The freedom to decide the content and timing of audit reports and to publish and disseminate them

Principles 5 and 6 both refer to a SAI’s power to report, and can usefully be considered together. The same text is therefore found on both pages.

Principles 5 and 6 seek to establish the important principles that a SAI should have the autonomy to decide what to include in its reports, should be able to issue reports which contain observations and recommendations (taking into account the views of the audited entity as appropriate), and should issue reports which are timely (as determined by the Head of SAI, except where the law prescribes specific reporting requirements).

These powers are fundamental to SAI independence, and to the effectiveness of the SAI as an auditing institution. They should be addressed in the SAI’s legal framework, but they also have important practical dimensions. For example, the reference to the dissemination of reports should be seen in the modern context of INTOSAI-P 12, which has emerged since the Mexico Declaration was written. This encourages SAIs to consider their reporting practices as part of a wider approach to communications and relationship management.

There are several distinct aspects to these principles, which also need to be considered carefully if modernising the legal framework.

Frequency of reporting, and to whom

The notes to Principle 5 say that SAIs should be required by law to report “at least once a year on the results of their audit work”. This is a fundamental principle of accountability – if a SAI does not produce at least one report a year, then what value can the SAI’s work have for citizens and the Legislature?

The Legislature should be the primary recipient of the SAI’s. Some SAIs that are required to report to the Legislature must also send copies of their reports to the President, the Prime Minister, or other Ministers. The audited entity should also, of course, be aware of the report and its contents.

The requirement to report “at least annually" is often understood to mean that a SAI should only report once a year on the results of all its audits. This is also written into some countries’ legal frameworks. In some countries this is because the SAI is expected to issue a single opinion on the public accounts, or the financial statements of all ministries and other entities, each year and report on them to the Legislature.

While that reflects a strong basis in principle, it can lack flexibility. This is especially so if the SAI is reliant on a single reporting power to communicate the results of all its various audit work. Single reporting powers are less common in countries where the SAI can undertake a range of different types of audits, or audit accounts or entities other than those of the central government. A power to report “at least annually”, but also at other times, enables the SAI to report more frequently and at times of its choosing.

SAIs also have different reporting practices. Some, for instance, place their audit reports in the public domain as soon as individual audits, particularly performance audits, have been finalised – so providing the Legislature and other stakeholders with a steady stream of audit results. But in other countries it is the practice to produce one comprehensive report covering all audits produced in the year, and deliver this to the Legislature – sometimes in more than one volume.

In general terms, a more flexible approach to reporting is considered desirable. This may also extend to a power to report to other persons – for example, to Ministers or the Judiciary in relation to matters of improper behaviour, fraud, or corruption detected in the course of an audit. The ISSAIs can also be significant to the scope of a reporting power. They can also be a potential source of confusion, for example, if the SAI uses the ISSAIs (or equivalent standards) to prepare an “audit report” containing the SAI’s opinion on an entity’s financial statements. While the issue of that report may be considered part of the audit, principle 6 regards it as the exercise of a reporting power (saying that legislation should specify the content of a formal audit opinion or certificate). The legal framework should make the distinction clear.

Timing of reports

Principle 6 makes it clear that SAIs should be free to publish and disseminate their reports. However, this freedom is then qualified by reference to the reports being “tabled or delivered to the appropriate authority – as required by law”. This has proven contentious in some countries. In practice, it can result in audit reports rarely reaching the public domain because of technicalities or delays in the process of presentation to the Legislature or other recipient. If an audit report does not reach the public domain shortly after completion, it serves little purpose in enabling citizens and others to hold a government to account and undermines the value and benefits of the SAI’s work.

Balancing the rights of the primary recipients of the SAI’s reports against the need for timely dissemination of audit results can be a difficult question to resolve when drafting new reporting powers. While it may be appropriate for the Legislature (or the audited entity, or other office holders such as the Prime Minister) to be the first recipients of audit reports, this should not result in a lack of timeliness or provide a means to delay publication of reports which may be politically uncomfortable. Good practice internationally is that a SAI should be able to release its reports to the media, and on its website, at the moment or soon after the report is delivered to the Legislature. Many SAIs do this, but others are restricted in their ability to do so. Some SAIs are even prohibited by law from reporting publicly under any circumstances.

Determining the content of reports

Principles 5 and 6 also make it clear that SAIs should consider the views of audited entities or other affected persons before completing a report. In some countries, this is a legal requirement, or part of an overall duty to act fairly. In other countries, and under the ISSAIs, it is a matter of good practice. However, this also has the potential to undermine independence. If an auditee wants to slow down the release of an audit report, they can take a long time providing feedback to the SAI on the draft reports. To overcome this problem, if the law requires the SAI to include auditee comment in a report it should also require responses to be given in a reasonable time. What is reasonable should be within the power of the Head of SAI to determine. It is important for this to be fair – too short, and the auditee will not have time to provide a thorough response; but too long and the report may be unjustifiable delayed or the audit findings may cease to be relevant.