A performance audit mandate is an agreed scope defining the objective, criteria, evidence access, reporting and management-response responsibilities.
Commissioning should establish the question to answer and the authority under which work will proceed. The proposed arrangements below connect deliverables to acceptance evidence while preserving independent conclusions and management ownership of corrective action.
Establishing the commissioning objective, scope, and suitable criteria
discuss the audit criteria with the audited entity
— INTOSAI ISSAI3000, paragraph49 (planning/conducting requirement for adopting SAIs)
Commissioning a performance audit requires defining a clear objective and operational scope that focus review efforts on specific programmes, activities, or service delivery systems. The objective must articulate whether the audit evaluates economy, efficiency, or effectiveness, while the scope establishes boundaries regarding locations, timeframes, and records examined. Establishing suitable criteria provides objective benchmarks derived from management principles, policies, or comparative standards against which performance is evaluated.
Commissioning authorities and advisory teams must discuss proposed criteria with the audited entity during scope definition to foster a shared understanding of performance expectations. Discussing criteria enhances transparency and cooperation without diminishing the auditor's independent authority to select appropriate standards. A well-defined scope prevents scope creep and ensures audit procedures focus on high-impact operational areas.
Establishing criteria during initial scoping assists in identifying the specific operational data, system logs, and administrative files required for subsequent testing. Clarifying these requirements early prevents misunderstandings regarding performance expectations and ensures that audit procedures remain aligned with institutional priorities.
Defining authority, competencies, independence, and data availability
Executing a performance audit requires establishing clear terms of authority and data access to inspect operational records, systems, and facilities. The commissioning agreement must verify that the audit team collectively possesses necessary professional competencies, research skills, and sector knowledge to conduct the evaluation. Where specialist expertise is needed, assess the proposed expert's competence, objectivity and the reliability of the work to be used.
Independence safeguards must ensure that auditors maintain an objective, questioning attitude and remain free from operational conflicts of interest. Commissioning teams must assess data availability during scoping to confirm that required operational records exist and can be gathered efficiently. Identifying data limitations early prevents unrealistic testing scopes and ensures conclusions rest on valid, reliable evidence.
In addition, project management plans must outline resource allocations, audit timelines, and supervisory review protocols to ensure that fieldwork is executed efficiently. Managing the performance audit as a structured project ensures high-quality output while respecting administrative capacities.
Distinguishing advisory scoping from statutory audits and performance reporting
Institutions commissioning performance audit support must distinguish between advisory evaluations and statutory audits conducted by Supreme Audit Institutions. In South Africa, AGSA describes annual audit coverage of financial statements, performance information and material non-compliance, alongside performance auditing under its public mandate. ISSAI 3000 serves as the international performance audit standard designed for Supreme Audit Institutions that choose to adopt it under public mandates.
Referencing ISSAI3000 provides a methodological point of reference; the actual engagement mandate and applicable requirements establish its authority and obligations. A reference alone does not demonstrate standards conformance. Identify relevant legislative, professional and contractual requirements explicitly instead of inferring them from a generic terms-of-reference template.
Advisory performance reviews must not be confused with the annual audit of performance information. The AGSA's annual performance information audit evaluates whether reported achievements against predetermined objectives are useful and reliable, whereas performance auditing examines whether management measures ensure economy, efficiency, and effectiveness.
Discussion of findings, management response ownership, and follow-up
A structured commissioning mandate establishes formal protocols for discussing preliminary findings, managing responses, and executing follow-up verification. Auditors must provide the audited entity with an opportunity to review draft findings, correct factual errors, and submit written management responses before final report issuance. Incorporating management feedback ensures balanced reporting while documenting reasons for accepting or rejecting specific comments.
Management response ownership remains strictly with operational leadership, who hold responsibility for designing and implementing corrective action plans. Advisory teams provide objective findings and constructive recommendations but cannot assume management execution authority. Follow-up procedures focus on whether management has adequately addressed identified root causes after a reasonable operational period, recording what follow-up establishes and any remaining limitations.
Mandate workpackage and deliverable acceptance matrix
To operationalise commissioning terms, institutions deploy a structured workpackage matrix aligning mandate phases with deliverables, accountabilities, and acceptance criteria. For hypothetical and illustrative purposes, a public institution might commission a performance review of regional logistics workflows to evaluate supply delivery efficiency.
Key practical measures for governing the performance audit commissioning process include:
- Formulate specific audit questions focused on economy, efficiency, or effectiveness parameters.
- Establish formal data access agreements and verify research team competencies prior to fieldwork.
- Discuss evaluative criteria with operational management to ensure shared performance benchmarks.
- Record management responses objectively in working papers and final engagement deliverables.
- Distinguish mandatory standard requirements from non-mandatory implementation considerations.
| Mandate Workpackage | Deliverable Output | Accountable Owner | Acceptance & Handover Criteria |
|---|---|---|---|
| Scoping & Criteria Definition | Approved charter detailing audit objectives, scope, and suitable criteria. | Commissioning Authority & Lead Auditor | Formal agreement on audit scope boundaries and evaluative performance benchmarks. |
| Evidence Gathering & Analysis | Verified evidence repository and preliminary findings working papers. | Lead Auditor & Technical Specialists | Confirmation that gathered evidence is sufficient, relevant, and reliable to support findings. |
| Findings Discussion & Response | Draft report containing findings, root-cause analysis, and management responses. | Audited Entity Management & Lead Auditor | Documented examination of management comments and agreement on factual accuracy. |
| Final Acceptance & Follow-Up | Final performance report and corrective action follow-up schedule. | Lead auditor for report; management for action plans; oversight body receives findings | Evidence of report review, documented management responses and agreed follow-up. Acceptance does not give management a veto over independent conclusions. |
Sources
Frequently Asked Questions
How does an advisory performance review differ from the AGSA's annual audit of performance information?
The AGSA's annual audit of performance information determines whether reported performance against predetermined objectives in annual reports is useful and reliable. An advisory performance review independently evaluates whether management measures ensure that allocated resources are acquired economically and used efficiently and effectively.
Does referencing ISSAI 3000 grant an advisory firm statutory audit authority?
No, ISSAI 3000 is an international standard created for Supreme Audit Institutions adopting it under public mandates. The engagement's actual mandate determines its authority and applicable requirements. Referencing ISSAI3000 alone does not create public audit powers or demonstrate conformance.
Who holds primary responsibility for formulating management responses and action plans?
Operational management and responsible parties hold primary ownership for formulating management responses and implementing corrective action plans. Auditors provide independent findings and constructive recommendations but cannot assume management execution duties.
Why must performance criteria be discussed with the audited entity during scoping?
Discussing criteria with the audited entity ensures a common understanding of the quantitative and qualitative benchmarks used to evaluate performance. While discussed with management, final selection of suitable criteria remains the independent responsibility of the auditor.
What procedures govern follow-up verification after a performance review is completed?
Follow-up procedures involve an independent examination of whether management has adequately addressed identified operational problems and remedied underlying root causes after a reasonable period. Follow-up results are reported to executive leadership to evaluate remediation progress.
For wider context, read the performance audit overview.