Guidance Note on-“Compliance audit of Regulatory bodies”
Reference No: 725 /16-PPG/2016 Dated: August 24, 2016
Regulatory bodies are established either as a separate legislation or as a part of the general legislation governing a particular sector. The roles and responsibilities of Regulatory bodies include regulating the particular sector and aiding the executive in policy formulation. With increasing number, growing complexities and challenges in the functioning of regulatory bodies, the role of audit is also beginning to assume greater significance. Therefore planning, conduct and reporting of all types of audits- Financial, Performance and Compliance Audits of Regulatory bodies would have to follow the requisite rigour.
Financial Audit of accounts of Regulatory bodies is a long standing practice within the Department. The Department has also brought out guidelines on Performance Audit of Regulatory bodies in 2004. Compliance audits of Regulatory bodies, however, have largely been conducted as transaction audits with a limited scope. The objective of this guidance note is, therefore, to mainstream the planning and conduct of compliance audits of Regulatory bodies on a regular basis.
2. Salient features of the Compliance Auditing Guidelines
The Department has adopted the Compliance Auditing Guidelines envisaging a risk based approach to compliance audit, which requires preparation of annual compliance audit plans by:
a) Definition of Apex Auditable Entities and Audit Units
Extracts from Compliance Auditing Guidelines
The Department/Sector in the State Government or the Central Government being the top layer would be defined as the Apex Auditable Entity.
(Para 3.4)
Audit Unit is defined as a unit, which has one or more of the following attributes:
- a) substantial devolution of administrative and financial powers;
- b) functional autonomy; and
- c) operational significance with reference to achievement of objectives of the Apex Auditable Entity.
(Para 3.5)
The database of audit universe capturing the Apex Auditable Entities, Audit Units and Implementing Units as envisaged in the Compliance Auditing Guidelines would have to be prepared, maintained and updated regularly by the respective field offices. The database in each field office would have to include the Regulatory bodies under their audit jurisdiction. This database would form the basis of planning annual compliance audits.
b) Risk profiling
Extracts from Compliance Auditing Guidelines
The risk based approach to planning compliance audits is about focussing audit efforts on the perceived high risk areas/activities. Risk profiling of the Apex Auditable Entities and their Audit Units has to be done considering their structures, roles they are expected to perform and compliance requirements.
(Para 3.9)
Field offices are required to consider the Apex Auditable Entity’s environment from a broader perspective to evaluate the high risk areas/activities of the entity. The Compliance Auditing Guidelines provide the broad dimensions for evaluation of the high risk areas as also the various documents/literature and aspects that should be reviewed for assessment of risk.
Based on such a risk assessment the field offices have to prepare the annual compliance audit plan comprising a selection of Apex Auditable Entities and a sample of Audit Units and Implementing Units. Planning and conduct of compliance audit of Regulatory bodies under the audit jurisdiction of field offices would have to be part of the annual compliance audit plan of the respective field offices.
3. Scope of compliance audit of Regulatory bodies
The scope of compliance audit of Regulatory bodies would involve consideration of the following functions of Regulatory bodies. Guidance on determining the scope of compliance audit with reference of each of the functions is as under:
- (i) Quasi-judicial functions: This is a settled issue within the Department that the orders passed by regulatory bodies in exercise of their quasi-judicial functions, as its legality and justiceabilityshall not be within the scope of audit.
- (ii) Audit around the quasi-judicial functions: This includes the process of reaching decisions, availability of all required information and implementation of decisions, excluding the legality and justiceability. Considering the complexity and sensitivity involved, the varying nature and scope of each review/audit around the quasi-judicial functions across regulatory bodies, the conduct of compliance audit involving an audit around the quasi-judicial functions would be regulated on a case to case basis with the orders of the Competent Authority in Headquarters.
- (iii) Internal administration: These aspects are already being audited and as such auditing the internal administration of regulatory bodies would continue as at present.
- (iv) Executive functions: The executive functions such as granting licences/approvals and clearances, charging fees, tendering and contract management etc., which are generally based on or guided by a set of criteria/framework as also the process of executive decision making would have to be covered in compliance audits.
|