MFIs FAQs

• Audit Basics
  • What is the purpose of a financial audit?
  • What are management's responsibilities?
  • What are the roles and responsibilities of the Audit Committee?
• Selecting an Audit Firm
  • What are key factors in selecting auditors?
  • How do we evaluate audit firms?
  • How often should we re-tender for auditors?
  • What if no auditors with MFI experience are available?
• Negotiating the Price
  • Are there any "rules-of-thumb" for audit costs?
  • What are some key negotiating points?
• Preparing for the External Audit
  • Why conduct an interim audit?
  • Who should be involved in the audit preparation?
• Audit Standards
  • How can we know our auditor adheres to international standards?
• The Role of the Internal Auditor
  • What is the purpose of an internal audit?
  • At what point should we hire an internal auditor?
  • How do the roles of management and the board differ regarding the internal audit?
• Monitoring the Audit
  • How does MFI management monitor the audit?
  • How often should we have audit progress meetings?
  • Who does management work with on the audit team?
• Using the Audit
  • How do we use the management letter?
• Recommended Disclosure Guidelines
  • How can we get a copy of the guidelines?
  • Will this increase the cost of the audit?

Audit Basics

Almost all businesses can benefit from having an independent person or firm reviewing their activities.

An external financial audit is a formal review by a Certified Public Accountant (CPA) of a business entity's accounts and financial statements based on specific audit standards and performed by an auditor.

The output of the financial audit is an opinion on the financial statements and its notes and, when requested (and we recommend always requesting one in the TOR) a management letter.

Obtaining good quality MFI audits has proven rather challenging for several reasons related to both the MFIs and auditors. MFIs because they often have incomplete or non-existant terms of reference for the audits, poor preparation, and little understanding of how to gain value from and audit, for example. Auditors because they often do not take the time to recognize the unique requirements of an MFI audit. The experience internationally has been mixed with the quality of most MFI audits being weak.

It is not the role of the auditor to produce the financial statements with their accompanying notes. These are the responsibility of the management of the audited company.

There are also many other types of audits that can be performed by external auditors including operational and MIS audits, special purpose audits, agreed-upon procedures, reviews, and compilations.

An external audit is a critical tool for MFI managers and board members, donors, and investors because it provides a professional, independent opinion on the state of the institution. MFI boards should consider external audits as integral to the operations of the MFI.

In order to gain full benefit from external audits it is critical that MFI management understand the audit process (), the outputs of an audit, and what to do with those outputs.

For small MFIs it may be preferable for them to set as a priority the strengthening of their internal control systems and management information systems rather than depleting scarce resources in contracting a poor quality audit. With strong systems, the institution will be better able to manage its ongoing controls issues, and set a better foundation for solid growth.

What is the purpose of a financial audit?

The purpose of a financial audit is to provide assurance that the financial statements are being presented and the accounting is being conducted in accordance with specified standards, norms, and regulations. The audit report is written to the Board of Directors of the organisation being audited. The board of directors seeks the assurance that management has accounted for and presented the transactions appropriately in the financial statements. The board often releases the audit report to certain stakeholders (debt holders, equity holders, donors, prospective donors, government ministries/agencies etc.) and may choose to distribute it widely.

The audit report also states what accounting principles are being applied in the organisation. Generally Accepted Accounting Principles and International Accounting Standards () are often cited as accounting principles followed. The experienced reader will be able to identify from the type of principles applied if there are any adjustments that should be made to his/her analysis of the financial information to provide comparative value with financial statements prepared under other principles.

What are management's responsibilities?

The audited firm's management is responsible for preparing the financial statements (while the auditor's responsibility is to express an opinion on those statements). Preparing accurate financial statements starts with creating an internal control environment that will facilitate the preparation of the financial statements. The internal control environment should insure that correct and complete transactions are included (such as loan payments from clients) and questionable transactions are excluded or corrected before entry (such as property with an inflated value).

In practice, it is often the auditor who drafts the final presentation of the financial statements, using reports prepared from systems that are maintained and controlled by the organisation being audited. The distinction mentioned above is more of substance over form. The auditor has no responsibility for recording or summarizing the daily transactions of the organisation, but to report on the accuracy of how the financial information has been presented. Through audit tests, the auditor is likely to identify audit adjustments that should be recorded in the financial statement to make them "materially" accurate. The fact that these adjustments are found, and that the management of the organisation being audited agrees to make these adjustments, does not change the ultimate responsibility of the audited firm to create the financial statements.

What are the roles and responsibilities of the Audit Committee?

In general and depending on the size of the MFI, the audit committee has the following roles and responsibilities (from Grant Thornton's The Expanded Role of the Audit Committee ):

• Assist the board of directors in assuring the integrity and credibility of the company's financial reporting system
• Assist the board of directors in preserving the company's assets by understanding the company's risk environment and how it deals with risk
• Assist the board of directors in the oversight of the financial reporting process, development of financial policies and the internal control structure, and facilitate communication of these matters between the board, company management, the independent auditors, and the internal auditors
• Assist the board of directors in their evaluation of the aggressiveness or conservatism of accounting principles used to report significant transactions and estimates of their effect on the financial statements
• Act as the primary liaison between the company's financial management and the independent auditors and serve as an intermediary when views differ on the accounting treatment
• Meet privately with management, the internal auditors, and the independent auditors at least once a year and also hold an executive session to discuss company management's performance
• Act as "watchdog" - a key deterrent to corporate improprieties
• Oversee the company's internal control structure to assure operational effectiveness and efficiency, reduce the risk of unreliable financial reporting, protect the company's assets from misappropriation, and encourage legal and regulatory compliance
• Discuss any reported weaknesses in the internal control structure with the internal and independent auditors and review management actions taken in response to the auditors' recommendations as presented in the management letter or otherwise.
• Communicate regularly with the MFI's senior financial officer, especially to understand the corporate environment and culture and to evaluate top management's "corporate mentality"
• Make recommendations to the board of directors for the selection of the company's independent auditors
• Know the scope of procedures performed by the independent auditors and their results, including a clear understanding of the CGAP disclosure requirements
• Exercise an active oversight role over internal auditors, including reviewing their mandate, staffing, budgets, and audit results and demanding a detailed annual presentation, plus ongoing updates
• Be prepared to discuss any risk of fraud brought to the committee's attention by the independent auditors and the auditors' recommendation for timely action

Selecting an Audit Firm

The board of directors is the ultimate governing body of an MFI, responsible for overseeing management. The external auditor is usually commissioned by-and ultimately responsible to-the board of directors. Occasionally the external auditor will also have a contractual or fiduciary relationship with an outside stakeholder such as a donor. Ensuring that clear terms of reference are developed and that the most qualified auditors are selected in the tendering process are among the board's key responsibilities.

Usually, a board will select an audit committee from among its non-management members. This committee is responsible for developing the TOR, managing the selection process, overseeing the audit itself, and receiving and addressing the audit reports.

In commissioning an external audit (), the audit committee normally consults with the MFI's board and management, determines the scope of services and terms of reference, circulates the terms of reference to qualified audit firms, selects and engages a firm to do the work, and oversees the auditors during the audit process.

Overall, the MFI must seek a balance. It wants auditors who are rigorously objective. At the same time, it wants to work with audit staff who have the ability and judgment to understand the unique circumstances and challenges of microfinance institutions. The relationship must be constructive and the dialog free flowing where the MFI feels that the auditor's recommendations are supportive and the auditor feels that the MFI is making a good-faith effort to address valid concerns.

In order to accomplish this balance the MFI must be careful in the development of its TOR and in the bidding process. Objective criteria must be developed to manage the selection of the firm.

An MFI's relationship is usually long-term and thus the audit should improve year after year based on the increasing auditor's increasing knowledge of the MFI and improved preparation and accounting by the MFI.

What are key factors in selecting auditors?

Auditors are engaged by and report to the Board of Directors. It is common for an MFI's board to designate an audit committee , which will write the Terms of Reference (Scope of Work) for the external audit, receive proposals to do the audit work, select the audit firm, receive reporting from the external auditors, and report back to the overall board.

The key to selecting an audit firm is having a clear understanding of exactly who will do the audit, because the experience, competence, and integrity of the firm and the individual staff who will actually do the work is the most important selection criterion.

It is common-and costly-to give too little attention to the quality of the firm and its commitment to provide staff members who the MFI thinks are competent to do the onsite work.

It is equally common-and equally costly-to give too much weight to other factors such as the elegance of the proposal document, scores on elaborate, mathematically weighted evaluation formulas, and even the price.

The main focus in choosing an auditor must be on evaluating the firm and the specific people it will put on the job. It is critical to the quality of the audit that such an evaluation be conducted prior to commissioning the audit ().

How do we evaluate audit firms?

In evaluating the competence and character of the audit firm, attention should be paid to its reputation in the business community, supplemented by private conversations with customers of the firm.

Staff at the bank supervisory authority are usually familiar with the firms that audit banks, and will often respond candidly to a private inquiry from someone they trust to keep their comments confidential.

Well-connected members of the MFI's board of directors can often be very useful in this kind of reference checking.

Checking with local accounting bodies () about the firms you are considering may prove useful depending on the strength of the accounting body.

How often should we re-tender for auditors?

MFIs should enter into audit contracts with external auditors with the expectation that they will serve as auditors for several years. The first year audit is often a learning period and hardly ever goes as expected for the auditor or for the MFI. It is unlikely that replacement auditors would do much better, if the auditors were not retained for a subsequent year. Knowledge and efficiencies can be gained in subsequent years that should reduce costs over time. For example, internal control checklists need only be updated in subsequent years rather than created from scratch.

This objective does not prohibit the MFI from revisiting the selection of the audit firm at least casually every year to evaluate if the MFI was satisfied with the previous year's audit. Some important questions the audit committee should ask in assessing the audit, include:

• Did the audit firm accomplish the audit on time and within the budget presented (or have good reasons for issuing the report later than planned and going over budget)?
• Did the audit firm treat the MFI with professionalism and integrity?
• Were issues identified that allowed the MFI to run is operations better than before?
• Was the audit firm fair in presenting audit adjustments and explaining why the adjustments were necessary (and not capitulate under management pressure)?
• Are there issues of independence that may be compromised, such as the MFI offering an employee of the audit firm a job?
• Did the audit outputs mirror the request in the Terms of Reference (TOR ()) agreed upon during the contracting phase of the audit?

These are just some of the questions that the board audit committee (with assistance of management) might consider annually prior to re-engaging the same audit firm. Often these questions must be addressed to the annual general meeting of members where the audit firm renewal is approved (or rejected).

A negative response to any one of the above questions is not a reason to discharge the auditor for a subsequent year. However, any dissatisfaction by the board (or the audit committee) should certainly be discussed with the auditor before re-engagement.

There are also times when, after assessing the results of the first audit, the Audit Committee may recognize that the audit firm is simply not capable of producing at a level of quality expected. In this case, the auditors should be changed and the issues of dissatisfaction should be made clear in the new search to new bidders for the audit.

There is no hard and fast rule that states how often, or even if, an audit firm should be rotated. Some may find that the audit firm puts the audit on "autopilot" and does very little creatively from year to year to keep up with the changing nature of the organisation's business. If that is the case, an organisation should consider the possibilities of sending the audit out for bid. Other organisations may find that they enjoy a very good relationship with their auditors, receive good value for the audit fee, and retain them for 10, 20 or more years.

Click on the icon for an interesting article on the reasons why firms switch audit firms ()

What if no auditors with MFI experience are available?

If there are no audit firms with MFI experience available, there the MFI should consider several options:

1. Are there auditors available with Banking or financial institution experience?
2. Are there auditors available with non-profit experience (if the MFI is a non-profit)?
3. What do other MFIs do for auditing services in the same region?
4. What do donors/bankers/equity holders suggest?
5. What would the increased cost be to the MFI to gain auditors with MFI experience (from another region)? How would that extra cost be paid?
6. How willing to learn about MFIs are the inexperienced auditors? For example, will they read, understand and implement the CGAP audit guide ()?
7. Is there a consultant that could help educate the MFI and the audit firm? Would the audit firm be receptive to share in the cost of this individual?

Negotiating the Price

As with firms in other industries (), the level of effort required to audit an MFI varies greatly, ranging from 100 hours for a small MFI to 1,700 hours for a large MFI with many branches and loans. The level of effort also depends on whether there is a professional internal audit function producing evidence that is considered reliable by the external auditors. The cost of the audit will depend not only on the level of effort, but also on the rates at which the audit firm charges the time of its staff. You should research to gain an understanding of the price of an audit for similarly structured MFIs in your area. This will help you to develop an acceptable price range even before you start negotiating.

The proposal from the audit firm will typically identify the anticipated hours for staff at each level from partner to secretary. Be careful to make sure there is enough time allocated for the senior people to adequately review the work of their juniors, but not too much management time allocated for minor tasks.

Make sure to integrate the work that your internal auditor does with that of the audit firm. If the firm has confidence in your internal auditor, this will translate into savings both in preparation and actual audit time. Hiring a good internal auditor should save a large portion of his or her salary just in the reduction of the external audit cost. Audit firm pre-approval of your internal auditor can make it much easier to get them to reduce the hours allocated, and thus billed, and save you money.

Also, use your preparation as leverage in the negotiations. If you can be fully prepared for the audit, you should be able to get the auditors to reduce the proposed time required and thus the price.

Remember, price is not the only component of determination for selecting an audit firm. A low price will often result in a bad quality audit as a result of poor audit planning and execution performed by junior auditors with limited experience or skills.

Once the TOR () and the price are agreed upon, the audit firm will provide an engagement letter to the MFI management.

Are there any "rules-of-thumb" for audit costs?

Unfortunately, the only rule-of-thumb that exists in audit pricing involves the standard rates that the audit firm charges, how many audit staff and management are estimated (and actually needed) to complete the audit, and how much time it takes them. Thus, the price quote depends on the relative salary scale for professional accountants in the country in question. For example, a senior accountant may be priced at $150 per hour in the USA, $50 per hour in Guatemala, and $25 in Bangladesh.

The number of hours an audit firm will spend on the most important audit item, the loan portfolio, depends on the size of the loan portfolio of the MFI, and may depend more so on the number of loans rather then the overall balance of the loan portfolio. (Consider that if a loan portfolio of $1,000,000 consisted of one loan, it could be tested relatively quickly, where a more diversified loan portfolio of 10,000 $100 loans would require much more testing.)

However, the larger MFIs may be able to cut down on the number of hours spent on its portfolio testing if it has good internal controls and applies them consistently. Good controls allow an audit firm to test the controls and determine if they can be relied upon. This will reduce the amount of other testing that an auditor would perform to gain comfort with the loan portfolio.

In addition, the existence of an appropriately trained internal auditor can reduce the amount of time spent by the external audit firm auditing the institution.

Some relative benchmarks () do exist for larger businesses in particular geographic regions. Initially, at least, these can provide information about what is commonly tracked in terms of audit costs.

What are some key negotiating points?

MFIs may have success in negotiating with external audit firms if they point out the following issues:

• MFIs are likely to grow in number everywhere (there are an estimated 10,000 of them worldwide at this point), thus providing opportunity to specialize in this type of audit.
• The existence of good internal controls (if it's true) within the institution. Good internal controls can be tested and relied upon, if they exist. If they do not exist, additional testing will need to be performed, and this increases the cost.
• The existence of a well trained, internal auditor whose skills and competencies are recognized by the external auditor
• The ability to have the audit performed in the "off-season", if that is possible. May - October is typically a slow time for external auditors. If the MFI's fiscal year falls between April and August, this may be feasible. Donors and other stakeholders may or may not be flexible in moving the dates of when they expect the external audit, so this should be investigated with them before offering it as a solution.
• Expressed clarity about how the MFI functions. The first time an external audit firm negotiates for an audit with an MFI they are likely to price very conservatively since they do not understand the nature of the MFI audit until they have performed it. Thus, by being explicit in the TOR about the structure of the balance sheet and what will be needed to audit it, the external auditor may gain a better understanding of the actual requirements of the job. This may help in getting the price down.
• The desire of the MFI to negotiate a fixed fee contract. With a fixed fee contract, the MFI is guaranteed a certain price unless the audit firm uncovers items that require additional time. When those issues are uncovered, the auditor should approach the MFI client and discuss them, and any fee increases that will accompany their resolution before going forward, rather than surprising the MFI with a larger bill after the audit is over. A clear understanding of this process is key to meet expectations when the audit is over.

Preparing for the External Audit

Proper and complete preparation for the external audit will save any institution much money and grief. Preparation starts with maintaining comprehensive policies which guide the accountability of the staff and require the maintenance of the accounts per generally accepted accounting principles. Next is frequent review of the accounts and compliance with the MFI's policies, preferably by a qualified internal auditor.

MFI management is entirely responsible for the production and approval of the financial statements and thus must take an active role in preparing for the audit.

A critical preparation activity is the planning meeting between the MFI management and the Audit partner and manager. During this meeting, MFI management can outline specific areas of concern with regards to the audit so that auditors can pay particular attention to those areas as part of their comprehensive audit. During or soon after this meeting, MFI management should receive a series of audit schedules from the auditors. These schedules must be completed by the MFI before the audit can begin. In setting the date for the audit, management must take into consideration the time required to complete the schedules, PRIOR to the commencement of the audit. The key to an efficient audit is having everything ready for the auditors when they arrive.

Often MFIs will have their auditor conduct an interim audit during the year to minimize the duration between year-end and the presentation of the audit results.

Why conduct an interim audit?

An interim audit refers to audit work that is conducted during the fiscal year, usually as a means of minimizing the work and time involved in concluding the audit after the fiscal year. An MFI might, for example, have an interim audit covering the first nine months of activity for the fiscal year. Then, at the end of the fiscal year, most of the auditing will focus on the last three months of activity. This allows for a comprehensive audit and early completion of the audit reports.

Also, if the auditor plans to rely on internal controls, some extensive testing may be done at an interim period, when the auditor is less busy.

An interim audit does not usually yield any formal reports from the external auditors. However they do often result in informal recommendations that will help the MFI better prepare for the final part of the audit, and reduce the issues noted in the management letter.

MFIs should consider recommending auditors conduct an interim audit when:

• The year-end audit needs to be issued fairly rapidly after the end of the fiscal year
• Immediate tests of controls are warranted.
• Interim procedures can be performed during an auditor's off-season when the auditor might offer a discount for hours spent during the off-season, thus reducing the time required after the end of the MFI's fiscal year which may correspond to the auditor's prime "busy season".

Conducting an interim audit will likely:

• Cause the final audit to be issued more quickly
• Cause the entire audit to cost less

The reduction in cost results from the possibility that the audit firm can be persuaded to offer some discount for the ability to audit during their slow season. In some cases, this has resulted in a 5% to 15% reduction in the overall cost of the audit.

Who should be involved in the audit preparation?

Audit preparation starts at the board level and works down through the organisation.

The board (or audit committee of the board) commissions the audit (), defines the TOR, interviews, and approves the external audit firm. They also receive communications from the audit firm during fieldwork, and receive the official audit report and management letter.

Acting on direction from the board, management, starting with the executive director, the financial manager, the accounting manager, or the internal auditor assists the auditor in obtaining evidence supporting the accuracy of the financial statements. The board delegates day-to-day mission achievement to management, and as such, management will field these requests for information instead of the board.

Generally, coordination of the audit falls upon the most senior individual who deals exclusively with accounting functions to coordinate the audit functions for the MFI. The audit firm will most likely give this accounting manager (lead accountant) a list of audit schedules that need to be prepared and dates when the schedules should be prepared. S/he delegates the preparation of such schedules to individuals in charge of those areas, such as bank reconciliations, portfolio reconciliation, fixed assets, and others. Several general requests are also made, such as copies of the board of director meeting minutes, which can be made by administrative assistants (secretaries) or others.

Some items will require the analysis of the executive director and the financial manager, such as assuring that the loan loss reserve is appropriate and recorded properly. The MIS manager may be required to generate a trial balance through the computer system and save it on diskette, tape, or send it via e-mail to the auditors for conversion into "lead sheet" format. Finally, certain donors, banks, clients, and attorneys need to be sent letters confirming account balances, and legal issues.

The "Prepared by Client" or "PBC" list identifies the above and other items needed from the MFI for the auditor to be most efficient.

Audit Standards

Audit standards () are determined, depending on where the business is located, through several sources including statutory law, an auditing standards body, and through case law.

The audit standards set by the International Auditing Practices Committee (IAPC) () are generally accepted as the primary audit standards. Related to these, auditors will require that MFIs comply with International Accounting Standards (IAS) (). MFI management should confirm that its auditors will be following these standards.

Statutory requirements are often national and dictate the minimum requirements of an audit. These may be different depending on the ownership structure of the company. These requirements also often dictate what type of institution must be audited, the scope of the audit and the format of the audit report. In several countries, there is no requirement for NGOs, a common registration type for MFIs, to contract an external audit.

Additionally CGAP offers guidelines for financial statement disclosures to make audits more comprehensive and thus more useful to MFIs and others.

How can we know our auditor adheres to international standards?

The best method of assurance that the audit is being conducted appropriately is education on what are appropriate audit procedures and what is expected generally of an external auditor. It is important for the MFI management to understand the particular issues as international audit standards () relate to MFIs. The International Accounting Standards Committee (IASC) () maintains international accounting standards ().

As the MFI matures, the MFI may consider a former auditor (who is intimately familiar with international auditing standards) as a member of the staff of the MFI (as an internal auditor, accounting manager, or financial manager) or consider the value of having an external auditor in current practice on the board of the MFI (as chair of the audit committee, for example). In the latter case, under no circumstances should the auditor performing the audit work sit on the board of directors of the MFI, as independence would be impaired.

The Role of the Internal Auditor

The internal auditor conducts the internal audits () of the MFI based on directions from management and the board. Several key factors help to improve their effectiveness. These include:

• Independence,
• Adequate resources,
• Senior management support, and
• Full understanding of their role and responsibilities

Generally, the internal auditor's () activities revolve around the several areas within the institution. These include:

• Financial audits where the auditor analyses the economic activity of the MFI, reviewing for accuracy, timeliness, and completeness.
• Compliance, which includes a comprehensive review of financial and operating controls to assess their conformity with written policies, laws, established standards, regulatory requirements, donor agreements.
• Operational which includes a comprehensive review of portfolio, savings, cash and other operations assessing efficiency and effectiveness, as well as risk of the various activities.
• Fraud Investigations are another important aspect of the work of the internal auditor. A fraud investigation is a confidential review of the circumstances surrounding misconduct either on the part of clients or staff. The internal auditor, based on evidence derived from audit activities, often initiates these investigations.

They are usually full-time employees of the MFI, though sometimes MFIs will contract external auditors to perform the internal audit function. This will impair the independence of the auditor or firm relative to the annual audit.

Internal auditors can play a critical role in improving the efficiency of an external audit by obtaining guidance from the external auditors and collecting audit evidence in a manner that can be used with confidence.

The relationship between internal and external auditors can become strained at times. Management should ensure a fruitful and collaborative relationship between these parties.

What is the purpose of an internal audit?

According to the Institute of Internal Auditors (IIA) (), the purpose of an internal audit () is to evaluate the adequacy and effectiveness of a company's internal control system and determine the extent to which assigned responsibilities are actually carried out. The IIA's five audit scope standards outline the internal auditor's responsibilities:

1. Review the reliability and integrity of operating and financial information and how it is identified, measured, classified, and reported.
2. Determine whether the systems designed to comply with operating and reporting policies, plans, procedures, laws, and regulations are actually being followed.
3. Review how assets are safeguarded and verify the existence of assets as appropriate.
4. Examine company resources to determine how effectively and efficiently they are utilized.
5. Review company operations and programs to determine whether they are being carried out as planned and whether they are meeting their objectives.

The internal auditor is usually an employee of the organisation being audited and follows management's requirements of the audit.

At what point should we hire an internal auditor?

The MFI should consider hiring an internal auditor when it is economically feasible and operationally beneficial to do so.

From a purely direct cost perspective, some argue that an MFI should hire an internal auditor once it has 100 employees. At this point, it is argued, an MFI will be easily able to cover the costs incumbent in the new position.

Others argue for hiring the initial internal auditor much earlier. Their arguments centrearound capacity building and strengthening internal controls early in the life of the MFI to protect it from large problems. Their considerations include:

• It takes time to develop the audit function and an MFI should have the internal auditor in place to oversee it as you build their capacity.
• It takes time to build the capacity of the internal auditor. They should have full capacity when the institution really needs their oversight rather than searching for someone when the institution is already over due in terms of institutional needs.
• MFIs tend to enter a new phase of growth at about 3-5,000 clients requiring a reassessment of policies and internal controls. It helps to have an independent internal auditor to focus on their development without vested interests.
• MFIs often provide a great deal of independence to their field staff and elevate supervisors from the credit officer staff. Thus, independent staff are often weakly supervised. The internal auditor can provide an important oversight to this operational structure.
• When major control problems occur early in a program's life it can create serious problems for future growth. An early internal auditor can help detect and avoid such problems before their impact is excessive on the institution.

An MFI, using a group or individual based methodology may have staff servicing between 5,000 and 20,000 clients, once there are 100 staff members. Much of this work is done independently and controls must be strong and frequently reinforced. This requires the expertise of an internal auditor. An appropriate approach might be to hire a junior internal auditor (at least one year audit experience) at about 3,000 clients and a senior internal auditor and about 10,000 clients. This varies significantly depending on the structure of the MFI. In general, the more decentralized the activities, the sooner you need an internal auditor.

If having an internal auditor can eliminate 1/3 to 1/2 of the work that is needed by the external audit firm, and the external audit costs $10,000, then an annual salary of $3,333 to $5,000 may be justifiable. Explicit conversations with the external audit firm can help in identifying cost savings attributable to the internal audit function. Do not just expect that by hiring an internal auditor that costs of the audit will decline rapidly if you have not had this conversation beforehand.

Occasionally, companies will hire audit firm staff from the audit firm they work with in order to staff their internal audit position. If the MFI feels that one of the members of the external audit team would make a good employee, it is important that this fact not be discussed until after the audit report is issued for the year the staff member is working on the audit.

How do the roles of management and the board differ regarding the internal audit?

Roles of management and the board with respect to the internal auditor:

MANAGEMENT

• Day-to-day supervision
• Facilitation of access to all areas of institution
• Requests special audits
• Provides necessary resources
• Receives copies of audit reports
  • Enforces response provision by affected departments/staff
  • Oversees correction/implementation of IA recommendations

BOARD

• Oversight of IA function
• Oversees job description preparation and IA hiring process, and finalizes selection of senior internal auditor
• Designates a person (audit committee chair) to act as board contact for internal auditor
• Assesses performance of IA
• Conducts periodic salary assessments
• Mediates issues between management and the IA
• Receives IA report at board meetings
• Approves annual IA work plan
• Assigns special audits

The ultimate authority regarding the internal audit function is the Board of Directors.

Monitoring the Audit

Much work was done in developing the Terms of Reference for the audit and in selecting the "right" external audit firm. While conducting the audit (), it is important to remain vigilant and hold the auditors accountable for the results, process, and timing agreed upon in the TOR (). It is not uncommon for MFI management, once they have selected the "right" audit firm, to step back from the process only to find when it is too late that the firm did not comply with the TOR.

Through management oversight of the audit process and its own staff in relation to the needs of the auditors, coupled with audit progress meetings with weekly findings presented and discussed, the MFI should be able to adequately monitor the external audit process. The day-to-day management overseer of this process is often the senior accounting officer, who should occasionally report on the progress to the Senior Manager who reports to the Board of Directors' audit committee. The audit committee should request an update meeting during the audit with the auditors.

Frequently audits are rushed to satisfy statutory or other deadlines. It is helpful for MFI management to ask for a draft audit report well in advance of the audit deadline so that they can properly review it and get the auditors back to complete the work if the requirements of the TOR have not been fully satisfied.

How does MFI management monitor the audit?

Once the board (or audit committee) has hired the auditor, it is up to management to work with the auditor in order to complete the audit within the time frame agreed to in the TOR. The board (or audit committee) should have direct conversations, both formal and informal, with the auditors, as well as with management, during the course of the audit.

While conducting the external audit (), there are several areas on which MFI management should focus. These include:

1. Audit Schedules: External auditors will base their timing on the assumption that the audit schedules are complete when they need them. If audit schedules are not available when requested, delays and cost overruns result. It falls to management to track the progress of schedule preparation in order to have them prepared and reviewed by management before the planned start of the audit. If these are not ready, management should give sufficient advance notice and postpone the audit until the schedules are complete.
2. Staff responsiveness: Once the auditors are at the MFI reviewing the schedules and other documents, they will have many questions to confirm and clarify information. Management must make sure that these issues are addressed accurately and efficiently. Often department heads are designated to respond to relevant audit inquiries. Auditors will often present a list of issues to senior management who can then quickly provide or generate a response.
3. Loan portfolio and savings accounts Confirmations: Formal traditional balance confirmations letters are not recommended relative to MFI loan and savings accounts. Confirmation of these balances will require client visits and are likely to increase the costs of the audits.
4. Other confirmations. However, auditors will need to confirm MFI deposit and loan balances with banks, and investment balances with others, as well as donor disbursements to the MFI through traditional means. The banks and donors return these notoriously slowly. It is critical that MFI management prepare the confirmations for the auditors to send out immediately after the end of the fiscal year and then continue to follow them up until all are received. Missing confirmations may lead to a qualified audit.
5. Field Visits: Field visits require preparation. Management must ensure that these visits are properly planned. Once the auditors are in the field, management should meet with them frequently (daily, especially in the beginning) to make sure the auditors understand what they are looking for while in the field. It is not uncommon for an MFI to pay for two weeks of a junior auditor's time only to find out that they had no idea of what they were doing. Diligent monitoring of this process is critical especially since an audit firm will often send junior people to do the field audits.

How often should we have audit progress meetings?

Audit progress meetings should occur at regular intervals, when all those involved in the audit process need communications. Certain formal meetings are appropriate for the audit committee (or a representative from the audit committee). These should be held with management (where appropriate) and the senior audit staff at least once during audit planning, during the audit itself, and on presentation of the audit reports by the audit firm.

Other meetings should be held between the audit manager and senior staff of the MFI on a weekly basis during the audit.

No one should be alarmed if MFI management is asked to leave the room when the auditors talk privately to the board of directors. This is a necessary step in making sure that the reporting relationship from the external auditor to the board of directors is clear. If a sensitive issue such as fraud needs to be discussed with the board of directors, there needs to be an appropriate channel established so that the concern can be raised and evaluated immediately.

Management and auditors should work out a schedule for these regular meetings to eliminate any audit surprises at the end of the audit timeline. Generally, the MFI should know the status of the work.

As it is the most important and significant asset, the external auditor should consider starting with the loan portfolio section of the audit. In addition, this area is most likely to take extra time. Communication upfront regarding irregularities (perhaps in the way loan files are kept from one field credit officer to another) should be addressed by MFI management to the auditors during audit planning rather than waiting for auditors to discover them.

Auditors should be left to coordinate and conduct their own work when needed, and not be micromanaged by the MFI.

Limiting the scope and access to records and information can result in a qualified opinion, so MFIs should be as open as possible with their records, while keeping on top of what is going on during the audit.

Who does management work with on the audit team?

The daily contact between MFI management and the audit team is generally done between the lead accountant and the audit senior. The audit senior typically has a 3-7 years of audit experience and is responsible for the day-to-day administration of audit activities. S/he typically leads a team of 1-3 other auditors who perform tasks based on their experience level.

However, the MFI should have ready access to the audit partner and audit manager if there appears to be a problem with the conduct of the audit senior.

Using the Audit

Many MFIs contract an external audit simply because they are required to by donors or statutory requirements. They receive the reports, distribute them, and put them away. The board may or may not even comment on them. This is unfortunate, not only because of the investment made in the external audit process, but because of the valuable information left sitting on the shelf.

The major output of the external financial audit is the audit opinion. Additionally, we highly recommend requiring a management letter from the auditors and this requirement should be stated in the TOR.

The audit opinion simply provides the overall comment of the auditors on how well the MFI's financial statements reflect what is really happening in the MFI, while the management letter provides a detailed listing of issues found during the audit with suggestions by the auditors for addressing them.

The Board should discuss these documents and develop a strategy for improvement where necessary. It is recommended to have all board members sign an acknowledgement sheet noting that they have seen the audit reports.

These two documents can be important tools for the MFI in improving their operations and controls, as well as providing external confirmation of their financial reports. This confirmation is a necessary input to obtaining credit and enticing investors.

How do we use the management letter?

1. What is the content of the management letter?

   The management letter () contains required correspondence between the auditor and the MFI, which principally consists of internal control weaknesses and recommendations. When an auditor detects a "serious" internal control weakness, they are required to issue a management letter disclosing this fact to the board.

   The management letter is not rigidly structured, as is the opinion letter, but flexible to accommodate the needs and demands of each audit. MFIs audit committees should consider this flexibility when developing the terms of reference for their audit.

   Of more assistance to the MFI are recommendations for improvement in the MFI's business. An external audit firm is unique in being given access to key individuals and the entire financial records of the organisation. Based on experience with other clients, most auditors can draw similarities between or what was observed that worked significantly better elsewhere. Areas often addressed include cash management, policies and procedures, and internal controls.

   Commonly, the audit firm will require a written response by MFI management on how it will address the audit points noted in the management letter. The Board should review the Auditors recommendation to assess their quality and interest and follow up the MFI management response.

2. Who receives the management letter?

   The management letter is addressed to the board of directors.

3. Who should see the management letter?

   MFIs should be encouraged by donor agencies to share their management letters with donors, prospective donors, investors, or significantly interested parties. MFI managers should feel confident that their responses to the items noted in the letter would demonstrate their control over the internal control environment in their MFI. It is rare that an MFI would not receive a management letter, as improvements can always be made, but it is up to the MFI management to implement prudent recommendations. It is not a requirement that the MFI implement the recommendations, although subsequent management letters will indicate the status of previously noted items.

Recommended Disclosure Guidelines

Donors and other investors rely on an MFI's financial statements to assess the institution's financial situation which hinges a great deal on the condition of its loan portfolio. Unfortunately, many MFI financial statements are prepared with standard disclosures that simply do not include enough information to permit such an assessment.

There is a clear need to improve the depth of disclosures on MFI audits with special regards to several features, including the loan portfolio, the fund balances, and the separation of MFI activity from other services in a multi-service institution. Important details for these areas are often either obscured or completely void from most MFI financial statements.

To help address this problem, CGAP has developed a set of disclosure guidelines to help MFIs and auditors ensure the presentation of information to a level of detail that aids adequate assessment of an MFI by external readers. These guidelines help MFIs to know what minimum information should be included in the financial statements. MFIs should include these guidelines as part of their TOR to the auditors to obtain an opinion of compliance.The guidelines are an interim version and will be revised based on the field experience from the year 2001 audit season. CGAP requests feedback from MFIs and auditors who use these guidelines during this period.

How can we get a copy of the guidelines?

You can download the guideline on line under PDF format here: ()

or you can request an electronic copy at cgap@worldbank.org

Will this increase the cost of the audit?

In principle, no. No additional testing is required to give an opinion of compliance. Good auditors will have verified most of the information requiring disclosure during the course of their audit. The guidelines are largely comprised of International Accounting Standards (IAS) disclosure requirements with which auditors are already familiar. In addition to IAS requirements are areas of reporting which an auditor specializing in MFI audits needs to know to conduct a reasonable audit.

However, the question is debatable. Some auditors ask for a fee increase given that:

1. Auditors may perceive an additional risk in giving an opinion that reflects the standard of their work
2. Auditors may have to engage in verifying more information if, prior to the guideline, their audit did not have comprehensive coverage.
3. Any new request presents an opportunity to renegotiate audit fees to cover an expanded workload

The MFI should evaluate whether an increase in costs is justified.

The additional disclosures will require less supervision time from donors and others, and this cost savings would likely pay for any increase in costs.