Examining Internal Audit Process of Selected Local Governments in the Central Region of Ghana

The need for audit was traced back to public finance systems in Babylonia, Greece, the Roman Empire, and the City States of Italy which developed detailed systems of checks and counterchecks (Ramamoorti, 2003). Governments, companies and institutions were concerned about employees who could commit errors in bookkeeping in addition to those likely to commit other forms of irregularities whenever there was the opportunity.

The justification for ensuring adequate control over processes, as in the principles of institutional theory, stems from the fraud cases such as the Tulip Scandal of the 17th Century in the Netherlands and the South Sea Bubble of 18th Century in Great Britain. The recurrence of irregularities in the operations of local governments in Ghana as per the Auditor-General (2012) confirms the need for an oversight mechanism such as the internal auditing. Internal auditing is a product of trust issues which had the potential to derail the achievement of organisational objectives. The effectiveness of internal auditing is indispensable because it creates improvement in government ministries (Unegbu & Kida, 2011).

The objective of this paper is to examine the internal audit process of selected local governments in the Central Region of Ghana. The intention is to understand the process that internal auditors go through as they carry out internal auditing.

This section reviews literature on three issues namely; internal audit process, studies reviewed and theoretical perspective.

nternal auditing is carried out by going through some steps in a systematic manner. These steps are known as the internal audit process. The internal audit process involves the activities that are undertaken to ensure that the objective(s) of carrying out internal audit is (are) achieved. The internal audit process takes different forms depending on the environment and the orientation of the personnel driving the process; but it has the same approach and objective to add value to an organisation.

Internal audit engagements differ in objective and scope but the internal audit process remains similar because they are designed to achieve common objectives of evaluating and improving the effectiveness of risk management, control, and governance processes in a disciplined and systematic manner. The internal audit process may have different terminologies and tasks for the stages. As suggested by AuditNet (2019), the internal audit process consists of four stages namely planning (sometimes called Survey or Preliminary Review), fieldwork, audit report, and follow-up review. The University of Bath (2019), on the other hand, has a six-stage activity namely; identifying areas to review, arranging an audit, fieldwork, minimising disruption during an audit, reporting, and follow-up while the Wayne State University (2018) adopts a three-stage approach in the internal audit process as planning, fieldwork, and reporting. The University of Pittsburgh (2015) has four stages as planning, fieldwork, reporting, and follow-up. Clarke (2019) indicates that Linford and Company LLP, a Consultancy firm, also has four phases of activities as planning, fieldwork, reporting, and follow-up. The KPMG International (2017), a Consulting firm, has identified seven key steps namely; work programme, planning, fieldwork, exit meeting, reporting, issue resolution tracking, and overall considerations. In all the stages and steps identified, the main consideration is to ensure that the objectives of the internal audit assignments have been achieved to ensure that issues of risk management, control, and governance processes in organisations have been addressed effectively.

The internal audit process continues to remain relevant and it is the responsibility of internal auditors to ensure that the process is followed to expectation. For the purpose of this paper, the internal audit process covers the internal audit planning, internal audit execution, internal audit reporting and follow-up as shown in Figure 1.

The planning stage is where internal auditors plan for their assignments. Planning for audit assignments ensures that the needed logistics are mobilised to direct the focus of the assignments. Kwakye (2008) indicates that the tasks to be performed at the planning stage involve the internal auditors making sure that there is adequate staffing of the internal audit units with the required skill-mix to carry out the evaluation processes, developing assignment plans to guide them in the monitoring engagement, conducting risk assessments to ensure that situations that would hinder the effective management of resources in the local governments have been identified, assessed, and managed, and preparing audit programmes which are the step by step approach in the auditing process which need to be followed in order for them to be focused on achieving the objective of the internal audit assignments.

The internal auditors then undertake the field work of the monitoring processes at the execution stage. The tasks to be performed are to organise entrance conferences to announce their presence for the audit, indicate the completion date for the audit, and undertake some preliminary reviews to acquaint themselves with the audit environment; evaluating and documenting evidence gathered; and consulting the relevant standard internal audit working tools in the course of performing their assignments. The standard internal audit working tools applied in the internal audit process are internal audit documents which aid internal auditors to discharge their duties to expectation and they are the internal audit charter, internal auditing standards, strategic plan for the internal audit unit, code of ethics for internal auditing, internal audit plan, programme of work and audit programme (Kwakye, 2008). The last task to be performed at the execution stage is to organise exit conferences where the findings of the audit are discussed and managements’ response is sought for inclusion in the final audit report.

The reporting stage is where the results of the assignments are communicated to designated recipients. The tasks to be performed are writing the final audit report on the following format:

1. Criteria - the standards, laws, rules, policies, and other dicta which describe the standard situation under normal circumstances;

2. Condition - the state of the situation as at the time of the monitoring engagement;

3. Cause - the reason(s) for the state of the situation as at the time of the monitoring engagement;

4. Effect - the consequences of the reason(s) for the situation at the time of the monitoring engagement

5. Recommendations - control measures which need to be undertaken to remedy the reason(s) for the state of the situation (cause) as at the time of the monitoring engagement; and

1. Audit Client’s comment(s) - comment(s) from the audit client in respect of the finding(s) and the conduct of the monitoring engagement as a whole.

Writing the reports according to the format enables a clear appreciation of the issues involved in the process of monitoring the management of resources. The other tasks are communicating internal audit assignment results to Audit Report Implementation Committee (ARIC), and furnishing management bodies and audit clients with copies of internal audit reports.

The follow-up stage is where the internal auditors conduct a review of their assignments. The tasks to be performed are reviewing the internal audit report and ascertaining the implementation status of the recommendations prescribed. After communicating the report of the audit assignments to designated recipients, the internal auditors go back to the audit clients to ascertain whether or not the recommendations made in their reports have been implemented. The follow-up stage serves as a further check to ensure the achievement of corporate objectives.

Some of the studies reviewed were internal audit practices and the performance of internal audit departments in companies in North-Eastern Ohio (Fadzil, 2003) and the focus was on assessment of internal audit function; the effectiveness of internal auditing in the Telecommunication organisations in Lorestan Province in Iran (Hematfar, Marefat & Mozafari, 2013), on effectiveness of internal auditing; the role of internal audit function in enhancing risk management in Rwandan Social Security Fund (Rudasingwa, 2006) which aimed at the role of internal auditing.

Others were internal audit effectiveness of the Ethiopian Public Sector (Mihret & Yismaw, 2007); factors influencing the adoption or non-adoption of risk based internal auditing among Ghanaian companies (Ayagre, 2014); and enhancing internal audit to promote effective and efficient financial management in the public sector in selected Ministries, Departments and Agencies (MDAs) and Metropolitan, Municipal, District Assemblies (MMDAs) (Asuming, Forkuo, Kankam, Ode & Tetteh, 2013).

The paper adopts the institutional theory to explain the internal audit process. A central assumption which underlies institutional theory points out that pressures are brought to bear on organisations to become similar (DiMaggio & Powell, 1983). In support of this central assumption, Scott (1987) and Zucker (1987) assert that internal and external forces put pressures on organisations; and that while the internal pressures are made of formalised structures such as schemes, procedures and processes, the external pressures constitute forces that relate to state requirements, professional protocols and code of ethics. The institutional theory explains that organisations survive because structures, practices, schemes and procedures have been firmly established and rigidly enforced (Meyer & Rowan, 1977; Scott, 2004).

Per the institutional theory, the internal audit process must be followed strictly in conducting internal auditing thereby, exerting pressures constantly on internal auditors in order to ensure that established laid down procedures and other dicta covering their functions are complied with. It means that in situations where internal auditors do not follow the internal audit process rigidly, they cannot discharge their functions to expectation in order to achieve their mandate of helping to ensure soundness in operations of organisations. Irregularities in the internal audit process may weaken the effects of good corporate governance in local government institutions.

The study was conducted in the Cape Coast Metropolitan Assembly (CCMA), Mfantseman Municipal Assembly (MMA), Abura-Asebu-Kwamankese District Assembly (AAKDA), and Twifo-Hemang-Lower-Denkyira District Assembly (THLDDA) in the Central Region of Ghana. The four local governments were selected purposively according to the structure of local government in the Central Region. The region has one Metropolitan Assembly, seven Municipal Assemblies, and 12 District Assemblies; totaling 20 local government institutions. The only Metropolitan Assembly in the region was selected in addition to one Municipal Assembly and two District Assemblies.

The research philosophy was interpretivism and the in-depth interview design was adopted for the study due to their appropriateness for the collection of non- standardised and non-numerical data. The interviews covered internal audit planning, internal audit execution, internal audit reporting and follow-up.

The key informants were purposively selected through the expert sampling method. Seven key informants participated in the study including four Internal Auditors, one Metropolitan, Municipal, and District Co-ordinating Director (MMDCD), one Chairperson of ARIC and one District Auditor. The qualitative sample size for the study was adequate enough because the goal of qualitative research is to attain saturation. Saturation occurs when adding more participants to the study does not result in additional perspectives or information. For a phenomenological study like this, Creswell (1998) recommended 5–25 participants while Morse (1994) suggested at least six participants.

The study employed four research assistants who were recruited and trained to collect the data using interview guide. The interview guide covering 17 items were grouped under five sections that related to background information on the participants as well as the tasks under internal audit process as identified in Figure 1. Tape recorders were used to capture the responses to the questions in the interview guide.

The data were analysed using pattern matching and content analysis based on themes. They were transcribed, documented and organised in common themes corresponding to the research objectives. In other words, data were coded around themes and the contents analysed with inferences made from the participants’ quotations.

To make the results easy to read and understand, some quotations of the key informants and the corresponding dates were captured in two tables while the rest were presented in prose. The results focused on the tasks involved in the internal audit process.

Three internal auditors indicated that the staffing of the internal audit units was adequate whilst one internal auditor and the other three key informants noted inadequate staff as presented in Table 1.

The four internal auditors were asked to report on whether or not they had developed assignment plans to guide them in performing their tasks. Their quoted responses as presented in Table 2 suggest that they had developed assignment plans as expected of them.

They further reported developing audit programmes in performing their duties as follows:

Audit programmes are developed and used (Internal Auditor 1, 10th August, 2016).

We develop audit programmes for our assignments (Internal Auditor 2, 12th August, 2016).

We develop audit programmes and apply them in our assignments (Internal Auditor 3, 24th August, 2016).

Yes, we prepare audit programmes and follow the steps (Internal Auditor 4, 1st September, 2016).

However, it was further revealed that two of the internal auditors did not conduct risk assessment of audit clients’ departments before assignments as reflected in their responses:

We don’t conduct risk assessment because we already know the system (Internal Auditor 1, 10th August, 2016).

We do not conduct risk assessment because we have been auditing the place always and know the audit clients’ environment (Internal Auditor 4, 1st September, 2016).

Two auditors explained the reasons for not conducting entrance and exit meetings in internal auditing as follows:

The entrance and exit meetings are not conducted because it is internal but the external auditors do (Internal Auditor 1, 10th August, 2016).

We don’t conduct the meetings because the audit clients know what we come for and we issue the reports to them internally (Internal Auditor 2, 12th August, 2016).

Further results showed that while three internal auditors applied the internal audit working tools in their assignments, one did not prepare strategic plan for the internal audit unit that:

I apply all except the strategic plan (Internal Auditor 1, 10th August, 2016).

We employ the working tools because they are useful (Internal Auditor 2, 12th August, 2016).

We use the working tools in our assignments (Internal Auditor 3, 24th August, 2016).

We apply the internal audit working tools (Internal Auditor 4, 1st September, 2016).

The internal auditors pointed out that they document and evaluate evidence in the course of discharging their duties as per the following:

Evidence gathered is documented and evaluated (Internal Auditor 1, 10th August, 2016).

All traces of evidence are documented and evaluated (Internal Auditor 2, 12th August, 2016).

Yes, we document and evaluate all the evidence we gather (Internal Auditor 3, 24th August, 2016).

We document and evaluate evidence (Internal Auditor 4, 1st September, 2016).

At this stage, the final audit reports were prepared to communicate internal audit findings and recommendations to the designated recipients of the audit reports including the ARICs (now known as Audit Committees), management bodies and the audit clients. The following quotations indicated that the tasks under internal audit reporting were performed:

We perform all the tasks (Internal Auditor 1, 10th August, 2016).

Yes, the internal audit reporting tasks are performed (Internal Auditor 2, 12th August, 2016).

Yes, we comply with the directives at the internal audit reporting stage (Internal Auditor 3, 24th August, 2016).

All the tasks under internal audit reporting are performed (Internal Auditor 4, 1st September, 2016).

The internal auditors made follow-up, reviewed the internal audit reports and took actions in order to ascertain the implementation status of the recommendations prescribed. The indication was that the internal auditors conducted follow-ups as reported that:

We follow-up on our recommendations (Internal Auditor 1, 10th August, 2016).

Yes, we review the implementation status of internal audit reports at the follow- up stage (Internal Auditor 2, 12th August, 2016)

Yes, we perform follow-ups (Internal Auditor 3, 24th August, 2016).

Follow-ups are conducted (Internal Auditor 4, 1st September, 2016).

Examining the internal audit process enabled an understanding of the issues contributing to irregularities in the operations of local government institutions. Irregularities in operations depict the quality of internal auditing conducted. In situations where internal auditing is not carried out to expectation the local government institutions are exposed to avoidable risks. It is therefore, necessary that the internal audit process was investigated to ensure an effective way of conducting internal auditing. Literature reviewed was appropriate to assist in examining the internal audit process. Different types of internal audit processes were looked at to provide the basis for settling on one which covered the essentials of all the processes reviewed. Review of literature ensured that this paper stayed within the scope of the study. Diverse views were presented in literature and aided in exploring other similar works which had been conducted. The institutional theory adopted for this paper was appropriate even though the use of agency theory to make provisions for monitoring activities in the internal audit process could have as well explained the research problem. However, the institutional theory aided to explain the phenomenon of enquiry that laid down procedures should be followed in organisations just as in the case of internal audit process of the selected local government institutions.

The in-depth interview design adopted by this study allowed free flow of discussions and key informants expressed themselves to satisfaction. Other designs used in similar works adopted descriptive designs with statistical analysis but the manual analysis of this paper ensured that the data were analysed in their raw state. The key informant interview justified the use of purposive sampling technique and the sample size of seven. Larger sample sizes were employed in other similar works but the use of experts in this qualitative paper made sure that the information provided by the seven key informants assisted in arriving at dependable conclusions. All the four internal auditors of the four selected local government institutions were selected because internal auditors were the key actors of the internal audit process. The Coordinating Directors and the Chairpersons of ARIC supported the internal audit process while the District Auditors were the regulators of the internal audit process.

The results show that in some circumstances, the required tasks under the internal audit process were performed while others were not executed, thereby exposing the system to various degrees of risks. The number of internal auditors required at the internal audit unit depended on the amount of work involved, the complexity of issues, and the time available for assignments to be performed in an organisation, among others. If the number of internal auditors was not adequate, then the quality of internal auditing would not be good. In situations, where internal auditors plan their activities well, few internal auditors can do a lot of work and where there is no proper planning; even a good number of internal auditors cannot perform well in terms of quality of work. The inadequate nature of staffing at the internal audit unit has implications for quality of internal audit assignments. The results were in agreement with the finding of Kiabel (2012) that the internal audit departments were operating with skeleton staff which was not adequate in relation to the size of the companies. However, the results did not agree with International Professional Practices Framework (IPPF) for internal auditing (IIA, 2015) regarding Performance Standard 2030 on resource management of the International Standards for internal auditing. Moreover, the results did not conform to the principles of institutional theory because the selected local governments did not ensure that there was adequate staffing at the internal audit units as part of the structures and laid down procedures.

Assignment plans detail the specific requirements for carrying out internal audit assignments. The plans look at the skill-mix of internal auditors needed for a particular assignment, the number of internal auditors, the nature and amount of resources among others, required to execute the assignment cost-effectively. It is therefore, proper that assignment plans were prepared for internal audit assignments.

The inability to prepare strategic plans indicated that the internal auditors could not adapt to changing expectations in order to be in tune with the selected local governments’ goals and objectives as this could be achieved through the use of strategic plans. Failing to prepare strategic plans agreed with the finding of Mihret and Yismaw (2007) which revealed that the internal audit department did not prepare strategic plans. However, it was not consistent with IPPF-Practice Guide (IIA, 2012, p.1) which requires the internal audit units to prepare and keep strategic plans in order to remain relevant to achieving an organisation’s objectives. Additionally, the results offended against the principles of the institutional theory because the internal auditors failed to observe the preparation of the strategic plans as a laid down policy.

By not conducting risk assessment before internal audit assignments at the planning stage, the internal auditors did not capture all the risks in operations in order to inform management bodies of the need to assess the magnitude of the risks and have them managed. In situations where there were risks, irregularities occurred and resulted in mismanagement of resources. Organisational objectives were not achieved. The argument by some internal auditors that they were familiar with the environments of audit clients and therefore, could perform their duties without conducting risk assessment before assignments was not sound. The reason is that risks avail themselves through situations and the fluid nature of our workplace environments is likely to present different situations at any given point in time with the attendant different forms of risks which are likely to hinder the achievement of objectives. There was therefore, the need to conduct risk assessments before undertaking internal audit assignments in order to capture all manner of risks at any given point in time to be managed. Internal auditors conducting risk assessment has been a contestable issue as others believe that it is rather the responsibility of management bodies to do so and that internal auditors only facilitate the process of risk assessment. In spite of this debate, it is still pertinent that internal auditors conduct risk assessment of the audit clients’ environment in order for them (internal auditors) to understand the environment well to enable them perform to expectation, as they go about their facilitation role in the risk assessment process. It is only when the internal auditors have conducted a risk assessment and understood the environment that they would be in a position to facilitate the risk assessment properly.

At the execution stage, audit clients were expected to be informed of the internal audit engagements in order to prepare for the assignments and this ought to be done at the entrance meetings or conferences. If the entrance meetings were not conducted, the audit clients would not know the work plan of the internal auditors with regard to the start and completion dates for the audit assignments to enable them plan their activities for the audit. In addition, the audit clients would also not have the opportunity to raise any preliminary issues for clarification before the commencement of the audit. The internal auditors followed the steps in the audit programmes, which guided them in performing assignments. This ensured that they went about assignments in a disciplined and systematic manner in order to detect deviations and provided the required assurance on operations. Applying audit programmes for assignments was a useful activity. Evidence gathered in the course of discharging assignments were documented and evaluated. By doing so, decisions and recommendations could be traced to the evidence documented and evaluated and provided a trail to support re-performance and ensured consistency. This achieved the much needed objectivity and rigour. It was appropriate for the internal auditors to document and evaluate evidencegathered.

The other issue was that without organising exit meetings after internal audit assignments, the audit clients could not know the findings of the audit for them to respond to the issues raised before writing the final report. Audit clients would want all doubts surrounding issues to be cleared before the final report was written. In situations where there were no exit meetings, the opportunity to straighten records would be missed. The reports would contain unnecessary details some of which could have been dealt with at the exit meetings. The arguments by some of the internal auditors that it was the external auditors who conducted the entrance and exit meetings were not tenable. The reason is that every internal audit assignment requires the internal auditors to introduce the nature of the assignments to the audit clients, give the audit clients the opportunity to seek clarifications on issues relating to the audit assignments, and also responding to issues raised in the findings before the final report is written. The entrance and exit meetings were essential at the execution stage and should be performed at all times of internal audit assignment.

The lapses such as inadequate staff, lack of risk assessment, not conducting entrance and exit meetings at the internal audit planning and execution stages conformed to the finding of Udeh and Nwadialor (2016) that staff of the internal audit department did not implement internal audit procedures. Badara (2012) corroborated the existence of lapses in the internal audit process by stating that auditors did not adhere to general auditing standards. However, the lapses did not conform to the finding of Tackie, Marfo-Yiadom, and Achina (2016) that there was high quality of audit work due to compliance with the international standards on auditing and local audit legislations. The lapses also contrasted to the institutional theory, which emphasizes that norms, schemes, structures, and procedures should be followed in an organisation, because some tasks under the internal audit planning and execution were breached.

After the execution stage, the internal auditors communicated the results of the internal audit assignments through internal audit reports. Internal audit reports contained the details of the audit examination exercise and should be written at the end of each internal audit assignment. Performing the tasks at the internal audit reporting stage of the internal audit process meant that the findings and recommendations of the internal audit engagements were communicated to designated recipients of the reports for necessary actions to be taken. By reviewing the implementation status of the internal audit reports at the follow-up stage, internal auditors became abreast of the outstanding issues in the internal audit reports which needed further attention.

The performance of the tasks at the internal audit reporting and follow-up stages is in agreement with the standard activities of the internal audit process (Kwakye, 2008). It also conformed to the logical approach to the definition of internal auditing (IIA, 2015) which requires a disciplined and systematic sequence. The results were in consonance with Anthony (2015) which pointed out that the independent variables used to assess the effectiveness of internal audit were highly correlated to effectiveness of internal audit and the internal audit was, on average, effective. The results were also in line with the institutional theory because the internal auditors accomplished the tasks following the norms and procedures under the two stages of the internal audit process.

The contribution to research is that the in-depth interview design allowed the authors to arrive at dependable results and that underscored the fact that the interpretivist philosophy and the qualitative approach were a good choice for studies involving human experiences. On the other hand, the contribution to practice is that internal auditors should not assume to be familiar with their work environment for them to skip some laid down procedures in their work engagements because risks are bound to occur as situations continue to change in organisations.

The paper has provided evidence that the internal auditors of the selected local government institutions largely but not fully followed internal audit process. The lapses prevented internal auditors to achieve their objectives of evaluating and improving the risk management, control, and governance processes because there were irregularities in operations. To address the lapses, the Head of Local Government Service should sanction internal auditors who fail to comply with the tasks in the internal audit process. The Director-General of the Internal Audit Agency should step up its monitoring functions to ensure that the breaches to the internal audit process are instantly corrected by the affected internal auditors. The lessons from this study should be adopted by other local government institutions in Ghana.