GIACC.PACS 12.LOGO.2021


PACS Standard 12:

Independent Auditing

PACS Standard 12 forms part of GIACC’s Project Anti-Corruption System (PACS), which comprises 15 PACS Standards (see links at foot of this webpage). 

Requirements

  1. Auditing:  The Project Owner should ensure that the Project is audited by independent auditors in accordance with paragraphs 2 to 8 below.
  2. Selection, qualifications, appointment, and termination of appointment of independent auditors:
    1. Different independent auditors should be selected to carry out each of the financial and technical audits specified in paragraph 3 below, in order to ensure that the auditors are appropriately experienced in the type of audit.
    2. The Project Owner should request an independent and reputable body to select each independent auditor.
    3. The independent body should select an auditor who is:
      1. a reputable individual or organisation
      2. independent of the Project Owner and any other organisations or individuals involved in the Project
      3. without any conflict of interest in relation to the Project Owner or any other organisations or individuals involved in the Project
      4. competent
      5. appropriately qualified and experienced.
    4. Each independent auditor who is selected should be appointed and paid by the Project Owner or by another appropriate body.
    5. Each independent auditor may be appointed to perform only the functions stated in this PACS Standard, or may be appointed to perform the functions stated in this PACS Standard and other auditing functions.
    6. The appointment of an independent auditor should be terminated only in the following circumstances:
      1. where, in relation to the performance of the independent auditor’s obligations, there are reasonable grounds to believe that there has been corruption, gross negligence, material failure to perform, or wilful misconduct by the independent auditor
      2. with immediate effect, upon service of written notice by the independent auditor if her/his fees are more than [2] months overdue
      3. upon the expiry of [3] months’ prior written notice from the independent auditor.
    7. In the case of termination of appointment, a replacement independent auditor should be promptly appointed in accordance with the above provisions.
  3. Auditing obligations:  The independent auditors should carry out the following audits and related actions in relation to the Project:
    1. Financial audits:  The financial auditor should assess whether:
      1. all payments by the Project Owner in respect of the Project were properly made to legitimate persons and for legitimate purposes
      2. all revenues due to the Project Owner in respect of the Project have been received in full, and were from legitimate persons and for legitimate purposes
      3. the financial management in relation to the Project was properly carried out in accordance with applicable laws, regulations and financial management procedures.
    2. Technical audits:  The technical auditor should assess whether:
      1. there was a legitimate need for the works, equipment, materials, products and services supplied in relation to the Project
      2. the Project has been designed and specified in accordance with applicable laws and regulations and good technical practice and provides good value for money
      3. the Project has been properly completed in accordance with the Project design and specification
      4. In relation to each Major Project Contract and Major Project Sub-contract:
        1. the contract design and specification were based on the legitimate needs of the Project Owner and were not intended to benefit any particular Supplier
        2. the contract has been properly performed in accordance with the contract design and specification.
    3. Identifying suspicious circumstances:  In carrying out the above audits, each independent auditor should identify any suspicion of corruption and whether any issues or deficiencies found during these audits may have been caused by corruption. 
    4. Investigating and reporting corruption:  If an independent auditor identifies any suspicion of corruption, the independent auditor should make preliminary investigations of such matters and, where there are reasonable grounds to suspect corruption, the independent auditor should report such suspicions to the top management and Project compliance manager of the Project Owner, to the body which appointed the auditor (if different from the Project Owner), and to the law enforcement body.
    5. Audit timing:
      1. Financial audits should be carried out annually if the Project duration is in excess of a year, and also upon completion of the Project.
      2. Technical audits should be carried out upon completion of the Project.
    6. Audit reports:  In respect of each such audit, the independent auditor should submit a detailed written report of the independent auditor’s activities and findings to the top management and Project compliance manager of the Project Owner, and to the body which appointed the auditor (if different from the Project Owner), together with copies of, or reference to, all relevant documents.
    7. Records:  Each independent auditor should comprehensively record in writing all activities and findings of the auditing process and retain these records and reports for a minimum of [12] years from Project completion.
  4. Duties of independent auditors:  In carrying out the auditing obligations, each independent auditor should:
    1. act impartially
    2. undertake the audit in compliance with recognised international audit standards
    3. be required to do only what is reasonable taking into account the time available under the appointment
    4. be required to make assessments to the best of the independent auditor’s knowledge and belief and on the basis of the facts available to the independent auditor
    5. keep confidential all information obtained as a result of the auditing function, unless:
      1. the information is already in the public domain
      2. the Project Owner is legally obliged to publicly disclose such information (e.g. under a transparency regulation)
      3. the information should be disclosed under PACS Standard 15
      4. disclosure is necessary in order to comply with the auditing duties
    6. not disclose the identity of any person who has reported suspicion of corruption to the independent auditor unless the person who has made the report provides written consent to the disclosure of identity.
  5. Liability of independent auditors for failure to detect corruption:  An independent auditor should be liable under the independent auditor’s contract of appointment for a failure to detect corruption only where such failure is due to corruption, gross negligence, material failure to perform, or wilful misconduct by the independent auditor.
  6. Full co-operation, no interference, and access:  In relation to the performance of the auditing duties, each independent auditor should:
    1. receive full co-operation from the Project Owner, Suppliers, Sub-suppliers and their personnel
    2. be allowed to perform the auditing duties without any interference or influence by the Project Owner, Suppliers, Sub-suppliers or their personnel
    3. be allowed to have, without requiring advance notice, unrestricted access to any of the Project Owner’s, Suppliers’ or Sub-suppliers’:
      1. office and site premises
      2. personnel
      3. records and correspondence
      4. works, products, services, equipment and materials.
  7. Resources:  Each independent auditor should be provided by the Project Owner with sufficient funding and resources to be able to undertake the auditing function effectively.
  8. Transparency to the public:  In relation to any Project which is wholly or partly publicly owned or funded, the following should be disclosed to the public by the Project Owner on its freely accessible public website in relation to each independent auditor:
    1. the identity of the body which selected the independent auditor
    2. the identity of the body(ies) which appointed and is paying the independent monitor
    3. the identity, contract of appointment, and contact details of the independent auditor (excluding home address)
    4. the full reports of the independent auditor.

Guidance

G1:  What is the purpose of PACS Standard 12?

The primary purpose of PACS Standard 12 is to require financial and technical audits to be carried out so as to:

  • identify any financial irregularities, technical inadequacies, inappropriate design, failure to build in accordance with the specification, over-costing, or poor value for money
  • identify whether these problems may be caused by corruption and, if there are reasonable grounds to suspect that they are, to make reports as specified under this PACS Standard.

The fact that the project is being financially and technically audited will act as a significant deterrent against corruption.  In addition, if the auditors are competent and diligent, the audits may also uncover corruption. 

Paragraph 2 of this PACS Standard provides that different auditors should be appointed to perform the financial audit and the technical audit.  This is so as to ensure that each auditor has the appropriate qualifications and experience for the relevant audit function.

G2:  Who should select each independent auditor? (Paragraph 2 of PACS Standard 12)

The selection of an independent auditor is a separate issue from the appointment of the auditor.  Selection is the choosing of the independent auditor.  Appointment involves the contractual appointment of the selected auditor to the role of auditor.  Greater independence is assured if the independent auditor is selected by an independent and reputable institution (such as a professional institution or specialist organisation) and then appointed by the relevant party (see G3 below).  This reduces the opportunity for any undue influence by the appointing party in the selection and reduces the risk that an auditor may not report problems or suspected corruption for fear this would upset the appointing party and so prevent a future appointment.

Under paragraph 2 of this PACS Standard, the Project Owner is required to select the independent body who will in turn select each independent auditor.  To protect against the Project Owner selecting an independent body which will choose an auditor who will favour the Project Owner’s interests, the Project Owner is required to select an “independent and reputable” body.

G3:  Who should appoint and pay each independent auditor? (Paragraph 2 of PACS Standard 12)

Depending on the type of project and applicable regulations, an independent auditor could be appointed and paid by the Project Owner, a government department (e.g. a National Audit Office), a regulatory authority, a bank funding the project, or an independent body.

Appointment and payment by any party which may have a conflict of interest (such as the Project Owner or, in the case of a public sector project, a government department) is less preferable as this could compromise the independence of the auditor, for example:

  • where the Project Owner or government department try to influence the auditor by withholding or delaying payment, or
  • where the independent auditor is reluctant to make assessments which are against the interests of the Project Owner or government in case this affects the auditor’s payment.

Consequently, where possible and practical, appointment and payment should be by an independent body.  Such appointment is also more likely to be perceived by the public  and project participants as genuinely independent. 

However, whoever appoints and pays the independent auditor, it is vital that:

  • the appointing body is required to appoint the independent auditor who has been selected by the independent body under G2 above
  • the auditor should act, and be seen to act, independently.

G4:  What are the necessary qualifications of each independent auditor? (Paragraph 2 of PACS Standard 12)

Each independent auditor should be a reputable individual or organisation, be suitably qualified, and be genuinely independent of the Project and all project participants.  Each auditor should have, in relation to their technical or financial audit function:

  • detailed experience and understanding of the type of matters and project being audited, and
  • a working knowledge of the law of bribery, extortion, fraud, cartels, embezzlement, abuse of office, and money-laundering, and of how these can occur on infrastructure projects.   

It is possible that an organisation may be appointed as independent auditor.  In this case, the organisation should be a reputable organisation, and the personnel employed by the auditing organisation to undertake the auditing activities should possess the qualifications required of an individual auditor.  

G5:  Why should the independent technical auditor audit only Major Project Contracts and Major Project Sub-contracts, and not other Project Contracts? (Paragraph 3 of PACS Standard 12)

Corruption can occur in relation to any Project Contract (however large or small) and involve any project participant.  However, it would not be practical or cost effective for there to be independent auditing of every aspect of every Project Contract, and of every action of every participant.  Consequently, PACS Standard 12 recommends that, in addition to the technical audit of the whole Project, the technical auditor should audit the technical aspects of Major Project Contracts and Major Project Sub-contracts as this is where the more significant corruption is likely to occur.

G6:  How should each independent auditor investigate matters of concern which may suggest corrupt activity, and make appropriate reports where there is evidence of corruption? (Paragraph 3 of PACS Standard 12)

If, in carrying out the auditing obligations, an independent auditor identifies an issue which may indicate corruption, the auditor should conduct preliminary investigations so as to determine whether there are reasonable grounds to suspect corruption.  If this is established, then the auditor should not investigate any further and should report the matter to the top management and Project compliance manager of the Project Owner, to the body which appointed the auditor (if different from the Project Owner), and to the law enforcement body.  For example, if the technical auditor ascertains that a Major Supplier has provided a significant quantity of materials which are not in accordance with, and are cheaper than, the materials required by the technical specification, and yet has invoiced the Project Owner for the materials which should have been provided, the auditor may conclude that there are reasonable grounds to suspect corruption and so should report this issue as required in this PACS Standard.  The auditor would not be obliged to undertake a detailed investigation to establish whether or not the Major Supplier deliberately provided the incorrect materials.

In carrying out these preliminary investigations and making these reports, each independent auditor should ensure, as far as possible, that:

  • enquiries are kept confidential so as not to alert the wrongdoer who may then destroy or tamper with evidence or seek to intimidate or interfere with potential witnesses
  • the identity of potential informants or witnesses is not revealed, so as to protect them from retaliation or danger
  • reports are made promptly so as to:
    • limit the risk of the matter being suppressed
    • avoid any perception of collusion between the auditor and a particular party
    • limit the risk that the auditor could be in personal danger as being the only person who is aware of the potential corruption
  • reports are made in a manner which limits the risks of:
    • retaliation against or danger to the auditor, informants or witnesses
    • allegations of defamation against the auditor
    • compromising any investigation
    • any unwarranted damage to the reputation of the alleged wrongdoer should the concerns prove to be unfounded
  • evidence is preserved.

It is preferable that each auditor has a duty to report suspected corruption.  Firstly, this duty will act as a significant deterrent to corruption, as the parties involved in the project will be aware that each independent auditor has an obligation to report suspected corruption.  Secondly, having a duty, rather than a discretion, to report will help to counter any personal reluctance that the auditor may have to report corruption due to its potentially serious consequences.

G7: Audit reports (Paragraph 3 of PACS Standard 12)

Paragraph 3 of this PACS Standard requires each independent auditor to submit audit reports to the specified persons.  In preparing these reports, the independent auditor should take similar precautions as those stated in G6 above, particularly as these reports are also (in the case of wholly or partly publicly owned or funded projects) required to be published to the public under paragraph 8 of this PACS Standard.

G8:  Full co-operation, no interference, and access (Paragraph 6 of PACS Standard 12)

If each independent auditor is to be able to carry out the auditing duties effectively, it is necessary that Project participants (i.e. the Project Owner, Suppliers and Sub-suppliers) fully co-operate with the independent auditor, do not interfere with or try to influence the independent auditor, and provide the independent auditor with access to their Project offices and site premises, personnel, records and correspondence, and works, products, services, equipment and materials.

In order to help ensure this, the contractual commitment of the Project Owner, Suppliers and Sub-suppliers will be required.  These contractual commitments are contained in PACS Standard 4 and there are corresponding requirements for their personnel in the Project Code of Conduct.  Any failure by the Project Owner, Suppliers and Sub-suppliers or any of their personnel to comply with these commitments should be reported by the independent auditor as a breach of the contractual commitments or Project Code of Conduct (see paragraph 3 of PACS Standard 12).  Having received such reports, the Project Owner should take enforcement action under PACS Standard 14.

G9: Transparency (paragraph 8 of PACS Standard 12)

Paragraph 8 of this PACS Standard provides that, in relation to any Project which is wholly or partly publicly owned or funded, the Project Owner should publish the full reports of each independent auditor to the public.  In view of this intended wide publication and also for the other reasons stated in G6 above, each independent auditor should, when preparing these reports, take inter alia the precautions identified in G6 above.

G10:  Can the independent auditors make decisions affecting the Project?

Under PACS Standard 12, the independent auditors do not have the power to make decisions affecting the Project or to require action by any Project participant (e.g. to stop payment for work on the Project, or change the identity of a payee).  The auditors’ remit is primarily one of auditing, making preliminary investigations and reporting. 

G11:  Will the independent auditors be cost effective?

The financial loss due to corruption can be very large.  Many observers assume the cost of corruption at a minimum of 5% of project value.  Bribes as high as 30% of the overall project value are common in some territories and sectors.  In addition to bribes paid to win contracts (whose costs are then added to the contract prices), corruption during contract execution also adds to the cost.  This could include matters such as inflated claims which are paid as a result of deception and/or bribery, unjustified and costly variations to the contract scope procured by bribes, and the provision of defective work or materials. 

In addition to the above attempts to quantify the costs of corruption in financial terms, there are the unquantifiable costs, such as the construction of unnecessary, over-designed, or unsafe projects, the retarding effect of corruption on national development, and the uncertainties and inefficiencies which it introduces into business.  

It is therefore imperative that action is taken to prevent and detect corruption.  The appointment of independent financial and technical auditors is widely regarded as being an effective anti-corruption action.  There is no guarantee that the independent auditors will uncover any corrupt activity.  Some corruption may be too well hidden.  Some auditors may not be sufficiently experienced, alert or diligent, or may not have adequate time under their appointment to examine certain aspects of the project.  Some auditors may themselves be corrupt. However, the very presence of reputable auditors is likely to be a major deterrent, and should, therefore, result in a material reduction in corrupt activity.  There is also a strong likelihood that competent and diligent auditors will uncover significant corrupt activity.  If the auditors do uncover financial or technical issues or corruption, there is also an opportunity for the wronged party to obtain redress from the wrongdoers.

The presence of the auditors on a project is also a strong signal from the project owner that the project will be managed ethically, and is accordingly likely to:

  • encourage the participation on the project of ethical funders, contractors, suppliers and consultants
  • in the case of a public sector project, provide assurance to the public that corruption prevention is being taken seriously by government.

It is not possible to prove that independent auditors will be cost effective, i.e. will save more money in preventing corruption than the cost of the auditing.  As corruption is usually hidden, the full extent of corruption on a project may not be identified, and it is unlikely to be possible to show how much loss due to corruption will be or has been avoided by having auditors.  However, the appointment of competent auditors with carefully controlled and reasonable scopes of work and fee structures is likely to be a cost-effective investment.

G12:  How can the integrity and safety of each independent auditor be assured?

Each independent auditor is at risk of being bribed, threatened, or harmed by a corrupt party so as not to report corruption.  There is also the risk that the auditor could extort bribes so as not to report corruption. These risks can be minimised, but not entirely avoided:

  • The risk of corruption of or by the auditor can be minimised by ensuring that:
    • the auditor is a person of known integrity and is a member of a professional institution which maintains high ethical standards and has strict disciplinary procedures
    • all relevant personnel on the Project have received anti-corruption training and so will be alert to suspicions of corruption by the independent auditor and how to report such corruption.
  • The risk of threats and personal harm to the auditor can be minimised by rapid and routine reporting of findings by the auditor (subject to the factors in paragraph G6 above).  Once information has been reported to other parties, threats and personal harm to the auditor becomes less likely.

The auditor’s safety should be taken very seriously, and protection for the auditor may need to be provided.

G13:  Could the same person carry out the role of independent auditor and independent monitor (see PACS Standard 11 Independent monitoring)?

PACS Standard 11 requires the appointment of an independent monitor who has an ongoing remit to monitor the Project for corruption during its whole duration. 

PACS Standard 12 requires the appointment of independent auditors to carry out financial and technical audits of the Project to assess whether there has been any corruption in relation to the Project’s financial and technical aspects.

It is possible that the same person could act as independent monitor and technical auditor as these functions may require similar professional and technical qualifications and experience.   However, it is preferable for the monitor and technical auditor to be separate persons, as this will enable the auditor to act as a check on the monitor: the auditor may identify corruption that the monitor has failed to identify and may also identify corruption by the monitor.

It is unlikely to be appropriate for the independent monitor and financial auditor to be the same person, as these functions are likely to require different skills and qualifications.  The independent monitor should be a professional with detailed knowledge of the type of construction being undertaken (so that the monitor can identify possible corruption during the Project).  A financial auditor is likely to be an accountant who is skilled in financial controls.  Furthermore, as with the technical auditor, it is in any case preferable for the monitor and financial auditor to be separate persons, as the auditor will act as a check on the monitor: the auditor may identify corruption that the monitor has failed to identify and may also identify corruption by the monitor.

Updated on 1st November 2021

© GIACC