Decree No. 05/2019/ND-CP regulatons on internal audit

DECREE

On internal audit^[1]

Pursuant to the June 19, 2015 Law on Organization of the Government;

Pursuant to the November 20, 2015 Accounting Law;

At the proposal of the Minister of Finance;

The Government promulgates the Decree on internal audit.

Chapter I

GENERAL PROVISIONS

Article 1.Scope of regulation

This Decree prescribes internal audit in state agencies, public non-business units and enterprises.

Article 2.Subjects of application

1. This Decree applies to:

a/ Ministries, ministerial-level agencies, and government-attached agencies;

b/ Provincial-level People’s Committees;

c/ Public non-business units;

d/ Enterprises;

dd/ Other organizations and individuals involved in internal audit activities.

2. Entities that are required by specialized laws to carry out internal audit shall comply with such specialized laws. For issues not regulated by specialized laws, internal audit shall be carried out in accordance with this Decree.

3. Internal audit of credit institutions must comply with the Law on Credit Institutions, documents guiding this Law, and other guiding documents issued by the State Bank.

4. Internal audit of the State Bank must comply with the Law on the State Bank of Vietnam, documents guiding this Law, and other guiding documents issued by the State Bank.

Article 3.Interpretation of terms

1. Internal audit performer means a person performing internal audit work of a unit.

2. Person in charge of internal audit means a person assigned by a competent authority defined by law or by regulations of a unit to take charge of internal audit of such unit.

3. Affiliated person of an internal audit performer may be his/her blood parent, adoptive parent, parent-in-law, spouse, offspring, adopted child, blood sibling or sibling-in-law.

Article 4.Objectives of internal audit

Through examination, assessment and consultancy activities, internal audit provides independent and objective guarantees and recommendations about:

1. Units’ internal control systems established and operating in a proper manner, in order to prevent, detect and address risks of the units.

2. Governance and risk management processes of units, in order to ensure their effectiveness and high efficiency.

3. Operation objectives and strategic objectives, and working plans and tasks which units have achieved or performed.

Article 5.Basic principles of internal audit

1. Independence: Internal audit performers of units may not concurrently perform jobs subject to internal audit. Units shall ensure that internal audit is not subject to any intervention while the reporting and assessment tasks are performed.

2. Impartiality: Internal audit performers shall ensure impartiality, accuracy, honesty and fairness while performing their tasks.

3. Compliance with law and responsibility before law for internal audit activities.

Article 6.Requirements to ensure compliance with basic principles of internal audit

1. Internal audit performers must have a fair, impartial and unbiased attitude. They have the right and obligation to report on matters that may affect their independence and impartiality related to the assigned internal audit work.

2. Internal audit performers must be independent and impartial. In case their independence and impartiality is affected or likely to be affected, they shall report such to their direct managers or the entities specified in Clause 4, Article 12 of this Decree or persons authorized by such entities.

3. In internal audit, a unit shall comply with the following regulations in order to ensure the independence and impartiality and prevent unfairness, prejudice and conflict of interests:

a/ Internal audit performers may not audit internal regulations and policies, procedures and processes of which they are in prime charge of formulation;

b/ Internal audit performers are not in a conflict of rights and economic benefits with the audited divisions or sections; they may not audit divisions and sections managed by their affiliated persons;

c/ Internal audit performers may not participate in auditing operations and sections they are in charge of or manage within 3 years from the date of issuance of decisions relieving them from conducting such operations or managing such sections;

d/ The unit shall take inspection measures to ensure the independence and impartiality of internal audit in the course of performing audit at the audited divisions and sections and at the stage of making and sending audit reports;

dd/ Audit scope, cycle, method and process must ensure that audit results correctly reflect the actual state of audited operations;

e/ Auditing notes in internal audit reports shall be prudently analyzed and based on collected data and information to ensure impartiality.

Article 7.Code of professional ethics of internal audit performers

1. In the course of performing audit and providing consultancy, internal audit performers shall strictly comply with and maintain at least the following professional ethics:

a/ Integrity: Internal audit performers shall perform their professional jobs with honesty, prudence and sense of responsibility; and comply with the relevant regulations and disclose necessary information as required by law and to meet professional requirements of internal audit; they may not participate in illegal activities or activities harmful to the professional prestige and reputation of their units;

b/ Impartiality: Internal audit performers shall show the highest level of professional impartiality in the collection, evaluation and exchange of information about audited operations and processes. They may make impartial evaluations about all related circumstances and are not influenced by personal interests or anyone in making their considerations and conclusions;

c/ Professional capacity and prudence: Internal audit performers shall apply their professional knowledge, skills and experience in internal audit and, at the same time, act prudently in accordance with the applicable professional and technical standards;

d/ Confidentiality: Internal audit performers shall respect the values of and ownership over the provided information and refrain from disclosing such information without permission of competent authorities, unless the information disclosure is one of their professional responsibilities or required by law;

dd/ Professional behavior: Internal audit performers shall comply with law and relevant regulations and refrain from taking acts harmful to their professional reputation.

2. Persons in charge of internal audit shall, apart from complying with the code of professional ethics prescribed in Clause 1 of this Article, take monitoring, evaluation and management measures to ensure internal audit performers comply with the code of professional ethics.

Chapter II

SPECIFIC PROVISIONS

Section 1

INTERNAL AUDIT WORK

Article 8.Internal audit work of state agencies

1. Ministries, ministerial-level agencies and government-attached agencies shall perform internal audit work at their head offices and attached units, including non-business units.

2. Provincial-level People’s Committees shall perform internal audit work at their offices, specialized agencies and attached non-business units.

3. The performance of internal audit work at the units specified in Clauses 1 and 2 of this Article must neither lead to an increase in state payrolls nor create new working positions.

Article 9.Internal audit work of public non-business units

Public non-business units that cover by themselves their regular expenses and investment expenses and those that cover by themselves their regular expenses and have a total amount of salaries and salary-based allowances and contributions of their existing employees (including employees on state payrolls, employees working under labor contracts under the Government’s Decree No. 68/2000/ND-CP of November 17, 2000, and employees working under other specialized labor contracts) of at least VND 20 billion or employ at least 200 employees each shall perform internal audit work.

Article 10.Internal audit work of enterprises

1. The following units shall perform internal audit work:

a/ Listed companies;

b/ Enterprises of which the State owns more than 50% of charter capital and which are parent companies operating after the parent company-subsidiary model;

c/ State enterprises which are parent companies operating after the parent company-subsidiary model;.

2. Enterprises not specified in Clause 1 of this Article are encouraged to perform internal audit work.

3. The enterprises specified in this Article may hire independent audit firms qualified for conducting audit operations as prescribed by law to provide internal audit services. Enterprises that hire independent audit firms to provide internal audit services shall comply with the basic principles of internal audit and satisfy the prescribed requirements to ensure compliance with the basic principles of internal audit prescribed in Articles 5 and 6 of this Decree.

The hiring of internal audit services by enterprises of the Ministry of National Defense and Ministry of Public Security must comply with the regulations of the Minister of National Defense and Minister of Public Security.

Article 11.Criteria for an internal audit performer

1. Possessing a university or higher degree in a major suitable to audit requirements, having sufficient and updated knowledge about fields in which he/she is assigned to perform internal audit.

2. Having at least 5 years’ experience of working in the trained major or at least 3 years’ experience of working in the current employing unit or at least 3 years’ experience of working as an auditor, accountant or inspector.

3. Having general knowledge about law and operations of the unit; being capable of collecting, analyzing, evaluating and synthesizing information; having knowledge about and skills in internal audit.

4. Having never been disciplined in the form of caution or more severe sanctions for a violation in economic management, finance or accounting or is not currently serving a disciplining sanction.

5. Other criteria prescribed by the employing unit.

Article 12.Internal audit regulation and process

1. An internal audit regulation covers objectives and scope of operation, position, tasks, powers and responsibilities of the internal audit division of a unit and its relationship with other divisions, including requirements on independence and impartiality, basic principles, professional qualifications, assurance of quality of internal audit, and other related contents.

2. An internal audit process covers provisions and detailed guidelines on risk assessment approach, formulation of annual internal audit plans and plan for each audit, method of performing audit jobs, making and sending audit reports, post-audit monitoring and correction supervision, monitoring of implementation of post-audit recommendations, and archive of internal audit records and documents.

3. Based on the provisions of this Decree, units shall formulate their internal audit regulations and processes suitable to their operation characteristics. Units are encouraged to apply international practices on internal audit that are not contrary to the provisions of this Decree and other legal documents.

4. Competent to issue internal audit regulations are:

a/ Ministers, heads of ministerial-level agencies or heads of government-attached agencies, for ministries, ministerial-level agencies or government-attached agencies;

b/ Chairpersons of provincial-level People’s Committees, for provincial-level People’s Committees;

c/ Heads of public non-business units, for public non-business units;

d/ Boards of Directors, for listed companies;

dd/ Boards of Directors, for enterprises of which the State owns more than 50% of charter capital and which are parent companies operating after the parent company-subsidiary model;

e/ Members’ Councils or Presidents, for state enterprises which are parent companies operating after the parent company-subsidiary model.

Article 13.Internal audit approaches

1. Internal audit approach is the risk-based audit approach whereby resources are concentrated to audit units, divisions and processes that are rated to be of high risk.

2. An internal audit plan shall be formulated based on risk assessment results and updated, changed or modified to suit developments or changes in the operation of a unit and change of accompanying risks.

Article 14.Annual internal audit plans

1. Based on objectives, policies, scale and risk level of existing operations and resources, internal audit divisions shall formulate annual internal audit plans, stating the scope of audit, auditee, audit objectives and period, and allocation of resources.

2. An annual internal audit plan of a unit must meet the following requirements:

a/ Risk-based approach: To ensure that high-risk executive and professional operations/divisions are audited at least once a year;

b/ To ensure a sufficient time volume for performing unscheduled audits upon request or upon the receipt of information about signs of a violation or high risk of to-be-auditees.

3. An annual internal audit plan of a unit may be modified upon a fundamental change in the operation scale, risk development or existing resources.

4. An internal audit plan for the next year shall be sent to:

a/ Minister, head of the ministerial-level agency, or head of the government-attached agency, for a ministry or ministerial-level or government-attached agency;

b/ Chairperson of the provincial-level People’s Committee, for a provincial-level People’s Committee;

c/ Head of the public non-business unit, for a public non-business unit;

d/ Board of Directors or Supervisory Board, for a listed company;

dd/ Board of Directors or Supervisory Board, for an enterprise of which the State owns over 50% of the charter capital and which is a parent company operating after the parent company-subsidiary model;

e/ Members’ Council, President or Supervisory Board, for a state enterprise which is a parent company operating after the parent company-subsidiary model;

g/ Other divisions as prescribed by the internal audit regulation of the unit.

5. Competent to approve audit plans are:

a/ Ministers, heads of ministerial-level agencies or heads of government-attached agencies, for ministries, ministerial-level agencies or government-attached agencies;

b/ Chairpersons of provincial-level People’s Committees, for provincial-level People’s Committees;

c/ Heads of public non-business units, for public non-business units;

d/ Boards of Directors, for listed companies;

dd/ Boards of Directors, for enterprises of which the State owns more than 50% of charter capital and which are parent companies operating after the parent company-subsidiary model;

e/ Members’ Councils or Presidents, for state enterprises which are parent companies operating after the parent company-subsidiary model.

Article 15.Implementation of audit plans

1. Units shall organize the implementation of their annual internal audit plans and performance of unscheduled audits under regulations.

2. Audit scope, cycle, approach and process must ensure that audit results correctly reflect the actual state of audited contents.

Article 16.Audit reports

1. An internal audit report of a unit shall be promptly made, completed and sent to:

a/ Minister, head of the ministerial-level agency, or head of the government-attached agency, for a ministry or ministerial-level or government-attached agency;

b/ Chairperson of the provincial-level People’s Committee, for a provincial-level People’s Committee;

c/ Head of the public non-business unit, for a public non-business unit;

d/ Board of Directors, Members’ Council, President, Supervisory Board or Director General (Director), for an enterprise;

dd/ Other divisions as prescribed by the internal audit regulation of the unit.

2. An audit report must clearly state the audited contents, audit scope; evaluations and conclusions on the audited contents and grounds for making such evaluations and conclusions; weaknesses, problems, errors, violations and proposed measures to correct errors and handle violations; proposed measures to rationalize and improve professional processes; improvement of risk management policies and organizational structure of the unit (if any).

3. An audit report must contain opinions of the leaders of the audited division/unit. In case an audited division/unit disagrees with audit results, the internal audit report must clearly state such disagreeing opinions and reasons for making them.

4. An audit report must bear the signature of the head of the audit team or the person in charge of the audit. In case of hiring internal audit services, an audit report must bear at least the signature of the at-law representative or authorized person and the seal (if any) of the service provider. In addition, an audit report may bear signatures of other affiliated persons of the service provider as agreed by the parties.

5. Annual audit reports: An annual audit report must bear the signature of the person in charge of internal audit. Within 60 days after the end of a fiscal year, the person in charge of internal audit shall send an annual audit report summarizing results of the implementation of the preceding year’s internal audit plan to the entity specified in Clause 1 of this Article. An annual audit report must clearly state the set audit plan; performed audit jobs; detected major violations and errors; measures proposed by internal audit performers; evaluation of the internal control system related to audited operations and proposals to improve the internal control system; and implementation or realization of measures, recommendations and proposals of internal audit performers.

Article 17.Extraordinary reports and professional consultation

1. An internal audit division shall make an extraordinary report in the following cases:

a/ When detecting a serious violation or error or seeing a high risk that may adversely impact the operation of its unit, the internal audit division shall promptly report such to the entity specified in Clause 4, Article 12 of this Decree;

b/ If problems stated in the audit report are not promptly addressed and solved after a given period of time, the internal audit division shall promptly notify such to the head of the audited division/unit;

c/ If problems remain unaddressed and unsolved after being notified to the head of the audited division/unit under Point b of this Clause, the internal audit division shall promptly report such in writing to the entity specified in Clause 4, Article 12 of this Decree.

2. In the course of audit, persons in charge of internal audit of public non-business units of ministries, ministerial-level agencies, government-attached agencies or provincial-level People’s Committees may seek professional consultation of persons in charge of internal audit of their respective ministries, ministerial-level agencies, government-attached agencies or provincial-level People’s Committees.

3. In the course of audit, persons in charge of internal audit of state enterprises may seek professional consultation of persons in charge of internal audit of ministries, ministerial-level agencies, government-attached agencies or provincial-level People’s Committees acting as their owner representatives.

Article 18.Archive of internal audit records and documents

1. Records and documents of an audit shall be made in writing and archived in the prescribed sequence so that individuals and organizations (that have professional expertise and knowledge about operations of units) competent to access them can understand audit jobs and performance results.

2. Audit reports, records and documents shall be archived at units in accordance with the law on archives.

Article 19.Assurance of quality of internal audit activities

1. A unit shall conduct internal evaluation of internal audit activities in order to ensure their quality.

Internal evaluation of internal audit activities means self-evaluation of internal audit activities at the end of an audit and annual self-evaluation of all internal audit activities performed by the internal audit division itself in order to ensure the quality of internal audit activities.

2. Results of annual internal evaluation shall be reported to the entities specified in Clause 4, Article 12 of this Decree.

3. A unit may hire an outside organization with professional expertise to evaluate the quality of its internal audit activities.

Section 2

TASKS, RESPONSIBILITIES AND POWERS OF INTERNAL AUDIT DIVISIONS AND INTERNAL AUDIT PERFORMERS

Article 20.Tasks of internal audit divisions

1. To establish the professional process of internal audit for their units, and submit it to the direct managing authority for consideration and approval.

2. To make and submit annual internal audit plans to the competent authority for approval, and perform internal audit activities under approved plans.

3. To implement approved internal audit policies, processes and procedures, ensuring quality and efficiency.

4. To perform unscheduled audits and provide consultancy at the request of the entities specified in Clause 4, Article 12 of this Decree.

5. To recommend measures to correct and address errors; to propose measures to improve and raise effectiveness and efficiency of the internal control system.

6. To make audit reports.

7. To notify and promptly send internal audit results under regulations.

8. To develop, modify, supplement and improve internal audit approaches and scope of their operation in order to update and keep up with the development of their units.

9. To advise agencies, units and enterprises on the selection and control of the use of independent audit services in an economical and efficient manner.

10. To present their opinions when so requested to the entities specified in Clause 4, Article 12 of this Decree for them to consider, decide on, allocate and assign budget estimates, and make budget finalization, financial and governance reports.

11. To maintain the regular exchange of opinions with independent audit divisions of their units in order to ensure effective cooperation.

12. To perform other tasks as assigned by the entities specified in Clause 4, Article 12 of this Decree or prescribed by law.

Article 21.Responsibilities of internal audit divisions

1. To keep confidential documents and information in accordance with current regulations and internal audit regulations of their units.

2. To be answerable to the entities specified in Clause 4, Article 12 of this Decree for results of internal audit work, and evaluations, conclusions, recommendations and proposals in internal audit reports.

3. To monitor, urge and inspect results of the realization of post-internal audit recommendations of other divisions of their units.

4. To organize constant training courses to improve and ensure professional qualifications of internal audit performers.

Article 22.Powers of internal audit divisions

1. To be provided with necessary resources and sufficient and prompt information, documents and records necessary for such internal audit activities as making, allocation and assignment of budget estimates, budget accounting and finalization for budget-estimating units; state budget estimation and finalization for localities; financial statements, governance reports and strategies for enterprises, and other reports related to the organization and operation of units.

2. To access and consider all professional processes and assets when performing internal audit; to contact and interview all employees of their units about matters related to audited contents.

3. To receive meetings’ documents and minutes of the entities specified in Clause 4, Article 12 of this Decree and other functional divisions related to internal audit work.

4. To attend internal meetings in accordance with law or internal regulations or rules of their units.

5. To supervise, evaluate and monitor error correction and remediation acts of leaders of their units and other divisions regarding matters noted by themselves and on which they have made recommendations.

6. To be protected against uncooperative acts of audited divisions/units.

7. To be provided with training to improve the capacity of their personnel.

8. To take the initiative in performing their tasks under approved audit plans.

9. To exercise other powers prescribed by law and internal audit regulations of their units.

Article 23.Responsibilities and powers of internal audit performers

1. Responsibilities:

a/ To implement approved audit plans;

b/ To identify adequate, reliable, appropriate and useful information for the achievement of audit objectives;

c/ To give conclusions and audit results in an independent and impartial manner based on appropriate analyses and evaluations;

d/ To keep relevant information to support conclusions and give audit results;

dd/ To take responsibility for results of audit work they are assigned to perform;

e/ To keep confidential information in accordance with law;

g/ To constantly improve their professional capacity and adhere to the code of professional ethics;

h/ To perform other responsibilities prescribed by law and internal audit regulations of their units.

2. Powers:

a/ To stay independent in making remarks, evaluations, conclusions and recommendations on audited contents while performing audit;

b/ To request audited divisions/units to promptly and adequately provide documents and information related to audited contents;

c/ To reserve their written opinions on audit results within the assigned audit scope;

d/ To exercise other powers in accordance with law and internal audit regulations of their units.

Article 24.Responsibilities and powers of persons in charge of internal audit

1. Responsibilities:

a/ To manage and administer internal audit divisions in performing their tasks under regulations;

b/ To ensure that personnel of internal audit divisions are regularly trained and professionally qualified and capable to perform their tasks;

c/ To implement measures to guarantee the independence, impartiality and reliability of internal audit;

d/ To report to the entities specified in Clause 4, Article 12 of this Decree when detecting weaknesses and problems of the internal control system;

dd/ To give their opinions when consulted by persons in charge of internal audit of attached state enterprises or public non-business units;

e/ To take responsibility for results of audits performed by internal audit divisions;

g/ To keep confidential information in accordance with law;

h/ To perform other responsibilities prescribed by law and internal audit regulations of their units.

2. Powers:

a/ To propose the entities specified in Clause 4, Article 12 of this Decree to issue internal audit regulations, processes and professional approaches;

b/ To request employment of persons from other divisions of their units; to propose hiring of experts, consultants and audit service providers to participate in internal audits when necessary, while ensuring the independence of internal audit;

c/ To attend meetings under internal regulations of their units and in accordance with law;

d/ To exercise the powers provided at Points a, b and c, Clause 2, Article 23 of this Decree;

dd/ To exercise other powers prescribed by law and internal audit regulations of their units.

Section 3

RESPONSIBILITIES OF PARTIES FOR INTERNAL AUDIT

Article 25.Responsibilities of ministers, heads of ministerial-level agencies, heads of government-attached agencies, chairpersons of provincial-level People’s Committees and heads of public non-business units

1. To issue internal audit regulations of their units.

2. To create favorable conditions for internal audit divisions to fully exercise their powers and fulfill their responsibilities under regulations.

3. To decide on the realization of internal audit recommendations; to take timely handling measures upon receiving internal audit recommendations or proposals.

4. To perform other responsibilities for internal audit as prescribed by law.

Article 26.Responsibilities of Boards of Directors, Members’ Councils and Presidents of companies

1. To issue internal audit regulations of their units.

2. To create favorable conditions for internal audit divisions to fully exercise their powers and fulfill their responsibilities under regulations.

3. To review, examine and evaluate the effectiveness and efficiency of internal audit divisions; to take the prime responsibility for ensuring the quality of internal audit activities.

4. To provide necessary resources for internal audit divisions.

5. To decide on the realization of internal audit recommendations; to urge and monitor  divisions in realizing internal audit recommendations; to take timely handling measures upon receiving internal audit recommendations or proposals.

6. To approve or modify annual internal audit plans to ensure these plans are risk-based.

7. To perform other responsibilities for internal audit as prescribed by law and internal audit regulations of their units.

Article 27.Responsibilities of Directors General (Directors) of enterprises

1. To create favorable conditions for internal audit divisions to perform their assigned tasks and direct other divisions in coordinating with internal audit divisions in their task performance under internal audit regulations.

2. To urge units and divisions to realize recommendations on which they have agreed with internal audit divisions or as directed by Boards of Directors or Members’ Councils; to notify internal audit divisions of the realization of recommendations on which they have agreed with internal audit divisions.

3. To ensure that internal audit divisions are fully notified of changes and problems arising in operations of their units in order to identify as soon as possible related risks.

4. To perform other responsibilities for internal audit as prescribed by law and internal audit regulations of their units.

Article 28.Responsibilities of audited units and divisions

1. To provide all information, documents and records necessary for internal audit work at the request of internal audit divisions in an honest, accurate and transparent manner.

2. To promptly notify internal audit divisions of weaknesses, problems, violations, errors, risks and major property losses or risks of property loss as soon as they are detected.

3. To realize recommendations on which they have agreed with internal audit divisions or as directed the entities specified in Clause 4, Article 12 of this Decree.

4. To create favorable conditions for internal audit divisions to work with the highest efficiency.

5. To perform other responsibilities for internal audit as prescribed by law and their internal audit regulations.

Section 4

STATE MANAGEMENT OF INTERNAL AUDIT

Article 29.State management of internal audit

1. The Government shall perform the unified state management of internal audit.

2. The Ministry of Finance is answerable to the Government for performing the state management of internal audit and shall perform the following tasks:

a/ To draft and submit to the Government for promulgation or promulgate according to its competence legal documents on internal audit;

b/ To prescribe the application of professional standards and code of professional ethics of internal audit;

c/ To promulgate the model internal audit regulation for use as a basis for units to make their own internal audit regulations under Clause 1, Article 12 of this Decree.

Chapter III

IMPLEMENTATION PROVISIONS

Article 30.Transitional provisions

Within 24 months from the effective date of this Decree, units obliged to perform internal audit work under Articles 8, 9 and 10 of this Decree shall complete preparations necessary for the performance of internal audit work in accordance with this Decree.

Article 31.Effect

This Decree takes effect on April 1, 2019.

Article 32.Implementation responsibility

Ministers, heads of ministerial-agencies, heads of government-attached agencies, chairpersons of provincial-level People’s Committees, and other related organizations and individuals shall implement this Decree.-

On behalf of the Government
Prime Minister
NGUYEN XUAN PHUC