QU OF NT AT A FE RU

BERMUDA

2010 : 3

WHEREAS it is expedient to establish an Internal Audit Department to provide an independent, objective assessment of the stewardship, performance and cost of Government policies, programs and operations, and to provide reasonable assurance that persons entrusted with public funds carry out their functions effectively, efficiently, economically, ethically, equitably and in accordance with the law; Be it enacted by The Queen’s Most Excellent Majesty, by and with the advice and consent of the Senate and the House of Assembly of Bermuda, and by the authority of the same, as follows:

PART 1 — PRELIMINARY

Short title

1 This Act may be cited as the Internal Audit Act 2010.

Interpretation

2 In this Act, unless the context otherwise requires— “assurance activity” means an activity which (based on an independent assessment of an auditee’s risk management, control and governance processes) provides reasonable assurance that internal controls are adequate to mitigate risks, governance processes are effective and efficient, and organizational goals and objectives are capable of being met; “auditee” means a Government Department or other public authority referred to in section 4 of the Public Treasury (Administration and Payments) Act 1969; “Committee” means the Internal Audit Committee established under section 14; “conflict of interest”, in relation to an officer of the Department, means a situation where an officer of the Department has a personal interest in a matter which influences, or may reasonably appear to influence, the impartial performance of the officer’s duties in respect of that matter; “Department” means the Internal Audit Department established under section 3(1);

“Director” means the Director of Internal Audit appointed under section 3(2); “governance processes”, in relation to an auditee, means those systems and processes concerned with ensuring transparency, accountability and equity in the use of public funds; “internal audit” means an independent, objective consulting and assurance activity designed to add value and improve the operations of auditees, helping auditees accomplish their objectives by bringing a systematic, disciplined approach to evaluating and improving the effectiveness of risk management, internal control, and governance processes; “internal control”, in relation to an auditee, means a procedure, policy or system designed to promote efficiency, safeguard assets, and reduce fraud and error; “irregularity” means an act or omission which unlawfully diminishes public funds or which is not consonant with the proper management of public funds; “professional standards” means the prevailing Standards and Code of Ethics of the Institute of Internal Auditors (IIA); “risk management”, in relation to an auditee, means the process of analysing exposure to risk and determining how best to deal with such exposure. [Section 2 defintion "professional standards" inserted by 2019 : 47 s. 2 effective 13 December 2019]

PART 2 — THE DEPARTMENT

3. Establishment of Department

(1) There is established a Department to be known as the Internal Audit Department which is charged with exercising and performing the functions assigned to it under this Act.

(2) The Department shall consist of a public officer appointed by the Governor who shall be known as the Director of Internal Audit and such number of other public officers as may be required.

(3) The Director shall report—

(a) administratively to the Secretary to the Cabinet; and

(b) as provided in this Act, to the Committee.

4. Functions of Department

(1) The Department shall, in accordance with the professional standards, establish procedures for the conduct of internal audit activities to provide an independent, objective assessment of the stewardship and performance of Government policies, programmes and operations.

(2) The Department shall determine whether an auditee’s risk management, control and governance processes (as designed and represented by the auditee) are adequate and functioning in a manner which provides reasonable assurance that—

(a) public funds are adequately safeguarded and are used as intended;

(b) public funds are used economically, effectively and efficiently;

(c) risks are appropriately identified and managed;

(d) financial, managerial and operating information is accurate, reliable and timely;

(e) the auditee’s actions are in compliance with policies, standards, procedures and the law; and

(f) plans, goals and objectives of the auditee are capable of being achieved.

(3) Without limiting subsections (1) and (2), the Department shall—

(a) promote economy, efficiency and effectiveness in the administration of Government programmes and operations;

(b) prepare plans to be approved by the Committee for the development and maintenance of an efficient internal audit for the auditees;

(c) design plans to provide reasonable assurance that accounts are free of material misstatement, whether caused by error or fraud; and

(d) provide a means for keeping the auditees fully and currently informed about problems and deficiencies identified in relation to the administration of their programmes and operations and the necessity for appropriate corrective action.

(4) The Department shall oversee all the internal audit activities of an auditee and the auditee shall not, without the prior written approval of the Director, engage any other person or entity to conduct an internal audit of the auditee. [Section 4 subsection (1) amended by 2019 : 47 s. 3 effective 13 December 2019]

5. Functions of Director

(1) The Director shall, subject to directions of the Committee on matters of policy and subject to this Act, be responsible for the day-to-day management and administration of the Department, and may make such decisions and exercise such powers as are necessary for the attainment of the functions and objectives of the Department.

(2) Without limiting subsection (1), the Director shall—

(a) oversee the implementation of the annual audit plan, as approved by the Committee, including any special projects requested by the Committee or an auditee;

(b) establish a quality assurance programme to monitor the operation of internal audit activities;

(c) make regular reports to the Committee on the management and operations of the Department;

(d) provide data and advice necessary for the formulation of policies for the attainment of the objectives of the Department; and

(e) perform such other duties as the Committee may direct.

Declaration of officers of Department

6 The Director and the other officers of the Department shall, before entering upon their duties, make a solemn declaration in the form set out in the Schedule.

Independence of Department

7 Subject to this Act, the Director and other officers of the Department—

(a) shall not be subject to any direct or indirect influence or control by an auditee and shall not themselves influence or control an auditee, but an auditee may request the Director to carry out such specific investigations as may be considered reasonable by the Director; and

(b) shall not perform or direct any operational duties for an auditee.

8. Report on internal audit of auditee

(1) The Director shall, as soon as practicable after concluding an internal audit, transmit a final report thereof to the auditee and to the Permanent Secretary under whose supervision the auditee falls.

(2) Within one month of receipt of such report, the auditee shall advise the Permanent Secretary, in writing, on the steps it has taken to address any problems or deficiencies identified in the report.

(3) The Permanent Secretary shall follow up with the auditee, at least once every month after receiving the report, until satisfied that any problems or deficiencies identified in the report are addressed.

Follow-up reviews

9 The Director shall conduct such follow-up reviews after an internal audit as the Director considers necessary to ensure that any problems or deficiencies identified in the report have been addressed.

10. Conflict of interest

(1) Where the Director or the Committee considers that there would be a conflict of interest if the Director were to conduct an internal audit, the Committee may appoint a senior public officer from amongst the officers of the Department to conduct that investigation in the Director’s stead.

(2) An officer of the Department who has any form of a conflict of interest in an internal audit that officer is assigned to work upon, whether such conflict is direct or indirect, shall immediately disclose to the Director (and if the officer is the Director,

immediately disclose to the Committee) that officer’s interest and shall refrain completely from being involved in that internal audit.

11. Suspected cases of irregularity or fraud

(1) If an auditee has reason to suspect an irregularity or fraud of public funds, it shall refer the matter forthwith to the Director, and shall supply to the Director all information in its possession relating to the suspected irregularity or fraud.

(2) If the Director establishes the existence of a suspected case of irregularity or fraud in the auditee under review, the Director shall immediately inform—

(a) the Permanent Secretary of the auditee and the Auditor General; or

(b) the Head of the Public Service and the Auditor General, if the Director believes that it is more appropriate to do so. [Section 11 amended by BR 85 / 2021 reg. 6 effective 7 June 2021 ]

12. Access to documents and information

(1) The Director, for the purpose of carrying out any functions under this Act—

(a) shall be afforded unimpeded access to any premises of an auditee in order to conduct an internal audit; and

(b) may require an auditee to produce for inspection any documents or information, including any computer data in any form, and may make copies or extracts of such documents or information.

(2) The Director is entitled to be given any information and explanations that he may request in the performance of his functions under this Act.

(3) Notwithstanding any other Act or any privilege under the law of evidence, the Director may obtain any documents or information of an auditee under this section, and no such documents or information may be withheld from the Director on any grounds.

(4) In this section, “Director” includes a person authorised in writing by the Director. [Section 12 subsection (2) amended and subsections (3) and (4) inserted by 2011 : 35 s. 5 effective 21 October 2011]

13. Confidentiality of information furnished by auditee

(1) All information furnished by an auditee during the course of any internal audit shall at all times be treated by the Department as confidential and shall be used by the Department solely for the purpose of carrying out the internal audit.

(2) The Director shall treat internal audit reports as strictly confidential and shall, except in pursuance of section 11 or for the purpose of any criminal investigation or prosecution, only disclose their contents to the Permanent Secretary and, if a report deals with a suspected case of irregularity or fraud, or if the Director thinks it necessary, to the Committee and to the Auditor General.

PART 3 — THE COMMITTEE

14. Establishment of Committee

(1) There is established a Committee, to be known as the Internal Audit Committee, which shall be the governing body of the Department.

(2) The Committee shall exercise the functions assigned to it by this Act.

15. Composition of Committee

(1) The Committee shall be composed of—

(a) the Secretary to the Cabinet as Chairperson;

(b) the Head of the Public Service or, where the Secretary to the Cabinet is also the Head of the Public Service, the Assistant Secretary to the Cabinet (Deputy Head of the Public Service);

(c) a Permanent Secretary, appointed by the Chairperson; and

(d) two persons of good standing in the accounting or auditing profession (who are not public officers) appointed by the Premier.

(2) A person appointed under subsection (1)(c) shall be appointed for a term of one year and is eligible for reappointment for a further term of one year, such that the person shall not be appointed for more than two terms in succession.

(2A) A person appointed under subsection (1)(d) shall be appointed for a term of two years and is eligible for reappointment for a further term of one year, such that the person shall not be appointed for more than two terms in succession.

(3) The Premier may appoint an alternate to a person appointed under subsection

(1)(d) to perform the functions of that person in his absence.

(4) A person appointed under subsection (1)(d), and that person’s alternate, shall be paid in accordance with the Government Authorities (Fees) Act 1971 as if the person were a chairman or equivalent. [Section 15 amended by 2018 : 34 s. 2 effective 16 July 2018; Section 15 subsection (2) and (4) amended, and subsection (2A) inserted by 2019 : 47 s. 4 effective 13 December 2019; Section 15 amended by BR

85 / 2021 reg. 6 effective 7 June 2021]

Functions of Committee

16 The Committee shall—

(a) establish appropriate structures for the effective and efficient execution of the functions of the Department;

(b) endeavour to secure the achievement of the objectives of the Department;

(c) approve policies, procedures and methods for the development and maintenance of an efficient internal audit for auditees;

(d) take reasonable and timely action on reports submitted to it by the Director;

(e) serve as an independent and objective body to monitor the public internal financial control function in Bermuda;

(f) oversee the work of the Department;

(g) safeguard the continued independence of the Director and officers of the Department;

(h) endorse or otherwise plans, budgets and schedules as proposed by the Director for the proper administration of the Department;

(i) require the Department to carry out specific tasks in accordance with its functions under this Act; and

(j) ensure that the Department has adequate staff, funding and other resources to carry out its functions.

17. Meetings of Committee

(1) The Committee shall meet at such times and places as the Chairperson may determine but, in any event, it shall meet at least once every three months.

(2) The Chairperson may at any time, and shall, on the written request of at least four members of the Committee, call a special meeting of the Committee.

(3) At each meeting of the Committee—

(a) the Chairperson shall preside; or

(b) in the absence of the Chairperson, a member of the Committee elected by the members present from among their number shall preside.

(4) The quorum for a meeting of the Committee shall be three members, one of whom shall be a person appointed under section 15(1)(d) or that person’s alternate.

(5) A decision at a meeting of the Committee shall be that of the majority of the members present and voting and, where there is equality of votes, the Chairperson or the person presiding shall have a second vote.

(6) The Committee may co-opt a person to act as an adviser at its meetings but a co-opted person is not entitled to vote at a meeting on a matter for decision by the Committee.

(7) The validity of any proceedings of the Committee shall not be affected by a vacancy in its membership or by a defect in the appointment or qualification of any of its members.

(8) Subject to this section, the Committee shall regulate its own procedure.

Disclosure of interest

18 A member of the Committee who is directly or indirectly interested in a matter being considered or dealt with by the Committee shall disclose the nature of the interest at a meeting of the Committee and shall not take part in any deliberation or decision of the Committee with respect to the matter.

PART 4 — MISCELLANEOUS PROVISIONS

19. Annual report by Director to Committee

(1) The Director shall, not later than three months after the end of each financial year, compile and transmit to the Committee an annual internal audit report dealing generally with the activities of the Department during that financial year and containing such other information relating to the activities of the Department as the Committee may from time to time require.

(2) The Committee shall, within a month of receiving the Report, deliver it to the Premier and to the Minister of Finance.

Annual report by Committee to Premier

20 The Committee shall, not later than four months after the end of each financial year, submit to the Premier a report on its activities and the activities of the Department in respect of that financial year and shall in the report—

(a) state its findings on activities of the Department; and

(b) provide details of the Committee’s expenditure, and that of the Department, for that financial year as compared with its budgeted expenditure for that year.

21. Regulations

(1) The Premier may, on the advice of the Committee, make regulations for the proper carrying out of the provisions and purposes of this Act, including, without prejudice to the generality of the foregoing, regulations in respect of—

(a) the manner in which internal audits by the Department are to be carried out;

(b) an internal audit charter which sets out the role, responsibilities, scope and authority of the Director and the Department;

(c) the persons or bodies to whom reports of the Department shall be distributed by the Committee; or

(d) the protection of officers of the Department.

(2) The negative resolution procedure applies to regulations made under this section.

22. Offences and penalties

(1) Any person who—

(a) when required under section 12 to give the Director access to any information or explanation, gives the Director any information or explanation which the person knows to be false or which the person has no reason to believe to be true;

(b) when required under section 12 to give the Director access to any document, information, explanation or premises, fails to produce for inspection by the Director or otherwise fails to give the Director access to that document, information, explanation or premises;

(c) wilfully suppresses any information or explanation required by the Director; or

(d) obstructs the Director in any way in the performance of functions under this Act, commits an offence and is liable on summary conviction to a fine not exceeding $5000 or to imprisonment for a term not exceeding 12 months or to both such fine and imprisonment.

(1A) Any person who alters, erases, destroys or conceals any document or information with the intention of avoiding producing the document or information in accordance with section 12, commits an offence and is liable on summary conviction to a fine not exceeding $10,000, or to imprisonment for a term not exceeding 12 months, or to both such fine and imprisonment.

(2) Any officer of the Department who—

(a) demands or takes a bribe, gratuity, recompense or reward for the neglect, omission, commission or performance of a duty under this Act;

(b) wilfully fails to report to the Director any abuse or irregularity that comes to the notice of the officer in the course of the performance of a duty under this Act;

(c) makes any report to the Director which the officer knows to be false or which the officer has no reason to believe to be true;

(d) knowingly acts in contravention of section 10(2); or

(e) being the Director, wilfully fails when required under section 11(2) to inform the Permanent Secretary of an auditee or the Head of the Public Service (as the case may be) of a suspected case of fraud or irregularity by the auditee, commits an offence and is liable on summary conviction to a fine not exceeding $5000 or to imprisonment for a term not exceeding 12 months or to both such fine and imprisonment.

(3) For the purposes of subsection (1), the Director includes any officer acting under the instructions of the Director.

(4) Notwithstanding anything in any other provision of law, proceedings in respect of an offence against this Act shall be commenced within three years after the date of the commission of the offence.

(5) No person shall be charged with an offence under subsection (2)(a) committed wholly on or after the commencement date of the Bribery Act 2016. [Section 22 subsection (1A) inserted by 2011 : 35 s. 6 effective 21 October 2011; subsection (4) inserted by 2012 : 25 s. 6 effective 3 July 2012; subsection (5) inserted by 2016 : 47 s. 24(1) & Sch 2 effective 1 September 2017; Section 22 amended by BR 85 / 2021 reg. 6 effective 7 June 2021]

23. Review of Department

(1) The Committee shall, at least once every five years, appoint an auditor, or a firm of auditors, that is a member of the Institute of Internal Auditors (IIA) or a member of the Chartered Professional Accountants of Bermuda, to conduct a review of the Department’s operations and assess conformance with the professional standards.

(2) The auditor, or firm of auditors, appointed under subsection (1) shall be independent of the Director and the work of the Department and, on completion of the review, shall submit a written report to the Committee. [Section 23 amended by 2014 : 8 s. 16 effective 11 April 2014; Section 23 subsection (1) amended by

2019 : 47 s. 5 effective 13 December 2019]

SCHEDULE

(Section 6) SOLEMN DECLARATION OF OFFICERS OF THE INTERNAL AUDIT DEPARTMENT

I,…………………………………………………….., solemnly declare that I shall honestly and diligently fulfil my duties as an officer of the Internal Audit Department in conformity with the requirements of the Internal Audit Act 2010, and that I shall not, except as provided by law, at any time disclose or make known any matter which comes to my knowledge by reason of my service as an officer of the Department.

………………………………………………….

Signature of person making declaration

Declared and signed before me this .............. day of ....................... of the year ............... at ...........................

......................................

Secretary to the Cabinet

[Assent Date: 25 February 2010]

[Operative Date: 25 February 2010]

[Amended by:

2011 : 35

2012 : 25

2014 : 8

2016 : 47

2018 : 34

2019 : 47 BR 85 / 2021]