Related to the Output 2.1 of the project, the overall objective of the assignment is to standardize and operationalize the RBIA manuals across the IAA and MACs, and to strengthen the capacity of internal audit staff to consistently apply the methodology, supported by modern data analytics and strong audit communication practices.

Specific objectives include:

1.   Standardize the RBIA manuals and deploy them as the common framework for internal audit practice across participating MACs, moving audit practice from a compliance-based to a systematic, risk-focused approach.

2.   Build the technical capacity of internal auditors to plan and execute systems audits, apply data mining and analytics techniques, and detect ghost transactions, payroll and procurement irregularities.

3.   Strengthen adherence to the IIA International Professional Practices Framework (IPPF) / International Standards for the Professional Practice of Internal Auditing, including audit evidence, documentation and quality assurance practices.

4.   Improve the quality, clarity and impact of audit communication, including report writing and data storytelling for presenting audit findings to management and oversight bodies.

5.   Support the IAA in institutionalizing the RBIA approach through standardized tools, templates, job aids and a sustainable internal training/coaching capability, so that gains are not dependent on continued external support.

Under the overall guidance and supervision of the IAA & Expertise France, the consultant will deliver the assignment through two complementary parts described below. Both are tailored to the RBIA manuals and to the operating context of participating MACs, and should be sequenced so that Part 1 (standardization) establishes the methodology that Part 2 (training) then builds capacity to apply.

Part 1. Framework Standardization

Objective: Deploy the specialized RBIA manuals to the IAA to move internal audit practice toward a systematic, risk-focused approach across MACs.

1.1 Review and gap analysis

•     Review the existing RBIA manuals (audit manual, methodology guides, templates and any related policy documents) against the IIA Standards/IPPF and against the practical operating conditions of MACs (staffing levels, systems, data availability).

•     Assess consistency and completeness across the manuals, identify gaps, duplications or provisions that are impractical to apply, and benchmark against comparable risk-based audit frameworks used in the region where useful.

•     Consult IAA management, a sample of MAC internal audit heads, and relevant oversight stakeholders (e.g., audit committees, General Auditing Commission liaison as applicable) to capture practical constraints and expectations.

1.2 Standardization of manuals and tools

•     Revise and standardize the RBIA manuals to resolve identified gaps and ensure a single, consistent methodology that can be applied uniformly across MACs of different size and capacity.

•     Develop or standardize the supporting tools and templates linked to the manuals, including: risk assessment and audit universe templates, risk-based annual audit planning tools, audit programs, working paper and evidence templates, and standardized reporting templates.

•     Ensure the manuals and tools explicitly integrate systems audit, data analytics and ghost-transaction detection techniques, and quality assurance requirements, so that part 1 and part 2 are technically aligned.

1.3 Deployment and change management

•     Develop a deployment/rollout plan for the standardized manuals, including sequencing across participating MACs, resourcing implications, and a change-management and communication plan for IAA and MAC leadership.

•     Conduct orientation/sensitization sessions with IAA senior management and MACs on the standardized manuals and the shift to a risk-focused audit approach.

1.4 Piloting and finalization

•     Support the pilot application of the standardized manuals and tools in at least one live audit assignment in each of a sample of participating MACs (number and MACs to be agreed with the IAA at inception).

•     Observe and coach MAC audit teams during the pilot, document practical issues encountered, and refine the manuals and tools accordingly.

•     Finalize and hand over the standardized RBIA manuals, together with a short institutionalization note describing how the IAA should own, maintain and periodically update the manuals going forward.

1.5   Monitoring of Relevant Logframe Indicators

•     Develop the project logframe and identify the relevant indicator(s) linked to Internal and external audit systems are bolstered and this specific RBIA assignment.

•     Establish a simple monitoring approach and baseline for the relevant indicator(s), drawing on available IAA and MAC information.

•     Monitor progress against the relevant indicator(s) during implementation of the RBIA framework standardization, deployment, training and pilot activities.

•     Collect and validate evidence of progress, including the number of MACs applying the standardized RBIA methodology, internal audit staff trained, application of standardized tools, and other agreed measures relevant to the project logframe.

•     Provide brief updates on indicator progress and flag implementation gaps or corrective actions required.

•     Contribute relevant indicator results and evidence to the assignment’s final report and recommendations for institutionalization.

Part 2: Training

Objective: Build the competencies of internal audit staff across the IAA and participating MACs to apply the standardized RBIA manuals in practice, through a structured, competency-based training programme covering three thematic areas.

2.1 Systems Audit, Data Analytics & Ghost Transaction Detection

•     Systems audit: planning and executing audits of automated financial management, payroll and procurement systems, including IT general and application controls relevant to internal auditors (not a full IT audit certification).

•     Data mining, analytics and storytelling: use of analytical techniques and accessible tools (e.g., spreadsheet-based analytics, and other tools available to the IAA) to interrogate large transaction datasets, identify anomalies, trends and red flags, and translate analytical results into a clear narrative.

•     Payroll integrity and procurement compliance: techniques for testing payroll data for ghost workers, duplicate payments and unauthorized changes, and for assessing compliance of procurement processes with applicable regulations and value-for-money principles.

•     Review of concession agreements, payrolls and financial transactions: practical exercises reviewing concession/contract terms against actual revenue and compliance reporting, and cross-checking payroll and financial transaction data, using real or de-identified MAC data where available.

2.2 Internal Audit Standards, Methodology & Quality Assurance

•     IIA Standards/IPPF: The International Professional Practices Framework, the International Standards for the Professional Practice of Internal Auditing, and the Code of Ethics, with practical application to the standardized RBIA manuals.

•     Audit evidence and documentation: gathering sufficient, reliable and relevant audit evidence; structuring working papers; and maintaining an audit trail that supports conclusions and withstands external review.

•     Quality Assurance: designing and applying a quality assurance and improvement programme (QAIP), including supervisory review, internal self-assessment, and preparation for periodic external quality assessment.

2.3 Audit Communication & Reporting

•     Strategic communication: engaging auditees, senior management and audit/oversight committees throughout the audit process, and managing sensitive or contested findings.

•     Audit report writing for easy interpretation: structuring reports (executive summaries, clear findings, risk ratings, practical recommendations) so that non-technical readers can act on them quickly.

•     Data storytelling, particularly for presenting audit findings: using visuals, dashboards and narrative techniques to present analytical findings (from Component 2.1) persuasively to decision-makers.

2.4 Cross-cutting training design and delivery tasks

•     Conduct a brief training needs assessment/diagnostic to confirm participant profiles, MAC-specific priorities and available data before finalizing training design, building on the review conducted under Component 1.

•     Develop or adapt training curricula, facilitator guides, case studies, datasets and job aids aligned with the standardized RBIA manuals and tools from Component 1.

•     Deliver training through a blended approach: classroom sessions, hands-on practical workshops using real or de-identified data, and, where feasible, on-the-job coaching within selected MACs (linked to the Component 1 pilots).

•     Administer pre- and post-training assessments for each module to measure knowledge gain, and collect participant feedback (course evaluation) after each session.

•     Prepare a short trainer/facilitator handover pack so that IAA staff can co-facilitate and eventually sustain future iterations of the training.

The following deliverables are indicative and should be refined and agreed with the IAA and EF at inception. All deliverables are subject to review and written approval by the IAA and EF before associated payments are released.