Bulgarian Public Sector Internal Auditor Exam key terms

An independent, objective assurance and consulting activity inside a Bulgarian public organisation that evaluates risk management, control and governance, operating under the Public Financial Inspection Act and the internal audit framework adopted by the Minister of Finance.

Bulgarian legislation that establishes the internal audit function in the public sector, defines who performs it, the scope of its work, the powers of auditors and the oversight of audit activity by the Minister of Finance.

A formal written document approved by senior management and the audit committee that states the internal audit unit's purpose, authority, responsibility, position in the organisation and right of access to records, personnel and property.

A body, separate from management, that oversees internal audit in a Bulgarian public organisation, approves its plans and reports, monitors the independence of auditors and reviews whether management acts on audit findings.

The person who leads the internal audit unit, manages its resources, reports functionally to the audit committee and administratively to senior management, and is accountable for the quality and coverage of audit work.

A Bulgarian state body that carries out financial inspections and checks for irregularities in the use of public funds, distinct from internal audit, which gives independent assurance rather than exercising administrative control.

The freedom of the audit unit from conditions that threaten its ability to carry out audit work objectively, including freedom from operational duties, from pressure on findings and from reporting lines that place auditors under the managers they review.

An auditor's state of mind that allows conclusions to be reached without bias, conflict of interest or undue influence, and that requires avoiding relationships and tasks that would compromise an honest professional judgement.

Any personal, financial, employment or organisational circumstance that weakens an auditor's ability to act independently, which must be disclosed to the chief audit executive and resolved before the engagement proceeds.

The set of principles and rules of conduct for internal auditors covering integrity, objectivity, confidentiality and competency, together with detailed guidance on how those principles apply in practice and how breaches are handled.

The personal quality of honesty and moral courage that leads an auditor to report facts truthfully, respect legal limits, disclose material facts and refuse to be part of unlawful or improper activity.

The duty to protect information obtained during audit work, to use it only for professional purposes and to avoid disclosing it without proper authority, while still making required disclosures to oversight bodies and the courts.

A situation in which an auditor's personal, financial or other interest could influence professional judgement, requiring disclosure and removal from the affected engagement or decision so that objectivity is preserved.

An attitude of questioning and critical assessment of evidence, in which the auditor does not accept information at face value and actively looks for contradictory data before drawing conclusions.

The global framework issued by the Institute of Internal Auditors that sets mandatory requirements for internal audit work, including attribute standards on the audit unit and performance standards on how engagements are planned, performed and reported.

A structured system of internal and external assessments that checks whether the audit unit follows standards and the code of ethics, measures its performance and identifies improvements, with results reported to senior management and the audit committee.

The coordinated process by which a public organisation identifies, assesses, treats and monitors events that could prevent it from achieving its objectives, integrated into planning, budgeting and service delivery rather than treated as a separate exercise.

The amount and type of risk an organisation is willing to accept in pursuing its objectives, expressed by senior management and used to judge whether identified risks need treatment or can simply be monitored.

A maintained record of identified risks that lists each risk, its cause and consequence, its likelihood and impact ratings, the responsible owner, the controls in place and the planned treatment actions with deadlines.

The level of risk that exists before any management controls are applied, used as a starting point for judging how much protection existing controls actually provide.

The risk that remains after management's existing controls have been taken into account, which the auditor compares with the organisation's risk appetite to decide whether further action is needed.

The risk that a material error or irregularity will not be prevented, detected or corrected in time by the organisation's internal controls, which drives how much substantive audit work is required.

The whole set of policies, procedures and organisational arrangements established by management to give reasonable assurance that objectives are met, resources are safeguarded, laws are followed and reliable information is produced.

A widely used model describing internal control as five interrelated components - control environment, risk assessment, control activities, information and communication, and monitoring - applied across the whole organisation and at process level.

The tone set at the top of an organisation - its ethical values, governance structure, commitment to competence and management philosophy - which forms the foundation on which all other controls rest.

The concrete policies and procedures that help ensure management directives are carried out, such as authorisation, segregation of duties, reconciliation, physical safeguards and review of performance indicators.

The ongoing and separate evaluations that management and internal audit perform to determine whether controls continue to operate effectively over time and whether deficiencies are corrected promptly.

A control that separates incompatible tasks - such as authorising a transaction, recording it and holding the related asset - so that no single person can both commit and conceal an error or fraud.

A document, usually covering one year, that sets out which areas will be audited, the priorities and resources assigned, based on a risk assessment of the organisation, and that is approved by the audit committee.

The approach of selecting audit topics and allocating effort according to the likelihood and impact of risks facing the organisation, so that scarce audit resources are directed to the areas of greatest exposure.

The complete inventory of auditable entities, processes, programmes and systems within an organisation, which is assessed and ranked by risk to form the basis for the multi-year and annual audit plan.

A document prepared for a single audit that defines its objectives, scope, criteria, key risks, planned procedures, timetable and resource needs, and that guides fieldwork and the eventual report.

The initial information-gathering phase of an engagement in which the auditor reviews documents, interviews staff and observes operations to understand the activity and refine the risks and objectives of the audit.

A detailed list of the specific procedures, tests and sampling steps to be performed during fieldwork, linked to the engagement objectives and updated as new information emerges.

All information gathered and analysed by the auditor to support findings and conclusions, which must be sufficient, reliable, relevant and useful for the purpose for which it is used.

The measure of how much evidence the auditor has collected - its quantity and completeness - judged against the risk and materiality of the matter so that a reasonable conclusion can be reached.

The organised records an auditor keeps of procedures performed, evidence obtained and conclusions reached, which must be complete enough for another experienced auditor to understand the work without additional explanation.

Procedures that check the accuracy and validity of individual transactions, balances or records, for example by inspecting documents, confirming amounts or recalculating figures, rather than relying on the design of controls.

Procedures that verify whether prescribed controls, laws or procedures were actually applied during the period under review, often by examining a sample of transactions for evidence of authorisation and review.

A documented conclusion about a condition the auditor examined, normally presented with the criteria expected, the actual situation, the cause of the difference and the effect or risk it creates.

The formal written output of an engagement that states objectives and scope, presents findings and their significance, gives an overall opinion or conclusion where required, and includes management's comments and agreed actions.

A proposed action addressed to management that, if implemented, would correct the cause of a finding and reduce the associated risk, ideally specific, feasible and accompanied by a deadline and responsible owner.

Management's written response to audit findings and recommendations, setting out the actions it accepts, the person responsible for each and the date by which implementation will be completed.

The process of checking, after a report is issued, whether management has implemented agreed actions, recording the status of each recommendation and escalating unresolved or overdue items to senior management and the audit committee.

The threshold at which an error, omission or irregularity could reasonably influence the decisions of those who use the audit report or the financial statements, guiding what is reported and how much testing is done.

The risk that the auditor expresses an inappropriate conclusion or misses a material problem, made up of inherent risk, control risk and the risk that audit procedures themselves fail to detect the issue.

Bulgarian legislation governing how contracting authorities award contracts for works, supplies and services using public funds, setting procedures, thresholds, publication duties, award criteria and rules on conflicts of interest.

A public body or other entity obliged to apply public procurement rules when spending public funds, responsible for planning the purchase, choosing a lawful procedure, evaluating tenders and signing and managing the contract.

The monetary limits set by law that determine which procurement procedure and advertising rules apply, so that smaller purchases follow simpler rules and larger contracts require open competition and publication.

The annual law approving planned revenues and expenditures of the state, which authorises spending limits for public bodies and provides the financial framework against which budget execution is audited.

The phase in which approved budget amounts are actually spent and received, monitored through commitments, payments and reporting to check that spending stays within legal limits and matches the purposes approved.

Money from the state budget, municipal budgets, EU programmes or other public sources, whose use is subject to legal rules on legality, economy, efficiency and accountability and is a central concern of public sector audit.

A governance model in which operational management owns and manages risk, a risk and compliance function provides oversight and advice, and internal audit gives independent assurance to the governing body.

The signals sent by senior management and the governing body through their behaviour, decisions and stated priorities about the importance of ethics, control and compliance, which shape how staff actually act.

The possibility that intentional deception by staff, contractors or third parties causes loss or misstatement, assessed by considering incentives, opportunities and rationalisations, and addressed by controls and audit procedures.

A procedure in which the auditor traces one or a few transactions through the whole process from initiation to recording, to confirm understanding of how the control system actually works in practice.

The rules and practices governing how long working papers and reports are kept, who may access them, and how they are protected and eventually disposed of, in line with legal and professional requirements.