Part XIII – INTERNAL AUDIT AND AUDIT COMMITTEES

153Mandate of internal auditors

Internal auditors shall—

• (a) review and evaluate budgetary performance, financial management, transparency and accountability mechanisms and processes in county government entities, including County Assembly;

• (b) have a duty to give reasonable assurance through the audit committee on the state of risk management, control and governance within the organization; and

• (c) review the effectiveness of the financial and non-financial performance management systems of the entities.

154Compliance with professional standards and code of ethics

Internal auditors shall comply with the International Professional Practices Framework as issued by the Institute of Internal Auditors from time to time and shall conduct audits in accordance with policies and guidelines issued by the Public Sector Accounting Standards Board to ensure uniformity and consistency across county government.

155Independence of the internal auditor

(1) The Head of Internal Audit unit in a county government entity shall enjoy operational independence through the reporting structure by reporting administratively to the Accounting Officer and functionally to the Audit Committee.

(2) An Accounting Officer shall ensure that the organizational structure of the internal audit unit facilitate—

• (a) the entity to accomplish its internal audit responsibilities;
• (b) internal auditor with sufficient authority to promote independence and to ensure broad internal audit coverage, adequate consideration of audit reports;
• (c) appropriate action to be taken on internal audit recommendations; and
• (d) the internal auditor to be independent of the programs, operations and activities he or she audits to ensure the impartiality and credibility of the audit work undertaken.

(3) The internal auditor shall have unrestricted, direct and prompt access to all records, officials or Personnel holding any contractual status and to all the premises and properties of the entity.

(4) The internal auditor shall respect the confidential nature of information and shall use such information with discretion and only in so far as it is relevant to reach an audit opinion.

(5) All internal audit activities shall remain free of influence by any element in the organization, including matters of audit selection, scope, procedures, frequency, timing, or report content to permit maintenance of an independent and objective mental attitude necessary in rendering reports.

(6) Internal Auditors shall have no direct operational responsibility or authority over any of the activities they review. Accordingly, they shall not develop nor install systems or procedures, prepare records, or engage in any other activity which would normally be audited.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

THE COUNTY HEAD OF INTERNAL AUDIT SERVICES OF THE COUNTY TREASURY

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

156Independence of County Head of Internal Audit services

The County Head of Internal Audit Services shall be an office in the County Treasury.

157Functions of County Head of Internal Audit services

The County Head of Internal Audit Services, in leading the internal audit function within the County Treasury, is responsible for operational aspects of internal audit function within the county government entities including—

• (a) advising the County Executive Committee Member and the Chief Officer on emerging issues in internal auditing;

• (b) developing and implementing the use of innovative approaches in performing independent assessment of systems, controls and efficiencies guided by professional standards;

• (c) promoting county government-wide risk management and provide the management with consulting services to improve the overall county government operations;

• (d) providing capacity building for county government entities including developing curriculum, training materials and undertake training for audit committees; and

• (e) reporting annually to the County Treasury on the internal audit function performance.

158The role of Accounting Officer in risk management

The Accounting Officer shall ensure that—

• (a) the county government entity develops risk management strategies, which include fraud prevention mechanism; and

• (b) the county government entity develops a system of risk management and internal control that builds robust business operations.

159Performance appraisal

(1) Each year the head of internal audit unit shall assess its own effectiveness through an internal performance appraisal and shall carry out annual review of the performance of the internal audit activity commenting on its effectiveness in the annual report to County Treasury.

(2) Each year the Audit Committee shall carry out annual review of the independence, performance and competency of the internal audit unit and comment on their effectiveness in the annual report.

(3) At least once every three years, but not more than five years, internal audit unit shall undergo a professional assessment of its effectiveness undertaken by a professionally recognized body or institution.

160Reporting material breaches and persistent material breaches

(1) When indications of fraud, material breaches and wasteful expenditure have been identified in a county government entity in accordance with section 92 of the Act, the head of the internal audit unit shall immediately notify the County Executive Committee Member.

(2) The County Executive Committee Member may notify the Cabinet Secretary of the findings of paragraph (1) in this regulation with a copy to the Auditor-General.

161Prohibition from conducting assurance services

An internal auditor shall not perform audit assignments for providing assurance relating to activities and structures on which he or she has provided consulting services or in which he or she had been employed over in the last twenty four months.

162Disciplinary liability on internal auditors

Heads of internal audit and the internal auditors shall bear legal and disciplinary liability for failure to discharge their responsibilities under the Act and these Regulations: Provided that assurance procedures alone even when performed with due professional care shall not be a guarantee that all significant risk shall be identified.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

INTERNAL AUDIT PLANNING, PERFORMANCE AND REPORTING

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

163Risk based audit assessment strategic plan

(1) Internal audit planning shall be carried out on the basis of risk assessment and shall be set out in a three-year strategic plan, on the basis of which an annual internal audit activity plan shall be developed.

(2) The annual work plan developed in paragraph (1) shall be—

• (a) submitted to the audit committee by 15th February each financial year; and
• (b) approved by the audit committee and shared with the Accounting Officer of that entity, in sufficient time for inclusion in the budget of that entity.

164Communicating results

(1) The findings and recommendations arising from each internal audit assignment shall be promptly reported to the accounting officer.

(2) The final report, including the actions taken by the accounting officer should be reported to the audit committee in a format to be gazetted by the Cabinet Secretary.

(3) When updating the management of the progress of an audit assignment, the internal auditor shall—

• (a) give an oral preliminary report which shall be confirmed in writing within seven (7) days;
• (b) discuss the findings, conclusions and recommendations with the auditee;
• (c) issue a signed written report after each internal audit assignment that is objective, clear, concise and timely;
• (d) give reports which clearly present the purpose, scope and results of the audit; and
• (e) give reports with recommendations for potential improvement, suggestions of corrective actions and acknowledgement of satisfactory performance.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

IMPLEMENTATION OF AUDIT RECOMMENDATIONS

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

165Enforcement of Internal Audit recommendations

(1) The accounting officer of the concerned entity shall be responsible for the implementation of the recommendations made in the audit reports and shall develop response and action plan which they shall submit to the chairperson of the audit committee within fourteen days.

(2) The response and action plan submitted to chairperson of internal audit committee in paragraph (1) of this regulation shall be followed up to ensure its implementation.

166Preparation and submission of quarterly and annual audit reports

(1) Each head of internal audit unit shall prepare a quarterly internal audit report which shall cover areas provided for in guidelines and shall be in a format issued by the Cabinet Secretary.

(2) The quarterly report in paragraph (1) of this regulation shall be submitted within 14 days of the end of the quarter to the Accounting Officer of the concerned entity, the Audit Committee and the County Treasury.

(3) At the end of each financial year, the County Head of Internal Audit Services shall prepare for the county government clear and comprehensible annual report that consolidates the quarterly audit assurance reports prepared by all internal audit units activities in county government entities, in accordance with formats prescribed by the Public Sector Accounting Standards Board.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

AUDIT COMMITTEES

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

167Establishment of audit committees

(1) Subject to paragraph (2) of this regulation, each county government entity shall have an audit committee.

(2) The County Treasury, where deemed necessary, may approve the sharing of one audit committee by two or more county government entities.

(3) In the case of a shared audit committee referred to in paragraph (2) of this regulation, the appointing authorities of the concerned entities shall jointly appoint the chairperson and members of the joint audit committee in consultation with the County Treasury.

(4) There shall be a minimum of three members, excluding a person who shall be appointed to represent the County Treasury in each audit committee and a maximum of five of whom at least two shall be from recognized professional bodies.

(5) The chairperson of an audit committee shall be independent to the County government entities, be knowledgeable of the organization, have the requisite business and leadership skills and shall not be a political office holder.

(6) In addition to paragraph (5) of this regulation, majority of members appointed to the audit committee shall not be past or present employees of the entity, and shall not have served as an employee or agent of a business organization which has carried out any business with the concerned entity in the last two years.

(7) All members of an audit committee shall—

• (a) hold a first degree in relevant field from a recognized university;
• (b) have a good understanding of county government operating, financial reporting or auditing; and
• (c) have a good understanding of the objects, principles and functions of the entity to which they are to be appointed.

(8) Each accounting officer of a county government entity shall ensure that, the audit committee is adequately funded and supported.

(9) The chairperson of an audit committee shall not serve concurrently as a member of any other committee of the concerned county government entity, however its members can serve in up to a maximum of three audit committees at the same time.

(10) The Public Sector Accounting Standards Board shall prescribe guidelines for appointment of audit committees to be approved and gazetted by the Cabinet Secretary. [L.N. 230/2015, r. 7.]

168Duties of the audit committees

The main function of the audit committee shall be to—

• (a) support the accounting officers with regard to their responsibilities for issues of risk, control and governance and associated assurance: Provided that the responsibility over the management of risk, control and governance processes remains with the management of the concerned county government entity; and

• (b) follow up on the implementation of the recommendations of internal and external auditors.

169Composition of audit committees

(1) The Accounting Officer of a county government entity shall not be a member of the audit committee, but shall attend meetings of the audit committee by the invitation of the chairperson of the committee.

(2) Audit Committee members shall be persons of integrity and in compliance with the requirements of Chapter six of the Constitution.

170Terms of appointment

(1) Members of audit committees shall be appointed, for a term of three years and shall be eligible for re-appointment for a further one term only.

(2) Despite the provision of paragraph (1) of this regulation, after expiry of every term, at least one third of the committee shall retire and not be eligible for re-appointment.

(3) The roles and responsibilities of the audit committee shall be laid out in the guidelines issued by the Public Sector Accounting Standards Board.

171Vacancy of office

(1) A person shall cease to be a member of an audit committee if—

• (a) that person is convicted of a criminal offence and sentenced to a term of imprisonment of not less than six months; or
• (b) that person is absent from three consecutive regular meetings of the committee without leave of absence; or
• (c) that person resigns, in writing, from the audit committee; or
• (d) that persons' term of office expires; or
• (e) that person ceases to be a member by virtue of withdrawal of his or her nomination to the board by the nominating institution; or
• (f) that person becomes an employee or officer of the concerned entity; or
• (g) that person is discovered to have a conflict of interest as described in his or her letter of appointment at the time of his or her appointment and failed to disclose it; or
• (h) the audit committee is disbanded.

(2) The County Treasury shall be informed of any contemplated termination of the services of a person serving on an audit committee for its concurrence.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

FUNCTIONS AND RESPONSIBILITIES OF THE AUDIT COMMITTEE

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

172Meetings of the audit committee

(1) The audit committee shall meet at least once in every three months.

(2) Each member of the audit committee shall have one vote.

(3) The audit committee shall make decisions by resolution

(4) In the event of a tie vote, the chair shall be entitled to cast a second vote.

(5) A majority of the members of the audit committee that includes at least fifty percent plus one member shall constitute a quorum for the meetings of the committee.

(6) The chair of the audit committee shall—

• (a) ensure that minutes are taken at each meeting and provided to the members of the Committee before the next meeting;
• (b) have access to management, the head of internal audit and external auditors; and
• (c) send or cause to be sent—
• (i) notice of audit committee meetings at least fourteen days before the meeting; and (ii) all minutes of audit committee meetings.

(7) If at any meeting of the audit committee the chair is not present, the members shall elect a chair for purposes of conducting that meeting.

173Code of conduct

Any code of conduct of public officers shall also apply to members of the audit committee in relations to their functions, powers and duties as members of the committee.

174Remuneration and compensation

(1) Members of the audit committee shall be paid an allowance on account of attendance of audit committee meetings as determined by County Treasury in consultation with other relevant entities.

(2) A county government entity shall reimburse members of its audit committee for expenses incurred while attending to audit committee duties.

175Capacity building for audit committees

The accounting officer shall—

• (a) provide capacity building to all public county government entity audit committees;

• (b) provide policies and guidelines on audit committees;

• (c) monitor the effectiveness of audit committees; and

• (d) provide periodic updates of audit committee activities through the website.