effectively the internal control system operates. This is done by drawing on relevant findings related to the internal control arrangements and activities, and by structuring the information around the five internal control components identified by international standards:
- Control environment
- Risk assessment
- Control activities
- Information and communication
- Monitoring
The internal control framework approach to designing and operating internal control systems is a useful tool to build an integrated assessment and to highlight areas insufficiently addressed or where irregularities or errors might be more significant. It also helps to identify whether the control system goes beyond the traditional approach focused on isolated control activities.
The assessment should draw on relevant documentation collected for the preceding sections of the report and conclusions leading to the scoring of the indicator set. It should build on the description of the design of internal controls (through legal, regulatory and institutional arrangements, in Section 2 of the PEFA report) as well as the individual assessment of specific control activities as covered by a significant number of performance indicators (without being exhaustive: PI-6, 8, 10, 11, 12, 13, 16, 19, 21, 22, 23, 24, 25, 27, 28 in Section 3).
This section should also draw on recent evaluations of the effectiveness of internal control issued by internal audit, external audit, or other external bodies to the extent that such reports exist. Reports on the functioning of internal control issued by government may equally be useful. Cross-country assessments of governance by international organizations may also provide useful inputs to the assessment if they provide insight into the establishment and performance of the government’s internal control framework.
Detailed findings concerning the main elements of the five internal control components are summarized in a table (Annex 2) that also highlights any gaps in coverage of the control components by the assessed internal control system.
External oversight mechanisms contribute to monitoring of the effectiveness of the internal control system and to putting pressure on the executive to improve it. Such mechanisms include, e.g., undertaking systems audits, review of audits by the legislature, follow-up systems for the executive’s implementation of remedial measures, and providing public access to relevant reports and debates. Such activities therefore serve as reinforcement mechanisms and form part of the analysis of effectiveness of the control systems. The interaction between the external oversight and the internal control system shall therefore be considered in the analysis.
The analysis in this subsection also aims at reaching an impression of how internal controls contribute to addressing the risks related to achieving each of the three main fiscal and budgetary outcomes. To facilitate this analysis, assessors should consider how internal control elements of each individual indicator dimension contribute to each of the three main fiscal/budgetary outcomes.
The effectiveness of internal control also offers a perspective on the reliability of data obtained from government systems and therefore contributes to explaining the degree of confidence with which conclusions may be drawn on the basis of indicator assessments which rely on such data.
