In terms of our internal audit shop, they did four things. One was the readiness assessment, which I mentioned earlier, which basically was, “Are you ready with your programs?”
The second thing they did is something called process mapping. It sounds technical, but basically it asks, from the application to the money going out, what process is followed and where the gates of control are. So when you chart it out, you look at the chart and you know that you have no controls at that particular moment, so therefore you have to fix that. This helps you. But it also helps you to remove the duplicative actions. Because sometimes when we're trying to be really, really careful with money, we put too many levels of control in, and then the system blocks. So it has helped our efficiency, but also the process.
The other thing they have done is something called continuous auditing. Basically, they're looking at the programs on a continuous basis, which is a best practice, because with an audit that comes after the fact, the program is gone, and what are you going to fix? Yes, it's a good lesson for the future, but in this case, we had the auditors watching the program design and delivery as it was happening.
In some ways, it's the same thing with the Auditor General. The moment they were there, it actually focused our minds further on the controls.