The existence of an appropriate and effective constitutional/statutory/legal framework and of de facto application provisions of this framework.

Principle 1 recognises the importance of a constitutional and statutory/legal framework for the SAI. The aim is to ensure that the SAI is formally recognised in the country’s law and system of public sector governance. This is important because it provides legitimacy, clarity, and a stable basis for the SAI to function. It also reduces the opportunity for arbitrary change driven by political or other expediency.

It is important to understand the framework in terms of the SAI both as an institution and for what it is mandated to do. As a minimum, a SAI needs legal recognition of its:

• Institutional form and structure, including its institutional independence;
• Head and office holders (whether the SAI as an institution takes the form of, or is headed by, a court, a board, or a single public office-holder) – their independence is discussed under Principle 2;
• mandate (including which entities and/or accounts it audits, and what types of audits it can perform) – discussed further under Principle 3;
• legal powers to support its auditing work (including powers to obtain or require production of documents and obtain information from officials or other persons) – discussed further under Principle 4; and
• powers to report and/or disclose information (whether to the Legislature, the Executive, the Judiciary, or other agencies or persons) – discussed under Principle 5 and Principle 6.

Principle 1 expects these fundamental provisions to be either enshrined in the Constitution or set out in specific legislation (such as an Act or a Law) devoted solely to the SAI or the work of public sector auditing. Legal recognition of the SAI as an independent institution is increasingly important in the modern context of professionally-based auditing. It is also a pre-requisite to the implementation of Principle 8, which concerns financial independence of the institution and the autonomy of the Head of SAI to govern and manage it.

The legal framework should also, therefore, address how the SAI:

• develops and either gives or obtains legal authority for its auditing plans;

• sets (or is given) its auditing standards;

• prepares and either confirms or seeks approval of its operational budget, obtains its funds, and reports on its financial and other performance;

• obtains and manages its personnel and other resources.

Other important institutional arrangements include how the SAI:

• functions in a professional and ethical sense, including in relation to conflicts of interest, the confidentiality of information, and staff conduct; and

• follows up or enforces its reports or findings – discussed under Principle 7.

Depending on the country system, matters of this type may be either set out in the SAI’s specific enabling legislation or included in other legislation (such as a public finance law dealing with all public sector agencies’ budgeting and financial management). Alternatively, they may be addressed in standards, protocols, or MOUs with other agencies (or a combination).

There are risks in specifying the SAI’s governing law in too much detail. A less detailed or prescriptive approach can leave space for matters of operational significance to be worked out over time, and put into practice through subsidiary legislation, internal regulations, or operational policies – depending what is appropriate in the country context.

Developing the constitutional or statutory/legal framework is not simple. It is a strategic activity for a SAI. Globally, there is considerable experience of the areas which are often overlooked or which can be contentious.