Strengthening Internal Control and Risk Management in Finland

Executive summary

This report provides a comprehensive overview of the internal control and risk management system in Finland’s central government. It combines the findings of a diagnostic assessment and a set of strategic recommendations to support the Ministry of Finance of Finland in designing and implementing a robust, future-oriented internal control and risk management strategy.

Context and diagnostic findings

Finland has long demonstrated a commitment to transparency, public trust, and integrity in governance. The Ministry of Finance plays a central co-ordinating role, and government-level efforts have established an internal control and risk management framework, along with corresponding guidance, across central government agencies. These form a strong basis for reform. However, the diagnostic assessment, conducted through stakeholder interviews, surveys, desk analysis, and review of OECD Public Integrity Indicators, reveals implementation gaps that limit the overall effectiveness of internal control systems.

Key findings include:

• A fragmented internal control framework and a lack of clarity on roles, responsibilities, and objectives across ministries.

• Inconsistent managerial accountability and awareness of internal control, undermining effective implementation.

• Lack of a comprehensive central harmonisation function, limiting co-ordinated government-wide improvements and oversight.

• Weaknesses in internal audit capacity, including inconsistent internal audit independence and the absence of quality assurance practices or professional development schemes.

• Absence of comprehensive reporting and monitoring mechanisms, resulting in limited visibility of risks and performance across the system.

Despite meeting 60% of the regulatory benchmarks, Finland fulfils only 5% of the practical implementation criteria for internal control and audit, based on OECD Public Integrity Indicators (OECD averages are 67% and 33% respectively). This points to a significant gap between design and execution (based on data extracted from the OECD Public Integrity Indicators Database in 2023 and analysed in 2024).

Strategic response and recommendations

To address these challenges, the report outlines recommendations to support the development of a comprehensive strategy and action plan to elevate internal control and risk management as a core element of public governance. The proposed approach is evidence-based, participatory, and aligned with international standards such as the OECD Recommendation on Public Integrity.

The recommendations highlight a selection of key objectives to guide the development of a national strategy and action plan:

• Strengthen the legal and policy framework: Harmonise internal control regulations to define scope, responsibilities, and standards consistently across central government.

• Enable a central harmonisation function: Strengthen the co-ordinating role to oversee internal control activities, provide guidance, monitor performance, and ensure quality.

• Enhance managerial accountability: Develop clear accountability mechanisms, supported by improved legal provisions and strategic communication.

• Reinforce internal audit independence and capacity: Separate audit from management roles, ensure minimum staffing requirements, and implement systematic quality assurance processes.

• Introduce structured professional development: Support the development of a training and certification scheme for internal control and audit professionals.

• Develop a comprehensive reporting and evaluation framework: Enable data-driven insights, continuous learning, and transparency through consistent reporting obligations and feedback loops.

• Advance systemic assurance practices: Strengthen the quality and consistency of internal control implementation through clear expectations, structured feedback, and coordinated improvement efforts.

Each recommendation is accompanied by indicative implementation actions, timelines, and responsible actors to support planning and follow-up. The action plan outlines short-, medium-, and long-term goals to guide structured implementation and strengthen institutional resilience.

Anticipated impact

The approach proposed in this report is designed to transform internal control in Finland from a fragmented and technical function into a strategic, government-wide enabler of public sector performance and integrity. Successful implementation of these recommendations is expected to:

• Elevate the visibility and value of internal control within central government decision making.

• Enhance the effectiveness, independence, and capacity of internal audit functions.

• Improve the quality, coherence, and comparability of internal control practices.

• Support evidence-based public governance and policy implementation.

• Increase public trust by reinforcing accountability, transparency, and institutional resilience.

The recommended action plan calls for leadership by the Ministry of Finance, while recognising the essential role of each ministry and agency in implementation. By anchoring reform in stakeholder engagement and international good practice, Finland can ensure that its internal control framework evolves to meet the complex demands of modern public governance.