (where they exist) to ensure that the operational environment is optimized for
internal audit, including the legislative and regulatory framework.
nn Ensuring that internal audit is configured in a way that optimizes its value. This requires
working with organizations and their senior management with a view to enhancing the
effectiveness of internal audit functions.
nn Providing training and development opportunities directly to practitioners. Such training
(whether face-to-face, remotely, or by blended means) would enhance the skills of internal audit
practitioners. In addition, internal audit programs should be promoted in academia — universities
and colleges — to train future internal audit practitioners.
nn Developing the local IIA affiliates. This would entail providing them with the necessary resources
so they are better able to support the audit profession in their countries (and perhaps in the
region). The local affiliates are best placed to advocate for the profession locally, provide training
and continuing education to practitioners, and support quality assurance programs by providing
external quality assurance review services.
nn Partnering with development agencies and other organizations. Such partnerships would
include development agencies, the Big Four accounting firms, and the local accounting bodies
that are building internal audit capacity on the ground. This will help to maximize outcomes.
• Enhance the capacity of the local affiliate to enable its leaders to drive favorable internal audit
legislation.
• Undertake targeted training on internal audit with various objectives (e.g., to increase the
Botswana number of practitioners who hold IIA certifications, and to enhance the skills of internal audit
practitioners).
• Increase visibility and knowledge of the profession by promoting an internal audit curriculum in
universities and colleges.
• Train internal audit practitioners to enhance their skills (e.g., certification-targeted training).
• Collaborate with development agencies to advocate for the role and value of internal audit to
Ghana government and other key stakeholders.
• Convene development agencies and harmonize the internal audit capacity building strategy for
the country to maximize outcomes.
• Convene development agencies to provide funding for an internal audit center of excellence
(the local affiliate has already acquired land; if successful, it can be used as a regional center of
excellence).
• Enhance competency of practitioners through targeted training including IIA certifications.
Kenya • Collaborate with development agencies to advocate for the recognition of internal audit as a
profession by the public service commission and corporate leaders (e.g., to require CAEs to
have IIA certifications instead of accounting or financial qualifications).
• Convene development agencies and harmonize the internal audit capacity building strategy for
the country to maximize outcomes.
• Collaborate with development agencies to advocate for the role and value of internal audit to
government and other key stakeholders.
Malawi • Train internal audit practitioners to enhance their skills and increase the number of practitioners
who hold IIA certifications.
• Increase advocacy for more colleges/universities to offer internal audit programs.
• Mentor the local affiliate to accelerate its maturity and capacity to lead the profession in the
country.
• Increase visibility and knowledge of the profession by promoting an internal audit curriculum in
universities and colleges.
Rwanda
• Train internal audit practitioners to enhance their skills and increase IIA membership and
practitioners who hold IIA certifications.
• Collaborate with development agencies to advocate for the internal audit profession in
government and with key stakeholders.
• Convene development agencies and harmonize the internal audit capacity building strategy for
the country to maximize outcomes.
• Collaborate with development agencies to advocate for the recognition of internal audit as a
Tanzania profession by the public service commission, accounting bodies, and corporate leaders.
• Deliver targeted IIA certification training to increase the number of IIA certified internal audit
practitioners.
• Empower the local affiliate to advocate for internal audit programs in universities/colleges.
• Increase visibility and knowledge of the profession by promoting an internal audit curriculum in
universities and colleges.
• Train internal audit practitioners to enhance their skills and also improve professionalism by
Uganda
promoting the value of IIA certifications.
• Collaborate with development agencies to advocate for the value of the internal audit
profession to government and key stakeholders.
• Empower the local affiliate to advocate for internal audit legislation that recognizes internal
audit as a profession.
• Invest in advocacy to boost the value of internal audit in both the public and private sectors
and for the recognition of internal audit as a profession by the public service commission and
Zambia corporate leaders.
• Increase visibility and knowledge of the profession by promoting an internal audit curriculum in
universities and colleges.
• Train internal audit practitioners to enhance their skills. Encourage internal audit practitioners to
be IIA members and to be IIA certified.
• Empower the local affiliate to advocate for the recognition of the value of internal audit in both
the public and private sectors.
Zimbabwe
• Train internal audit practitioners to enhance their skills and increase the number of practitioners
who hold IIA certifications.
4. IIA certification and GDP per capita Very low: IIA certification to GDP per capita is 0.5%.
3. IIA membership and GDP per capita Low: IIA membership to GDP per capita is 30.7%.
4. IIA certification and GDP per capita Low: IIA certification to GDP per capita is 5.7%.
4. IIA certification and GDP per capita Very low: IIA certification to GDP per capita is 1.1%
B. National indicators
1. Transparency International 2015 CPI
for fraud and The 2015 CPI ranking is 56/168
rank (/168)
corruption
2. Transparency International 2015 CPI
The 2015 CPI score is 47%
score (/100)
1. Role of audit firms in delivering
Audit firms are providing internal audit services to a large number of
internal audit services (assurance and
companies.
consulting)
C. Role of audit firms 2. Role of audit firms in delivering Audit firms deliver training and guidance in internal audit to a large number
and accounting training and guidance for internal audit of companies.
associations 3. Role of accounting associations in
Limited involvement in delivering training and guidance for internal audit
delivering training and guidance for
especially for its members.
internal audit
4. Role of accounting associations in
Train members who are audit committee members; also participate in
delivering training and guidance for
trainings arranged for audit committees by other professional bodies.
audit committees
There is significant need for funding for internal audit capacity building but
1. Availability of funding for internal
only some is available from World Bank, GIZ, African Development Bank,
audit training commensurate with need
D. Development CIDA, DANIDA, and Commonwealth.
agencies There is a significant need for advocacy but focus by development
2. Delivery of advocacy for internal
agencies in this area is insufficient. Harmonized/coordinated effort is
auditing commensurate with need
required.
Limited advocacy mainly through Bank of Ghana, National Insurance
1. Provision of advocacy for internal
E. Role of other Commission, and the Ghana Stock exchange requirements. Most firms
auditing
bodies including stock follow corporate governance best practices.
exchange and central Limited requirements are set for internal audit mainly through Bank of
bank 2. Setting of internal audit related
Ghana, National Insurance Commission, and the Ghana Stock exchange
policy and corresponding enforcement
requirements for financial institutions.
4. IIA certification and GDP per capita Low: IIA certification to GDP per capita is 5.7%
3. IIA membership and GDP per capita Substantial: IIA membership to GDP per capita is 85.2%
4. IIA certification and GDP per capita Very low: IIA certification to GDP per capita is 4.9%
3. IIA membership and GDP per capita Low: IIA membership to GDP per capita is 28.6%
4. IIA certification and GDP per capita Very low: IIA certification to GDP per capita is 2.7%
3. IIA membership and GDP per capita Very Low: IIA membership to GDP per capita is 10.8%
4. IIA certification and GDP per capita Very low: IIA certification to GDP per capita is 0.3%
4. IIA certification and GDP per capita Very low: IIA certification to GDP per capita is 2.4%
4. IIA certification and GDP per capita Low: IIA certification to GDP per capita is 6%
3. IIA membership and GDP per capita Very Low: IIA membership to GDP per capita is 22%
4. IIA certification and GDP per capita Very low: IIA certification to GDP per capita is 2.3%
3. IIA membership and GDP per capita Moderate: IIA membership to GDP per Capita is 67.6%
4. IIA certification and GDP per capita Low: IIA certification to GDP per Capita is 5.8%
ACCA Nigeria
PwC Botswana
Head of Internal Audit – Kenya Government Head of Internal Audit, Zambia Government