Mr. Seamus McCarthy:

I will respond to the Deputy. There is no individual percentage of total spend that would be appropriate to dedicate to internal audit or oversight. That is why when I made my opening remarks I presented a sort of overall framework in which audit and investigation is just one part. It is very important to recognise that internal audit is only a part of an overall system of financial control. Looking at the HSE's financial statements, the statement on the system of internal financial control is very extensive and covers very many other risks that exist within the organisation.

There must be controls around the taking on of grant-assisted bodies. There must be awareness throughout the organisation that is dealing with grant-funded entities; information must be shared within the oversight organisation. If anything untoward comes to light, it should be brought together and assessed as a whole. It is certainly important to have an adequate internal audit function but it must be set in a context that there are other controls relied upon.

References were made earlier to reliance on the sets of audited financial statements. If the public sector is not able to rely on the audited financial statements of grant-funded bodies, we will grind to a halt. We must rely on them. Bodies like the HSE and the Arts Council, among other entities, rely on those kinds of financial statements. There is an assumption that there is a regime existing meaning the quality of the audit will be sufficient and it can be relied upon. That does not mean it will not fail from time to time. I am not judging what has happened in this case but it is certainly a key control.

The other question was around the adequacy of carrying out 13 audits from a total of a couple of thousand funded bodies. It is a point we have made on a number of occasions. One certainly needs the capacity to respond and carry out investigations where suspicions are raised.

It is also probably very important that there be a regime of random audits conducted for no particular reason other than that it is time to look at a selection of bodies. It may alert them to weaknesses in their own control systems. Even looking at 13, there will be lessons to be learned. The important thing is to harvest those lessons and feed them back into the rest of the control system. Stating there will be a process of random selection may have a deterrent effect, which is probably one of the most important aspects of that type of internal audit function. A body may be selected for no particular reason, it may not have done anything wrong. Sometimes there is a criticism that resources are put into the wrong area by auditing entities about which there is no suspicion, and that it may be a waste of time when auditing should be trying to detect irregularities, but the random selection and testing of a reasonable number should tell things that perhaps need to be addressed. It also has that deterrent effect that anybody can expect an audit at any particular time.