Risk management

9. The Turnbull report states that a sound system of internal control "depends on a thorough and regular evaluation of the nature and extent of the risks to which the company is exposed". It further states that the purpose of internal control "is to help manage and control risk rather than to eliminate it". The SIC should therefore be the end result of a process of management that is embedded in the planning operational monitoring and review activities of the body* these activities being the critical elements of the statement. Production of the SIC should not be conducted as an "add-on" end of year activity. The Statement on Internal Control should explain the nature of control and any material changes in control exercised through the whole of the accounting period.

*    '' Draft guidance on risk management was produced by Treasury in February 2000 in "Management of Risk-A Strategic Overview" (The "Orange Book").   The final version of this will be issued shortly after this letter. A version of this guidance developed to be especially appropriate to smaller organisations ("Management of Risk - Guide for Smaller Bodies") has been produced. These documents are advisory and each body should identify for itself the methodology for embedded risk management that is most appropriate for its business and circumstances.

Internal Audit and Audit Committees

10. The Turnbull Report referred to the need for internal audit or other monitoring processes to assure management and the board that the system of internal control is functioning as intended. Accounting Officers are already required to make provision for internal audit under the provisions of Government Accounting. Accounting Officers should as part of their annual review of the system of internal control ensure that their internal audit provision is adequately resourced to deliver a service in accordance with the standards in the Government Internal Audit Manual.

11. To assist in supporting the contribution of audit to risk management and governance "Policy Principles for Audit Committees" have been developed in consultation with both Principal Finance Officers and Heads of Internal Audit. These are attached at Annex C.

Enquiries

13. Departments should ensure that their executive agencies trading funds and executive Non-Departmental Public Bodies are aware of the requirements of this letter.

Yours sincerely

As Accounting Officer I have responsibility for maintaining a sound system of internal control that supports the achievement of departmental policies aims and objectives set by the department's Ministers whilst safeguarding the public funds and departmental assets for which I am personally responsible in accordance with the responsibilities assigned to me in Government Accounting. (Accounting Officers may wish to amend this paragraph to provide a comprehensive explanation of the accountability arrangements surrounding their organisation)

The system of internal control is designed to manage rather than eliminate the risk of failure to achieve policies aims and objectives; it can therefore only provide reasonable and not absolute assurance of effectiveness.

The system of internal control is based on an ongoing process designed to identify the principal risks to the achievement of departmental policies aims and objectives to evaluate the nature and extent of those risks and to manage them efficiently effectively and economically. This process has been in place [for the year ended 31 March 200x/since XX] and up to the date of approval of the annual report and accounts and accords with Treasury guidance.

As Accounting Officer I also have responsibility for reviewing the effectiveness of the system of internal control.

o procedures for identifying the body's objectives and key risks;
o the development of the control strategy and risk management policy;
o the allocation of risk ownership;
o the role of the Audit Committee or other relevant committee;
o involvement and role of internal audit;
o procedures for ensuring that aspects of risk management and internal control are regularly reviewed and reported on;
o systems used to ensure compliance with specific regulations or procedures laid down by central departments
o details of monitoring procedures for subsidiary bodies
o monitoring of progress with current initiatives and compliance with extant external requirements

My review of the effectiveness of the system of internal control is informed by the work of the internal auditors and the executive managers within the department who have responsibility for the development and maintenance of the internal control framework and comments made by the external auditors in their management letter and other reports.

As Accounting Officer I have responsibility for maintaining a sound system of internal control that supports the achievement of departmental policies aims and objectives set by the department's Ministers whilst safeguarding the public funds and departmental assets for which I am personally responsible in accordance with the responsibilities assigned to me in Government Accounting.

The system of internal control is designed to manage rather than eliminate the risk of failure to achieve policies aims and objectives; it can therefore only provide reasonable and not absolute assurance of effectiveness.

The system of internal control is based on an ongoing process designed to identify the principal risks to the achievement of departmental policies aims and objectives to evaluate the nature and extent of those risks and to manage them efficiently effectively and economically. This process has been in place for the year ended 31 March 2002 and up to the date of approval of the annual report and accounts and accords with Treasury guidance.

As Accounting Officer I also have responsibility for reviewing the effectiveness of the system of internal control. The department has established the following processes:

• periodic reports from the chairman of the audit committee to the board concerning internal control;

• regular reports by internal audit to standards defined in the Government Internal Audit Manual which include the Head of Internal Audit's independent opinion on the adequacy and effectiveness of the department's system of internal control together with recommendations for improvement;

• regular reports from managers on the steps they are taking to manage risks in their areas of responsibility including progress reports on key projects;

• a regular programme of facilitated workshops to identify and keep up to date the record of risks facing the organisation;

• a programme of risk awareness training;

• implementation of a robust prioritisation methodology based on risk ranking and cost-benefit analysis;

• establishment of key performance and risk indicators;

• maintenance of an organisation-wide risk register

• reports from the chief executives of the department's agencies on internal control activities

• reports on compliance with the principal recommendations in the Cabinet Office report Successful IT: Modernising Government in Action.

My review of the effectiveness of the system of internal control is informed by the work of the internal auditors and the executive managers within the department who have responsibility for the development and maintenance of the internal control framework and comments made by the external auditors in their management letter and other reports.

As Accounting Officer I have responsibility for maintaining a sound system of internal control that supports the achievement of departmental policies aims and objectives set by the department's Ministers whilst safeguarding the public funds and departmental assets for which I am personally responsible in accordance with the responsibilities assigned to me in Government Accounting.

The system of internal control is designed to manage rather than eliminate the risk of failure to achieve policies aims and objectives; it can therefore only provide reasonable and not absolute assurance of effectiveness.

The system of internal control is based on an ongoing process designed to identify the principal risks to the achievement of departmental policies aims and objectives to evaluate the nature and extent of those risks and to manage them efficiently effectively and economically. I expect to have the procedures in place in March 2002 necessary to implement Treasury guidance. This takes account of the time needed to fully embed the processes which the department has agreed should be established and improve their robustness.

We have held a risk management workshop attended by representatives of all grades of staff throughout the department during which we identified the department's objectives and risks and determined a control strategy for each of the significant risks. As a result of this workshop a risk management policy document has been sent to all staff setting out the department's attitude to risk to the achievement of the departmental objectives.

The management board has changed its meeting calendar and agenda so that risk management and internal control will be considered on a regular basis during the year and there will be a full risk and control assessment before reporting on the year ending 31 March 2003. Risk management has been incorporated more fully into the corporate planning and decision making processes of the department.

The board receives periodic reports from the chairman of the audit committee concerning internal control and we require regular reports from managers on the steps they are taking to manage risks in their areas of responsibility including progress reports on key projects.

Following the publication in September 2000 of the department's risk framework further work has been done to widen the basis of the framework and to bring about more consistency in the way in which the department treats risks.

In addition to the actions mentioned above in the coming year the department plans to:

• arrange a regular programme of facilitated workshops to identify and keep up to date the record of risks facing the organisation;

• introduce a programme of risk awareness training; 

• establish a system of key performance and risk indicators; 

• develop and maintain an organisation-wide risk register; and

• arrange for reports from the chief executives of the department's agencies on internal control activities.

The department has an Internal Audit Unit which operates to standards defined in the Government Internal Audit Manual. They submit regular reports which include the HIA's independent opinion on the adequacy and effectiveness of the department's system of internal control together with recommendations for improvement.

My review of the effectiveness of the system of internal control is informed by the work of the internal auditors and the executive managers within the department who have responsibility for the development and maintenance of the internal control framework and comments made by the external auditors in their management letter and other reports.

'I review whether the statement on page - reflects the [name of audited body]'s compliance with Treasury's guidance "Corporate Governance: Statement of Internal Control". I report if it does not meet the requirements for disclosure specified by Treasury or if the statement is misleading or inconsistent with other information I am aware of from my audit of the financial statements'.

• Consideration of whether the disclosures are consistent with the NAO's review of board and committee minutes and their knowledge of the audited body obtained during the audit of the financial statements;

• NAO attendance at audit committee meetings at which corporate governance internal control and risk management matters are considered;

• Consideration of the process adopted by the Accounting Officer for his/her effectiveness review and of the documentation prepared to support the statement.

4. As noted above the auditor's work on the financial statements audit is not driven by the requirement for an internal control statement and cannot be relied upon to indicate that controls are effective. Nevertheless the NAO audit approach `Audit 21' is a risk based approach based upon obtaining a good understanding of the business the risks that it faces and how those risks are managed. Although the ernphasis remains to an extent on financial risks and controls this work should provide a sound base for the auditor's consideration of the Accounting Officer's internal control statement. It should also provide opportunities to make recommendations for improvements to internal controls.

The purpose of an Audit Committee is to give advice to the Accounting Officer on the adequacy of audit arrangements (internal and external) and on the implications of assurances provided in respect of risk and control in the organisation. The following principles are provided to facilitate the establishment of Audit Committees that will be well equipped to meet that purpose.

6. The Audit Committee is appointed to give advice to the Accounting Officer. Although the Accounting Officer may chair the Audit Committee the objectivity of the advice given can be enhanced if another member (particularly a non-executive) is the Chair of the Audit Committee.

7. Members of the Audit Committee who have executive responsibility in the body (in those organisations which have a sufficiently large number of senior executive staff) should be rotated on an appropriate cycle (three years will generally be appropriate) to provide for objectivity in the long term and to avoid over or under representation of particular aspects of the body's business and administrative interests.

8. Audit Committees should have documented terms of reference from the Accounting Officer/Board which should include a remit to consider the adequacy of risk management and internal control through reviewing (inter alia):

the mechanisms for the assessment and management of risk

the planned activity of internal audit

the results of internal audit activity

the planned activity of external audit

the results of external audit activity

adequacy of management response to issues identified by audit activity

assurances relating to the corporate governance requirements for the organisation

9. The Head of Internal Audit and the senior member of the external audit team should have the right of access to the Audit Committee and should normally be present at meetings (as attendees rather than members)

10. The Audit Committee should meet regularly and at least three times a year.

• DAO Letters home page