Implementing International Standards: A Regional Perspective

by the Supreme Audit Institution of Portugal, Chair of the European Organization of Supreme Audit Institutions Task Force on Audit and Ethics

Supreme Audit Institutions (SAIs) are expected to make a difference to the lives of citizens, particularly as nations embark on achieving the Sustainable Development Goals (SDGs). To do so, SAIs must act as model organizations. They must lead by example.

Adhering to the International Organization of Supreme Audit Institutions (INTOSAI) Code of Ethics—using International Standards of Supreme Audit Institutions (ISSAI) 30 as guidance—is one way to gain, and assure, society’s trust and assist in SDG realization.

The European Organization of Supreme Audit Institutions (EUROSAI) established the Task Force on Audit and Ethics (TFA&E) to support European SAIs in promoting ethical conduct. Since its establishment in 2011, the group has implemented several initiatives, including identifying SAI ethics management practices and analyzing those practices against international standards and recommendations; publishing ethical infrastructure documentation; organizing ethics-focused seminars and workshops; and, most recently, participating in the ISSAI 30 revision review.

The TFA&E employed a proactive approach in reviewing the ISSAI 30 revision by encouraging active participation among all members; integrating discussion sessions at events and workshops focused on how SAIs can impact the new standard; ensuring all relevant information was channeled to the ISSAI 30 review team; and contributing to the review’s assessment report.

Similarly, the task force, recognizing the need to provide guidance on putting the new standard into practice, spearheaded the “How to Implement ISSAI 30” publication. The guide, created in partnership with the European Court of Auditors (ECA) and using the inputs obtained from numerous workshops and international events, was approved at the X EUROSAI Congress in Istanbul, Turkey. Though the guide is based primarily on employing regional scope, given its general nature, all SAIs may find it useful.

The revised ISSAI 30 is demanding. In addition to the five core values that drive SAI staff behavior, the standard establishes a set of overall SAI responsibilities aimed at creating an environment conducive to integrity, that include:

• Implementing an ethics control system;
• Adopting, applying and publicizing a code of ethics;
• Emphasizing the importance of ethics and promoting an ethical culture;
• Setting the tone through actions and SAI leadership examples;
• Requiring staff and external provider engagement in ethical conduct and providing guidance and support; and
• Solving conflicts between ethical requirements.

“How to Implement ISSAI 30” helps SAIs create an ethical environment by furnishing practical guidance on how to construct ethics control system elements. While it is based on best practices and useful tools, the guideline should be adapted locally to each SAI, as ethics, its management and control, heavily depends on environmental surroundings and culture.

“How to Implement ISSAI 30” is organized in two sections and includes six annexes:

Section A: Approach to Implementing an Ethics Control System; and

Section B: Main ethical issues a SAI Usually Faces Regarding Each of the Components of the Ethics Control System; Concrete Alternatives and Good Practices Available to Deal with Them. The good practices component is expected to be regularly updated as SAIs continue to implement revised ISSAI 30 and new, practical experience is gained.

Annex 1: Good practice references identified in the different areas;
Annex 2: Important ethics leadership attitudes and initiatives;
Annex 3: Ethical dilemmas staff may face that should be discussed;
Annex 4: Decision modeling to help individuals address ethical dilemmas;
Annex 5: Examples of conflicts of interests; and
Annex 6: Self-assessment checklist concerning gifts and hospitality

Key elements found in the guide include:

Components of the Ethics Control System. Code of ethics; leadership and tone at the top; ethics guidance; ethics management; and ethics monitoring.
Put ethics in context. In setting up the ethics control system, the SAI must consider its culture, as well as its legal and social systems.

Participative approach. The SAI must proceed in an inclusive manner.

Act transparently. The SAI must act in a transparent manner and provide relevant information on its ethical behavior.

Design the ethics control system on the basis of a well-prepared organizational ethics strategy. SAIs must design ethics control systems based on an overall strategy to address specific vulnerabilities and risks.

How to Address Ethical Dilemmas. A good practice model for individuals to address ethical dilemmas should include four main steps:

• Analyze the problem to assess whether it involves a right-versus-right situation (real dilemma) or a right-versus-wrong situation (compliance issue);
• Evaluate the situation and provide a solution based on the values at stake and assess the consequences;
• Check whether other persons involved (management, colleagues) agree with identified options or look into alternatives; and
• Evaluate the real impact of the action taken and any feedback.

Policies and checklist relating to gifts and hospitality. It is well established and recognized that integrity, independence, impartiality and objectivity can be affected by: receiving gifts or hospitality from auditees or suppliers; accepting meals during audit assignments; and receiving free travel, accommodation or entertainment.

Nevertheless, practice varies:

• Some SAIs completely forbid staff from receiving any gifts or other benefits;
• Many have specific rules and guidance, either included in law or established in their code of ethics. Provisions specify the nature and the maximum value of the gifts that might be accepted; in some cases the auditors must also ask for permission from management before accepting any gifts.
• Several SAIs consider that staff should not accept inappropriate or inadequate gifts and provide guidance for defining these concepts.
• In most cases, social and protocol gifts must be handed over to the institution.

To read the “How to Implement ISSAI 30” guideline and to obtain additional informational materials (including videos) on ethics topics, visit www.tfae.tcontas.pt.