Action Plan to be Implemented by Internal Audit Division, Ministry of Finance

The Internal Audit Division (IAD) of the Ministry of Finance (MOF) operates as a cornerstone of the public financial management framework. In alignment with international standards (IIA Global IPPF) and the national Public Finance Management Act, the Division provides independent, objective assurance and advisory services designed to add value and improve the operations of the Ministry. This Action Plan outlines the concrete measures, timelines, and responsibilities that will guide the IAD over the next eighteen months, with a focus on enhancing risk-based auditing, building data analytics capability, and reinforcing accountability across all MOF entities.

The plan responds to the evolving fiscal environment, emerging risks in digital financial systems, and the increasing demand for transparency from citizens and international partners. It is structured around five strategic pillars: (1) audit coverage and risk-based planning, (2) methodology and digital transformation, (3) human capital and competency development, (4) stakeholder engagement and followup, and (5) quality assurance and performance measurement.

By the end of Q1 2025, IAD will complete a Ministry-wide risk assessment covering all 14 departments, 6 attached agencies, and 3 special funds. The assessment will incorporate quantitative financial data, qualitative interviews with senior management, and a review of emerging risks such as cybersecurity threats to the Treasury Single Account and procurement irregularities in large infrastructure projects. The resulting risk register will be updated semi-annually and used to drive the 20252026 audit work plan.

The audit plan will allocate resources according to risk ratings. High-risk areas (e.g., public debt management, tax revenue collection, and subsidy disbursements) will receive 60% of total audit hours. Medium-risk areas (e.g., payroll, travel expenditures) will receive 30%, and low-risk areas (e.g., routine administrative processes) the remaining 10%. The plan will be presented to the Audit Committee of the Ministry by 31 March 2025 for approval.

In addition to the annual cycle, IAD will conduct two thematic audits each year:

• Digital payments audit covering the transition to electronic fund transfers and mobile money for social transfers.
• Climate finance audit examining the use of green bonds and climate adaptation funds administered by the Ministry.

Special investigations may be initiated at the request of the Minister or the Permanent Secretary, with clear terms of reference and a maximum completion timeline of 60 working days.

IAD will adopt a standardized audit methodology based on the IIAs International Professional Practices Framework (IPPF) and adapted to the public sector context. All audit engagements will follow a consistent structure: planning memorandum, risk and control matrix, work programs, working papers, draft report, management response, and final report. Templates and checklists will be deployed via the divisions collaborative platform by April 2025.

A dedicated Data Analytics Unit (DAU) will be established within IAD, staffed with three analysts. The unit will use ACL and Python scripts to perform continuous monitoring of high-volume transactions, including procurement payments, VAT refunds, and salary disbursements. Key performance indicators for the DAU include: 100% coverage of high-risk transaction streams by Q3 2025, and at least five data-driven audit findings per quarter. A pilot anomaly detection system for the Treasury ledger will be launched in June 2025.

The division will procure and implement a cloud-based audit management platform (TeamMate or equivalent) to support planning, time tracking, finding tracking, and management reporting. The system will be fully operational by September 2025, with training completed for all 42 auditors.

IAD currently has 42 approved positions (38 filled). The plan includes the recruitment of 4 additional auditors: two senior IT auditors, one forensic auditor, and one data scientist. The organizational structure will be realigned into three divisions: Financial & Compliance Audit, Performance & IT Audit, and Risk & Advisory Services. Each division will be led by a Deputy Director reporting to the Director of Internal Audit.

Every auditor will complete a minimum of 40 hours of continuing professional education (CPE) per year. Priority areas include:

• Certified Internal Auditor (CIA) preparation 8 staff enrolled in 2025.
• Certified Information Systems Auditor (CISA) 4 staff targeted.
• Data analytics and audit technology mandatory workshop for all auditors by June 2025.
• Public procurement and forensic audit advanced course for 12 senior auditors.

A mentorship program will pair each new auditor with a senior colleague for the first 12 months. Quarterly performance dialogues will replace the traditional annual appraisal to foster continuous feedback.

The Director of Internal Audit will participate in the Ministrys Senior Leadership Forum and report functionally to the Audit Committee. A refreshed Code of Ethics and Conflict-of-Interest Declaration will be signed by all IAD staff annually. Any breach will be addressed through the Ministrys disciplinary framework.

IAD will issue quarterly audit activity reports to the Audit Committee, summarizing engagements completed, key findings, implementation status of recommendations, and emerging risk themes. The Director will hold bi-monthly meetings with the Permanent Secretary to discuss systemic issues and strategic risks. An annual stakeholder satisfaction survey will be conducted, targeting a rating of 4.0/5.0 or higher.

A centralized recommendation tracker will be maintained in the audit management platform. Each finding will be assigned a unique identifier, a responsible action owner, a target date, and a status (open, in progress, closed, or not implemented). The system will generate automatic reminders at 30, 15, and 7 days before the due date. The status of all open recommendations will be reviewed by the Audit Committee every quarter.

IAD will cooperate fully with the National Audit Office, the Public Accounts Committee, and anti-corruption agencies. All external audit findings related to MOF will be analyzed by IAD, and a management action plan will be developed within 30 days of the publication of any external audit report. Progress on implementation will be reported publicly through the Ministrys transparency portal.

IAD will conduct an annual internal quality assessment (self-assessment) using the IIAs Quality Assurance and Improvement Program (QAIP) framework. The assessment will cover compliance with standards, efficiency of audit processes, and stakeholder satisfaction. Results will be reported to the Audit Committee and used to update the annual improvement plan.

An independent external quality assessment will be scheduled for Q1 2026, to be performed by a team of peer reviewers from other ministries or a qualified external firm. The assessment will evaluate the divisions conformity with the IIA Standards and provide recommendations for enhancement. The last external review was conducted in 2022; the target is to achieve Generally Conforms in all areas.

The following KPIs will be tracked monthly and reported quarterly:

KPI	Target 2025	Target 2026
Percentage of audit plan completed	90%	95%
Average time from fieldwork completion to draft report issuance	15 working days	10 working days
Implementation rate of audit recommendations (within 12 months)	75%	85%
Staff CPE compliance rate	100%	100%
Stakeholder satisfaction score (out of 5)	3.8	4.2
Data analytics coverage of high-risk transactions	100%	100%

The action plan will be executed in three phases:

• Phase 1 Foundation (Q1Q2 2025): Risk assessment completed, audit management software procured, DAU established, methodology documents approved, and training plan launched.
• Phase 2 Integration (Q3Q4 2025): Full deployment of digital tools, first thematic audits commenced, recommendation tracker operational, and first internal quality assessment conducted.
• Phase 3 Maturity (Q1Q2 2026): External quality assessment, second annual stakeholder survey, achievement of all KPIs, and preparation of the 20272028 strategic audit plan based on lessons learned.

Implementation of this plan requires an estimated additional budget of USD 380,000 over eighteen months, covering:

• Audit management software licensing and implementation: USD 120,000
• Data analytics tools and training: USD 65,000
• Recruitment and capacity building: USD 95,000
• External quality assessment: USD 50,000
• Miscellaneous (travel, workshops, certifications): USD 50,000

Funding will be sourced from the Ministrys capacity development allocation and development partner support. A detailed cost-benefit analysis has been submitted to the Finance and Budget Division for approval.

Key risks to the successful implementation of the action plan include:

• Resistance to change mitigated through continuous communication, involvement of staff in system design, and visible sponsorship by the Audit Committee.
• Data access limitations addressed by signing memoranda of understanding with IT and Treasury divisions, and by embedding data analysts within business units during pilot phases.
• Staff turnover mitigated through competitive remuneration, a positive work environment, and a succession plan for critical roles.
• Budget constraints managed through phased implementation and prioritization of high-impact activities; alternative funding sources will be explored.

This Action Plan represents a decisive step toward transforming the Internal Audit Division of the Ministry of Finance into a modern, risk-aware, and data-driven assurance function. By embedding a culture of continuous improvement, investing in our people, and leveraging technology, IAD will not only safeguard public resources but also provide forward-looking insights that support better decision-making across the Ministry. Every auditor, manager, and stakeholder has a role to play in this journey. The division commits to reporting transparently on progress through quarterly updates published on the MOF intranet and discussed in the Audit Committee. With dedicated execution and collective ownership, we will build an internal audit function that is truly fit for the future.