Compliance Management Framework for PFMA Compliant Institutions

COMPLIANCE MANAGEMENT FRAMEWORK Presenter: Sandiso Thutshini | Director: PFMA Compliance | 08 September 2016

PURPOSE To assist the Accounting Officers/ Authorities of PFMA Compliant institutions to improve the levels of compliance by their respective Institutions with all applicable compliance obligations. 2 2

LEGISLATIVE REQUIREMENTS Sec 38(1)(n) of the PFMA - AO must comply and ensure compliance by their institutions with the provisions of the Act; TR 3.1.10(f) - the audit committee must, amongst others, review the institution s compliance with legal and regulatory provisions; and TR 3.2.11(e) - The internal audit function must assist the accounting officer in maintaining efficient and effective controls by evaluating those controls to determine their effectiveness and efficiency, and by developing recommendations for enhancement or improvement. The controls subject to evaluation include compliance with laws, regulations and controls. 3 3

LEGISLATIVE REQUIREMENTS Cont.. Regulation 14 of the revised Treasury Regulations Requires AO to ensure that sufficient capacity exists within their institutions to prevent, detect and mitigate any non-compliance with the applicable financial management regulatory framework; How - by establishing a compliance function with such roles and responsibilities as prescribed by National Treasury Instruction. King III Compliance structure and appointment of Compliance Officer to manage and monitor compliance; King IV To assist organisations to move beyond a mere compliance (compliance with the letter of the law) to compliance with the spirit of the law. 4 4

APPLICABILITY OF THE FRAMEWORK National and provincial departments; National and provincial trading entities; Constitutional institutions; and Schedule 3 (a) and 3 (c) public entities. 5 5

CONSEQUENCE MANAGEMENT Sections 81 of the PFMA - An AO commits an act of financial misconduct if that AA wilfully or negligently fails to comply and ensure compliance with any provisions of the PFMA; and makes or permits an unauthorised expenditure, an irregular expenditure or a fruitless and wasteful expenditure; and Sections 81(2) of the PFMA - An official to whom a power or duty is assigned in terms of section 44 commits an act of financial misconduct if that official wilfully or negligently fails to exercise that power or perform that duty. 6 6

CONSEQUENCE MANAGEMENT Cont.. Section 38(1)(h) of the PFMA AA must take effective and appropriate disciplinary steps against any official who (i) contravenes or fails to comply with a provision of the PFMA; (ii) commits an act which undermines the financial management and internal control systems of the institution; and (iii) makes or permits an unauthorised expenditure, irregular expenditure or fruitless and wasteful expenditure (UIF). 7 7

COST vs. BENEFIT COMPLIANCE FUNCTION In the past 4 years the Department of Health has incurred R1.2 billion in legal costs relating to medical malpractice; Ekurhuleni has won an R11.6m lawsuit against the Gauteng health department; and A major airline in South Africa was fined R900 000 for failing to comply with the Employment Equity Act (EEA). Big four banks fined 125 mil for non compliance with FIC, 8 8

COMMON NON-COMPLIANCE FINDINGS Supply Chain Management: Transgression of SCM prescripts; Asset Management: No proper control systems to safeguard and maintain assets; Material misstatements identified in: Non-current assets, current assets, liabilities, expenditure and disclosure items; AFS not prepared in accordance with the prescribed financial reporting framework; Expenditure Management AA did not take effective steps to prevent irregular and fruitless and wasteful expenditure. 9 9

NON-COMPLIANCE AREAS Cont.. Irregular Expenditure:- Supply chain management (SCM); and Human resource management practices. The of non-compliance relate to irregular expenditure as a result of transgressions of the SCM prescripts as follows: Procurement without following competitive bidding processes; Procurement without obtaining quotations; Non-compliance with procurement processes; and Non-compliance with legislation on contract management. 10 10

COMPLIANCE IMPLEMENTATION PLAN No Key Activities Year 1 Year 2 Approved compliance structure/ organogram 1 X Approved compliance job descriptions/ specifications 2 X Capacitate compliance management function 3 X Approved compliance risk management policy 4 X Compliance policy statement 5 X Approved compliance risk management framework/ manual 6 X Approved compliance charter 7 X Approved compliance risk management plan 8 X Include compliance matters in the performance agreements of the top management 9 X Appoint risk champions/ Risk Committee 10 X Inclusion of the compliance responsibilities into the auditor other committee charter 11 X The formats, structure and content of compliance report 12 X Training and Awareness 13 X 11 11

IMPLEMENTATION OF COMPLIANCE FUNCTION Compliance Management function - New concept in the public sector; Budget constraints; Phased approach to compliance implementation; Compliance function matures over time; Information sessions National Treasury; and Formal compliance qualification UJ, UCT & Compliance Institute of SA 12 12

THREE LINES OF DEFENCE 13 13

DIFFERENT ASSURANCE PROVIDERS Internal Control Function; Risk Management Function; Compliance Management Function Norms & Std. is not Compliance; Security and quality assurance; Internal Audit Function; External audit function; and Regulators. 14 14

COMBINED ASSURANCE King III Audit committee should ensure that a combined assurance model is applied to provide a co-ordinated approach to all assurance providers. Management Internal Assurance Providers External Assurance Providers Combined Assurance 15 15

ASSURANCE PROVIDERS Compliance Management - Maintain & update CU. - Educate management & Board - Facilitate legislative risk prioritization - Maintain CRMP - Assist business with implementations of operational compliance - Monitor & Report Risk Management - Conduct legislative risk prioritization - Facilitate completion of compliance risk registers with ratings and mitigating actions - Ensure awareness on the part of management & board on risk consequences of non compliance Internal Audit - Assess adequacy & Effectiveness of compliance processes; - Systems & Structure, highlight key weaknesses and associated risks noted and make recommendations 16 16

COMPLIANCE FUNCTION Compliance function assesses the conformity of the institution with compliance obligations - Compliance requirements and commitments; The compliance function should be independent Report ideally functionally to the AC and administratively to the AA; and The concept of independence involves four related elements- 17 17

COMPLIANCE FUNCTION Cont.. Firstly - should have a formal status within the institution; Secondly - there should be Head of compliance with overall responsibility for co-ordinating the management of the compliance risk; Thirdly - Staff and Head should not be placed in a compromised position where there is perceived or actual conflict of interest; and Fourthly - Staff with appropriate number of competency with sufficient independence to fulfil their role objectively. 18 18

COMPLIANCE FUNCTION Cont.. External & internal audit focus mainly on financial management; Identify all applicable laws and regulations, and prioritise them Compliance Universe: H&S Act, POCA, Refugee Amendment Act, etc. Training and awareness - to management and staff; Research and update the institution on upcoming legislative changes; Develop CRMP s and monitor implementation; and Assess the institutions compliance with applicable laws and regulation. 19 19

ANNUAL COMPLIANCE PLAN 20 20

HEALTH INDUSTRY REGULATORY UNIVERSE LEGISLATION Legislation Dental Technicians Act Hazardous Substance Act Allied Health Proffessions Act Health Proffesions Act Choice on Termination of Pregnancy Ammendment Act Genetically Modified Organisms Act Sterilization Act Traditional Health Practitioners Act National Health Act Parmacy Act Medica South African Medical Research Council Act Health and Wellfare Matters Act Nursing Act Public Health Act Mental healthcare Act Measurement Standards Act Council for medical Schemes levies Act Medical Schemes Act International Health Regulations Act Medical University of Southern (Private) Amendment Act Foodstuffs, cosmetics and disinfectants Act Genetically Modified Organisms Act 21 21

HEALTH INDUSTRY REGULATORY UNIVERSE CODES AND GUIDELINES Code & Guidelines Policy framework for ethics approval and endorsement of health research Policy on the management of public hospitals Guide on leprosy control in SA Yellow Fever Polocy Guide for the managenment, prevention and control of meningococcal disease in SA Society on Medical Laboratory Technologists of South Africa Codes Essential steps in the management of common conditions associated with internal mortality. Guide for the prevention of malaria in South Africa Policy Guide on Child and Adolescent mental health A policy on quality in healthcatre for South Africa Health proffessions council of South Africa Codes National Health Insurance Plan Green Paper 22 22

COMPLIANCE RISK ASSESSMENT TEMPLATE Inherent Risk RatingOverall Likelih ood Penalty for non- compliance Risk Affected DepartmentCategory Legislation/Industry Code/Bill management plan in place Rating Impact Finance, Budget, IA, Risk Financial misconduct Public Finance Management Act Core 5 5 5 Yes Treasury Regulations Public Service Act Public Service Regulations Protected disclosure Act Employment Equity Act Protection of personal Information Act Broad Based Economic Empowerment Act Prevention of combating corrupt activities Act Prevention of organized crime 23 23

COMPLIANCE RISK ASSESSMENT TEMPLATE 24 24

COMPLIANCE MONITORING PLAN 25 25

CONCLUSION Effectiveness Consequence Management; Tone at the top; Independence; Compliance culture Can it be taught; instill the culture of compliance at development stages of our scholars? Institutions Start preparing for compliance functions; i.e. address governance issues; National Treasury Provide information sessions; and avail compliance framework and Guidelines; Outsourcing Internal capacity still required to oversee outsourced function. 26 26

THE END 27 27