DECREE

INTERNAL AUDIT

Pursuant to the Law on Government Organization dated June 19, 2015;

Pursuant to the Law on Accounting dated November 20, 2015;

Upon the request of the Minister of Finance,

The Government hereby promulgates the Decree on internal audit.

Chapter I

GENERAL PROVISIONS

...

...

...

This Decree prescribes the internal audit carried out by state regulatory authorities, state-owned public service units and enterprises.

Article 2. Subjects of application

1. This Decree shall apply to the followings:

a) Ministries, Ministry-level bodies, Governmental agencies;

b) People’s Committees of centrally-affiliated cities and provinces;

c) State-owned public service units;

d) Enterprises;

dd) Organizations and individuals involved in internal audit.

2. Those subject to the internal audit required by specialized laws shall be governed by these laws. Issues that are not covered by specialized laws shall be subject to provisions laid down herein for the purpose of implementation of internal audit activities.

...

...

...

4. Internal audit of the State Bank shall be subject to the Law on State Budget, law-guiding or other instructional documents issued by the State Bank.

Article 3. Definition

1. Internal auditor means a person performing tasks of internal audit at a unit.

2. Person in charge of internal audit means a person authorized by a competent authority to take charge of internal audit at a unit in accordance with laws or regulations of that unit.

3. Person related to an internal auditor means a natural parent, foster parent, parent-in-law of a spouse, natural child, adopted child or sibling-in-law of the internal auditor.

Article 4. Objectives of internal audit

By means of carrying out inspection, assessment and consulting activities, the internal audit may come up with assurances of independence and objectivity and recommendations about the followings:

1. The internal audit system of a unit must have been established and operated in an appropriate manner in order to prevent, detect and handle risks to which the unit may be exposed.

2. Management and risk management processes of a unit must ensure efficiency and high performance.

...

...

...

Article 5. Fundamental principles of internal audit

1. Independence: An internal auditor shall not be charged with performing tasks subject to internal audit. A unit must ensure that the internal audit is not affected by any interference whilst performing tasks of reporting and assessment.

2. Objectivity: An internal audit must ensure objectivity, accuracy, reliability and equality during the process of performing internal audit tasks.

3. Complying with laws and being held legally liable for internal audit activities.

Article 6. Requirements for assuring compliance with fundamental principles of internal audit

1. Internal auditor must have a fair, unbiased and unprejudiced view.  Internal auditor shall have rights and obligations to report on issues that may affect his/her independence and objectivity in relation to assigned internal audit tasks.

2. Internal auditor must ensure independence and objectivity. In case where the independence or objectivity is affected or is likely to be affected, the internal auditor must inform the immediate supervisory superior or report to one of those persons referred to in clause 4 of Article 12 herein or the person authorized by one of those persons specified in clause 4 of Article 12 herein.

3. Upon carrying out internal audit, a unit must implement the following regulations in order to ensure the independence and objectivity, prevent inequality, prejudice and conflict of interests:

a) Internal auditors shall not be allowed to carry out the internal audit of internal regulations, policies, procedures or processes that they assume the main responsibility for formulation thereof;

...

...

...

c) Internal auditors shall not be allowed to get involved in auditing activities and divisions under their assigned duties and authority within the maximum period of 3 years from the date of grant of the decision on exclusion from these activities or tasks of management of these divisions;  

d) Units must implement inspection measures in order to ensure independence and objectivity of the internal audit immediately in the process of performing the internal audit at audited units and divisions, and at the stage of preparing and submitting audit reports;

dd) Scope, cycle and methods of audit and audit processes must be determined to ensure that audit results duly reflect the reality of audited matters;

e) Audit recordings contained in internal audit reports must be discreetly analyzed based on collected data and information to ensure objectivity. 

Article 7. Moral principles of internal auditors

1. In the process of performing auditing and consulting tasks, internal auditors must ensure conformity with and maintenance of the least moral principles of internal auditors as follows:

a) Truthfulness: Internal auditor must perform their professional tasks in an honest and discreet manner and a high sense of responsibility; comply with provisions of laws and declare necessary information according to requirements of laws and professional requirements of internal auditors; shall be prohibited from participating in illegal acts or other acts causing harm to the prestige of the audit profession and units;

b) Objectivity: Internal auditors must ultimately express their professional objectivity with respect to the collection, assessment and exchange of information about audited activities and processes.   Internal auditors may give unbiased comments on all of related circumstances and must not be affected or controlled by personal interests or any person while making their judgement and conclusion;

c) Professional capabilities and discretion: Internal auditors must apply their internal audit knowledge, skills and professional experience. They must also act in a discreet manner and in conformity with professional and technical standards in force;

...

...

...

dd) Professional manner: Internal auditors must comply with laws and relevant regulations, must be prevented from performing any act that may reduce their professional prestige.

2. Persons in charge of internal audit activities must, in addition to assurance of conformance to professional moral principles specified in clause 1 of this Article, implement monitoring, assessment and management measures in order to ensure that internal auditors comply with professional moral principles of internal auditors.

Chapter II

SPECIFIC PROVISIONS

Section 1: INTERNAL AUDIT DUTIES

Article 8. Internal audit duties of state regulatory authorities

1. Ministries, Ministry-level agencies and Governmental bodies must perform internal audit duties at these entities and their affiliates, including public service units affiliated to these entities.

2. People’s Committees of centrally-affiliated cities and provinces must perform internal audit duties at these Committees; their specialized departments and affiliated public service units.

3. Implementation of internal audit duties at entities specified in clause 1 and clause 2 of this Article shall adhere to principles of avoidance of increase in number of employees and additional focal points.

...

...

...

If state-owned public service units covering recurrent and capital expenditures on their own, and those covering recurrent expenditures on their own, set aside at least VND 20 billion per year for the total fund of wages, salaries, allowances and other salary-based contributions for existing employees (including permanent employees that are present and contract employees defined in the Government’s Decree No. 68/2000/ND-CP dated November 17, 2000 and other specialized contract employees), or hire at least 200 employees, they shall be required to perform the internal audit.

Article 10. Internal audit duties of enterprises

1. Enterprises that have to perform the internal audit shall include the followings:

a) Listed companies;

b) Enterprises with 50% of their charter capital is held by the State, which are parent companies operating in a parent - subsidiary business model;  

c) State enterprises which are parent companies operating in a parent - subsidiary business model.  

2. Other enterprises not covered in clause 1 of this Article shall be encouraged to perform the internal audit.

3. Enterprises referred to in this Article may hire independent audit bodies legally accredited to render their audit services. In case where enterprises hire accredited independent auditing bodies to provide internal audit services, they must ensure conformance to fundamental internal audit principles and other requirements for assuring conformance to fundamental internal audit principles as prescribed in Article 5 and Article 6 herein. 

Hiring of independent bodies providing internal audit services for enterprises controlled by the Ministry of National Defense and the Ministry of Public Security shall be subject to regulations approved by the Minister of National Defense and the Minister of Public Security.

...

...

...

1. Hold undergraduate degrees in majors meeting audit requirements, acquire sufficient and updated knowledge about assigned internal audit sectors.  

2. Have at least 5 years’ working experience in the industries relevant to their training majors or at least 3 years’ experience in working for their current employer or at least 3 years' experience in working in the audit, accounting or inspection field.

3. Acquire general knowledge and understanding about laws and business operations of audited units; have competence in collecting, analyzing, assessing and consolidating information; have knowledge and skills related to the internal audit.

4. Have not yet been subject to any discipline in a warning or severer form that is likely to be imposed on any violation arising from economic or financial administration or accounting activities or, at present, be not subject to disciplinary actions.

5. Meet other standards prescribed by audited units.

Article 12. Internal audit rules and processes

1. Internal audit rules must set out regulations on objectives, scope of operation, position, duties, powers and responsibilities of an internal audit department in an audited unit, and relationship of that department with others; requirements concerning independence, objectivity, fundamental principles, requirements concerning professional qualification and assurance of internal audit quality and other contents.

2. Internal audit processes shall include the followings: providing regulations and specific instructions on methods of assessment of risks, preparing annual internal audit plans, planning each internal audit, methods for carrying out internal audits, preparing and submitting audit reports, monitoring and supervising post-audit corrections, keeping track of implementation of post-audit recommendations, filing records and documents related to internal audits.   

3. After consulting provisions laid down herein, units performing internal audits must formulate their internal audit rules and processes relevant to their particular business characteristics. These units shall be encouraged to adopt international internal audit rules if these practices are not contradictory to provisions of this Decree and other legislative documents.

...

...

...

a) Ministers, Heads of Ministry-level agencies, Heads of Governmental bodies over Ministries, Ministry-level agencies and Governmental bodies;

b) People’s Committees of centrally-affiliated cities and provinces over People’s Committees of centrally-affiliated cities and provinces;

c) Heads of state-owned public service units over state-owned public service units;

d) Management Boards over listed companies;

dd) Management Boards over enterprises with 50% of their charter capital is held by the State, which are parent companies operating in a parent - subsidiary business model;  

e) Members’ Boards and Presidents of enterprises over state enterprises which are parent companies operating in a parent - subsidiary business model.  

Article 13. Internal audit approaches

1. The method for carrying out the internal audit means the risk-oriented auditing approach that prioritizes the concentration of resources on auditing of units, departments or processes assessed at the high level of risk.

2. Internal audit plans must be developed based on results of the risk assessment, must be updated and revised to correspond to variations arising from business activities of units and changes in associated risks.

...

...

...

1. Based on objectives, policies, scale and level of risks of activities and available resources, internal audit departments shall develop annual internal audit plans containing information about the extent of internal audit, audited subjects, audit objectives and audit time and distribution of resources.

2. Annual internal audit plans of units performing internal audits shall have to meet the following requirements:

a) Risk-orientedness: Operations/management and operations departments at high level of risk must be audited at least once a year;

b) The audit plan must save adequate time for performing unscheduled audits right after receipt of an audit request or upon receipt of information about signs of offences or high risks of audited subjects.

3. Annual internal audit plans of audited units may be revised when there is any basic change in the scale of operations, risk variations or existing resources.

4. Following years’ internal audit plans shall be submitted to:

a) Ministers, Heads of Ministry-level agencies, Heads of Governmental bodies in case of auditing of Ministries, Ministry-level agencies and Governmental bodies;

b) People’s Committees of centrally-affiliated cities and provinces in case of auditing of People’s Committees of centrally-affiliated cities and provinces;

c) Heads of state-owned public service units in case of auditing of state-owned public service units;

...

...

...

dd) Management Boards or Control Boards in case of auditing of enterprises with 50% of their charter capital is held by the State, which are parent companies operating in a parent - subsidiary business model;  

e) Members’ Boards, Presidents of enterprises or Control Boards in case of auditing of state enterprises which are parent companies operating in a parent - subsidiary business model;   

g) Other departments under internal audit rules of each audited unit.

5. Authority to grant approval of audit plans shall be delegated to:

a) Ministers, Heads of Ministry-level agencies, Heads of Governmental bodies over Ministries, Ministry-level agencies and Governmental bodies;

b) People’s Committees of centrally-affiliated cities and provinces over People’s Committees of centrally-affiliated cities and provinces;

c) Heads of state-owned public service units over state-owned public service units;

d) Management Boards over listed companies;

dd) Management Boards over enterprises with 50% of their charter capital is held by the State, which are parent companies operating in a parent - subsidiary business model;  

...

...

...

Article 15. Implementation of audit plans

1. Units performing internal audits shall be required to implement annual internal audit plans and other unscheduled audits in accordance with regulations in force.

2. Scope, cycle and methods of audit and audit processes must be determined to ensure that audit results duly reflect the reality of audited matters.

Article 16. Audit reports

1. Internal audit reports of audited units must be prepared, completed and submitted to:

a) Ministers, Heads of Ministry-level agencies, Heads of Governmental bodies in case of auditing of Ministries, Ministry-level agencies and Governmental bodies;

b) People’s Committees of centrally-affiliated cities and provinces in case of auditing of People’s Committees of centrally-affiliated cities and provinces;

c) Heads of state-owned public service units in case of auditing of state-owned public service units;

d) Management Boards, Members’ Boards, Presidents of enterprises, Control Boards or Directors General (Directors) in case of auditing of enterprises;

...

...

...

2. An internal audit report must clarify:  Audited matters, audit extent; opinions and conclusions related to audited matters and bases for giving such opinions and conclusions; weaknesses, unresolved issues, defaults, defects, violations and recommended actions against errors, defects and violations; recommended measures for rationalization and improvement of auditing processes; perfection of policies on management of risks and organizational structure of each audited unit (if any).

3. Internal audit reports must have opinions from leaderships of departments/units subject to internal audits. In case where audited departments/units have contentious opinions on audit results, internal audit reports shall need to clarify contentious opinions of audited departments/units and reasons.

4. Internal audit reports must bear signatures of the Head or Leader of the audit group or commission or the person in charge of the internal audit. In case of hiring of independent bodies rendering internal audit services, audit reports must carry signatures of the legal representatives or authorized persons as a minimum requirement and stamps (if any) of these bodies.   In addition, audit reports may carry signatures of other related persons of internal audit service providers, depending on agreements between parties involved.

5. Annual audit reports: The annual audit report must carry the signature of the person in charge of the internal audit. Within the duration of 60 days from completion of a financial year, the person in charge of the internal audit must send an annual audit report which is the consolidated report on results of implementation of the internal audit plan in the previous year to those persons referred to in clause 1 of this Article. An annual audit report must clarify: Predetermined audit plan; audit tasks that have already been performed; unresolved issues and serious violations that have already been detected; measures recommended after the internal audit; assessment of the internal control system relating to activities to be audited and recommendations about this system for the purpose of building a more perfect one; situations of implementation of measures, recommendations and proposals after completion of the internal audit.

Article 17. Unscheduled audit reports and specialized consultations

1. The internal audit department shall make an unscheduled report in the following cases:

a) In case where it is established that serious violations or high-level risks may cause adverse effects on an audited unit’s operations, the internal audit department of that unit must immediately report to those specified in clause 4 of Article 12 herein;

b) Send a timely notification to the head of the audited department/unit if unresolved issues specified in the audit report are not corrected or remedied on time after a specified time limit;

c) After informing the head of the audited department/unit as prescribed in point b of this clause, if these issues have not yet been corrected or remedied, a timely written notification must be sent to those specified in clause 4 of Article 12 herein.

...

...

...

3. In the course of internal audit, the persons in charge of internal audit of state enterprises may consult with and ask for professional opinions from the persons in charge of internal audit of ministries, Ministry-level agencies, Governmental bodies, People’s Committees of centrally-affiliated cities and provinces that are representatives of owners of these state enterprises.

Article 18. Filing and archival of internal audit records and documents

1. Records and documents created in each internal audit must be in writing and stored in order so that organizations and individuals (that are qualified and have good understanding of the audited unit's operations) entitled to have access to them may understand internal audit activities and results.

2. Audit reports, records and documents must be filed and archived at audited units in accordance with laws on archival.

Article 19. Assurance of quality of internal audit activities

1. A unit shall be required to carry out the internal assessment of internal audit activities in order to ensure quality of internal audit activities.

The internal assessment of internal audit activities refers to the self-assessment of internal audit activities after completion of an internal audit. The annual self-assessment of all of internal audit activities shall be performed by the internal audit department with the aim of assurance of quality of internal audit activities.

2. Annual internal assessment results must be reported to those specified in clause 4 of Article 12 herein.

3. Units in need of such assessment may outsource accredited independent bodies to assess the quality of internal audit activities. 

...

...

...

Article 20. Duties of internal audit departments

1. Design internal audit processes at their units and submit them to intermediate superiors to request their consideration and approval.

2. Prepare annual internal audit plans for submission to competent authorities to request their approval and implement internal audits according to approved audit plans.

3. Implement internal audit policies, processes and procedures which have already been approved and assure quality and effectiveness thereof.

4. Carry out unscheduled audits and offer counsels after receipt of requests from those specified in clause 4 of Article 12 herein.

5. Give recommendations about measures to correct and remedy errors; propose measures to improve and increase efficiency and performance of internal audit systems.

6. Prepare audit reports.

7. Inform and send internal audit results on time in accordance with regulations in force.

8. Develop, modify, supplement and perfect internal audit approaches and scope of internal audit in order to keep abreast of the growth of their units.

...

...

...

10. Present internal audit opinions upon request so that those referred to in clause 4 of Article 12 herein can consider issuing their decisions on budget estimates, distribution and allocation of the estimated budget, final budget accounts, financial and managerial reporting. 

11. Maintain effective rapports between units and independent audit bodies. 

12. Perform other tasks assigned by those specified in clause 4 of Article 12 herein or under legislative regulations.

Article 21. Responsibilities of internal audit departments

1. Protect confidentiality of records, documents and data in accordance with regulations in force and internal audit rules of each audited unit.

2. Bear responsibility to those specified in clause 4 of Article 12 herein for internal audit performance results, assessments, conclusions, recommendations and proposals integrated into internal audit reports.

3. Monitor, expedite and inspect results of implementation of recommendations after completion of internal audit of departments of units.

4. Organize regular training sessions in order to improve and assure professional competences of internal auditors.

Article 22. Rights of internal audit departments

...

...

...

2. Handle and inspect all of professional processes and property during the process of internal audit; meet all staff members of audited units and interview them about issues related to audited matters.

3. Receive documents, records and meeting minutes from those specified in clause 4 of Article 12 herein and from other entities related to internal audit activities.

4. Attend internal meetings in accordance with laws and regulations of audited units’ statutes or internal rules.

5. Oversee, assess and monitor corrective and remedial actions against errors and incomplete issues which have been recorded and warned of in audit reports by leaderships of audited units and departments.

6. Have access to protection against refusal of collaboration of audited departments/units.

7. Have access to training in improving competencies of staff of internal audit departments.

8. Actively perform tasks specified in approved audit plans.

9. Exercise other rights defined under laws and internal audit rules of each audited unit.

Article 23. Rights and responsibilities of internal auditors

...

...

...

a) Carry out internal audit plans that have already been approved;

b) Identify information that is sufficient, reliable, proper and useful to accomplish audit objectives;

c) Rely on appropriate analyses and assessments in order to give independent and unbiased audit conclusions and results;

d) Store related information in order to support audit conclusions and produce audit results;

dd) Bear responsibility for results of assigned internal audits;

e) Protect confidential information in accordance with laws;

g) Incessantly improve professional competencies and adhere to professional ethics;

h) Assume other responsibilities prescribed by laws and internal audit rules of each audited unit.

2. Rights:

...

...

...

b) Request audited department/units to provide materials, documents and information related to audited matters in a timely and sufficient manner;

c) Retain written opinions on audit results within the scope of their assigned tasks;

d) Exercise other rights defined under laws and internal audit rules of each audited unit.

Article 24. Rights and responsibilities of persons in charge of internal audits

1. Responsibilities:

a) Manage and administer internal audit departments to ensure that they perform tasks in accordance with regulations in force;

b) Ensure that internal audit staff members have access to regular training, possess necessary qualifications and competencies to perform assigned tasks;

c) Implement measures in order to ensure independence, objectivity and truthfulness of internal audits;

d) Report to those specified in clause 4 of Article 12 herein whenever detecting defects or shortcomings of internal audit systems;

...

...

...

e) Assume responsibility for results of audits conducted by internal audit departments;

g) Protect confidential information in accordance with laws;

h) Assume other responsibilities prescribed by laws and internal audit rules of each audited unit.

2. Rights:

a) Appeal to those specified in clause 4 of Article 12 herein to promulgate internal audit rules and processes as well as internal audit approaches;

b) Request staff members of other departments to get involved in internal audit activities; request hiring of experts, consultants and audit service providers taking part in internal audits where necessary and on condition that the independence of internal audits is respected;

c) Attend meetings in accordance with internal rules of their units and legislative regulations.

d) Exercise the rights prescribed in point a, b and c of clause 2 of Article 23 herein;

dd) Exercise other rights defined under laws and internal audit rules of their units.

...

...

...

Article 25. Responsibilities of Ministers, Heads of Ministry-level agencies, Heads of Governmental bodies, Chairpersons of People’s Committees of centrally-affiliated cities and provinces, and Heads of state-owned public service units

1. Adopt internal audit rules of their units.

2. Provide internal audit departments with advantages so that they can fully implement their rights and duties in accordance with regulations in force.

3. Issue decisions on implementation of recommendations after completion of internal audits; take timely actions to implement recommendations and suggestions given after completion of internal audits.

4. Assume other responsibilities for internal audits in accordance with legislative regulations.

Article 26. Responsibilities of Management Boards, Members’ Boards and Presidents of enterprises

1. Adopt internal audit rules of their units.

2. Provide internal audit departments with advantages so that they can fully implement their rights and duties in accordance with regulations in force.

3. Review, check and assess the performance and effectiveness of internal audit departments; mainly take responsibility for assuring quality of internal audit activities.

...

...

...

5. Issue decisions on implementation of recommendations after completion of internal audits; assist audited departments in and monitor implementation of recommendations after internal audits; take timely actions to implement recommendations and suggestions given after completion of internal audits.

6. Approve and revise annual internal audit plans to ensure that these plans are risk-oriented.

7. Assume other responsibilities prescribed by laws and internal audit rules of their units.

Article 27. Responsibilities of Directors General (Directors) of enterprises

1. Provide internal audit staff with advantages to perform their assigned tasks and direct other departments to collaborate with internal audit departments in performing tasks in accordance with internal audit rules.

2. Push audited units and departments to implement recommendations agreed upon with internal audit departments or follow directions of Management Boards or Members’ Boards; inform internal audit departments of implementation of recommendations agreed upon with internal audit departments.

3. Ensure that internal audit departments are fully informed of any change and problem arising from activities of their units in order to early detect associated risks.

4. Assume other responsibilities prescribed by laws and internal audit rules of their units.

Article 28. Responsibilities of audited units and departments

...

...

...

2. Promptly inform internal audit departments in case of detecting any error, unsolved issue, violation, risk or loss of property or risk of loss of property.

3. Implement recommendations agreed upon with internal audit departments or follow directions given by those specified in clause 4 of Article 12 herein.

4. Provide all favorable conditions for internal audit departments in order to ensure they perform their tasks the most effectively.

5. Assume other responsibilities prescribed by laws and internal audit rules of their units.

Section 4: STATE MANAGEMENT OF INTERNAL AUDITS

Article 29. State management of internal audits

1. The Government shall carry out the uniform state management of internal audits.

2. The Ministry of Finance shall be held responsible to the Government for the state management of internal audits and perform the following duties:

a) Draft legislative documents on internal audits, submit them to the Government to seek its ratification, or issue those falling under their jurisdiction.

...

...

...

c) Adopt sample internal audit rules as a basis for formulation of internal audit rules of their own in accordance with clause 1 of Article 12 herein.

Chapter III

IMPLEMENTARY PROVISIONS

Article 30. Transitional provisions

Within duration of 24 months from the entry into force of this Decree, units subject to internal audit requirements as prescribed in Article 8, Article 9 and Article 10 hereof must complete tasks necessary for performing internal audit activities in accordance with this Decree.

Article 31. Entry into force

This Decree shall be in effect on April 1, 2019.

Article 32. Implementary responsibilities

Ministers, Heads of Ministry-level agencies, Heads of Governmental bodies, Chairpersons of People’s Committees of provinces and centrally-affiliated cities, other organizations and individuals involved shall be responsible for implementing this Decree./.

...

...

...

PP. GOVERNMENT
PRIME MINISTER




Nguyen Xuan Phuc