Among the elements of the public administration system, which is designed to ensure the most efficient, transparent use of financial resources provided by the state as well as international donors and partners, are financial controls, including internal controls (IC) and internal audit (IA).

For Ukraine as a candidate for EU membership, the key guidelines for reforming and developing internal controls and internal audit primarily encompass regulations, guidelines and legal acts set out in the EU acquis; frameworks based on the current EU acquis, OECD legal instruments, other international standards, as well as on the best practices of the EU and OECD member states; international obligations of Ukraine; reports of international organisations and experts on the assessment of the current PIFC-related issues.

Proper public finance management systems (including Public Internal Financial Control (PIFC)) are a prerequisite for ensuring the effective use of EU funds both at the central and at regional and local levels. According to the European Commission’s guidelines, the PIFC system should equally fully cover all budgetary resources of the country as well as EU resources.

According to Article 35 of the Regulation on the Ukraine Facility and Annex C for Component I[1], Ukraine must establish an effective management and control system based on internationally recognised internal control principles.

Regarding EU funds, amendments to Article 4 of Regulation (EU) No. 1303/2013 in connection with new internal control requirements were made in compliance with Regulation (EU) 2021/1060. In the new Regulation, Article 4 has been replaced by Article 69, which sets forth updated provisions on management, control and avoiding conflict of interest. The key changes include:

1. Strengthening internal controls. The new provisions emphasise the need for robust management and control systems ensuring, among other things, the effective use of funds and the prevention of financial abuse.
2. Avoiding conflict of interest. The updated provisions clearly define mechanisms to prevent conflict of interest among persons involved in the implementation of the budget.
3. Ensuring transparency. New requirements have been established for the transparency of financial transactions to ensure increased accountability of the authorities, including those responsible for managing the funds.

These changes aim to improve the internal control system in the context of the new challenges faced by the EU Member States and to ensure a more efficient use of financial resources.

Chapter 22 of the acquis provides for introducing financial mechanisms for regional policies and the use of EU structural instruments, which should be based on the applicable internal control systems described in Chapter 32 of the acquis.

Therefore, the development of financial management and controls at the local level largely depends on the progress in implementing Chapter 32 of the acquis. Although Chapter 22 of the acquis is not included in the cluster of fundamental reforms, its introduction and development at the local level are closely related to fulfilling the objectives of Chapter 32 of the acquis, especially in terms of the implementation of legislation on financial management and controls. “ Public management and control systems include procedures for preventing, detecting and reporting on irregularities and fraud, ensuring co-ordination and timely investigation and sanction of fraud and corruption.[2]”

The best European internal control and internal audit practices provide a proper reference point and should guide Ukraine on the path of the development and improvement of the Ukrainian PIFC system.

According to the INTOSAI 9110 Guidance for Reporting on the Effectiveness of Internal Controls,[3] creating effective internal control systems requires the following key elements: (1) a legislative framework; (2) internal control standards; (3) managers who are primarily responsible for effective controls; (4) regular self-assessment of internal controls managers; (5) internal audit and controls; (6) a supreme body — the central harmonisation unit (hereinafter the CHU), which creates and coordinates the internal control systems.

The experience of some EU countries and candidate countries for EU membership is presented below. It covers the following issues: development and implementation of the regulatory and methodological frameworks in the field of public internal financial control (including internal controls and internal audit at the local level); identification of pain points in their introduction; advanced training and certification of internal auditors, etc.

Ireland[4]

Ireland has 31 local self-government bodies, and all of them have an internal audit function. At the same time, 22 LSGs carry out internal audits using their own resources, 3 LSGs have fully outsourced the internal audit function and 6 LSGs use a combined internal audit model (both their own resources and outsourcing).

In addition, Ireland has the Local Government Internal Audit Network (LGIAN) — a forum for local self-government internal auditors. Its key objective is to share knowledge and best practices and improve the effectiveness of the internal audit function, and all local self-government bodies with internal audit functions are its members.

All local self-government bodies have a training plan for internal auditors, with the exception of two agencies where the internal audit function is outsourced. At the same time, the internal audit function is implemented in practice in accordance with the Terms of Reference approved by the Audit Committee.

In most municipalities, the heads of the internal audit units are directly subordinate and report to the chairperson of the executive committee of the local self-government body; in some, however, they report to both the chairperson of the executive committee and the head of the finance body.

During audits, internal audit units have unlimited access to all data, records, property and personnel of the local self-government body. In the case of Leitrim, where the internal audit function is fully outsourced, the audit topics are selected by the Audit Committee subject to the approval of the head of the finance body of the local self-government body.

Thus, all functions and scope of activities of a local self-government body are subject to the audit of the internal audit unit. Following the audit, the internal audit units prepare and publish an annual report (for each body separately).

Romania[5]

In Romania, the PIFC powers are vested in the central harmonisation unit at both the state and local levels. According to the country’s laws, each public body/institution must have within its structure a special unit consisting of at least two employees to perform internal audit functions. While most central government bodies (ministries, departments) easily fulfil this requirement, the situation is different at the local level, with its shortage of material, financial and human resources.

To support local leaders in creating the above internal audit units, Romania’s existing regulatory framework enables cooperation between several local self-government bodies. Either one of these bodies can act as the organiser or the organisational role can be entrusted to a shared unit created jointly by these bodies. Hence, cooperation in the field of internal audit involves joint creation and use of the internal audit function as well as pooling of the necessary financial resources to ensure the relevant activities. The main requirement is that the cost of providing an internal audit is lower than in the case of creating separate units.

The laws on the joint use system in internal audit management provide for several features defined for the local level. Each body has an annual and strategic audit plan, which are then combined into centralised annual and strategic plans. Internal auditors are administratively subordinate to the management of the shared unit, and they report to the managers of the bodies participating in this cooperation model in their internal audit activities. Reports on the internal audit are only provided to and approved by the manager of the institution being audited. Audit-related organisational decisions should be made unanimously.

The advantages of this approach include the possibility of internal audit for small state/local bodies and cost-effective use of financial resources. However, this system also has its drawbacks, such as difficulties in decision-making and poor engagement of participants in the cooperation model. Further problems arise due to the shortage of qualified personnel, a poor financial footing and the need for more active training of professionals in this area.

The Netherlands[6]

Unlike the classical PIFC theory, according to which the central harmonisation unit combines coordination functions, both in terms of introducing the internal control system in the public sector and the creation and operation of internal audit services there, the Netherlands delimit the functions of the CHU, distributing them between the designated government bodies. Certain functions that traditionally belong to the CHU, related to the development of the procedures for implementing the internal audit function, coordination and quality assessment of this function, are delegated to the designated unit within the Central Government Audit Service (CGAS) (subordinate to the Ministry of Finance), which regularly reports to the CHU of the Ministry of Finance.

However, the CGAS does not have control powers over municipalities. Such controls are implemented by independent commercial audit firms that are contracted and reimbursed directly by municipalities. In this case, CGAS contracts only the firms qualified to audit the specific (directions, issues, etc.) to be audited in municipalities.

Serbia[7]

The public administration sector has seen active development of internal audits. According to the report on the negotiations on Chapter 32 of the acquis[8], the internal audit function was established back in 2014 within 76 administrators of budget funds (55 at the central government level and 21 at the local self-government level), which administered 90% of budget funds. Of the above 76 managers of budget funds: 27 units employed one internal auditor, 11 units had two internal auditors, and the remaining 38 units had three or more internal auditors. If the manager of budget funds (budgetary institution) has a small number of employees, it can establish a shared internal audit unit or enter into an agreement with the budget managers (institutions) that have the internal audit function to use the services of their auditors.

North Macedonia

In accordance with the Law on Internal Financial Control in the Public Sector, the following internal audit models are used in practice:

• Internal audit is conducted by a unit of the designated body, institution or agency;
• Establishing a shared internal audit unit;
• Contracting internal audit services.

The law also defines the internal audit criteria at the central and local levels, which include the following:

• Scope of financial transactions: internal audit is conducted to verify financial transactions at the central and local levels according to their scope and complexity;
• Risk level: internal audit is aimed at directions or processes with the highest risk for the effective functioning of the internal control system at the central and local levels;
• Compliance: internal audit may include verification of the body’s compliance with the legislation and regulations at the central and local levels;
• Financial efficiency: internal audit aims to analyse the efficiency of the use of financial resources at both levels and identifies options for their optimisation;
• Strategic goals: internal audit should meet the strategic goals and priorities of the body at both levels;
• Internal needs: internal audit should be designed to meet the internal management and control needs at both levels.

These criteria can be established to reflect the specific features and needs of each individual body or institution at the central and local levels. The criteria applied at the central and local levels depend on the average budget performance over the past three years.

Moldova[9]

The PIFC concept was developed by the European Commission as a structured operating model to assist authorities in modernising their own internal control environment and, among other things, to update public sector controls in line with international standards and EU best practices.

Over the past decade, Moldova has been taking steps to foster conditions for the comprehensive implementation and development of the PIFC[10] system according to European standards. Below are some of the provisions of the Law on State Internal Financial Control. For instance, the Law:

• applies at the local level as well;
• defines the key terms (including PIFC, internal control, internal audit, principles and elements);
• identifies positions responsible for organising and implementing internal controls throughout the public entity’s hierarchy: - the top-level manager of the public entity is referred to as the public manager; - managers responsible for managing the organisational structure at all other levels of the public entity are “operational managers”.

In order to assess the internal management control system, the public entity holds an internal audit as follows:

• IA conducted by an internal unit of the public entity;
• IA through association;
• IA on a contractual basis.

Ministries, the National Social Insurance Fund and the National Health Insurance Company should create internal audit units with at least three full-time employees, and second-level local public administration bodies should establish these units with at least two full-time employees.

Regarding second-level local public administration bodies, the relevant provisions of the Law entered into force on 1 January 2020.

The head of the internal audit unit must have professional qualifications in the field of internal audit in the public sector certified by the Ministry of Finance, or an internationally-recognised internal audit qualification certificate.

IA units of higher-level public entities ensure internal audits in subordinate public entities that do not have their own internal audit units.

A public entity is entitled to contract internal audit services. In this case, the internal audit is conducted by at least one professional in the field of internal audit in the public sector certified by the Ministry of Finance or a professional with an internationally recognised internal audit qualification certificate.

Conclusion:

1. Although different countries have different PIFC systems, they employ similar organisational approaches using tools stemming from the EU principles that are established for financial management and control (IC) and internal audit and enshrined in internationally recognised standards.
2. Most of the countries studied have reformed their PIFC systems to factor in the practices of EU candidate countries, in accordance with government concepts and strategies, which have been consistently updated based on the state of affairs in this area (identified problems, new trends, development options and objectives), which allowed them to timely finetune their PIFC legislation to implement it at the local level.

All countries have further adopted relevant legislation. Most EU countries and EU candidate countries introduced pertinent laws: some regulate PIFC issues by a single law, while others have separate laws to regulate internal control and internal audit issues, and there are also countries where PIFC regulations are fully integrated into the main law on the budget system and budget process.

3. The practices of implementing the PIFC system in EU countries show that there can be no universal model for organising the internal control system and internal audit activities at the local level due to the specific features of each individual country, national legislation, administrative and territorial structure, etc. However, there are certain reference points in the form of guidelines, methodologies of European institutions and trends in the lawmaking and implementation processes of other countries regarding the organisation of internal controls and internal audits at the local level. According to them, internal audit activities in particular can take place according to various schemes defined in the laws (Ireland, the Netherlands, North Macedonia, Romania, Serbia, Moldova), by:

• Creating a separate internal audit unit in an institution (administration/mayor’s office) subordinate to the executive body, based on the decision of the local council;
• Creating a unit shared by several local bodies based on the decisions of the relevant local councils;
• Contracting private companies/auditors certified to conduct such activities in local public bodies as prescribed by law.

4. The above flexible approach to organising the internal audit has become widespread in many countries and is in line with the new principles of public administration adopted by SIGMA in 2023.[11] For instance, one of the components of Principle 27 (“Internal audit improves the management of public administration bodies”) provides that the structure and organisation of the internal audit function can be adapted to the type, size and complexity of the institution, which includes the possibility of shared internal audit services.

In other words, when making a decision to create an internal audit unit in bodies (institutions, agencies), their structure and number of employees must be taken into account. If creating a separate unit is deemed inexpedient, the internal audit function can be implemented by creating a shared internal audit unit (cooperation system) or contracting internal audit services.

5. A shared feature for all countries is that the audit of the use of EU funds must comply with internationally recognised audit standards and a strategy agreed with the CEAOB, which sets out at least the audit procedure, sampling method for auditing activities, etc., with an emphasis on accountability and responsibility for the resources spent and meeting the targets.
6. In most modern management systems, responsibility for monitoring the targeted and effective use of budget funds lies with the management of the body, agency or institution. However, ensuring the implementation of the principle of accountability and responsibility of both the managers of the institution and other officials is still a significant factor.
7. Effective functioning of the PIFC system in Ukraine (internal controls and internal audit), including at the local level, requires:

• Flexible legislation that can be implemented in practice at the local level, adapting its provisions in accordance with the established principles of public administration adopted by SIGMA in 2023, factoring in the above experience of other countries;
• Developed guidelines for the implementation of internal controls and internal audits at the local level, model provisions (templates), instructions, etc. These materials should help local authorities and self-government bodies in creating a robust PIFC system, which will ensure, among other things, financial management and control of both their own budgetary and international resources;
• Advisory support from international projects on the development of standard documents necessary for the practical introduction of the foundations, key principles and elements of internal controls and the functioning of internal audit, including in the context of the use of EU funds.

8. Effective internal controls necessitate regular assessments of their progress and effectiveness. This, in turn, requires the regulatory framework for internal audit, which should be mandatory rather than merely advised to government bodies of all levels and local self-government bodies.
9. Introduction of mandatory internal audits of local self-government bodies with the subsequent release of audit reports, which are designed to increase the accountability of these bodies, improve their performance and transparency and mitigate corruption risks in the public administration system, using systematic, consistent and risk-based approaches to assessing the entity subject to the internal audit through the provision of independent and objective conclusions and recommendations.