1

Groupe institut supérieur de commerce et d’administration des entreprises

Centre de Rabat

Mémoire de fin d’étude

Internal auditing & ethical governance in

the public sector. The case of national
Morocco’s tourist office

Rédigé par : NORA EZZEMRANI

Encadré par : Mme. NAZHA BOURQUIA

Année universitaire : 2014/2015

 Acknowledgments
I would like to address my sincere acknowledgments, and I would like to honor those
who have helped me to accomplish this report, those who have provided me with the
information and techniques needed to write it, but also supported and encouraged me.
My sincerest thanks go to Mr.Imad Lakzit, my thesis tutor who provided me with
insights and useful tutoring; to Mrs. Amal El Maarouf, Administration and Finance
Director at the Moroccan National Tourist Office, who agreed to welcome me among
her team for my internship, and to other employees of the Office: Mr. Mohammed
Srairi, Mr. Driss Merzouki, Mr Fouad Azim and Mrs.Souad Khafaji, who made sure
that I spend my internship in the best conditions.

I would also like to thank other employees of the Office: Mr. Mohammed Srairi, Mr.
Driss Merzouki, Mr Fouad Azim and Mrs.Souad Khafaji, who made sure that I spend
my internship in the best conditions. They did not hesitate to help me, advise me, to
give me as much information as possible about their responsibilities and to answer all
my questions without any reluctance. For all these reasons, they deserve my respect,
my gratitude and the most honest recognition.

I also cease this opportunity to thank all the professors and administrative staff of
ISCAE, which guarantee us a qualitative academic curriculum that goes along with
professional requirements.

Finally, I would like to thank my parents and family for their unconditional love and
support.

To all the people I have mentioned, may you find perceive this work as the expression
of my deep gratitude and my highest consideration.

1
 Table of Contents
Acknowledgments .......................................................................................................1
Introduction ................................................................................................................3
I. Internal Auditing and Ethical Governance in the public sector .......................4
A. General, contextual and historical definitions ..........................................................4
1. Internal Auditing ...............................................................................................................4
2. Governance ........................................................................................................................6
3. Ethics..................................................................................................................................8
B. An overview of internal auditing in the public sector ............................................. 10
1. The development of internal auditing in the public sector ............................................. 10
2. The Internal Audit Capability Model (IA-CM) for the public sector ............................ 13
3. The evolution of Internal Auditing in the Moroccan public sector ................................ 16
C. The development of Ethical Governance in the public sector and the contribution
of Internal Auditing ........................................................................................................ 18
1. The development of Ethical Governance in the public sector ........................................ 18
2. The evolution of Ethical Governance in Morocco .......................................................... 20
3. Internal Auditing and developing Ethical Governance in the public sector .................. 22
II. The Case of Morocco’s National Tourist Office (MNTO) ............................... 24
A. Presentation of Morocco’s National Tourist Office (MNTO) ................................ 24
1. Mission and activities of MNTO...................................................................................... 24
2. Historical background and current organization ........................................................... 26
3. Future perspectives of MNTO ......................................................................................... 27
B. An overview of internal auditing in MNTO ............................................................ 29
1. Organization of the IA department at MNTO ................................................................ 29
2. Internal audit engagements and obstacles ...................................................................... 31
3. Conducting an IA-CM study at MNTO .......................................................................... 32
C. Ethical Governance and the contribution of Internal Auditing at MNTO ............ 37
1. Organizational and ethical climate in MNTO ................................................................ 37
2. Internal Auditing and shaping a better ethical governance at MNTO .......................... 38
Conclusion ................................................................................................................39
Bibliography..................................................................................................................... 40
Appendix 1: The Global Internal Audit Survey Questions chosen as indicators for
KPAs ................................................................................................................................ 41

2
 Introduction
"The power of ethics today is neither religious, nor philosophical or political: it is
simply, and unfortunately, in the consciousness of impending disaster that men are
bringing about their irresponsibility. Reasonable ethical power is objectively the
ultimate remedy for human folly. "

This quote from Mr. Tariq Ramadan, an academician, philosopher and intellectual ;
recalls the emergence of new management-related concepts, including ethics or social
responsibility, in a business environment characterized by a blind race towards
economic growth , to the detriment of the environment or social values.

Following business scandals such as the famous Enron scandal, the rush for moralizing
business has boosted with various measures, including vouching for Internal Auditing
as an objective and independent practice which may bring new solutions enhancing
integrity and ethical values.

However, this moralization hasn’t stopped at the private sector, but was extended to
the public sector accordingly, also due to political scandals, and a new approach of
dealing with public goods and public entities, known as public sector governance. And
with ensuring right and ―ethical‖ governance, comes the responsibility of Internal
Auditing.

Accordingly, this thesis addresses the particular topic of how Internal Auditing can
shape Ethical Governance in the Public Sector, through meticulous research and
fieldwork. The following report is thus an attempt to tackle this topic, throughout two
major parts: A theoretical part and a practical part. The first addresses theoretical
concepts and research about the thesis statement, and the second is a compilation of
on-field work at one of Morocco’s most important public entities, The Moroccan
National Tourist Office, both aimed at finding concrete liaisons between Internal
Auditing and Ethical Governance.

3
 I. Internal Auditing and Ethical Governance in
the public sector
The first part of this report represents a theoretical overview of our thesis statement.
Indeed, such an overview is necessary to better apprehend the main concepts
pertaining to our topic, including their contextual and historical evolution. It is also
essential to explore the different theoretical associations between internal auditing and
ethical governance in the public sector, in order to lay the groundwork to the next part
of this report, which involves more fieldwork and practical aspects.
This part begins with a conceptual chapter which provides contextual definitions and
historical insights about Internal Auditing, Governance and Ethics. Following is a
chapter about the characteristics of internal auditing in the public sector, globally and
in Morocco. The third and last chapter of this part focuses on ethical governance in
public organizations and the role played by internal auditing in reinforcing it.

A. General, contextual and historical definitions

This chapter is divided into three sections; presenting general, contextual and historical
definitions of each one of the key concepts of our thesis statement: Internal Auditing,
Governance, and Ethics.

1. Internal Auditing
In order to better define and understand internal auditing as a specific type of auditing,
we must first tackle the latter term and elucidate it.
Auditing can be broadly defined as the examination and verification of the accounts,
books and documents of an organization, assuring that these don’t present any
irregularities and are adequately maintained as it is required by different regulations.
Contrary to popular belief, auditing doesn’t regard financial and accounting activities
exclusively. In fact, any subject matter can be audited, such as internal controls,
project management, quality management, information technology, etc. Such audits
enable organizations to assess and thus ameliorate the effectiveness of risk
management, internal controls and governance processes.
Audits can be internal or external, depending on whether the auditors reside within the
audited organization (i.e. they are organization employees), or outside it, respectively.
After defining and clarifying auditing and its types, we will focus on the core element
of our study, which is internal auditing. The Institute of Internal Auditors (IIA) defines
internal auditing as ―an independent, objective assurance and consulting activity
designed to add value and improve an organization's operations. It helps an
organization accomplish its objectives by bringing a systematic, disciplined approach
to evaluate and improve the effectiveness of risk management, control, and
governance processes.‖

4
Accordingly, the scope of internal auditing revolves around issues such as
organizational governance, risk management and internal controls pertaining to
operations’ efficiency and effectiveness, financial and managerial reporting’s
reliability, and overall compliance with regulations and laws.
While internal auditors are certainly part of the organizations which employ them, they
are bound to show objectivity and independence, both of which are fundamental
standards regulating the internal auditing profession and are given prominence in
different guides and practice advisories. Internal auditors are commended by the IIA to
show independence towards the activity they audit. The organizational placement and
hierarchical reporting lines of the internal audit activity must also demonstrate the
objectivity and independence of internal auditors.
The internal auditing profession has progressed steadily with the evolution of
managerial science. It is often conceptually assimilated to financial audits which are
practiced by independent accounting and auditing firms. It is undeniable that some of
the basic techniques used in internal auditing are derived from consulting activities and
accounting professions; nevertheless, internal auditing as we know it today was
originally conceived by Lawrence Sawyer who is referred to as ―the father of modern
internal auditing‖; along with the current philosophy, theory and practice of modern
internal auditing as it is defined by the International Professional Practices Framework
(IPPF) of the IIA. 1
As the USA implemented the Sarbanes-Oxley Act in 2002, the role and importance of
internal auditing were exposed and valued more than ever. Internal auditors seemed to
own the needed essential competencies to aid organizations in meeting the
requirements of regulations, and abiding by the rules of the law. Nonetheless, it
appeared that the internal auditors’ activity was more focused on financial procedures,
derailing from the global purpose of internal auditing which we have mentioned
before, and creating confusion about its authentic functions.
Internal auditing relies largely, if not completely, on the establishment of an audit plan.
The audit plan is based on a risk assessment of the organization, which reveals the
main aspects to focus on. The audit plan is normally proposed by the Chief Audit
Executive (CAE), and submitted to the approval of the Audit Committee or the Board
of Directors. The conduct of internal auditing is generally considered as an extremely
confidential assignment.
At the end of each audit, internal auditors ordinarily issue reports which generally
outline their findings and recommendations, as well as responses and action plans
from management. Audit reports must respect few qualitative rules such as: 2

 Objectivity: Comments and opinions expressed in the Report should

demonstrate objectivity, be unbiased and devoid of value judgments.
 Clarity: The language used in the Report should be clear and straightforward.
 Accuracy: The information contained in the Report should be accurate.
1
http://en.wikipedia.org/wiki/Internal_audit
2
http://en.wikipedia.org/wiki/Internal_audit

5
  Brevity: The Report should be concise.
 Timeliness: The Report should be released immediately after the conclusion of
the audit, ideally within a month.
Internal Auditing has grown to be a cornerstone of an effective and efficient
management of organizations, and an essential activity to enhance performance and
improve, among other elements, governance processes. The next section addresses this
latter notion.

2. Governance
In completion of the first chapter of this report, as well as the process of defining and
clarifying the key concepts of our thesis statement, this second section tackles the
concept of Governance, considering its definition and understanding will shed more
light on the problematic addressed in this work.
In his book ―Governance: A very short introduction‖, Professor Mark Bevir defines
governance as ―all processes of governing, whether undertaken by a government,
market or network, whether over a family, tribe, formal or informal organization or
territory and whether through laws, norms, power or language.‖
Another definition addresses Governance as ―the processes of interaction and decision-
making among the actors involved in a collective problem that lead to the creation,
reinforcement, or reproduction of social norms and institutions.‖3
Governance involves all kinds of organizations, whether it is geopolitical (a nation, or
a state), a legal entity (a business, a corporation, etc.), or an informal body. The
governance of an organization is how rules, norms, decisions and actions are
produced, maintained, regulated and held accountable. For example; a government’s
governance process includes all the participants in the decision-making process, such
as lobbies, parties, Medias, etc.
In an organizational context, more particularly in a business context, governance (in
this case referred to as Corporate Governance), pertains to the processes and relations
by which organizations are controlled and managed. Governance actors in this context
are responsible for the allocation of responsibilities as well as rights among the
organization’s stakeholders, such as the board of directors, shareholders, managers,
auditors, creditors, etc. Governance includes the procedures and rules of decision-
making, establishing policies, as well as setting and pursuit of objectives with
consideration to the environmental aspects.

3
Hufty, Marc (2011). "Investigating Policy Processes: The Governance Analytical Framework (GAF). In:
Wiesmann, U., Hurni, H., et al. editors. Research for Sustainable Development: Foundations, Experiences, and
Perspectives.". Bern: Geographica Bernensia: 403–424.

6
The main frameworks pertaining to corporate governance include documents such as
The Cadbury Report (UK, 1992) and The Principles of Corporate Governance (OECD,
1998 and 2004) which provide generic principles about proper business practices; and
of course The Sarbanes-Oxley Act (USA, 2002), which is more of a legislative act as it
was issued by the federal government of the United States.
Principles of good corporate governance include:
 Equitable and fair treatment of shareholders: by respecting their rights and
providing guidance in exercising them. Such practices involve communicating
information openly and effectively.
 Keeping the interests of other stakeholders: By recognizing the legal, social,
and contractual obligations to other stakeholders (besides shareholders), such as
employees, creditors, suppliers, policy makers, etc.
 Identifying the responsibilities of the organization’s board: identifying the
relevant skills and competencies needed for the board to exercise its roles such
as reviewing management performance. The board’s responsibilities should
also include appropriate levels of commitment and independence.
 Integrity and ethical behavior: Board members and corporate officers should
demonstrate a proper practice of integrity. Moreover, organizations should
establish codes of conduct which promote ethical and responsible behavior at
all hierarchical levels.
 Transparency and disclosure: Organizations should elucidate the duties and
responsibilities of the board and the top management, in order to determine the
levels of accountability. In addition, organizations should also carry out
processes which independently verify and validate the integrity of their
financial reporting. The disclosure of findings concerning the organization
should be issued in a timely manner, and should be accessed by all
stakeholders.
Governance doesn’t concern solely corporations and the private sector. As we have
mentioned before, governance processes apply to any system which involves decision-
making, producing and regulating actions, as well as accountability. Governance is
also an inherent part of public sector organizations. The given definitions of
governance still apply to public sector governance. However, the framework of public
institutions serves different purposes and objectives, and thus includes other
stakeholders.
Indeed, governments and other public sector institutions collect financial resources
mainly from taxpayers and state budgets, both of which are considered as ―public
money‖, or government spending. Public sector institutions are responsible and
accountable for their management and use of these resources. Accordingly, the
principles of good governance remain the same.

7
As we have acknowledged before, a fundamental principal of governance is ethical
behavior. Governance processes wouldn’t serve their rightful and genuine purposes if
they are not solely based on integrity and ethics. The last section of this chapter
addresses the concept of Ethics and its principles, in order to better comprehend its
requirements and its preponderant role in governance.

3. Ethics
Before emerging in a business context, ethics were generally known as moral
principles, affecting lives and decision-making processes, based on a ―right and
wrong‖ approach. Originally, ethics is a branch of philosophy which involves the same
approach, by systematizing, defending, and recommending concepts of right and
wrong conduct. 4
Ethics revolve around the questions which determine ―the best way for people to lead
their lives‖, and ―what actions are right or wrong in particular circumstances.‖ By
investigating such questions, ethics seek to resolve issues relative to human morality,
by providing clear distinctions between good and evil, right and wrong, virtue and
vice, justice and crime. 5
According to these definitions, ethics seem to take part in every aspect of life and
livelihood, including business and organizational behavior. Professional ethics have
gained notoriety with the arousal of ethical scandals revolving around business and
politics. Such scandals have pushed the thoughts on morality and ethics within private
or public organizations, considering these a cornerstone of society, and consequently
part of the ―right and wrong‖ conduct and moral code. Placing organizations in a
sphere of social and moral conduct lies within the fact that they use social resources,
which therefore holds them morally and ethically accountable to society.
Ethical behavior in the workplace is an important part of employment. In an era where
organizational social values and social responsibility have become essential
conditions, ethical behavior and high morale are profitable and definite ingredients for
success. Professional ethics involve practices revolving around:
 Behavior: Organizations should specify the aspects of acceptable and
inacceptable behavior within their environment. Employees must be made
aware of expected conducts during interviews (during the hiring process) or in
job descriptions. Behavioral guidelines normally address matters such as proper
conduct, work attire, harassment, language, etc. Typically, correctional
measures should be planned in regards of employees who don’t abide by codes
of conduct.
 Integrity: Integrity involves being honest and choosing right over wrong at all
times in business and workplace transactions. It can include putting an honest
effort in work, avoiding sneakiness, fair dealings, etc.
 Accountability: Accountability relies on everyone taking responsibility of his or
her own actions.
4
http://en.wikipedia.org/wiki/Ethics
5
http://en.wikipedia.org/wiki/Ethics

8
  Teamwork: Teamwork is vital aspect which makes or breaks organizations.
Ethical teamwork involves everyone from supervisors to subordinates and even
to customers. Teamwork also involves putting aside personal or work-related
differences in order to reach a larger goal.
 Commitment: Among the most crucial principles of ethics is commitment,
which can be defined as a great amount of dedication. Commitment, through
giving a strong effort to the job and having a positive attitude towards it is as
much rewarding as skills and competencies.
After enunciating definitions and general information about the key concepts of our
thesis statement, we will tackle, in the next chapter, the details of the profession of
Internal Auditing and its particularities in the public sector.

9
 B. An overview of internal auditing in the public sector
The second chapter of this part addresses the profession of internal auditing in the
context of public sector. As we have mentioned before, the public sector has different
characteristics from those pertaining to corporations of the private sector, particularly
in terms of missions and objectives. From this difference stems the need to
contemplate the specificities of internal auditing within the scope of the public sector
exclusively.
In order to get an appropriate and holistic overview at the profession of internal
auditing in the public sector, this chapter is also divided into three sections. The first
section addresses the managerial development of public institutions, which explains
the necessity of internal auditing activities in the public sector. Following in the
second section, is a presentation of a model developed to assess the performance and
capability of internal auditing activities exclusively in the public sector: The Internal
Audit Capability Model (IA-CM). Finally, the third chapter provides an analysis of the
evolution of internal auditing in the Moroccan public sector.

1. The development of internal auditing in the public sector

The astonishing evolutions of management science in the late twentieth century, and
the manner in which managerial techniques have contributed in bringing solutions to
many contemporary social issues, have proven the importance of management science
in bringing systematic solutions and achieving timely objectives. Initially intended for
businesses and corporations, managerial techniques have extended to all types of
organizations, even the non-lucrative ones. That is to say the extent to which
managerial functions can provide insightful solutions and catalyze the process of
reaching target objectives. Therefore, public sector institutions, which are also
organizations concerned with the latest managerial trends, have evolved into following
the corporate and business-like models, to serve the ultimate objective of effectively
and efficiently managing the public goods.
Justly, in following the latest managerial trends such as the decentralization and
delegation of power and decision-making; actions of strengthening internal controls
systems relevant to different functioning processes in public sector organizations
should also be considered. Such actions revolve around regulations, and involve
elaborating regulatory documents such as procedures manuals or professional
standards. Subsequently, those measures can be strengthened by the recognition of the
role of internal auditing, and consequently the creation of internal audit departments
within public sector organizations.
Internal audit departments in public organizations, just like in private organizations,
serve the purposes of objective assurance and value-adding to organizational processes
which are aimed at reaching qualitative or quantitative objectives as well as overall
missions such as:

10
  Safeguarding public goods;
 Producing safe and reliable information enabling central authorities to control
the decentralized services and measure performance;
 Introducing corrective actions in case there is deviation from the targets set at
the central level;
 Enforcing the respect of rules, standards, procedures and central directives.
Public sector entities represent a principal-agent relationship. Public sector officials,
acting as the principal’s (the public) agent, must regularly report to the principal about
their use of resources, and the extent to which agreed-upon objectives have been
accomplished. In addition, an effective audit activity must reduce the risks inherent in
a principal-agent relationship. In this case, the principal depend on the auditor to
provide an independent and objective evaluation of the agent’s accounting, and report
on whether the agent uses the resources in accordance with the principal’s
requirements.6 Relying on a third party to attest the credibility of performance results,
financial reporting and compliance stems from different aspects characterizing the
relationship between the principal and its agent, such as:
 Conflicts of interest: Agents may use their authority and resources for their
benefits rather than the principal’s.
 Remoteness: Operations can be removed from the principal’s oversight.
 Complexity: The principal may not possess the technical skills and
competencies necessary to oversee the activity.
 Consequence of error: Errors can be costly especially when it comes to the
agent’s responsibility for resources and programs affecting the principal’s lives.
With the creation of Internal Audit departments within the different components of the
public sector such as ministries, administrations and other public institutions, officials
are equipped with a very effective tool to enforce policies, guidelines and instructions.
Accordingly, they have the possibility to prevent and detect malfunctions and find
appropriate solutions to address them, in consultation with the services and
decentralized entities which are the subject matter of audits. However, there should be
a clear definition of:
 The roles of Internal Audit entities, vis-à-vis other forms of controls;
 The role to be played by these entities as part of external audit engagements.
Subsequently, drafting a charter of internal audit in public sector organizations is
crucial, in order to clearly define the roles and responsibilities of internal auditors.
This definition will help remove the ambiguities and confusions between auditing and
other forms of controls, such as inspection. This definition should also highlight the
true purpose of Internal Auditing, namely the quest for effectiveness, efficiency and
economy by providing solutions to malfunctions which are likely to interfere with the
regular course of public sector entities.

6
The IIA, « The Role of Auditing in Public Sector Governance”, 2nd edition, January 2012

11
According to the Institute of Internal Auditor’s, there are nine elements required for
effective Internal Audit in the public sector7. Those nine elements are:

 Organizational independence: This allows the internal audit department to

conduct its activities without meddling by the organization subject of the audit.
Organizational independence needs to be coupled with objectivity, hence
contributing to the accuracy of the auditing work and the ability to rely on
reported results.
 A formal mandate: The audit activity’s duties and powers should be enunciated
by a legal document such as a charter or public sector’s constitution. Such a
document tackles procedures and reporting requirements, as well as the
commitment of the audited entity to collaborate with the auditors.
 Unrestricted access: Audits should be conducted with total and unrestricted
access to any elements appropriate for the performance of audit activities, such
as employees, property, or records.
 Sufficient funding: The internal audit department must have adequate funding
relative to the size of its responsibilities, because budgets impact the audit
activity’s ability to perform its diligences.
 Competent leadership: The head of the internal audit department must have the
capacity to recruit, retain and manage staff which skills comply with his
demand, with total independence and without managerial or political influence.
In addition, the leader should also be professionally qualified and possess skills
pertaining to applicable audit standards. Moreover, the head of the audit activity
should be an articulate public spokesperson.
 Objective staff: The staff of internal auditors must demonstrate impartial and
objective attitudes and avoid conflicts of interest.
 Competent staff: Internal auditing activity is in need of a professional staff that
has the essential competence and qualifications to conduct the audit-related
tasks required.
 Stakeholder support: Public sector stakeholders, such as officials, Medias and
involved citizens should understand and support the legitimacy of the auditing
activity and its mission.
 Professional audit standards: Professional audit standards, whether they are
national or international, represent as the basic framework for implementing the
previous elements and promoting quality audit work.

These elements are applied globally and without significant regard to the local
regulations of each country or region. They are needed in the maintenance and
development of a good and robust internal audit activity in the public sector. In
addition to these elements, The Institute of Internal Auditors has developed, with the
considerable assistance of the Internal Audit department at the World Bank, a practical
model for assessing the performance and capabilities of internal auditing in public
sector institutions. The second section of this chapter details the specificities of this
model.
7
MACRAE E. VAN GILS D. «Nine Elements Required for Internal Audit Effectiveness in the Public Sector”, The
IIARF, 2014.

12
 2. The Internal Audit Capability Model (IA-CM) for the public
sector
The Internal Audit Capability Model (IA-CM) for the public sector is a recognized
international framework. It identifies the fundamental elements needed for effective
internal auditing in the public sector. Its particularity is that it is a universal model,
since its comparability revolves solely around principles, practices and processes
which can be applied at a global level. This model may be used as a tool for self-
assessment and capacity building.

In 2004, the PSC (Public Sector Committee) recognized that the internal audit activity
could be significantly divergent from one country to another, mainly because of
differences in managerial practices, processes, and culture. From here came the need
for a universal model that public sector internal audit activities could use for self-
assessment and development purposes.

The IA-CM model consists of five progressive capability levels, describing the
characteristics and capabilities of an Internal Audit activity at that particular level:8

Level 5 Optimizing Internal audit learning from inside and outside the
organization for continuous improvement
Level 4 Managed Internal audit integrates information from across the
organization to improve governance and risk management
Level 3 Integrated Internal audit management and professional practices
uniformly applied
Level 2 Infrastructure Sustainable and repeatable internal audit practices and
procedures
Level 1 Initial No sustainable, repeatable capabilities—dependent upon
individual efforts

Accordingly, there are six crucial elements of every internal audit activity which are
measured by the five capability levels:

 Services and Role of Internal Auditing: Services include providing assurance

and advice as well as co-sourced services with external service providers. The
role of internal auditing pertains to providing objective and independent
assessments to help the organization accomplish its objectives and improve its
operational processes.
 People management: Creating a work environment which allows people to
perform to the best extent of their abilities. This activity includes job
descriptions, recruitment, performance standards, professional development,
training, ongoing coaching, and career development.

8
Internal Audit Capability Model (IA-CM) for the Public Sector (Altamonte Springs, FL: The Institute of Internal
Auditors Research Foundation, 2009), p. 7.

13
  Professional practices: Addresses the full background of policies, processes
and practices which enable the internal audit activity to be performed
effectively and with proficiency.
 Performance Management and Accountability: refers to the information
needed to manage, conduct and control operations of the internal audit activity
and account for its performance and results.

 Organizational Relationships and Culture: Involves the organizational

structure and the internal management and relationships within the internal
audit activity itself, along with the Chief Audit Executive’s relationship with
senior management.
 Governance Structures: Including the administrative and functional reporting
relationship of the CAE, and the internal audit activity’s place within the
organizational and governance structure of the entity.

The measurement of these six elements relies on Key Process Areas (KPAs), which
are found within each capability level. KPAs determine the capability of an audit
activity, in a building-block manner. Achieving a capability level involves mastering
all of the KPAs within the Internal Audit elements included in that level and ensuring
that these KPAs are formally institutionalized within the IA activity. Institutionalizing
KPAs at one level lays the basis for capabilities and practices at the next level. 9

The Internal Audit Capability Model’s matrix is represented as following:

9
Internal Audit Capability Model (IA-CM) for the Public Sector (Altamonte Springs, FL: The Institute of Internal
Auditors Research Foundation, 2009), p. 7.

14
The positioning of the internal audit activity’s elements in this matrix can give a clear
idea about the performance and capabilities of the IA activity as a whole. There will be
an explicit application of this model in the second part of this work, which will provide
more clarification and insights on its use.

Meanwhile, the next section will deal with the development of the internal audit
activity in the Moroccan public sector, in order to obtain a greater theoretical overview
on this matter.

15
 3. The evolution of Internal Auditing in the Moroccan public
sector
In this section, we will tackle the prominent place that internal auditing has shaped in
the Moroccan public sector, and return to the first origins and legal obligations relating
to the practice of internal auditing in Moroccan public entities. We will also take the
examples of the entities responsible for internal auditing in some renowned Moroccan
public institutions for comparison purposes.
Many public sector organizations created internal audit departments which conduct
internal audits relative to various aspects of their management, in order to control and
master their activities by assessing the risks that they involve.
It is legitimate to acknowledge the development of the Auditing of different
managerial aspects relevant to Moroccan public institutions, such as strategies,
accounts, performances, etc. It is manifest that there is a significant will to support
public organizations in developing the internal audit function within them, particularly
since there is rising awareness concerning the roles of the internal audit activity in
helping manager better master their activities to effectively achieve the organizations’
objectives.
Many legislative texts have focused on creating an enabling environment for the
promotion of Internal Audit in public institutions and ministries, for instance:

 The Royal letter of 1993: This letter, which had the force of a law, has been
addressed by His Majesty the King Hassan II to the Prime Minister, asking him
to submit public institutions and administrations to Audit;
 The Circular of the Prime Minister: This circular took over the royal
instructions and ordered all ministers to submit the public institutions under
their supervision to external audits, as well as the creation of Internal Auditing
Departments in public institutions and companies, and decreed the submission
of all managerial aspects relevant to these institutions to internal and external
audits.
 The decisions and ministerial circulars; for instance the Decision
n°DPE113/70/16 of 09.23.1993 organizing Auditing of the public enterprises
under the supervision of the Ministry of Public Works, by subjecting them to
three types of Audits: Financial Audit, Internal Audit and Management Audit.
 The Act n°69-00 relative to the State’s finance controlling on public enterprises
and organizations.
 The Act relative to the institution of Morocco’s national and regional Courts of
Audit.
While these legal incentives helped develop the practice of Internal Audit in public
institutions and enterprises in Morocco, we must underline other considerations which
intervened in this process, especially to meet internal requirements, which differ from
one organization to the other.

16
There is no unanimity regarding an official appellation of the departments which
handle internal auditing in Moroccan public sector organizations. Subsequently, each
ministry or public institution has the liberty of choosing the official appellation of their
internal auditing unit, as well as its size and its organizational place within the
organization. This assertion is made clearer if we take the examples of some well
known Moroccan public sector organizations, whose place is considerable in the
Moroccan economy:

 The Caisse de Dépôt et de Gestion (French for Deposit and Management Fund,
shortened as CDG), which is a state-owned financial entity operating in
managing long-term saving assets. The CDG’s internal auditing body works
alongside with the inspection body, both fused in a division called ―Directorate
of General Inspection and Audit‖.
 The Caisse Marocaine des Retraites (French for Moroccan Retirement Fund,
shortened as CMR), which is a Moroccan public institution in charge of
managing pension funds, has a relatively smaller internal auditing activity, with
merely an ―Auditing Service‖, under a larger ―Division of Audit, Risk
Management and Management Control‖.
Internal Audit departments are generally related to the top management of the
organizations in which they exist. Less often, the internal audit activity in the
Moroccan public sector can be affiliated to a directorate, like other organizational
functions such as Finance or Human Resources. It is the case of Bank Al Maghrib,
Morocco’s central bank, in which the entity responsible of internal auditing is included
in the ―Directorate of Audit and Risk prevision‖, at the same level as other
directorates.
There is no unanimously agreed-upon formal status of the internal audit activity within
Moroccan public organizations, or a legal or professional obligation determining the
exact organizational and hierarchical status that the internal audit activity should have
in the Moroccan public organizations; nevertheless, these public organizations should
bear in mind that however the organizational status of the internal audit activity within
the organization, it mustn’t compromise its objectivity and independence, neither its
ability to guarantee good governance practices as well as ethical behaviors. The
following chapter deals with the question of good public governance, and the role of
internal auditing in its concrete development.

17
 C. The development of Ethical Governance in the public
sector and the contribution of Internal Auditing
Having dealt previously with the development of internal auditing in the public sector
worldwide and in Morocco, we will now do the same with the concepts of governance
and ethics in the public sector, before concretely showing the prominent role played by
internal auditing in the development of these two concepts.

This chapter is divided into three sections, the first dealing with the development of
ethical governance in the public sector at a global level, the second section addressing
the development of ethical governance in the Moroccan public sector, and the third
one demonstrating the great contributions of internal auditing to achieving ethical
governance practices in public entities.

1. The development of Ethical Governance in the public sector

Public sector governance examines aspects such as the practices, policies, procedures
and responsibilities, exercised to provide strategic guidance, insure objectives are
attained, manage risks and use resources correctly and accountably. Public sector
governance also covers the essential role of leadership in guaranteeing that robust
governance practices are diffused throughout the organization, and the ample
responsibility of all public officials to implement governance practices and policies in
their everyday work.

Good governance encompasses two major aspects:

 Performance: The use of governance procedures to contribute in the public

organization’s global performance and the supply of public goods or services.
 Conformance: The use of governance procedures to ensure conformity with the
requirements of the law and other regulations of accountability, integrity and
openness.

Meaning that, generally, public governance tackles the way officials of the public
sector implement policies and take decisions.

Due to the unique nature of the public sector and its dealings, the governance
principles which apply to this sector are also partly exclusive to it. Public sector
dealings involve, for instance, the importance of political forces, the non-lucrative
features, and the ultimate objective of serving the people and the communities.

Simultaneously, organizations of the public sector hold coercive powers over civilians
and economic enterprises, and accordingly they must provide protections to guarantee
fairness and accountability while using those powers and in delivering the expected
public services. These protections are crucial in political systems in which citizens
bestow their powers upon public sector entities. Generally, any type of public sector
entity may profit from accountability measures which provide assurance that officials

18
use their authority and the resources they manage to achieve the assigned objectives
and goals. Additionally, good public governance demands impartial and fair laws and
regulations. The lack of good governance configurations and the absence of adherence
to fundamental basic governance principles intensify the major risk of public
corruption, which can be defined as the abuse of assigned power and authority for
private gain.

Accordingly, promoting and applying the principles of accountability, transparency,

integrity and equity are crucial in the public sector.

 Accountability: The International Federation of Accountants (IFAC) defines

accountability as ―The process whereby public sector entities and the
individuals within them are responsible for their decisions and actions,
including their stewardship of public funds and all aspects of performance, and
submit themselves to appropriate external scrutiny. It is achieved by all parties
having a clear understanding of those responsibilities, and having clearly
defined roles through a robust structure. In effect, accountability is the
obligation to answer for responsibility conferred.10
 Transparency: The principle of transparency pertains to the frankness and
honesty of a public sector entity to its components. Good governance involves
disclosure of significant information to stakeholders so that they possess the
pertinent details about the public sector organization’s performance and
operations. Correspondingly, public sector organization’s decisions, actions,
and transactions need to be conducted in the open. Laws and regulations often
compel public sector organizations to make important public documents
available upon request, as well as to publish formal meetings notices with
specific agenda items.
 Integrity: Integrity implies that public officials should act in consistence with
ethical principles, as well as the expectations, values, and policies of their
respective public sector organizations. The incredibility and unreliability of
public information and actions may cause an erosion of public trust which
weakens the public sector’s ability to govern and legitimacy, costing very much
politically, socially, economically and even environmentally.
 Equity: Equity relates to the extent of fairness public sector officials use in
exercising the power delegated to them. The public confers money and power
on public sector officials to achieve their responsibilities. The public is
nevertheless concerned with the mishandling of power and resources, and other
subjects including corruption or ineffective management that could harmfully
impact the organization’s diligences towards citizens.

10
IFAC, Governance in the Public Sector: A Governing Body Perspective, 2001

19
So, to sum up, good public sector governance revolves around ensuring that public
sector organizations act with consideration to the public interest at all times. Public
interest includes11:

 Strong commitment to integrity, ethical values, and the rule of law;

 Openness and comprehensive stakeholder engagement;
 Defining outcomes in terms of sustainable economic, social and environmental
benefits;
 Developing the capacity of the entity, including the capability of its leadership
and the individuals within it;
 Managing risks and performance through robust internal control and strong
public financial management;
 Implementing good practices in transparency and reporting to deliver effective
accountability.

2. The evolution of Ethical Governance in Morocco

In recent years, the Kingdom of Morocco has launched a comprehensive reform of the
Moroccan public sector tending to modernize and improve governance in public
organizations. This reform is part of a national and international context marked in
particular by:

 The country’s commitment to a broader process of democratization of society

and to promoting morality and transparency in managing public affairs,
openness of national economy and its integration in the international
environment which requires the improvement of the competitiveness of public
enterprises and the legal and institutional business environment;
 The need for further efforts to boost the economic growth of Morocco to meet
the increasing growing needs of the population in terms of employment and
access to basic social infrastructure;
 The launch of several sectorial reforms requiring significant funding and
concerning in particular the fight against poverty as part of the ―Initiative
Nationale du Dévelopement Humain (French for the National Initiative of
Human Development, shortened as INDH), extension of medical coverage,
education reforms, expanding rural access to basic equipment including water,
electricity and rural roads; etc.

11
IFAC, « Good Governance in the Public Sector: Consultation Draft from an International Framework”; June
2013.

20
The main axes of modernization and improvement of the governance of Moroccan
public institutions can be comprised under the following points:

 Strengthening of administrative deconcentration in order to:

 Provide insightful and close responses to needs expressed by the
population;
 Empower and expand the flexibility of managers at decentralized levels;
 Make the principle of deconcentration a criterion to establish the
organization and responsibilities of central governmental institutions. In
this context, central institutions are responsible for missions of
conception, orientation, organization, planning, coordinating, monitoring
and control. Decentralized institutions are in charge of implementing and
executing governmental policies, at a territorial level (provincial,
prefectural or regional);
 Establish and strengthen the contractualization of relationships between
central institutions and their decentralized branches through
objectives/means contracts to rehabilitate the role of these branches as an
essential actor in local management of public policies, and to decline
concerns of performance, transparency and accountability locally.
 Simplification of administrative procedures through:
 An identification and inventory of administrative procedures in order to
simplify them or even suppress some of them to facilitate overall
administrative steps and implement more transparency in the relationship
between public administrations and citizens;
 Establishment of procedure manuals and brochures providing insightful
information on administrative operations by the various governmental
and other public departments;
 Bringing public administrations near citizens by providing them with the
appropriate administrative information they need.
 Transparency and moralizing public life through:
 Strengthening the development of ethics in the public sector by
elaborating codes of good conduct at all departmental and hierarchical
levels of public organizations, with an emphasis on integrity, good
governance and ethical values;
 The creation of laws mandating public sector officials exercising sensitive
functions to declare their assets;
 Reforming regulations of public procurements in order to establish new
rules and procedures in the sense of transparency, guaranteeing the rights
of competitors and the effectiveness of public expenditures;
 Strengthening the institutional framework for prevention of corruption,
through mobilizing administrations, NGOs and civil society as well as the
application of the UN’s convention relative to the fight against
corruption.
 Strengthening the role of the General Inspectorate of Finance, general
ministerial inspections and financial jurisdictions in financial controls and
audits of management in public sector entities.

21
These are all measures which indicate that Morocco has taken the right path towards
the promotion and implementation of good governance practices in order to accelerate
its social and economic development and to encourage and advocate ethical values,
transparency and accountability vis-à-vis its citizens.

In continuation of this work and to make the link between internal auditing and ethical
governance in the public sector, the following section explains the elements that make
the internal audit a key factor in ensuring ethical governance within public
organizations.

3. Internal Auditing and developing Ethical Governance in the

public sector

Internal auditing is a vehicle for enhancing organizations’ governance, risk

management and management controls. With commitment to values such as integrity
or accountability, internal auditing supplies insight, assessments and recommendations
to governing bodies and senior management, while being trusted as an impartial source
of objective advice.

As we have mentioned before, public sector governance revolves around particular

aspects, which involve: the boards of directors/committees of public sector
organizations, legal and regulatory issues, ethical professional practices, disclosure and
transparency, and risk management.

Internal auditing directly affects all these aspects and deals with their particularities;
they are even the center of its activity. Let us examine how internal auditing
contributes to assessing and improving these governance aspects in order to enhance
their overall performance.

 Boards of directors/committees: Boards establish organizations’ directions,

missions and values. They oversee performance, and see to protect
stakeholder’s interests (mainly the citizens’). Generally, the Boards’
responsibilities have to be formally defined and written in organizational
documents and charters. Roles of Internal Auditing pertaining to the boards of
directors and committees include assisting them with their self-assessment,
reviewing the audit committee’s charter, bringing ideas of best-practice
concerning internal controls, risk management and overall governance;
verifying the accuracy of information used in decisions; etc.

 Legal and regulatory issues: This aspect relates to the legal limits, within
which a public organization operates, as well as its compliance and conformity
requirements, and legal duties and obligations towards citizens. The Internal
Auditing activity intervenes here to verify that the organization has met its legal
diligences and requirements.

22
  Ethical professional practices: Public organizations should maintain a goal of
consistency and accountability in conduct, decision-making processes and
performance. Ethics provide a moral boundary reflected by the citizens’
expectations. Building good public sector governance needs a strong sense of
ethics, which include a fair treatment of employees, maintaining the interests of
stakeholders. Codes of conducts are also encouraged, since they provide clear
guidance to employees on ―right and wrong‖ professional practices which can
ease up implementing or improving good governance. Internal Auditing
reviews the ethics policies and the codes of conduct, to verify that they are
updated adequately, and communicated to employees at all hierarchical levels.
In addition, Internal Auditing helps the audit committee and senior management
in holding employees accountable for their actions.

 Disclosure and transparency: this aspect pertains to the timing and nature of
information that a public organization provides to its stakeholders. The
information published should meet requirements of relevance, clarity and
reliability. In addition, information should be disclosed in a timely manner.
Internal Auditing ensures transparency of shared information, and is bound to
act within timely limits.

 Risk management: Risk management tends not only to mitigate risk, but also to
better comprehend internal controls and provide the foundation of evaluating
governance processes. Internal Auditing facilitates the identification of risk
areas and assists with understanding and assessing the controls which revolve
around them.

The logical connection between internal auditing and ethical governance in the public
sector is thus undeniable. With that said, and in order to better assimilated the
theoretical work that has been presented so far more concretely and practically, the
second part of this report will be devoted to field work. Thus, we will study the links
of internal auditing and ethical governance in an important Moroccan public structure:
The Morocco’s National Tourist Office.

23
 II. The Case of Morocco’s National Tourist Office
(MNTO)
In the second part of this thesis, we will discuss the specific case of one of Morocco’s
strategic public entities: The Morocco National Tourist Office (MNTO), through its
internal audit department and its ethical governance climate. Thus, this part is divided
into three chapters: the first one is an introductory chapter about MNTO and its
activities; the second one is an evaluative chapter about the internal audit activity of
MNTO; and the last one is a conclusive chapter addressing the role of the Department
of Internal Audit in shaping ethical governance in this establishment.

A. Presentation of Morocco’s National Tourist Office (MNTO)

This introductory chapter tackles three major aspects of MNTO’s presentation:
Mission and activities (section 1), historical background and current organization
(section 2), and future perspectives (section 3).

1. Mission and activities of MNTO

Morocco’s National Tourist Office is a Moroccan public entity administered by a
board of directors and managed by a Chief Executive. MNTO’s principal
headquarters are in Rabat, the capital of Morocco. Nevertheless, MNTO has several
representative offices in all parts of the globe. MNTO is under the supervision of the
Moroccan Ministry of Tourism and the Moroccan Ministry of Finance.
MNTO is the organization in charge of elaborating strategies of touristic promotion of
Morocco; it is thus often referred to as an Expert in marketing the ―Morocco‖ brand.
As such, MNTO’s objectives relate to identifying high potential markets and studying
their features and characteristics in order to better identify the profile, attitudes and
purchasing process of potential tourists.
In a context of activating international as well as national markets, MNTO develops
communication and advertising campaigns, press and public relation activities as well
as considerable events in order to promote the country’s brand and to value its image
to a large and divergent public.
MNTO aims to promote the diverse natural and cultural wealth of Morocco, by
establishing and developing marketing strategies for each touristic area. The touristic
promotion relies greatly on the aspect of diversity.

24
As we have mentioned previously, MNTO has offices worldwide as well, for purposes
of conducting marketing actions while being near the considered market segments.
MNTO is present through its delegations in many countries: Germany, United
Kingdom, France, Spain, Italy, Benelux countries, Sweden, Portugal, Switzerland,
Austria, Canada, USA, Poland, China and the United Arab Emirates.
There are several factors to determine MNTO’s choice of positioning in client
markets, such as the potential of travel to foreign countries, the average duration of
stay, the travel frequency, and average consumption per tourist and day. Other aspects
also include the organization and the structure of the market at the level of tour
operators and travel agencies, in addition to the conformity of the market’s demand
with the Moroccan supply of touristic products.
In 2004, those were the criteria which helped in the positioning on three market
categories: strategic markets: including Germany, Spain, France, Portugal, and United
Kingdom; emerging markets: Italy, Scandinavian Countries, Switzerland, Benelux
countries and the Middle-East; and ―tactical‖ markets. Some changes have been made
since 2004 but the market categories remain the same.
The communication approach which MNTO uses is increasingly oriented towards a
proximity communication whose object is enhancing the purchasing act. This
approach focuses on three complementary techniques which are: Institutional
publications, joint marketing and public relations.

 Institutional publications: The advocated approach in the development and

launching of communication campaigns is to launch restricted calls for bids
from communication agencies specialized in each market. Each candidate
agency is called to present a well-detailed project about the product, its
environment and the strategies to adopt. The standards and types of
recommendations included in the tender specifications are established by
MNTO and the National Commission of Advertising.
 Joint-marketing: Touristic competition is fierce between countries. Thereby,
tour operators have greater bargaining power than that of the countries. Tour
operators are usually approached by MNTO for the purposes of programming
the Morocco destination in their tours, conduct joint-marketing campaigns and
supporting in promoting the country. Opportunities for collaboration with Tour
Operators are reviewed by local actions (delegates of the office abroad) after
canvassing professionals. Subsequently, proposals are communicated to
MNTO’s senior management for approval and signing contracts. Following the
signature of the contracts are proceedings to the budget commitment and the
execution of the campaign.
 Public relations: Their main objective is to increase the awareness and
involvement of the international media, Tours Operators and travel agencies
and opinion leaders. These different actors in global tourism are invited to
Morocco in the framework of familiarization trips. Once on site, they appreciate
the quality, richness and diversity of the product ―Morocco‖ and consequently,

25
 they take actions to help promote the touristic appeal of the destination through
reportages, articles, interpersonal advertising, etc
In addition; exhibitions, fairs and events exclusively or partially reserved for tourism,
are becoming an important way to promote a destination. These events provide a dual
aim of contact both with professionals and consumers. They make it possible to bring
together in a single space the actors of supply and demand.

To address the noted information gap, MNTO has set up a structure to provide
information intended for professional or general public use. Brochures published by
MNTO have especially an advertorial and promotional aspect. The achievements in
this direction are different documents such as hotel guides, brochures, tourist posters,
and thematic brochures. The Office also publishes information in multimedia supports.

2. Historical background and current organization

MNTO’s historical background can be traced as far back as to when Morocco was
under the French Protectorate. Though the Office didn’t exercise the same tasks as it
does today, and didn’t have the same appellation, it was created for nearly the same
principal mission: Promoting the touristic qualifications of Morocco and making
tourism a prominent sector in the Moroccan economy.
The reasons that justified the creation of a specialized organization such as MNTO are
the flexibility of action, the task specialization and a simpler control financially
speaking.
MNTO was not responsible for the promotion of the Moroccan tourist product until
the early seventies. The real start of this organization's communication strategy
occurred in 1982.
MNTO’s promotional action can be traced back to three phases:

 The phase from 1965 to 1972 was primarily marked by the introduction of
equipment, infrastructure and tourist facilities. The marketing of Moroccan
tourism products was therefore made by foreign travelers. This period is
characterized by the almost total absence of communication policy for the
destination.
 The need for information and promotion was more felt during the period
between 1972 and 1982, after the establishment and development of various
priority development areas and tourist development units.
 Starting 1982, MNTO launched the first large-scale communication campaigns
targeting the major markets generating and attracting tourists to Morocco.
As we have mentioned previously, Morocco’s national tourist office is administered by
a board of directors along with the management of a chief executive. Nevertheless, we
should probably mention that the office suffered from a major lack of organizational
stability since its creation, sometimes marked by the total absence of the Chief
Executive. Thus, in 2007, a new organizational structure was established within

26
MNTO, with the creation of four directorates: Administration and Finance, Marketing,
Communication, and Directorate of Markets. A department of Auditing and
Management Control was also created.
The Directorate of Marketing has overall responsibility for defining, coordinating and
implementing the MNTO Marketing strategy as well as ensuring its implementation.

The Directorate of Administration and Finance has overall responsibility for defining
accounting, financial and budgetary policies accordingly with the financial balances
and the overall strategy of MNTO.

The Directorate of Communication aims to define, coordinate and implement the

MNTO communication strategy across different available formats and channels.

The Directorate of Markets has overall responsibility for coordinating and integrating
the operational marketing activities of MNTO, and managing relationships with
distribution networks, including Tours operators and agencies.

Finally, the Department of Audit and Management Control consists of two divisions:
the Audit division whose mission is the auditing of management, according to a
schedule drawn up at the beginning of each year; and the Management Control
Division whose mission is the monitoring of the projects launched and ensuring
respect of the deadlines and the budgets for each project.

3. Future perspectives of MNTO

With the completion of the ―Vision 2010‖ and the development of vision 2020, all
Moroccan tourism indicators are positive despite the crisis context. A new impetus
was given to the tourism sector with capitalization on the achievements of the 2010
vision and working for the development of sustainable and eco-friendly tourism.

The Vision 2020 is based on the following commitment: "Continue to make tourism
one of the engines of economic, social and cultural development of Morocco". The
deep and rapid transformation of the country since the launch of the 2010 vision, as
well as the opportunities offered by new global tourism trends, allow to feed great
ambitions for the next decade , based on fundamental values as well as differentiation
points such as:

 Authenticity: In the last decade, Moroccan tourism has consolidated the

development and positioning of its mark on authenticity. This position is
different from that of its direct competitors, engaged mostly in mass tourism,
which is now a real competitive advantage. The Vision 2020 cultivates this
historic choice through a proactive approach to preservation, conservation and
enhancement of cultural and natural heritage of the Kingdom.

27
  Diversity: In terms of tourism, the most important comparative advantage of
Morocco is its diversity: diversity of territories and landscapes, diversity of
natural resources and ecosystems, diversity of cultures and influences (African
and European). The Vision 2020 promotes diversity through an ambitious
territorial planning policy.

 Quality: The development of new capacities remains a strategic objective, and

Vision 2020 aims to significantly improve the competitiveness of all the links in
the tourism chain, and in particular, to deepen the culture of service and
develop a convincing offer of animations.

 Sustainability: Finally, in accordance with the general guidelines adopted for

the whole country, the Vision 2020 puts sustainable development at the heart of
its ambitions. Morocco, whose resources have historically been preserved, has a
real and considerable potential for differentiation in a highly competitive
environment.

In addition to a strong commitment that is part of the general reforms initiated by the
country, Vision 2020 revolves around solid ambition: "in 2020, Morocco will be
among the top 20 world destinations and will emerge as a reference in the
Mediterranean on sustainable development" and the corresponding goal of "Doubling
the size of the sector.", with measures such as:

 Doubling the accommodation capacity with the construction of 200 000 new
beds, 150 000 of which are hotels and 50,000 in assimilated tourist
establishments to offer visitors a rich and dense tourist experience.
 Consequently doubling tourist arrivals, doubling market share in key traditional
European markets and attracting 1 million tourists from emerging markets.
 Also tripling the number of domestic trips, with the goal of democratizing
tourism in the country.
 Creating 470,000 new direct jobs across the country, to employ at the end of the
decade nearly a million Moroccan.
 Increasing tourism revenues to 140 billion Dirhams in 2020, a cumulative sum
of the decade close to 1,000 billion Dirhams.
 Increase of two points the tourism GDP in the overall national GDP to reach
almost 150 billion Dirhams.

Therefore MNTO continues the development of its priority markets by implementing

strategies of targeting conquests. This dynamic is based on the understanding and
integration of the new tourism consumer trends and media consumption, with
particular interest for new technologies and more specifically social networking.

That said, it is clear that MNTO is a public institution that has a prominent role in the
development of the national economy given the sensitivity of the sector in which it
operates, but also given its annual budget and its leading role in the collection of tax
resources (touristic promotion tax and air tax).

28
 B. An overview of internal auditing in MNTO
The internal auditing function holds a prominent position in MNTO. It is due to the
fact that there must be a set of controls which provide managers with assurance
regarding the achievements of the organization’s objectives. And it is justly the role of
audit, through audit engagements, to assess these control measures and to ameliorate
them.
This chapter discusses and describes in detail the organization and activities of the
Internal Auditing department of MNTO, in section 1 and 2. The third section presents
the findings of the Internal Audit Capability Model’s (Presented in the first chapter)
survey and positioning on the matrix.

1. Organization of the IA department at MNTO

As we have stated before, the body responsible for internal auditing in MNTO is the
Audit Division, which is under the hierarchical responsibility of the Department of
Audit and Management Control. This department reports directly to the general
management. Such an organizational positioning enables this department to conduct
field investigations and be entitled a freedom of opinion and an adequate consideration
for its recommendations; while guaranteeing the independence and objectivity of the
internal audit activity.

The overall mission of the Audit and Management Control Department is to: ―conduct
the internal audit work in compliance with the regulations, procedures, management
and ethics of the function." Other specified missions and responsibilities of the
department are grouped in this table:

29
Impact Expected permanent results Main related activities
Achieve Monitoring the execution of -Perform control testing
the office procedures - Identify gaps
- Ensure the development and monitoring
of the action plan
- Propose areas of improvement
Achieve Audit engagements -Ensure planning
accordingly with the audit -Ensure communication
plan -Implement the plan and monitor all
expenditures
Contribute To the realization of the -Recount the highlights
annual report -Propose areas of improvement
Achieve The coordination with senior -Project intelligence
management -Organizational intelligence
-Operational intelligence
Guarantee Establishing and updating -Ensure the implementation and the
non existing procedures updates of procedures
- Ensure the assessment of procedures
and their contribution to internal controls
- Elaborate the action plans

We must point out that MNTO’s internal auditing department has no charter
describing the internal auditing activity, commonly known as the ―internal audit
charter‖. We believe that the existence of such document within the IA department is
highly important, as it provides insight into crucial elements of the internal audit
activity, such as the IA department’s acknowledgments of its mission, role,
accountability, professional standards, scope of work, responsibility, assessment and
quality assurance… and many other essential key elements, to be established by the
head of the IA department and to be shared within the organization.

Instead of an IA activity charter, MNTO’s IA department relies on the Audit

Committee charter, which pertains more to the work and mission of the Audit
Committee. The Audit Committee charter includes the following:
 The AC’s composition and members;
 Powers of the audit committee;
 The AC’s missions and assignments;
 The AC meetings’ characteristics;
 The functioning of the Audit Committee;
 Reporting characteristics;
 Diligences and professional conduct.

30
 2. Internal audit engagements and obstacles
This section addresses the phases of internal audit engagements as exercised by
MNTO, as well as some apparent obstacles which obstruct a full efficiency of the
internal audit activity within this public institution.

First of all, we should mention that MNTO uses a formalized internal control system,
as well as a risk assessment map which was developed by an independent audit firm.
Unfortunately, we could not get access to these documents due to the confidential
nature of the information they contain. The audit service which assesses the internal
control system via engagements uses more than theoretically the risk assessment map,
in order to adapt measures of internal control.

Internal auditing engagements within the MNTO like any audit engagement consist of
three main phases:

 The planning phase: After receiving the engagement order, the internal
auditing service proceeds to enunciating and planning the audit activity. This
requires:
 Taking knowledge of the audit subject and awareness of its usual risks
through an analysis of risks and best practices, this concludes in the
selection of auditable items and then discussions with the auditee. All these
studies are endorsed by the risk assessment map;
 Identification of specific risks of the entity being audited, through a
discernment of risks in the field, to select the verifications to conduct. This
leads to the exposed strengths and weaknesses of the entity;
 This phase ends with the selection of audit objectives.

 The diagnostic phase or verification phase: This second phase revolves around
more fieldwork and consists of:
 The determination of verifications to be performed through a verification
program with the use of different documents aiming at the unraveling and
the analysis of findings;
 Estimating expenditures through a schedule budget, affecting auditors to
determined tasks according to the developed planning.

 The concluding phase or recommendations phase: This phase is an alternation

of actions and interactions between the internal audit team and the auditees.
Concretely, it is about:
 Structuring the conclusions and the audit engagement report;
 Reorganizing the paper work and the verification documents in a draft
report and validating it along with the auditees;
 Possible changes and diffusion of the final report;
 Obtaining the action plans that the auditees elaborated in response to the
recommendations and evaluation.

31
The recommendations emitted by the Audit Department of the MNTO, through its
various internal audit engagements, are usually followed and monitored by the same
Department as well as the Audit Committee, in order to verify their timely
implementation.

As its definition clearly stipulates, internal auditing must bring value within the
organizations and enhance the efficiency of its processes. The least we can say about
internal audits conducted within the MNTO is that they have been largely beneficial,
as these missions lead to operational recommendations whose monitoring is ensured
by the Internal Auditing Service and the Audit Committee as we pointed out above.

However, we believe that one of the many obstacles which the IA department is facing
is that auditees still perceive auditors as inspectors. This misperception stems from
incomprehension of the internal auditor’s role and the fact that he is expected to help
the auditee in master his operations, thus achieving his operational objectives.
In addition, we must underline the fact that generally, there is very little effort to
promote the ―Audit culture‖ in the organization.

For the purposes of a clearer and more concise assessment of the internal audit activity
of MNTO, we have thought it would be more appropriate to use the Internal Audit
Capability Model, previously explained in the first part. The next section addresses the
work which was done in this direction as well as the considerable findings.

3. Conducting an IA-CM study at MNTO

In order to conduct the IACM study, we need to determine the Key Process Areas of
each capability level per internal audit element, as we have mentioned before. The
determination of these KPAs was done using a survey published by The Institute of
Internal Auditors in 2010 to assess the global performance of the internal audit
activity, both in public and private sector (The IIA’s Global Internal Audit Survey,
2010). Questions whose answers provided indicators on the KPAs relevant to each
capability level of each internal audit capability were used again in another survey, this
time regarding the very same Internal Audit Capability Model (MACRAE E. & VAN
GILS D. ―Internal Audit Capabilities and Performance Levels in the Public Sector‖,
The IIA, 2014).
We gathered the questions addressing KPAs of the IA-CM in a questionnaire
(Appendix 1) that we administered to the CAE (Chief Audit Executive) of Morocco’s
National Tourist Office. The results were as following:

32
Element #1: Services and Role of Internal Auditing

The Role and Services of Internal Auditing in MNTO stand at a level 4 capability,
which means they are managed. Indeed, mastering all the KPAs at level 2, level 3 (see
relevant questions), as well as the KPAs at level 4 draws the following conclusion:
―Internal audit services performed at Level 4 focus on overall assurance on
governance, risk management, and control. The main purpose is to conduct sufficient
work to provide an opinion on the overall adequacy and effectiveness of the
organization’s governance, risk management, and control processes. The internal audit
activity has coordinated its audit services to be sufficiently comprehensive that it can
provide reasonable assurance at a corporate level that these processes are adequate and
functioning as intended to meet the organization’s objectives.‖12

Element #1: People Management

12
MACRAE E. & VAN GILS D. “Internal Audit Capabilities and Performance Levels in the Public Sector”, The IIA,
2014

33
The initial level (level 1) indicates that there are no sustainable or repeatable
capabilities, and reveals dependency on individual efforts only. Unfortunately,
MNTO’s internal audit activity didn’t get pass through the first level in terms of
people management. Indeed, the study revealed several weaknesses which should be
tackled as soon as possible.

Element #3: Professional practices

Element #4: Performance Management and Accountability

34
At level 3 of Performance Management and Accountability, internal audit activities
develop financial metrics and other meaningful indicators primarily based on input and
process measures with some output measures. In this way, the internal audit activity
measures and reports on its performance and routinely monitors its progress against
targets to ensure that results are achieved as economically and efficiently as possible.
To achieve Level 4, internal auditors should at least use customer/auditee surveys from
audited departments and surveys/feedback from the board, audit committee, and/or
senior management. 13 MNTO’s internal auditors use only the first tool, which does not
make them qualified for mastering level 4.

Element #5: Organizational relationships and culture

13
MACRAE E. & VAN GILS D. “Internal Audit Capabilities and Performance Levels in the Public Sector”, The IIA,
2014

35
Element #6: Governance Structures

The internal audit activity of MNTO didn’t level up using the criterion of governance
structures’ efficiency neither. This is mainly due to the absence of an internal audit
charter, as well as the exclusion of the audit team from the formal reporting of results.

It is therefore clear that the internal audit activity of MNTO undergoes enormous gaps
which unravel the negative impacts on its governance system and compliance with
ethical standards. In order to study the ethical component in isolation, we have decided
to conduct another study which we will address in the following chapter.

36
 C. Ethical Governance and the contribution of Internal
Auditing at MNTO

In the final chapter of this work, we have decided to conduct another study on the
organizational and ethical climate of Morocco’s National Tourist Office, whose results
are going to build a conclusion on the extent to which internal auditing has been
contributing in promoting ethical values within MNTO.

1. Organizational and ethical climate in MNTO

In order to get a hold of the organizational and ethical climate in MNTO, we have
conducted a study under the form of interviews, talks and focus groups with different
employees. The results revealed that the majority of employees are not generically
satisfied with their workplace’s ethical atmosphere. Most of them responded that there
were no communicated entity policies regarding matters as acceptable business
practices, conflicts of interest or codes of conduct.

Moreover, senior management did not seem to offer clear moral guidance on the ―right
and wrong‖ working practices. Some went as far as declaring, in privacy, that daily
working relationships with stakeholders are not necessarily based on foundations of
integrity and ethical values. In the event of a deviation of the approved policies and
procedures already in place, no corrective measures are taken to address it.

Regarding the role of the Audit Department, the participants unanimously affirmed
that the controls established by this department are neither documented nor
appropriately explained to the employees.

In addition to that, with the considerable experience they have, many said they were
aware of behaviors of their colleagues which were contrary to ethical standards. That
said, some have taken the trouble to inform their superiors of these offenses, but in
vain, as superiors are rarely reactive.

Furthermore, MNTO employees are generally dissatisfied with their superiors,

especially those in the top management. Many have already admitted that their
superiors do not represent a good example of ethical behavior; they do not
communicate to their subordinates about the importance of integrity and ethics in the
work they do, and they do not encourage them to display an ethical conduct.
Moreover, it seems that the primary concern is to achieve goals, to the detriment of
any ethical questioning. Superiors are also said to rarely evoke the terms of
governance and ethics in meetings.

The results of this study show that the ethical climate of MNTO is not healthy, and this
affects not only the reputation and expertise of the Office, but also the performance of
employees who are not very comfortable or productive in such a climate.

37
 2. Internal Auditing and shaping a better ethical governance at
MNTO

Facing such an ethical climate, and speaking from a perspective of participation of the
internal audit activity in a better implementation of ethical governance in the public
sector , it is recommended to create codes of conduct , codes of governance and an
internal audit charter within MNTO and to deliver it to the entire staff.

It is also recommended to the internal audit activity of MNTO to encourage a

separation of the powers that it surrounds, to ensure a better understanding of its role
and contribution in the improvement of processes, the establishment of effective and
efficient measures to achieve agreed targets, but also to raise the rank of the public
sector to more transparent and fair.

More recently, a report14 from the Moroccan Court of Audit, pertaining to the
management of MNTO was issued. The report has also identified several shortcomings
in the Office, particularly regarding the role of internal control in governance. For
example, the Court of Auditors notes that there's inaccuracies concerning the choice of
market positioning, and displays the lack of a process that can help identify achievable
goals, allocate budgetary and human resources and to define the specific tasks of each
actor. The measures necessary for the implementation of the objectives are taken
without using a steering system.

There's also the problem of lack of indicators that would integrate financial and non-
financial measures, which is rather quite risky because without those measures, the
strategic objectives and performance measures associated with them are out of sight.

The Court of Audit also notes the worsening situation due to the lack of a coherent
information system that could generate progress reports on the actions of
implementation.

Those findings indicate large gaps on the role of internal auditing in achieving its
objectives, and therefore not ensuring the implementation of an ethical governance of
the public sector, which serves the interests of citizens and the countries.

14
Moroccan Court of Audit, Auditining the Management of the Moroccan National Tourist Office, February
2014.

38
 Conclusion
To conclude this work, we must recall, through the evidence we have shown, the
essential role of internal auditing in promoting governance and ethical values in public
institutions. However, even if the internal audit activity takes increasingly a strategic
dimension which involves (in addition to governance) risk management, assessment of
internal control and other aspects; it is still perceived by many, mainly in the public
sector, as a simple function that is limited to exercising simple conformity tests. Even
worse, some still confuse auditing with inspection, placing auditing in a controlling
dimension only.

We have attempted through this work, and especially through the concrete case we
have worked on to prove that internal auditing can and must fully contribute to the
realization of ethical governance in the public sector. Actions should be taken in this
direction in order to promote the ―Audit culture‖ in public organizations at all levels,
for the ultimate purpose of ensuring a genuine ethical governance.

39
 Bibliography
 MACRAE E; VANGILS D ―Nine Elements Required for Internal Audit
Effectiveness in the Public Sector‖, The IIA Research Foundation, 2014

 International Federation of Accountants; ―Good governance in the Public

Sector – Consultation Draft for an International Framework‖; June 2013.

 The IIA Research Foundation ―Internal Audit Capability Model for the Public
Sector‖, 2009.

 The IIA, ―The Role of Auditing in Public Sector Governance‖, January 2012

 Tazi S. « Améliorer la gouvernance de la gestion publique », lettre

d’information trimestrielle de la Banque Mondiale, 2007

 Tembley Modibo ; Hachim Haroune Adam; « La pratique d’audit au sein des

établissements et entreprises publics au Maroc : Concepts et réalités ; Cas de la
CDG »

 Cour des comptes ; « Auditing the Moroccan National Tourist Office » ;

February 2014.

 www.wikipedia.com ; wikis for ―Internal Auditing‖; ―Governance‖ and

―Ethics‖.

 www.tourisme.gov.ma; website of the Moroccan Ministry of Tourism,

consulted on 20/05/2015.

40
Appendix 1: The Global Internal Audit Survey Questions chosen as indicators for
KPAs

1. Are you a member of the Internal Institute of Auditors (IIA)?

o Yes
o No
2. Are you a Certified Internal Auditor by the IIA?
o Yes
o No
3. How many hours of formal training do you receive per year?
……………………..
4. Does your organization have an Audit Committee?
o Yes
o No
5. Do you prepare a written report on overall internal control for use by the audit
committee or senior management? How often do you provide a report?
o Yes; frequency: ……………………………
o No
6. Are you invited to participate in Audit committee meetings?
o Yes
o No
7. Are you invited to informal meetings with the Audit committee?
o Yes
o No
8. Who is involved in appointing the chief audit executive (CAE) or equivalent?

o CEO/president/head of government agency

o Audit committee/committee chairman
o Board/supervisory committee
o Chairman of the board/supervisory committee
o Chief financial officer (CFO)/vice president of finance
o Chief operating officer (COO)
o Other

9. Where do you administratively report (direct line) in your organization?

o Chief executive officer (CEO)/president/head of government agency
o Audit committee or equivalent
o Chief financial officer (CFO)/vice president of finance
o General/legal counsel
o Chief operating officer (COO)
o Chief risk officer (CRO) or equivalent
o Controller/financial director
o Other

41
 o Not applicable

10. Who contributes to the evaluation of your performance?

o CEO/president/head of government agency

o Audit committee/committee chairman
o Senior management
o Auditee/customer
o Self
o Board/supervisory committee
o Supervisor
o Peers
o Chairman of the board/supervisory committee
o Subordinates
o Not evaluated

11. Which of the following exist in your organization ?

o Corporate Governance code

o Internal Audit Charter
o Risk assessment map
o Documented Audit Strategy
o Internal Audit Mission Statement
o Audit Committee charter
o Internal Audit operations manual/policy statement

12. How does your organization measure the performance of the internal audit
activity?

o Percentage of audit plan complete

o Recommendations accepted/implemented
o Customer/auditee surveys from audited departments
o Surveys/feedback from the board, audit committee, and/or senior management
o Assurance of sound risk management/internal control
o Reliance by external auditors on the internal audit activity
o Timely closure of audit issues
o Number of significant audit findings
o Number of management requests for internal audit assurance or consulting
projects
o Completion of mandated coverage
o Budget to actual audit hours
o Cost savings/avoidance and improvements from recommendations implemented
o Cycle time from entrance conference to draft report
o Cycle time – report turnaround (end of fieldwork to final report)
o Balanced scorecard

42
 o Absence of regulatory or reputation issues and significant failures
o No formal performance measurement of the internal audit activity

13. How frequently do you update your audit plan?

…………………………………………

14. Please check all that applies while establishing your audit plan:

o Use of a risk-based methodology

o Requests from management
o Consult previous year’s audit plan
o Consultation with divisional or business head
o Compliance/regulatory requirements
o Audit committee requests
o Requests from or consultation with external auditors
o Other

15. Please indicate your agreement with the following statements as they relate to your
current organization or organizations that you audit:

o The internal audit activity proactively examines important financial matters,

risks, and internal controls
o Internal Audit plays an integral part of the governance process by providing
reliable information to management
o Sufficient status in the organization to be effective
o Has value-added access to the Audit Committee

16. Is your organization offering any special incentives to hire/retain internal audit
professionals?

o Tuition reimbursement
o Transportation allowance
o Relocation expenses
o Vehicle provided
o Signing bonus
o Accelerated raises
o Referral finder fee—payment to an employee who introduces a person
subsequently hired
o Other
o
17. What methods is your organization employing to compensate for missing skill
sets?
o Co-sourcing/Outsourcing
o Reducing areas of coverage

43
 o Borrowing staff from other departments
o More reliance on audit software
o No missing skill sets
o Other
18. Does your organization use the Standards (International Standards for the
Professional Practice of Internal Auditing promulgated by The IIA)?

o Yes—all of the Standards

o Partial Yes—some of the Standards
o I do not know.
o No/not applicable

19. Does your internal audit activity have a quality assessment and improvement
program in place in accordance with Standard 1300?

o Yes, currently in place

o To be put in place within the next 12 months
o No plans to put in place in the next 12 months
o The quality assurance program is not in accordance with Standard 1300.
o I do not know/not applicable.

20. When was your internal audit activity last subject to a formal external quality
assessment in accordance with Standard 1312?
…………………………………………………………

21. For your internal audit activity, which of the following is part of your internal audit
quality assessment and improvement program?

o Reported issues are adequately supported in working papers

o Checklists/manuals to provide assurance that proper audit processes
o are followed
o Verification that the internal audit activity complies with the Standards
o Reported issues are followed-up to closure
o Engagement supervision
o Feedback from audit customers at the end of an audit
o Verification that internal audit professionals comply with The IIA’s
o Code of Ethics
o Verification of compliance with other standards or codes
o Reviews by other members of the internal audit activity
o Review by external party
o Other
o Not applicable

44
22. Please indicate whether your internal audit activity performs (or is anticipated to
perform) the following:

- Compliance Audit engagements such as :

o Audits of compliance with regulatory code (including privacy) requirements

o Investigations of fraud and irregularities
o Security assessments and investigations
o Disaster recovery testing and support
o Auditing of outsourced operations
o Quality/ISO audits
o Social and sustainability (corporate social responsibility, environmental) audits
o Migration to International Financial Reporting Standards (IFRS)

-Performance/Value for money Audits such as:

o Operational audits
o Evaluating effectiveness of control systems (using COSO, COBIT, etc.
frameworks)
o Auditing of financial risks
o Auditing of IT/ICT risks
o Auditing of information risks
o Project management assurance/audits of major projects
o Management audits
o Business viability (going-concern) assessments

-Audit engagements of overall assurance on governance, risk management, and control

such as:

o Audits of enterprise risk management processes

o Corporate governance reviews
o Ethics audits

-Advisory services such as:

o Facilitating risk/control/compliance training and education for organization

personnel
o Control self-assessment
o Reviews addressing linkage of strategy and company performance (e.g.,
balanced scorecard)
o Due diligence reviews for corporate acquisitions/mergers
o Executive compensation assessments

45
23. Do you provide assistance to external audit?

o Yes
o No

24. Do you usually provide a form of opinion of the audit subject area in individual
internal audit reports?

o Yes
o No

26. Please mark the most important of the following behavioral skills for each
professional staff level to perform their work.

o Confidentiality
o Objectivity
o Communication—sending clear messages, listening
o Judgment
o Work independently
o Team player—collaboration/cooperation
o Work well with all levels of management
o Governance and ethics sensitivity
o Influence—ability to persuade
o Relationship building—building bonds
o Facilitation
o Change catalyst
o Team building/creating group synergy
o Leadership
o Staff management

Please mark the most important of several suggested competencies needed for CAEs to
perform their work

o Ability to promote the value of the internal audit activity within the
organization
o Communication skills (including oral, written, report writing, and presentation
skills)
o Keeping up-to-date with industry and regulatory changes and professional
standards
o Conflict resolution/negotiation skills
o Problem identification and solution skills (including critical, conceptual, and
analytical thinking skills)
o Organizational skills (including project and time management)
o Staff training and development
o Change management skills
o Competency with accounting frameworks, tools, and techniques
46
 o Competency with IT/ICT frameworks, tools, and techniques
o Cultural fluency and foreign language skills

28. Please indicate if the following statements apply to your organization or not:

o Educating Organization Personnel about Internal Controls, Corporate

Governance, and Compliance Issues
o Advisory Role in Strategy Development
o Training for Audit Committee Members

47
Abstract:
The object of this professional thesis is to determine, through meticulous research and
rigorous fieldwork, the role of internal auditing in shaping ethical governance in the
public sector, worldwide and in Morocco. Enriched with a practical case relevant to
the Moroccan National Tourist Office, it addresses the prominent role of internal
auditing in public institutions, which aims at respecting and promoting the principles
of transparency, accountability, and responsibility. It also focuses on the contribution
of internal auditing as a new function to the public sector.

Key words:
Internal Auditing – Ethics – Governance – Public Sector

Résumé:
L'objet de cette thèse professionnelle est de déterminer, grâce à un travail de recherche
méticuleux et un travail de terrain rigoureux, le rôle de l'audit interne dans la
concrétisation de la gouvernance éthique dans le secteur publique. Enrichie d'un cas
pratique (Office National Marocain de Tourisme), elle traite du rôle prépondérant que
joue l'audit interne dans les établissements publics, dans le respect et la promotion des
principes de transparence, de reddition des comptes, et de responsabilité. Elle se
focalise également sur les apports de l'audit interne en tant que nouvelle fonction au
secteur public.

Mots-clés :
Audit Interne – Ethique – Gouvernance – Secteur Publique

48