This book is published in a period when the COVID-19 outbreak is having an unprecedented effect across most countries of the world and all EU Member States on the health of their citizens and resilience of their economies. We do not know yet to what extent the world will be different once this crisis is over. However, we know already that the COVID-19 pandemic has certainly brought challenges to our societies and called into question how they are organised. It has also raised, and will continue to raise, important questions on the public service, its resilience and response in times of crisis, and the relationship between citizens and public administrations.
Were our societies and the actors of the public, semi-public and private sectors (governments, regional and local administrations, health authorities, hospitals, research centres, laboratories and companies) sufficiently prepared? Have they done enough before and during the crisis to anticipate and limit its impact and consequences?
These are just a few key questions for which there are no definitive answers yet and which will certainly trigger many different interpretations through books, articles, in-depth analyses, talk-shows, seminars or conferences over the years to come.
While many issues related to the coronavirus crisis are still to be assessed, it is already clear now that this crisis reinforces the responsibility and the accountability of the public sector. The challenging socio-economic situation that unfortunately lies ahead will trigger additional scrutiny and pressure from citizens and the public opinion on the managers of international, national, regional and local authorities.
But what exactly is the relationship between the crisis provoked by the COVID-19 pandemic and a book on internal control management in the public sector?
In my opinion, it is in times of deep crisis in particular that one desperately needs the resilience and soundness of systems. Many political leaders and governments have stated that the depth and breadth of the coronavirus shock on the public health and socio-economic situation requires organisations that are able to provide a response unprecedented in scale and speed. It is in times of crisis that the quality, efficiency and effectiveness of public authorities need to be proven.
This is exactly the point of the current handbook: it highlights the necessary ingredients for successful internal control management in the public sector. All the requirements and conditions that make the internal control system for public management efficient and effective are presented in a clear and informative way and with plenty of practical examples. The underlying analysis is structured around four key areas: why do we need to implement internal control management, how do we organise it, how do we plan the related activities and how do we implement in practice the internal control management standards?
But at the same time one could ask the question, is it still relevant to have a long list of requirements and conditions on internal control management, when flexibility and rapidity of the implementation of public action are now a top priority, and even more so in a crisis situation?
I would refer here to one of the fundamental legal texts at European level, the Financial Regulation applicable to the EU budget, which in its Article 36 lists the key objectives of internal control for budget implementation: (a) effectiveness, efficiency and economy of operations; (b) reliability of reporting; (c) safeguarding of assets and information; (d) prevention, detection, correction and follow-up of fraud and irregularities; and (e) adequate management of the risks relating to the legality and regularity of the underlying transactions, taking into account the multiannual character of programmes as well as the nature of the payments concerned. The internal control framework of the European Commission is designed to be able to respond to these key objectives. Without prejudice to national specificities, they are applicable to all forms of public management and budget spending, and, as such, they are not subject to crisis considerations. In line with the legal requirements, citizens and stakeholders will continue to expect managers in the public sector to be held accountable based on these principles.
I therefore very much welcome the approach of this handbook and its conclusions on recommended areas for improvement. The research and guidance on internal control at international level has progressively evolved over the last decade from a compliance-led to a principle-based approach. Indeed, this was the objective of the latest revision of the highest international standards on internal control set by the Committee of Sponsoring Organisations of the Treadway Commission (COSO) in 2013. The aim of a move to a principle-based approach is to maintain a robust internal control framework, while providing the necessary flexibility that enables management to adapt it to the specific characteristics and circumstances of a particular organisation. The European Commission took this path in 2017 when it revised its own internal control framework. After the first two years of implementation, it has proven to be a positive development in terms of a fresh assessment of the actual implementation of internal control, and in reporting to stakeholders.
I recommend this handbook as an excellent tool for all managers and practitioners of internal control in the public sector. It provides many practical examples and a useful perspective on all the key assurance building blocks (control environment, risk assessment, control activities, information and communication, and monitoring activities), towards a result-oriented implementation of the internal control framework.
I would like to congratulate the two distinguished authors, Jean-Pierre Garitte and Marius Tomoială, for their practical approach and insightful perspective, based on years of experience as internal control and audit practitioners.
Dr Manfred Kraff
Director-General of the Internal Audit Service of the European Commission