tamkeen - final ia report - qa proce… · march 7, 2016. dear mr. ja. r. rar, in accordance with...

Performance Audit Services

March 2016

Tamkeen Performance Audit Final Report: Quality Assurance process

March 7, 2016

Dear Mr. Jarrar,

In accordance with our provision of performance auditoutsourcing services for Tamkeen dated June 30th 2015, wehave completed our activities related to the performanceaudit task assigned by Tamkeen and we are pleased topresent our final performance audit report for the qualityassurance process.

The primary objective of this performance audit exercise was to evaluate the existing controls related to the quality assurance process at Tamkeen. The resulting issues and recommendations were discussed with the management during the course of the audit and prior to the finalisation of this final report.

Our performance audit review was performed in accordancewith the Standards for the Professional Practice of InternalAuditing as prescribed by the Institute of Internal Auditors(IIA). The procedures we performed did not constitute anexamination or a review in accordance with generallyaccepted auditing standards or attestation standards,accordingly we do not provide an opinion, attestation orother form of assurance with respect to our review, except asmay be specified in this report.

Further, we did not plan and perform our work with the objective of preventing or discovering fraud. Our procedures under this engagement are also not designed to and are not likely to reveal misrepresentation by the management of the company. Consequently, we give no assurance on whether the period covered by our audit was free of fraud (whether by management or by external parties), other irregularities or misrepresentation by the management of the company or

any other persons. Full details regarding our audit andreport limitations are stated in our Letter of Engagementwith Tamkeen dated June 30th 2015.

We would like to take this opportunity to thank themanagement and staff of who assisted us in the course of ourwork.

Yours faithfully

PricewaterhouseCoopers

PricewaterhouseCoopers M.E Limited, CR # 47378, 13th Floor, Jeera I Tower, PO Box 21144 – Seef District, Kingdom of Bahrain. Telephone: +973 17 11 8800 | Fax: +973 17 540556, www.pwc.com/middle-east

Mr. Hassan Amin JarrarChairman of the Audit CommitteeTamkeenP.O. Box 18131, Manama, Kingdom of Bahrain

1 Executive Summary 1

2 Summary of Audit Observations 6

3 Detailed observations and recommendations 9

1 Meetings Conducted 14

Contents

PwCMarch 2016

Executive SummarySection 1

Tamkeen • Performance Audit Final Report: Quality Assurance process1

PwCMarch 2016

The criteria adopted for classifying the importance of each observation as High, Moderate or Low are as follows:

Section 1 – Executive Summary


Priority 1High

Serious and substantial impact on the Tamkeen’s ability to achieve objectives

Conditions which would have a significant impact on the Tamkeen’s overall performance, the achievement of itsobjectives, arising through significantly deficient or degraded control processes or inefficient/ineffective workingpractices. These could include incidents involving failure to report or react to situations where activities are placed at risk;acts of employee infidelity; failures on of managerial staff to adequately direct activities or supervisory staff to adequatelycontrol their areas of responsibility; significant violations involving segregation of duties; gross breaches of standinginstructions or policies; failure to correct more material conditions previously reported; conditions which have continuedfor extended periods in management’s knowledge.

Priority 2 Moderate

Moderate impact on the Tamkeen’s ability to achieve objectives

Situations might include “one off errors” arising through misunderstandings rather than neglect; less material omissions,but those of a recurring nature; variations in systems, where controls need refinement to ensure adequacy, or levels ofeffectiveness while not wholly unsatisfactory, require enhancement, incidents where reporting requirements have notbeen fulfilled on a timely basis; breaches of procedural requirements where corrective action is required to avoid loss.

Priority 3Low

Minimal impact on the Tamkeen’s ability to achieve objectives

Deficiencies which are unlikely to cause other than a low level disruption to the achievement of objectives, butnevertheless represent areas where working practices could be improved, or where controls require minimalimprovement to fully achieve their objective, attention should be paid to them at some stage, but early resolution is notcritical.

This report has been prepared on an exception basis and consequently only matters that come to our attention during our review, that require to be addressed tomanagement, have been reported.

Our report has been prepared solely for your information and the management of Tamkeen and is not to be used for any other purposes. It should not beincluded or referred to in any document or publication made available to persons outside Tamkeen without our written consent. We do not accept responsibilityto any other party to whom it may be shown or who on their own volition may decide to rely on it. Our engagement has been performed on out-sourcing basis.

PwCMarch 2016

Background

Tamkeen’s senior management and audit committee have decided toembark on a performance audit project; in this regard, PwC was appointedto perform an inherent-based risk assessment, develop a 3-year internalaudit plan, and execute audit reviews over specific processes that weremutually agreed with Tamkeen’s audit committee.

Engagement objectives

The objectives of this engagement are to:

• Provide an independent and objective report on Tamkeen’s selectedoperational and support functions by bringing a systematic anddisciplined approach to evaluating the risks and controls’ over thesefunctions and recommending opportunities for improvements.

• Conduct a follow up review over the previous performance auditfindings

Audit period and time line

The audit review covers the period from January 1st, 2011 to December 31st,2014. We have assessed the specific risks identified within each scope area,evaluated the associated mitigating controls, and commented on theresults of our audit procedures which were performed on sampling basis.Management should be aware of the inherent limitations of the results ofusing a sample; if the tests were expanded to 100% of the population,observation details could have differed.

Objective and scope of this report

The objective of this report is to provide Tamkeen’s senior management andaudit committee with our performance audit observations andrecommendations over the quality assurance process, which were establishedbased on our (PwC) standard performance audit activities and procedures.

Our approach included the following steps:

• Conducting meetings with Tamkeen’s management and Audit Committeemembers to confirm the objective of the audit exercise and identify areasof concerns;

• Conducting meetings with the relevant process owners in order to obtain aholistic understanding of current departmental practices;

• Submitting an initial List of Requirements (LOR) and requesting samplesfrom the relevant process owners;

• Obtaining, reviewing and testing the selecting samples;

• Preparing and submitting the draft performance audit report to Tamkeen’smanagement for feedback and further discussions.

• Preparing and submitting the final performance audit report to Tamkeen’smanagement and audit committee inclusive of feedback/managementresponses.

Executive SummarySection 1 – Executive Summary


PwCMarch 2016

Summary of audit results

The purpose of the chart below is to provide Tamkeen’s senior managementand audit committee with a high level summary of the overall risk levelscorresponding to our audit observations.

Total number of observations: 3

• Total % of observations with a High Risk rating: 100%

• Total % of observations with a Moderate Risk rating: 0%

• Total % of observations with a Low Risk rating: 0%

Audit scope and objective

The audit included gaining an understanding of the various activitieswithin the process, evaluating the overall control environment and testingvarious documents/files to provide reasonable assurance that theidentified internal controls are operating as designed. Based on ourdeveloped performance audit program, the performance audit comprisedthe following areas:

• Organizational Effectiveness

• Quality Management System

• Quality Improvement

The main objective of our performance audit was to assess theeffectiveness of the existing controls related to the quality assuranceprocess. We performed our audit through inquiry, observation ofapplicable policies and procedures, and inspection of relevantdocumentation. The “observations/risks” section on the following pages isintended to propose improvements to the existing controls over theserisks, which, when implemented, could improve the efficiency andeffectiveness of current operations.

Executive Summary (Continued)



0%0%

100%

AUDIT RESULTS BY SEVERITY LEVEL

Low Moderate High

PwCMarch 2016

Summary of observations and potential risks

Below is a summary of the key observations with a high risk priority. Details are set out in section 2 of this report.

Organizational effectiveness

During the course of our audit review of the Quality Assurancedepartment, we noted that there are no job descriptions nor departmentalpolicies and procedures to govern the required activities within thedepartment. Additionally, the Quality Assurance department currentlydoes not review Tamkeen departments’ policies and procedures. Hence,this could lead to decreased efficiency and effectiveness of the quality ofwork within the department, and hindered ability to take critical decisions.

Quality Management System

During our audit review, we also noted that the department does notcurrently have a Quality Management System (QMS) in place tostandardize and integrate Tamkeen’s key processes. Thus, the absence of aQMS may lead to inefficient use of time and resources, increased conflictsand ambiguities, and lack of integration of processes.

Quality Improvement

During the course of our audit review of the Quality Assurancedepartment, we noted that there is no continuous implementation ofraised recommendations or action plans on processes that went throughlean six sigma process re-engineering projects. Moreover, major schemes,at Tamkeen did not implement lean six sigma projects. This can lead to areduced quality of work, decreased customer satisfaction, and reducedefficiency and effectiveness.

Executive Summary (Continued)



PwCMarch 2016

Summary of Audit ObservationsSection 2


PwCMarch 2016

The purpose of this section is to present Tamkeen’s senior management and audit committee with a high level summary of the performance audit observationsthat were identified during our performance audit of the quality assurance process. A priority level has been assigned to each observation; the detailedperformance audit observations are shown in Section 3 of this report.

Quality Assurance processSection 2 – Summary of Audit Observations


Ref Observation Rating Page

1 Lack of departmental organizational effectiveness High 10

2 Absence of Quality Management System High 12

3 Lack of continuous quality improvement High 13

PwCMarch 2016

Observations layout & disclaimerSection 2 – Summary of Audit Observations


Observations The observations were derived from discussions with concerned managers and process owners, in addition toevaluating the process flows and the representative sample selected during our course of work. Management shouldbe aware of the inherent limitations of the results of using a sample; if the tests were expanded to 100% of thepopulation, observation details could have differed. The recommendations listed are proposed to enhance theprocess and its execution. Management should assess the relevant cost to benefit formula of implementing suchrecommendations before deciding on doing so.

PwCMarch 2016

Detailed observations and recommendations Section 3


PwCMarch 2016

Observation

During the course of our audit, we have met with the Quality Assurance Manager to obtain better understanding of the department’s role at Tamkeen. Hence, based on our understanding, we have observed the following:

• The Quality Assurance department has currently one employee only who is the Quality Assurance Manager with no subordinates; thus, limiting the departments’ capability of performing its projected tasks which are framed within the Quality Assurance annual plan.

• Absence of approved job description for the Quality Assurance Manager

• Absence of approved policies and procedures for the Quality Assurance department. In addition, the Quality Function manual received was a draft version only.

• Lack of involvement of Quality Assurance department in reviewing Tamkeen’s policies and procedures

Potential Risk and Impact

• Decreased efficiency, effectiveness and quality of work

• Lack of effective decision making

• Increased conflicts and ambiguity between departments

1 – Lack of departmental organizational effectiveness – High

Section 3 – Detailed observations and recommendations


PwCMarch 2016

Recommendation

In order to mitigate the above observation, it is recommended to have clear, defined and approved roles and responsibilities pertaining to the Quality Assurance department personnel and ensure that approved departmental policies and procedures are in place. Furthermore, a manpower assessment for the department is required in order to estimate the required number of employees within the department.

1 – Lack of departmental organizational effectiveness – High (Continued)



Management response and remediation plan Responsible and due date

Recommendation no. 1 agreed: A public internal tender for “ Developing & Implementing QMS in accordancewith ISO 9001:2015 was announced on Feb 22ND , 2016. Bidders will submit their proposal on March 10TH 2016.

Responsible: QA Reem Jasim

Due Date: 30/3/2016

Recommendation no. 2&3 agreed: Agreed however, since QA has no staff reporting to the QA manager, no. ofQuality Initiatives and % of policy & procedures to be reviewed and by QA department will be planned for once thedepartment is equipped with the manpower.


Due Date: 20/3/2016

Recommendation no. 4 agreed: % of nonconformities will be identified by QA internal auditors as part of theQMS before the external audit/accreditation body is selected for the ISO 9001:2015 certification. However, gapanalysis will be conducted with the consultancy firm once they are selected and all gaps will be closed before theexternal audit.


Due Date: 30/8/2016

PwCMarch 2016

Observation

During the course of our audit and throughout our meeting with the Quality Assurance Manager, we observed that the department does not have any Quality Management System (QMS) in place to help in setting up a framework for standardizing and integrating Tamkeen’s key processes.


• Increased conflicts and ambiguities

• Lack of integration of processes

• Inefficient use of time and resources

Recommendation

In order to mitigate the above observation, it is recommended to introduce a Quality Management System (QMS) in Tamkeen that will help in improving theinternal and external processes and services, increase beneficiary satisfaction, and increase efficiency of the use of time and resources. Hiring of required QApersonnel shall be implemented during the implementation phase in order to acquire the mandatory QMS-related training.

2 – Absence of Quality Management System (QMS) – High




QMS will be introduced in Tamkeen, currently A public internal tender for “ Developing & Implementing QMS inaccordance with ISO 9001:2015 was announced on Feb 22ND , 2016. Bidders will submit their proposal on March 10TH

2016.

Responsible: QA

Due Date: 30/3/2016

PwCMarch 2016

Observation

During the course of our audit review and throughout our meetings with the Quality Assurance Manager, we noted that the following lean six sigma process re-engineering projects were implemented by the Quality Assurance department:

• “E7trf”, dated December 2014

• “ ESF”, dated March 2012

• “ EDS”, dated January 2013

Additionally, we noted the absence of continuous implementation of the raised recommendations and action plans. On the same note, we observed the lack of implementation of similar lean six sigma projects for other major schemes such as Finance Scheme and CPP.


• Reduced quality of work

• Decreased customer satisfaction

• Reduced efficiency and effectiveness of work

Recommendation

In order to mitigate the above raised observation, it is recommended to establish a quality improvement plan on an annual basis for critical projects. Theoutcome of the recommendations and related action plans shall be logged within a tracking sheet for effective implementation.

3 – Lack of continuous quality improvement – High




Agreed lean six sigma initiative should be done for other major projects such as Finance Scheme and CPP; however, Itwas agreed by Management in Tamkeen that QMS will be established first as a foundation for Quality Assurance andonce the QMS is in place, Lean six sigma initiatives will start accordingly.


Due Date: 2017

PwCMarch 2016

Appendix 1Meetings Conducted


PwCMarch 2016

Meetings ConductedAppendix 1 – Meetings Conducted


# Name Position

1 Ms. Reem Jassim Quality Assurance Manager

Limitations and ResponsibilitiesLimitations inherent to the internal auditor’s workWe have undertaken the review associated with evaluating the existing controls within Tamkeen’s Quality Assurance process, subject to thelimitations outlined below:

Internal controlInternal control systems, no matter how well designed and operated, are affected by inherent limitations. These include the possibility of poorjudgment in decision-making, human error, control processes being deliberately circumvented by employees and others, management overridingcontrols and the occurrence of unforeseeable circumstances. The observations raised within this report are resulting from conducting our auditwithin the limited time of each audit. The observations were raised based on a risk-based audit approach where the focus was to highlightobservations to Tamkeen Audit Committee based on the risk exposure of the department or function. Action plans and deadlines were committed byTamkeen management process owners based on agreement on the raised observations.

The work we performed did not constitute a review in accordance with generally accepted auditing standards or attestation standards. Accordingly,we do not provide an opinion, attestation or other form of assurance with respect to our work.

Future periodsOur assessment of controls relating to this Internal Audit review is for the period from 01 January 2011 to 31 December 2014. Historic evaluation ofeffectiveness is not relevant to future periods due to the risk that:

• the design of controls may become inadequate because of changes in operating environment, law, regulation or other; or• the degree of compliance with policies and procedures may deteriorate.

Responsibilities of management and internal auditorsDespite the fact that we did not plan and perform our work with the objective of preventing or discovering fraud or misrepresentation by Tamkeen, itis management’s responsibility to develop and maintain sound systems of risk management, internal control and governance and for the preventionand detection of irregularities and fraud. Internal audit work should not be seen as a substitute for management’s responsibilities for the design andoperation of these systems.

We endeavour to plan our work so that we have a reasonable expectation of detecting significant control weaknesses and, if detected, we shall carryout additional work directed towards identification of consequent fraud or other irregularities. However, performance audit procedures alone, evenwhen carried out with due professional care, do not guarantee that fraud will be detected.

Accordingly, our examinations as performance auditors should not be relied upon solely to disclose fraud, defalcations or other irregularities whichmay exist.

Disclaimer

This report has been prepared in accordance with our Agreement and Agreements Terms and Conditions with Tamkeen dated 30 June 2018,

and has been prepared for Tamkeen only and not for any other purpose. To the extent permitted by law, PricewaterhouseCoopers, M.E.Limited does not accept or assume any liability, responsibility or duty of care for any use of or reliance on this document by anyone, other than(i) the intended recipient to the extent agreed in the Agreement for the matter to which this document relates (if any), or (ii) as expressly

agreed by PricewaterhouseCoopers, M.E. Limited at its sole discretion in writing in advance. Accordingly, regardless of the form of action,

whether in contract or otherwise, and to the extent permitted by applicable law, PricewaterhouseCoopers, M.E. Limited accepts no liability ofany kind and disclaims all responsibility for the consequences of any person acting or refraining to act in reliance on the contents of this reportor for any decisions made or not made which are based upon the contents of this report.

“PricewaterhouseCoopers” refers to PricewaterhouseCoopers (a partnership) or, as the context requires, other member firms ofPricewaterhouseCoopers International Limited, each of which is a separate and independent legal entity.

© 2016 PricewaterhouseCoopers. All rights reserved.

© 2016 PricewaterhouseCoopers. All rights reserved.

pwc.com/middle-east

PwC firms provide industry-focused assurance, tax and advisory services to enhance value for their clients. More than 203,000 people in 157 countries in firms across the PwC network share their thinking, experience and solutions to develop fresh perspectives and practical advice. See pwc.com for more information.

“PwC” is the brand under which member firms of PricewaterhouseCoopers International Limited (PwCIL) operate and provide services. Together, these firms form the PwC network. Each firm in the network is a separate legal entity and does not act as agent of PwCIL or any other member firm. PwCIL does not provide any services to clients. PwCIL is not responsible or liable for the acts or omissions of any of its member firms nor can it control the exercise of their professional judgment or bind them in any way.

PwC in the Middle East

Established in the region for over 45 years, PwC has offices in 12 countries: Bahrain, Egypt, Iraq, Jordan, Kuwait, Lebanon, Libya, Oman, Palestine, Qatar, Saudi Arabia and the United Arab Emirates, with around 3,000 people.

Complementing our depth of industry expertise and breadth of skills is our sound knowledge of local business environments across the Middle East.

www.pwc.com/middle-east

tamkeen - final ia report - qa proce… · march 7, 2016. dear mr. ja. r. rar, in accordance with...

Documents