Organising Internal Audit in Ukraine: The Advantages and Disadvantages of Centralised vs Decentralised Approaches

By Manfred van Kesteren, International Expert on Public Internal Financial Control

EU Public Finance Management Support Programme for Ukraine (EU4PFM)

In June 2023, the EU4PFM project concluded a paper that encompasses possible modalities for the future development of the internal audit function in the Ukrainian public sector. The paper draws insights from a comprehensive study conducted in EU and non-EU member states, comparing various configurations for public sector internal audit. The focus of this comparison lies in centralised and decentralised internal audit arrangements, aiming to learn from other countries’ experiences and derive implications for the future of internal audit in Ukraine. The findings and recommendations presented in the paper aim to foster discussions that contribute to shaping future policy development regarding internal audit. This article highlights the main points and potential pathways for public sector internal audit in Ukraine.

Importance of Considering the Future of Internal Audit in Ukraine

Developing a robust public sector internal audit system is an essential component of a modern public internal control system. However, there are diverse approaches to organising internal audit in the public sector, and institutional arrangements are constantly evolving in response to new challenges. Whilst most EU member states and candidate countries have decentralised internal audit units inside each public sector organisation, certain European countries, such as the Netherlands, UK, and Belgium, have recently semi-centralised these units under a central internal audit agency that provides an internal audit service to central government bodies. These developments have sparked discussions in many countries, including Ukraine, about the optimal organisation of internal audit in the future. Considering the desire to enhance public sector internal audit in Ukraine, as reflected in the PFM Strategy 2022-2025, the insights presented in the paper can fuel discussions on this topic.

Key Transformation Issues in Organising Public Sector Internal Audit

Most Central and Eastern European countries inherited public internal control systems that relied primarily on a centralised control function under the Ministry of Finance. This function encompassed ex-ante controls and ex-post inspections of transactions across the public sector, often referred to as the francophone model. These countries had limited experience with internal audit. In contrast, the EU’s Public Internal Financial Control (PIFC) concept is based on the concept of managerial accountability, assigning responsibility for control systems and broader performance to the managers of public bodies. This is supported by decentralised, functionally independent internal audit units inside each entity.

Transitioning from a reliance on a centralised control and inspection function to managerial accountability supported by decentralised internal audit involves a profound and sometimes difficult transformation in attitudes towards public control and public sector management in general.

During the transition to the PIFC model of decentralised internal audit, many countries in reform opted to maintain smaller central inspection, investigation, or audit bodies with mandates to inspect all government bodies. These bodies may be responsible for financial inspection, fraud and corruption investigations, or the audit of specific funds (e.g., EU funds) or activities (e.g., public procurement). This can be an important line of assurance, particularly in countries where internal and external audit functions are insufficiently developed. However, there is a risk that a large and powerful financial inspection function, focused on sanctioning individuals rather than strengthening systems to prevent problems and losses in the first place, could hinder the long-term development of managerial accountability and robust decentralised audit functions. Thus, establishing a clear distinction between financial inspection and audit activities becomes integral to developing a “PIFC compliant” financial inspection function.

Handling Transformation Issues in Ukraine

Over the past decade, Ukraine has made considerable progress in implementing the three pillars of the PIFC concept: internal audit, internal control systems, and a central harmonisation unit in the Ministry of Finance, responsible for coordinating reforms in both areas. Internal audit units are now mandatory in all ministries, central executive bodies, key spending units, and regional level administrations. Investments have been made to introduce international auditing standards. However, challenges persist, including understaffing of internal audit units and a lack of managerial understanding of the importance and role of internal audit in some public entities, hindering the effectiveness of internal audit.

In addition to the PIFC structures, Ukraine maintains a separate and centralised “State Financial Control” function implemented by the State Audit Service (SAS). While primarily conducting financial inspections and procurement monitoring and verification, the SAS is also responsible for “public financial audits” and IT audits, activities typically covered by internal and/or external audit in other countries.

Insights from EU Member States that Transitioned to Decentralised Internal Audit

During their accession into the EU, Bulgaria, Poland, Hungary, and Croatia faced the challenging transition from a centralised control and inspection function to decentralised internal audit functions aligned with the PIFC model. All four countries have successfully integrated decentralised internal audit units across their public sectors, albeit with varying national arrangements. The most valuable lesson from these countries is the importance of harmonising PIFC reforms with broader public administration and public finance (budget) reforms. In all four countries, some form of centralised financial inspection has continued to operate alongside decentralised internal audit but these bodies have transitioned from large to smaller organisations with narrower mandates. They focus on investigating suspicions  of major fraud or abuse or inspecting specific activities such as procurements. For instance, in Poland, the “Department for Audit of Public Funds” primarily conducts audits of EU funds, while the other three countries have introduced a separate audit body, in addition to the financial inspection body, as the audit authority for EU funds.

Insights from Countries with a Long History of Public Sector Internal Audit

To improve the overall quality of internal audits and address the increasing need to audit horizontal and specialist issues, particularly in IT, the UK and the Netherlands (and more recently, Belgium) have brought the previously decentralised internal audit units of central government bodies under one semi-centralised government internal audit service. In this model, internal auditors are still physically located within each government body and report to its leadership. However, they are employed by the central audit service, which invoices each ministry for internal audit services, establishing a client-customer relationship.

Although initially contested, this semi-centralisation is widely considered as a positive development. It has yielded various advantages, including increased audit quality, scope, and impact, improved human resource management (e.g., motivation, staff retention, and development), and a more flexible use of limited resources. Nevertheless, this reform effort presented significant political and administrative challenges.

Implications for Ukraine’s Future Organisation of Public Sector Internal Audit

Drawing from the experiences of the four EU member states, Ukraine can chart a path forward that involves:

1. Clear separation of financial inspection from other types of external audit activities, gradually transitioning towards a narrower, yet still significant, mandate for a “PIFC compliant” financial inspection function.
2. Substantial investments in promoting managerial accountability and financial management and control.
3. Significant investments in strengthening internal audit to become a professional and valued support function for managers.

While the semi-centralised internal audit model introduced in the UK and the Netherlands offers many advantages and is likely to be followed by more countries in the future, Ukraine, where internal audit is relatively new, may face challenges if it centralises internal audit units under a single agency. This could perpetuate the perception of internal audit as an inspection and sanctioning function rather than a supportive function for managers to enhance control systems. Furthermore, such centralisation represents a complex administrative reform that may not be a priority at present.

Nonetheless, Ukraine can explore a number of possible “hybrid” solutions to address internal audit staffing and quality standards. These solutions may include developing a centrally managed “pool” of auditors to provide specialist skills (e.g., IT, performance audits, EU funding) or fill vacancies in internal audit units, giving the central harmonization unit (CHU) a more active role in coordinating internal audit staffing and systems, and establishing shared internal audit services among smaller or related key spending units.

Next Steps after the Country Study Paper

The completion of the country study paper marks an important milestone in informing the future development of internal audit in Ukraine. However, further analytical work is necessary to apply the insights gained to the Ukrainian context. This includes exploring how Ukraine can develop a “PIFC compliant” financial inspection function and translating the mentioned “hybrid” solutions into concrete legislative and administrative terms. Additionally, raising awareness among leadership levels is crucial to improve understanding of the roles and responsibilities of each line of assurance covered in the paper.