THE STATE OF THE

Internal Audit Profession

IN AFRICA
 PREPARED BY: JANE MWEBI

ACKNOWLEDGMENT
The IIA would like to thank the leaders of the local IIA affiliates for Botswana, Ethiopia, Ghana, Kenya,
Malawi, Nigeria, Rwanda, Tanzania, Uganda, Zambia, and Zimbabwe for their participation in this
research. Their contribution and support with necessary contacts and documents was invaluable.

The IIA also acknowledges the significant contributions from all the respondents to the survey
questionnaire including:

nn Supreme Auditors General for Ghana, Kenya, Malawi, Uganda, Zambia, and Zimbabwe.
nn Heads of Government Internal Audit for Botswana, Kenya, Malawi, Rwanda, Tanzania,
Uganda, and Zambia.
nn Deloitte Ghana and Zimbabwe.
nn KPMG Ghana, Kenya, and Nigeria.
nn PwC Botswana, Ghana, Kenya, Malawi, Uganda, Zambia, and Zimbabwe.
nn Accounting associations/bodies in Ethiopia, Ghana, and Nigeria.
nn Heads of reserve/central banks for Rwanda and Tanzania.
nn Heads of Capital Markets Authority/Stock Exchanges for Rwanda, Uganda, and Zambia.
The author would like to thank Francis Nicholson, at The IIA, for his direction, guidance, and support
throughout the research period. The author is also particularly grateful to the World Bank’s internal
audit staff, namely Grace Verances and Muhammad Sadiq Ismail who assisted with the graphs and
Graham Colin-Jones, who edited the report.

ABOUT THE RESEARCH

This research was executed under the fellowship memorandum of understanding between The Institute
of Internal Auditors (The IIA) and the World Bank Group’s internal audit department. The research
studied the state of the internal audit profession in 11 African countries as commissioned by The IIA.

ABOUT THE AUTHOR

Jane M. Mwebi, Ph.D., CIA, CA, CFE, CISA, is a senior internal auditor at the World Bank Group. She
has over 20 years of professional experience in accounting, external and internal auditing, and financial
management, with 13 years of that spent at the World Bank Group. Mwebi is also an active member of
The IIA’s Public Sector Guidance Committee.

The IIA is responsible for the contents of this report including the analytical approaches utilized. This report does not
represent the views of the World Bank Group.

2 globaliia.org | The Institute of Internal Auditors

TABLE OF CONTENTS
Acknowledgment....................................................... 2 3.2. Country Findings.............................................. 23

About the Research.................................................... 2 3.2.1. Botswana........................................................ 23

About the Author....................................................... 2 3.2.2. Ethiopia.......................................................... 24

Table of Contents....................................................... 3 3.2.3. Ghana............................................................. 25

Acronyms and Abbreviations.................................... 4 3.2.4. Kenya.............................................................. 27

Executive Summary.................................................... 4 3.2.5. Malawi............................................................ 28

1. Introduction............................................................ 8 3.2.6. Nigeria............................................................ 30

1.1. Background......................................................... 8 3.2.7. Rwanda........................................................... 31

1.2. Research Purpose............................................... 8 3.2.8. Tanzania.......................................................... 33

2. Research Methodology......................................... 9 3.2.9. Uganda........................................................... 34

2.1. Research Limitations........................................ 10 3.2.10. Zambia......................................................... 36

3. Research Findings................................................ 11 3.2.11. Zimbabwe.................................................... 37

3.1. Cross Country Analysis.................................... 11 4. Conclusions.......................................................... 39

3.1.1. National Context Indicator.......................... 11 5. Next Steps............................................................ 44

3.1.2. Public Sector Governance Indicator.......... 13 Research Resources................................................. 48

3.1.3. Public Sector Quality Indicator................... 15 Appendix I: Internal Audit

National Maturity Model......................................... 50
3.1.4. Public Sector Resources Indicator.............. 16
Appendix II: Detailed Country Findings................ 56
3.1.5. Private Sector Governance Indicator......... 18
Appendix III: List of
3.1.6. Private Sector Quality Indicator.................. 20
Interviewees/Survey Respondents......................... 98
3.1.7. Private Sector Resources Indicator............. 21

African Initiative Research Report | globaliia.org 3

ACRONYMS AND EXECUTIVE SUMMARY
ABBREVIATIONS The vision of The IIA is to elevate the capacity of the
internal audit profession across the continent of Africa to
AC Audit Committee
meet or exceed the expectations of the profession’s key
stakeholders. This research, which was commissioned after
AfDB African Development Bank
The IIA’s initial analysis of the situation in Africa, found the
African Federation of following:
AFIIA
Institutes of Internal Auditors
nn There is a greater need for effective internal audit in
Computerized Automated
CAATTs the public and private sectors in the service of sound
Auditing Tools and Techniques
governance than is currently being provided.
CAE Chief Audit Executive
nn In some instances, there is limited awareness of
CBOK Common Body of Knowledge internal audit and its contribution to governance,
despite the significant need for better governance.
CEOs Chief Executive Officers
nn The resources available for training are limited
(coupled with the high cost of face-to-face training
CIA® Certified Internal Auditor®
and connectivity issues for virtual training).
CPE Continuous Professional Education nn Efforts are poorly coordinated across the continent to
support the development of good governance.
CPI Corruption Perception Index
nn In many instances, support from the local IIA affiliate
Danish International is constrained by limited resources, including
DANIDA
Development Agency
staff and/or volunteers, and poor information and
Department for International communications technology infrastructure.
DFID
Development (United Kingdom)
Deutsche Gesellschaft für nn Accounting associations with a limited grasp of and
GIZ
Internationale Zusammenarbeit capability in internal auditing are moving aggressively
International Federation to take on internal audit responsibilities, and this
IFAC
of Accountants could have a negative impact on the quality of the
IIA The Institute of Internal Auditors
internal audit services provided.

International Professional
This research takes account of the current state of the
IPPF® internal audit profession in 11 sub-Saharan countries1.
Practices Framework®
Japan International The assessment of the current state was completed using
JICA an internal audit national maturity model. The model
Cooperation Agency
Public Expenditure focuses on elements that have most relevance to internal
PEFA
Financial Accountability audit maturity, grouped together under four indicators:
PwC PricewaterhouseCoopers nn National Context: This indicator looks at country
macro factors which include professionalism,
United States Agency for
USAID
International Development
1
These are English-speaking sub-Saharan countries where there is an established
IIA affiliate (excluding South Africa), namely Botswana, Ethiopia, Ghana, Kenya,
Malawi, Nigeria, Rwanda, Tanzania, Uganda, Zambia, and Zimbabwe.

4 globaliia.org | The Institute of Internal Auditors

 education programs, and recognition; national
indicators for fraud and corruption; role of
audit firms and accounting associations;
development agencies; and role of other
bodies including stock exchanges and central
banks.
nn Governance: This indicator assesses such
elements as legislation, regulation, corporate
governance code, and national policies;
leadership and tone at the top in organizations
from CEOs and boards; positioning of
internal audit in organizations and its effective
independence; audit committees; and risk
management practices.
nn Quality: This indicator focuses on the internal
audit function and elements considered
including audit strategy and charter; audit
planning including risk assessment; use of
internal audit standards; scope of internal audit
work, reporting, and follow up; and quality
assurance and improvement planning.
nn Resources: This indicator reviews resources for
internal audit functions including adequacy of
staffing resources; staff skills and training; and
use of technology.
The model consists of five discrete levels to indicate
the respective country’s level of maturity for each of
the indicators:
nn Internal audit functions performing control
activities as a large part of their work instead
of providing assurance that the controls are
operating effectively.
nn Poor governance due to the lack of audit
committees or their ineffectiveness in
performing their duties.
nn The absence or incompleteness of risk
management frameworks.
nn The poor quality of the operations of internal
audit functions that do not meet modern
internal auditing standards including risk-
based planning, application of The IIA’s
International Professional Practices Framework
(IPPF), and arrangements for quality assurance.
nn Shortage of qualified internal audit professionals.
Chart I shows the maturity levels of the four
indicators of the internal audit national maturity
model in the public sector for each country in the
study. The National Context indicator is depicted as
a line as it remains the same for both the public and
private sectors and provides a background for the
other indicators.
Chart I: Public Sector Internal Audit National
Maturity Levels

nn Level 1 – Initial. nn Level 4 – Integrated.

nn Level 2 – Emerging. nn Level 5 – Optimizing.
nn Level 3 – Established.
The research found that the internal audit profession
is broadly in its infancy in these sub-Saharan African
countries. It is yet to get to an “Established” level of
maturity, especially in the public sector, where seven
of the 11 countries are at the two lowest levels of the
maturity model, either “Initial” or “Emerging.” The
main factors that have resulted in the internal audit
profession being rated low on the maturity model
include:

African Initiative Research Report | globaliia.org 5

Only three (Kenya, Tanzania, and Uganda) of
the 11 countries show an “Established” maturity
level for the National Context indicator. Key
factors promoting the growth of the internal audit
profession in these countries are a combination of:
Similar to the public sector, the Resources
indicator is still at the “Emerging” level due to a
shortage of skilled/qualified internal auditors and
limited use of computerized automated auditing
tools and techniques.

nn Active collaboration of government with a Chart II shows the maturity levels of the four
number of development agencies in building indicators of the internal audit national maturity
the capacity of the internal audit profession. model in the private sector for each country in
the study.
nn Active advocacy for the internal audit
function in organizations by the stock
exchange and the central bank. Chart II: Private Sector Internal Audit
National Maturity Levels
nn Active participation of the Big Four accounting
firms in the marketing of the profession in their
provision of internal audit services.
Internal auditing in the private sector
generally demonstrates faster growth towards
“Established” maturity in the indicators of
Governance and Quality, compared with
the public sector. This is mainly because
organizations are adopting internal audit best
practices that comply with modern internal
auditing, as follows:

nn Governance: Internal audit functions are

appropriately positioned in organizations with
reporting lines that promote independence,
audit committees are well constituted and
effective, and organizations adopt consistent
approaches to managing risk.
nn Quality: Internal audit functions have
adopted practices that are in accordance with
the IPPF in audit planning, risk assessments,
audit strategies and charters, scope of
audit work, quality of audit reports, and
effectiveness in follow-up of issues. However,
many challenges remain in the area of quality
assurance programs, which are still weak.
These research findings provide a glimpse into
the areas to prioritize for building the capacity
of the internal audit profession in sub-Saharan
Africa. Overall, the National Context indicator is
an area in which eight of the countries require
more advocacy of the internal audit profession to
influence key players in the government, private
sector, accounting and audit firms, and accounting
associations. The Resources indicator is also still
at the “Emerging” level in nine of the countries in
both the public and the private sectors, and efforts
to increase IIA membership and certification will
be instrumental in growing the maturity of this
indicator. The Governance and Quality indicators
are likely to benefit from increased advocacy
and resources for the internal audit profession.

6 globaliia.org | The Institute of Internal Auditors

Therefore, to build the capacity of the internal nn Developing the local IIA affiliates. This
audit profession, possible areas of focus include: would entail providing them with the
necessary resources so they are better able
nn Raising the level of awareness and to support the audit profession in their
understanding of the role and value countries (and perhaps in the region). The
of internal auditing. This is necessary to local affiliates are best suited to advocate
increase the appetite and demand for internal for the profession locally, provide training
audit among key stakeholders (governments, and continuing education to practitioners,
investors, and the public at large). It may and support quality assurance programs by
include working with governments and their providing external quality assurance review
leaders, supreme auditors general, heads services.
of central banks and stock exchanges, and
internal auditors general (where they exist) nn Partnering with development agencies
to ensure that the operational environment and other organizations. Such partnerships
is optimized for internal audit, including the would include development agencies,
legislative and regulatory framework. the Big Four accounting firms, and local
accounting bodies that are building internal
nn Ensuring that internal audit is configured audit capacity on the ground. This will help
in a way that optimizes its value. This to maximize outcomes.
requires working with organizations and their
senior management with a view to enhancing
the effectiveness of internal audit functions.
nn Providing training and development
opportunities directly to practitioners.
Such training (whether face-to-face, remotely,
or by blended means) would enhance
the skills of internal audit practitioners. In
addition, internal audit programs should
be promoted in academia — universities
and colleges — to train future internal audit
practitioners.

African Initiative Research Report | globaliia.org 7

1. INTRODUCTION
1.1. Background
The IIA has identified Africa as a strategic priority
for capacity building for at least the next three
years. The IIA has 25 affiliates in Africa (and three
international chapters in development) with a total
membership of around 12,000 (subject to seasonal
variation due to a membership renewal cycle), of
which approximately half is in South Africa. This
represents a very low penetration of the assumed
internal audit profession and of the potential
contribution internal audit could be making.
Similarly, many multi-lateral bodies have an
interest in making a lasting impact in Africa,
which in turn depends on effective governance.
The World Bank has therefore been working for
many years to build internal audit capacity in its
client countries to enhance fiduciary capabilities
to manage public funds. Other development
agencies are also involved in internal audit
capacity building in Africa.
The internal audit profession is operating below
capacity in many African countries. It faces
a number of challenges in many parts of the
continent, although the picture is highly variable.
In South Africa, corporate governance is at a more
mature stage and the internal audit profession
is supported by a strong IIA affiliate. Factors
contributing to the low capacity in the 11 countries
identified in this study include:
nn Often there is limited awareness of
internal audit as a profession and a lack
of understanding about its contribution
to good governance, reducing both the
demand and the resources available for
internal audit.
8 globaliia.org | The Institute of Internal Auditors
nn Where there is internal audit, it does not
always maximize its value as a result of
limitations on its scope, profile, or influence,
in addition to resource constraints.
nn There is a shortage of qualified internal
auditors.
nn There is limited access to training and other
support for internal auditors.
nn IIA affiliates are often not well equipped
in terms of leadership, human resources,
information and communications technology
infrastructure, and other resources.
nn Regulation and/or legislation is not always
conducive to internal audit best practice.
nn In some jurisdictions, those representing
the interests of certified or chartered
accountants are making aggressive moves to
take on some or all of the duties of internal
audit without being best suited to provide an
effective service.
1.2 Research Purpose
The purpose of this research was twofold:
nn To inform the planning and delivery of future
capacity building of the internal auditing
profession in Africa.
nn To develop a model for analysis that may
be used as a benchmark against which to
measure progress on capacity-building goals
in Africa and as a tool for similar analysis in
other regions.
2. RESEARCH METHODOLOGY
This research was conducted through a
combination of primary and secondary research.
The primary research consisted of deploying
surveys and conducting interviews with key
players as follows:
nn Interviews with and completion of a
questionnaire by the respective country IIA
affiliate leaders.
nn Surveys of public accounting firms: PwC,
Deloitte, KPMG, and EY.
nn Surveys of heads of central banks, supreme
auditors general, heads of internal audit
in central/national government, heads of
capital markets/stock exchanges, and heads
of accounting associations/bodies of the 11
countries in the study.
Appendix III lists the interviewees and survey
respondents.
The secondary research consisted of a desk
review of (i) regulatory/legislative documents
(e.g., corporate governance codes, relevant
acts, circulars); (ii) World Bank publicly available
reports (e.g., country governance assessments,
Public Expenditure and Financial Accountability
(PEFA) Assessments, and Integrated Fiduciary
Assessments); and (iii) IIA research reports and
other relevant previous research (e.g., local
research, reports from accounting firms and
accounting bodies).
In addition, existing IIA survey data was used to
supplement data from the primary research. The
data used included the latest data on IIA affiliates
and the Common Body of Knowledge (CBOK)
2015 data. The 2015 Transparency International
data was also used for the country CPI rankings
and scores.
African Initiative Research Report | globaliia.org
All the data collected from the primary and
secondary sources were analyzed using the
internal audit national maturity model. The
model has four indicators, which are broken
down into elements and then into sub-elements.
It focuses on elements/sub-elements that have
most relevance to internal audit maturity, grouped
together under four indicators:
nn National Context: This indicator looks
at country macro factors, which include
professionalism, education programs, and
recognition; national indicators for fraud and
corruption; role of audit firms and accounting
associations; development agencies; and role
of other bodies including stock exchanges
and central banks.
nn Governance: This indicator assesses
such elements as legislation, regulation,
corporate governance code, and national
policies; leadership and tone at the top
in organizations from CEOs and boards;
positioning of internal audit in organizations
and its effective independence; audit
committees; and risk management practices.
nn Quality: This indicator focuses on the internal
audit function and elements considered
include audit strategy and charter; audit
planning including risk assessment; use of
internal audit standards; scope of internal
audit work, reporting, and follow up; and
quality assurance and improvement planning.
nn Resources: This indicator reviews resources
for internal audit functions including
adequacy of staffing resources; staff skills
and training; and use of technology.
9
The model consists of five discrete levels to
indicate the respective country’s level of maturity
for each of the indicators:
nn Level 1 – Initial.
nn Level 2 – Emerging.
nn Level 3 – Established.
nn Level 4 – Integrated.
nn Level 5 – Optimizing.
This model was developed to assist in the
assessment of the current state of maturity of the
internal audit profession in Africa and is intended
to be used as a tool for similar analysis in other
regions. A sample of the model is included in
Appendix I. Details of each country analysis using
the model are included in Appendix II.
2.1 Research Limitations
The research is limited in its scope due to a heavy
reliance on a few key individuals especially for
the surveys, although attempts were made to
10 globaliia.org | The Institute of Internal Auditors
corroborate evidence by matching statements
from multiple sources. The survey responses
had disparity in the sufficiency of information,
with some being more extensive than others.
Moreover, not all those surveyed responded
to the questionnaire, so the data was not
comparable across countries in all cases.
Further, some of the secondary data used is not
current. For example, some PEFA reports are
from 2011. Also, the 2015 CBOK data for some
countries was based on very few samples due to
poor responses from these countries. Finally, the
internal audit national maturity model used to
analyze data is new and is yet to be fully validated
and socialized.
To divide the research project into more
manageable portions, phase I of the research was
limited to English-speaking sub-Saharan countries
where there is an established IIA affiliate (excluding
South Africa). These countries are Botswana,
Ethiopia, Ghana, Kenya, Malawi, Nigeria, Rwanda,
Tanzania, Uganda, Zambia, and Zimbabwe.
 Chart III: National Context Indicator Maturity
3. RESEARCH FINDINGS Level
3.1. Cross Country Analysis

3.1.1. National Context Indicator

With respect to this indicator, the majority of the
countries (8 out of 11) are at the “Emerging”
stage of maturity as shown in Chart III. A number
of factors have an adverse impact on the maturity
level of the National Context indicator including:

nn Low levels of general awareness nationally

of internal auditing, as these countries have
hardly any academic programs in internal
audit, so the profession is not known or
even recognized as a profession, as well as a
The three countries — Kenya, Tanzania, and
failure to recognize the full potential of the
Uganda — which have reached the “Established”
contribution internal auditing is able to make
stage, are mainly helped by a combination of:
in improving efficiency and accountability.
nn Active collaboration of government with a
nn Shortage of professional internal auditors
number of development agencies in building
as evidenced by low membership of The IIA
the capacity of the internal audit profession.
and also very few internal audit certifications
conferred to auditors in these countries. nn Active advocacy for the internal audit function
in organizations by the stock exchange and
nn Low levels of advocacy for the internal audit
central bank.
profession by key stakeholders in government
and the private sector, and by other nn Active participation of the Big Four
professional bodies. accounting firms in the marketing of the
profession in their provision of internal audit
services.

African Initiative Research Report | globaliia.org 11

The maturity level is an average of the maturities of the 14 sub-elements of this indicator. Some sub-
elements are at a more mature level on the spectrum of maturity than others, as depicted in Table 1
below. The maturity levels of the sub-elements range from “Initial” to “Integrated.” None of the sub-
elements was found to be at the “Optimizing” level.

Table 1: National Context Indicator (Public Sector) – Sub-element Level of Maturity

(by Country)

Elements Sub-elements BW ET GH KE MW NG RW TZ UG ZM ZW

1. Presence of university programs in

internal auditing
A. Professionalism, 2. Understanding and recognition by
education key stakeholders of the role and value of
programs, internal auditing
recognition
3. IIA membership and GDP per capita
4. IIA certification and GDP per capita
B. National 1. Transparency International 2015 CPI score
indicators for fraud (/100)
and corruption 2. Transparency International CPI rank (/168)
1. Role of audit firms in delivering internal
audit services (assurance and consulting)
2. Role of audit firms in delivering training
C. Role of and guidance for internal audit
audit firms and 3. Role of accounting associations in
accounting delivering training and guidance for internal
associations audit
4. Role of accounting associations in
delivering training and guidance for audit
committees
1. Availability of funding for internal audit
D. Development training commensurate with need
agencies 2. Delivery of advocacy for internal auditing
commensurate with need
E. Role of other 1. Provision of advocacy for internal auditing
bodies including
stock exchanges 2. Setting of internal audit-related policy
and central banks and corresponding enforcement

LEGEND: Initial Emerging Established Integrated

12 globaliia.org | The Institute of Internal Auditors

3.1.2. Public Sector Governance Indicator
As shown in Chart IV below, 10 of the 11 countries are at the “Emerging” stage of maturity on the
Governance indicator in the public sector; the exception is Nigeria, which is still at the “Initial” stage.
The main factors hampering a higher Governance maturity indicator in these countries include:

nn Ineffective audit committees that lack capacity to execute their duties and have little
understanding of internal audit.
nn Public entities with no formal risk management frameworks.
nn The positioning and status of internal audit, which places the head of internal audit at a junior level
of management and largely performing a control monitoring role instead of an assurance role.
In addition to these factors, Nigeria does not have audit committees in the public sector and the
internal audit function lacks any true independence.

Chart IV: Public Sector Governance Indicator Maturity Level

African Initiative Research Report | globaliia.org 13

The maturity level is an average of the maturities of the 13 sub-elements of this indicator. Some sub-
elements are at a more mature level on the spectrum of maturity than others, as depicted in Table 2
below. The maturity levels of the sub-elements range from “Initial” to “Integrated.” None of the sub-
elements was found to be at the “Optimizing” level

Table 2: Governance Indicator (Public Sector) – Sub-element Level of Maturity (by Country)

Elements Sub-elements BW ET GH KE MW NG RW TZ UG ZM ZW

A. Legislation, 1. Requirement for internal audit

regulation, 2. Status of internal audit
corporate
governance code, 3. Standards for internal audit
and national 4. Audit committees
policies 5. Monitoring and enforcement
B. Leadership and
tone at the top in 1. Extent to which CEOs and boards
organizations from support internal audit
CEOs and boards
C. Positioning 1. Reporting lines and independence
of internal audit
in organizations 2. Positioning of internal audit within the
and its effective organization
independence
1. Independence and strength of audit
committee membership
2. Understanding of internal audit
D. Audit 3. Powers of the audit committee include to
committees hire and fire CAE, approve audit plan, and
resources
4. Effectiveness in holding the CAE and the
organization to account
E. Risk
1. Organizational risk management maturity
management

LEGEND: Initial Emerging Established Integrated

14 globaliia.org | The Institute of Internal Auditors

3.1.3. Public Sector Quality Indicator
While 9 of the 11 countries are at the “Emerging” maturity stage on the Quality indicator in the public
sector, Rwanda is moving towards “Established” maturity but Nigeria is still at the “Initial” stage, as
shown in Chart V. These factors have an adverse impact on the maturity of the Quality indicator:

nn Internal audit functions have no defined charters or strategy requirements.

nn Audit planning is only partially risk-based and risk assessments are not done regularly.
nn The scope of internal audit work is limited, and audit reports are of poor quality.
nn Internal audit functions have only limited or non-existent quality assurance arrangements.
Nigeria remains at the “Initial” stage mainly because its internal audit function is under the accounting
function and its work is mainly prepayment processing. Rwanda is ranked at the “Established” maturity
level because internal audit functions have formal charters, the scope of internal audit is broad, the
audit reports are of good quality, and there is systematic follow-up of audit recommendations.

Chart V: Public Sector Quality Indicator Maturity Level

African Initiative Research Report | globaliia.org 15

The maturity level is an average of the maturities of the eight sub-elements of this indicator. Some
sub-elements are at a more mature level on the spectrum of maturity than others, as depicted in Table
3. The maturity levels of the sub-elements range from “Initial” to “Established.” None of the sub-
elements was found to be at the “Integrated” or “Optimizing” levels.

Table 3: Quality Indicator (Public Sector) – Sub-element Level of Maturity (by Country)

Elements Sub-elements BW ET GH KE MW NG RW TZ UG ZM ZW

A. Audit strategy 1. Presence and strength of charter,

and charter sense of purpose, and focus
1. Extent to which audit planning is risk-
B. Audit planning, based and aligned with strategy
including risk
assessment 2. Frequency of risk assessment and
alignment with strategy
C. Use of standards 1. Use of robust internal audit standards
1. Scope of audit work
2. Quality of the audit reports –
D. Scope, reporting,
effectiveness in identifying and
and follow up
communicating issues
3. Effectiveness in following up on issues
1. Internal (monitoring, supervision,
E. Quality assurance
appraisal, training, review of audit
and improvement
papers, self-assessment) and external
planning
(Quality Assurance Review)

LEGEND: Initial Emerging Established

3.1.4. Public Sector Resources Indicator

All 11 countries have resource constraints, as evidenced by the Resources indicator maturity levels
attained so far, as shown in Chart VI. The main factors adversely impacting the maturity of this indicator
include:

nn Shortage of professional practitioners in internal audit (membership of The IIA and the number of
practitioners holding the CIA designation from these countries are very low).
nn Limited access to internal audit training.
nn Limited use of computerized automated auditing tools and techniques.

16 globaliia.org | The Institute of Internal Auditors

Chart VI: Public Sector Resources Indicator Maturity Level

The maturity level is an average of the maturities of the six sub-elements of this indicator. Some sub-
elements are at a more mature level on the spectrum of maturity than others, as depicted in Table 4
below. The maturity levels of the sub-elements range from “Initial” to “Established.” None of the
sub-elements was found to be at the “Integrated” or “Optimizing” levels.

Table 4: Resources Indicator (Public Sector) – Sub-element Level of Maturity (by Country)

Elements Sub-elements BW ET GH KE MW NG RW TZ UG ZM ZW

A. Adequacy of
staffing resources, 1. Adequacy of staffing resources
including structure
1. Competency and experience
B. Skills 2. Internal audit specific certifications held
3. Highest educational level
C. CPE and training 1. Access to and frequency of training
D. Technology 1. Use of CAATTs

LEGEND: Initial Emerging Established Integrated

African Initiative Research Report | globaliia.org 17

3.1.5. Private Sector Governance Indicator
Compared with the public sector, the private sector is more mature in the Governance indicator, as
shown in Chart VII. All countries have a Governance indicator at the “Established” level of maturity.
Positive aspects contributing to this level of maturity include:

nn Appropriate positioning of internal audit in organizations, where the head of internal audit is
recognized as being part of senior management and internal audit is positioned as a third line of
defense.
nn Audit committees that are effective in providing oversight of internal audit functions, thus
promoting their independence.
nn Organizations having a consistent approach to managing risk.

Chart VII: Private Sector Governance Indicator Maturity Level

18 globaliia.org | The Institute of Internal Auditors

The maturity level is an average of the maturities of the 13 sub-elements of this indicator. Some sub-
elements are at a more mature level on the spectrum of maturity than others, as depicted in Table 5.
The maturity levels of the sub-elements range from “Initial” to “Integrated.” None of the sub-elements
was found to be at the “Optimizing” level.

Table 5: Governance Indicator (Private Sector) – Sub-element Level of Maturity (by Country)

Elements Sub-elements BW ET GH KE MW NG RW TZ UG ZM ZW

A. Legislation, 1. Requirement for internal audit

regulation, 2. Status of internal audit
corporate
governance code, 3. Standards for internal audit
and national 4. Audit committees
policies 5. Monitoring and enforcement
B. Leadership and
tone at the top in 1. Extent to which CEOs and boards
organizations from support internal audit
CEOs and boards
C. Positioning 1. Reporting lines and independence
of internal audit
in organizations 2. Positioning of internal audit within the
and its effective organization
independence
1. Independence and strength of audit
committee membership
2. Understanding of internal audit
D. Audit 3. Powers of the audit committee include to
committees hire and fire CAE, approve audit plan, and
resources
4. Effectiveness in holding the CAE and the
organization to account
E. Risk
1. Organizational risk management maturity
management

LEGEND: Initial Emerging Established Integrated

African Initiative Research Report | globaliia.org 19

3.1.6. Private Sector Quality Indicator
As shown in Chart VIII, the majority of the countries (9 of 11) have reached “Established” maturity for
the Quality indicator. This maturity has been attained largely because of these factors:

nn Internal audit functions are adopting the principles and standards of the IPPF in having charters
and strategies, and in conducting risk-based audit planning and regular risk assessments.
nn The scope of internal audit work is broad, audit reports are of good quality, and there is systematic
follow-up of audit recommendations.
Ethiopia and Zambia lag behind because their internal audit functions:

nn Have only basic charters with no comprehensive strategies.

nn Conduct risk assessments infrequently such that audit planning is only partially risk-based.
nn Have a narrow scope of work that focuses mostly on compliance and financial controls.

Chart VIII: Private Sector Quality Indicator Maturity Level

20 globaliia.org | The Institute of Internal Auditors

The maturity level is an average of the maturities of the eight sub-elements of this indicator. Some
sub-elements are at a more mature level on the spectrum of maturity than others, as depicted in Table
6. The maturity levels of the sub-elements range from “Initial” to “Established.” None of the sub-
elements was found to be at the “Integrated” or “Optimizing” levels.

Table 6: Quality Indicator (Private Sector) – Sub-element Level of Maturity (by Country)

Elements Sub-elements BW ET GH KE MW NG RW TZ UG ZM ZW

A. Audit strategy 1. Presence and strength of charter, sense

and charter of purpose, and focus
1. Extent to which audit planning is risk-
B. Audit planning, based and aligned with strategy
including risk
assessment 2. Frequency of risk assessment and
alignment with strategy
C. Use of
1. Use of robust internal audit standards
standards
1. Scope of audit work
D. Scope,
2. Quality of the audit reports (effectiveness
reporting, and
in identifying and communication issues)
follow up
3. Effectiveness in following up on issues
E. Quality 1. Internal (monitoring, supervision,
assurance and appraisal, training, review of audit papers,
improvement self-assessment) and external (Quality
planning Assurance Review)

LEGEND: Initial Emerging Established

3.1.7. Private Sector Resources Indicator

In comparison with the Governance and Quality indicators, the Resource indicator maturity lags behind
the other indicators for the majority of the countries, with 9 of the 11 countries being at the “Emerging”
stage, as shown in Chart IX.

As evidenced by low IIA membership and CIA certifications, these countries are experiencing a
shortage of skilled or qualified internal auditors. In addition, internal auditors have limited access to
internal audit training mainly due to lack of funding, and the use of computerized automated auditing
tools and techniques is at an early stage. Two of the 11 countries (Tanzania and Zimbabwe) are tending
towards “Established” maturity mainly because (i) the local IIA affiliates are actively providing internal
audit training, and (ii) the accounting bodies are active in internal audit and also internal audit functions
leverage co-sourcing and outsourcing of internal audit services to the public accounting firms.

African Initiative Research Report | globaliia.org 21

Chart IX: Private Sector Resources Indicator Maturity Level

The maturity level is an average of the maturities of the six sub-elements of this indicator. Some sub-
elements are at a more mature level on the spectrum of maturity than others, as depicted in Table 7.
The maturity levels of the sub-elements range from “Initial” to “Established.” None of the sub-
elements was found to be at the “Integrated” or “Optimizing” levels.

Table 7: Resources Indicator (Private Sector) – Sub-element Level of Maturity (by Country)

Elements Sub-elements BW ET GH KE MW NG RW TZ UG ZM ZW

A. Adequacy of
staffing resources, 1. Adequacy of staffing resources
including structure
1. Competency and experience

B. Skills 2. Internal audit specific certifications held

3. Highest educational level

C. CPE and
1. Access to and frequency of training
training
D. Technology 1. Use of CAATTs

LEGEND: Initial Emerging Established

22 globaliia.org | The Institute of Internal Auditors

3.2. Country Findings
3.2.1. Botswana
Botswana is a small landlocked country of 2.262
million people and a GDP of $14.39 billion as of
2015. With a GDP per capita of $6,360, Botswana
is an upper middle income country2. Internal audit
is recommended but not regulated in Botswana
except in central government, which is regulated
by Public Finance Management Act No. 1 of
1999. In the private sector, the Bank of Botswana
requires banks to have internal audit functions.
Other organizations try to follow best practices of
corporate governance and the majority of listed
companies have internal audit functions.
The current state of internal audit in Botswana
shows that the National Context indicator is at
an “Emerging” maturity stage. Organizations are
embracing internal audit as they become more
aware of good corporate governance practices
and the demand for internal audit is slowly
growing. In the past year, audit firms have started
offering internal audit services via outsourcing
or co-sourcing. Chart X shows the internal audit
national maturity levels for both the private and
public sectors in Botswana.
Chart X: Botswana Internal Audit National
Maturity Indicators
2 reporting functionally to the audit committee
http://data.worldbank.org/country/botswana
African Initiative Research Report | globaliia.org
Public Sector: Similar to the National Context
indicator, the Governance, Quality, and Resources
indicators are at the “Emerging” level of maturity.
nn The Governance indicator is “Emerging”
mainly because:
»» Audit committees are ineffective as they
lack independence and relevant internal
audit skills.
»» Internal audit is positioned as a
monitoring function.
»» Public entities lack formal risk
management frameworks.
nn The Quality indicator is “Emerging” because:
»» Internal audit functions are largely in
their infancy with only basic charters and
strategies.
»» Audit planning is not fully risk-based.
»» IIA standards are only partially applied.
»» Arrangements for quality assurance are
not formalized.
nn The Resources indicator is “Emerging”
because:
»» There are insufficient qualified staff with
relevant internal audit skills.
»» Internal auditors have limited access to
internal audit training.
»» Internal audit functions’ use of
computerized automated auditing tools
and techniques is limited.
Private Sector: As Chart X shows, the Governance
and Quality indicators are at an “Established”
level of maturity while the Resources indicator is at
the “Emerging“ level of maturity.
nn The Governance indicator is at the
“Established” stage because the internal
audit function is appropriately positioned
in organizations where the head of internal
audit is usually part of senior management
23
 and administratively to the chief executive of Ethiopia are expected to increase the demand
officer, and audit committees are effective for internal audit. In addition, development
in providing oversight of the internal audit agencies (the World Bank and DFID) are actively
function including approving the audit plan advocating for internal audit by funding internal
and requesting budgetary resources. audit capacity-building activities. Chart XI shows
the internal audit national maturity levels for both
nn The Quality indicator is increasingly getting
the private and public sectors.
to the “Established” level of maturity as
internal audit functions have charters and
strategies, have adopted risk-based planning, Chart XI: Ethiopia Internal Audit National
and prepare audit reports that effectively Maturity Indicators
communicate audit issues that are actionable.
nn Similar to the public sector, the Resources
indicator is at the “Emerging” stage due to a
shortage of qualified internal audit staff with
relevant skills, the limited access of internal
auditors to internal audit training, and the
limited use of computerized automated
auditing tools and techniques by internal
audit functions.

3.2.2. Ethiopia
Ethiopia is the second-most populous country
Public Sector: Similar to the National Context
in Sub-Saharan Africa with a population of 99.4
indicator, the Governance, Quality, and Resources
million and a GDP of $61.537 billion in 2015. With
indicators are at the “Emerging” level of maturity.
a GDP per capita of $619, Ethiopia is a low income
country3. Internal audit in Ethiopia is regulated by nn The Governance indicator is at the
the Financial Administration Council of Ministers “Emerging” maturity level because internal
Regulation No. 190/2010 for public organizations audit functions are positioned as a second
and the National Bank of Ethiopia for financial line of defense, audit committees lack
institutions4. Other private sector organizations independence and relevant internal audit
follow best-practice corporate governance. skills, and organizations lack comprehensive
risk management frameworks.
Based on the current state of internal audit in
Ethiopia, the National Context indicator is at nn The Quality indicator is also at the
the “Emerging” maturity stage. There is limited “Emerging” level of maturity mainly because
understanding of the role and value of internal internal audit functions have no formal
audit, but the new directives5 in the banking and charters and strategies, audit planning
insurance industry issued by the National Bank is not risk-based, and quality assurance

3
http://data.worldbank.org/country/ethiopia
4
Licensing and Supervision of Banking Business, Bank Corporate Governance Directives No.SBB/62/2015; Licensing and Supervision of
Insurance Business, Corporate Governance Directives No. SIB/…./2015
5
Ibid.

24 globaliia.org | The Institute of Internal Auditors

 arrangements are not formalized. the Internal Audit Agency Act (Act 658), 2003, for
public sector organizations and by the Bank of
nn The Resources indicator is at the “Emerging”
Ghana and National Insurance Commission for
level of maturity because of a shortage of
financial institutions7 and corporate governance
qualified staff with relevant internal audit
guidelines on best practice for listed companies8.
skills, the limited access of internal auditors to
The remaining private sector entities follow best
internal audit training, and the limited use of
corporate governance practice.
computerized automated auditing tools and
techniques by internal audit functions. Based on the current state of internal audit in
Ghana, the National Context indicator is at the
Private Sector: Unlike for the public sector,
“Emerging” maturity stage. The demand for
the Governance maturity indicator is at the
internal audit services is increasing as evidenced
“Established” level, but the Quality and Resources
by the presence of audit firms providing either
indicators are at the “Emerging” level.
co-sourced or outsourced internal audit services.
nn The Governance indicator is showing a However, the understanding of the role and
higher maturity level because internal audit value of internal audit continues to be limited as
is appropriately positioned with the head of internal audit functions face funding constraints
internal audit being part of senior management, and a shortage of staff with internal audit skills.
and audit committees are effective as their Moreover, even though a number of development
composition and roles are aligned to best agencies are funding internal audit capacity
corporate governance practices. building, the number of internal auditors who are
IIA members and hold internal audit certifications
nn The Quality indicator is at the “Emerging”
remains low. Chart XII shows the internal audit
maturity level mainly because internal audit
national maturity levels for both the private and
functions have no charters or strategies, audit
public sectors.
planning is only partially risk-based, and
arrangements for quality assurance are limited.
Chart XII: Ghana Internal Audit National
nn Similar to the public sector, the Resources Maturity Indicators
indicator is at the “Emerging” stage due to a
shortage of qualified staff with relevant skills,
internal auditors’ limited access to internal
audit training, and internal audit functions’
limited use of computerized automated
auditing tools and techniques.

3.2.3. Ghana
In 2015, Ghana’s population was 27.41 million
and its GDP was $37.86 billion. With a GDP per
capita of $1,381, Ghana is a lower middle income
country6. Internal audit is regulated in Ghana by
6
http://data.worldbank.org/country/ghana
7
Banking and Financial Laws of Ghana 1998-2006
8
SEC Corporate Governance guidelines on best practices, 2010

African Initiative Research Report | globaliia.org 25

Public Sector: Like the National Context
indicator, the Governance, Quality, and Resources
indicators are at the “Emerging” level of maturity.
nn The Governance indicator is at the
“Emerging” level of maturity mainly because:
»» Internal audit functions are positioned
as a first line of defense doing ex-ante
checks of compliance with rules and
procedures instead of as a third line
of defense providing assurance on the
effective operation of controls.
»» Audit committees have limited internal
audit skills and powers.
»» Organizations lack comprehensive risk
management frameworks.
nn The Quality indicator is also “Emerging”
because:
»» Internal audit functions have only basic
charters and strategies.
»» Audit planning is only partially risk-
based.
»» The scope of internal audit function
work is narrow (mainly financial controls
and compliance).
»» Formal quality assurance arrangements
are limited.
nn The Resources indicator is “Emerging” in
maturity because:
»» There is a shortage of qualified staff with
relevant internal audit skills.
»» Internal auditors have limited access to
internal audit training.
»» Internal audit functions’ use of
computerized automated auditing tools
and techniques is very limited.
Private Sector: The Governance and Quality
maturity indicators are at an “Established” level
of maturity while the Resources indicator is at the
“Emerging” level of maturity.
26 globaliia.org | The Institute of Internal Auditors
nn The Governance indicator is “Established” in
maturity mainly because:
»» The head of internal audit is elevated to
a senior management level, reporting
functionally to the audit committee and
administratively to the chief executive
officer.
»» The internal audit function is performing
as a combined second and third line of
defense.
»» Audit committees are independent and
effective in providing oversight to the
internal audit function.
»» Organizations have a consistent
approach to managing risk.
nn The Quality indicator is also increasingly
“Established” in maturity mainly as internal
audit functions are adopting practices
aligned to IIA standards such as:
»» Having internal audit charters and
strategies.
»» Conducting regular risk assessments
and risk-based audit planning.
»» Producing good quality audit reports
with effective follow-up processes.
nn Similar to the public sector, the Resource
indicator is at the “Emerging: stage because:
»» There is a shortage of qualified staff with
relevant skills.
»» Internal auditors have limited access to
internal audit training.
»» Internal audit functions’ use of
computerized automated auditing tools
and techniques is limited.
3.2.4. Kenya Chart XIII: Kenya Internal Audit National
Maturity Indicators
Kenya is among the fastest growing economies
in Africa9. In 2015, its population was 46.1 million
and its GDP was $63.4 billion. With a GDP
per capita of $1,376, Kenya is a lower middle
income country10. Within the past decade, the
government has recognized the important role
internal audit plays in governance, transparency,
and accountability of public resources. This is
evidenced in two key laws: the Public Financial
Management Act, 2012 (revised 2015) and the
Mwongozo (the code of governance for state
corporations), which require an effective internal
audit function in all public entities. Internal
audit in the private sector is mostly required for Public Sector: Unlike the National Context
financial institutions and listed companies11. indicator, the Governance, Quality, and Resources
Other organizations follow best practices of indicators in the public sector are at the
corporate governance. “Emerging” level of maturity.
Based on the current state of internal audit in nn The Governance indicator remains at the
Kenya, the National Context indicator is moving “Emerging” level of maturity because audit
towards an “Established” maturity stage, mainly committees lack independence and relevant
due to an understanding and recognition of internal audit skills, and public entities do
the role and value of internal auditing by key not have risk management frameworks.
stakeholders in the government and the private
sector. The active involvement of the Big Four nn The Quality Indicator is at “Emerging”
audit firms and accounting associations is also a maturity because:
key contributor to the National Context indicator »» The scope of internal audit functions’
maturity. Chart XIII shows the internal audit audit work is narrow, covering
national maturity levels for both the private and compliance and financial controls.
public sectors. »» The quality of audit reports is poor12.
»» Quality assurance arrangements are not
formalized.

9
Anchoring High Growth, Can Manufacturing Contribute More? Kenya Economic Update, Edition No. 11, World Bank Report, December
2104
10
http://data.worldbank.org/country/kenya
11
Gazette Notice No. 1420, The Capital Markets Act, (Cap. 485A) the Code of Corporate Governance Practices for Issuers of Securities to
the Public 2015; Principles for Corporate Governance in Kenya and a Sample Code of Best Practice for Corporate Governance, Private Sector
Corporate Governance Trust Report
12
Public Expenditure Financial Accountability Report, August 2012

African Initiative Research Report | globaliia.org 27

nn The Resources indicator is also at
“Emerging” maturity because:
»» There is a shortage of staff with relevant
internal audit skills and qualifications.
»» Internal audit functions’ use of
computerized automated auditing tools
and techniques is limited.
Private Sector: The Governance and Quality
indicators are at par with the National Context
indicator in maturity, while the Resources
indicator is at par with the public sector.
nn The difference in maturity level on the
Governance indicator between the public
and private sector is mainly because, in the
private sector:
»» Internal audit functions are appropriately
positioned in organizations, and have
effective independence, as the head of
internal audit reports functionally to an
audit committee and administratively to
the chief executive officer.
»» Audit committees are effective in the
delivery of their duties.
»» Organizations have consistent
approaches to managing risk.
nn For the Quality Indicator, the main difference
between the public and private sector is:
»» Adoption of risk-based audit planning
aligned to organizational strategies.
»» The broad scope of internal audit
work, which includes compliance,
financial, operational, and other areas as
determined by risk assessments.
»» The good quality of audit reports and
systematic follow-up of audit issues.
13
http://data.worldbank.org/country/malawi
14
Malawi Code II: Code of Best Practice for Corporate Governance in Malawi, Overarching Provisions, June 2010
15
Corporate Governance Guidelines, Reserve Bank of Malawi, 2010
16
Corruptions Perceptions Index 2015, Transparency International, 2015
28 globaliia.org | The Institute of Internal Auditors
nn Similar to the public sector, the Resources
indicator is at the “Emerging” maturity level
due to the shortage of qualified staff with
relevant internal audit skills, and the limited
use of computerized automated auditing
tools and techniques by internal audit
functions.
3.2.5. Malawi
Malawi has an estimated population of 17.2
million and a GDP of $6.565 billion as of 2015.
With a GDP per capita of $381, Malawi is a low
income country13. In the public sector, internal
audit is regulated to a limited scale by the
Public Finance Management Act No. 7 of 2003.
Efforts are under way to enact an internal audit
act. In the private sector, the Malawi Corporate
Governance code14 and the Reserve Bank of
Malawi corporate governance guidelines15
require organizations to have effective internal
audit functions.
Based on the current state of internal audit in
Malawi, the National Context indicator is at the
“Emerging” maturity stage. There is a general
appreciation of the role of internal audit and the
demand for internal audit services is increasing,
as evidenced by the presence of audit firms
providing either co-sourced or outsourced
internal audit services. However, the country ranks
high in the fraud and corruption index16, and
advocacy from development agencies and other
national bodies has not yet led to an increase in
qualified internal auditors, as the country still has
a shortage of staff with relevant internal audit
skills. Chart XIV shows the internal audit national
maturity levels for both the private and public
sectors.
Chart XIV: Malawi International Audit
National Maturity Indicators
Private Sector: The Governance and Quality
indicators are at the “Established” level of
maturity, while the Resources indicator is at the
“Emerging” level of maturity.
Public Sector: Similar to the National Context
indicator, the Governance, Quality, and Resources
indicators are at the “Emerging” level of maturity.
nn The Governance indicator is at the
“Emerging” level of maturity due to:
»» Lack of comprehensive internal audit
legislation providing for internal audit
purpose, authority, and responsibility.
»» Audit committees lacking independence
as members are political appointees.
»» Organizations do not have risk
management frameworks to guide
a consistent approach to risk
management.
nn The Quality indicator is also at an
“Emerging” maturity level because:
»» Internal audit functions have no defined
charters and/or strategies.
»» Audit planning is only partially risk-
based and risk assessments are not
regularly done.
»» Audit reports are generally of poor
quality.
»» Arrangements for quality assurance are
not formalized.
African Initiative Research Report | globaliia.org
nn The Resources indicator is at an “Emerging”
maturity level mainly due to:
»» Inadequate qualified staff with relevant
internal audit skills.
»» Internal audit staff having limited access
to internal audit training.
»» Internal audit functions’ use of
computerized automated auditing tools
and techniques is limited.
nn The Governance Indicator is at the
“Established” level of maturity mainly
because internal audit is appropriately
positioned with reporting lines that
promote independence, audit committees
are effective in the oversight of the audit
function, and organizations have a consistent
approach to managing risk.
nn The Quality indicator is also increasingly
“Established” in maturity because:
»» Internal audit functions are adopting
risk-based audit planning and regular
risk assessments.
»» The scope of internal audit work is broad
beyond compliance and financial controls.
»» Internal audit reports are of good quality
and internal audit functions conduct
systematic follow-up of audit issues.
nn Similar to the public sector, the Resources
indicator is at the “Emerging” maturity stage
due to:
»» A shortage of skilled and qualified
internal auditors.
»» Internal audit staff’s limited access to
internal audit training.
»» Internal audit functions’ limited use of
computerized automated auditing tools
and techniques.
29
3.2.6. Nigeria Chart XV: Nigeria Internal Audit National
Maturity Indicators
Nigeria is the largest country in Africa in terms
of the key indicators of population and economy
size. In 2015, its population was 182.2 million
and its GDP was $481 billion. With a GDP per
capita of $2,640, Nigeria is a lower middle
income country17. Internal audit in the public
sector is regulated by the financial regulation18
which requires internal audit to perform
prepayment audits — a control function. In the
private sector, internal audit is regulated by the
Companies and Allied Matters Act 1990, code of
corporate governance for public companies in
Nigeria, the code of governance for Banks and
Discount Houses in Nigeria, and guidelines for Public Sector: Unlike the National Context
whistleblowing in the Nigerian banking industry. indicator, the Governance and Quality indicators
The current state of internal audit in Nigeria are at the Initial stage.
shows a wide disparity between the public and nn The Governance indicator is still at the
private sectors, with the public sector lagging “Initial” stage because:
behind at the “Initial” stage while internal
»» Internal audit is positioned as a first
audit in the private sector is increasingly more
line of defense performing prepayment
“Established” in maturity. This is largely due to
audits.
financial regulations in the public sector that
require internal audit to operate as a control »» There are no audit committees in the
function performing prepayment audits instead public sector.
of being an oversight function supporting »» Organizations do not have formal risk
management. management frameworks.
The National Context indicator shows Nigeria nn The Quality indicator is also at the “Initial”
to be at the “Emerging” maturity stage. This is stage as the internal audit function performs
mainly due to regulation limiting the role and a control function. It has no charters or
value of internal auditing to control activities, the strategies, no formal risk assessment and
country’s high ranking in the fraud and corruption audit planning, and audit work is mainly
index19, limited advocacy for internal audit from prepayment processing.
development agencies and stock exchanges, and
a shortage of skilled/qualified internal auditors. nn Similar to the National Context indicator,
Chart XV shows the internal audit national the Resources indicator is at the “Emerging”
maturity levels for both the private and public stage, mainly because the academic
sectors. qualifications of internal auditors are a first

17
http://data.worldbank.org/country/nigeria
18
Public Finance (management and control) bill, 2009
19
Corruptions Perceptions Index 2015, Transparency International, 2015

30 globaliia.org | The Institute of Internal Auditors

 degree or above and a few have the CIA
certification. Other Resources indicator
factors such as access to internal audit
training and use of computerized automated
auditing tools and techniques are limited.
Private Sector: In contrast with the public
sector, the Governance indicator and the Quality
indicator are at an “Established” maturity level.
nn The Governance indicator is at the
“Established” level mainly because internal
audit is positioned as an independent unit
with the head of internal audit reporting
administratively to the chief executive officer
and functionally to the audit committee.
Also, the audit committees provides effective
oversight to the internal audit functions.
nn The Quality indicator is also at an
“Established” level of maturity as internal
audit functions have adopted practices
consistent with the IPPF, including having
internal audit charters, and conducting
regular risk assessments and risk-based
planning. The scope of internal audit work is
also broad, going beyond financial controls
and compliance.
nn The Resources indicator is at the “Emerging”
level mainly because:
»» There is a shortage of skilled internal
auditors.
»» Internal audit staff have limited access to
internal audit training.
»» Internal audit functions’ use of
computerized automated auditing tools
and techniques is limited.
20
http://data.worldbank.org/country/rwanda
21
Regulation n°11/2011 on minimum internal control and audit standards in banks
African Initiative Research Report | globaliia.org
3.2.7. Rwanda
Rwanda is a small landlocked country in East
Africa. It has an estimated population of 11.6
million and a GDP of $8.096 billion as of 2015.
With a GDP per capita of $697, Rwanda is a
low income country20. Internal audit in the
public sector in Rwanda is regulated by Acts
of Parliament and Ministerial laws. In the case
of financial institutions, the National Bank
of Rwanda regulations require them to have
internal audit functions21. Other private sector
organizations follow best corporate governance
practices including the King Report on Corporate
Governance, IIA standards, and IFAC guidelines.
Based on the current state of internal audit in
Rwanda, the National Context indicator is at the
“Emerging” maturity stage. There is a general
appreciation of the role of internal audit as
demonstrated by the regulations, but the country
has a high shortage of staff resources with internal
audit skills. Also, the Big Four audit firms and the
local accounting associations are not involved in
the provision of internal audit services/training,
which may be a sign of low or no demand for the
internal audit services. Moreover, IIA–Rwanda
has only recently been formed to promote the
internal audit profession and raise the level
of awareness of the internal audit profession
in general. Chart XVI shows the internal audit
national maturity levels for both the private and
public sectors.
31
Chart XVI: Rwanda Internal Audit National audits. Moreover, the audit reports are of
Maturity Indicators good quality and there is systematic follow-
up of audit issues22.
Private Sector: The Governance and Quality
indicators are at the “Established” level of
maturity while the Resources indicator is at the
“Emerging” level.

nn The Governance indicator is at the

Public Sector: Like the National Context
indicator, the Governance and Resources
indicators are at the “Emerging” level of maturity.
nn The Governance indicator is at the
“Emerging” level of maturity mainly because
audit committees lack capacity to execute
their duties, as for example in the monitoring
of compliance with laws and regulations on
internal audit, and public entities lack risk
management frameworks.
nn The Resources indicator is also at the
“Emerging” level mainly due to a shortage
of professional practitioners in internal audit,
limited access to internal audit training, and
limited use of computerized automated
auditing tools and techniques.
nn The Quality indicator is, however, ranked
as “Established” because internal audit
functions have adopted practices consistent
with IPPF, including having internal audit
charters and conducting regular risk
assessments. In addition, the scope of
internal audit is broad covering compliance,
financial, operational, and performance
“Established” level mainly because internal
audit is appropriately positioned as an
independent function reporting directly to
the chief executive officer administratively
and functionally to the audit committee. In
addition, audit committees provide effective
oversight to internal audit functions, and
organizations have a consistent approach to
managing risk.
nn The Quality indicator is also increasingly
“Established” in maturity as internal audit
functions have adopted practices consistent
with IIA standards, including having formal
charters and conducting risk-based annual
audit planning. Internal audit work is also
broad in scope beyond compliance and
financial controls. Furthermore, internal audit
reports are of good quality and follow-up of
audit issues is systematic.
nn Similar to the public sector, the Resources
indicator is still at the “Emerging” stage
because:
»» There is a shortage of skilled internal
auditors.
»» Internal audit staff have limited access to
internal audit training.
»» Internal audit functions’ use of
computerized automated auditing tools
and techniques is limited.

22
Rwanda: Transformation of Agriculture Sector Phase 3 Program-for-Results, Integrated Fiduciary Assessment Report, 2014; Public Sector
Governance Program-for-Results, Fiduciary Assessment Report, 2014

32 globaliia.org | The Institute of Internal Auditors

3.2.8. Tanzania Chart XVII: Tanzania Internal Audit National
Maturity Indicators
Tanzania has an estimated population of 53.5
million and a GDP of $44.895 billion as of 2015.
With a GDP per capita of $864, Tanzania is a low
income country23. Internal audit in Tanzania’s
public sector is regulated by the Public Finance
Act 2010 (revised 2014), Local Government
Finances Act of 1982, Executive Agency Act of
1997, and Public Corporations Act of 1992. In the
private sector, requirements for internal audit are
included in the Banks and Financial Institutions
Act of 2006. Other private sector entities follow
corporate governance best practices.

Based on the current state of internal audit

in Tanzania, the National Context indicator is
increasingly at the “Established” maturity stage.
There is a general appreciation of the role and
value of internal audit, demand for internal
audit services is increasing as demonstrated by
the presence of the Big Four audit firms in this
field, and the National Board of Accountants
and Auditors provides support to the internal
audit profession by regulating application of the
IPPF. There are also a number of development
agencies supporting internal audit capacity
building and active advocacy is undertaken by
key bodies including the Bank of Tanzania and
the Dar es Salaam stock exchange. Chart XVII
shows the internal audit national maturity levels
for both the private and public sectors.
Public Sector: Unlike the National Context
indicator, the Governance, Quality, and Resources
indicators are at the “Emerging” level of maturity.
nn The Governance indicator is at the
“Emerging” level because audit committees
lack independence and relevant internal
audit skills, and public entities have no
formal risk management frameworks.
nn The Quality indicator is “Emerging” in
maturity because internal audit functions
have only basic charters and strategies, have
not fully adopted risk-based planning, and
the follow-up of audit recommendations
is not fully effective24. Arrangements for
quality assurance are also limited.
nn The Resources indicator is also “Emerging”
in maturity because of a shortage of skilled
internal auditors, limited access to training
due to funding challenges, and limited use
of computerized automated auditing tools
and techniques.

23
http://data.worldbank.org/country/tanzania
24
Tanzania Public Expenditure Financial Accountability Report, 2013

African Initiative Research Report | globaliia.org 33

Private Sector: Similar to the National Context require their respective market players to have
indicator, the Governance, Quality, and Resources internal audit functions. Other private sector entities
indicators are at an “Established” level of maturity. follow corporate governance best practices.

nn The Governance indicator is “Established”
in maturity mainly because internal audit
is appropriately positioned to promote
its independence and audit committees
effectively provide oversight to internal audit
functions.
nn The Quality indicator is also at “Established”
maturity as internal audit functions
have charters and strategies aligned to
organization strategies, have adopted annual
risk assessments for audit planning, and have
a broad scope of work beyond compliance
and financial controls. In addition, audit
reports are of good quality and follow-up of
audit recommendations is methodical.
nn The Resource indicator is “Established”
mainly because the local IIA affiliate is
actively providing internal audit training, and
the accounting bodies are active in internal
audit services promotion. In addition, the Big
Four public accounting firms are providing
co-sourcing and outsourcing internal audit
resources.
Based on the current state of internal audit
in Uganda, the National Context indicator is
becoming “Established” in maturity. There is
a general appreciation of the role and value of
internal audit as the government is jointly working
with development agencies to build internal audit
capacity. There is also increasing demand for
internal audit services as big audit firms outsource
and/or co-source their internal audit services, and
the accounting associations provide support to
the profession through training. In addition to
development agencies supporting internal audit
capacity building, the Capital Markets Authority
and Bank of Uganda are actively advocating for
internal audit through their listing and supervision
requirements, respectively. Chart XVIII shows the
internal audit national maturity levels for both the
private and public sectors.
Chart XVIII: Uganda Internal Audit National
Maturity Indicators

3.2.9. Uganda
Uganda has an estimated population of 39.03
million and a GDP of $26.369 billion as of 2015. With
a GDP per capita of $675, Uganda is a low income
country25. Internal audit in Uganda’s public sector is
regulated by the Public Finance and Management
Act, 2015. In the private sector, the Bank of
Uganda26 and the Capital Markets Authority27

25
http://data.worldbank.org/country/uganda
26
The Financial Institutions (Corporate Governance) Regulations, 2005
27
The Capital Markets Corporate Governance Guidelines, 2003

34 globaliia.org | The Institute of Internal Auditors

Public Sector: Unlike the National Context
indicator, the Governance, Quality, and Resources
indicators are at the “Emerging” level of maturity.
nn The Governance indicator is at the
“Emerging” level of maturity because audit
committees lack independence and have
limited understanding of internal audit. In
addition, public entities have no formal risk
management frameworks.
nn The Quality indicator is “Emerging” in
maturity as internal audit functions have
only basic charters and strategies and have
not fully adopted risk-based planning. Also,
internal audit reports are of poor quality
and the follow-up process is not systematic,
resulting in weak implementation of internal
audit recommendations28. Moreover, quality
assurance arrangements are still under
development.
nn The Resources indicator is also “Emerging”
in maturity because:
»» There is a shortage of skilled internal
auditors.
»» Internal auditors have limited access to
internal audit training.
»» Internal audit functions are not fully
using computerized automated auditing
tools and techniques.
28
Uganda Public Expenditure Financial Accountability Report 2012; Uganda support to municipal infrastructure development program,
Fiduciary Systems Assessment, 2012
African Initiative Research Report | globaliia.org
Private Sector: The Governance and Quality
indicators are at an “Established” level of maturity.
nn The Governance indicator is “Established”
because internal audit is appropriately
positioned in organizations as the head
of internal audit is regarded as part of
senior management and the reporting lines
promote independence. Audit committees
are also effectively providing oversight for
the internal audit functions.
nn The Quality indicator is also “Established” in
maturity because:
»» Internal audit functions have charters
and strategies aligned to organization
strategies.
»» Internal audit functions have adopted
practices consistent with IIA standards
such as annual risk assessments and risk-
based audit planning.
»» Internal audit functions have a broad
scope of work beyond compliance and
financial controls.
»» Audit reports are of good quality
and follow-up processes for audit
recommendations are effective.
nn Like the public sector, the Resources
indicator is at the “Emerging” level of
maturity because:
»» There is a shortage of skilled internal
auditors.
»» Internal auditors have limited access to
training on internal audit.
»» Internal audit functions are not fully
using computerized automated auditing
tools and techniques.
35
3.2.10. Zambia Chart XIX: Zambia Internal Audit National
Maturity Indicators
Zambia has an estimated population of 16.2 million
and a GDP of $21.202 billion as of 2015. With a
GDP per capita of $1,361, Zambia is a lower middle
income country29. Internal audit in Zambia’s public
sector is regulated by the Public Finance Act
No. 15 of 2004. In the private sector, the Banking
and Financial Services Act30 requires all financial
institutions to have an internal audit function.
Other private sector organizations generally follow
corporate governance best practices.

The internal audit profession in Zambia is still in

its infancy, as evidenced by three of the internal
audit national maturity indicators, which are
at the “Emerging” level of maturity in both
the public and private sectors. The National
Context indicator is at the “Emerging” stage
mainly because there is a lack of recognition of
internal audit as a profession, as evidenced by
the absence of university programs in internal
auditing and very low levels of IIA membership
and certification. Positive factors at the National
Context level include the current general
appreciation for the value and role of internal
audit by the government, as it is working with
development agencies and the local IIA affiliate
to build internal audit capacity; and the growing
presence of the big four audit firms, which are
providing internal audit services. Chart XIX shows
the internal audit maturity levels for both the
private and public sectors.
Public Sector: Similar to the National Context
indicator, the Governance, Quality, and Resources
indicators are at the “Emerging” level of maturity.
nn The Governance indicator is at the
“Emerging” level because the head of
internal audit is placed at a junior level
of management largely performing
a control monitoring role. Also, audit
committees lack independence and have
limited understanding of internal audit. In
addition, public entities have no formal risk
management frameworks.
nn The Quality indicator is “Emerging” in
maturity as internal audit functions have only
basic charters and strategies and have not
adopted risk-based planning. Internal audit
reports are of poor quality and the follow-
up process is not systematic, hampered
mostly by constrained budgets. Also,
quality assurance arrangements are not fully
operational.

29
http://data.worldbank.org/country/zambia
30
Banking and Financial Services Act, Cap 387 of the Laws of Zambia

36 globaliia.org | The Institute of Internal Auditors

 nn The Resources indicator is also “Emerging”
in maturity because:
»» There is a shortage of skilled internal
auditors.
»» Internal auditors have limited access to
training due to funding challenges.
»» Internal audit functions use manual
systems rather than any computerized
automated auditing tools and
techniques.
Private Sector: Unlike the National Context
indicator, the Governance indicator is at the
“Established” level of maturity. But like the public
sector, the Quality and the Resources indicators
are at the “Emerging” stage.
nn Governance is at a more mature level in
the private sector mainly because internal
audit is appropriately positioned with the
head of internal audit being part of senior
management and with reporting lines
that promote independence, and internal
audit operates as a third line of defense. In
addition, audit committees are somewhat
effective in providing oversight of the
internal audit function.
nn The Quality indicator is still at “Emerging”
maturity because:
»» Internal audit functions have only
basic charters with no comprehensive
strategies.
»» Internal audit functions conduct risk
assessments infrequently and audit
planning is only partially risk-based.
»» The scope of internal audit work is
narrow, mostly compliance and financial
controls.
»» Quality assurance programs are not
formalized.
31
http://data.worldbank.org/country/zimbabwe
African Initiative Research Report | globaliia.org
nn The Resources indicator is also “Emerging”
as there is a shortage of skilled internal
auditors. Internal auditors have only limited
access to training on internal audit and
most internal audit functions are not using
computerized automated auditing tools and
techniques.
3.2.11. Zimbabwe
Zimbabwe has an estimated population of 15.6
million and a GDP of $13.9 billion as of 2015. With a
GDP per capita of $890, Zimbabwe is a low income
country31. Internal audit in Zimbabwe’s public sector
is regulated by the Public Finance Management
Act (No. 11-2009). In the private sector, the new
National Code on corporate governance is being
implemented. Organizations have been following
corporate governance best practices such as the
King Report on corporate governance.
The current state of internal audit in Zimbabwe
shows a maturity disparity between the private and
public sector for three of the internal audit national
maturity indicators of Governance, Quality, and
Resources. The National Context indicator is at
the “Emerging” maturity stage even though the
Big Four audit firms are actively providing internal
audit services and training, and the accounting
associations are providing training and guidance
to members and audit committees. The limited
recognition of the value and role of internal audit
in the government where internal audit is a control
function, and the limited advocacy by key players
in the private sector impact the maturity of the
internal audit profession at the national level.
Moreover, the corporate governance code is
relatively new. Chart XX shows the internal audit
national maturity levels for both the private and
public sectors.
37
Chart XX: Zimbabwe Internal Audit National nn The Resources indicator is also “Emerging”
Maturity Indicators as there are very few trained internal auditors
and there is limited access to training due
to lack of funds. In addition, internal audit
functions are still using traditional manual
systems instead of computerized automated
auditing tools and techniques.
Private Sector: Unlike in the public sector, the
Governance, Quality, and Resources indicators
are at the “Established” level of maturity.

nn The Governance Indicator is “Established”

in maturity because internal audit is
appropriately positioned as part of senior
management, with reporting lines that
Public Sector: Similar to the National Context promote its independence. In addition,
indicator, the Governance, Quality, and Resources audit committees are effectively providing
indicators are at the “Emerging” level of maturity. oversight to internal audit functions.

nn Governance is at the “Emerging” level of nn The Quality indicator is at the “Established”

maturity because audit committees lack level as internal audit functions have charters
independence and objectivity in decision and strategies aligned to organization
making due to political interference, strategies, have adopted annual risk
and public entities have no formal risk assessments for audit planning, and have
management frameworks. a broad scope of work beyond compliance
and financial controls. In addition, audit
nn The Quality indicator is at the “Emerging” reports are of good quality and follow-
level as internal audit functions have only up processes for implementation of audit
basic charters and strategies and generally recommendations are in place.
have not adopted risk-based planning. The
scope of internal audit work is limited to nn The Resource indicator is also at the
financial controls and compliance, internal “Established” level because the local IIA
audit reports are not distributed in a timely affiliate is actively providing internal audit
way, and the follow-up process is incomplete, training, together with the accounting
being mostly hampered by unsatisfactory bodies, while leveraging co-sourcing and
management responses or no responses at outsourcing of internal audit services to the
all32. Also, there are no formal arrangements public accounting firms.
for quality assurance.
Detailed analysis of the internal audit national
maturity indicators for all 11 countries are
included in Appendix II.

32
Zimbabwe Country Integrated Fiduciary Assessment, World Bank, 2012

38 globaliia.org | The Institute of Internal Auditors

4. CONCLUSIONS
The results of this research tell the story of the
state of the internal audit profession in Sub-
Saharan Africa. In many ways it confirms the
findings of The IIA’s initial analysis and provides
more granular detail into the areas that will need
to be developed. The mapping of the current
state of internal audit to the internal audit
maturity model provides some clues as to what
capacity building activities need to be conducted
to enable each country to advance to the next
level of maturity for each indicator for both the
public and private sectors.
The results show a private sector that is more
mature in the Governance and Quality indicators
compared with the public sector. The National
Context indicator maturity is impacted by the
level of awareness of the role and value of the
internal audit profession. The research found:
nn Low awareness of the profession and its
potential contribution to better efficiency,
greater transparency, more accountability,
and tackling fraud and corruption. This is
because the countries’ key stakeholders have
limited understanding and recognition of
the role and value of internal auditing. Also,
the countries have very limited academic
programs in internal auditing, which would
be a great avenue for increasing awareness
of the profession.
nn An inadequate number of professional
internal auditors, as evidenced by low
membership at The IIA and very few internal
audit certifications. Also, World Bank country
assessment reports indicated the existence
of vacancies in government internal audit
functions due to a lack of skilled/qualified
internal audit staff.
nn Low levels of advocacy for the internal
audit profession by key stakeholders in
government and the private sector, and by
other professional bodies.
African Initiative Research Report | globaliia.org
The current state of internal audit in the public
sector is most heavily impacted by legislation
and regulations — or the absence of them
— especially where internal audit is not fully
recognized as an oversight function but treated
more like a control function.
The current state of internal audit maturity in
the private sector is mostly driven by central
bank/stock exchange regulations, and the active
participation of the Big Four accounting firms
in the provision of services and internal audit
training.
The key strengths and areas for improvement of
each of the 11 countries are presented below.
Botswana: Only two indicators are at
“Established” maturity (i.e., private sector
Governance and Quality indicators) with
the others at “Emerging” maturity. The key
strengths for Botswana include: its low fraud
and corruption index; and the internal audit
function is appropriately positioned in private
sector organizations where the head of internal
audit is usually part of senior management,
reporting functionally to the audit committee and
administratively to the chief executive officer. Key
areas for improvement, where the sub-elements
are at the “Initial” stage, include:
nn Increasing IIA membership and certification,
nn Participation of the Big Four accounting firms
and accounting associations in support of
the internal audit profession.
nn Legislation and regulation of internal audit.
nn Empowerment of audit committees in the
public sector.
nn Improving organizational risk management
frameworks in the public sector.
nn Formalizing quality assurance arrangements
in the public sector.
39
Ethiopia: The Governance indicator for the
private sector is at “Established” maturity, but
the rest of the indicators are only “Emerging”
in maturity. The key strengths include the
appropriate positioning of internal audit in the
private sector where the head of internal audit is
part of senior management, and the effectiveness
of audit committees as their composition and
roles are aligned to best corporate governance
practices. The key areas that are at the “Initial”
stage and need to be improved include:
nn Introducing internal audit programs in
colleges and universities.
nn Improving the understanding and
recognition of the role and value of internal
auditing by key stakeholders.
nn Addressing the high fraud and corruption
ranking.
nn Participation of the Big Four accounting firms
and accounting associations in support of
the internal audit profession.
nn Empowerment of audit committees in the
public sector.
nn Strengthening the monitoring and
enforcement of internal audit legislation and
regulation.
nn Improving organizational risk management
frameworks in the public sector.
nn Adoption of IIA standards with respect
to audit strategy and charters, and audit
planning and risk assessments.
Ghana: The Governance and Quality indicators for
the private sector have an “Established” maturity,
while the same indicators for the public sector and
the National Context and Resources indicators are
all at “Emerging” maturity. Most of the indicator
elements are showing either an “Emerging” or
“Established” maturity, with “Emerging” tilting
the scales. The key strength is mainly the status of
internal audit in the private sector, where the head
40 globaliia.org | The Institute of Internal Auditors
of internal audit is elevated to a senior management
level, reporting functionally to the audit committee
and administratively to the chief executive officer.
The areas for improvement, where the sub-
elements are at the “Initial” stage, include:
nn Increasing the number of practitioners who
hold an IIA certification.
nn Improving the understanding and recognition
of the role and value of internal auditing in
government, where the internal audit function
is currently positioned as a first line of defense
performing an ex-ante check of compliance
with rules and procedures.
nn Improving organizational risk management
frameworks in the public sector.
Kenya: The National Context, and the Governance
and the Quality indicators in the private sector
are at “Established” maturity. The Resources
indicator for both the private and public sectors is at
“Emerging” maturity. The key strengths include the
use of IIA standards in both the public and private
sector, and appropriate positioning of internal
audit functions in the private sector organizations,
where the head of internal audit is usually part of
senior management, reporting functionally to the
audit committee and administratively to the chief
executive officer. The key areas for improvement
include the following:
nn Addressing the high fraud and corruption
ranking.
nn Strengthening the monitoring and
enforcement of internal audit regulation and
legislation.
nn Empowerment of audit committees in the
public sector, especially regarding internal
audit.
nn Improving organizational risk management
frameworks in the public sector.
nn Formalizing quality assurance arrangements
in the public sector.
Malawi: Two indicators in the private sector —
Governance and Quality— are at “Established”
maturity while the others are at “Emerging”
maturity. The key strengths include substantial
IIA membership in relation to GDP per capita
and the appropriate status of internal audit in
the private sector, where the head of internal
audit is part of senior management. Key areas for
improvement include:
nn Increasing the number of practitioners who
hold an IIA certification.
nn Addressing the high fraud and corruption
ranking.
nn Participation of accounting associations in
support of the internal audit profession.
nn Strengthening the monitoring and
enforcement of internal audit regulation and
legislation.
nn Empowerment of audit committees in the
public sector, especially regarding internal
audit.
nn Improving organizational risk management
frameworks in the public sector.
nn Adoption of IIA standards with respect to
audit strategy and charters, and quality of
audit reports.
nn Formalizing quality assurance arrangements
in the public sector.
Nigeria: The internal audit national maturity
indicators for Nigeria range from “Initial” stage
to “Established” maturity. The Governance
and Quality indicators in the private sector
are “Established” in maturity, while the same
indicators are at the “Initial” stage in the public
sector. The National Context indicator and the
Resources indicator for both the public and private
sectors are at the “Emerging” stage. Nigeria’s
key strength is that internal audit is appropriately
positioned in private sector organizations with the
head of internal audit reporting administratively
African Initiative Research Report | globaliia.org
to the chief executive offier and functionally to
the audit committee. There are many areas for
improvement where the sub-elements are ranked
at the “Initial” stage, including:
nn Improving the understanding and
recognition of the role and value of internal
auditing by key stakeholders.
nn Increasing the number of practitioners who
hold an IIA certification.
nn Addressing the high fraud and corruption
ranking.
nn Participation of accounting associations in
support of the internal audit profession.
nn Elevating the status of internal audit in
government.
nn Introducing and empowering audit
committees in the public sector.
nn Improving organizational risk management
frameworks in the public sector.
nn Adopting IIA standards in public sector
internal auditing.
Rwanda: There are three indicators at the
“Established” maturity — the Governance
indicator, and the Resources indicator for both
the private and public sector — while the other
indicators are at “Emerging” maturity. Most of the
indicator sub-elements are at either “Emerging”
or “Established” maturity. The key strengths
include a low fraud and corruption ranking and
the high status of internal audit in private sector
organizations where the head of internal audit
is part of senior management. Key areas for
improvement, where the sub-elements are at the
“Initial” stage, include:
nn Introduction of internal audit programs in
colleges and universities.
nn Increasing the number of practitioners are
members of The IIA and who hold an IIA
certification.
41
 nn Participation of the Big Four accounting firms
and accounting associations in support of the
internal audit profession.
nn Strengthening the monitoring and
enforcement of internal audit regulation and
legislation.
nn Improving organizational risk management
frameworks in the public sector.
Tanzania: There are four indicators with
“Established” maturity — National Context,
and the private sector Governance, Quality, and
Resources indicators — while the other indicators
are at “Emerging” maturity. Most of the indicator
elements are at the “Emerging” and “Established”
levels of maturity. The key strengths include:
nn The use of standards for internal audit is
clearly defined.
nn Internal audit functions are well positioned in
private sector organizations, with reporting
lines that promote independence.
Key areas for improvement, where the sub-
elements are at the “Initial” stage, include:
nn Increasing the number of practitioners who
hold an IIA certification.
nn Addressing the high fraud and corruption
ranking.
nn Empowering audit committees in the public
sector.
nn Improving organizational risk management
frameworks in the public sector.
Uganda: The National Context, and the private
sector Governance and Quality indicators are
at the “Established” level of maturity. Similar to
Tanzania, most of the indicator sub-elements
are at the “Emerging” and “Established” levels
of maturity. The key strengths, where the sub-
elements are above the “Established” level,
include:
42 globaliia.org | The Institute of Internal Auditors
nn Substantial IIA membership in relation to GDP
per capita.
nn High status of internal audit with the
head of internal audit being part of senior
management.
nn Positioning of internal audit as a third line of
defense in the private sector.
The key areas for improvement, where the sub-
elements are at the “Initial” stage, include:
nn Introduction of internal audit programs in
colleges and universities.
nn Addressing the high fraud and corruption
ranking.
nn Empowering audit committees in the public
sector.
nn Improving the quality of audit reports in the
public sector.
nn Improving organizational risk management
frameworks in the public sector.
Zambia: Only the private sector Governance
indicator is at “Established” maturity. All the
other indicators are at “Emerging” maturity. The
key strength is the appropriate positioning of
the internal audit function in the private sector,
where the head of internal audit is part of senior
management with reporting lines that promote
independence. Key areas for improvement,
where the sub-elements are at the “Initial” stage,
include:
nn Introduction of internal audit programs in
universities and colleges.
nn Increasing the number of practitioners who
hold an IIA certification.
nn Strengthening the monitoring and
enforcement of internal audit regulation and
legislation.
nn Empowering audit committees in the public
sector.
nn Adoption of IIA standards with respect to
audit planning including risk assessment and
quality of audit reports in the public sector.
nn Improving organizational risk management
frameworks in the public sector.
Zimbabwe: The private sector Governance,
Quality, and Resources indicators are at
“Established” maturity, while the same indicators
in the public sector are at the “Emerging” level
of maturity. The National Context indicator is
also at the “Emerging” level of maturity. Most
of the sub-elements are either at “Emerging”
or “Established” maturity. Key strengths ranking
above “Established” maturity include:

nn High status of internal audit in the private

sector where the head of internal audit is
elevated to a senior management level,
reporting functionally to the audit committee
and administratively to the chief executive
officer. Internal audit is also positioned as a
third line of defense.
nn The use of standards for internal audit is
clearly defined in the private sector.
The key areas for improvement, where the sub-
elements are at the “Initial” stage, include:

nn Addressing the high fraud and corruption

ranking.
nn Strengthening the monitoring and
enforcement of internal audit regulation and
legislation.
nn Empowering audit committees in the public
sector.
nn Improving organizational risk management
frameworks in the public sector.
nn Formalizing quality assurance arrangements
in the public sector.

African Initiative Research Report | globaliia.org 43

5. NEXT STEPS
Based on these research findings, capacity building activities that would bring real growth may vary
from country to country, and some capacity building activities may apply to more than one country or
to all countries. However, from a general perspective, key capacity building activities to advance the
internal audit profession in Sub-Saharan Africa include:

nn Raising the level of awareness and understanding of the role and value of internal auditing.
This is necessary to increase the appetite and demand for internal audit among key stakeholders
(governments, investors, and the public at large). It may include working with governments and
their leaders, supreme auditors general, heads of central banks and stock exchanges, and internal
auditors general (where they exist) to ensure that the operational environment is optimized for
internal audit, including the legislative and regulatory framework.
nn Ensuring that internal audit is configured in a way that optimizes its value. This requires
working with organizations and their senior management with a view to enhancing the
effectiveness of internal audit functions.
nn Providing training and development opportunities directly to practitioners. Such training
(whether face-to-face, remotely, or by blended means) would enhance the skills of internal audit
practitioners. In addition, internal audit programs should be promoted in academia — universities
and colleges — to train future internal audit practitioners.
nn Developing the local IIA affiliates. This would entail providing them with the necessary resources
so they are better able to support the audit profession in their countries (and perhaps in the
region). The local affiliates are best placed to advocate for the profession locally, provide training
and continuing education to practitioners, and support quality assurance programs by providing
external quality assurance review services.
nn Partnering with development agencies and other organizations. Such partnerships would
include development agencies, the Big Four accounting firms, and the local accounting bodies
that are building internal audit capacity on the ground. This will help to maximize outcomes.

44 globaliia.org | The Institute of Internal Auditors

Taking the state of the internal audit profession per country into consideration, the following specific
capacity building activities are suggested:

Country Suggested Internal Audit Capacity Building Activities

Strengthen AFIIA by:

• Building its capacity in leadership, offices, and staffing to strengthen regional representation of
the profession.
Regional Level
• Having a regional center of excellence with training facilities.
• Collaborating with regional bodies including ECOWAS, EAC, SADC, AFroSAI-E, and ACCA
Africa to support AFIIA.

• Enhance the capacity of the local affiliate to enable its leaders to drive favorable internal audit
legislation.
• Undertake targeted training on internal audit with various objectives (e.g., to increase the
Botswana number of practitioners who hold IIA certifications, and to enhance the skills of internal audit
practitioners).
• Increase visibility and knowledge of the profession by promoting an internal audit curriculum in
universities and colleges.

• Build a stronger local affiliate with good, motivated leadership.

• Collaborate with development agencies to advocate for internal audit in government and with
key players in the private sector.
Ethiopia
• Increase visibility and knowledge of the profession by promoting an internal audit curriculum in
universities and colleges.
• Train internal audit practitioners to enhance their skills including obtaining IIA certifications.

• Train internal audit practitioners to enhance their skills (e.g., certification-targeted training).
• Collaborate with development agencies to advocate for the role and value of internal audit to
Ghana government and other key stakeholders.
• Convene development agencies and harmonize the internal audit capacity building strategy for
the country to maximize outcomes.

• Convene development agencies to provide funding for an internal audit center of excellence
(the local affiliate has already acquired land; if successful, it can be used as a regional center of
excellence).
• Enhance competency of practitioners through targeted training including IIA certifications.
Kenya • Collaborate with development agencies to advocate for the recognition of internal audit as a
profession by the public service commission and corporate leaders (e.g., to require CAEs to
have IIA certifications instead of accounting or financial qualifications).
• Convene development agencies and harmonize the internal audit capacity building strategy for
the country to maximize outcomes.
• Collaborate with development agencies to advocate for the role and value of internal audit to
government and other key stakeholders.
Malawi • Train internal audit practitioners to enhance their skills and increase the number of practitioners
who hold IIA certifications.
• Increase advocacy for more colleges/universities to offer internal audit programs.

African Initiative Research Report | globaliia.org 45

 • Invest in advocacy to boost the value of internal audit, especially in the public sector.
• Boost the capacity of the local affiliate leaders (e.g., with support from AFIIA and ACCA Africa).
• Train internal audit practitioners to enhance their skills and also improve professionalism by
promoting the value of IIA membership and certifications.
Nigeria
• Consider building a center of excellence with training infrastructure and tools to cater to the
West African region.
• Increase visibility and knowledge of the profession by promoting an internal audit curriculum in
universities and colleges.

• Mentor the local affiliate to accelerate its maturity and capacity to lead the profession in the
country.
• Increase visibility and knowledge of the profession by promoting an internal audit curriculum in
universities and colleges.
Rwanda
• Train internal audit practitioners to enhance their skills and increase IIA membership and
practitioners who hold IIA certifications.
• Collaborate with development agencies to advocate for the internal audit profession in
government and with key stakeholders.

• Convene development agencies and harmonize the internal audit capacity building strategy for
the country to maximize outcomes.
• Collaborate with development agencies to advocate for the recognition of internal audit as a
Tanzania profession by the public service commission, accounting bodies, and corporate leaders.
• Deliver targeted IIA certification training to increase the number of IIA certified internal audit
practitioners.
• Empower the local affiliate to advocate for internal audit programs in universities/colleges.

• Increase visibility and knowledge of the profession by promoting an internal audit curriculum in
universities and colleges.
• Train internal audit practitioners to enhance their skills and also improve professionalism by
Uganda
promoting the value of IIA certifications.
• Collaborate with development agencies to advocate for the value of the internal audit
profession to government and key stakeholders.

• Empower the local affiliate to advocate for internal audit legislation that recognizes internal
audit as a profession.
• Invest in advocacy to boost the value of internal audit in both the public and private sectors
and for the recognition of internal audit as a profession by the public service commission and
Zambia corporate leaders.
• Increase visibility and knowledge of the profession by promoting an internal audit curriculum in
universities and colleges.
• Train internal audit practitioners to enhance their skills. Encourage internal audit practitioners to
be IIA members and to be IIA certified.

• Empower the local affiliate to advocate for the recognition of the value of internal audit in both
the public and private sectors.
Zimbabwe
• Train internal audit practitioners to enhance their skills and increase the number of practitioners
who hold IIA certifications.

46 globaliia.org | The Institute of Internal Auditors

One of the ways The IIA can maximize outcomes
on internal capacity building is to partner with
development agencies on the ground. The
research found that a number of development
agencies are active in building internal
audit capacity, either in conjunction with the
government or independently, in the 11 countries
covered by this report. The table below gives a
summary of development agencies active in each
country in the study.
Development Agencies
Country Engaging in Internal Audit
Capacity Building in the Country
audit committees to follow up on actions
included in internal audit reports as part of
the oversight function.
nn Training internal auditors to support
government efforts to implement Enterprise
Risk Management (ERM).
nn Providing consultancy and operational
support in the conduct of specialized audits
such as procurement audits, payroll audits,
system-based audits, and risk-based audits.
nn Developing internal auditing manuals and
training materials for governments.

Botswana World Bank, UK and Commonwealth nn Training internal auditors on risk-based

internal auditing.
Ethiopia World Bank, DFID
The IIA can collaborate with the development
World Bank, GIZ, CIDA, DANIDA,
Ghana UK and Commonwealth, African agencies in helpful ways:
Development Bank
nn Seek funding from development agencies to
World Bank, African Development Bank,
Kenya implement activities directly (e.g., training for
GIZ, DANIDA, DFID
CIA certification, building a regional center of
Malawi World Bank, GIZ
excellence).
Nigeria World Bank
nn Present a proposal for The IIA to be a
Rwanda World Bank, GIZ consultant and advise on the design and
implementation of development agencies’
World Bank, DFID, USAID, JICA, GIZ,
Tanzania internal audit projects.
African Development Bank

Uganda World Bank, DFID nn Convene the development agencies and

Zambia World Bank, GIZ, DFID
Zimbabwe World Bank, African Development Bank
The internal audit capacity building activities
being implemented by the development agencies
include:
nn Designing, developing, and rolling out
internal audit quality assurance programs.
nn Providing operational resources and tools
(e.g., computers, hardware, and software)
and training internal audit staff on how to use
computers.
advocate for a harmonized strategy for
internal audit capacity building within the
region and in individual countries.
nn Leverage development agencies’ influence
on governments, regional bodies, and key
stakeholders to advocate for the role and
value of internal audit in good governance.
nn Collaborate with development agencies
to encourage the government authorities
to pass legislation that enables internal
audit to become a vibrant component of
good governance at both the national and
corporate levels.

nn Financing the establishment of audit

committees and in some cases strengthening

African Initiative Research Report | globaliia.org 47

RESEARCH RESOURCES
General
1. Corruptions Perceptions
Index 2015, Transparency
International, 2015
2. IIA CBOK 2015 data and
reports
Botswana
1. Public Finance Management
ACT No. 1 of 1999 updated to
Government Gazette 33059
dated 1 April 2010
2. Public Expenditure and
Financial Accountability
Assessment (PEFA) Report,
August 2013
3. Country Governance Profile,
African Development Bank,
2009
Ethiopia
1. Regulation No. 190/2010
Financial Administration
Council of Ministers
Regulation
2. National Bank of Ethiopia
Licensing and Supervision
of Banking Business, Bank
Corporate Governance
Directives No.SBB/62/2015
3. National Bank of Ethiopia
Licensing and Supervision of
Insurance Business, Corporate
Governance Directives No.
SIB/…./2015
4. Ethiopia PEFA 2014 Regional
Reports, Oromia Regional
State
48 globaliia.org | The Institute of Internal Auditors
Ghana
1. Internal Audit Agency Act,
2003 (Act, 658)
2. Audit Service Act, 2000 (Act
584)
3. PEFA Report, June 2013
4. Banking and Financial Laws of
Ghana 1998–2006
5. Ghana Securities and
Exchange Commission
Corporate Governance
guidelines on best practice,
2010
Kenya
1. PEFA Report, August 2012
2. Audit Committees in the
Public Sector, ICPAK Report,
2015
3. Treasury Circular No. 4/08,
Strengthening of Internal
Audit Function in Government
Service
4. Treasury Circular No.
3/2009, Development
and Implementation of
Institutional Risk Management
Policy Framework (IRMPF) in
the Public Sector
5. Integrated Fiduciary
Assessment of the Kenya
National Safety Net Program
for Results, World Bank, 2013
6. Gazette Notice No. 2690,
Audit Committee Guidelines
for County Governments, Vol.
CXVIII—No. 40, April 2016
7. Gazette Notice No. 1420, The
Capital Markets Act, (Cap.
485A) the Code of Corporate
Governance Practices for
Issuers of Securities to the
Public 2015
8. Principles for Corporate
Governance in Kenya and a
Sample Code of Best Practice
for Corporate Governance,
Private Sector Corporate
Governance Trust Report
9. Anchoring High Growth, Can
Manufacturing Contribute
More? Kenya Economic
Update, Edition No. 11, World
Bank Report, December 2014
10. Mwongozo, The Code
of Governance for State
Corporations, Public
Service Commission &
State Corporations Advisory
Committee Joint Report
11. Public Finance Management
Act No. 18, 2012, revised 2015
Malawi
1. Malawi Code II: Code of
Best Practice for Corporate
Governance in Malawi,
Overarching Provisions, June
2010
2. Public Finance Management
Act No. 7, 2003
3. PEFA Report, March 2011
4. Corporate Governance
Guidelines, Reserve Bank of
Malawi, 2010
Nigeria
1. Program-for-results to
support the saving one
million lives initiative,
Integrated Fiduciary
Assessment Report, World
Bank, 2015
2. Code of Governance for
Banks and Discount Houses
in Nigeria and Guidelines
for Whistle Blowing in the
Nigerian Banking Industry,
Circular FPR/DIR/CIR/
GEN/01/004, 2014
3. Public Finance (Management
and Control) Bill, 2009
4. Code of Corporate
Governance for Public
Companies in Nigeria
5. Atu, Omimi-Ejoor O.K.,
(2014) Audit Committees:
The Journey So Far In
Nigeria, IOSR Journal of
Economics and Finance,
Volume 3, Issue 1., pp 40–43
Rwanda
1. Government of Rwanda
Audit Committee Charter,
2011
2. Government of Rwanda
Internal Audit Charter, 2011
3. Government of Rwanda
Internal Audit Procedures
Manual, 2011
4. Ministerial Order No
002/09/10/GP/A of
12/02/2009 Setting out
Regulations for Internal
Control and Internal Audit in
Government
5. Ministerial Order No.
001/16/10/TC of 26/01/2016
relating to financial
regulations
6. Organic Law No. 12/2013/
OL of 12/09/2013 on State
Finances and Property
7. Regulation No. 11/2011 on
Minimum Internal Control
and Audit Standards in
Banks
8. Rwanda: Transformation of
Agriculture Sector Phase
3 Program-for-Results,
Integrated Fiduciary
Assessment Report, 2014
9. Public Sector Governance
Program-for-Results,
Fiduciary Assessment
Report, 2014
Tanzania
1. PEFA Report, September
2013
2. The Banking and Financial
Institutions Act, 2006
3. Tanzania - Urban Local
Government Strengthening
Program, Fiduciary Systems
Assessment Report, 2012
4. The Finance Act, 2000
Uganda
1. The Accountants Act, 2013
2. Internal Audit Commission
Bill, 2016
3. Charter for Internal Audit
Functions, The Republic of
Uganda, November 2008
African Initiative Research Report | globaliia.org
4. The Public Finance
Management Act, 2015
5. Principles of the Internal
Audit Bill
6. Uganda Support to
Municipal Infrastructure
Development Program,
Fiduciary Systems
Assessment, 2012
7. Public Expenditure Financial
Accountability Report, 2012
8. The Financial Institutions
(Corporate Governance)
Regulations, 2005
9. The Capital Markets
Corporate Governance
Guidelines, 2003
Zambia
1. Audit Committee Handbook,
Republic of Zambia, 2009
2. Internal Audit Charter,
Republic of Zambia
3. The Public Finance Bill, 2004
Zimbabwe
1. The National Code on
Corporate Governance for
Zimbabwe, 2011
2. Public Finance Management
Act No. 11/2009
3. Securities (Registration,
Licensing, and Corporate
Governance) Rules, 2010
4. Country Integrated Fiduciary
Assessment, World Bank,
2012
49
APPENDIX I:
Internal Audit National Context Maturity Model

Sub- Level 1 – Level 2 – Level 3 – Level 4 – Level 5 –

Elements
elements Initial Emerging Established Integrated Optimizing
One or more Multiple stand-
1. Presence Multiple stand-
programs One or more alone programs
of university alone programs
No programs incorporating stand-alone present linked to
programs in linked to
internal audit programs professional status
internal auditing professional status
content and internships
Comprehensive
2. Understanding
General view consistent
and recognition by Comprehensive
A. Professionalism, key stakeholders Limited to appreciation with the three lines
Very limited or view consistent
education compliance and/or of broader role of defense model
of the role and inaccurate with the three lines
programs, financial controls across multiple risk and stakeholders
value of internal of defense model
recognition areas act as advocates
auditing
for the profession
3. IIA membership Moderate (50% or Substantial (75% or
Very low (less than Low (25% or more
and GDP per more but less than more but less than High (100%)
25%) but less than 50%)
capita 75%) 100%)
4. IIA certification Moderate (10% or Substantial (15% or
Very low (less than Low (5% or more High (20% or
and GDP per more but less than more but less than
5%) but less than 10%) more)
capita 15%) 20%)
1. Transparency
20% or more but 40% or more but 60% or more but
B. National International 2015 Less than 20% 80% or more
less than 40% less than 60% less than 80%
indicators for CPI score (/100)
fraud and 2. Transparency
corruption International CPI Above 100 76-100 51-75 26-50 25 and below
rank (/168)
1. Role of audit Generally
Limited to a Common in
firms in delivering More common in common in large
small number of organizations of all
internal audit Negligible large organizations organizations for
organizations for sizes for specialist
services (assurance for specialist audits specialist and
specialist audits and general audits
and consulting) general audits
Generally Common in
2. Role of audit Limited to a More common in
common in large organizations of all
firms in delivering small number of large organizations
organizations for sizes for specialist
training and Negligible organizations for for specialist
specialist and and general
guidance for specialist training training and
general training training and
C. Role of internal audit and guidance guidance
and guidance guidance
audit firms and
accounting 3. Role of
Generally Common in
associations accounting Limited to a More common in
common in large organizations of all
associations in small number of large organizations
Negligible organizations for sizes for specialist
delivering training organizations for for specialist
specialist and and general
and guidance for specialist training training
general training training
internal audit
4. Role of
accounting
Limited to a Generally Common in
associations in More common in
Negligible small number of common in large organizations of
delivering training large organizations
organizations organizations all sizes
and guidance for
audit committees

50 globaliia.org | The Institute of Internal Auditors

Internal Audit National Context Maturity Model (continued)

Sub- Level 1 – Level 2 – Level 3 – Level 4 – Level 5 –

Elements
elements Initial Emerging Established Integrated Optimizing
The need for
The need for
funding is
funding is
There is a matched and there
matched and there
There is a significant need The need for is a harmonized
1. Availability of is a coordinated
significant need for funding from funding from effort among
funding for internal effort among
for funding from development development development
audit training development
development agencies and agencies is agencies, or there
commensurate agencies, or
agencies but none some but matched by what is no need for
with need there is no need
is available insufficient is is available funding and the
for funding from
available country is a net
development
provider of funds
agencies
D. Development elsewhere
agencies The need for
The need for
advocacy is
advocacy is
There is a matched and there
matched and there
There is a significant need The need for is a harmonized
2. Delivery of is a coordinated
significant need for advocacy from advocacy from effort among
advocacy for effort among
for advocacy from development development development
internal auditing development
development agencies and agencies is agencies, or there
commensurate agencies, or there
agencies but none some but matched by what is no need for
with need is no need for
is available insufficient is is available advocacy and the
advocacy from
available country supports
development
advocacy efforts
agencies
elsewhere
Bodies are
Bodies are active highly active
in delivering and coordinated
1. Provision of Bodies are active
No advocacy is Limited advocacy advocacy and this in delivering
advocacy for in delivering
provided is provided is reinforced by advocacy and this
E. Role of other internal auditing advocacy
legislation and/or is reinforced by
bodies including regulation legislation and/or
stock exchange regulation
and central bank
2. Setting of Limited Positive Positive Comprehensive
internal audit No requirements requirements are requirements for requirements for requirements for
related policy and are set for internal set for internal internal audit are internal audit are internal audit are
corresponding audit audit but with little set with some set with effective set with effective
enforcement or no enforcement enforcement enforcement enforcement

African Initiative Research Report | globaliia.org 51

Maturity Indicator II: Governance

Sub- Level 1 – Level 2 – Level 3 – Level 4 – Level 5 –

Elements
elements Initial Emerging Established Integrated Optimizing
Requirements for
Requirements for Requirements for
internal audit are
internal audit are Requirements for internal audit are
No requirement highly detailed and
1. Requirement very new and not internal audit are detailed and positive
or negative positive and are
for internal audit yet established detailed and positive and are somewhat
requirements effectively integrated
or are limited or and are established supported by policies
into policies and
contain limitations and procedures
procedures
The head of
Internal audit The head of internal The head of internal The head of internal
2. Status of internal audit is
has no clear or audit is part of middle audit is part of senior audit is regarded as
internal audit part of junior level
separate identity management management an executive
management
The use of standards The use of standards
The use of standards
is defined and is defined and
A. Legislation, is defined but
The use of does include the given emphasis to
regulation, There is no does not include
3. Standards for standards is IIA standards or the IIA standards
corporate reference to the the IIA standards
internal audit recommended but “internationally or “internationally
governance use of standards or “internationally
not defined recognized recognized
code, and recognized standards”
standards” or words standards” or words
national or words to that effect
to that effect to that effect
policies
There are effective There are
There are no There are limited There are effective
and detailed comprehensive
4. Audit requirements for requirements for requirements for
requirements for requirements for
committees having an audit having an audit having an audit
having an audit having an audit
committee committee committee
committee committee
There is limited
There is no There is regular There is regular There is regular
monitoring of
effective monitoring of monitoring of monitoring
requirements
monitoring of requirements for requirements for and effective
5. Monitoring and for internal
any requirements internal auditing and internal auditing and enforcement of
enforcement auditing and audit
for internal audit committees audit committees requirements for
committees but
auditing or audit but limited means of and some form of internal auditing and
little or no means
committees enforcement effective enforcement audit committees
of enforcement
B. Leadership
Those charged Those charged
and tone at 1. Extent to which Those charged with Those charged with
with governance with governance Internal audit is a fully
the top in CEOs and boards governance provide governance provide
provide no provide limited integrated part of
organizations support internal general support for responsive support
effective support support for internal governance
from CEOs and audit internal audit for internal audit
for internal audit audit
boards
Where there is Internal audit reports Internal audit
Internal audit reports
internal audit, it functionally to an reports functionally
functionally to an audit
does not report audit committee to the chair of a
Internal audit committee comprising
functionally to an comprising fully independent
C. Positioning 1. Reporting reports functionally predominantly
audit committee predominantly non- audit committee
of internal lines and to a management executive directors
or equivalent executive directors and administratively
audit in independence position within the and administratively
and reports to and administratively to the most
organizations organization to a middle or senior
a low level in to a senior ranking senior executive
and its ranking official within
the organization official within the officer within the
effective the organization
administratively organization organization
independence
2. Positioning Where internal Internal audit is Internal audit is part of
Internal audit is Internal audit is fully a
of internal audit exists, it is largely a second a combined second
largely a third line of third line of defense
audit within the part of the first line of defense and third line of
defense function function
organization line of defense function defense

52 globaliia.org | The Institute of Internal Auditors

Maturity Indicator II: Governance (continued)

Sub- Level 1 – Level 2 – Level 3 – Level 4 – Level 5 –

Elements
elements Initial Emerging Established Integrated Optimizing
The audit committee The audit committee
comprises comprises solely
predominantly non- non-executive
The audit The audit committee executive directors directors and
committee includes non- and individuals individuals of high
1. Independence comprises executive directors of high caliber caliber in accounting
There is no audit
and strength of solely executive and accounting including some and other disciplines
committee or
audit committee directors with little experience rotating with accounting relevant to the
equivalent
membership transparency in on a regular basis experience serving organization
the nomination through a transparent no more than two serving no more
process nominations process terms of three than two terms of
years through three years through
a transparent a transparent
nominations process nominations process
Members
Members of the
Members of the audit
Members of the Members of the audit committee
of the audit committee have
audit committee audit committee have a good
2. Understanding committee have a comprehensive
have a limited have a general understanding of
of internal audit no appreciable understanding of
understanding of understanding of internal audit and
understanding of internal audit and
internal audit internal audit receive occasional
D. Audit internal audit receive regular
updates
committees updates
The audit committee
The audit committee
has an advisory role
The audit leads on the hiring
in the hiring and firing The audit committee
3. Powers of the committee has and firing of the
The audit of the CAE, does not is fully empowered
audit committee only limited CAE, undertakes
committee, if routinely undertake an to hire and fire the
the ability to involvement in an occasional
there is one, annual performance CAE, undertake an
include hire and the appointment performance
has no effective appraisal, commends annual performance
fire CAE, approve of the CAE and appraisal, approves
powers and the audit plan to appraisal, approve
audit plan and in the approval of the audit plan,
authority management, the audit plan, and
resources the audit plan and and makes
and makes assign resources
resources recommendations on
recommendations on
resources
resources
The audit
The audit
committee
4. Effectiveness committee The audit committee The audit committee The audit committee
has limited
in holding the is unable to is somewhat effective is effective in holding is highly effective in
effectiveness
CAE and the hold either the in holding the CAE the CAE and the holding the CAE and
in holding the
organization to CAE or the and the organization organization to the organization to
CAE and the
account organization to to account account account
organization to
account
account
There is no There is a
1. Organizational formal or somewhat limited There is a consistent Enterprisewide risk Enterprisewide risk
E. Risk
risk management consistent and inconsistent approach to management in management is fully
management
maturity approach to approach to managing risk place embedded
managing risk managing risks

African Initiative Research Report | globaliia.org 53

Maturity Indicator III: Quality

Sub- Level 1 – Level 2 – Level 3 – Level 4 – Level 5 –

Elements
elements Initial Emerging Established Integrated Optimizing
There is a There is a charter There is a charter
1. Presence
There is no charter rudimentary There is a charter consistent with consistent with the IPPF
A. Audit and strength of
and no defined charter and a consistent with the the IPPF that is that is reviewed annually
strategy and charter, sense
internal audit rudimentary IPPF and a clear reviewed annually and a clear strategy that
charter of purpose, and
strategy internal audit strategy and a clear informs professional
focus
strategy strategy practice
Audit planning is Audit planning is
Audit planning
1. Extent to which Audit planning fully risk based, fully risk based, Audit planning is fully
B. Audit is partially risk
audit planning is not risk based fully aligned with fully aligned with risk based, fully aligned
planning, based and is
is risk based and and is not aligned organizational organizational with organizational
including risk partially aligned
aligned with with organizational strategy and is strategy and is strategy and is updated
assessment with organizational
strategy strategy updated at least updated at least continuously
strategy
annually twice a year
Risk assessments Risk assessments
Risk assessments
are completed are completed
1. Frequency of are completed at Risk assessments are
There are no infrequently at least twice
risk assessment least annually and completed continuously
formal risk and are partially a year and are
and alignment are fully aligned and are fully aligned with
assessments aligned with fully aligned with
C. Use of with strategy with organizational organizational strategy
organizational organizational
standards strategy
strategy strategy
Implements
2. Use of robust Implements standards
Does not apply Partially apply Fully applies standards that are
internal audit that are fully consistent
formal standards formal standards formal standards fully consistent
standards with IPPF
with IPPF
Internal audit work Internal audit
Internal audit covers a
Internal audit covers a broad covers a very
comprehensive scope of
Internal audit has a narrow scope of risks but broad scope of
1. Scope of audit risks including emerging
work is primarily a scope focused on is not dynamic risks including
work risks with flexibility
control function financial controls and limited emerging risks
and scope for ad hoc
and compliance scope for ad hoc with scope for ad
assignments
assignments hoc assignments
Audit reports are Audit reports are timely,
2. Quality of the
Audit reports Audit reports timely, effectively effectively communicate
D. Scope, audit reports – Audit reports are
are generally of are timely and communicate findings, help
reporting, and effectiveness in largely perfunctory
poor quality and effectively findings, and help management address
follow up identifying and and are not timely
limited use to communicate management control weaknesses and
communication and effective
management findings address control exploit opportunities, and
issues
weaknesses encourage innovation
Follow up on reported
Follow up on Follow up on
Follow up on issues is systematic and
3. Effectiveness in There is no follow reported issues reported issues
reported issues complete resulting in
following up on up on reported is systematic is systematic
is sporadic and timely, cost effective, and
issues issues resulting in timely resulting in
incomplete innovative resolution of
resolution of issues resolution of issues
issues
Arrangements Arrangements for
1. Internal
for quality quality assurance are
(monitoring, Arrangements for Arrangements for
assurance are comprehensive, generally
E. Quality supervision, There are quality assurance quality assurance
comprehensive, conform with Standard
assurance and appraisal, no formal are incomplete are comprehensive
generally conform 1300, embrace innovative
improvement training, review of arrangements for and partially and generally
with Standard solutions, and the function
planning audit papers, self- quality assurance conform with conform with
1300, and embrace assists in peer reviews
assessment) and Standard 1300 Standard 1300
innovative of other internal audit
external (QAR)
solutions functions

54 globaliia.org | The Institute of Internal Auditors

Maturity Indicator IV: Resources

Sub- Level 1 – Level 2 – Level 3 – Level 4 – Level 5 –

Elements
elements Initial Emerging Established Integrated Optimizing
The budget for The budget for internal
The budget for
internal audit The budget for audit staff (in-house and
internal audit staff The budget for
staff (in-house internal audit staff from other sources) is
(in-house and from internal audit staff
A. Adequacy and from other (in-house and from adequate to deliver the
other sources) is (in-house and from
of staffing 1. Adequacy sources) is very other sources) is audit plan, has built-in
inadequate to other sources) is
resources, of staffing limited and adequate to deliver flexibility, and allows for
deliver the audit adequate to deliver
including resources inadequate to the audit plan and the temporary secondment
plan although the the audit plan
structure deliver the audit has built-in flexibility of internal audit staff to
available resource and staff are well
plan and staff and staff are very other functions, and the
is reasonably well organized
are not well well organized organization of staff is
organized
organized optimized
Internal audit
Internal audit staff have a very
Internal audit Internal audit staff have
staff have Internal audit good practical
staff have a good excellent practical and
very limited staff have limited and theoretical
1. Competency practical knowledge theoretical knowledge of
understanding understanding knowledge of
and experience of internal internal auditing based on
and experience and experience of internal auditing
auditing based on extensive experience and
of internal internal auditing based on solid
experience formal study
auditing experience and
formal study
The majority of
The majority of
2. Internal Internal audit internal audit staff All members of the internal
Some internal audit internal audit staff
audit specific staff do not hold hold an internal audit function hold CIA or
staff hold internal are active CIAs and
certifications internal audit audit certification other IIA certification or are
B. Skills audit certifications some hold other IIA
held certifications including some who actively working towards it
certifications
are active CIAs
A majority of
A majority of A majority of internal internal audit staff The significant majority of
3. Highest A majority of internal
internal audit audit staff hold an hold a first degree internal audit staff hold a
educational audit staff hold a first
staff hold a high associate degree or and some hold a first degree and some hold
level degree or equivalent
school diploma equivalent master’s degree or a master's degree or above
above
The CAE had The CAE had The CAE had
no internal audit minimal internal some internal audit The CAE is an The CAE is an experienced
4. CAE skills experience prior audit experience experience prior experienced internal auditor and is CIA
to assuming the prior to assuming to assuming the internal auditor or QIAL certified
position the position position
Internal audit Internal audit staff have
Internal audit staff have good good access to training
Internal audit staff Internal audit staff
staff have very access to training (a minimum of 40 hours
1. Access to have limited access have good access to
C. CPE and limited access (a minimum of 40 CPE per year), there is an
and frequency to training (between training (a minimum
training to training (less hours CPE per year) in-house training program,
of training 10 and 40 hours CPE of 40 hours CPE per
than 10 hours and there is an and there is a peer
per year) year)
CPE per year) in-house training coaching and mentoring
program system
The internal audit function
The use of CAATTs
Internal audit exemplifies leading
is commonplace
D. 1. Use of There is no use There is limited use planning and practice in the use of
and integrated
Technology CAATTs of CAATTs of CAATTs administration is CAATTs and shares its
into operational
fully automated expertise with other
processes
internal audit functions

African Initiative Research Report | globaliia.org 55

APPENDIX II: DETAILED COUNTRY FINDINGS
1. BOTSWANA
Maturity Indicator I: National Context

Elements Sub-elements Analysis

1. Presence of university programs in Universities/colleges have one or more programs incorporating internal
internal auditing audit content.
2. Understanding and recognition by Very limited understanding of role and value of internal audit. No demand
A. Professionalism, key stakeholders of the role and value for internal audit knowledge has led to universities/colleges to be hesitant
education programs, of internal auditing in introducing IA programs.
recognition
3. IIA membership and GDP per capita Very Low: IIA membership to GDP per capita is 5.8%.

4. IIA certification and GDP per capita Very low: IIA certification to GDP per capita is 0.5%.

1. Transparency International 2015 CPI

The 2015 CPI ranking is 28/168.
rank (/168)
B. National indicators 2. Transparency International 2015 CPI
The 2015 CPI score is 63%.
for fraud and score (/100)
corruption 1. Role of audit firms in delivering Limited to a small number of organizations. PwC has just started
internal audit services (assurance and operations in Botswana. It provides co-sourcing and outsourcing internal
consulting) audit services.
2. Role of audit firms in delivering Negligible: PwC has not yet started delivering training and guidance on
training and guidance for internal audit internal audit.
3. Role of accounting associations in
C. Role of audit Negligible. Accounting associations are not involved in delivering training
delivering training and guidance for
firms and accounting and guidance for internal audit.
internal audit
associations
4. Role of accounting associations in
delivering training and guidance for Negligible.
audit committees
There is significant need for funding but very little is available through the
1. Availability of funding for internal
commonwealth secretariat. World Bank is currently building capacity for
D. Development audit training commensurate with need
external audit.
agencies
2. Delivery of advocacy for internal There is a significant need for advocacy but focus by development
auditing commensurate with need agencies in this area is insufficient.
E. Role of other 1. Provision of advocacy for internal Limited advocacy mainly through bank requirements. Most firms follow
bodies including stock auditing corporate governance best practices.
exchanges and central 2. Setting of internal audit related Limited requirements are set for internal audit mainly through central bank
banks policy and corresponding enforcement requirements for financial institutions.

56 globaliia.org | The Institute of Internal Auditors

Maturity Indicator II: Governance
Elements Sub-elements
1. Requirement for internal
audit
A. Legislation, 2. Status of internal audit
regulation,
corporate
3. Standards for internal
governance code,
audit
and national
policies
4. Audit committees
5. Monitoring and
enforcement
B. Leadership and
1. Extent to which CEOs
tone at the top in
and boards support internal
organizations from
audit
CEOs and boards
C. Positioning 1. Reporting lines and
of internal audit independence
in organizations
and its effective
independence
2. Positioning of internal
audit within the organization defense.
1. Independence and
strength of audit committee
membership
2. Understanding of internal
audit
D. Audit
committees
3. Powers of the audit
committee include hire and
fire CAE, approve audit plan
and resources
4. Effectiveness in
holding the CAE and the
organization to account
E. Risk 1. Organizational risk
management management maturity
Public Sector Analysis
Requirements for internal audit are provided
for in the Public Finance Management Act
[PFMA] for central government. There is no
legislation governing internal audit for other
government institutions.
Head of internal audit is part of middle
level management as they report to the
Permanent Secretary, Finance.
The use of standards is defined and does
include the IIA standards.
There are effective requirements for having
an audit committee as per PFMA Act and
following recommended best practice.
There is no monitoring of compliance with
laws and regulations on internal audit or
audit committees as most public entities
voluntarily follow best practice.
Those charged with governance provide
limited support for internal audit. Minister
of finance participates in internal audit
awareness activities.
In central government, head of internal
audit reports functionally to the Government
Audit Committee and administratively
to the Permanent Secretary, Finance. For
Parastatals, CAEs report administratively
to the CEOs and functionally to audit
committees.
Internal audit is largely a second line of
Audit committees comprise non executives
– a mix of accountants and non accountants.
Chairpersons of audit committees are
government/ministerial appointees.
Members of the audit committee have a
limited understanding of internal audit due
to selection criteria.
Audit committees have no effective powers
and authority on appointment of CAE and
resources for the internal audit function.
Hiring and renewal of contracts is at the
discretion of the Permanent Secretary,
Finance. Also internal audit resources are
approved by management.
The audit committee is unable to hold either
the CAE or the organization to account.
Members are political appointees.
There is no risk management framework in
government.
African Initiative Research Report | globaliia.org
Private Sector Analysis
Organizations establish internal audit
functions as part of following best practice
in corporate governance. For financial
institutions, the Bank of Botswana requires
them to have internal audit functions.
Head of internal audit is part of senior
management as they report to the AC and
to the CEO.
IIA standards are partially applied.
Organizations follow best practice corporate
governance codes, mostly the King Report
on corporate governance.
For financial institutions, there is limited
monitoring by Bank of Botswana, but other
organizations voluntarily follow best practice.
CEOs and audit committees provide general
support for internal audit.
Head of internal audit reports functionally to
the audit committee and administratively to
the chief executive officer.
Internal audit is part of a combined second
and third line of defense as evidenced by
nature of work which is mostly compliance.
Audit committees comprise non executives –
mainly accountants.
Members of audit committee have a limited
understanding of internal audit. Priority of
knowledge requirement is accounting.
The audit committee has advisory role in the
appointment of the head of internal audit,
can approve the audit plan, and can request
budgetary resources.
Audit committee is somewhat effective in
holding head of internal audit to account.
Most organizations have a consistent
approach to managing risk.
57
Maturity Indicator III: Quality

Elements Sub-elements Public Sector Analysis Private Sector Analysis

1. Presence and strength of Internal audit functions have strategies
A. Audit strategy Internal audit functions have basic charters
charter, sense of purpose, and which are aligned to organization’s
and charter and strategies.
focus strategy/priorities.
1. Extent to which audit Some internal audit functions have adopted
planning is risk-based and Audit planning is increasingly risk-based. risk-based audit planning with flexibility to
B. Audit planning, aligned with strategy adjust for emerging risks.
including risk
assessment 2. Frequency of risk
Annual work plans are prepared within a Annual work plans are updated regularly for
assessment and alignment
framework of risk-based assessments. emerging risks.
with strategy
C. Use of 1. Use of robust internal audit
IIA standards are partially applied. IIA standards are partially applied.
standards standards
Internal audit work has a broad scope but
Internal audit work covers a narrow scope,
1. Scope of audit work is not dynamic. Focus include compliance,
mainly financial and compliance.
financial, operational, performance.
2. Quality of the audit reports
D. Scope, Audit reports are timely and effectively Audit reports are timely and effectively
– effectiveness in identifying
reporting, and communicate findings. communicate findings.
and communication issues
follow up
Follow-up process is in place and working
3. Effectiveness in following up well. Audit committees play an important Audit issues are systematically followed up
on issues role in ensuring that internal audit reports regularly.
are given due consideration.
E. Quality Arrangements for quality assurance are
1. Internal – monitoring,
assurance and There are no formal arrangements for limited. Internal audit functions have quality
supervision, appraisal, training,
improvement quality assurance. reviews of their audit work. External reviews
review of audit
planning of internal audit functions are not in place.

Maturity Indicator IV: Resources

Elements Sub-elements Public Sector Analysis Private Sector Analysis

A. Adequacy of
1. Adequacy of staffing Staffing resources for internal audit are Audit committees request budgetary
staffing resources,
resources inadequate. resources adequate to deliver on work plan.
including structure
Internal auditors have limited Most internal audit staff have limited
1. Competency and
understanding and experience of modern understanding and experience of modern
experience
internal auditing. internal auditing.
Majority of internal audit staff hold Majority of internal audit staff hold
B. Skills 2. Internal audit specific
accounting qualifications with a few holding accounting qualification with a few holding
certifications held
internal audit qualifications. internal audit qualifications.
Majority of internal audit staff hold a first Majority of internal audit staff hold a first
3. Highest educational level
university degree. university degree.
Majority of internal audit staff have very Majority of internal audit staff have very
C. CPE and 1. Access to and frequency of limited access to internal audit training as limited access to IA training as the majority
training training majority is dependent on development is dependent on development agencies’
agencies funding. funding.
There is limited use of CAATTs. Majority
Limited use of CAATTs. Majority of internal
D. Technology 1. Use of CAATTs of the internal audit functions do not use
audit functions do not use CAATTs.
CAATTs.

58 globaliia.org | The Institute of Internal Auditors

2. ETHIOPIA
Maturity Indicator I: National Context

Elements Sub-elements Analysis

1. Presence of university programs in
No internal audit programs in universities/colleges.
internal auditing
Very limited understanding of role and value of internal audit. With new
2. Understanding and recognition by directives in the banking and insurance industry, especially the concept and
A. Professionalism, key stakeholders of the role and value application of corporate governance codes will result in surge of demand
education programs, of internal auditing for internal audit. Also, there is need to sensitize business executives on the
recognition value of internal audit.

3. IIA membership and GDP per capita Low: IIA membership to GDP per capita is 30.7%.

4. IIA certification and GDP per capita Low: IIA certification to GDP per capita is 5.7%.

1. Transparency International 2015 CPI

B. National indicators The 2015 CPI ranking is 103/168.
rank (/168)
for fraud and
corruption 2. Transparency International 2015 CPI
The 2015 CPI score is 33%.
score (/100)
1. Role of audit firms in delivering
internal audit services (assurance and Negligible: Public accounting firms focus on external audits.
consulting)
2. Role of audit firms in delivering
Negligible: Public accounting firms focus on external audits.
C. Role of audit training and guidance for internal audit
firms and accounting 3. Role of accounting associations in
associations Negligible. Accounting associations are not involved in delivering training
delivering training and guidance for
and guidance for internal audit.
internal audit
4. Role of accounting associations in
Negligible. Focus of audit committee training is on financial reporting/
delivering training and guidance for
accounting.
audit committees
1. Availability of funding for internal There is significant need for funding for internal audit training but very little
D. Development audit training commensurate with need is available through World Bank and DFID programs.
agencies 2. Delivery of advocacy for internal There is a significant need for advocacy but focus by World Bank and DFID
auditing commensurate with need in this area is insufficient.
E. Role of other 1. Provision of advocacy for internal Limited advocacy mainly through National Bank of Ethiopia requirements
bodies including stock auditing plus the corporate governance code directives.
exchanges and central 2. Setting of internal audit related Limited requirements are set for internal audit mainly through National
banks policy and corresponding enforcement Bank of Ethiopia requirements for financial institutions.

African Initiative Research Report | globaliia.org 59

Maturity Indicator II: Governance

Elements Sub-elements Public Sector Analysis Private Sector Analysis

No legislation covers full private sector. In the
banking and insurance industry, a sector highly
regulated by the National Bank of Ethiopia,
there is a requirement to establish an internal
Requirements for internal audit are provided
audit unit and an audit committee that oversees
1. Requirement for for in the Regulation No. 190/2010 Financial
the activities of the internal audit units. In
internal audit Administration Council of Ministers Regulation
addition, the National Bank of Ethiopia recently
for public organizations.
issued corporate governance directives that
specify the requirements, composition, and
modus operandi of the different actors of the
A. Legislation, corporate governance.
regulation,
corporate Due to lack of legislation for private sector
governance entities, organized internal audit is only found
Head of internal audit is part of middle
code, and 2. Status of internal in the banking and insurance industry. Head of
level management as they report to head of
national policies audit internal audit is part of senior management as
organization.
they report to the audit committee and to the
chief executive officer.
3. Standards for The use of standards is defined and does include
IIA standards are partially applied.
internal audit the IIA standards.
There are limited requirements for having audit Only banking and insurance industry have
4. Audit committees
committees. directives to have audit committees.
Partial monitoring of compliance with laws and There is no effective monitoring of compliance
5. Monitoring and
regulations on internal audit or audit committees with laws and regulations on internal audit or
enforcement
through the inspections department. audit committees.
B. Leadership
Those charged with governance provide limited
and tone at
1. Extent to which support for internal audit. The Minister of
the top in CEOs and audit committees provide support to
CEOs and boards Finance has developed internal audit procedure
organizations internal audit through resources and oversight.
support internal audit manual and internal audit training module based
from CEOs and
on the procedure manual.
boards
Internal audit reports functionally to a
management position within the organization
– internal audit function in government
agencies at a federal and regional level are
at a directorate level within each government
agency and report directly (administratively) to In the banking and insurance Industry, head of
1. Reporting lines the head of the organization. At district level internal audit reports functionally to the audit
C. Positioning and independence the internal audit units are established within the committee and administratively to the chief
of internal audit District Bureau of Finance, reporting directly to executive officer.
in organizations the Head of the Finance Bureau. In state owned
and its effective enterprises and parastatals, the internal audit
independence units have functional reporting lines to the audit
committee and administrative reporting lines to
the head of the organization.
Internal audit is largely a second line of defense. Internal audit is largely a second line of defense.
2. Positioning of
Internal audit independent from finance Adopted best practice corporate governance
internal audit within
department and report directly to the head of directives, which increase independence of
the organization
the organization/board/audit committee. internal audit.

60 globaliia.org | The Institute of Internal Auditors

Maturity Indicator II: Governance (continued)

Elements Sub-elements Public Sector Analysis Private Sector Analysis

Audit committees comprise solely of executive
directors – senior government employees
(above director level). Audit committees in
Audit committees include non executives whose
1. Independence public enterprise/parastatals have three to five
skills are a mixture of core competencies such as
and strength of committee members who are directly appointed
finance, insurance, accounting, legal, business
audit committee by the ministry responsible for the oversight of
administration, auditing, information technology,
membership these organizations for a three-year term. At
and investment management.
least one of the committee members, normally
the chair, needs to have accounting education/
qualification.
Members of the audit committee have a limited
D. Audit 2. Understanding of Members of audit committee have a limited
understanding of internal audit due to selection
committees internal audit understanding of internal audit.
criteria.
Audit committees have no effective powers
3. Powers of the audit For financial Institutions, the audit committee
and authority on appointment of CAE and
committee to include has an advisory role in the appointment of
resources for the internal audit function. Instead,
hire and fire CAE, the head of internal audit, reviews the internal
the Ministry of Finance is responsible for
approve audit plan audit plan, and ensures adequate resources are
appointment and firing of internal audit staff,
and resources secured.
with clearance from the Auditor General Office.
4. Effectiveness in
The audit committee is unable to hold either the Audit committee is somewhat effective in
holding the CAE and
CAE or the organization to account. Members holding head of internal audit to account as it
the organization to
are part of the management of the organization. provides an oversight role.
account
There is a limited approach to managing
1. Organizational risk. Financial industries have just started
E. Risk
risk management There is no formal approach to managing risk. implementing a directive on corporate
management
maturity governance codes that is line with international
best practice.

African Initiative Research Report | globaliia.org 61

Maturity Indicator III: Quality

Elements Sub-elements Public Sector Analysis Private Sector Analysis

There is no charter and no defined internal
1. Presence and audit strategy. Public organizations usually There are no charters or defined audit
A. Audit strategy and strength of charter, adopt and use the internal audit procedure strategy. Some organizations have internal
charter sense of purpose, and manual developed by the Ministry of audit manuals which are based on best
focus Finance, which is entirely based on IIA practice.
standards.
1. Extent to which audit
Audit planning is partially risk-based. New
planning is risk-based Audit planning is not risk-based. Basic
corporate governance code directives
B. Audit planning, and aligned with training on risk-based auditing is ongoing.
require risk management focus.
including risk strategy
assessment 2. Frequency of risk Regular risk assessments are carried out, at
There are no formal risk assessments.
assessment and least annually to produce the annual work
However, annual work plans are prepared.
alignment with strategy plan.
1. Use of robust internal
C. Use of standards IIA standards are partially applied. IIA standards are partially applied.
audit standards
Internal audit has a narrow scope focused
on financial controls and compliance.
Internal audit activities are focused on Internal audit work covers a narrow
1. Scope of audit work budget utilization, routinely reviews internal scope, mainly financial, operational and
controls to improve compliance and is management audits.
directly concerned with the detection and
prevention of fraud.
Audit reports are timely and effectively
communicate findings. The heads of the
2. Quality of the audit internal audit units are required to issue Audit reports are timely and effectively
D. Scope, reporting,
reports – effectiveness their audit report to the Ministry of Finance communicate findings. The corporate
and follow up
in identifying and (at Federal level) and Bureau of Finance governance code adopted meets
communication issues (regional level) for follow-up and monitoring. international best practice.
At district level, internal audit reports to the
district cabinet for follow-up and monitoring.
Follow-up process is in place and working Audit issues are systematically followed up
moderately well. Specific actions resulting regularly. As per corporate governance code
3. Effectiveness in from the audit findings are carried out directives, audit committees are to regularly
following up on issues because implementation of these actions is review the audit findings and ensuring that
subject to scrutiny by a public monitoring issues are being managed and rectified
team from the Ministry of Finance. appropriately and in a timely manner.
Formal arrangements for quality assurance
are limited/incomplete. The inspection Arrangements for quality assurance are
E. Quality assurance 1. Internal - monitoring,
department supervises internal audit limited. The competency of the head of
and improvement supervision, appraisal,
activities and is also responsible to build internal audit unit and effectiveness of the
planning training, review of audit
capacity of the internal audit units and to audit committee drives an effective QAIP.
enhance internal audit quality.

62 globaliia.org | The Institute of Internal Auditors

Maturity Indicator IV: Resources

Elements Sub-elements Public Sector Analysis Private Sector Analysis

Staffing resources for internal audit are
A. Adequacy of inadequate. There is a shortage of staff Staffing resources for internal audit are
1. Adequacy of staffing
staffing resources, with the right qualifications or skills. Internal inadequate. There is a shortage of staff with
resources
including structure auditors have low capacity to deliver quality the right qualifications or skills.
work.
Internal auditors have limited understanding Internal auditors have limited understanding
1. Competency and and experience of modern internal auditing. and experience of modern internal auditing.
experience There is a shortage of staff with appropriate There is a shortage of staff with appropriate
qualifications and skills. qualifications and skills.
B. Skills
2. Internal audit specific Few internal audit staff hold internal audit Few internal audit staff hold internal audit
certifications held qualifications. qualifications.
3. Highest educational Majority of internal audit staff hold a first Majority of internal audit staff hold a first
level university degree. university degree.
1. Access to and Majority of internal audit staff have limited Majority of internal audit staff have limited
C. CPE and training
frequency of training access to internal audit training. access to internal audit training.
Majority of internal audit functions do
Majority of the internal audit functions do
D. Technology 2. Use of CAATTs not use CAATTs. Primarily rely on manual
not use CAATTs.
systems and processes.

African Initiative Research Report | globaliia.org 63

3. GHANA
Maturity Indicator I: National Context

Elements Sub-elements Analysis

One stand-alone program is offered by one university – The University of
1. Presence of university programs in
Professional Studies, Accra, offers an MBA degree in internal auditing.
internal auditing
Other universities offer programs that include internal audit content.
2. Understanding and recognition by Very limited understanding and recognition of role and value of internal
A. Professionalism,
key stakeholders of the role and value audit. Good recognition will lead to adequate resourcing of the internal
education programs,
of internal auditing audit function, which currently faces funding constraints.
recognition
3. IIA membership and GDP per capita Low: IIA membership to GDP per capita is 29.7%

4. IIA certification and GDP per capita Very low: IIA certification to GDP per capita is 1.1%

B. National indicators
1. Transparency International 2015 CPI
for fraud and The 2015 CPI ranking is 56/168
rank (/168)
corruption
2. Transparency International 2015 CPI
The 2015 CPI score is 47%
score (/100)
1. Role of audit firms in delivering
Audit firms are providing internal audit services to a large number of
internal audit services (assurance and
companies.
consulting)
C. Role of audit firms 2. Role of audit firms in delivering Audit firms deliver training and guidance in internal audit to a large number
and accounting training and guidance for internal audit of companies.
associations 3. Role of accounting associations in
Limited involvement in delivering training and guidance for internal audit
delivering training and guidance for
especially for its members.
internal audit
4. Role of accounting associations in
Train members who are audit committee members; also participate in
delivering training and guidance for
trainings arranged for audit committees by other professional bodies.
audit committees
There is significant need for funding for internal audit capacity building but
1. Availability of funding for internal
only some is available from World Bank, GIZ, African Development Bank,
audit training commensurate with need
D. Development CIDA, DANIDA, and Commonwealth.
agencies There is a significant need for advocacy but focus by development
2. Delivery of advocacy for internal
agencies in this area is insufficient. Harmonized/coordinated effort is
auditing commensurate with need
required.
Limited advocacy mainly through Bank of Ghana, National Insurance
1. Provision of advocacy for internal
E. Role of other Commission, and the Ghana Stock exchange requirements. Most firms
auditing
bodies including stock follow corporate governance best practices.
exchange and central Limited requirements are set for internal audit mainly through Bank of
bank 2. Setting of internal audit related
Ghana, National Insurance Commission, and the Ghana Stock exchange
policy and corresponding enforcement
requirements for financial institutions.

64 globaliia.org | The Institute of Internal Auditors

Maturity Indicator II: Governance

Elements Sub-elements Public Sector Analysis Private Sector Analysis

There is no legislation that regulates internal
audit practice in the private sector in Ghana.
Requirements for internal audit are provided for in
Organizations establish internal audit functions
the Internal Audit Agency Act (Act 658), 2003. This
1. Requirement for as part of following best practice in corporate
law only governs the public sector and directs the
internal audit governance. Organizations regulated by Bank
operations, powers, and reporting responsibilities
of Ghana, National Insurance Commission, and
of internal audits of government institutions.
the Ghana Stock Exchange are required to have
internal audit functions.
Head of internal audit is part of middle level Head of internal audit is part of senior
A. Legislation, 2. Status of internal
management as they report to the head of the management as they report to the audit committee
regulation, audit
entity. and to the CEO.
corporate
3. Standards for The use of standards is defined but does not
governance IIA standards are partially applied.
internal audit specify which standards.
code, and
national There are effective requirements for having
Organizations follow best practice corporate
policies audit committee. The internal audit regulations
governance codes. The SEC requires issuers
allow heads of institutions and other line
to have an audit committee, but provides no
directors to serve as members of the audit
4. Audit committees details on its composition or functions. There
report implementation committees in the public
is no requirement for audit committees to have
sector. This could be a source of threat to the
independent members, and companies are not
independence and objectivity of the internal
encouraged to have an internal audit function.
auditors.
There is limited monitoring of compliance with For the National Insurance Commission and the
5. Monitoring and
laws and regulations on internal audit or audit Bank of Ghana, there is regular monitoring though
enforcement
committees through the internal audit agency. enforcement is limited.
Those charged with governance provide general
B. Leadership
support for internal audit. The governing body
and tone at 1. Extent to which
of the Internal Audit Agency is the board, which
the top in CEOs and boards CEOs and audit committees provide oversight to
comprises a membership of seven with the Minister
organizations support internal the internal audit function and work.
for Finance and the Minister for Local Government
from CEOs and audit
and Rural Development or their representatives as
boards
members.
Head of internal audit reports functionally to the
Head of internal audit report functionally to the
audit committee and administratively to the CEO
1. Reporting lines board through the Audit Report Implementation
C. Positioning of the company. In some instances, the reporting
and independence Committee and administratively to the head of the
of internal lines are to the CEO both administratively and
entity.
audit in functionally.
organizations Internal audit is largely part of the first line of
and its defense. The largest part of internal audit’s time is
effective 2. Positioning of
spent on pre-auditing transactions, which is ex-ante Internal audit is part of a combined second and
independence internal audit within
check of compliance to the rules and procedures; third line of defense.
the organization
limited time is allocated to post audits and
systemic issues.
Audit committees comprise mainly executives.
1. Independence The composition of audit committees is usually a
It includes two external representatives with a
and strength of mix of executive and non-executive directors. The
minimum of eight years’ experience in accounting
audit committee chairman of the audit committee is usually a non
D. Audit or auditing one each nominated by the Internal
membership executive director.
committees Audit Agency and IIA–Ghana.
Members of the audit committee have limited Members of audit committee have a limited
2. Understanding of
understanding of internal audit due to selection understanding of internal audit. Priority of
internal audit
criteria. knowledge requirement is accounting.

African Initiative Research Report | globaliia.org 65

Maturity Indicator II: Governance (continued)

Elements Sub-elements Public Sector Analysis Private Sector Analysis

Audit committees have no involvement in
appointment of heads of internal audit and in the
3. Powers of the
approval of audit plan and resources. By legislation, The audit committee has an advisory role in the
audit committee to
Audit Report Implementation Committees (ARICs) appointment of the head of internal audit, can
include hire and fire
should review and advise on the strategic and approve the audit plan, and can request budgetary
CAE, approve audit
annual internal audit plans; and monitor the resources.
D. Audit plan and resources
performance of internal audit units against its
committees annual internal audit plans and strategic plans.
4. Effectiveness
in holding the The audit committee has limited effectiveness Audit committee is somewhat effective in holding
CAE and the in holding heads of internal audit and the entity head of internal audit to account through the
organization to accountable. monitoring on delivery of work plan.
account
1. Organizational
E. Risk There is no comprehensive risk management Most organizations have a consistent approach to
risk management
management framework in most public entities/government. managing risk.
maturity

Maturity Indicator III: Quality

Elements Sub-elements Public Sector Analysis Private Sector Analysis

1. Presence and strength
A. Audit strategy
of charter, sense of
and charter
purpose, and focus
1. Extent to which audit
planning is risk based and Audit planning is partially risk-based.
B. Audit planning, aligned with strategy
including risk
assessment 2. Frequency of risk
Most internal audit functions prepare work
assessment and alignment
plans which are updated annually.
with strategy
C. Use of 1. Use of robust internal
standards audit standards
1. Scope of audit work
2. Quality of the audit
reports – effectiveness
D. Scope, in identifying and
reporting, and communication issues
follow up
3. Effectiveness in
following up on issues
E. Quality
1. Internal - monitoring,
assurance and
supervision, appraisal,
improvement
training, review of audit
planning
Few internal audit functions have basic Most internal audit functions have charters
charters but no strategies. that are consistent with IIA standards.
Some internal audit functions have adopted
risk-based audit planning with flexibility to
adjust for emerging risks.
Internal audit functions prepare annual work
plans, but these are not usually updated
based on emerging risks.
Partially apply IIA standards. IIA standards are partially applied.
Internal audit work has a narrow scope, mostly Internal audit work covers a narrow scope,
financial and compliance. mainly financial and compliance.
Quarterly and annual reports are produced
Audit reports are timely and effectively
and they reasonably communicate audit
communicate findings.
findings.
Follow-up process is institutionalized but
not functioning well as many ARICs are
Audit issues are systematically followed up
not yet functioning. ARICs are to monitor
regularly.
the implementation of agreed audit
recommendations.
There are limited arrangements for quality
Arrangements for quality assurance are
assurance. The Central Internal Audit Agency
limited. The quality assurance programs
was established to coordinate, facilitate,
do not align with the requirements of IIA
and provide quality assurance for all internal
standards.
activities within the public sector.

66 globaliia.org | The Institute of Internal Auditors

Maturity Indicator IV: Resources

Elements Sub-elements Public Sector Analysis Private Sector Analysis

A. Adequacy of staffing
1. Adequacy of staffing Funding constraints/inadequate funding for There is shortage of skilled/qualified internal
resources, including
resources staffing resources. auditors.
structure
Most internal audit staff have limited
Internal auditors have limited understanding
1. Competency and understanding and experience of modern
and experience of modern internal auditing.
experience internal auditing. Most have external audit
Most have external audit backgrounds.
backgrounds.
B. Skills Majority of internal audit staff hold Majority of internal audit staff hold
2. Internal audit specific
accounting and finance qualifications with accounting qualification with very few
certifications held
very few holding internal audit qualifications. holding internal audit qualifications.
3. Highest educational Majority of internal audit staff hold a first Majority of internal audit staff hold a first
level university degree. university degree.
Due to resource constraints, access and
frequency of training in internal audit is
limited. However, availability of training in
Majority of internal audit staff have limited
1. Access to and internal auditing is not a problem as it is
C. CPE and training access to internal audit training as priority is
frequency of training provided by various training institutions
given to accounting qualifications.
including IIA–Ghana, Institute of Chartered
Accountants (Ghana), accounting firms, and
others
Limited use of CAATTs. Majority of internal
audit functions are not using CAATTs.
But with the introduction of new financial There is limited use of CAATTs. Majority
D. Technology 1. Use of CAATTs management policy in Ghana (IFMIS), of the internal audit functions do not use
more and more internal audit functions are CAATTs.
migrating to computerized tools like IDEA
and Teammate.

African Initiative Research Report | globaliia.org 67

4. KENYA
Maturity Indicator I: National Context

Elements Sub-elements Analysis

1. Presence of university programs in One stand-alone program is offered by one university – KCA University
internal auditing offers a diploma and post-graduate diploma in internal auditing
There is a general appreciation of the value and value of internal auditing.
2. Understanding and recognition by
The auditor general, accountant general, minister of finance, the Central
A. Professionalism, key stakeholders of the role and value
Bank of Kenya, and the CMA recognize the need for an effective internal
education programs, of internal auditing
audit function.
recognition
3. IIA membership and GDP per capita Moderate: IIA membership to GDP per capita is 69.7%

4. IIA certification and GDP per capita Low: IIA certification to GDP per capita is 5.7%

1. Transparency International 2015 CPI

B. National indicators The 2015 CPI ranking is 139/168
rank (/168)
for fraud and
corruption 2. Transparency International 2015 CPI
The 2015 CPI score is 25%
score (/100)
1. Role of audit firms in delivering
Audit firms are providing internal audit services to a large number of
internal audit services (assurance and
companies.
consulting)
2. Role of audit firms in delivering Audit firms deliver training and guidance in internal audit to a large number
C. Role of audit training and guidance for internal audit of companies.
firms and accounting 3. Role of accounting associations in
associations delivering training and guidance for Accounting associations train their members who are internal auditors.
internal audit
4. Role of accounting associations in
From an external audit perspective, accounting associations are generally
delivering training and guidance for
involved in training and guiding audit committees.
audit committees
There is significant need for funding for internal audit capacity building. A
1. Availability of funding for internal lot of development agencies are on the ground including the World Bank,
audit training commensurate with need GIZ, African Development Bank, and DANIDA but their contributions are
D. Development not sufficient.
agencies
There is a significant need for advocacy but focus by development
2. Delivery of advocacy for internal
agencies in this area is insufficient. Harmonized/coordinated efforts are
auditing commensurate with need
required.
Active advocacy mainly through CBK prudential guidelines and CMA
E. Role of other 1. Provision of advocacy for internal
requirements including corporate governance code promotes internal
bodies including stock auditing
audit.
exchange and central
bank 2. Setting of internal audit related
Positive requirements are set for internal audit with some enforcement.
policy and corresponding enforcement

68 globaliia.org | The Institute of Internal Auditors

Maturity Indicator II: Governance

Elements Sub-elements Public Sector Analysis Private Sector Analysis

There is no legislation that regulates
internal audit practice in the entire
Requirements for internal audit are provided for in Public
private sector in Kenya. Organizations
Finance Management Act 2012 (PFMA) & Mwongozo code
1. Requirement for establish internal audit functions as part
for state corporations. The existing legislation, apart from
internal audit of following best practice in corporate
establishing the office of the auditor general, does not
governance. Organizations regulated
specify the reporting channel for the internal audit office.
by CBK and CMA are required to have
internal audit functions.
A. Legislation, Head of internal audit is part of middle level management Head of internal audit is part of senior
regulation, 2. Status of internal
and reports to director general, accounting services/ management as they report to the audit
corporate audit
accounting officers. committee and to the CEO.
governance
3. Standards for The IPPF has been adopted by the Public Sector Accounting Use of IIA standards is defined in
code, and
internal audit Standards Board. regulations.
national policies
CMA requirements for listed companies
There are effective requirements for having audit and other organizations use best
4. Audit committees
committees gazette by the government of Kenya. practice corporate governance Kings II
& III.
There is no effective monitoring of compliance with laws There is limited monitoring of
5. Monitoring and and regulations on internal audit or audit committees. compliance with laws and regulations on
enforcement Implementation of the PFMA regulations is not in internal audit or audit committees. CBK
compliance. monitors through inspections.
B. Leadership
The audit committees in the private
and tone at 1. Extent to which Those charged with governance provide general support for
sector are fairly independent compared
the top in CEOs and boards internal audit. The Minister of Finance, the Supreme Auditor
to those in the public sector, hence
organizations support internal General, and the Accountant General support the role and
giving the required support to their
from CEOs and audit value of internal audit.
internal audit function.
boards
The heads of internal audit report to their respective
ministry’s accounting officers administratively and
functionally to the audit committees. At central government
level, internal auditor general reports to the principal
secretary through the director general, accounting services.
This positioning greatly compromises the independence
of internal audit function in central government. At the The head of internal audit reports
C. Positioning 1. Reporting lines
county level, most of the heads of internal audit report both functionally to the audit committee and
of internal audit and independence
administratively and functionally to chief financial officer. For administratively to the CEO.
in organizations SOEs, heads of internal audit report functionally to audit
and its effective committee of their respective boards and administratively
independence to CEOs. The independence of the function is highly
dependent on the effectiveness of the respective audit
committees given that most board members criteria of
appointment are not limited to suitability alone.
2. Positioning of Internal audit is largely a second line of defense. The
Internal audit is largely a third line of
internal audit within largest part of the internal audit time is spent on checking
defense.
the organization compliance.
Audit committees comprise employees of the ministries/
departments they serve. This is contrary to the PFMA
regulations. Audit committees face the following challenges:
·  Lack relevant capacity and skills. The composition of audit committees
1. Independence
·  Absence of appropriate skills mix. are members of the board who don’t
D. Audit and strength of
·  Lack of opportunity for continuous trainings for skill perform executive roles (non executive).
committees audit committee
enhancement. Audit committee is chaired by a non
membership
·  Limited financing/resources. executive director.
·  Lack of succession planning.
·  Lack of independence and objectivity due to political
patronage.

African Initiative Research Report | globaliia.org 69

Maturity Indicator II: Governance (continued)

Elements Sub-elements Public Sector Analysis Private Sector Analysis

Members of audit committee have a
general understanding of internal audit.
At least one member is required to have
2. Understanding of Members of the audit committee have no appreciable
qualifications and expertise in audit,
internal audit understanding of internal audit due to selection criteria.
financial management and accounting,
with experience and knowledge in risk
management.
The audit committee has an advisory
role in the appointment of the head
3. Powers of the
D. Audit The audit committees in the government sector do not of internal audit (e.g., take part in the
audit committee to
committees have authority to appoint CAEs (CAEs are appointed by interview but the final appointment is
include hire and fire
the Public Service Commission). Audit committees approve done by the entire board or CEOs).
CAE, approve audit
audit plan but have little say in its implementation. Audit committees approve internal audit
plan and resources
plans and review adequacy of internal
audit budgetary resources.
4. Effectiveness
in holding the Audit committees have no effective powers and authority. Audit committee is somewhat effective
CAE and the They are unable to hold either the CAE or the organization in holding head of internal audit to
organization to to account. account.
account
1. Organizational
E. Risk Most organizations have a consistent
risk management There is no risk management framework in government.
management approach to managing risk.
maturity

Maturity Indicator III: Quality

Elements Sub-elements Public Sector Analysis Private Sector Analysis

Internal audit functions have charters Most internal audit functions have charters
consistent with the IPPF. Contents of the consistent with the IPPF. The charter
internal audit charter include mission, contents include: charter rationale, the
A. Audit 1. Presence and strength of authority, independence and objectivity of definition of internal audit, authority of
strategy and charter, sense of purpose, internal audit, duties and responsibilities internal audit, reporting lines, independence
charter and focus of internal audit, responsibilities of and objectivity, roles and responsibilities of
management, reporting channels and the internal audit. Strategies are not separately
need for self-assessment. Internal audit documented; most are included in audit
strategies are included in the audit plans. plan.
1. Extent to which audit Audit planning is risk-based but coverage Some internal audit functions have adopted
B. Audit planning is risk based and is not enterprisewide hence effectively, it is risk-based audit planning, which is aligned
planning, aligned with strategy partially risk-based. with organizational strategy.
including risk 2. Frequency of risk Annual risk assessment is performed but Internal audit functions prepare annual work
assessment assessment and alignment does not include enterprise wide strategic plans, but these are not regularly updated
with strategy focus. based on emerging risks.
IIA standards are partially applied by most
C. Use of 1. Use of robust internal audit Most internal audit functions partially apply internal audit functions except for the
standards standards IIA standards. multinational companies which have to
comply with group standards.

70 globaliia.org | The Institute of Internal Auditors

Maturity Indicator III: Quality (continued)

Elements Sub-elements Public Sector Analysis Private Sector Analysis

Internal audit work has a narrow scope– Internal audit work covers a broad scope
1. Scope of audit work mostly financial and compliance. Less on the including compliance, financial, operational,
entity’s operations and performance. and other areas based on risk assessments.
D. Scope, 2. Quality of the audit reports Audit reports do not effectively
Audit reports are timely and effectively
reporting, and – effectiveness in identifying communicate control weakness. They focus
communicate findings.
follow up and communication issues more on pointing out the errors.
Follow-up process is institutionalized but not
3. Effectiveness in following Audit issues are systematically followed up
functioning well as many audit committees
up on issues regularly.
are not in place or are not yet functioning.
E. Quality Arrangements for quality assurance are
1. Internal – monitoring, There are no formal arrangements for quality
assurance and incomplete. Quality assurance is only done
supervision, appraisal, assurance. A quality assurance program is
improvement through review of working papers and
training, review of audit being introduced.
planning deliverables

Maturity Indicator IV: Resources

Elements Sub-elements Public Sector Analysis Private Sector Analysis

A. Adequacy of
1. Adequacy of staffing
staffing resources,
resources
including structure
1. Competency and
experience
2. Internal audit specific
B. Skills
certifications held
3. Highest educational level
C. CPE and 1. Access to and frequency
training of training
D. Technology 1. Use of CAATTs
Budget is inadequate to deliver audit plan.
Although available staff are reasonably well
There is an inadequate supply of qualified
organized, they are not enough for the need.
internal auditors.
There is a shortage of resources, staff, tools,
and relevant skills.
Internal auditors have limited understanding Most internal audit staff have limited
of modern internal audit practice. understanding of internal audit practices.
Majority of internal audit staff do not hold Majority of internal audit staff do not hold
internal audit qualifications. internal audit qualifications.
Majority of internal audit staff hold a first Majority of internal audit staff hold a first
university degree. university degree.
Internal audit staff have good access to Internal auditors have good access to
training. training.
Limited use of CAATTs. A majority of
Majority of the internal audit functions have
internal audit functions are not using
automated tools for filing internal audit
CAATTs, however, many are now adopting
work but few have tools and techniques for
these tools. The tools commonly used are
data analysis. TeamMate and ACL are the
TeamMate AM (for audit management) and
commonly used CAATTs.
ACL and IDEA for data mining.

African Initiative Research Report | globaliia.org 71

5. MALAWI
Maturity Indicator I: National Context

Elements Sub-elements Analysis

The polytechnic, a Constituent College of the University of Malawi has a
1. Presence of university programs in
stand-alone internal audit degree introduced three years ago. Student
internal auditing
enrollment to date is 115.
General appreciation of broader role of internal audit. Both sectors are
recognizing the difference between external audit and internal audit
2. Understanding and recognition by
A. Professionalism, and have established internal audit functions that are independent of
key stakeholders of the role and value
education programs, finance departments. The CIA designation and membership in The IIA
of internal auditing
recognition are also increasingly being used by many private sector organizations as a
requirement for recruitment.

3. IIA membership and GDP per capita Substantial: IIA membership to GDP per capita is 85.2%

4. IIA certification and GDP per capita Very low: IIA certification to GDP per capita is 4.9%

1. Transparency International 2015 CPI

B. National indicators The 2015 CPI ranking is 112/168
rank (/168)
for fraud and
corruption 2. Transparency International CPI score
The 2015 CPI score is 31%
(/100)
1. Role of audit firms in delivering
PwC, KPMG, and Deloitte are providing internal audit services to large
internal audit services (assurance and
multinational and national companies.
consulting)
2. Role of audit firms in delivering Audit firms provide training and guidance for internal audit to their client
C. Role of audit training and guidance for internal audit companies and in conferences for internal auditors.
firms and accounting 3. Role of accounting associations in Negligible. Their role is currently minimal because almost all internal audit
associations delivering training and guidance for functions are in-house and IIA–Malawi has raised its profile to almost the
internal audit same level as accounting bodies.
4. Role of accounting associations in
delivering training and guidance for Negligible. This has been dominated by IIA–Malawi.
audit committees
1. Availability of funding for internal World Bank and GIZ is providing training on internal auditing and this is
audit training commensurate with need limited to particular projects.
D. Development
agencies There is a significant need for advocacy for internal audit but the World
2. Delivery of advocacy for internal
Bank and GIZ work on the ground and the efforts of IIA–Malawi are
auditing commensurate with need
insufficient.
1. Provision of advocacy for internal A number of bodies (e.g., central bank, stock exchange) are active in
E. Role of other auditing delivering advocacy.
bodies including stock
exchange and central Positive requirements for internal audit are set with some enforcement.
2. Setting of internal audit related
bank Reserve Bank of Malawi and corporate governance code require effective
policy and corresponding enforcement
internal audit functions.

72 globaliia.org | The Institute of Internal Auditors

Maturity Indicator II: Governance

Elements Sub-elements Public Sector Analysis Private Sector Analysis

Requirements for internal audit are limited. The
Public Finance Management Act No. 7 of 2003
minimally covers internal audit requirements Corporate governance code and central bank
1. Requirement for
in government. At the moment, a national requirements require effective internal audit
internal audit
internal audit policy is being drafted and one functions.
of its recommendations is to enact the Internal
A. Legislation, Audit Act.
regulation, Head of internal audit is part of middle Head of internal audit is part of senior
corporate 2. Status of internal audit management as they report to chief secretary management as they report to the audit
governance or the secretary to the treasury. committee and to the CEO.
code, and
The use of standards is defined but does not
national 3. Standards for internal
include the IIA standards or “internationally Private sector applies IIA standards.
policies audit
recognized standards.”
There are limited requirements for having an Corporate governance code includes
4. Audit committees
audit committee. requirements for audit committee.
There is no monitoring of compliance with There is no effective monitoring of compliance
5. Monitoring and
laws and regulations on internal audit or audit with laws and regulations on internal audit or
enforcement
committees. audit committees.
B. Leadership
Those charged with governance provide
and tone at
1. Extent to which CEOs limited support for internal audit. Minister of
the top in CEOs and audit committees support internal
and boards support Finance and other high-level officials provide
organizations audit work.
internal audit some support for internal audit, especially
from CEOs and
working with IIA–Malawi
boards
In central government, internal audit is
supposed to administratively report to the
secretary to the treasury in the Ministry of
Finance and functionally report to independent
audit committees in the Office of the President
C. Positioning and cabinet. However, the independent Internal audit administratively reports to the
of internal 1. Reporting lines and
audit committees have been dormant for CEO and functionally to the audit committee of
audit in independence
the past two years. In local councils, internal the board – requirement of governance code.
organizations audit administratively reports to the CEO
and its and functionally to elected members of the
effective council. In state-owned enterprises, internal
independence audit administratively reports to the CEO and
functionally to the board of the enterprise.
2. Positioning of Internal audit is largely a second line of
Internal audit is part of a combined second and
internal audit within the defense. Some work of internal audit focuses
third line of defense.
organization on pre-payment audits.
Audit committees includes non executive According to the governance code, the
1. Independence
directors/non-serving public servants. majority of audit committee members,
and strength of audit
Nomination process may not be fully including the chairman, should be
committee membership
transparent due to political appointments. nonexecutive directors.
D. Audit
committees Members of audit committee have a general
Members of the audit committee have a understanding of internal audit. Priority of
2. Understanding of
limited understanding of internal audit due to knowledge requirement is audit, finance, and
internal audit
selection criteria. economics, and persons with qualifications in
the organization’s core operations.

African Initiative Research Report | globaliia.org 73

Maturity Indicator II: Governance (continued)

Elements Sub-elements Public Sector Analysis Private Sector Analysis

The audit committee is involved in the
appointment of the head of internal audit and
3. Powers of the audit
Audit committees have no effective powers in the approval of the audit plan and resources.
committee include hire
and authority on appointment of CAE and Audit committees in some private sector
and fire CAE, approve
D. Audit resources for the internal audit function. institutions have a say in the appointment of
audit plan and resources
committees the head of internal audit and resources for
internal audit function.
4. Effectiveness in The audit committee is unable to hold either Through their responsibilities, audit committees
holding the CAE and the the CAE or the organization to account due to are somewhat effective in holding organizations
organization to account political nature of environment. and CAEs accountable.
E. Risk 1. Organizational risk There is no risk management framework in Most organizations have a consistent approach
management management maturity government. to managing risk.

Maturity Indicator III: Quality

Elements Sub-elements Public Sector Analysis Private Sector Analysis

A. Audit strategy and 1. Presence and strength of charter,
charter sense of purpose, and focus
1. Extent to which audit planning is
risk based and aligned with strategy
B. Audit planning,
including risk
assessment 2. Frequency of risk assessment and
alignment with strategy
1. Use of robust internal audit
C. Use of standards
standards
1. Scope of audit work
D. Scope, reporting, 2. Quality of the audit reports –
and follow up effectiveness in identifying and
communication issues
3. Effectiveness in following up on
issues
E. Quality assurance
1. Internal - monitoring, supervision,
and improvement
appraisal, training, review of audit
planning
Having charters and strategies is
Few internal audit functions have
optional; hence there are no defined
charters and strategies that are
charters or internal audit strategy
aligned with organization’s priorities.
requirements.
Audit planning is partially risk-based Some audit functions have adopted
and there is flexibility to consider risk-based audit planning with
emerging risks. flexibility to adjust for emerging risks.
There are no frequent formal risk
management processes. Three-year Risk assessments are completed
audit plans are prepared and rolled regularly.
out annually.
IIA standards are partially applied. IIA standards are partially applied.
Internal audit work has a broad scope, Internal audit work covers a broad
which covers compliance, financial, scope. Focus is on compliance,
operational, performance, IT, fraud operational, and financial
investigations, and many other audits. performance.
Audit reports are generally of poor
quality and sometimes there are
Audit reports are timely and
no consolidated reports to provide
effectively communicate findings.
evidence of the level of internal audit
activity and key findings.
Follow-up process is weak. Audit
Audit issues are systematically
committees are not functioning
followed up regularly.
properly.
Some internal audit functions have a
There are no formal arrangements for quality assurance program but are not
quality assurance. fully compliant with IIA standards due
to lack of external assessments.

74 globaliia.org | The Institute of Internal Auditors

Maturity Indicator IV: Resources

Elements Sub-elements Public Sector Analysis Private Sector Analysis

A. Adequacy of staffing
Staffing resources for internal audit Resources allocated to internal audit
resources, including 1. Adequacy of staffing resources
are inadequate. function are somewhat sufficient.
structure
Internal auditors have limited
Most internal audit staff have limited
understanding and experience of
1. Competency and experience understanding of modern internal
modern internal auditing. Most have
auditing.
accounting backgrounds.
B. Skills Majority of internal audit staff hold Majority of internal audit staff hold
2. Internal audit specific certifications
accounting qualification with very few accounting qualification with very few
held
holding internal audit qualifications. holding internal audit qualifications.
Majority of internal audit staff hold a Majority of internal audit staff hold a
3. Highest educational level
first university degree. first university degree.
Access to training is limited Access to training is limited as priority
C. CPE and training 1. Access to and frequency of training as majority is dependent on is given to accounting qualifications
development agencies’ funding. trainings.
Majority of internal audit functions do Majority of internal functions do not
D. Technology 1. Use of CAATTs
not use CAATTs. use CAATTs.

African Initiative Research Report | globaliia.org 75

5. NIGERIA
Maturity Indicator I: National Context

Elements Sub-elements Analysis

1. Presence of university programs in Universities/colleges have one or more programs (mainly the accounting
internal auditing degree) incorporating internal audit content.
Understanding and recognition of value of internal audit is very limited and
2. Understanding and recognition by inaccurate in the government. Internal audit is seen as part of the internal
A. Professionalism, key stakeholders of the role and value controls as internal auditors do prepayment audits. In the private sector,
education programs, of internal auditing there is a general appreciation of the role of internal audit given that the
recognition big audit firms are offering outsourced/co-sourced internal audit services.

3. IIA membership and GDP per capita Low: IIA membership to GDP per capita is 28.6%

4. IIA certification and GDP per capita Very low: IIA certification to GDP per capita is 2.7%

1. Transparency International 2015 CPI

B. National indicators The 2015 CPI ranking is 136/168
rank (/168)
for fraud and
corruption 2. Transparency International 2015 CPI
The 2015 CPI score is 25%
score (/100)
1. Role of audit firms in delivering PwC and KPMG are providing internal audit services to large multinational
internal audit services (assurance and and national companies. Deloitte and Touché and EY are also involved in a
consulting) smaller scale.
2. Role of audit firms in delivering Audit firms provide training and guidance for internal audit to their client
C. Role of audit training and guidance for internal audit companies and in conferences for internal auditors.
firms and accounting 3. Role of accounting associations in
associations Negligible. Most internal auditors are chartered accountants. Accounting
delivering training and guidance for
bodies train their members on internal auditing.
internal audit
4. Role of accounting associations in
delivering training and guidance for Negligible. Audit committees focus on financial reporting.
audit committees
There is a significant need for funding but development agencies are
1. Availability of funding for internal
missing. Only the World Bank is providing training on internal auditing and
D. Development audit training commensurate with need
this is limited to its projects.
agencies
2. Delivery of advocacy for internal There is a significant need for advocacy for internal audit but the World
auditing commensurate with need Bank work on the ground and the efforts of IIA–Nigeria are insufficient.
E. Role of other 1. Provision of advocacy for internal
Limited advocacy through setting requirements.
bodies including stock auditing
exchange and central 2. Setting of internal audit related Compliance requirements include establishment of internal audit functions
bank policy and corresponding enforcement but enforcement is weak.

76 globaliia.org | The Institute of Internal Auditors

Maturity Indicator II: Governance

Elements Sub-elements Public Sector Analysis Private Sector Analysis

No specific requirement but the Companies
Requirements for internal audit in public and Allied Matters Act 1990 indicates audit
sector are detailed within the financial committees’ role over internal audit. Also
1. Requirement for
regulation. The requirement is negative the code of governance for Banks and
internal audit
as it requires internal audit function to do Discount Houses in Nigeria and guidelines
prepayment audits. for whistleblowing in the Nigerian banking
industry regulates the banking industry.
Head of internal audit is part of junior level Head of internal audit is part of senior
2. Status of internal
management as they report to the accounting management as they report to the audit
audit
A. Legislation, officer. committees and to the managing director.
regulation, The use of standards is recommended but not
3. Standards for
corporate defined. Set up of internal audit function also Private sector applies IIA standards.
internal audit
governance code, hinders application of IIA standards.
and national policies Requirements to have audit committees are
included in Companies and Allied Act 1990.
There is no requirement for having an audit Section 359(3) of the CAMA 1990 requires
4. Audit committees
committee. auditors of public companies to make a report
to an audit committee which shall be
established by all public companies.
There is regular monitoring of compliance
5. Monitoring and There is no monitoring of compliance with with laws and regulations on internal audit
enforcement laws and regulations on internal audit. or audit committees by the Central Bank of
Nigeria and the Nigerian Stock Exchange.
B. Leadership and
1. Extent to which Accountant general provides general support CEOs provide general support to internal
tone at the top in
CEOs and boards for internal audit as the head of internal audit audit. Audit committees provide oversight to
organizations from
support internal audit reports to him/her. internal audit work.
CEOs and boards
Internal audit does not report to an audit
committee functionally. The head of internal Functionally, the head of internal audit reports
C. Positioning 1. Reporting lines and audit reports functionally to the accounting to the board of directors – normally consists
of internal audit independence officer (head of the government agency) and of executive directors and administratively
in organizations administratively to the Accountant General of reports to the managing director.
and its effective the Federation.
independence 2. Positioning of
Internal audit is largely a first line of defense, Internal audit is part of a combined second
internal audit within
and their work focuses on pre-payment audits. and third line of defense.
the organization

African Initiative Research Report | globaliia.org 77

Maturity Indicator II: Governance (continued)

Elements Sub-elements Public Sector Analysis Private Sector Analysis

The audit committees is made up of an
equal number of directors and shareholder
1. Independence
representatives subject to a maximum of
and strength of There are no audit committees or equivalent
six members. The audit committee chair
audit committee in the public sector.
is selected by committee members but
membership
common practice is to vote a shareholder
representative as the chairman.
The Companies and Allied Act is silent on
the qualification of individual members of
the audit committee and their obligations.
2. Understanding of There are no audit committees in public
Normally, priority of knowledge requirement
internal audit sector.
is accounting and not internal audit. So the
understanding of internal audit within audit
D. Audit committee is limited.
committees The audit committee has limited involvement
3. Powers of the audit in the appointment of the head of internal
committee to include audit and in the approval of the audit plan
There are no audit committees in public
hire and fire CAE, and resources. Audit committees can make
sector.
approve audit plan recommendations on the appointment of
and resources CAEs and are required to ensure the effective
functioning of the internal audit function.
The Act empowers audit committees to
authorize the internal auditor to carry
4. Effectiveness in
out an investigation into any activities of
holding the CAE and There are no audit committees in public
the company which may be of interest or
the organization to sector.
concern to the audit committee. However,
account
audit committees in Nigeria have limited
effectiveness in ensuring accountability.
1. Organizational risk There is no risk management framework in Most organizations have a consistent
E. Risk management
management maturity public entities. approach to managing risk.

78 globaliia.org | The Institute of Internal Auditors

Maturity Indicator III: Quality

Elements Sub-elements Public Sector Analysis Private Sector Analysis

There is no charter and no defined Some internal audit functions have a
A. Audit strategy and 1. Presence and strength of charter, internal audit strategy. Internal audit charter that is consistent with the IPPF
charter sense of purpose, and focus is a part of internal control due to and strategies that are aligned with
nature of work. the organization’s priorities.
Some internal audit functions have
1. Extent to which audit planning is Audit planning is not risk-based as adopted risk-based audit planning
B. Audit planning, risk based and aligned with strategy focus is on transactions. with the flexibility to adjust for
including risk emerging risks.
assessment
2. Frequency of risk assessment and Risk assessments are completed at
There are no formal risk assessments.
alignment with strategy least annually.
1. Use of robust internal audit
C. Use of standards Formal standards are not applied. IIA standards are partially applied.
standards
Internal audit work covers a broad
Internal audit work is primarily a
scope. The focus is on compliance,
1. Scope of audit work control function. The focus is on
operational, and financial
prepayment processing.
performance.
D. Scope, reporting,
2. Quality of the audit reports – Audit reports are generally of poor
and follow up Audit reports are timely and
effectiveness in identifying and quality and sometimes there are no
effectively communicate findings.
communication issues reports.
3. Effectiveness in following up on No follow-up process on audit issues Audit issues are systematically
issues exists. followed up regularly.
E. Quality assurance Some internal audit functions have
1. Internal-monitoring, supervision, There are no formal arrangements for
and improvement quality assurance program but the
appraisal, training, review of audit quality assurance.
planning arrangements are limited.

Maturity Indicator IV: Resources

Elements Sub-elements Public Sector Analysis Private Sector Analysis

A. Adequacy of Internal audit functions exist within the
1. Adequacy of staffing Adequate staffing resources are allocated to
staffing resources, accounting unit. Resources are not separated
resources the internal audit function.
including structure from the accounting unit resources.
Internal auditors have very limited
1. Competency and Few internal audit staff have a good practical
understanding and experience of modern
experience knowledge of internal auditing.
internal auditing due to the nature of work.
B. Skills 2. Internal audit specific Some internal audit staff hold accounting or Some internal audit staff have accounting or
certifications held internal audit qualifications. internal audit certifications.
3. Highest educational The majority of internal audit staff hold a first The majority of internal audit staff hold a first
level university degree. university degree.
The majority of internal audit staff have
Access to training is very limited as it only less than 10 hours CPE per year. Access to
1. Access to and
C. CPE and training offered through the development agencies’ training is limited as it only offered through
frequency of training
funding and limited to specific PFM projects. the development agencies’ funding and
limited to specific PFM projects.
There is limited use of CAATTs such as IDEA,
CAAT, ACL, ActiveData, CaseWare. The
There is no use of computerized auditing
D. Technology 1. Use of CAATTs majority of internal audit functions are yet
tools.
to adopt computerized auditing tools and
techniques.

African Initiative Research Report | globaliia.org 79

7. RWANDA
Maturity Indicator I: National Context

Elements Sub-elements Analysis

1. Presence of university programs in No programs in internal auditing. IIA institute is very new and has not done
internal auditing any outreach to universities/colleges.
There is a general appreciation of the role and value of internal audit.
• An internal audit service has been established in all government
2. Understanding and recognition by institutions.
A. Professionalism, key stakeholders of the role and value • Central government internal audit is ranked level 2-3 of the IA-
education programs, of internal auditing CM and expects to be at level 4 by 2017.
recognition • Central Bank recognizes internal audit as an integral component
of sound corporate governance and risk management practices.

3. IIA membership and GDP per capita Very Low: IIA membership to GDP per capita is 10.8%

4. IIA certification and GDP per capita Very low: IIA certification to GDP per capita is 0.3%

1. Transparency International 2015 CPI

B. National indicators The 2015 CPI ranking is 44/168
rank (/168)
for fraud and
corruption 2. Transparency International 2015 CPI
The 2015 CPI score is 54%
score (/100)
1. Role of audit firms in delivering
Big Four public accounting firms have not started offering internal audit
internal audit services (assurance and
services in Rwanda.
consulting)
2. Role of audit firms in delivering Big Four public accounting firms do not yet provide internal audit training
C. Role of audit training and guidance for internal audit in Rwanda.
firms and accounting 3. Role of accounting associations in Accounting bodies currently focus on growing membership and
associations delivering training and guidance for qualifications in accounting. They regulate accountants and auditors who
internal audit are their members and provide training on internal audit.
4. Role of accounting associations in
Training and guidance for audit committees is more focused on financial
delivering training and guidance for
reporting and not internal audit.
audit committees
Country significantly needs internal audit resources, especially manpower.
Rwanda lacks skilled and experienced internal auditors. The World
1. Availability of funding for internal Bank is currently working with the Ministry of Finance on internal audit
audit training commensurate with need capacity building including professional certification (CIA) for government
D. Development internal auditors. Also GIZ and World Bank are supporting public financial
agencies management projects, which include internal audit.
Advocacy is still in infancy as the IIA institute is still in formation process.
2. Delivery of advocacy for internal
The World Bank seems to be the only development agency on the ground
auditing commensurate with need
and the focus of its capacity building is limited to its projects.
Stock exchange is young and small with a few listed companies – no
E. Role of other 1. Provision of advocacy for internal
advocacy for internal auditing. National Bank of Rwanda provides advocacy
bodies including stock auditing
through its regulations.
exchange and central
bank 2. Setting of internal audit related Central Bank enforces its internal audit requirements through regular
policy and corresponding enforcement surveillances.

80 globaliia.org | The Institute of Internal Auditors

Maturity Indicator II: Governance

Elements Sub-elements Public Sector Analysis Private Sector Analysis

Except for bank regulations which require banks
Requirements for internal audit in the public to have internal audit functions, the private sector
1. Requirement for
sector are detailed within acts of parliament and generally follow best practice (e.g., King Report
internal audit
ministerial laws. on corporate governance, IIA standards, and IFAC
guidelines_
A. Legislation, Chief internal auditor is part of middle level
regulation, 2. Status of internal management but is empowered to coordinate all Head of internal audit is part of senior
corporate audit internal auditors nationally and can move into any management – same level as heads of functions.
governance government entity to conduct an audit.
code, and
3. Standards for The use of IPPF is defined in relevant guidelines Private sector has adopted IIA standards as best
national
internal audit for internal audit. practice but their application varies.
policies
Requirements to have audit committees are Except for banks, there are no formalized
4. Audit committees included in ministerial instructions as part of requirements – entities follow best practice using
government laws. the King Report, IIA and IFAC.
5. Monitoring and There is no monitoring of compliance with laws National Bank of Rwanda monitors compliance
enforcement and regulations on internal audit. with requirements through regular surveillance.
B. Leadership
The minister of finance provides general support
and tone at
1. Extent to which for internal audit as the chief internal auditor
the top in Audit committees provide oversight to internal
CEOs and boards reports to him/her. Audit committees provide
organizations audit work.
support internal audit oversight to the internal audit function and
from CEOs and
approve audit plans and reports.
boards
Internal audit reports functionally to an audit
C. Positioning committee appointed by the minister of
For banks, internal audit is required to report
of internal 1. Reporting lines and finance and administratively to middle or senior
administratively to CEO and functionally to audit
audit in independence management official. The central government
committee.
organizations chief internal auditor reports to the Minister of
and its Finance.
effective 2. Positioning of
independence Internal audit is largely a second line of defense. For banks, internal audit is largely a third line of
internal audit within
No risk oversight function exists. defense.
the organization
Audit committee largely consists of executives,
1. Independence except for central government where they are For banks, audit committees comprise non
and strength of appointed by the Minister of Finance mainly from executive directors with the chair being required
audit committee the private sector or civil society. In state owned to be independent and not the chairman of the
membership entities, audit committee members come from board.
the board of directors.
Members of the audit committee have a mix of
Members of the audit committee are required
2. Understanding of technical know-how, experience, and business
to have accounting and financial management
internal audit acumen but are not required to have internal
D. Audit experience and not internal audit experience.
audit experience.
committees
3. Powers of the audit
Despite having the mandate, in practice audit
committee to include Audit committees have a role in the appointment
committees have limited involvement in the
hire and fire CAE, of CAEs and approval of internal audit plans and
appointment of the head of internal audit and in
approve audit plan resources.
the approval of audit plan and resources.
and resources
4. Effectiveness in As the audit committee does not fulfill its
Audit committees are somewhat effective in
holding the CAE and mandate, it has limited effectiveness in holding
holding organizations accountable through their
the organization to the head of internal audit and the organization to
responsibilities.
account account.
E. Risk 1. Organizational risk There is no risk management framework in public There is a limited and inconsistent approach to
management management maturity entities though legislation requires it. managing risk.

African Initiative Research Report | globaliia.org 81

Maturity Indicator III: Quality

Elements Sub-elements Public Sector Analysis Private Sector Analysis

1. Presence and Financial institutions regulation requires internal
A. Audit
strength of charter, Internal audit has a charter that is consistent with audit functions to have an internal audit charter
strategy and
sense of purpose, and IPPF and it also has a strategy. and strategic plan that is in line with best
charter
focus practices.
1. Extent to which Financial institutions’ regulations require the
Audit planning is intended to be risk-based
audit planning is risk head of internal audit to have a plan which is
B. Audit though not focused on whole entity risks
based and aligned with risk-based and flexible to respond to changing
planning, (enterprisewide).
strategy priorities and needs.
including risk
assessment 2. Frequency of risk
Risk assessments are completed annually though Annual risk assessments are conducted by
assessment and
not for covering entity wide strategic focus. internal audit functions.
alignment with strategy
C. Use of 1. Use of robust internal Internal audit standards partially conform to the
IIA standards are partially applied.
standards audit standards IPPF.
The focus is broad but not compressive due
to risk assessment limitations. Areas covered The focus is broad including compliance,
1. Scope of audit work
include compliance, financial, operational, and financial, operational, and performance.
performance audits.
Audit reports are timely and effectively
D. Scope, 2. Quality of the audit
communicate findings. Reports are produced
reporting, reports – effectiveness Audit reports are timely and effectively
quarterly and the chief internal auditor normally
and follow up in identifying and communicate findings.
prepares a summary of crosscutting internal
communication issues
control issues for the Minister of Finance.
Systematic follow up of issues is in place and
3. Effectiveness in
the majority of audit recommendations are Follow up on reported issues is systematic.
following up on issues
implemented in a timely manner.
E. Quality Arrangements for quality assurance are
1. Internal –monitoring,
assurance and incomplete and partially conform to IIA standards.
supervision, appraisal, Arrangements for quality assurance are limited.
improvement A formal quality assurance and improvement
training, review of audit
planning program is still under development.

Maturity Indicator IV: Resources

Elements Sub-elements Public Sector Analysis Private Sector Analysis

A. Adequacy
Staffing resources for internal audit are very limited
of staffing
1. Adequacy of to deliver the audit plan. There are not enough There is a shortage of staff with internal audit skills
resources,
staffing resources professional practitioners in internal audit functions; and qualifications.
including
staff with CIA certification are very few.
structure
1. Competency and Internal auditors have a limited understanding and Internal auditors have limited understanding and
experience experience of modern internal auditing. experience of modern internal auditing.
2. Internal The majority of the internal auditors do not hold The majority of the internal auditors do not hold
B. Skills audit specific professional qualifications. Staff with ACCA, CPA, professional qualifications. Staff with ACCA, CPA,
certifications held and CIA qualifications are very few. and CIA qualifications are very few.
3. Highest Some internal audit staff hold a first university Some internal audit staff hold a first university
educational level degree mostly in accounting or finance. degree mostly in accounting or finance.
1. Access to and Access to training is limited as it only offered through
C. CPE and Access to training is limited. Also the IIA institute
frequency of the development agencies’ funding and limited to
training is only at formation stage.
training specific public financial management projects.
The audit function is in thinitial stages of
There is limited use of CAATTS. Most internal
computerization. Teammate was introduced in 2013
D. Technology 1. Use of CAATTs audit functions are in the process of automation
but implementation is slow. The automation is still
mostly using Teammate.
being piloted.

82 globaliia.org | The Institute of Internal Auditors

8. TANZANIA
Maturity Indicator I: National Context

Elements Sub-elements Analysis

Internal audit content is incorporated in some programs, especially
1. Presence of university programs in
accounting/commerce degrees. The IIA institute has been conducting
internal auditing
awareness campaigns to various colleges and universities.
2. Understanding and recognition by
A. Professionalism, There is a general appreciation of the role and value of internal audit.
key stakeholders of the role and value
education programs, Support is provided through budget allocation and training.
of internal auditing
recognition
3. IIA membership and GDP per capita Moderate: IIA membership to GDP per capita is 50.2%

4. IIA certification and GDP per capita Very low: IIA certification to GDP per capita is 2.4%

1. Transparency International 2015 CPI

B. National indicators The 2015 CPI ranking is 117/168 and the score is 30%
rank (/168)
for fraud and
corruption 2. Transparency International 2015 CPI
The 2015 CPI score is 30%
score (/100)
1. Role of audit firms in delivering
Big Four public accounting firms provide outsourced and co-sourced
internal audit services (assurance and
internal audit services.
consulting)
2. Role of audit firms in delivering Big Four public accounting firms deliver training and guidance in internal
C. Role of audit training and guidance for internal audit audit.
firms and accounting 3. Role of accounting associations in Accounting bodies provide training and guidance on internal audit services
associations delivering training and guidance for to their members. Accounting bodies regulate internal auditors. They also
internal audit adopted the IPPF and are enforcing its implementation.
4. Role of accounting associations in
Training and guidance for audit committees is more focused on financial
delivering training and guidance for
reporting/accounting.
audit committees
There are a number of development agencies on the ground including
1. Availability of funding for internal
World Bank, JICA, African Development Bank, USAID, DFID, and GIZ
D. Development audit training commensurate with need
building internal audit capacity.
agencies
2. Delivery of advocacy for internal Multiple development agencies on the ground are good advocates of
auditing commensurate with need internal audit through their internal audit capacity building projects.
Advocacy is provided through legislation: Bank of Tanzania requires all
E. Role of other 1. Provision of advocacy for internal banks and financial institutions to have internal audit functions; Dar es
bodies including stock auditing Salaam Stock Exchange regulations require all companies trading in the
exchange and central stock market to have internal audit functions.
bank 2. Setting of internal audit related Bank of Tanzania enforces its internal audit requirements through regular
policy and corresponding enforcement reviews of implementation.

African Initiative Research Report | globaliia.org 83

Maturity Indicator II: Governance

Elements Sub-elements Public Sector Analysis Private Sector Analysis

Requirements for internal audit in public
sector are detailed in Public Finance Act 2010
Requirements for internal audit in private
revised in 2014, Local Government Finances
sector are included in the Banks and Financial
1. Requirement for internal Act of 1982, Executive Agency Act of 1997,
Institutions Act of 2006. There is no legislation
audit and Public Corporations Act of 1992. The
requiring all registered private organizations
negative impact of the legislation is the
to have internal audit functions.
requirement that internal auditors must be
accountants.
A. Legislation, Heads of internal audit are part of junior and
regulation, The head of internal audit is part of senior
2. Status of internal audit middle management. Positioning impacts
corporate management in most internal audit functions.
independence.
governance
The use of IPPF standards is defined in The use of IPPF standards is defined in
code, and 3. Standards for internal audit
relevant guidelines for internal audit. relevant guidelines for internal audit.
national
policies Requirements to have audit committees
are included in Public Finance Regulations,
2001 and Order number 12 of the Local Organizations follow best practice using the
4. Audit committees
Authority Financial Memorandum, 2009. The King Report, IIA, and IFAC.
regulations as defined affect audit committee
independence.
The Central Bank monitors compliance with
5. Monitoring and Monitoring of compliance with laws and
requirements through regular reviews of
enforcement regulations on internal audit if any is weak.
implementation.
B. Leadership
and tone at
The minister of finance, supreme auditor The heads of the stock exchange and Central
the top in 1. Extent to which CEOs and
general, and accountant general provide Bank support internal audit as evidenced in
organizations boards support internal audit
general support for internal audit. regulation requirements.
from CEOs and
boards
Internal auditors general report
administratively to senior ranking official
(accounting officer) and is the same level as
C. Positioning other department heads. However, there are
1. Reporting lines and CAE reports functionally to the audit
of internal instances where although the head of internal
independence committee and administratively to the CEO.
audit in audit reports to the accounting officer, their
organizations grades are lower than department heads.
and its Heads of internal audit report functionally to
effective the audit committee.
independence Internal audit is largely a second line of
2. Positioning of internal defense. Internal audit is championing
Internal audit is largely a third line of defense.
audit within the organization implementation of risk management
framework.

84 globaliia.org | The Institute of Internal Auditors

Maturity Indicator II: Governance (continued)
Elements Sub-elements
1. Independence and
strength of audit committee
membership
2. Understanding of internal
audit
D. Audit
committees
3. Powers of the audit
committee to include hire
and fire CAE, approve audit
plan and resources
4. Effectiveness in
holding the CAE and the
organization to account
E. Risk 1. Organizational risk
management management maturity
Maturity Indicator III: Quality
Elements Sub-elements
1. Presence and strength of
A. Audit strategy
charter, sense of purpose,
and charter
and focus
1. Extent to which audit
planning is risk-based and
B. Audit planning, aligned with strategy
including risk
assessment 2. Frequency of risk
assessment and alignment
with strategy
C. Use of 1. Use of robust internal audit Internal audit standards partially conform to
standards standards
Public Sector Analysis Private Sector Analysis
Audit committees comprise internal senior
managers nominated by accounting officers. Audit committees comprise executive and
Audit committees are largely constituted with non executive directors.
non independent members.
Audit committee members have limited
knowledge and experience of the committee’s Members of the audit committee have a
function, including understanding internal mix of technical know-how, experience, and
audit. Guidelines issued in 2013 by Ministry business acumen but limited understanding
of Finance require a mix of skills in audit of internal audit.
committee.
Audit committees have no powers and
authority in appointment of heads of internal
Audit committees are involved in the of CAEs
audit nor on approval of the budget and other
and approval of audit plans and resources for
resources for internal audit. However, annual
internal audit.
plans are approved by audit committees.
Parastatals are an exception.
Audit committees are not independent; Audit committees are somewhat effective in
hence are not effective in holding anyone holding CAEs accountable for internal audit
accountable. function delivery.
There is no formal risk management
framework in most public entities. The
championing of the implementation of risk Entities are increasingly developing a
management across government entities and consistent approach to managing risk.
strategies is included as part of the internal
audit strategy for the internal auditor general.
Public Sector Analysis Private Sector Analysis
Most internal audit functions have charters
Some internal audit functions have basic
and strategies aligned to organization
audit charters and strategies .
strategies.
Audit planning is partially risk-based and
Annual audit plans are not fully based on the
not always comprehensive but focused on
risk assessment results.
certain risks.
Risk assessments are completed annually Risk assessments are done annually but
though not covering entitywide risks. continuously updated for emerging risks.
Internal audit standards partially conform to
the IPPF. the IPPF.
African Initiative Research Report | globaliia.org 85
Maturity Indicator III: Quality (continued)

Elements Sub-elements Public Sector Analysis Private Sector Analysis

Focus is broad but is not fully risk-based due
to risk assessment limitations. Areas covered Scope of work is broad including
1. Scope of audit work include compliance, financial, operational, compliance, financial, operational, and
performance, strategic, governance, and risk performance.
management.
D. Scope, 2. Quality of the audit reports Audit reports are timely and effectively Audit reports are of good quality,
reporting, and – effectiveness in identifying communicate findings including systemic effectively communicate findings and assist
follow up and communication of issues issues. management to address control weaknesses.
Systematic follow up of issues is in place.
However, there is delayed implementation of
3. Effectiveness in following Follow-up is systematic and leads to effective
audit recommendations. Audit committees
up on issues implementation of issues.
do not enforce implementation of
recommendations.
Arrangements for quality assurance are
E. Quality
1. Internal (monitoring, incomplete and partially conform to IIA Most internal audit functions are in the
assurance and
supervision, appraisal, standards. QAIP procedures issued in process of developing quality assurance
improvement
training, review of audit 2012. Periodic internal and external quality programs.
planning
assessments are not done.

Maturity Indicator IV: Resources

Elements Sub-elements Public Sector Analysis Private Sector Analysis

A. Adequacy of
1. Adequacy of staffing
staffing resources,
resources
including structure
1. Competency and
experience
B. Skills
2. Internal audit specific
certifications held
3. Highest educational level
C. CPE and 1. Access to and frequency
training of training
D. Technology 1. Use of CAATTs
Budget for internal audit staffing and training
Audit committees request budget resources
is insufficient and there is a shortage of
for the CAE to deliver the audit plan.
internal auditors.
Most internal auditors, though with diverse
skills (including accountants, civil engineers, Staff skills is a mix of accounting, auditing,
quantity surveyors, IT specialists, and and industry knowledge. Most internal audit
procurement specialists), have limited staff have good understanding of modern
understanding and experience of modern internal auditing skills.
internal auditing techniques.
Most internal auditors do not hold internal Most internal auditors do not hold internal
audit certifications; instead majority are audit certifications; instead majority are
CPAs. A few have CFE, CIA, and CISA. CPAs. A few have CFE, CIA, and CISA.
Majority of internal audit staff hold a first Majority of internal audit staff hold a first
university degree. university degree.
Due to outsourcing model, most internal
Limited access to training due to funding
auditors have good access to training.
challenges. Training is provided by IIA
Training is provided by IIA affiliate,
affiliate, accounting bodies, and Big Four
accounting bodies, and Big Four accounting
accounting firms.
firms.
Limited use of CAATTs. Teammate has
been adopted but only few licenses in use.
Most internal audit functions do not use Use of CAATTs is limited.
computerized automated audit tools and
techniques.

86 globaliia.org | The Institute of Internal Auditors

9. UGANDA
Maturity Indicator I: National Context

Elements Sub-elements Analysis

1. Presence of university programs in
No programs on internal auditing in universities/colleges.
internal auditing
There is a general appreciation of the role and value of internal audit.
2. Understanding and recognition by
Government (ministry of finance, planning and economic development)
A. Professionalism, key stakeholders of the role and value
is working with development agencies to provide internal audit capacity
education programs, of internal auditing
building.
recognition
3. IIA membership and GDP per capita Substantial: IIA membership to GDP per capita is 78.2%

4. IIA certification and GDP per capita Low: IIA certification to GDP per capita is 6%

1. Transparency International 2015 CPI

B. National indicators The 2015 CPI ranking is 139/168
rank (/168)
for fraud and
corruption 2. Transparency International 2015 CPI
The 2015 CPI score is 25%
score (/100)
1. Role of audit firms in delivering
Public accounting firms provide outsourced and co-sourced internal audit
internal audit services (assurance and
services.
consulting)
2. Role of audit firms in delivering
Public accounting firms deliver training and guidance in internal audit.
C. Role of audit training and guidance for internal audit
firms and accounting 3. Role of accounting associations in
associations Accounting bodies provide training and guidance on internal audit services
delivering training and guidance for
to their members. Accounting bodies regulate internal auditors.
internal audit
4. Role of accounting associations in
Training and guidance for audit committees is more focused on
delivering training and guidance for
accounting/financial reporting.
audit committees
Insufficient budgets and lack of qualified staff resources render the need
for funding from development agencies significant. Though there are a
1. Availability of funding for internal number of them on the ground including World Bank, DFID, and GIZ,
audit training commensurate with need there is no coordinated effort to match funding to resource needs in an
D. Development efficient way; hence the available resources end up being insufficient. No
agencies development agency has taken a lead in internal audit capacity building
There is significant need for advocacy from development agencies. The
2. Delivery of advocacy for internal
World Bank, DFID and GIZ are on the ground but the capacity building
auditing commensurate with need
needs are significant.
Limited advocacy is provided through legislation: Bank of Uganda requires
E. Role of other 1. Provision of advocacy for internal all banks and financial institutions to have internal audit functions; Capital
bodies including stock auditing Markets Authority (CMA) Uganda requires listed companies to have
exchange and central internal audit functions.
bank 2. Setting of internal audit related Bank of Uganda enforces its internal audit requirements through regular
policy and corresponding enforcement review of implementation.

African Initiative Research Report | globaliia.org 87

Maturity Indicator II: Governance

Elements Sub-elements Public Sector Analysis Private Sector Analysis

Requirements for internal audit in private
sector are limited to financial institutions and
Requirements for internal audit in public sector is
listed companies. Using an implied provision in
regulated by the Public Finance and Management
regulation 31 (i) of the CMA Conduct of Business
Act 2015, Section 47 (Internal Auditor General), 48
Regulations, the CMA in August 2015, issued
(internal audit) and 49 (Audit committees).
a regulatory notice to market players requiring
1. Requirement for Negatives in legislation: The requirement
them to put in place internal audit procedures
internal audit for internal auditors to report to accounting
for compliance with securities laws and risk
officers impairs their independence because
management policies and provide internal audit
the accounting officers are the ones who control
reports to CMA annually. Bank of Uganda also
internal resources and also they appraise the
A. Legislation, has audit function requirements under section 59
internal auditors.
regulation, subsection 7(a) of the Financial Institutions Act
corporate 2004.
governance 2. Status of internal Heads of internal audit part of middle and/or Head of internal audit is part of senior
code, and audit senior management. management.
national policies
3. Standards for The use of IPPF standards is defined in relevant Use of IPPF standards is recommended but not
internal audit guidelines for internal audit. defined.
Requirements to have audit committees are
Organizations follow best practice using the King
4. Audit committees included in Public Finance and Management Act
Report, IIA, and IFAC.
2015.
Bank of Uganda monitors compliance with
requirements through regular inspections. CMA
5. Monitoring and There is limited monitoring of compliance with
monitors through its annual inspection and
enforcement laws and regulations on internal audit.
enforces laws through suspension of licenses or
revocation of licenses.
B. Leadership
The minister of finance, planning and economic
and tone at 1. Extent to which
development provides general support for
the top in CEOs and boards CEOs and audit committees provide oversight to
internal audit. Internal audit function in central
organizations support internal internal audit work.
government elevated from department to
from CEOs and audit
directorate.
boards
Internal auditor general reports functionally
reports to Parliament and administratively to
Permanent Secretary /Secretary to the Treasury.
CAE reports functionally to the audit committee
C. Positioning 1. Reporting lines The IAG is in same level as other department
of the board and administratively to the managing
of internal audit and independence heads. At Ministry level, heads of internal audit
director.
in organizations report administratively to the accounting officer/
and its effective heads of agencies and functionally to the Audit
independence Committee
2. Positioning of
internal audit within Internal audit is largely a second line of defense. Internal audit is largely a third line of defense.
the organization
Audit committee comprises non executive
1. Independence people, normally retired civil servants in various
Audit committee comprises independent non
and strength of professions such as teachers, engineers,
executive directors. The chairman is always a non-
audit committee lawyers, accountants, doctors among others.
executive director.
D. Audit membership Appointments are made by the minister in charge
committees of the respective ministry.
Members of audit committee have a limited
2. Understanding of Majority of members of audit committee have no understanding of internal audit. Priority is an audit
internal audit appreciable understanding of internal audit. committee member always has a financial expert
among the members.

88 globaliia.org | The Institute of Internal Auditors

Maturity Indicator II: Governance (continued)

Elements Sub-elements Public Sector Analysis Private Sector Analysis

3. Powers of the
Audit committees are not involved in the Audit committees are involved in the
audit committee to
appointment of heads of internal audit but they appointment of heads of internal audit and they
include hire and fire
approve work plans, budgets, and other resources approve work plans, budgets, and other resources
CAE, approve audit
for internal audit. for internal audit.
D. Audit plan and resources
committees 4. Effectiveness
Audit committees are not effectively providing
in holding the
Audit committees are not independent; hence are oversight. According to CMA, some companies
CAE and the
not effective in holding anyone accountable. do not have framework to govern internal audit
organization to
functions.
account
1. Organizational There is no formal risk management framework in
E. Risk
risk management most public entities, which have not yet embraced Limited/inconsistent approach to managing risk.
management
maturity risk management practices in their operations.

Maturity Indicator III: Quality

Elements Sub-elements Public Sector Analysis Private Sector Analysis

A. Audit strategy 1. Presence and strength of charter, Some internal audit functions have basic Some internal audit functions have
and charter sense of purpose, and focus audit charters and strategies. audit charters and strategies.
1. Extent to which audit planning
Audit planning is risk-based, but not aligned
B. Audit planning, is risk-based and aligned with to strategic objectives.
Audit planning is partially risk-based.
including risk strategy
assessment 2. Frequency of risk assessment and Risk assessments are completed annually,
Risk assessment is done annually.
alignment with strategy but not institutionwide.
C. Use of 1. Use of robust internal audit Internal audit standards partially conform to Internal audit standards partially
standards standards the IPPF. conform to the IPPF.
Focus is broad but is not fully risk-based due
to risk assessment limitations. Areas covered
include compliance, financial, operational,
Scope of audit work is broad including
performance, strategic, governance, and risk
1. Scope of audit work financial, operational, compliance,
management. Face challenges in conducting
performance, etc.
specialized and technical audits in the
D. Scope, areas of IT audits, performance audits, and
reporting, and forensics.
follow up 2. Quality of the audit reports –
Reports are issued and distributed quarterly. Reports are of good quality and
effectiveness in identifying and
Poor quality of Internal audit reports. effectively communicate issues.
communication issues
Follow up process is not systematic resulting
3. Effectiveness in following up on in weak implementation of internal audit
Follow up process is systematic.
issues issues – delayed responses to internal audit
issues in the majority of the entities.
Arrangements for ongoing quality assurance
program are under development. A good
E. Quality foundation has been put in place by Some internal audit functions
assurance and 1. Internal (monitoring, supervision, appointing a dedicated resource to facilitate have quality assurance programs
improvement appraisal, training, review of audit the QAIP. There there was no evidence of while others are in the process of
planning annual review of the IAF operations and development.
submission of the resulting report to the
accounting officer, or the audit committee.

African Initiative Research Report | globaliia.org 89

Maturity Indicator IV: Resources

Elements Sub-elements Public Sector Analysis Private Sector Analysis

A. Adequacy
of staffing Budget for internal audit staffing and training
1. Adequacy of staffing Shortage of internal auditors with proper skill
resources, is insufficient (limited funding), and there is a
resources set.
including shortage of a proper skill set.
structure
Most internal auditors, though with
diverse skills (including accountants, civil
With outsourcing and co-sourcing model with
1. Competency and engineers, quantity surveyors, IT specialists
the big 4 audit firms, internal auditors have a
experience and procurement specialists), have limited
good understanding of internal audit.
understanding and experience of modern
internal auditing techniques.
B. Skills
Most internal auditors do not hold internal
Most internal auditors do not hold internal
2. Internal audit specific audit certifications; instead majority are CPAs.
audit certifications; instead majority are CPAs.
certifications held Other certifications held are CIA, CISA, and
Other certifications held CIA, CISA, and CFE.
CFE.
3. Highest educational Majority of internal audit staff hold a first Majority of internal audit staff hold a first
level university degree. university degree.
Limited access to and frequency of training
mainly due to funding and lack of college/
C. CPE and 1. Access to and university curriculum on internal audit. Training Limited access to formal training on internal
training frequency of training is provided by IIA affiliate, accounting bodies audit.
and public accounting firms. Majority are 40
CPE and below.
Internal audit use CAATTs such as IDEA, Limited use of CAATTs. Most of internal audit
D. Technology 1. Use of CAATTs
Enterprise Risk Assessor. functions do not use CAATTs.

90 globaliia.org | The Institute of Internal Auditors

10. ZAMBIA
Maturity Indicator I: National Context

Elements Sub-elements Analysis

No programs on internal auditing in universities/colleges. IIA–Zambia is
1. Presence of university programs in
currently working on a curriculum for government internal auditors on
internal auditing
behalf of Ministry of Finance.
There is a general appreciation of the role and value of internal
2. Understanding and recognition by audit. Government (ministry of finance and planning) is working with
A. Professionalism,
key stakeholders of the role and value development agencies to provide internal audit capacity building and also
education programs,
of internal auditing with IIA affiliate to design a curriculum for the government internal auditors
recognition
on behalf of Ministry of Finance.

3. IIA membership and GDP per capita Very Low: IIA membership to GDP per capita is 22%

4. IIA certification and GDP per capita Very low: IIA certification to GDP per capita is 2.3%

1. Transparency International 2015 CPI

B. National indicators The 2015 CPI ranking is 76/168
rank (/168)
for fraud and
corruption 2. Transparency International 2015 CPI
The 2015 CPI score is 38%
score (/100)
1. Role of audit firms in delivering
Public accounting firms provide outsourced and co-sourced internal audit
internal audit services (assurance and
services.
consulting)
2. Role of audit firms in delivering
Public accounting firms deliver training and guidance in internal audit.
C. Role of audit training and guidance for internal audit
firms and accounting 3. Role of accounting associations in Accounting bodies provide training and guidance on internal audit
associations delivering training and guidance for services. Most of the internal auditors are members of the local accounting
internal audit bodies.
4. Role of accounting associations in
Training and guidance for audit committees is more focused on financial
delivering training and guidance for
reporting and not internal audit.
audit committees
Though there are a number of development agencies on the ground
including World Bank, DFID, Finland and GIZ, there is no coordinated effort
1. Availability of funding for internal
to match funding to resource needs in an efficient way hence the available
audit training commensurate with need
D. Development resources end being insufficient. No development agency has taken a lead
agencies in internal audit capacity building.
There is significant need for advocacy from development agencies. The
2. Delivery of advocacy for internal
World Bank, DFID, Finland and GIZ are on the ground but the capacity
auditing commensurate with need
building activities are not coordinated.
1. Provision of advocacy for internal Limited advocacy is provided through legislation: Central Bank requires all
E. Role of other auditing banks and financial institutions to have internal audit functions.
bodies including stock
exchange and central Limited requirements are set for internal audit with little or no enforcement
2. Setting of internal audit related
bank in the case of financial institutions. For listed companies, legislation has not
policy and corresponding enforcement
been enacted to compel the companies to have an internal audit function.

African Initiative Research Report | globaliia.org 91

Maturity Indicator II: Governance

Elements Sub-elements Public Sector Analysis Private Sector Analysis

Requirements for internal audit in private sector
Requirements for internal audit in public are limited – not yet established. The Banking
sector is regulated by the Public Finance Act and Financial Services Act requires that all
No. 15 of 2004. Requirements limit internal banks have an internal audit function. There is
1. Requirement for internal audit’s role. The main internal audit functions no mention of internal audit in the conditions
audit are maintaining the pre-audit controls on for listing on the Lusaka Stock Exchange. The
expenditure, as well as assessing the overall Exchange recommends that the company
adequacy of the financial management systems has an internal audit function to enhance its
A. Legislation, and procedures in place. corporate governance structure, but it is not a
regulation, requirement.
corporate
governance Heads of internal audit is part of junior level Head of internal audit is part of senior
2. Status of internal audit
code, and management – two levels below director level. management.
national 3. Standards for internal The use of IPPF standards is defined in relevant Use of IPPF standards is recommended but not
policies audit guidelines for internal audit. defined in requirements.
Requirements to have audit committees
are included in Public Finance Act No 15 of Companies follow best practice in good
4. Audit committees 2004. According to section 12 of the Act, governance (e.g., King Report, OECD
the Secretary to the Treasury is mandated to principles of corporate governance).
appoint the audit cmembers.
5. Monitoring and There is no monitoring of compliance with laws Bank of Zambia monitors compliance with
enforcement and regulations on internal audit. requirements through regular inspections.
B. Leadership
and tone at
1. Extent to which CEOs
the top in The Minister of Finance and National Planning CEOs and audit committees provide oversight
and boards support
organizations provides general support for internal audit. to internal audit work.
internal audit
from CEOs and
boards
The Internal Auditor General reports
functionally to the Controller of Internal
Audit and to the Secretary of Treasury and
C. Positioning administratively to the Permanent Secretary Functionally, the head of internal audit reports
of internal 1. Reporting lines and Economic Management and Finance (EMF). to the board through the audit committee and
audit in independence The IAG position is a rank lower compared to administratively to the managing director or
organizations other department heads. At local government, CEO.
and its heads of internal audit report to town clerks
effective who are also their auditee. Their independence
independence is inherently impaired.
2. Positioning of
Internal audit is largely a second line of
internal audit within the Internal audit is largely a third line of defense.
defense.
organization
Audit committee comprises of five (5) members
– two (2) public officers, one (1) from the Law
1. Independence Association of Zambia, one (1) Zambia Institute Audit committees are usually comprised of
and strength of audit of Chartered Accountants and one (1) from any finance experts and chaired by a non executive
D. Audit committee membership other professional body. The audit committee director.
committees appoints a chairperson from the private sector
and preferably an accountant or a lawyer.
Members of audit committees have a limited
2. Understanding of Majority of members of audit committees have
understanding of internal audit. Focus is
internal audit limited understanding of internal audit.
finance expertise.

92 globaliia.org | The Institute of Internal Auditors

Maturity Indicator II: Governance (continued)

Elements Sub-elements Public Sector Analysis Private Sector Analysis

Audit committees are not involved in the
appointment of heads of internal audit. Heads Audit committees are somewhat involved in the
3. Powers of the audit
of internal audit are appointed by the Public appointment of heads of internal audit, but the
committee to include hire
Service Commission like all civil servants. appointment is mainly done by the CEO/MD.
and fire CAE, approve
D. Audit Also, audit committees have no control over Some audit committees do approve budgets
audit plan and resources
committees funding/resources of internal audit function. and other resources for internal audit.
But they approve internal audit work plans.
4. Effectiveness in Audit committees are not involved in
Audit committees have limited impact in
holding the CAE and the appointment of CAE nor do they have control
effectively holding organizations accountable.
organization to account over internal audit resources.
There is no formal risk management framework
E. Risk 1. Organizational risk in most public entities, which have not yet Limited/inconsistent approach to managing
management management maturity embraced risk management practices in their risk.
operations.

Maturity Indicator III: Quality

Elements Sub-elements Public Sector Analysis Private Sector Analysis

A. Audit 1. Presence and strength Most internal audit functions have basic
Some internal audit functions have basic audit
strategy and of charter, sense of charters but do not have internal strategies.
charters and strategies.
charter purpose, and focus Those who have are not comprehensive.
Audit planning is not risk-based. Audit plan
consists of (i) Ongoing routine pre- and Audit planning is partially risk-based. Most
1. Extent to which audit
post-audit activities of expenditures files, CAEs have an annual plan that guides the work
B. Audit planning is risk based and
procurement procedures, accounting ledgers, of the internal audit function but these are not
planning, aligned with strategy
etc., and (ii) specific audits of targeted projects usually updated regularly for emerging risks.
including risk or functions.
assessment
2. Frequency of risk
Most internal functions have no formal risk Risk assessments are completed infrequently
assessment and alignment
assessments. and are not aligned to organizational strategy.
with strategy
C. Use of 1. Use of robust internal Internal audit standards partially conform to Internal audit standards partially conform to
standards audit standards the IPPF. the IPPF.
Internal audit functions have a narrow scope.
Most cover financial audits and sometimes act Internal audit has a narrow scope. The main
1. Scope of audit work as a control through pre audits of payments. focus is usually financial and compliance (where
Scope also includes performance, operational, the company is in a regulated industry).
compliance, and systems.
D. Scope,
2. Quality of the audit
reporting, and Reports are issued and distributed regularly.
reports – effectiveness Audit reports re of good quality and effectively
follow up Poor quality of Internal audit reports attributed
in identifying and communicate findings.
to staff competence/capacity.
communication issues
Follow up process is incomplete mostly Follow-up processes are systematic and
3. Effectiveness in
hampered by constrained budgets. Action is effective in implementation of audit
following up on issues
taken on major issues but with delay recommendations.
E. Quality
1. Internal (monitoring,
assurance and Arrangements for quality assurance are not fully Most internal functions do not have a
supervision, appraisal,
improvement operational. formalized quality assurance program.
training, review of audit
planning

African Initiative Research Report | globaliia.org 93

Maturity Indicator IV: Resources

Elements Sub-elements Public Sector Analysis Private Sector Analysis

A. Adequacy of staffing Limited resources (financial and staffing)
1. Adequacy of staffing Shortage of internal auditors with
resources, including and there is a shortage of specialized skill
resources specialized skill sets.
structure sets.
Most internal auditors though with diverse Most internal auditors though with diverse
1. Competency and skills have limited understanding and skills have limited understanding and
experience experience of modern internal auditing experience of modern internal auditing
techniques. techniques.
Most internal auditors do not hold internal Most internal auditors do not hold internal
B. Skills 2. Internal audit specific
audit certifications; instead the majority are audit certifications; instead the majority are
certifications held
CPAs. CPAs.
Majority of internal audit staff hold a first Majority of internal audit staff hold a first
3. Highest educational
university degree, mostly in accounting or university degree, mostly in accounting/
level
business administration. business administration.
Limited access to and frequency of
training mainly due to funding and lack of
1. Access to and college/university curriculum on internal Limited access to formal training on internal
C. CPE and training
frequency of training audit. Training is provided by IIA affiliate, audit.
accounting bodies and public accounting
firms. Majority are 40 CPE and below.
Most of internal audit functions do not
Most internal functions use manual
use CAATTs. Most use Microsoft Excel but
D. Technology 1. Use of CAATTs systems. There is limited use of CAATTs
Teammate is widely used for those that use
mostly ACL, IDEA, and TeamMate.
automated auditing tools.

94 globaliia.org | The Institute of Internal Auditors

11. ZIMBABWE
Maturity Indicator I: National Context

Elements Sub-elements Analysis

Internal audit is offered as a stand-alone bachelor’s degree program in two
1. Presence of university programs in
of Zimbabwe’s universities. Also, other accounting degrees offer internal
internal auditing
auditing as a module with the degree program.
There is limited understanding and recognition by key stakeholders of
the role and value of internal auditing. The government adoption of
2. Understanding and recognition by
A. Professionalism, the corporate governance code for state enterprises and parastatals
key stakeholders of the role and value
education programs, shows some recognition for internal audit. However, the use of internal
of internal auditing
recognition audit function in government as a control function demonstrates
misunderstanding of the value of internal audit.

3. IIA membership and GDP per capita Moderate: IIA membership to GDP per Capita is 67.6%

4. IIA certification and GDP per capita Low: IIA certification to GDP per Capita is 5.8%

1. Transparency International 2015 CPI

B. National indicators The 2015 CPI ranking is 150/168
rank (/168)
for fraud and
corruption 2. Transparency International 2015 CPI
The 2015 CPI score is 21%
score (/100)
1. Role of audit firms in delivering
Public accounting firms provide outsourced and co-sourced internal audit
internal audit services (assurance and
services.
consulting)
2. Role of audit firms in delivering
Public accounting firms deliver training and guidance in internal audit.
C. Role of audit training and guidance for internal audit
firms and accounting 3. Role of accounting associations in Accounting bodies (ACCA, CIMA, ICAZ and CPA) provide training and
associations delivering training and guidance for guidance on internal audit services. Most of the internal auditors are
internal audit members of these local accounting bodies.
4. Role of accounting associations in
Training and guidance for audit committees is more focused on financial
delivering training and guidance for
reporting/accounting and not internal audit.
audit committees
There is significant need for funding on internal audit capacity building.
1. Availability of funding for internal The World Bank is currently funding projects on the ground with IA
D. Development audit training commensurate with need components. AfDB has previously (2014) financed 5 CPE courses for central
agencies government IAs and sponsored 20 members to write CIA.
2. Delivery of advocacy for internal
Advocacy by World Bank and AfDB is not sufficient.
auditing commensurate with need
Limited advocacy is provided through legislation: Reserve Bank of
E. Role of other 1. Provision of advocacy for internal
Zimbabwe requires all banks and Financial Institutions to have internal
bodies including stock auditing
audit functions.
exchange and central
bank 2. Setting of internal audit related Limited requirements are set for internal audit in the Reserve Bank
policy and corresponding enforcement requirements.

African Initiative Research Report | globaliia.org 95

Maturity Indicator II: Governance

Elements Sub-elements Public Sector Analysis Private Sector Analysis

Requirements for internal audit in private sector
Requirements for internal audit in public sector is
are limited – not yet established. Are set in
1. Requirement for regulated by the Public Finance Management Act
new National Code on corporate governance.
internal audit (No. 11-2009). Requirements limit internal audit role
Reserve Bank require financial institutions to
– internal audit is to perform a monitoring role.
have internal audit functions.
Heads of internal audit are part of middle level
2. Status of internal management – one level below director level. There Head of internal audit is part of senior
A. Legislation, audit is no representation of internal audit function at management.
regulation, senior management level.
corporate
Use of standards is defined in requirements for
governance
3. Standards for The use of IPPF standards is recommended but not some sub-sectors. For example, Reserve Bank
code, and
internal audit defined in relevant guidelines for internal audit. of Zimbabwe guidelines require the internal
national policies
audit functions to conform to IIA requirements.
Requirements to have audit committees are
There are effective requirements for having an
included in the Public Finance Management Act.
4. Audit committees audit committee. National Code of corporate
However, the requirements are not effective as
governance provides for audit committees.
central government has no audit committees.
5. Monitoring and There is no monitoring of compliance with laws and Reserve Bank monitors compliance with
enforcement regulations on internal audit. requirements through regular inspections.
B. Leadership
and tone at
1. Extent to which Government adopted National Code of corporate Adoption of National Code of corporate
the top in
CEOs and boards governance for parastatals and state-owned governance, and audit committees provide
organizations
support internal audit enterprises. oversight to internal audit function.
from CEOs and
boards
Legislation provides for internal audit functional
reporting to the audit committee and administrative The heads of internal audit functionally report
C. Positioning 1. Reporting lines and
reporting to the Permanent Secretary (central to the chairman of the board, audit committee
of internal audit independence
government) and the CEO for (state-owned and administratively report to the CEO.
in organizations enterprises/parastatals).
and its effective
independence 2. Positioning of
Internal audit is largely a second line of defense
internal audit within Internal audit is largely a third line of defense.
performing a control monitoring role.
the organization
Audit committee comprises at least 3 members
– one not employed by public service, majority
not from the same ministry, and the chair is a non
1. Independence
executive of the ministry served by the particular Audit committees comprise non-executive
and strength of
audit committee. Currently, central government has directors who represent the board, and are
audit committee
no audit committees. In other government entities, chaired by a non executive chairman.
membership
lack of independence of audit committees and lack
of objectivity in decision making processes have
been exposed in the media.
D. Audit 2. Understanding of Majority of members of audit committee have no Members of audit committee have a general
committees internal audit appreciable understanding of internal audit. understanding of internal audit.
3. Powers of the audit Audit committees are involved in the
Where audit committees exist, they are not involved
committee to include appointment of heads of internal audit though
in the appointment of heads of internal audit nor do
hire and fire CAE, in some organizations appointment is done by
they have a say over funding/resources of internal
approve audit plan the CEO. Audit committees do have a say on
audit function.
and resources budgets and other resources for internal audit.
4. Effectiveness in
Audit committees are not independent (mainly due
holding the CAE and Audit committees effectively provide oversight
to political interference) hence are not effective in
the organization to to the internal audit functions.
holding anyone accountable.
account
E. Risk 1. Organizational risk There is no formal risk management framework in
Consistent approach to managing risk.
management management maturity government.

96 globaliia.org | The Institute of Internal Auditors

Maturity Indicator III: Quality

Elements Sub-elements Public Sector Analysis Private Sector Analysis

Some internal audit functions have
A. Audit 1. Presence and strength
Internal audit functions have basic audit charters and charters incorporated in the internal
strategy and of charter, sense of
strategies. audit plans and the strategies are
charter purpose, and focus
aligned to the organization’s strategies.
1. Extent to which audit Audit planning is not risk-based. Special audits dominate
Internal audit functions practice risk-
B. Audit planning is risk based audit programs, rather than routine system confirmations
based audit planning.
planning, and aligned with strategy and risk based internal auditing.
including risk 2. Frequency of risk Most internal audit functions prepare annual work plans Frequency of audit areas is based on the
assessment assessment and but they are not regularly updated to reflect emerging level of risk assigned to the specific audit
alignment with strategy risks. area.
C. Use of 1. Use of robust internal Internal audit standards partially conform
Internal audit standards partially conform to the IPPF.
standards audit standards to the IPPF.
Internal audit has a narrow coverage and scope as majority
Internal audit covers a broad scope
of time is spent vouching and checking departmental
1. Scope of audit work including compliance, financial, and
assets. Internal audit coverage includes financial,
operational.
compliance, operational, and performance of the entity.
D. Scope, 2. Quality of the audit
reporting, reports – effectiveness Reports are issued and distributed regularly but not always Audit reports are of good quality and
and follow up in identifying and timely and effective. effectively communicate findings.
communication issues
Follow-up process is incomplete and mostly hampered by Follow-up processes are systematic and
3. Effectiveness in
unsatisfactory management responses or no responses at effective in implementation of audit
following up on issues
all. recommendations.
E. Quality
1. Internal (monitoring, Arrangements for quality assurance are
assurance and There are no formal arrangements for quality assurance.
supervision, appraisal, incomplete. External quality assessments
improvement Internal audit is a compliance and advisory function.
training, review of audit are not in place.
planning

Maturity Indicator IV: Resources

Elements Sub-elements Public Sector Analysis Private Sector Analysis

A. Adequacy of Very limited trained internal auditors.
1. Adequacy of Resources for internal audit function are well planned and
staffing resources, There is need to skill up internal audit
staffing resources organized.
including structure staff.
Most internal auditors have very limited Due to outsourcing to the Big Four, most internal auditors have
1. Competency
understanding and experience of good understanding and experience of modern internal auditing
and experience
modern internal auditing techniques. techniques
2. Internal
B. Skills Very few internal auditors hold internal Some internal auditors hold internal audit qualifications (CIA,
audit specific
audit certifications (CIA and CGSA). CFSA, CGSA, CCSA).
certifications held
3. Highest Majority of internal audit staff hold a Majority of internal audit staff hold a first university degree. Some
educational level first university degree. hold MBAs in addition.
Limited access to and frequency
1. Access to and of training mainly due to lack of Internal audit services mostly offered by Big Four whose staff have
C. CPE and
frequency of funding. Training is provided by IIA good access to and frequency of training. Training is provided by
training
training affiliate, accounting bodies and public IIA affiliate, accounting bodies and public accounting firms.
accounting firms.
There is limited use of computerized automated auditing tools
Most internal audit functions do not
and techniques. Most use Microsoft Excel and word processing.
use CAATTs. Majority of internal audit
D. Technology 1. Use of CAATTs TeamMate is the widely used tool for those that use automated
processes are not computerized. They
auditing tools. Selected internal functions are now using data
use manual traditional systems.
analytics tools such ACL and IDEA.

African Initiative Research Report | globaliia.org 97

APPENDIX III: Country Interviewees/Survey Respondents

LIST OF INTERVIEWEES/ Association of National Accountants

SURVEY RESPONDENTS KPMG Nigeria
Nigeria
Country Interviewees/Survey Respondents IIA affiliate Leaders

ACCA Nigeria
PwC Botswana

Director of Internal Audit, Government IIA affiliate Leaders

Botswana
Director of Internal Audit, Botswana
International University of Science & Technology Head of Internal Audit – Rwanda Government
Rwanda
IIA affiliate Leaders Head of National Bank of Rwanda

Head of Capital Market Authority

Accounting and Auditing Board of Ethiopia
Ethiopia
IIA affiliate Leaders Head of Internal Audit – Tanzania Government

Tanzania Head of Bank of Tanzania

PwC Ghana
IIA affiliate Leaders
KPMG Ghana

Deloitte Ghana Supreme Auditor General

Ghana
Institute of Chartered Accountants Ghana PwC Uganda
Uganda
Supreme Auditor General Head of Capital Market Authority

IIA affiliate Leaders IIA affiliate Leaders

PwC Kenya Head of Lusaka Stock Exchange

KPMG Kenya Supreme Auditor General

Kenya Supreme Auditor General Zambia IIA affiliate Leaders

Head of Internal Audit – Kenya Government Head of Internal Audit, Zambia Government

IIA affiliate Leaders PwC Zambia

Supreme Auditor General PwC Zimbabwe

Head of Internal Audit, Malawi Government Deloitte Zimbabwe

Malawi Zimbabwe
IIA affiliate Leaders IIA affiliate Leaders

PwC Malawi Supreme Auditor General

98 globaliia.org | The Institute of Internal Auditors