MFMA section 165: what a municipal internal audit unit must actually do

Section 165 of the Local Government: Municipal Finance Management Act 56 of 2003 requires every municipality and municipal entity to have an internal audit unit. The section is short, and it is frequently over-read in audit reports.

What the section requires

• An internal audit unit must exist.
• It must prepare a risk-based audit plan and an internal audit programme for each financial year.
• It must advise the accounting officer and report to the audit committee on the implementation of that plan.
• Its work must address internal controls, accounting procedures and practices, risk and risk management, performance management, loss control, and compliance with the MFMA and other applicable legislation.

What it does not require

Section 165 does not mandate an annual audit of any specific function. This is misstated often — a finding that supply chain management must be audited every year because of section 165 is not supported by the text. What the section requires is that the plan be risk-based. If SCM carries high assessed risk, the plan should reflect that, and the reasoning should be documented. The obligation is to the method, not to a fixed schedule.

How it interacts with section 166

Section 166 establishes the audit committee. The two sections work together: internal audit performs the work and reports to the committee, and the committee advises the council, the accounting officer and management. A municipality that has an internal audit unit but a committee that does not meet, or vice versa, is not compliant with either.

Practical evidence an assessor will look for

• A current, approved risk-based audit plan with the linkage from assessed risk to selected engagement visible on the face of it.
• An internal audit charter that sets out the unit's mandate and reporting lines.
• Audit committee minutes showing that internal audit reports were tabled and discussed.
• Evidence that the implementation of agreed actions was confirmed, not merely reported by management.

Common questions

Does section 165 require SCM to be audited every year?

No. Section 165 requires a risk-based audit plan. Where supply chain management is assessed as high risk the plan should reflect that, but the section imposes no fixed annual requirement for any specific function.

Can a municipality outsource its internal audit function?

The MFMA permits the internal audit function to be performed by an outsourced provider in certain circumstances, but the accounting officer's responsibility for ensuring the function exists and operates effectively remains.