Reflection to Public Financial Management and Control Law No. 5018

Sevda Kılınç, İlyas Kayra Ak REFORM IN TURKISH PUBLIC ADMINISTRATION

1.INTRODUCTION

Turkey adopted the Public Financial Management and Control Law No. 5018 on 10 December 2003. It was published in the Official Gazette on 24 December 2003 and entered fully into force on 1 January 2006 (Kamu Mali Yönetimi ve Kontrol Kanunu, 2003). The law emerged at a time when the global agenda of New Public Management (NPM) was increasingly shaping public administration reform. It marked a major effort to reorganize Turkish public financial management around “fiscal transparency, accountability, strategic planning, performance-based budgeting, and the effective, economic, and efficient use of public resources” (Hood, 1991; Bozkurt, 2018). Law No. 5018 went beyond revising budgetary procedures. It aimed to replace a largely input-oriented and inspection-centered model, as in ‘müfettişlik’, with a more managerial system built on internal control, internal audit, reporting, and ex-post external audit. A key innovation was the institutionalization of internal audit within public administrations. This change moved the system away from the traditional logic of hierarchical inspection and toward a risk-based, performance-oriented audit function (Bozkurt, 2018).

This article approaches Law No. 5018 as both a legal framework and a reform project. It begins by outlining the law’s aims, institutional scope, and main mechanisms, with particular attention to the separation and coordination of internal control, internal audit, and external audit. It then considers how far these mechanisms have been implemented in practice. The analysis asks whether the shortcomings observed arise from ambiguities within the law, later legal interventions, weak administrative capacity, limited independence, fragmented reporting relations, or insufficient institutional ownership. By focusing on the gap between the reform’s formal design and its practical operation, the article assesses the transformative ambition of Law No. 5018 and identifies the areas where that ambition remains incomplete.

2. THEORITICAL BACKGROUND

The reform of Turkish public financial management under Law No. 5018 needs to be understood within the wider transformation of public administration linked to New Public Management. Hood (1991) describes New Public Management as a loose yet influential group of reform doctrines that gained prominence across many OECD countries. These doctrines emphasized professional management, explicit performance standards, output control, the disaggregation of public organizations, competition, private-sector management techniques, and discipline in resource use. In Türkiye, Law No. 5018 replaced the earlier framework established by Law No. 1050. It introduced a new approach to public financial management based on decentralized financial responsibility, multi-year budgeting, performance-based budgeting, internal control, internal audit, fiscal transparency, and accountability (Kesik, 2005). The law, therefore, went beyond reorganizing budgetary procedures. It sought to shift the administrative logic of public resource use away from formal compliance and ex-ante control and toward managerial responsibility, performance orientation, and ex-post audit.

Fiscal transparency is one of the central principles of this transformation. In a narrow sense, fiscal transparency refers to the open and reliable production of information about public revenues, expenditures, assets, liabilities, and administrative performance. However, transparency should not be treated as identical to accountability. Bovens (2007) argues that transparency is instrumental for accountability because it provides the information necessary for scrutiny, but transparency alone does not constitute accountability because accountability requires a social relationship between an actor and a forum in which the actor is obliged to explain and justify conduct, the forum can question and judge that conduct, and the actor may face consequences. Therefore, fiscal transparency under Law No. 5018 should be understood as a necessary condition for accountability rather than its substitute. Public administrations may publish strategic plans, performance programs, financial reports, and activity reports, but these documents become meaningful for accountability only when they enable legislative, administrative, judicial, or public forums to evaluate public action and attach consequences to failures. This distinction is important because the rise of audit-based accountability has a broader theoretical background. Power (1994) describes the expansion of audit practices as an “audit explosion,” in which financial audit, value-for-money audit, management audit, environmental audit, teaching audit, and many other forms of audit spread across public and private organizations. For Power (1994), audit is not only a technical practice but also an idea that reshapes how modern institutions imagine control, transparency, and accountability. In this framework, audit often functions as the “control of control”, which evaluates whether adequate systems of control exist rather than directly inspecting first-order activities. This point is directly relevant to Law No. 5018 because the law’s internal control and internal audit architecture similarly depend on the assumption that public performance can be improved by making administrative processes auditable, reportable, and assessable.

The public-private distinction is also central for understanding the limits and possibilities of this model. Kesik (2005) draws on the System of National Accounts and the European System of Accounts to distinguish the general government sector from other sectors of the national economy, including non-financial corporations, financial corporations, households, and non-profit institutions serving households. In this classification, government units are defined as public units established through political processes and exercising legislative, executive, or judicial authority over other units within a given territory (Kesik, 2005). This distinction matters because private-sector organizations enjoy a different form of autonomy from public administrations. Private corporations operate within a legal and regulatory framework, but their internal control and audit systems are primarily linked to corporate governance, investor confidence, risk management, financial reporting, and organizational efficiency. Public administrations, by contrast, operate under public law, use public resources, and are accountable not only to internal management but also to parliament, courts, supreme audit institutions, citizens, and other public forums.

Kesik’s distinction between general budget administrations and special budget administrations further clarifies the scope of public autonomy within the Turkish legal framework. General budget administrations are part of the state’s legal personality, do not possess separate assets or own revenues, and are included within the treasury unity principle.

Special budget administrations, by contrast, have separate legal personalities, a certain degree of autonomy, their own assets, own revenue sources, and their own cash management (Kesik, 2005). This shows that even within the public sector, autonomy is not uniform. The autonomy of a public administration is always legally constituted and politically bounded, whereas private-sector autonomy is structured more around ownership, contract, market relations, and sectoral regulation. Power’s (1994) notion of the state as a “regulator of last resort” helps explain this transformation: modern states may withdraw from direct provision or direct hierarchical control, but they often reassert control indirectly through audit, regulation, reporting, standards, and performance measurement. Thus, the comparison between public and private audit should not assume that public institutions can simply imitate private-sector audit. Public audit must also address legality, democratic accountability, public interest, and the political character of resource allocation.

The concepts of internal control and internal audit are at the center of the reform design of Law No. 5018. Kesik (2005) explains that internal control is broader than audit and includes the organizational structures, methods, processes, and internal audit activities established to ensure that public activities are carried out effectively, economically, efficiently, and in accordance with law and policy. Akbulut and Akyol (2023) similarly emphasize that Law No. 5018 introduced modern governance concepts such as strategic planning, performance programs, multi-year budgeting, internal control, and internal audit into the Turkish public financial management system. Internal control is therefore a managerial responsibility. It belongs primarily to the administration itself and aims to provide reasonable assurance that objectives are achieved, resources are protected, records are reliable, and activities comply with legal and administrative requirements. Internal audit, by contrast, is an independent and objective assurance and consulting activity that evaluates risk management, control, and governance processes and reports its findings to senior management (Akbulut & Akyol, 2023; Köseoğlu, 2024).

Strategic planning and performance-based budgeting form the managerial side of this reform. Performance-based budgeting links resources to strategic objectives, measurable targets, performance indicators, and activity reports. Kesik (2005) explains that under this model, public administrations first prepare strategic plans, then prepare performance programs that connect activities to resource needs and performance indicators and finally produce activity reports showing whether objectives have been achieved. This transforms budgeting from an input-oriented allocation process into a cycle of planning, implementation, measurement, reporting, and evaluation. Bozkurt (2018), however, notes an important conceptual problem: Law No. 5018 uses the term strategic planning rather than strategic management, which may limit the institutionalization of a broader strategic management cycle. From this perspective, the mere production of strategic plans is not sufficient. Strategic planning becomes meaningful only when it is connected to implementation, performance measurement, internal control, internal audit, and feedback mechanisms.

The principle of effective, economic, and efficient use of public resources, often summarized as the 3Es, is the normative core of the new public financial management model. Kesik (2005) defines effectiveness as the relationship between intended and actual effects and as the degree to which strategic objectives are achieved. Efficiency refers to the relationship between outputs and the resources used to produce them, aiming to maximize output with minimum input. Economy refers to minimizing the cost of resources while maintaining appropriate quality (Kesik, 2005). These principles also shape performance audit. Performance audit is not limited to whether transactions are formally lawful; it evaluates whether public administrations use public resources in ways that produce meaningful outputs and outcomes. However, Power (1994) warns that value-for-money audit may privilege what is easily measurable, especially economy and efficiency, over more ambiguous questions of effectiveness. This is especially important for public services because effectiveness often involves social outcomes that cannot be reduced to financial indicators alone.

The distinction between legality review and expediency review is therefore crucial. Legality review, or hukukilik denetimi, asks whether an administrative act, expenditure, or decision complies with law, procedure, and legally defined authority. This corresponds to what Bovens (2007) calls legal accountability, where conduct is assessed against detailed legal standards, and to what Kesik (2005) describes as compliance-oriented financial and regularity audit. Expediency review, or yerindelik denetimi, goes further by evaluating whether a decision is appropriate, necessary, proportional, or desirable from a managerial or policy perspective. Turkish public audit law draws a strict boundary between these two forms of review. Under the Sayıştay framework, audit includes the examination of public accounts, financial transactions, activities, internal control systems, and the evaluation of whether resources are used effectively, economically, efficiently, and lawfully; however, the Turkish Court of Accounts (Sayıştay) cannot conduct an expediency review or restrict the discretionary authority of the administration (Sayıştay Kanunu, 2010, Article 35/1-a). This creates tension at the center of performance audit: the audit institution is expected to evaluate effectiveness, economy, and efficiency, but it must avoid substituting its own policy judgment for that of the administration.

The prohibition of expediency review should not be understood as necessarily incompatible with performance-oriented public audit. A useful comparison can be drawn with the United Kingdom’s value-for-money audit model. Under Section 6 of the National Audit Act 1983, the Comptroller and Auditor General may examine the economy, efficiency, and effectiveness with which public bodies use their resources. The National Audit Office (NAO) therefore reports to Parliament on whether public spending delivers value for money, makes recommendations for improvement, and supports parliamentary scrutiny through the Public Accounts Committee. At the same time, the UK model preserves a boundary between audit and politics: the NAO does not question the merits of government policy objectives, but examines whether the chosen policy, once adopted, has been implemented economically, efficiently, and effectively (National Audit Act 1983, s. 6) In this sense, the British model shows that a supreme audit institution can avoid substituting itself for elected government while still conducting substantive performance and value-for-money scrutiny.

The Turkish framework contains a similar formal distinction, but its practical trajectory has been more restrictive. Article 35 of Law No. 6085 defines Sayıştay audit as including the examination of public administrations’ accounts, financial transactions, activities, and internal control systems, together with the evaluation of whether public resources are used effectively, economically, efficiently, and lawfully. However, the same provision also states that Sayıştay cannot conduct an expediency review or restrict the discretionary authority of the administration. Then, Article 36 defines performance audit in relation to the objectives and indicators determined by the public administrations themselves (Court of Accounts Law No. 6085, 2010, Arts. 35-36). The problem, therefore, is not the existence of a boundary between performance audit and expediency review as such. The UK case suggests that such a boundary is both possible and necessary. The problem in Turkey is that this boundary has often been interpreted in a way that narrows the performance audit itself. The 2012 amendment introduced by Law No. 6353 attempted to further restrict Sayıştay’s reporting capacity by preventing audit reports from containing assessments that could be read as administrative or policy-based recommendations on grounds such as effectiveness, economy, and efficiency. Although the Constitutional Court later annulled the most restrictive part of this intervention, the post-annulment practice did not fully develop into a broad value-for-money audit model comparable to the UK. Instead, Sayıştay’s performance audit practice remained largely confined to the audit of performance information produced by administrations, rather than a substantive evaluation of whether public services actually achieved economy, efficiency, and effectiveness. Thus, while the UK model uses the prohibition on questioning policy merits as a boundary that preserves democratic choice without disabling performance scrutiny, the Turkish experience shows how the prohibition of yerindelik denetimi (expediency review) can become a legal and institutional device that weakens the practical reach of external audit.

A further controversy emerged with the amendment introduced by Law No. 6353 in 2012. Article 45 of Law No. 6353 added a second paragraph to Article 35 of the Court of Accounts Law No. 6085, which regulates the general principles of audit rather than a separate article on performance audit. The amendment stated that, even where public transactions were formally compatible with legislation and with the objectives and indicators determined by the administration, the Sayıştay could not issue audit reports containing opinions or recommendations that would amount to expediency review on grounds such as managerial necessity, proportionality, effectiveness, economy, or efficiency. It also prohibited reports that would require the administration to take a specific action, implement a specific policy, or restrict its discretionary authority (Bazı Kanun ve Kanun Hükmünde Kararnamelerde Değişiklik Yapılmasına Dair Kanun, 2012, Art. 45). This intervention is important because it sharpened the tension between performance-oriented audit and the prohibition of expediency review. On the one hand, the post-5018 audit framework requires the Court of Accounts to evaluate whether public resources are used effectively, economically, and efficiently. On the other hand, the 2012 amendment attempted to narrow the scope of audit reports by preventing assessments that could be interpreted as managerial or policy-based judgments. The Constitutional Court later annulled the phrase “effectiveness, economy, efficiency, and similar grounds” in this provision, reasoning that such a restriction would weaken the Sayıştay’s capacity to report on public resource use and undermine the legislature’s budgetary oversight function (Anayasa Mahkemesi, 2012). Therefore, the 2012 amendment should be read as a critical moment in the legal struggle over the boundary between legality review, performance audit, and prohibited expediency review in Turkish public financial control.

Although the Constitutional Court’s annulment removed one of the most explicit restrictions on the Sayıştay’s ability to refer to effectiveness, economy, and efficiency, this did not lead in practice to a fully restored value-for-money audit model. The post-annulment framework preserved the formal distinction between performance-oriented assessment and prohibited expediency review. Article 35 of Law No. 6085 still defines audit as the examination of public administrations’ accounts, financial transactions, activities, and internal control systems, together with the evaluation of whether resources are used effectively, economically, efficiently, and lawfully, while also prohibiting the Court of Accounts from conducting expediency review or restricting administrative discretion. Yet Article 36 defines performance audit more narrowly as the measurement of activity results in relation to the objectives and indicators determined by public administrations themselves (Court of Accounts Law No. 6085, 2010, Arts. 35-36). As a result, the practical effect of the annulment remained limited. Rather than developing into a broad audit of whether public services actually achieve effectiveness, economy, and efficiency in substantive terms, Sayıştay’s performance audit practice largely evolved into the audit of performance information, focusing on the quality, consistency, and reportability of strategic plans, performance programs, indicators, and activity reports.

The Turkish literature suggests that the formal framework created by Law No. 5018 has not been implemented with equal strength across all areas. Akbulut and Akyol (2023) argue that significant progress has been made in establishing and institutionalizing internal audit units, but internal control has not been institutionalized at the same level. They also show that, as of 2021, the average occupancy rate of internal auditor positions across public administrations was approximately 44 percent, indicating a serious capacity gap (Akbulut & Akyol, 2023). Köseoğlu (2024) similarly argues that internal audit in Turkish public administration has progressed since its formal adoption under Law No. 5018 and its actual implementation after 2007, but that it has not yet reached the desired level. One of the main problems is independence. Although the law emphasizes independence and objectivity, Köseoğlu (2024) argues that it does not provide sufficient structural safeguards to ensure the full independence and effectiveness of internal audit units. This problem is particularly important because internal auditors are positioned within the administration while being expected to evaluate the administration’s own control, risk, and governance processes.

Overall, the literature indicates that Law No. 5018 represents a major legal and institutional attempt to modernize Turkish public financial management through fiscal transparency, accountability, strategic planning, performance-based budgeting, internal control, and internal audit. Yet the same literature also shows that the success of this reform depends not only on the existence of legal provisions but also on institutional capacity, audit independence, managerial ownership, reliable reporting, and the ability to connect legality with performance without collapsing performance audit into expediency review. For this reason, the core question is not simply whether Law No. 5018 introduced modern public management concepts, but whether these concepts have been translated into functioning administrative practices. The gap between formal reform design and practical implementation is therefore the central problem through which the Turkish public internal control and audit system should be evaluated.

3. MORE ABOUT LAW NO. 5018

Public Financial Management and Control Law No. 5018 (Kamu Mali Yönetimi ve Kontrol Kanunu) is the current law that regulates audits in the public sector. The law was published in the Official Gazette (Resmi Gazete) on 24.12.2003 and came into effect by replacing the General Accounting Law No. 1050 (Muhasebe-i Umumiye Kanununu), which had been in effect from 26/5/1927 to 31.12.2004. Some of the main reasons for this replacement are:

• Law No. 1050 has failed to keep up with the rapidly changing conditions of the time. (32 times new things were added, and 8 times articles were repealed)

• Türkiye has started to change its structural form, especially after the 1980s. Thus, this structural change also brings some financial changes because:

  • There was a peak in public deficits. (According to Eğilmez and Kumcu (2002), the public sector borrowing requirement (PSBR) to GDP ratio was around 4-5% in the mid-1980s and increased 16.4% during the 2001 financial crisis. Simultaneously, the consolidated budget deficit surpassed 15% of GDP).

  • There were a lot of problems in the social security system (According to Turan (2004), the balance of social security institutions - SSK, Bağkur, Emekli Sandığı- was deeply damaged with the abolition of the retirement age limit in 1992. Therefore, the total deficit of these institutions increased from 0.25% of GDP in 1990 to 4.5% of GDP by 1999, and this led to unplanned central budget transfers to cover the black hole).

  • There was an emergence of off-budget expenditures (According to Karatepe (2006), the number of active Extra-Budgetary Funds (EBFs) was more than 70, and the revenues managed through these funds reached over 50% of the official state budget by the mid-1990s. Also, accumulation of duty losses in state banks, which are Ziraat and Halkbank, reached 12.2% of GDP by the year 2000).

  • There were accounting and statistical deficiencies (According to Hazine ve Maliye Bakanlığı (2003), Türkiye was utilizing a strict cash-based accounting system, so there was a massive discrepancy where international institutions found that billions of dollars in public contingent liabilities were completely unrecorded, and an inability to produce data compliant with international institutions’ standards).

  • There was a lack of a functioning audit and reporting system (According to Önen (2010), the Court of Accounts was limited by a rigid and ex-ante - before the fact- audit system. However, there was a necessity for an ex-post performance audit system with the aim of controlling over %60 of public financial transactions).

  • There was an increase in corruption (According to Transparency International (2002), International Corruption Perceptions Index (CPI), Türkiye’s score dropped into the high-risk zone and ranked 54th out of 91 countries in 2001).

• The relationships of Türkiye with international institutions such as the IMF, World Bank, and European Union require adherence to their system. (According to Güzelsarı (2007), under Chapter 32, which is about financial control, the harmonization of public financial management of Türkiye with the aim of internal audit and fiscal transparency became a core requirement of the accession negotiations).

All laws in Türkiye explain their aims in the first article. The first article of Law No. 5018 explains its purpose as “to regulate structure and functioning of the public financial management, preparation and implementation of the public budgets, accounting and reporting of all financial transactions, and financial control in line with the policies and objectives covered in the development plans and programs, in order to ensure accountability, transparency and the effective, economic and efficient collection and utilization of public resources”. Thus, the law clearly defines the main measurement components from the beginning for all audit attempts regarding public spending. The law itself included the definition of accountability and transparency in Articles 7 and 8. Accountability is equal to the responsibility of duty-related public power usage against abuse of public resources in Article 8, and fiscal transparency requires informing the public through timely, clear, accessible, and comprehensive financial reporting under the control of the Ministry of Finance in Article 7. Thus, all related institutions must clearly define the role of their personnel for accountability, and the Ministry of Finance must take regular activity reports based on their performance-based budgeting, with the aim of giving information to the public on the spending of their money. Internal Audit and Coordination Board (2016) defines other measurement components in the guideline of performance audit for public auditors, so the effective, economic, and efficient understanding of the Ministry of Finance, which aims to be implemented in practice, is defined based on this guideline. Efficiency means producing maximum output and quality by using minimum input in projects, programs, processes, and activities, so it focuses on calculation by comparing inputs and outputs, which can be made based on the unit cost of the outputs produced by comparing standards or (if standards are not available) by comparing best practice examples or similar results within and outside of the organization. Economics is defined as acquiring and utilizing the appropriate quality and quantity of resources, at the right time and optimal cost, with the aim of achieving the desired outcomes. Thus, the main aim in economics is to determine whether public resources are used prudently and identify improvement areas in resource savings by comparing alternative ways to perform the same activity. Effectiveness is the capacity to achieve the planned results. Therefore, auditors try to check whether or not the related projects, programs, processes, and activities achieved their goals with existing resources and inputs; shortcomings and deficiencies that prevent the maximum achievement of the goals, and areas for improvement.

Law No. 5018 brings some important changes to public revenues and expenditure. These are:

• Changes in definition and scope regarding budget types: In Law No. 1050, there was 3 types of budgets, which are the general budget, supplementary budget, special budget and revolving fund budgets attached to them. Also, even though there is no regulation about fund budgets in the law, fund budgets were established based on their own legislation. According to that legislation, fund budgets were not subject to Law No. 1050 in terms of preparation, implementation, and auditing. Therefore, these funds caused the deterioration of fiscal discipline by increasing public deficits. In Law No. 5018, there is 3 types of budgets based on Article 12, which are the central government budget, the social security institutions’ budgets, and local government budgets. Moreover, the law explicitly highlights the prohibition of creating budgets under any other name besides these, so fund budgets or any other type out of audit budgets are eliminated. In addition, amendments like the abolition of supplementary budgets and the abolition of revolving fund budgets are very important and appropriate for ensuring integrity, transparency, efficiency in the use of public resources, and prevention of resource waste and irregular transactions.

  Figure omitted from the web edition; see the original PDF.

• Modernization of budget principles: Article 13 defines the main principles of the law, and these principles have been amended sufficiently for the needs of age. The article states some important keywords, such as sustainable development, performance metrics, cost-benefit analysis, transparency, openness, and honesty.

  Figure omitted from the web edition; see the original PDF.

• Changes in the budget preparation process: The process had been regulated in a more detailed and comprehensive way. However, after 2018, the Turkish Republic transitioned from a parliamentary system to a presidential executive system, so this process was re-regulated with presidential decrees.

  Figure omitted from the web edition; see the original PDF.

• A multi-year budgeting approach: In this approach, which is mentioned in Article 17, public revenues, expenditures, and plans are organized to encompass multiple years, so data for the current year, estimates for the following year, and data for the two future years can be viewed together. According to Kesik (2005), this system permits the allocation of public services to predetermined locations.

• Performance-based budgeting: In this technique, the ruler aims to control public finance with efficiency and effectiveness principles (as mentioned in the theoretical background part). It was envisioned that all public institutions, organizations, and administrations would switch to performance-based budgeting in 2006.

• Analytical budget classification: In Article 17, the ruler mentioned that “The expenditure and revenue proposals shall be prepared in accordance with the classification system defined by the Ministry of Finance in line with international standards so as to enable economic and financial analysis and to ensure accountability and transparency.”. Hançer (2003) refers to this classification as:

  • Institutional classification: identifies the political and administrative responsibility of public expenditures by answering the question of “Who?” is spending the public resource (Example: Central government → ministries → directorates → specific administrative sub-units). Thus, the intermingling of institutional funds is prevented, and this enhances administrative accountability.

  • Functional classification: categorizes public expenditure based on the types of services and socio-economic objectives provided by the state, by answering the question of “Why?” or “For what purpose?” the money is being spent. (Example: The ruler utilizes the United Nations’ COFOG (Classification of the Functions of Government) standards and divides public services into 12 in Law No. 657, which are General Administrative Services, Technical Services, Health and Auxiliary Health Services, Education and Training Services, Security Services, Legal Services, Religious Services, Auxiliary Services, Civil Administration Heads, Gendarmerie Services, Coast Guard Services, and National Intelligence Services.)

  • Financial classification: identifies the source of the funds used in public expenditure by answering the question of “How is it funded?” or “From which source?”. It tracks whether a public activity is financed through general budget revenues, domestic/foreign loans, international grants (like EU funds), or special revenues generated internally by the institution (revolving funds). This classification is vital for monitoring debt sustainability and foreign aid dependency.

  • Economic classification: classification groups expenditures according to their economic nature and their impact on the overall market and resource allocation by answering the question of “What is the economic nature of the transaction?”. It separates expenditures into structural categories such as Personnel Expenses, Social Security Contributions, Goods and Services Procurement, Interest Expenses, Current Transfers (like subsidies or social aid), and Capital Expenditures (investments like building roads or purchasing infrastructure). Thus, it helps to analyze current expenditures and capital expenditures.

• Changes in the income area: the fifth section of the law, which is about the collection of revenues, shows all types of revenues because the ruler focuses on ensuring that all revenues and expenditures of public administration are included in the budget. Therefore, the ruler aimed to prevent the generation of revenues and expenditure outside the budget.

• Public loss: Article 71 defines the keyword with its responsibilities and sanctions. According to Koçberber (2015), codifying the public losses caused by officials who mismanage resources, holding them accountable, and mandating compensation serves as a vital symbol of their public accountability.

To sum up, Law No. 5018 has brought some important changes to public finance to keep pace with the innovations that come with the NPM era and to control the fundamental financial components by achieving standardization in line with global giants.

4. INTERNAL CONTROL, INTERNAL AUDIT AND EXTARNAL AUDIT

Law No. 5018 is a comprehensive set of rules related to public budget expenditures that is divided into nine sections. Although this article emphasizes the fundamental changes introduced by the law, the sections primarily intended for examination are Part 5, which is about internal control and audit, and Part 6, which is about external audit. The main argument of the criticism is that even though this law comes onto the agenda with the aim of applying a new public management style, the defined control mechanisms do not provide a proper understanding of private sector management. The paper will divide internal control, internal audit, and external audit by comparing the law with its applications in the public sector and differences with the private sector.

4.1. INTERNAL CONTROL

Article 55 defines internal control as “Internal control encompasses financial controls and other controls comprising organizational, methodology, procedural and internal audit established by the administration in order to ensure that the activities are performed in an effective, economic and efficient way in accordance with the aims, defined policies of the administration and with legislation, the assets and resources are protected, the accounting records are held correctly and completely, the financial information and management information are produced in time and securely.”. In the article, the internal control process is described to include the internal audit process; however, internal control is defined not as a destination but as a continuously operating and dynamic process designed to help the organization achieve its goals by the Committee of Sponsoring Organizations of the Treadway Commission (2013). Thus, it is a process conducted by senior management and all personnel to provide “reasonable assurance” regarding the effectiveness and efficiency of operations, the reliability of financial reporting, and compliance with legal regulations. On the other hand, the Institute of Internal Auditors (2024) defines internal audit as an independent and objective assurance and consulting activity aimed at improving and adding value to an organization’s operations, which means internal audit aims to decrease information asymmetry between shareholders and professional managers in a company in the private sector, so it conducts its operations based on the agency theory. At that point, defining internal audit as a part of internal control is a huge mistake (even though internal control has broader perspective) because internal auditors need to have control and authority in the reports of internal control departments to decrease information asymmetry and provide proper consulting, so the separation of these two positions can supply more qualified, objective, and independent audits, as in the private sector, by giving space to internal auditors for overseeing the whole process. Moreover, their separation can facilitate defining objectives and responsibilities more clearly.

Components of an internal control system based on the KPMG International (2016) need to be:

1. Control environment, which is the set of standards, processes, and structures that provide the basis for carrying out internal control across the organization. The system needs seven factors for an effective control environment: integrity and ethical values, commitment to competence, board of directors or audit committee, management’s philosophy and operating style, organizational structure, assignment of authority and responsibility, and human resource policies. Thus, the 5 principles are important here:

   1. Champion integrity and ethics,
   2. Ensure independent board oversight,
   3. Establish clear structures,
   4. Attract and retain top talent,
   5. Enforce accountability.

2. Risk assessment, which involves a dynamic and iterative process for identifying and analyzing risks to achieving the entity’s objectives, forms a basis for determining how risks should be managed. COSO defines 4 principles relating to risk assessment:

   1. Define clear objectives,
   2. Identify and analyze risks,
   3. Evaluate fraud potential,

3. Anticipate organizational changes Control activities, which are the actions established by the policies and procedures to help ensure that management directives to mitigate risks to the achievement of objectives are carried out. Control activities are performed at all levels of the entity, at various stages within business processes, and over the technology environment. For these purposes, there are 3 principles related to control activities:

   1. Design targeted mitigations,
   2. Secure and standardized technology controls,
   3. Deploy controls through formal policies.

4. Information, which is necessary for the entity to carry out internal control responsibilities in support of the achievement of its objectives, and communication, which enables personnel to understand internal control responsibilities and their importance to the achievement of objectives, are very important, so there are 3 principles relating to information and communication:

   1. Source and use quality data,
   2. Communicate clearly inside the organization,
   3. Manage external communications proactively.

5. Monitoring activities, which are crucial for understanding how all of the components of internal control are applied and whether the overall system of internal control operates effectively. Therefore, there are 2 principles:

   1. Conduct continuous and separate evaluations,
   2. Report and fix deficiencies fast.

Thus, the KPMG International defines 17 principles for efficient and effective internal control processes based on Committee of Sponsoring Organizations of the Treadway Commission (COSO) standards. Article 57 defines units of internal control as spending units, accounting and financial services, ex ante financial control, and internal audit. Therefore, these 17 principles must be sustained by these 4 units. However, even though there are clearly defined financial control mechanisms in law, there are large gaps, especially in ensuring independent board oversight, identifying and analyzing risks, securing and standardizing technology controls, and communicating clearly inside the organization. The importance of financial control in internal control processes can be defined as the lifeblood of the organization and assurance of sustainability, but it does not demonstrate that everything is done in the most proper way when the ruler only considers it. Hood (1991) criticizes this focus by dividing the values of administration into three types: sigma type, theta type, and lambda type. According to him, sigma type values, which are economy, efficiency, and effectiveness, may not always be the most important thing. If the government only focuses on sigma-type values, other values can collapse when they need them.

Figure omitted from the web edition; see the original PDF.

According to the law, the control mechanisms of institutions are determined based on the standards of the Internal Audit and Coordination Board under the Ministry of Treasury and Finance, and each institution establishes its own internal control mechanism for the purpose of:

1. managing the public revenues, expenditures, assets, and liabilities in an effective, economic, and efficient way,

2. ensuring that public administration operates in accordance with the laws and other legislation,

3. preventing irregularities and fraud in all kinds of financial decisions and transactions,

4. ensuring regular, timely, and reliable reporting and information acquisition for decision-making and monitoring,

5. preventing the misuse and waste of assets and protecting against losses.

Although the law clearly specified how and for what purposes internal control should be carried out in 2003, concrete steps were taken by public institutions much later than the law stipulated. Consider the adaptation process of TCDD (Republic of Türkiye State Railways) to the law from the perspective of internal control. Even though TCDD takes its budget based on Law No. 5018, the first initiative regarding its internal control unit was the “Action Plan for Compliance with Public Internal Control Standards,” which was launched on May 24, 2022. The date of this action plan is very interesting because they decided to establish an efficient and effective internal control unit after a great stir over the Çorlu train accidents, which happened in 2018, mainly because of a lack of control process. The accident happened in a passenger train, which is number 12703 and operating on Uzunköprü-Halkalı, carrying 362 passengers and 6 crew members. On accident day, there was a very heavy downpour, so the authorities described the reason for the accident as a natural disaster. However, after the first trial, the export reports and supplementary indictments between 2020 and 2022 show that there is a chain of major omissions because there was a lack of infrastructure, risk analyses, control, and communication over weather conditions. This case revealed there are huge gaps in the application of internal control principles, which are identifying and analyzing risks, evaluating fraud potential, securing and standardizing technology controls, deploying controls through formal policies, communicating clearly inside the organization, managing external communications proactively, conducting continuous and separate evaluations, and reporting and fixing deficiencies fast, even though TCDD is one of the subjects of the law. Therefore, this situation shows that the public institutions and government did not care about the requirements of control discipline until they faced serios problems.

4.2. INTERNAL AUDIT

Law No. 5018 defines internal audit as an independent and objective assurance and consulting activity designed to add value to public administration, improve institutional operations, and assess whether resources are managed according to the principles of economy, effectiveness, and efficiency. Article 63 states that internal audit is performed by internal auditors and that, depending on the structure and personnel size of public administrations, internal audit unit presidencies may be established with the approval of the Internal Audit Coordination Board and directly attached to the senior manager. Article 64 further assigns internal auditors the tasks of evaluating management and control structures based on objective risk analyses, examining the effective, economic, and efficient use of resources, conducting post-expenditure legal compliance audits, auditing the conformity of financial decisions and transactions with strategic plans and performance programs, and making recommendations for improvement. The same article also provides that internal auditors are independent in their duties, cannot be assigned non-audit tasks, and submit their reports directly to the senior manager (Public Financial Management and Control Law No. 5018, 2003, Arts. 63-64). This legal design creates a central tension. On the one hand, direct reporting to the senior manager can protect internal auditors from the pressure of lower administrative levels and audited units. In this respect, the model aims to give internal audit institutional visibility and access to decision-making authority. On the other hand, direct attachment to the senior manager does not produce the same type of institutional autonomy that can be observed in private-sector audit committees or board-level reporting structures. In the private-sector interview conducted for this study, the internal audit manager emphasized that the impartiality of control and audit functions depends on their distance from operational execution and process owners. Similarly, the public-sector interviewee argued that direct reporting to the senior manager protects internal auditors from lower level hierarchy but does not necessarily make them independent from senior management itself. Therefore, the main analytical question is not simply whether the internal audit is formally independent, but from whom, under what reporting relationship, and with what practical consequences this independence is protected.

The evolution of public internal audit after Law No. 5018 can be read as a process of partial institutionalization. Over time, internal audit became more visible, standardized, professionalized, and technologically supported. However, this development did not automatically make internal audit a strong accountability mechanism across the public sector. A comparison of 2008, 2015, and 2024 Public Internal Audit General Reports shows a mixed trajectory: the system expanded and matured in procedural terms, but its institutional value, administrative demand, staffing capacity, and practical influence remained uneven.

The 2008 Public Internal Audit General Report captures the first stage of the system: establishment and adaptation. At this point, internal audit was still being introduced into public administration as a new function following the implementation of Law No. 5018. The report presents internal audit as one of the principal components of the new public financial management and control system and emphasizes the adaptation of internationally recognized internal audit standards to Turkish public administration (Internal Audit Coordination Board [IACB], 2009, p. 6). The main concern in this early phase was not yet whether internal audit had produced a deep institutional transformation. Rather, the immediate questions were whether internal audit units existed, whether internal auditors had been appointed, whether institutional directives had been prepared, and whether public administrations had begun to understand and use the new function. The numerical data from 2008 show that institutionalization was still incomplete. By the end of that year, 261 public administrations had been allocated internal auditor positions, but only 208 had appointed internal auditors, and a total of 789 internal auditors were actively employed (IACB, 2009, p. 42). Although 1,369 internal auditor positions had been allocated, 580 remained vacant, producing a vacancy rate of approximately 42 percent (IACB, 2009, pp. 43-44). The same report indicates that only 71 of the 208 administrations with appointed internal auditors had submitted internal audit reports to the Board by the end of 2008, corresponding to approximately 34 percent of the administrations with appointed auditors (IACB, 2009, p. 48). The report consequently emphasized the need to establish internal audit units, clarify their location within organizational structures, appoint sufficient numbers of internal auditors, and strengthen senior management ownership of the function (IACB, 2009, pp. 29-30). These findings suggest that the early implementation problem was not merely conceptual. The new system existed in law, but it was not yet fully embedded in personnel structures, reporting practices, and organizational routines.

The 2015 Public Internal Audit General Report represents a second stage: consolidation, standardization, and professionalization. By this time, internal audit was no longer simply a newly introduced institution. It had acquired a more developed regulatory and methodological infrastructure. The report discusses internal audit legislation, quality assurance and improvement arrangements, the Public Internal Audit Software known as “İçDen”, performance audit guidance, information technology audit guidance, professional training, and certification activities (IACB, 2016, pp. 17-23). This indicates a clear transformation in the meaning of internal audit. It was no longer presented solely as a statutory requirement under Law No. 5018, but increasingly as a professional field with its own standards, technological tools, training practices, quality assurance mechanisms, and audit methodologies. However, the 2015 report also reveals that professionalization did not eliminate structural weaknesses. As of September 2016, 383 public administrations subject to the internal audit provisions of Law No. 5018 had been allocated 2,075 internal auditor positions, but only 960 internal auditors were actively working in 253 public administrations. The filled-position ratio was approximately 46 percent (IACB, 2016, p. 35). If the filling of allocated internal auditor positions is used as a limited proxy for administrative demand, these figures suggest that internal audit had not become uniformly demanded across public administrations. Despite the expansion of the legal and technical infrastructure, the system continued to face serious problems of staffing and institutional ownership. The persistent vacancy rate indicates that internal audit may have been accepted more readily as a formal administrative requirement than as an indispensable management function. The 2015 report is particularly important because it identifies the cultural dimension of the problem. It points to inadequate awareness among senior managers and audited units and recognizes continuing reluctance toward internal audit within public administrations (IACB, 2016, p. 31). It also emphasizes the need to move away from traditional, retrospective audit practices toward a more future-oriented, system-based, and process-based approach (IACB, 2016, p. 47). The report’s recommendations concerning communication, senior management support, institutional ownership, and the reduction of resistance to audit further demonstrate that the problem was not limited to staff shortages or regulatory deficiencies (IACB, 2016, pp. 47-48). Internal audit was intended to move public administration from a transaction-oriented inspection culture toward a risk-based, advisory, system-oriented, and performance-sensitive model. Nevertheless, the report’s own analysis shows that this transformation remained incomplete.

The 2024 Public Internal Audit General Report represents a third stage: digitalization and technical maturity combined with persistent institutional limits. On the positive side, the system had clearly developed in terms of technological tools, reporting processes, professional training, and methodological capacity. The report states that İçDen was introduced in 2013 to automate the planning, execution, reporting, and monitoring stages of internal audit activities. By the end of 2024, 131 administrations and 761 internal auditors were using the software. When the total number of active internal auditors, 937, is taken as the reference point, this corresponds to an approximately 81 percent usage rate among internal auditors (IACB, 2025, p. 17). The report also displays growing attention to information technology audit, artificial intelligence, data analysis, information security, quality assurance, professional certification, and continuous professional development (IACB, 2025, pp. 22, 49-50). These developments demonstrate that the internal audit did not remain stagnant after the initial reform period. It acquired a more sophisticated technical infrastructure and began to adapt to new audit fields and technological risks. Yet the 2024 data also show that the basic capacity problem persisted. By the end of 2024, 396 public administrations had internal auditor positions, and 937 internal auditors were actively working in the public sector (IACB, 2025, p. 27). A total of 2,096 positions had been allocated, but active internal auditors were present in only 254 administrations. Thus, approximately 64.14 percent of the administrations with allocated positions employed at least one internal auditor (IACB, 2025, p. 29). Moreover, internal audit unit presidencies existed in only 132 administrations. When calculated against the 396 administrations with allocated internal auditor positions, this corresponds to approximately 34 percent (IACB, 2025, pp. 29-30). This distinction is important because the percentage would differ if the 132 unit presidencies were calculated only against the 254 administrations with active internal auditors. The 2024 report itself observes that the overall position occupancy rate remained around 45 percent and that many administrations could not establish internal audit unit presidencies because they employed two or fewer internal auditors. According to the report, this situation negatively affected both the effectiveness of internal audit activities and the use of the common audit software (IACB, 2025, p. 48). The comparison, therefore, reveals a paradox. Internal audit became more professionalized, but not necessarily more uniformly demanded. It became more digitalized, but not necessarily more powerful within the administrative hierarchy. It became more visible in reports, standards, and professional language, but not necessarily more effective in changing institutional behavior.

The reports repeatedly emphasize that internal audit can add value only if senior managers are willing to make use of audit work and if internal audit units can communicate their function effectively to management and audited units (IACB, 2016, pp. 47-48; IACB, 2025, pp. 49-50). This repeated emphasis suggests that internal audit has not failed as a regulatory idea, but it has struggled to become a fully internalized administrative practice. The institutional importance of internal audit continues to depend heavily on whether senior managers regard it as a governance and early-warning mechanism or merely as a formal obligation created by legislation. The types of audits conducted also reveal the limits of the transformation. The 2024 report states that, as in previous years, internal audit activities remained concentrated mainly on system and compliance audits, while financial audit, information technology audit, and performance audit remained limited (IACB, 2025, p. 34). Although information technology audits have gained importance through new information and communication security requirements, performance audit continues to appear as an underdeveloped field. This is significant because Law No. 5018 connects internal audit to the effective, economic, and efficient use of public resources. If performance audit remains limited, internal audit risks remain closer to system review and legal compliance than to the broader value-for-money logic promised by the reform.

The TCDD case illustrates, rather than proves, the broader dilemma of the Turkish public internal audit system. TCDD is a particularly relevant case because railway administration involves high operational, financial, infrastructural, and safety-related risks. TCDD’s 2023-2025 Internal Control Standards Compliance Action Plan presents the senior manager as the owner of the internal control system and assigns monitoring and coordination responsibilities to the Internal Control Monitoring and Steering Board, unit managers, the Strategy Development Department, and internal control representatives. The same plan defines the internal audit unit as responsible for continuously examining the design and operation of the internal control system, identifying its strengths and weaknesses, and contributing to its improvement through evaluations and recommendations (Turkish State Railways [TCDD], 2023). TCDD’s institutional definition of the Internal Audit Department also emphasizes adding value to the administration and evaluating whether resources are managed according to economy, effectiveness, and efficiency (TCDD, n.d.). Therefore, the issue should not be framed as the absence of an internal audit within TCDD. The more accurate question is whether the formal existence of the unit produces practical autonomy, risk-based horizontal reach, and consequence-producing capacity. For an institution such as TCDD, this question is critical. A risk-based internal audit function should not only examine whether individual documents comply with formal procedures, but also whether procurement, maintenance, asset management, staff planning, and operational safety risks are identified early enough and reported in a manner capable of producing administrative consequences. A protocol list, an action plan, or a formal departmental description can demonstrate that an internal audit function exists, but it does not by itself establish how far internal audit findings can challenge risks originating from upper-level managerial choices, investment priorities, procurement practices, maintenance planning, personnel allocation, or safety-related operational decisions.

4.3. EXTERNAL AUDIT

Law No. 5018 places external audit within the wider accountability framework of public financial management. Under Article 68, an ex-post external audit examines whether the financial activities, decisions, and transactions of public administrations comply with legislation and with institutional objectives, targets, and plans. The results are then reported to the Grand National Assembly of Turkey. The provision covers financial audit and legal compliance, as well as assessments of whether public resources are used effectively, economically, and efficiently. It also includes measuring activity results within the framework of accountability (Kamu Mali Yönetimi ve Kontrol Kanunu, 2003, Art. 68). Article 160 of the Constitution likewise authorizes Sayıştay (the Turkish Court of Accounts), to audit the revenues, expenditures, and assets of central government administrations and social security institutions on behalf of Parliament (Türkiye Cumhuriyeti Anayasası, 1982, Art. 160). Therefore, Sayıştay is not an ordinary administrative unit that reviews another part of the bureaucracy. It is a constitutionally established external audit institution located outside the managerial hierarchy of the public bodies under its audit.

Externality has a different meaning in the private and public sectors. In private-sector financial auditing, the audit firm is legally and organizationally separate from the company whose financial statements it reviews. Its externality is therefore based on organizational and contractual separation. Yet an auditor is not absolutely independent simply because it operates outside the audited company’s hierarchy. The audit relationship involves commercial payment, and fee dependence or the provision of non-assurance services may create self-interest, self-review, or other threats to independence. Therefore, International ethical standards set specific obligations for identifying, evaluating, and addressing these threats (International Ethics Standards Board for Accountants [IESBA], 2024, Sections 410 and 600). In the private sector, organizational separation forms the starting point of externality. Professional standards, governance arrangements, and restrictions on conflicting services are then expected to safeguard substantive independence. Sayıştay embodies a different kind of externality. It is not external to the state as a whole, and its authority does not come from a market contract. Instead, its externality is constitutional and institutional. Sayıştay operates outside the executive hierarchy of the administration it audits, exercises powers granted by the Constitution and legislation, and reports its audit findings to Parliament. The fact that one public institution audits another does not make the process an internal audit. This arrangement is better understood through O’Donnell’s concept of horizontal accountability.

O’Donnell defines horizontal accountability as the existence of state agencies that are legally authorized, factually willing, and practically capable of taking actions that range from routine oversight to sanctions in response to potentially unlawful acts or omissions by other state actors (O’Donnell, 1998, p. 117). For horizontal accountability to work, formal legal authority is insufficient on its own. Oversight bodies also need enough de facto autonomy from the institutions they supervise. The process depends on networks of state agencies rather than on one institution acting in isolation. These networks include legislatures, courts, accounting institutions, ombudsmen, and other supervisory bodies (O’Donnell, 1998, p. 118). O’Donnell’s framework was developed mainly to analyze institutional responses to unlawful or improper public conduct. On its own, it does not define the substantive scope of performance audit. It still offers a useful institutional framework for examining Sayıştay. The central question is not whether one state institution can meaningfully audit another. Constitutional government depends on institutions that supervise, question, and limit other holders of public authority. What matters more is whether the supervising institution has enough legal authority, operational autonomy, access to information, professional capacity, and institutional support to ensure that its scrutiny has consequences.

Bovens’s definition of accountability helps clarify this issue. Accountability does not exist simply because an organization prepares or publishes information. It requires a relationship in which an actor must explain and justify its conduct, while a forum has the power to question and judge that conduct. The actor may then face consequences based on the forum’s assessment (Bovens, 2007, p. 450). Submitting a Sayıştay report to Parliament is therefore a necessary part of accountability, but this step alone is insufficient. An appropriate forum must examine the report, and the findings must be able to contribute to parliamentary debate, administrative correction, political responsibility, legal action, public visibility, or institutional learning. A report that is formally produced but never discussed or acted upon may improve transparency without completing the accountability relationship.

• The Uneven Consequences of External Audit The legal consequences of the Sayıştay audit are not uniform. Law No. 6085 distinguishes between a regularity audit and a performance audit. A regular audit includes a financial audit, a compliance audit, and the assessment of financial management and internal control systems. Performance audit, by contrast, is defined as measuring activity results in relation to the objectives and indicators determined by public administrations themselves (Sayıştay Kanunu, 2010, Art. 36). Where an audit identifies an issue that has caused public loss, the auditors may prepare a judicial report after obtaining the defences of the responsible officials. The relevant chamber subsequently adjudicates the accounts and may order that the public loss be compensated by those found responsible (Sayıştay Kanunu, 2010, Arts. 48-50). Performance audits, however, are explicitly stated not to create financial or legal responsibility (Sayıştay Kanunu, 2010, Art. 7/6).

Sayıştay is therefore not an institution without binding authority. Rather, an external audit produces an asymmetrical structure of consequences . Findings concerning illegality and measurable public loss may enter the account-adjudication process and lead to a compensation judgment. Findings concerning effectiveness, economy, efficiency, policy implementation, or institutional performance are more dependent on indirect mechanisms. Their influence arises through parliamentary scrutiny, publication, political responsibility, public debate, administrative ownership, and the monitoring of recommendations. This asymmetry does not make performance audit inherently meaningless. A performance audit may identify inefficient processes, recurring risks, poor project design, ineffective public services, or the misuse of institutional capacity, even where no directly calculable public loss can be established. However, because such findings do not automatically produce financial or legal responsibility, their practical effect depends more heavily on the willingness and capacity of other accountability actors to respond. Performance audit is therefore particularly vulnerable where parliamentary examination is weak, recommendations are not systematically monitored, or audited administrations do not treat findings as a basis for corrective action.

• From Value-for-Money Audit to Performance Information Audit The historical development of performance audit shows how this vulnerability arose. Şener (2017) traces Sayıştay’s earlier authority to the 1996 amendment to the former Law No.

832. Under this framework, the institution could examine how efficiently, effectively, and economically audited bodies used their resources. This reflected a broad understanding of performance audit based on the three Es and similar value-for-money principles (Şener, 2017, pp. 4-5). Law No. 5018 and Law No. 6085 continued to refer to the effective, economic, and efficient use of public resources. Yet Law No. 6085 formally defined performance audit as measuring results against the objectives and indicators set by the audited administrations. Şener argues that this model differs from substantive performance audit. Examining whether an administration has produced measurable and consistent information about its objectives and indicators, and whether that information is reliable, amounts to a performance information audit. This type of scrutiny may improve planning and reporting while increasing transparency. It does not provide the same evaluation as an independent examination of whether a public program, service, or investment has actually achieved economy, efficiency, and effectiveness (Şener, 2017, pp. 5-7).

Performance information audit starts with the information architecture created by the audited administration. It examines whether strategic objectives are defined and whether indicators are measurable. It also considers whether reported results are reliable and whether planning documents are mutually consistent. Substantive performance audit starts from a broader evaluative question. It asks whether public resources produced the intended public results at a reasonable cost and whether alternative methods could have achieved better outcomes. The first approach evaluates the quality of administrative performance reporting. The second examines the actual performance of the administration, program, or service. This distinction matters because an administration may set internally consistent targets and indicators without showing that those targets adequately represent public need. It may also fail to demonstrate that the resulting service provides value for money. A technically sound performance report can therefore exist alongside weak substantive performance. When an audit is limited to information produced by the administration, the audited institution retains considerable influence over the scope of evaluation through its initial choice of objectives and indicators.

• Tarumar as an Analytical Framework This transformation can be examined through Akdoğan’s concept of tarumar, which draws on the policy-dismantling literature. Policy dismantling does not always involve formally abolishing a policy, institution, or legal mandate. It can occur through changes that reduce the number or strength of policy instruments, restrict the scope of an existing authority, weaken implementation capacity, or leave a legally valid obligation unused. These changes may be direct or indirect, visible or concealed, active or passive (Akdoğan, 2020, pp. 64-65). Akdoğan identifies four dismantling strategies: dismantling through non-implementation, dismantling through a change of level or institutional venue, symbolic dismantling, and active dismantling (Akdoğan, 2020, pp. 69-71). Active dismantling and dismantling through non-implementation are especially relevant to the development of Sayıştay’s performance-audit function. Dismantling through non-implementation occurs when existing policy instruments and obligations are formally retained but gradually weakened because authorities fail to update, apply, monitor, or enforce them. The legal and organizational framework remains in place, while its practical force declines. Active dismantling, by contrast, involves a deliberate and visible intervention that removes a policy instrument, reduces its intensity, or limits the authority under which it operates (Akdoğan, 2020, pp. 69-71).

When applied to Sayıştay, the concept does not suggest that the institution itself was abolished. Sayıştay kept its constitutional status and continued to audit public administrations, prepare reports, and exercise account-adjudication functions. The analytical question is more specific: whether the substantive content of performance scrutiny was weakened while the institution and the general language of performance audit remained formally intact. Akdoğan views the replacement of broad 3E auditing with a definition centred on objectives and indicators as part of an active dismantling process. He also points to the abolition of the specialized audit group based on efficiency, effectiveness, and economy. The absence of a dedicated methodology for exercising the formally retained 3E authority provides further evidence that weakening took place through organizational decisions and non-implementation (Akdoğan, 2020, pp. 72-76).

• Politicization and Institutional Constraint The concept of politicization must be used cautiously in evaluating this process. Political appointments, disagreement between government officials and auditors, or criticism of audit reports do not independently prove that every audit process is politically controlled. The sources examined here also do not establish that particular audit findings were altered through patronage, personal relationships, or direct intervention. Claims involving favouritism or the suppression of individual reports would require specific empirical evidence. Politicization can be approached more defensibly as an institutional process through which the autonomy, scope, legitimacy, or consequence-producing capacity of oversight is weakened. Relevant indicators may include attempts to narrow audit jurisdiction through legislation, political rhetoric portraying critical audit findings as illegitimate interference, organizational choices that reduce substantive audit capacity, failure to develop the methodology needed to exercise existing authority, and weak parliamentary or administrative follow-up.

Akdoğan documents the restructuring of performance audit together with public statements in which political actors criticized an understanding of audit that could interfere with administrative discretion or provide material for political opposition. He interprets these developments as evidence supporting an active dismantling argument (Akdoğan, 2020, pp. 73-76). These statements are relevant because they reveal a political conflict over the desired scope of the external audit. However, they should be treated as evidence of political contestation and institutional pressure, not as conclusive proof that every subsequent audit report was politically determined.

O’Donnell’s framework helps clarify the institutional risk. Horizontal accountability becomes weaker where oversight bodies lack practical autonomy, independently secured resources, professional capacity, or effective cooperation from other accountability institutions. Executives may seek to ignore, neutralize, co-opt, or institutionally weaken agencies capable of constraining their authority (O’Donnell, 1998, pp. 119-120). Preventive oversight institutions should consequently be professionalized, adequately resourced, and insulated from political interference (O’Donnell, 1998, p. 122). In the case of Sayıştay, the most defensible conclusion is not that the institution was entirely captured or rendered incapable of performing any meaningful function. Sayıştay continues to exercise constitutionally protected audit powers, publish reports, identify public losses, and produce judicially consequential decisions through account adjudication. The narrower argument is that its substantive performance-audit function was exposed to legal contestation, organizational weakening, and methodological underdevelopment.

5. INTERVIEW FINDINGS

This section presents two semi-structured interviews conducted to complement the legal and conceptual analysis of Law No. 5018. The first interview reflects the perspective of a private-sector internal audit manager working in a corporate vehicle leasing company. The second interview reflects the perspective of a public official with experience in the coordination of public internal audit.

5.1. Interview with a Private-Sector Internal Audit Manager

1. Question: To preserve the impartiality of internal control and internal audit functions, to which unit should they be hierarchically attached? Can a horizontal review mechanism be effective?

Answer: Internal control and internal audit functions should be positioned outside operational execution. In the private sector, their impartiality is best protected when they report to bodies such as the board of directors, the audit committee, or another structure that is not directly responsible for the processes being reviewed. If the control or audit function is placed under an operational department or under one of the process owners, independence and impartiality may be weakened. A horizontal review mechanism can be useful, especially because many corporate risks cut across departments rather than remaining within a single unit. However, such a mechanism can only function effectively if both senior management and process owners accept the legitimacy of the review.

2. Question: Why is impartiality so important in internal control and internal audit? Answer: Impartiality is essential because the credibility of the control function depends on the perception that findings are produced without pressure, personal interest, or institutional bias. If the unit responsible for control is exposed to managerial pressure or internal conflicts of interest, risks may not be identified accurately, and findings may be softened, delayed, or underreported. In that case, the function loses its value as a source of reasonable assurance. For this reason, impartiality is not only an ethical principle but also a practical condition for reliable risk detection and reporting.
3. Question: What is the main motivation behind internal control mechanisms in the private sector? Answer: The basic motivation is to identify risks, prevent errors and fraud, and provide reasonable assurance regarding company operations. Internal control does not aim only to find mistakes after they occur. Its more important function is preventive. It helps management understand where operational, financial, legal, and reputational risks may arise and whether existing controls are sufficient to manage those risks. In a corporate setting, this is directly linked to sustainability, compliance, asset protection, financial reliability, and managerial accountability.
4. Question: Since it is difficult to establish common control mechanisms even across different private-sector industries, how can a common policy be applied across public institutions that provide very different types of services? Answer: A single control policy can provide general principles, standards, and minimum expectations, but the details of implementation must be designed according to each institution’s field of activity, service model, and risk profile. Public institutions differ significantly from one another: a railway operator, a university, a hospital, a municipality, and a ministry do not produce the same risks. Therefore, a common public control framework should not mean a uniform checklist applied mechanically to all institutions. It should instead define the general architecture of control, while allowing each institution to adapt control points to its own operational risks.
5. Question: If you had the opportunity to place one additional control point in public expenditures, which area would you prioritize? Answer: The first priority would be procurement and large-scale public investment projects, especially high-value tenders and build-operate-transfer type projects. These areas involve substantial financial exposure and long-term public obligations. A control point should not be limited to the final payment stage. It should begin with a needs assessment and continue through technical specifications, tender design, competition conditions, contract management, progress payments, price adjustments,

delivery, acceptance, and post-contract monitoring. In other words, the most meaningful control point is not a single bureaucratic approval but a risk-based control chain covering the full life cycle of public spending.

5.2. Interview with a Public Official in Internal Audit Coordination Board (IDKK)

1. Question: Are the internal audit provisions of Law No. 5018 sufficiently clear for implementation, or do some provisions remain ambiguous? Answer: Law No. 5018 provides a relatively modern and coherent framework for public internal audit. It defines internal audit, assigns roles to internal auditors, establishes a connection with standards and ethical rules, and creates an institutional coordination structure. In this sense, the main problem is not the complete absence of legal rules. The more important issue concerns the practical consequences of internal audit findings. The legislation explains what an internal audit is and how it should operate, but it does not always guarantee that audit recommendations will alter administrative behavior. An internal auditor may identify risks, prepare findings, and submit recommendations; however, if the senior manager does not take ownership of these recommendations, internal audit may remain a reporting mechanism rather than a transformative management tool. Therefore, the ambiguity is less about the formal definition of internal audit and more about what happens when audit findings are not implemented.
2. Question: Does the main problem in public audit today stem from legal design or from implementation capacity? Answer: Legal design and implementation capacity are closely related, but the more visible weakness lies in institutional capacity and ownership. In the field of public internal audit, Turkey already has a law, secondary legislation, professional standards, ethical rules, guides, and general reports. The existence of this framework shows that the system is not legally empty. However, the practical question is whether audit reports enter the decision-making processes of public administrations. If findings do not affect budget decisions, procurement practices, staffing plans, investment priorities, or risk management procedures, the audit function becomes limited. In this respect, the problem is not only whether reports are produced, but whether they produce consequences. A system may generate reports without generating accountability.
3. Question: The independence of internal auditors is recognized in law and professional standards. To what extent can this independence be preserved in practice? Answer: Internal auditor independence appears strong at the normative level, but it is more fragile in practice. Independence is not only a matter of legal status. It also depends on career security, institutional culture, the reaction of senior management to critical findings, and whether audit reports are taken seriously after submission. An internal auditor may be formally independent from the units being audited, but if the auditor believes that strong findings will be ignored, resisted, or viewed negatively by

senior management, factual independence becomes weaker. In this sense, it is useful to distinguish between normative independence and practical independence. Normative independence exists in the legal and professional framework. Practical independence depends on whether the auditor can write findings without fear and whether the institution is willing to act on them. 4. Question: Does reporting directly to the senior manager create an advantage or a disadvantage for internal auditor independence? Answer: Direct reporting to the senior manager has both advantages and disadvantages. In theory, it protects the internal auditor from the pressure of lower administrative levels. If an internal auditor reports directly to the senior manager, the audited department cannot easily block, dilute, or suppress the report. This can strengthen the institutional weight of the internal audit. However, the same model may also create a vulnerability. The senior manager is responsible for the institution’s performance, budgetary decisions, administrative priorities, and, in some cases, politically sensitive objectives. If an audit finding concerns an area shaped by senior management’s own decisions, the recipient of the report may also become part of the problem being examined. Thus, direct reporting protects the auditor from lower-level hierarchy, but it does not make the auditor fully independent from senior management. 5. Question: Is there any article or mechanism in the legislation that should be changed? Answer: The issue should not be reduced to a single article. What needs to be strengthened is the consequence-producing capacity of the internal audit. First, the implementation of audit recommendations should become more visible and traceable. Once a finding is issued and an action plan is prepared, it should be clear whether the recommendation was implemented, why it was not implemented, and who is responsible for the delay or refusal. Second, when management does not implement an audit recommendation, the justification should be written, reviewable, and accountable. Not every recommendation must automatically be adopted, since management may have reasonable grounds for disagreement. However, repeated non-implementation without sufficient justification weakens accountability. Third, aggregated and anonymized information on recurring findings, unimplemented recommendations, and institutional risk areas could be made more visible. Finally, vacant internal auditor positions should be treated as a serious capacity problem. If a public institution has an internal audit structure on paper but lacks active internal auditors, the system exists formally but not functionally. 6. Question: What is the role of the Internal Audit Coordination Board in this system? Answer: The Internal Audit Coordination Board is important because it establishes a common professional language for public internal audit. It prepares standards, guides, ethical rules, and general reports, and it contributes to the standardization of audit practice across public administrations. However, its role is primarily coordinative rather than directly executive. It cannot be understood as a body that forces every institution to implement each internal audit recommendation. The Board can set the framework, monitor the system, and consolidate information, but the practical effect of internal audit still depends heavily on the senior manager, the internal audit unit, the strategy unit, spending departments, and institutional culture. Therefore, the Board is necessary for standardization, but it is not sufficient on its own to overcome resistance inside public institutions. 7. Question: In terms of effectiveness, efficiency, and economy, what can an internal audit do in public administration? Answer: Modern internal audit should not be limited to asking whether documents comply with formal rules. Legality is necessary in public administration, but it is not sufficient. Internal audit should also ask whether public resources are used to achieve intended outcomes, whether alternatives were considered, whether the same service could have been delivered with lower cost or lower risk, and whether the spending produced public value. In large investment projects, for example, it is not enough to check whether the tender file is formally complete. The audit should also consider needs analysis, cost increases, contract management, time extensions, maintenance planning, and operational risks. Internal audit contributes to effectiveness, efficiency, and economy by making these risks visible to management. However, the auditor does not replace the administration’s policy discretion. The auditor identifies risk, provides assurance, and offers recommendations; the transformation depends on whether management acts on them. 8. Question: If you had the opportunity to place one additional control point in public expenditures, which area would you prioritize? Answer: The priority would be public procurement and large investment projects. This includes infrastructure projects, construction works, maintenance and repair tenders, consultancy services, information technology procurements, public-private partnership projects, and high-value service contracts. The control point should not be placed only at the payment order stage. Public loss often begins earlier, with weak needs assessment, poorly prepared technical specifications, limited competition, inadequate contract monitoring, problematic progress payments, price differences, time extensions, and acceptance procedures. A second priority would be personnel planning and institutional capacity, because public resources are also wasted when human resources are misallocated or critical tasks are performed without sufficient expertise. A third priority would be idle asset management, including unused vehicles, equipment, buildings, stocks, and machinery. In general, public control should follow the entire decision chain, from the moment a need is defined to the final public service outcome.

6. DISCUSSION

The findings of this study show that Law No. 5018 created an extensive formal framework for public financial management, internal control, internal audit, and external audit in Turkey. The law introduced strategic planning, performance-based budgeting, managerial responsibility, and the principles of economy, efficiency, and effectiveness. It also separated internal control, internal audit, and external audit as distinct functions within the broader accountability system. Yet the institutional development of these mechanisms remained uneven. Legal recognition did not consistently produce operational capacity, effective independence, or consequences for administrative behaviour. The central gap identified in this study is therefore the distance between the reform architecture established by law and the way this architecture has functioned in public institutions.

Law No. 5018 can be understood as a Turkish adaptation of major New Public Management principles. NPM sought to shift public administration away from rigid input control and toward performance, managerial responsibility, and measurable results (Hood, 1991). The Turkish reform followed this direction through strategic plans, performance programs, internal control systems, and audit mechanisms concerned with the effective use of public resources (Kesik, 2005; Bozkurt, 2018). Still, Law No. 5018 should not be treated as a complete transfer of the NPM model. Its primary field was public financial management. The law was expected to influence wider administrative practice through budgeting, control, and accountability, but its instruments entered an institutional environment already shaped by centralized authority, formal legality, and strong administrative hierarchy. The resulting model combined managerial language with an established legalistic tradition. Public institutions were expected to identify risks, measure performance, and assume responsibility for results. At the same time, implementation remained closely tied to formal procedures, documentary compliance, and hierarchical approval. Therefore, the reform created a hybrid system. It introduced the vocabulary and instruments of performance management without fully displacing the older emphasis on rules, files, and authorization. This tension appears throughout the internal and external audit findings examined in the study.

The reform formally extended control beyond accounting accuracy and expenditure legality. In practice, however, performance continued to be understood largely through financial and document-based indicators. This does not mean that Law No. 5018 ignored service outcomes or institutional objectives. Strategic plans, performance programs, and activity reports were intended to connect public expenditure with administrative results. The problem lies in the way these instruments were applied. Measurable financial information and formal reporting requirements often became more visible than service quality, social outcomes, or public value. Financial accountability developed more clearly, while substantive accountability for the results of public services remained less secure.

The development of internal audit illustrates this pattern. The 2008, 2015, and 2024 Public Internal Audit General Reports show real institutional progress. Internal audit acquired professional standards, training mechanisms, quality assurance procedures, and a common digital infrastructure. Yet staffing problems persisted throughout the period. In 2008, 580 of the 1,369 allocated internal auditor positions remained vacant, producing a vacancy rate of approximately 42 percent (Internal Audit Coordination Board [IACB], 2009, pp. 42-44). The filled-position ratio was still approximately 46 percent in the 2015 report (IACB, 2016, p. 35). By 2024, the overall occupancy rate remained around 45 percent, and many administrations lacked enough auditors to establish an internal audit unit presidency (IACB, 2025, pp. 27-30, 48). These figures reveal the difference between creating an institution and making it function. Public administrations received internal auditor positions, while many of those positions remained unfilled. Standards and software became more developed, but administrative demand did not grow at the same pace. If position occupancy is used as a limited indicator of institutional demand, internal audit was accepted more easily as a formal element of the reform than as an essential management function. The 2024 report also shows that system and compliance audits remained dominant, while performance audit and other specialized forms of audit were more limited (IACB, 2025, p. 34). The reporting relationship of internal auditors creates another tension. Law No. 5018 recognizes internal audit as an independent and objective activity, yet internal audit units report directly to the senior manager. Direct reporting can protect auditors from interference by lower administrative levels. It also leaves their practical influence dependent on the same senior management whose decisions may fall within the scope of audit. The interviews conducted for this study support this distinction between formal and practical independence. Direct access to the senior manager may strengthen the auditor’s position within the hierarchy, but it does not make the auditor independent from senior management.

The private-sector interview provides a useful contrast. In the private sector, internal audit is generally expected to maintain distance from operational departments and process owners. Reporting to a board or audit committee can create a layer of institutional separation between the auditor and executive management. Public institutions do not reproduce this arrangement in the same form. Their internal auditors remain part of the organization and operate under a statutory reporting relationship with the senior manager. The comparison does not prove that the private-sector audit is completely independent. Commercial relationships create their own risks. It does show that public internal audit faces a specific structural problem: its authority depends on the support of senior management, while its work may require criticism of decisions made or approved at that level.

External audit presents a related problem at a different institutional level. Sayıştay is constitutionally positioned outside the executive hierarchy of the administrations it audits and reports to Parliament. Its position corresponds to a form of horizontal accountability in which one public institution supervises the use of authority by others (O’Donnell, 1998, pp. 117-118). Such an externality is different from the contractual separation of a private audit firm. Sayıştay remains part of the state, but it is external to the managerial structure of the audited administration. Institutional externality alone does not ensure effective accountability. Bovens defines accountability as a relationship in which an actor explains and justifies its conduct, a forum questions and judges that conduct, and consequences may follow (Bovens, 2007, p. 450). Sayıştay can prepare and submit a report, but the accountability process remains incomplete unless Parliament, public authorities, or other forums examine the findings and respond. Therefore, the practical effect of the external audit depends on what happens after the report is produced.

The consequences of the Sayıştay audit are also uneven. Findings involving illegality and measurable public loss may enter the account-adjudication process and lead to compensation decisions. Performance audit does not directly create financial or legal responsibility (Sayıştay Kanunu, 2010, Art. 7/6). Its influence is more indirect. It depends on parliamentary scrutiny, administrative response, and the public visibility of audit findings. Thus, a weak follow-up process affects performance audit more severely than regularity audit. The development of performance audit shows how an apparently broad reform can become narrower in practice. Law No. 5018 and Law No. 6085 continued to refer to economy, efficiency, and effectiveness, but the performance audit was formally connected to objectives and indicators determined by the audited administrations. Şener distinguishes this model from substantive value-for-money auditing. Performance information audit examines whether objectives, indicators, and reported results are measurable and reliable. Substantive performance audit asks whether a program or service actually used public resources well and achieved meaningful results (Şener, 2017, pp. 5-7). This distinction matters because an administration can produce coherent performance information without demonstrating strong public-sector performance. Targets may be measurable but poorly chosen. Indicators may be reliable but disconnected from service quality or public need. When the audit remains within the information framework prepared by the administration, the audited institution retains considerable influence over the boundaries of evaluation. Balyemez’s examination of post-2013 reports support this concern. The performance audit reports in his study did not contain substantive analyses of economy, efficiency, and effectiveness, while some observations using these concepts appeared in regular audit reports (Balyemez, 2018, pp. 295-300).

The concept of tarumar helps explain this development. Akdoğan uses the term to describe processes in which policies or institutional instruments are weakened without necessarily being formally abolished. The number or intensity of policy instruments may be reduced. Implementation may be neglected, or authority may remain legally available but institutionally unused. Akdoğan identifies dismantling through non-implementation, changes of institutional level, symbolic dismantling, and active dismantling as distinct strategies (Akdoğan, 2020, pp. 64-71). Active dismantling is visible where an existing instrument is directly narrowed through legislation or organizational change. The 2012 amendment introduced by Law No. 6353 is the clearest example in the field of external audit. The amendment attempted to restrict Sayıştay reports from including assessments based on effectiveness, economy, and efficiency, where such assessments could be treated as an expediency review. The Constitutional Court annulled the phrase that explicitly referred to these principles. It held that evaluating the economy, efficiency, and effectiveness of public resource use could not automatically be classified as interference with administrative discretion (Anayasa Mahkemesi, 2012, pp. 140-142).

The judgment did not remove the prohibition of expediency review. Sayıştay could not replace the administration or determine which policy should be adopted. The decision preserved a boundary between evaluating the implementation of public policy and making policy on behalf of the executive (Anayasa Mahkemesi, 2012, pp. 142-143). This boundary is compatible with a performance audit. The problem arises when the prohibition is interpreted so broadly that criticism based on cost, results, or efficiency becomes difficult. Dismantling through non-implementation appears in a different form. A legal mandate can remain in force while the capacity required to exercise it is left incomplete. Persistent vacancies in internal audit positions provide one example. The limited establishment of internal audit unit presidencies offers another. In external audit, the absence of a dedicated methodology for substantive three-E auditing and the movement toward performance information audit show how legally available authority may remain underdeveloped in practice (Akdoğan, 2020, pp. 72-76; Şener, 2017, pp. 7-8).

Symbolic dismantling also helps describe the gap between institutional names and institutional content. The language of performance, accountability, and value creation remained central to the reform. Institutions continued to prepare plans, reports, and audit documents. Yet the substance of a performance review could become narrower than the terminology suggested. A system may therefore preserve the visible form of performance management while reducing the depth of independent evaluation.

The findings of our paper do not support the claim that the entire post-5018 system was deliberately designed to fail. They also do not prove that every audit institution was directly controlled through political appointments or patronage. Such conclusions would require evidence concerning particular appointments, interventions, or altered reports. The study instead identifies institutional vulnerabilities. Centralized authority, dependence on senior management, weak follow-up mechanisms, and political resistance to critical scrutiny can limit the practical reach of audit without formally eliminating it.

Politicization is therefore better understood here as a process rather than a universal description of every audit activity. It may occur when the jurisdiction of an oversight body is narrowed, when its critical findings are treated as illegitimate political intervention, or when existing authority is not supported by adequate institutional capacity. Direct evidence of favouritism or personal patronage would be needed before stronger claims could be made. The available evidence supports a more limited conclusion: some elements of the control system became exposed to political-administrative pressure and institutional weakening.

The study’s main contribution lies in bringing internal and external audit into the same analytical framework. Both areas display a gap between formal authority and practical consequence. Internal auditors possess legal independence but remain dependent on senior management support and adequate staffing. Sayıştay possesses constitutional authority but relies on parliamentary scrutiny and administrative follow-up for many performance findings to produce results. Neither problem can be solved through legislation alone. Law No. 5018 was primarily a public financial management reform. It was not a comprehensive statute for every dimension of public administration. Still, its control philosophy was expected to influence managerial practice beyond accounting and budgeting. The evidence suggests that this wider transformation remained incomplete. Financial procedures became more structured, and reporting systems developed. The movement from formal financial control toward substantive responsibility for public-service outcomes was slower.

The future development of the system therefore depends less on adding further layers of legislation than on strengthening the institutions that apply existing rules. Internal audit requires filled positions, practical independence, and credible monitoring of recommendations. External audit requires substantive performance methodologies and serious parliamentary engagement with audit findings. Administrative actors must treat audit as a source of institutional learning rather than as a threat to managerial authority.

The Turkish adaptation of NPM produced a durable legal and technical architecture, but it did not create a uniformly results-oriented accountability culture. Its institutions were neither entirely successful nor wholly dismantled. They continued to operate while parts of their capacity remained weak or were narrowed over time. The concept of tarumar captures this uneven trajectory because it directs attention to the space between formal survival and functional erosion. That space is where the central problems of the post-5018 control system have developed.

7. CONCLUSION

This study examined Law No. 5018 as Turkey’s adaptation of a performance-oriented public management model. It traced how internal control, internal audit, and external audit were designed to strengthen accountability and improve the use of public resources. The analysis showed that this formal architecture developed unevenly in practice. Internal audit gained standards, professional tools, and institutional visibility, yet staffing gaps and dependence on senior management limited its practical reach. External audit retained constitutional authority, but the scope and consequences of performance scrutiny remained narrower than the reform’s original promise.

The concept of tarumar helped explain this gap between legal survival and functional erosion. Institutions were rarely abolished outright. Their capacity could instead be weakened through non-implementation, organizational narrowing, or direct legal intervention. Thus, the post-5018 system reveals a persistent tension between the language of accountability and the conditions required to make accountability effective. Public oversight cannot be cut to fit administrative convenience. When the space reserved for scrutiny becomes too narrow, justice is the first principle that no longer fits.

REFERENCES

Akbulut, N., & Akyol, Ç. (2023). Kamu mali yönetimi ve kontrol yapısında kamu kurumlarında iç denetim faaliyetlerinin durumu. Denetişim Dergisi, 28, 137–152.

Akdoğan, A. A. (2020). Türkiye’de işletmeci kamu politikalarının tarumarı. In C. U. Çiner (Ed.), Türkiye’de kamu politikaları: Güncel konular ve eğilimler (pp. 49–83). Ankara Üniversitesi Yayınları.

Akdoğan, A. A. (2026). Reform in Turkish public administration [Lecture notes]. İktisadi ve İdari Bilimler Fakültesi, ODTÜ.

Altınbaş, H. (2019). Kurumsal yönetim açısından iç denetim ve vekalet teorisi ilişkisi.

Muhasebe ve Finansman Dergisi .

Anayasa Mahkemesi. (2012, 27 Aralık). E. 2012/102, K. 2012/207. Sayıştay Dergisi, 88, 131–148.

Balyemez, A. S. (2018). Sayıştay performans denetimlerinin uygulama ve sonuçları üzerine bir tartışma. İşletme Araştırmaları Dergisi, 10 (2), 276–311.

Bazı Kanun ve Kanun Hükmünde Kararnamelerde Değişiklik Yapılmasına Dair Kanun (Kanun No. 6353). (2012, 12 Temmuz). Resmî Gazete (Sayı: 28351).

Bovens, M. A. P. (2007). Analysing and assessing accountability: A conceptual framework.

European Law Journal, 13 (4), 447–468.

Bozkurt, P. (2018). Türk kamu yönetiminde iç denetim sistemi: Stratejik yönetim perspektifinden bir değerlendirme. Sayıştay Dergisi, 109, 9–25.

COSO. (2013). Internal control—integrated framework . Committee of Sponsoring Organizations of the Treadway Commission.

Edizdoğan, N. (2008). Kamu bütçesi (7. baskı). Ekin Basım Yayın.

Eğilmez, M., & Kumcu, E. (2002). Ekonomi politikası: Teori ve Türkiye uygulaması . Remzi Kitabevi.

Göker, C. (2024). Public finance [Ders notları]. İktisadi ve İdari Bilimler Fakültesi, ODTÜ.

Güzelsarı, S. (2007). Kamu mali yönetiminin yeniden yapılandırılması: 5018 sayılı kanun.

Amme İdaresi Dergisi, 40 (2), 39–66.

Hançer, M. (2003). Kamu mali yönetimi ve kontrol kanunu tasarısı çerçevesinde analitik bütçe sınıflandırması. Maliye Dergisi, (144), 45–62.

Hood, C. (1991). A public management for all seasons? Public Administration, 69 (1), 3–19.

https://doi.org/10.1111/j.1467-9299.1991.tb00779.x Institute of Internal Auditors (IIA). (2024). Global internal audit standards . Institute of Internal Auditors.

Internal Audit Coordination Board. (2009). 2008 yılı kamu iç denetim genel raporu . Ministry of Finance.

Internal Audit Coordination Board. (2016). 2015 yılı kamu iç denetim genel raporu . Ministry of Finance.

Internal Audit Coordination Board. (2025). 2024 yılı kamu iç denetim genel raporu . Ministry of Treasury and Finance.

International Ethics Standards Board for Accountants. (2024). Handbook of the International Code of Ethics for Professional Accountants, including International Independence Standards . International Federation of Accountants.

Kamu Malî Yönetimi ve Kontrol Kanunu (Kanun No. 5018). (2003, 24 Aralık). Resmî Gazete (Sayı: 25326).

Karatepe, K. (2006). Mali anayasada değişiklik sorunu: 5018 çözümlemesi. Maliye Dergisi, (151), 34–55.

Kesik, A. (2005). Avrupa Birliği sürecinde Türk kamu mali yönetiminin yeniden yapılandırılması: Çok yıllı bütçelemenin uygulanabilirliği. Sosyoekonomi, 1 (1), 136–152.

Kesik, A. (2005). 5018 sayılı Kamu Mali Yönetimi ve Kontrol Kanunu bağlamında ve AB sürecinde Türk kamu iç mali kontrol sistemi. Kocaeli Üniversitesi Sosyal Bilimler Enstitüsü Dergisi, 9 (1), 94–114.

Koçberber, S. (2015). Kamu zararı kavramı üzerine yargı kurumları arasındaki hüküm uyuşmazlıklarında Uyuşmazlık Mahkemesinin rolü ve önemi. Sayıştay Dergisi, (97), 55–75. https://dergipark.org.tr/en/pub/sayistay/article/919179 Köseoğlu, İ. (2024). Türk kamu yönetiminde iç denetimin gelişimi üzerine bir inceleme.

Denetişim Dergisi, 30, 65–81.

KPMG International. (2016). COSO internal control – integrated framework (2013) [White paper]. https://assets.kpmg.com/content/dam/kpmg/pdf/2016/05/2750-New-COSO-2013-Fram ework-WHITEPAPER-V4.pdf National Audit Act 1983, c. 44, § 6.

O’Donnell, G. (1998). Horizontal accountability in new democracies. Journal of Democracy, 9 (3), 112–126.

Önen, S. M. (2010). Kamu mali yönetiminde kontrol ve sorumluluk. Sayıştay Dergisi, (81), 63–88.

Power, M. (1994). The audit explosion . Demos.

Sayıştay Kanunu (Kanun No. 6085). (2010, 19 Aralık). Resmî Gazete (Sayı: 27790).

Şener, H. E. (2017). Performans bilgisinin denetimi olarak Türk Sayıştayı’nın performans denetimi. Memleket Siyaset Yönetim, 12 (28), 1–27.

T.C. Hazine ve Maliye Bakanlığı. (2003). 5018 sayılı Kamu Malî Yönetimi ve Kontrol Kanunu genel gerekçesi . Gerekçeler Külliyatı.

T.C. Hazine ve Maliye Bakanlığı İç Denetim Koordinasyon Kurulu. (2016). Performans denetimi rehberi . https://ms.hmb.gov.tr/uploads/2019/09/PerformansDenetimiRehberi.pdf Tosun, E. (2003). Kamu mali yönetimi ve kontrol tasarısına ilişkin değerlendirme. Devlet Bütçe Uzmanları Dergisi, 16 (29), 20.

Transparency International. (2002). Corruption perceptions index 2002 . Transparency International.

Turan, A. (2004). Türkiye’de sosyal güvenlik sisteminin mali yapısı ve bütçeye yükü. Maliye Dergisi, (146), 85–102.

Turkish State Railways. (n.d.). İç Denetim Dairesi Başkanlığı kuruluş amacı .

Turkish State Railways. (2023). Kamu iç kontrol standartlarına uyum eylem planı 2023–2025 .

Türkiye Cumhuriyeti Anayasası (Kanun No. 2709). (1982, 9 Kasım). Resmî Gazete (Sayı:

17863).

Üst Kademe Kamu Yöneticileri ile Kamu Kurum ve Kuruluşlarında Atama Usûllerine Dair Cumhurbaşkanlığı Kararnamesi (Cumhurbaşkanlığı Kararnamesi No. 3). (2018, 10 Temmuz). Resmî Gazete (Sayı: 30474).