MFI Internal Audit and Controls Trainer’s Manual - …

1 Website: Website: MFI Internal Audit and Controls Trainer s Manual August 2007 Mennonite Economic Development Associates Ruth Dueck Mbeba MicroSave Market-led solutions for financial services Acknowledgements MEDA acknowledges the contribution and input of Ruth Dueck Mbeba, Joyce Lehman, Prakash, Praveesh Kunam, Madhurantika Moulick and Jasper Vet in writing and development of the overall toolkit. Special thanks to Graham Wright for support and contributions to the development of the materials. Much of the content and learning is based on industry best practices and on MEDA s work in microfinance over the past years.

2 Many thanks to the helpful input and support from MEDA staff in making this effort possible. A learning toolkit is never final as new techniques, tools and resources become available and are shared with one another. Participant feedback and comments will assist to continually improve this toolkit and its resources. MicroSave Market-led solutions for financial services MFI Internal Audit and Controls Trainer s Manual page i Table of Contents 1.. 1 SETTING THE CONTEXT: RISK AND RISK MANAGEMENTS ession 1 What are the Key Risks in Microfinance?.. 3 What are the Key Issues of Operational Risks?.. 6 What are the Key Issues of Managing Operational Risks?.. 7 Risk Management: Whose Job is it?

3 9 2.. 11 OVERVIEW OF Internal control SYSTEMSS ession 11 What do we mean by Internal Controls ? .. 12 a.. 14 control Environmentb.. 14 Risk Assessmentc.. 19 The control Activities: Systems, Policies and Proceduresd.. 19 Information and Communicationse.. 20 MonitoringWhat are the Key Challenges for MFIs?.. 24 3.. 27 PREVENTIVE control HUMAN RESOURCESS ession 27 What are the Factors Contributing to Commission of Fraud by Employees?.. 29 How do we Limit Opportunities? Effective Staff 31 Model for Sustainable Capacity 38 4.. 41 PREVENTIVE control POLICIES AND PROCEDURESS ession 41 Accounting 43 Segregation of 46 Independent Checks and 46 procedures for Cash 47 Cash 47 MicroSave Market-led solutions for financial services MFI Internal Audit and Controls Trainer s Manual page ii procedures for Cash 48 Bank 49 Cash 50 Portfolio Reconciliations The General Ledger and the Portfolio Tracking System (MIS).

4 51 Document 51 5.. 53 PREVENTIVE control INFORMATION SYSTEMSS ession 53 Risks Associated with Lack of 54 Managing MFI 54 Loan Portfolio 55 6.. 61 ROLE OF THE Internal AUDITS ession 61 What is an Internal Audit ?.. 62 Role of the Internal Audit in the Internal control 62 Role of the Audit in the Risk Management Feedback 63 Creating the Internal Audit 63 Reporting Function of the Internal 64 7.. 67 IMPLEMENTING THE Internal Audit FUNCTIONS ession 67 Planning the Internal 68 Professionalism and 73 Reporting Audit 73 Writing the Internal Audit Report and Making 74 Follow up Previous 76 Where Do We Go From Here?.. 77 Resource 79 MicroSave Market-led solutions for financial services MFI Internal Audit and Controls Trainer s Manual page iii Figures Figure - External and Internal Risks of HIV/AIDS to an 5 Figure - The Role of Internal Controls and Internal Audits in Operating Risk 8 Figure - Risk Management: Whose Job is it?

5 10 Figure - COSO Internal control 13 Figure - The Risk Management Feedback 15 Figure - The Cycle 16 Figure - Illustration of Assessing Risk Events, Drivers and 18 Figure - Steps to Evaluate Internal 22 Figure - The Fraud 29 Figure - Maslow s Hierarchy of Human 31 Figure - MFI Training 34 Figure - Model for Sustainable Capacity 39 Figure - MFI Financial Management Information 44 Figure - Areas of Risk in Loan 59 Figure - Differences Between Internal and External 62 Figure Sample Organisational 65 List of Handouts Section 1: Setting the Context: Risk and Risk Management Workshop Agenda Section 2: Overview of Internal control Systems Risk Assessment Tool Internal control Questionnaire Internal control Diagnostic Template Section 3: Preventive control Human Resources Sample Employee Code of Conduct Section 4: Preventive control Policies and procedures Sample Bank Reconciliation Format Sample Cash Count and Verification Sample Internal control Checklist Sample Reconciliation Problems and Tips Section 6: Role of the Internal Audit Sample Internal Auditor Job Description Section 7.

6 Implementing the Internal Audit Function Sample Internal Audit Annual Work Plan Internal Audit Checklist Cash Internal Audit Checklist Loan Internal Audit Checklist Financial Reports Internal Audit Checklist Savings Internal Audit Checklist Human Resources Internal Audit Checklist Fixed Assets Internal Audit Checklist Self Help Groups MicroSave Debriefing Note #57 Games that MFI Staff Play Sample Internal Audit Report Format Sample Loan Portfolio Audit Report Sample Internal Audit Report (Branch) Sample Internal Audit Report (Self Help Group) MicroSave Market-led solutions for financial services MFI Internal Audit and Controls Trainer s Manual page iv MicroSave Market-led solutions for financial services Management Response to Internal Audit Report Internal Audit Follow-up Tool List of Exercises Section 1: Setting the Context: Risk and Risk Management Section 2: Overview of Internal control Systems Follow the Money (Part I and II) Risk Assessment Exercise Internal control Diagnostic Exercise Policy and Procedure Compliance and Incident Worksheet Section 3: Preventive control Human Resources Human Resource Policy Discussion Section 4.

7 Preventive control Policies and procedures Policy and Procedure Worksheet Segregation of Duties - Distance Management Segregation of Duties - Loan Officers Handling Cash Segregation of Duties - Branch Personnel Problem Fraud Cases Ineffective Policies and procedures Section 5: Preventive control Human Resource Policies Case Assessing Preventive Controls Section 6: Role of the Internal Audit Internal Audit Group Discussion Section 7: Implementing the Internal Audit Function Internal Audit Reporting and Role Play Investigative Case Studies MFI Internal Audit Action Planning Setting the Context: Risk and Risk Management Mennonite Economic Development Associates MicroSave Market-led solutions for financial services MicroSave Market-led solutions for financial services MFI Internal Audit and Controls Trainer s Manual Section 1 - 1 1.

8 Setting the Context: Risk and Risk Management Session Overview Objectives: Understand risk and risk management within the Internal control context Recognize key risks in microfinance Appreciate everyone s role in the risk management process! Time: 1 hour Methods: Lecture, small group discussion and large group discussion Materials: Flipcharts and pens Slide Show: Electronic PowerPoint presentations: Section 1: hard copy of the PowerPoint presentations and trainer s notes. 1. Risk and Risk Management Time: 15 minutes (lecture/discussion) Exercise: none Slides: 3 Handouts: none 2. Key Operating Microfinance Risks Time: 20 minutes (lecture/large group brainstorming and discussion) Exercises: brainstorming discussion Slides: 6 Handouts: none 3.

9 Risk Management: Whose Job is it? Time: 25 minutes (lecture/small group discussion) Exercise: Table group discussion Slides: 4 Handouts: none Procedure 1. Risk and Risk Management Time: 15 minutes (lecture/discussion) Exercise: none Slides: 3 Handouts: none MicroSave Market-led solutions for financial services MFI Internal Audit and Controls Trainer s Manual Section 1 - 2 The Big Picture Microfinance institutions exist to fulfill a dual mission financial sustainability and positive social impact on the urban and rural poor in urban of the communities that they serve. However, too many MFIs are pre-occupied with expansion, out-smarting their competition, or reducing their operational costs to take time to look at risk management in their institutions.

10 Others operate without proper systems that help reduce exposure to risk. The underlying premise of both risk management and effective Internal control is that the business in our case the MFI, is on a path towards growth, profitability and sustainability, that it actually achieves its mission, and minimizes the risk of loss or failure in the process of conducting business. To fulfill their mission, MFI risks must be managed! Risk management is key to control the likelihood and severity of an adverse event. The primary purpose of this toolkit is to look at risk, risk management and Internal Controls from an operational perspective in the MFI.