Internal Audit Manual Wapda

Internal Audit Manual: Water and Power Development Authority (WAPDA)

1. Document Control & Revision History

---

2. Executive Summary & Scope

2.1 Clinical Statement of Operational Boundaries

This Standard Operating Procedure (SOP) defines the mandatory methodology, execution pathways, and governance controls for conducting internal audits across all directorates, project management units (PMUs), generation facilities, transmission networks, and administrative formations of the Pakistan Water and Power Development Authority (WAPDA).

The scope encompasses:

• Financial integrity, asset management, and capital expenditure (CAPEX) tracking.
• Engineering procurement and construction (EPC) contract lifecycle management.
• Environmental, social, and governance (ESG) compliance for mega-infrastructure projects (e.g., dams, barrages, hydropower plants).
• Information technology (IT) governance, SCADA cybersecurity, and enterprise resource planning (ERP) data integrity.

2.2 Regulatory Standards & Statutory Framework

All audits executed under this manual must comply with:

• The WAPDA Act, 1958 (as amended).
• Public Procurement Regulatory Authority (PPRA) Rules, 2004.
• International Standards for the Professional Practice of Internal Auditing (IIA Standards).
• Guidelines issued by the Auditor-General of Pakistan (AGP) and Public Accounts Committee (PAC) directives.
• Relevant international engineering and safety standards (IEC, IEEE, ISO 45001, ISO 14001).

---

3. Prerequisites & Tool Requirements

Execution of WAPDA internal audits requires rigorous preparation across physical, digital, and professional dimensions:

• Hardware & Equipment:
  • FIPS 140-2 compliant encrypted laptops with pre-installed audit software.
  • Ruggedized tablets for site inspections (IP67 rated).
  • Personal Protective Equipment (PPE): Steel-toe safety boots, high-visibility vests, hard hats with chin straps, hearing protection, and voltage-rated safety glasses (mandatory for substation and dam powerhouse entries).
• Software & Access Credentials:
  • Read-only administrative access to WAPDA’s Enterprise ERP (SAP/Oracle Financials).
  • Computer-Assisted Audit Techniques (CAATs) software (e.g., ACL Analytics, IDEA).
  • Secure WAPDA Virtual Private Network (VPN) client.
  • Electronic Document Management System (EDMS) credentials.
• Professional Certifications:
  • Lead Audit Team Members must hold at least one recognized professional designation: CIA, CPA, CA, CISA, or PMP (for engineering audits).
  • Mandatory clearance of WAPDA Security Directorate background vetting.

---

4. Roles & Responsibilities (RACI Matrix Table)

Legend: Responsible (Does the work), Accountable (Final approval/owner), Consulted (Provides input), Informed (Kept updated).

---

5. Step-by-Step Operational Procedure

Phase 1: Pre-Audit Planning & Risk Assessment

• 1.1 Review the WAPDA Corporate Strategic Plan, previous audit reports, PAC directives, and active litigation registers associated with the target directorate or project.
• 1.2 Execute an analytical review of financial statements and operational metrics using CAATs to identify variance thresholds exceeding $\pm 5%$.
• 1.3 Draft the formal Audit Engagement Letter detailing objectives, scope, timeline, and required data extracts.
• 1.4 Submit the Engagement Letter to the Chief Internal Auditor (CIA) for final sign-off and dispatch it to the target Auditee General Manager (GM) 14 calendar days prior to fieldwork.

Phase 2: Entrance Conference & Fieldwork Execution

• 2.1 Conduct the formal Entrance Conference with the Auditee project team to establish communication channels, confirm document access, and outline site visit protocols.
• 2.2 Deploy CAAT scripts to test 100% of population transactions for high-risk domains (e.g., payroll, contractor billings, inventory movements) and perform statistical sampling for lower-risk items in accordance with IIA sampling standards.
• 2.3 Execute physical verification of assets, inventory godowns, and civil works sites, ensuring strict adherence to WAPDA safety PPE mandates.
• 2.4 Document all observations, interviews, and physical evidence in the Electronic Audit Working Papers (EAWP), ensuring each workpaper is cross-referenced to source documents.

Phase 3: Exit Conference & Draft Report Compilation

• 3.1 Draft individual audit findings containing the mandatory structure: Condition, Criteria, Cause, Effect, and Recommendation (the 5 C's of Audit Findings).
• 3.2 Convene the Exit Conference with the Auditee management to present preliminary findings, review factual accuracy, and secure initial feedback.
• 3.3 Compile the Draft Internal Audit Report, incorporating substantiated auditee management comments where applicable.
• 3.4 Submit the Draft Report to the Director Audit for technical review and quality control check.

Phase 4: Final Reporting & Remediation Tracking

• 4.1 Issue the Final Audit Report, signed by the Chief Internal Auditor, to the WAPDA Authority (Chairman and relevant Members), the concerned General Manager, and the Federal Audit Board.
• 4.2 Establish a remediation tracking matrix in the Audit Management System, setting mandatory target implementation dates (not exceeding 60 days for standard findings, 30 days for high-risk/fraud vulnerabilities).
• 4.3 Initiate Follow-up Audit procedures upon receipt of the Auditee's formal closure attestation.

---

6. Quality Assurance & Verification Criteria

6.1 Audit Working Paper Quality Checklist

• Completeness: Every assertion must be backed by verifiable documentary evidence stored in the EAWP.
• Independence: Reviewers must verify that no audit team member has held operational responsibilities within the audited directorate within the preceding 3 years.
• Supervisory Review: 100% of working papers must be reviewed and digitally signed by the Senior Audit Manager prior to report drafting.

6.2 Tolerance Thresholds & Acceptance Benchmarks

• Financial Variances: Unreconciled variances in project accounts exceeding PKR 100,000 are classified as material non-compliance.
• Procurement Compliance: Any deviation from PPRA Rules without documented emergency authorization constitutes an automatic critical finding.
• Asset Verification Discrepancies: Physical asset counting variances exceeding 0.5% of total asset register value require mandatory forensic expansion of the audit scope.

---

7. Practical Troubleshooting Scenarios

Scenario A: Auditee Refuses Access to Critical ERP Financial Records or Physical Sites

• Context: A project directorate denies administrative access to specific sub-ledger modules citing "National Security / Classified Hydro-Installation Status."
• Immediate Corrective Action Protocol:
  1. Halt intrusive data collection immediately to prevent operational escalation.
  2. Invoke Section 24 of the WAPDA Act, 1958, which grants internal auditors statutory unhindered access to all books, accounts, and records.
  3. Issue a formal, written Notice of Access Obstruction to the Auditee, copying the Chief Internal Auditor and the WAPDA Member (Finance/Water/Power).
  4. If access is not granted within 24 hours, escalate to the Chairman WAPDA for emergency administrative intervention and log the event as a critical internal control failure in the quarterly report to the Public Accounts Committee.

Scenario B: Discovery of Active Fraud, Embezzlement, or Severe Financial Malpractice

• Context: Field testing reveals systematic duplicate billing and phantom contractor payments totaling millions of rupees.
• Immediate Corrective Action Protocol:
  1. Secure all digital and physical working papers, transaction logs, and supporting invoices under cryptographic lock to prevent spoliation of evidence.
  2. Suspend standard reporting timelines and issue an immediate Confidential Special Alert directly to the Chief Internal Auditor and Chairman WAPDA within 4 hours.
  3. Hand over forensic evidence extraction duties to the WAPDA Vigilance Directorate and Federal Investigation Agency (FIA) liaison unit, maintaining a strict chain-of-custody ledger.
  4. Expand the audit scope horizontally to test historical transactions across all projects managed by the same administrative unit over the preceding 3 fiscal years.