Legal and Institutional Framework of Public Sector Internal Audit in Bulgaria
The statutory anchor
Bulgarian public sector internal audit rests on the Public Financial Management Act (Закона за публичните финанси) and the subordinate internal audit regulation, together with the Internal Audit Act (Закон за вътрешния одит в публичния сектор). Candidates must know the architecture: the Minister of Finance sets the methodological framework and the strategic guidance, the Central Harmonisation Unit for Internal Audit (CHUIA, within the Ministry of Finance) harmonises methodology, coordinates training and certification, and reports on the quality of internal audit across the public sector. The Public Financial Inspection Agency is a separate control body - a classic distractor.
Who is in scope
Obligated entities include ministries, state agencies, municipalities, state-owned enterprises above statutory thresholds, and managers of EU and other international funds. Each obligated organisation appoints a head of internal audit (ръководител на вътрешния одит), who reports functionally to the head of the organisation and is functionally independent of the activities audited. The internal audit unit is organisationally separated from finance, accounting and control-execution functions; it cannot design or operate the controls it audits.
Traps
Questions blur roles: who appoints the head of internal audit (the head of the organisation, with a statutory procedure), who coordinates certification (CHUIA), who may remove the head of internal audit (restricted grounds). Another trap confuses internal audit with the financial inspection function, or assumes internal audit can impose sanctions. Internal audit gives assurance and advice; it does not manage risk or issue penalties.
Rule of thumb
When a question asks "who does what", anchor on three words: harmonise (CHUIA), assure (internal audit unit), inspect (financial inspection). If an option makes internal audit an operational manager, it is wrong.
Worked example
A municipality wants its internal auditor to sign off payment orders as a control. The correct answer: not permitted - this is a management function that would impair objectivity and breach the functional separation required by the framework.