Bulgarian Public Sector Internal Auditor Exam cheat sheet

The Public Sector Internal Audit Act (PSIAA) is the primary statute: it defines the scope of internal audit, the status of the internal auditor, and the responsibilities of the heads of public sector organisations.

Internal audit is mandatory for all public sector organisations under the PSIAA; the internal audit unit reports functionally to the head of the organisation and is administratively subordinate to that same head.

The Minister of Finance sets methodological rules and the Code of Ethics for internal auditors in the public sector; the Ministry of Finance's Internal Audit Directorate performs central harmonisation and quality assessment.

The Public Financial Inspection Agency (PFIA) performs inspections and ex-post control, distinct from internal audit, which provides independent assurance and consulting to management.

The Bulgarian National Audit Office (BNAO) is the external supreme audit institution; it audits public funds and does not substitute for internal audit.

Internal auditors must hold a certification recognised under Bulgarian rules (e.g., CIA, CGAP, or a state-recognised internal audit qualification) and complete continuing professional development.

The internal audit charter, approved by the head of the organisation, defines purpose, authority, responsibility, and the right of access to records, personnel, and assets.

Independence is protected by law: internal auditors cannot be assigned operational duties, and removal of the head of internal audit requires notification to the central harmonisation unit.

The IIA Global Internal Audit Standards (2024) replaced the IPPF; they comprise five domains: Purpose, Ethics and Professionalism, Governing the Internal Audit Function, Managing the Internal Audit Function, and Performing Internal Audit Services.

Core Principles: integrity, objectivity, confidentiality, competency, professional behaviour, alignment with organisational strategy, positioning, adequate resources, effective communication, and quality assurance.

Objectivity is threatened by self-review, social pressure, economic interest, personal relationships, and familiarity; safeguards include rotation, independent review, and disclosure of impairments.

The Code of Ethics has four principles - Integrity, Objectivity, Confidentiality, Competency - each with rules of conduct; violations are handled through the professional disciplinary process.

Mandatory elements: conformance with the Standards is required; deviations must be disclosed, and the nature of any non-conformance is reported to senior management and the board.

The Quality Assurance and Improvement Programme (QAIP) requires internal assessments (ongoing monitoring plus periodic self-assessment) and an external assessment at least every five years.

The chief audit executive must report the QAIP results, including conformance status, to senior management and the board at least annually.

Risk = likelihood × impact; the risk score is the product of the two ratings, and residual risk is assessed after controls are applied.

COSO ERM (2017) organises risk management around governance and culture, strategy and objective-setting, performance, review and revision, and information, communication and reporting.

ISO 31000 provides the process: establishing context, risk identification, analysis, evaluation, treatment, communication and consultation, monitoring and review.

Public sector risk categories: strategic, operational, financial, compliance/legal, reputational, fraud/corruption, and service-delivery risk.

Risk appetite and risk tolerance must be formally approved by the head of the organisation; internal audit uses them to prioritise engagements.

The risk register records risk description, owner, inherent and residual ratings, existing controls, treatment actions, deadlines, and status.

Inherent risk is assessed before controls; control risk is the risk that controls fail to prevent or detect a material error.

Risk-based prioritisation: engagements are ranked by risk score, materiality, and time since the last audit, producing the annual audit plan.

COSO Internal Control - Integrated Framework (2013) has five components: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring Activities.

The 17 COSO principles are mapped to the five components; each principle must be present and functioning for the system to be effective.

Control types: preventive vs detective; manual vs automated; entity-level vs transaction-level; directive, preventive, detective, corrective.

Segregation of duties separates authorisation, custody, recording, and reconciliation; compensating controls apply when separation is impractical.

The three lines model: first line - operational management; second line - risk and compliance functions; third line - internal audit, providing independent assurance.

Internal control aims at reliability of reporting, effectiveness and efficiency of operations, and compliance with laws and regulations.

COSO limitations: collusion, management override, human error, and cost-benefit constraints mean no system gives absolute assurance.

Control testing: walkthrough to confirm design, then test of operating effectiveness on a sample; deficiencies are graded as deficiency, significant deficiency, or material weakness.

The annual risk-based audit plan is approved by the head of the organisation; changes during the year require documented justification and re-approval.

Engagement planning steps: understand the entity and process, define objectives and scope, assess risks and controls, set criteria, allocate resources and timing, and prepare the engagement work programme.

Engagement objectives state what the audit will conclude about; scope defines boundaries (period, locations, processes) and exclusions.

Audit criteria are the standards, laws, or benchmarks against which the condition is compared (e.g., the PSIAA, procurement rules, internal policies).

Materiality is set at planning and revised during the engagement if new information emerges.

The engagement work programme lists procedures, sampling approach, evidence to be obtained, responsible auditor, and deadlines.

Risk assessment at engagement level: identify inherent risks, evaluate control design, determine residual risk, and focus testing on high residual risk areas.

The planning memorandum or engagement plan is reviewed and approved by the head of internal audit before fieldwork starts.

Evidence must be sufficient, reliable, relevant, and useful; reliability ranking: auditor's direct observation > external documents > internal documents > oral representations.

Evidence types: physical, documentary, testimonial, analytical, and electronic; corroboration of oral evidence is required.

Audit procedures: inspection, observation, inquiry, confirmation, recalculation, re-performance, analytical review, and sampling.

Working papers must document the objective, procedures performed, evidence obtained, findings, conclusions, and reviewer sign-off; they support the audit report.

Working papers are the property of the organisation; access is restricted, and retention follows the statutory retention period.

Sampling: statistical (random, systematic) and non-statistical (judgmental); sample size increases with tolerable error decreasing and expected error increasing.

Analytical procedures compare ratios, trends, and budget-to-actual variances; significant unexplained variances require further investigation.

Supervision and review: work is reviewed before the report is issued; review notes and clearance are documented in the file.

Report structure: objectives and scope, criteria, findings (condition, criteria, cause, effect), conclusions, recommendations, and management responses with target dates.

Findings must state the condition, criteria, cause, effect, and recommendation; each recommendation is assigned to a responsible official with a deadline.

The draft report is sent to the auditee for factual accuracy; management responses are included in the final report, including disagreement.

The final report is signed by the head of internal audit and addressed to the head of the organisation; distribution is defined in the charter.

Follow-up: recommendations are tracked until implemented; overdue recommendations are escalated to senior management and the board.

Communication during the engagement: opening meeting, progress updates, and closing meeting to confirm findings and agree on actions.

Significant risks and material deficiencies are reported immediately, not deferred to the final report.

Quality of the report: clear, concise, objective, constructive, accurate, complete, and timely.

The Public Finance Act governs the budget process, the consolidated fiscal programme, and the responsibilities of spending units (first-, second-, and third-level authorising officers).

Budget principles: legality, transparency, annuality, universality, specification, and accountability; the budget is adopted by the National Assembly.

The State Financial Inspection Act governs ex-post control of public funds; the Public Financial Inspection Agency conducts inspections and imposes measures.

Public procurement is governed by the Public Procurement Act (PPA) transposing the EU directives; thresholds distinguish below-threshold and above-threshold contracts.

Procurement principles: transparency, equal treatment, non-discrimination, proportionality, and free competition.

Procedures: open procedure, restricted procedure, competitive dialogue, negotiated procedure, and direct award under statutory thresholds.

Grounds for exclusion include criminal convictions, tax and social security debts, conflicts of interest, and professional misconduct.

Contract amendments are limited: substantial changes require a new procurement procedure; permitted changes are defined in the PPA.

Conflict of interest: officials involved in procurement must declare interests and be excluded from evaluation where a conflict exists.

Independence is the freedom from conditions that threaten objectivity; objectivity is a state of mind, independence is the appearance of it.

Impairments to independence must be disclosed to the head of the organisation; if independence is materially impaired, the engagement is reassigned or declined.

Internal auditors must not audit activities they previously managed; a cooling-off period applies after transfer from an operational role.

Confidentiality: information obtained in the engagement is not disclosed without authority unless legally required.

Conflicts of interest are declared in writing; the auditor withdraws from the engagement if the conflict cannot be managed.

QAIP: internal assessments (ongoing and periodic) plus an external assessment at least every five years; results are reported to senior management and the board.

External quality assessment conclusions: generally conforms, partially conforms, or does not conform; the rating and action plan are reported.

Continuing professional education is required to maintain competence; records of CPD hours are kept and reviewed.

Gifts and hospitality that could influence judgement must be declined or disclosed under the organisation's policy.

The Public Sector Internal Audit Act (PSIAA) is the primary statute: it defines the scope of internal audit, the status of the internal auditor, and the responsibilities of the heads of public sector organisations.

Internal audit is mandatory for all public sector organisations under the PSIAA; the internal audit unit reports functionally to the head of the organisation and is administratively subordinate to that same head.

The Minister of Finance sets methodological rules and the Code of Ethics for internal auditors in the public sector; the Ministry of Finance's Internal Audit Directorate performs central harmonisation and quality assessment.

The Public Financial Inspection Agency (PFIA) performs inspections and ex-post control, distinct from internal audit, which provides independent assurance and consulting to management.

The Bulgarian National Audit Office (BNAO) is the external supreme audit institution; it audits public funds and does not substitute for internal audit.

Internal auditors must hold a certification recognised under Bulgarian rules (e.g., CIA, CGAP, or a state-recognised internal audit qualification) and complete continuing professional development.

The internal audit charter, approved by the head of the organisation, defines purpose, authority, responsibility, and the right of access to records, personnel, and assets.

Independence is protected by law: internal auditors cannot be assigned operational duties, and removal of the head of internal audit requires notification to the central harmonisation unit.

The IIA Global Internal Audit Standards (2024) replaced the IPPF; they comprise five domains: Purpose, Ethics and Professionalism, Governing the Internal Audit Function, Managing the Internal Audit Function, and Performing Internal Audit Services.

Core Principles: integrity, objectivity, confidentiality, competency, professional behaviour, alignment with organisational strategy, positioning, adequate resources, effective communication, and quality assurance.

Objectivity is threatened by self-review, social pressure, economic interest, personal relationships, and familiarity; safeguards include rotation, independent review, and disclosure of impairments.

The Code of Ethics has four principles - Integrity, Objectivity, Confidentiality, Competency - each with rules of conduct; violations are handled through the professional disciplinary process.

Mandatory elements: conformance with the Standards is required; deviations must be disclosed, and the nature of any non-conformance is reported to senior management and the board.

The Quality Assurance and Improvement Programme (QAIP) requires internal assessments (ongoing monitoring plus periodic self-assessment) and an external assessment at least every five years.

The chief audit executive must report the QAIP results, including conformance status, to senior management and the board at least annually.

Risk = likelihood × impact; the risk score is the product of the two ratings, and residual risk is assessed after controls are applied.

COSO ERM (2017) organises risk management around governance and culture, strategy and objective-setting, performance, review and revision, and information, communication and reporting.

ISO 31000 provides the process: establishing context, risk identification, analysis, evaluation, treatment, communication and consultation, monitoring and review.

Public sector risk categories: strategic, operational, financial, compliance/legal, reputational, fraud/corruption, and service-delivery risk.

Risk appetite and risk tolerance must be formally approved by the head of the organisation; internal audit uses them to prioritise engagements.

The risk register records risk description, owner, inherent and residual ratings, existing controls, treatment actions, deadlines, and status.

Inherent risk is assessed before controls; control risk is the risk that controls fail to prevent or detect a material error.

Risk-based prioritisation: engagements are ranked by risk score, materiality, and time since the last audit, producing the annual audit plan.

COSO Internal Control - Integrated Framework (2013) has five components: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring Activities.

The 17 COSO principles are mapped to the five components; each principle must be present and functioning for the system to be effective.

Control types: preventive vs detective; manual vs automated; entity-level vs transaction-level; directive, preventive, detective, corrective.

Segregation of duties separates authorisation, custody, recording, and reconciliation; compensating controls apply when separation is impractical.

The three lines model: first line - operational management; second line - risk and compliance functions; third line - internal audit, providing independent assurance.

Internal control aims at reliability of reporting, effectiveness and efficiency of operations, and compliance with laws and regulations.

COSO limitations: collusion, management override, human error, and cost-benefit constraints mean no system gives absolute assurance.

Control testing: walkthrough to confirm design, then test of operating effectiveness on a sample; deficiencies are graded as deficiency, significant deficiency, or material weakness.

The annual risk-based audit plan is approved by the head of the organisation; changes during the year require documented justification and re-approval.

Engagement planning steps: understand the entity and process, define objectives and scope, assess risks and controls, set criteria, allocate resources and timing, and prepare the engagement work programme.

Engagement objectives state what the audit will conclude about; scope defines boundaries (period, locations, processes) and exclusions.

Audit criteria are the standards, laws, or benchmarks against which the condition is compared (e.g., the PSIAA, procurement rules, internal policies).

Materiality is set at planning and revised during the engagement if new information emerges.

The engagement work programme lists procedures, sampling approach, evidence to be obtained, responsible auditor, and deadlines.

Risk assessment at engagement level: identify inherent risks, evaluate control design, determine residual risk, and focus testing on high residual risk areas.

The planning memorandum or engagement plan is reviewed and approved by the head of internal audit before fieldwork starts.

Evidence must be sufficient, reliable, relevant, and useful; reliability ranking: auditor's direct observation > external documents > internal documents > oral representations.

Evidence types: physical, documentary, testimonial, analytical, and electronic; corroboration of oral evidence is required.

Audit procedures: inspection, observation, inquiry, confirmation, recalculation, re-performance, analytical review, and sampling.

Working papers must document the objective, procedures performed, evidence obtained, findings, conclusions, and reviewer sign-off; they support the audit report.

Working papers are the property of the organisation; access is restricted, and retention follows the statutory retention period.

Sampling: statistical (random, systematic) and non-statistical (judgmental); sample size increases with tolerable error decreasing and expected error increasing.

Analytical procedures compare ratios, trends, and budget-to-actual variances; significant unexplained variances require further investigation.

Supervision and review: work is reviewed before the report is issued; review notes and clearance are documented in the file.

Report structure: objectives and scope, criteria, findings (condition, criteria, cause, effect), conclusions, recommendations, and management responses with target dates.

Findings must state the condition, criteria, cause, effect, and recommendation; each recommendation is assigned to a responsible official with a deadline.

The draft report is sent to the auditee for factual accuracy; management responses are included in the final report, including disagreement.

The final report is signed by the head of internal audit and addressed to the head of the organisation; distribution is defined in the charter.

Follow-up: recommendations are tracked until implemented; overdue recommendations are escalated to senior management and the board.

Communication during the engagement: opening meeting, progress updates, and closing meeting to confirm findings and agree on actions.

Significant risks and material deficiencies are reported immediately, not deferred to the final report.

Quality of the report: clear, concise, objective, constructive, accurate, complete, and timely.

The Public Finance Act governs the budget process, the consolidated fiscal programme, and the responsibilities of spending units (first-, second-, and third-level authorising officers).

Budget principles: legality, transparency, annuality, universality, specification, and accountability; the budget is adopted by the National Assembly.

The State Financial Inspection Act governs ex-post control of public funds; the Public Financial Inspection Agency conducts inspections and imposes measures.

Public procurement is governed by the Public Procurement Act (PPA) transposing the EU directives; thresholds distinguish below-threshold and above-threshold contracts.

Procurement principles: transparency, equal treatment, non-discrimination, proportionality, and free competition.

Procedures: open procedure, restricted procedure, competitive dialogue, negotiated procedure, and direct award under statutory thresholds.

Grounds for exclusion include criminal convictions, tax and social security debts, conflicts of interest, and professional misconduct.

Contract amendments are limited: substantial changes require a new procurement procedure; permitted changes are defined in the PPA.

Conflict of interest: officials involved in procurement must declare interests and be excluded from evaluation where a conflict exists.

Independence is the freedom from conditions that threaten objectivity; objectivity is a state of mind, independence is the appearance of it.

Impairments to independence must be disclosed to the head of the organisation; if independence is materially impaired, the engagement is reassigned or declined.

Internal auditors must not audit activities they previously managed; a cooling-off period applies after transfer from an operational role.

Confidentiality: information obtained in the engagement is not disclosed without authority unless legally required.

Conflicts of interest are declared in writing; the auditor withdraws from the engagement if the conflict cannot be managed.

QAIP: internal assessments (ongoing and periodic) plus an external assessment at least every five years; results are reported to senior management and the board.

External quality assessment conclusions: generally conforms, partially conforms, or does not conform; the rating and action plan are reported.

Continuing professional education is required to maintain competence; records of CPD hours are kept and reviewed.

Gifts and hospitality that could influence judgement must be declined or disclosed under the organisation's policy.

The Public Sector Internal Audit Act (PSIAA) is the primary statute: it defines the scope of internal audit, the status of the internal auditor, and the responsibilities of the heads of public sector organisations.

Internal audit is mandatory for all public sector organisations under the PSIAA; the internal audit unit reports functionally to the head of the organisation and is administratively subordinate to that same head.

The Minister of Finance sets methodological rules and the Code of Ethics for internal auditors in the public sector; the Ministry of Finance's Internal Audit Directorate performs central harmonisation and quality assessment.

The Public Financial Inspection Agency (PFIA) performs inspections and ex-post control, distinct from internal audit, which provides independent assurance and consulting to management.

The Bulgarian National Audit Office (BNAO) is the external supreme audit institution; it audits public funds and does not substitute for internal audit.

Internal auditors must hold a certification recognised under Bulgarian rules (e.g., CIA, CGAP, or a state-recognised internal audit qualification) and complete continuing professional development.

The internal audit charter, approved by the head of the organisation, defines purpose, authority, responsibility, and the right of access to records, personnel, and assets.

Independence is protected by law: internal auditors cannot be assigned operational duties, and removal of the head of internal audit requires notification to the central harmonisation unit.

The IIA Global Internal Audit Standards (2024) replaced the IPPF; they comprise five domains: Purpose, Ethics and Professionalism, Governing the Internal Audit Function, Managing the Internal Audit Function, and Performing Internal Audit Services.

Core Principles: integrity, objectivity, confidentiality, competency, professional behaviour, alignment with organisational strategy, positioning, adequate resources, effective communication, and quality assurance.

Objectivity is threatened by self-review, social pressure, economic interest, personal relationships, and familiarity; safeguards include rotation, independent review, and disclosure of impairments.

The Code of Ethics has four principles - Integrity, Objectivity, Confidentiality, Competency - each with rules of conduct; violations are handled through the professional disciplinary process.

Mandatory elements: conformance with the Standards is required; deviations must be disclosed, and the nature of any non-conformance is reported to senior management and the board.

The Quality Assurance and Improvement Programme (QAIP) requires internal assessments (ongoing monitoring plus periodic self-assessment) and an external assessment at least every five years.

The chief audit executive must report the QAIP results, including conformance status, to senior management and the board at least annually.

Risk = likelihood × impact; the risk score is the product of the two ratings, and residual risk is assessed after controls are applied.

COSO ERM (2017) organises risk management around governance and culture, strategy and objective-setting, performance, review and revision, and information, communication and reporting.

ISO 31000 provides the process: establishing context, risk identification, analysis, evaluation, treatment, communication and consultation, monitoring and review.

Public sector risk categories: strategic, operational, financial, compliance/legal, reputational, fraud/corruption, and service-delivery risk.

Risk appetite and risk tolerance must be formally approved by the head of the organisation; internal audit uses them to prioritise engagements.

The risk register records risk description, owner, inherent and residual ratings, existing controls, treatment actions, deadlines, and status.

Inherent risk is assessed before controls; control risk is the risk that controls fail to prevent or detect a material error.

Risk-based prioritisation: engagements are ranked by risk score, materiality, and time since the last audit, producing the annual audit plan.

COSO Internal Control - Integrated Framework (2013) has five components: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring Activities.

The 17 COSO principles are mapped to the five components; each principle must be present and functioning for the system to be effective.

Control types: preventive vs detective; manual vs automated; entity-level vs transaction-level; directive, preventive, detective, corrective.

Segregation of duties separates authorisation, custody, recording, and reconciliation; compensating controls apply when separation is impractical.

The three lines model: first line - operational management; second line - risk and compliance functions; third line - internal audit, providing independent assurance.

Internal control aims at reliability of reporting, effectiveness and efficiency of operations, and compliance with laws and regulations.

COSO limitations: collusion, management override, human error, and cost-benefit constraints mean no system gives absolute assurance.

Control testing: walkthrough to confirm design, then test of operating effectiveness on a sample; deficiencies are graded as deficiency, significant deficiency, or material weakness.

The annual risk-based audit plan is approved by the head of the organisation; changes during the year require documented justification and re-approval.

Engagement planning steps: understand the entity and process, define objectives and scope, assess risks and controls, set criteria, allocate resources and timing, and prepare the engagement work programme.

Engagement objectives state what the audit will conclude about; scope defines boundaries (period, locations, processes) and exclusions.

Audit criteria are the standards, laws, or benchmarks against which the condition is compared (e.g., the PSIAA, procurement rules, internal policies).

Materiality is set at planning and revised during the engagement if new information emerges.

The engagement work programme lists procedures, sampling approach, evidence to be obtained, responsible auditor, and deadlines.

Risk assessment at engagement level: identify inherent risks, evaluate control design, determine residual risk, and focus testing on high residual risk areas.

The planning memorandum or engagement plan is reviewed and approved by the head of internal audit before fieldwork starts.

Evidence must be sufficient, reliable, relevant, and useful; reliability ranking: auditor's direct observation > external documents > internal documents > oral representations.

Evidence types: physical, documentary, testimonial, analytical, and electronic; corroboration of oral evidence is required.

Audit procedures: inspection, observation, inquiry, confirmation, recalculation, re-performance, analytical review, and sampling.

Working papers must document the objective, procedures performed, evidence obtained, findings, conclusions, and reviewer sign-off; they support the audit report.

Working papers are the property of the organisation; access is restricted, and retention follows the statutory retention period.

Sampling: statistical (random, systematic) and non-statistical (judgmental); sample size increases with tolerable error decreasing and expected error increasing.

Analytical procedures compare ratios, trends, and budget-to-actual variances; significant unexplained variances require further investigation.

Supervision and review: work is reviewed before the report is issued; review notes and clearance are documented in the file.

Report structure: objectives and scope, criteria, findings (condition, criteria, cause, effect), conclusions, recommendations, and management responses with target dates.

Findings must state the condition, criteria, cause, effect, and recommendation; each recommendation is assigned to a responsible official with a deadline.

The draft report is sent to the auditee for factual accuracy; management responses are included in the final report, including disagreement.

The final report is signed by the head of internal audit and addressed to the head of the organisation; distribution is defined in the charter.

Follow-up: recommendations are tracked until implemented; overdue recommendations are escalated to senior management and the board.

Communication during the engagement: opening meeting, progress updates, and closing meeting to confirm findings and agree on actions.

Significant risks and material deficiencies are reported immediately, not deferred to the final report.

Quality of the report: clear, concise, objective, constructive, accurate, complete, and timely.

The Public Finance Act governs the budget process, the consolidated fiscal programme, and the responsibilities of spending units (first-, second-, and third-level authorising officers).

Budget principles: legality, transparency, annuality, universality, specification, and accountability; the budget is adopted by the National Assembly.

The State Financial Inspection Act governs ex-post control of public funds; the Public Financial Inspection Agency conducts inspections and imposes measures.

Public procurement is governed by the Public Procurement Act (PPA) transposing the EU directives; thresholds distinguish below-threshold and above-threshold contracts.

Procurement principles: transparency, equal treatment, non-discrimination, proportionality, and free competition.

Procedures: open procedure, restricted procedure, competitive dialogue, negotiated procedure, and direct award under statutory thresholds.

Grounds for exclusion include criminal convictions, tax and social security debts, conflicts of interest, and professional misconduct.

Contract amendments are limited: substantial changes require a new procurement procedure; permitted changes are defined in the PPA.

Conflict of interest: officials involved in procurement must declare interests and be excluded from evaluation where a conflict exists.

Independence is the freedom from conditions that threaten objectivity; objectivity is a state of mind, independence is the appearance of it.

Impairments to independence must be disclosed to the head of the organisation; if independence is materially impaired, the engagement is reassigned or declined.

Internal auditors must not audit activities they previously managed; a cooling-off period applies after transfer from an operational role.

Confidentiality: information obtained in the engagement is not disclosed without authority unless legally required.

Conflicts of interest are declared in writing; the auditor withdraws from the engagement if the conflict cannot be managed.

QAIP: internal assessments (ongoing and periodic) plus an external assessment at least every five years; results are reported to senior management and the board.

External quality assessment conclusions: generally conforms, partially conforms, or does not conform; the rating and action plan are reported.

Continuing professional education is required to maintain competence; records of CPD hours are kept and reviewed.

Gifts and hospitality that could influence judgement must be declined or disclosed under the organisation's policy.

The Public Sector Internal Audit Act (PSIAA) is the primary statute: it defines the scope of internal audit, the status of the internal auditor, and the responsibilities of the heads of public sector organisations.

Internal audit is mandatory for all public sector organisations under the PSIAA; the internal audit unit reports functionally to the head of the organisation and is administratively subordinate to that same head.

The Minister of Finance sets methodological rules and the Code of Ethics for internal auditors in the public sector; the Ministry of Finance's Internal Audit Directorate performs central harmonisation and quality assessment.

The Public Financial Inspection Agency (PFIA) performs inspections and ex-post control, distinct from internal audit, which provides independent assurance and consulting to management.

The Bulgarian National Audit Office (BNAO) is the external supreme audit institution; it audits public funds and does not substitute for internal audit.

Internal auditors must hold a certification recognised under Bulgarian rules (e.g., CIA, CGAP, or a state-recognised internal audit qualification) and complete continuing professional development.

The internal audit charter, approved by the head of the organisation, defines purpose, authority, responsibility, and the right of access to records, personnel, and assets.

Independence is protected by law: internal auditors cannot be assigned operational duties, and removal of the head of internal audit requires notification to the central harmonisation unit.

The IIA Global Internal Audit Standards (2024) replaced the IPPF; they comprise five domains: Purpose, Ethics and Professionalism, Governing the Internal Audit Function, Managing the Internal Audit Function, and Performing Internal Audit Services.

Core Principles: integrity, objectivity, confidentiality, competency, professional behaviour, alignment with organisational strategy, positioning, adequate resources, effective communication, and quality assurance.

Objectivity is threatened by self-review, social pressure, economic interest, personal relationships, and familiarity; safeguards include rotation, independent review, and disclosure of impairments.

The Code of Ethics has four principles - Integrity, Objectivity, Confidentiality, Competency - each with rules of conduct; violations are handled through the professional disciplinary process.

Mandatory elements: conformance with the Standards is required; deviations must be disclosed, and the nature of any non-conformance is reported to senior management and the board.

The Quality Assurance and Improvement Programme (QAIP) requires internal assessments (ongoing monitoring plus periodic self-assessment) and an external assessment at least every five years.

The chief audit executive must report the QAIP results, including conformance status, to senior management and the board at least annually.

Risk = likelihood × impact; the risk score is the product of the two ratings, and residual risk is assessed after controls are applied.

COSO ERM (2017) organises risk management around governance and culture, strategy and objective-setting, performance, review and revision, and information, communication and reporting.

ISO 31000 provides the process: establishing context, risk identification, analysis, evaluation, treatment, communication and consultation, monitoring and review.

Public sector risk categories: strategic, operational, financial, compliance/legal, reputational, fraud/corruption, and service-delivery risk.

Risk appetite and risk tolerance must be formally approved by the head of the organisation; internal audit uses them to prioritise engagements.

The risk register records risk description, owner, inherent and residual ratings, existing controls, treatment actions, deadlines, and status.

Inherent risk is assessed before controls; control risk is the risk that controls fail to prevent or detect a material error.

Risk-based prioritisation: engagements are ranked by risk score, materiality, and time since the last audit, producing the annual audit plan.

COSO Internal Control - Integrated Framework (2013) has five components: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring Activities.

The 17 COSO principles are mapped to the five components; each principle must be present and functioning for the system to be effective.

Control types: preventive vs detective; manual vs automated; entity-level vs transaction-level; directive, preventive, detective, corrective.

Segregation of duties separates authorisation, custody, recording, and reconciliation; compensating controls apply when separation is impractical.

The three lines model: first line - operational management; second line - risk and compliance functions; third line - internal audit, providing independent assurance.

Internal control aims at reliability of reporting, effectiveness and efficiency of operations, and compliance with laws and regulations.

COSO limitations: collusion, management override, human error, and cost-benefit constraints mean no system gives absolute assurance.

Control testing: walkthrough to confirm design, then test of operating effectiveness on a sample; deficiencies are graded as deficiency, significant deficiency, or material weakness.

The annual risk-based audit plan is approved by the head of the organisation; changes during the year require documented justification and re-approval.

Engagement planning steps: understand the entity and process, define objectives and scope, assess risks and controls, set criteria, allocate resources and timing, and prepare the engagement work programme.

Engagement objectives state what the audit will conclude about; scope defines boundaries (period, locations, processes) and exclusions.

Audit criteria are the standards, laws, or benchmarks against which the condition is compared (e.g., the PSIAA, procurement rules, internal policies).

Materiality is set at planning and revised during the engagement if new information emerges.

The engagement work programme lists procedures, sampling approach, evidence to be obtained, responsible auditor, and deadlines.

Risk assessment at engagement level: identify inherent risks, evaluate control design, determine residual risk, and focus testing on high residual risk areas.

The planning memorandum or engagement plan is reviewed and approved by the head of internal audit before fieldwork starts.

Evidence must be sufficient, reliable, relevant, and useful; reliability ranking: auditor's direct observation > external documents > internal documents > oral representations.

Evidence types: physical, documentary, testimonial, analytical, and electronic; corroboration of oral evidence is required.

Audit procedures: inspection, observation, inquiry, confirmation, recalculation, re-performance, analytical review, and sampling.

Working papers must document the objective, procedures performed, evidence obtained, findings, conclusions, and reviewer sign-off; they support the audit report.

Working papers are the property of the organisation; access is restricted, and retention follows the statutory retention period.

Sampling: statistical (random, systematic) and non-statistical (judgmental); sample size increases with tolerable error decreasing and expected error increasing.

Analytical procedures compare ratios, trends, and budget-to-actual variances; significant unexplained variances require further investigation.

Supervision and review: work is reviewed before the report is issued; review notes and clearance are documented in the file.

Report structure: objectives and scope, criteria, findings (condition, criteria, cause, effect), conclusions, recommendations, and management responses with target dates.

Findings must state the condition, criteria, cause, effect, and recommendation; each recommendation is assigned to a responsible official with a deadline.

The draft report is sent to the auditee for factual accuracy; management responses are included in the final report, including disagreement.

The final report is signed by the head of internal audit and addressed to the head of the organisation; distribution is defined in the charter.

Follow-up: recommendations are tracked until implemented; overdue recommendations are escalated to senior management and the board.

Communication during the engagement: opening meeting, progress updates, and closing meeting to confirm findings and agree on actions.

Significant risks and material deficiencies are reported immediately, not deferred to the final report.

Quality of the report: clear, concise, objective, constructive, accurate, complete, and timely.

The Public Finance Act governs the budget process, the consolidated fiscal programme, and the responsibilities of spending units (first-, second-, and third-level authorising officers).

Budget principles: legality, transparency, annuality, universality, specification, and accountability; the budget is adopted by the National Assembly.

The State Financial Inspection Act governs ex-post control of public funds; the Public Financial Inspection Agency conducts inspections and imposes measures.

Public procurement is governed by the Public Procurement Act (PPA) transposing the EU directives; thresholds distinguish below-threshold and above-threshold contracts.

Procurement principles: transparency, equal treatment, non-discrimination, proportionality, and free competition.

Procedures: open procedure, restricted procedure, competitive dialogue, negotiated procedure, and direct award under statutory thresholds.

Grounds for exclusion include criminal convictions, tax and social security debts, conflicts of interest, and professional misconduct.

Contract amendments are limited: substantial changes require a new procurement procedure; permitted changes are defined in the PPA.

Conflict of interest: officials involved in procurement must declare interests and be excluded from evaluation where a conflict exists.

Independence is the freedom from conditions that threaten objectivity; objectivity is a state of mind, independence is the appearance of it.

Impairments to independence must be disclosed to the head of the organisation; if independence is materially impaired, the engagement is reassigned or declined.

Internal auditors must not audit activities they previously managed; a cooling-off period applies after transfer from an operational role.

Confidentiality: information obtained in the engagement is not disclosed without authority unless legally required.

Conflicts of interest are declared in writing; the auditor withdraws from the engagement if the conflict cannot be managed.

QAIP: internal assessments (ongoing and periodic) plus an external assessment at least every five years; results are reported to senior management and the board.

External quality assessment conclusions: generally conforms, partially conforms, or does not conform; the rating and action plan are reported.

Continuing professional education is required to maintain competence; records of CPD hours are kept and reviewed.

Gifts and hospitality that could influence judgement must be declined or disclosed under the organisation's policy.

The Public Sector Internal Audit Act (PSIAA) is the primary statute: it defines the scope of internal audit, the status of the internal auditor, and the responsibilities of the heads of public sector organisations.

Internal audit is mandatory for all public sector organisations under the PSIAA; the internal audit unit reports functionally to the head of the organisation and is administratively subordinate to that same head.

The Minister of Finance sets methodological rules and the Code of Ethics for internal auditors in the public sector; the Ministry of Finance's Internal Audit Directorate performs central harmonisation and quality assessment.

The Public Financial Inspection Agency (PFIA) performs inspections and ex-post control, distinct from internal audit, which provides independent assurance and consulting to management.

The Bulgarian National Audit Office (BNAO) is the external supreme audit institution; it audits public funds and does not substitute for internal audit.

Internal auditors must hold a certification recognised under Bulgarian rules (e.g., CIA, CGAP, or a state-recognised internal audit qualification) and complete continuing professional development.

The internal audit charter, approved by the head of the organisation, defines purpose, authority, responsibility, and the right of access to records, personnel, and assets.

Independence is protected by law: internal auditors cannot be assigned operational duties, and removal of the head of internal audit requires notification to the central harmonisation unit.

The IIA Global Internal Audit Standards (2024) replaced the IPPF; they comprise five domains: Purpose, Ethics and Professionalism, Governing the Internal Audit Function, Managing the Internal Audit Function, and Performing Internal Audit Services.

Core Principles: integrity, objectivity, confidentiality, competency, professional behaviour, alignment with organisational strategy, positioning, adequate resources, effective communication, and quality assurance.

Objectivity is threatened by self-review, social pressure, economic interest, personal relationships, and familiarity; safeguards include rotation, independent review, and disclosure of impairments.

The Code of Ethics has four principles - Integrity, Objectivity, Confidentiality, Competency - each with rules of conduct; violations are handled through the professional disciplinary process.

Mandatory elements: conformance with the Standards is required; deviations must be disclosed, and the nature of any non-conformance is reported to senior management and the board.

The Quality Assurance and Improvement Programme (QAIP) requires internal assessments (ongoing monitoring plus periodic self-assessment) and an external assessment at least every five years.

The chief audit executive must report the QAIP results, including conformance status, to senior management and the board at least annually.

Risk = likelihood × impact; the risk score is the product of the two ratings, and residual risk is assessed after controls are applied.

COSO ERM (2017) organises risk management around governance and culture, strategy and objective-setting, performance, review and revision, and information, communication and reporting.

ISO 31000 provides the process: establishing context, risk identification, analysis, evaluation, treatment, communication and consultation, monitoring and review.

Public sector risk categories: strategic, operational, financial, compliance/legal, reputational, fraud/corruption, and service-delivery risk.

Risk appetite and risk tolerance must be formally approved by the head of the organisation; internal audit uses them to prioritise engagements.

The risk register records risk description, owner, inherent and residual ratings, existing controls, treatment actions, deadlines, and status.

Inherent risk is assessed before controls; control risk is the risk that controls fail to prevent or detect a material error.

Risk-based prioritisation: engagements are ranked by risk score, materiality, and time since the last audit, producing the annual audit plan.

COSO Internal Control - Integrated Framework (2013) has five components: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring Activities.

The 17 COSO principles are mapped to the five components; each principle must be present and functioning for the system to be effective.

Control types: preventive vs detective; manual vs automated; entity-level vs transaction-level; directive, preventive, detective, corrective.

Segregation of duties separates authorisation, custody, recording, and reconciliation; compensating controls apply when separation is impractical.

The three lines model: first line - operational management; second line - risk and compliance functions; third line - internal audit, providing independent assurance.

Internal control aims at reliability of reporting, effectiveness and efficiency of operations, and compliance with laws and regulations.

COSO limitations: collusion, management override, human error, and cost-benefit constraints mean no system gives absolute assurance.

Control testing: walkthrough to confirm design, then test of operating effectiveness on a sample; deficiencies are graded as deficiency, significant deficiency, or material weakness.

The annual risk-based audit plan is approved by the head of the organisation; changes during the year require documented justification and re-approval.

Engagement planning steps: understand the entity and process, define objectives and scope, assess risks and controls, set criteria, allocate resources and timing, and prepare the engagement work programme.

Engagement objectives state what the audit will conclude about; scope defines boundaries (period, locations, processes) and exclusions.

Audit criteria are the standards, laws, or benchmarks against which the condition is compared (e.g., the PSIAA, procurement rules, internal policies).

Materiality is set at planning and revised during the engagement if new information emerges.

The engagement work programme lists procedures, sampling approach, evidence to be obtained, responsible auditor, and deadlines.

Risk assessment at engagement level: identify inherent risks, evaluate control design, determine residual risk, and focus testing on high residual risk areas.

The planning memorandum or engagement plan is reviewed and approved by the head of internal audit before fieldwork starts.

Evidence must be sufficient, reliable, relevant, and useful; reliability ranking: auditor's direct observation > external documents > internal documents > oral representations.

Evidence types: physical, documentary, testimonial, analytical, and electronic; corroboration of oral evidence is required.

Audit procedures: inspection, observation, inquiry, confirmation, recalculation, re-performance, analytical review, and sampling.

Working papers must document the objective, procedures performed, evidence obtained, findings, conclusions, and reviewer sign-off; they support the audit report.

Working papers are the property of the organisation; access is restricted, and retention follows the statutory retention period.

Sampling: statistical (random, systematic) and non-statistical (judgmental); sample size increases with tolerable error decreasing and expected error increasing.

Analytical procedures compare ratios, trends, and budget-to-actual variances; significant unexplained variances require further investigation.

Supervision and review: work is reviewed before the report is issued; review notes and clearance are documented in the file.

Report structure: objectives and scope, criteria, findings (condition, criteria, cause, effect), conclusions, recommendations, and management responses with target dates.

Findings must state the condition, criteria, cause, effect, and recommendation; each recommendation is assigned to a responsible official with a deadline.

The draft report is sent to the auditee for factual accuracy; management responses are included in the final report, including disagreement.

The final report is signed by the head of internal audit and addressed to the head of the organisation; distribution is defined in the charter.

Follow-up: recommendations are tracked until implemented; overdue recommendations are escalated to senior management and the board.

Communication during the engagement: opening meeting, progress updates, and closing meeting to confirm findings and agree on actions.

Significant risks and material deficiencies are reported immediately, not deferred to the final report.

Quality of the report: clear, concise, objective, constructive, accurate, complete, and timely.

The Public Finance Act governs the budget process, the consolidated fiscal programme, and the responsibilities of spending units (first-, second-, and third-level authorising officers).

Budget principles: legality, transparency, annuality, universality, specification, and accountability; the budget is adopted by the National Assembly.

The State Financial Inspection Act governs ex-post control of public funds; the Public Financial Inspection Agency conducts inspections and imposes measures.

Public procurement is governed by the Public Procurement Act (PPA) transposing the EU directives; thresholds distinguish below-threshold and above-threshold contracts.

Procurement principles: transparency, equal treatment, non-discrimination, proportionality, and free competition.

Procedures: open procedure, restricted procedure, competitive dialogue, negotiated procedure, and direct award under statutory thresholds.

Grounds for exclusion include criminal convictions, tax and social security debts, conflicts of interest, and professional misconduct.

Contract amendments are limited: substantial changes require a new procurement procedure; permitted changes are defined in the PPA.

Conflict of interest: officials involved in procurement must declare interests and be excluded from evaluation where a conflict exists.

Independence is the freedom from conditions that threaten objectivity; objectivity is a state of mind, independence is the appearance of it.

Impairments to independence must be disclosed to the head of the organisation; if independence is materially impaired, the engagement is reassigned or declined.

Internal auditors must not audit activities they previously managed; a cooling-off period applies after transfer from an operational role.

Confidentiality: information obtained in the engagement is not disclosed without authority unless legally required.

Conflicts of interest are declared in writing; the auditor withdraws from the engagement if the conflict cannot be managed.

QAIP: internal assessments (ongoing and periodic) plus an external assessment at least every five years; results are reported to senior management and the board.

External quality assessment conclusions: generally conforms, partially conforms, or does not conform; the rating and action plan are reported.

Continuing professional education is required to maintain competence; records of CPD hours are kept and reviewed.

Gifts and hospitality that could influence judgement must be declined or disclosed under the organisation's policy.

The Public Sector Internal Audit Act (PSIAA) is the primary statute: it defines the scope of internal audit, the status of the internal auditor, and the responsibilities of the heads of public sector organisations.

Internal audit is mandatory for all public sector organisations under the PSIAA; the internal audit unit reports functionally to the head of the organisation and is administratively subordinate to that same head.

The Minister of Finance sets methodological rules and the Code of Ethics for internal auditors in the public sector; the Ministry of Finance's Internal Audit Directorate performs central harmonisation and quality assessment.

The Public Financial Inspection Agency (PFIA) performs inspections and ex-post control, distinct from internal audit, which provides independent assurance and consulting to management.

The Bulgarian National Audit Office (BNAO) is the external supreme audit institution; it audits public funds and does not substitute for internal audit.

Internal auditors must hold a certification recognised under Bulgarian rules (e.g., CIA, CGAP, or a state-recognised internal audit qualification) and complete continuing professional development.

The internal audit charter, approved by the head of the organisation, defines purpose, authority, responsibility, and the right of access to records, personnel, and assets.

Independence is protected by law: internal auditors cannot be assigned operational duties, and removal of the head of internal audit requires notification to the central harmonisation unit.

The IIA Global Internal Audit Standards (2024) replaced the IPPF; they comprise five domains: Purpose, Ethics and Professionalism, Governing the Internal Audit Function, Managing the Internal Audit Function, and Performing Internal Audit Services.

Core Principles: integrity, objectivity, confidentiality, competency, professional behaviour, alignment with organisational strategy, positioning, adequate resources, effective communication, and quality assurance.

Objectivity is threatened by self-review, social pressure, economic interest, personal relationships, and familiarity; safeguards include rotation, independent review, and disclosure of impairments.

The Code of Ethics has four principles - Integrity, Objectivity, Confidentiality, Competency - each with rules of conduct; violations are handled through the professional disciplinary process.

Mandatory elements: conformance with the Standards is required; deviations must be disclosed, and the nature of any non-conformance is reported to senior management and the board.

The Quality Assurance and Improvement Programme (QAIP) requires internal assessments (ongoing monitoring plus periodic self-assessment) and an external assessment at least every five years.

The chief audit executive must report the QAIP results, including conformance status, to senior management and the board at least annually.

Risk = likelihood × impact; the risk score is the product of the two ratings, and residual risk is assessed after controls are applied.

COSO ERM (2017) organises risk management around governance and culture, strategy and objective-setting, performance, review and revision, and information, communication and reporting.

ISO 31000 provides the process: establishing context, risk identification, analysis, evaluation, treatment, communication and consultation, monitoring and review.

Public sector risk categories: strategic, operational, financial, compliance/legal, reputational, fraud/corruption, and service-delivery risk.

Risk appetite and risk tolerance must be formally approved by the head of the organisation; internal audit uses them to prioritise engagements.

The risk register records risk description, owner, inherent and residual ratings, existing controls, treatment actions, deadlines, and status.

Inherent risk is assessed before controls; control risk is the risk that controls fail to prevent or detect a material error.

Risk-based prioritisation: engagements are ranked by risk score, materiality, and time since the last audit, producing the annual audit plan.

COSO Internal Control - Integrated Framework (2013) has five components: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring Activities.

The 17 COSO principles are mapped to the five components; each principle must be present and functioning for the system to be effective.

Control types: preventive vs detective; manual vs automated; entity-level vs transaction-level; directive, preventive, detective, corrective.

Segregation of duties separates authorisation, custody, recording, and reconciliation; compensating controls apply when separation is impractical.

The three lines model: first line - operational management; second line - risk and compliance functions; third line - internal audit, providing independent assurance.

Internal control aims at reliability of reporting, effectiveness and efficiency of operations, and compliance with laws and regulations.

COSO limitations: collusion, management override, human error, and cost-benefit constraints mean no system gives absolute assurance.

Control testing: walkthrough to confirm design, then test of operating effectiveness on a sample; deficiencies are graded as deficiency, significant deficiency, or material weakness.

The annual risk-based audit plan is approved by the head of the organisation; changes during the year require documented justification and re-approval.

Engagement planning steps: understand the entity and process, define objectives and scope, assess risks and controls, set criteria, allocate resources and timing, and prepare the engagement work programme.

Engagement objectives state what the audit will conclude about; scope defines boundaries (period, locations, processes) and exclusions.

Audit criteria are the standards, laws, or benchmarks against which the condition is compared (e.g., the PSIAA, procurement rules, internal policies).

Materiality is set at planning and revised during the engagement if new information emerges.

The engagement work programme lists procedures, sampling approach, evidence to be obtained, responsible auditor, and deadlines.

Risk assessment at engagement level: identify inherent risks, evaluate control design, determine residual risk, and focus testing on high residual risk areas.

The planning memorandum or engagement plan is reviewed and approved by the head of internal audit before fieldwork starts.

Evidence must be sufficient, reliable, relevant, and useful; reliability ranking: auditor's direct observation > external documents > internal documents > oral representations.

Evidence types: physical, documentary, testimonial, analytical, and electronic; corroboration of oral evidence is required.

Audit procedures: inspection, observation, inquiry, confirmation, recalculation, re-performance, analytical review, and sampling.

Working papers must document the objective, procedures performed, evidence obtained, findings, conclusions, and reviewer sign-off; they support the audit report.

Working papers are the property of the organisation; access is restricted, and retention follows the statutory retention period.

Sampling: statistical (random, systematic) and non-statistical (judgmental); sample size increases with tolerable error decreasing and expected error increasing.

Analytical procedures compare ratios, trends, and budget-to-actual variances; significant unexplained variances require further investigation.

Supervision and review: work is reviewed before the report is issued; review notes and clearance are documented in the file.

Report structure: objectives and scope, criteria, findings (condition, criteria, cause, effect), conclusions, recommendations, and management responses with target dates.

Findings must state the condition, criteria, cause, effect, and recommendation; each recommendation is assigned to a responsible official with a deadline.

The draft report is sent to the auditee for factual accuracy; management responses are included in the final report, including disagreement.

The final report is signed by the head of internal audit and addressed to the head of the organisation; distribution is defined in the charter.

Follow-up: recommendations are tracked until implemented; overdue recommendations are escalated to senior management and the board.

Communication during the engagement: opening meeting, progress updates, and closing meeting to confirm findings and agree on actions.

Significant risks and material deficiencies are reported immediately, not deferred to the final report.

Quality of the report: clear, concise, objective, constructive, accurate, complete, and timely.

The Public Finance Act governs the budget process, the consolidated fiscal programme, and the responsibilities of spending units (first-, second-, and third-level authorising officers).

Budget principles: legality, transparency, annuality, universality, specification, and accountability; the budget is adopted by the National Assembly.

The State Financial Inspection Act governs ex-post control of public funds; the Public Financial Inspection Agency conducts inspections and imposes measures.

Public procurement is governed by the Public Procurement Act (PPA) transposing the EU directives; thresholds distinguish below-threshold and above-threshold contracts.

Procurement principles: transparency, equal treatment, non-discrimination, proportionality, and free competition.

Procedures: open procedure, restricted procedure, competitive dialogue, negotiated procedure, and direct award under statutory thresholds.

Grounds for exclusion include criminal convictions, tax and social security debts, conflicts of interest, and professional misconduct.

Contract amendments are limited: substantial changes require a new procurement procedure; permitted changes are defined in the PPA.

Conflict of interest: officials involved in procurement must declare interests and be excluded from evaluation where a conflict exists.

Independence is the freedom from conditions that threaten objectivity; objectivity is a state of mind, independence is the appearance of it.

Impairments to independence must be disclosed to the head of the organisation; if independence is materially impaired, the engagement is reassigned or declined.

Internal auditors must not audit activities they previously managed; a cooling-off period applies after transfer from an operational role.

Confidentiality: information obtained in the engagement is not disclosed without authority unless legally required.

Conflicts of interest are declared in writing; the auditor withdraws from the engagement if the conflict cannot be managed.

QAIP: internal assessments (ongoing and periodic) plus an external assessment at least every five years; results are reported to senior management and the board.

External quality assessment conclusions: generally conforms, partially conforms, or does not conform; the rating and action plan are reported.

Continuing professional education is required to maintain competence; records of CPD hours are kept and reviewed.

Gifts and hospitality that could influence judgement must be declined or disclosed under the organisation's policy.