Service Business Plan

Transcription

1 Service Business Plan Service Name Internal Audit Service Type Internal Service Owner Name Sheila Jones Year 2018 Service Owner Title Service Description City Auditor An internal service to provide independent, objective audits and consulting services related to risk and controls. Current State Customers & Their Expectations Existing Service Delivery Existing Customer Engagement Tools / Methods Is this Service Provincially Legislated? For this Service are there Approved Service Standards? Sub-Services This service is delivered to: City senior management, for comfort that appropriate internal controls are in place to manage risk City staff, for understanding risks and the internal controls required to minimize risk. Results of this service are conveyed to the Audit Committee/Council to provide information regarding the effective management of processes in place to mitigate risk. Independent, objective audits and consulting services to evaluate and improve the effectiveness of risk management, internal control and the practices that ensure accountability, fairness and transparency External resources (e.g. accounting firms or consulting firms) may be used to deliver the audit service. In person discussions, on-site visits, , telephone, written reports, web page information and verbal presentations. No Yes Recent Continuous Improvement Initiatives International Professional Practices Framework (Institute of Internal Auditors) In 2017, the Office of the City Auditor: Better use of Active Data (the Excel add-on) resulted in a detailed and specific analysis of data to support audit findings and scope of work. Moving towards full digital working papers to reduce the environmental impacts of printing, reducing the amount of storage and use of paper. Worked with management to interpret and facilitate understanding the concepts of control frameworks to assist management in responding to the needs of the Audit Committee.

2 Emerging Opportunities and Anticipated Risks Emerging Opportunities The City's administration is working on a number of initiatives,ranging from inter-jurisdictional, cross-platform projects to service improvements; all involving opportunity and risk. Internal Audit consultation and advisory service through the development and implementation of key initiatives supports proactive assessment of the risk and design of controls at the most cost effective time. The City has also focused on business performance practices; such as, business plans, performance measures and continuous improvement activities, to achieve efficient, effective and economical delivery of services. Internal Audit is an independent, objective party who can participate in service reviews to proactively assess the reliability and relevancy of performance measures. Anticipated Risks The exponential growth of data requires expanding capacity for analytics to enhance decision making and to analyze greater volumes of data in less time. Increasing the use of data analytics within in audit supports more effective audit planning and more efficient audit testing. The City's move to implement business intelligence tools provides an effective way to introduce continuous auditing/monitoring into the business cycle. The rise in the number of change initiatives within the City can lead to a drop in risk management effectiveness, decreased productivity and a higher likelihood of employee attrition. Service Objectives Digitization and increased mobility means the potential for increased technology risk across the span of operations. There are a wealth of cybersecurity risks, generated particularly by employees, and compliance and data privacy risks due to all the personal information being collected, collated, and analyzed. Collaborate with project management office to identify opportunities for internal audit involvement. Develop the business case to support using a system for automating internal audit workflows to improve the efficiency of the internal audit function. Internal audit will work with the Enterprise Risk Management (ERM) function to determine how the results of ERM can be used to inform internal audit planning. Target Completion Apr 2018 Jun 2018 Oct 2018

3 # of Events MEASURING SUCCESS How much did we do? Number of Audits Completed (#) Number of Consulting Projects Number of Hours Spent on Consulting and Special Investigations (#) How well did we do it? Perceived Value of Audits Perceived Value of Audits Internal Audit adds value by helping identify and assess risks and demonstrate how well the internal controls are working. A survey is used at the end of every audit to determine how much value the client received through the audit. The target is an average of 3 out of a total score of 4. The scores are based on a scale from 1 to 4. Percentage of Audit Hours Used to Date The audit work plan is based on the allocation of available audit hours. Audits are planned using a range of hours based on the complexity of the area. The 2016 available audit hours were not fully utilized as more time was required in the on-going leadership in service management; particularly in the early part of the year. Audit planning occurred during January and February and audit work did not begin until April. 110% 100% 90% 80% 70% 60% 50% Percentage of Audit Hours Used to Date 99% 89% 90% 90% 90% 90% 90% 70% Industry Benchmark % Audit Hours Used 55%

4 Is anyone better off? Where do we want to go? Overall internal audit ratings An overall audit rating is an opinion based on the findings for the function audited. Tracking of audit results since inception of the Internal Audit Service shows slightly over half of the audits completed to date have rated the area audited "good" to "excellent." This suggests there is opportunity to improve internal controls, compliance with policy and laws and/or improve the efficiency and effectiveness of operations. Increase percentage of overall internal audit ratings of "good" and "excellent". Summary of Overall Audit Ratings % Not Rated, 12% % Excellent, 12% % Weak, 0% % Fair, 31% % Good, 46% Where do we want to go? Percentage of internal audit findings by severity rating Findings are categorized by severity. Tracking of severity rating since the inception of Internal Audit Service indicates the majority of findings rated medium and low. These overall results indicate management has controls in place and these controls are working relatively well to manage the risk in the audited areas. Decrease the number of high and medium risk audit findings. Findings by Severity Profile % High, 9% % Low, 54% % Medium, 37%

5 2018 OPERATING BUDGET SERVICE RESOURCE SUMMARY Service Description Service Owner Name An internal service to provide independent, objective audits and consulting services related to risk and controls. Sheila Jones Proposed Year End Projections Base $ Change vs % Change vs Business Cases Human Resources $ 369,334 $ 288,945 $ 288,945 $ 297,617 $ 8, % - INTERNAL AUDIT Total % Change vs $ $ 297, % Operating/Minor Capital Equip. $ 2,352 $ 2,550 $ 2,550 $ 700 $ (1,850) -72.5% $ - $ % Purchased Services $ 35,133 $ 39,650 $ 39,650 $ 39,550 $ (100) -0.3% $ - $ 39, % Corp. Expenditures/Provisions $ - $ - $ - $ - $ - 0% $ - $ - 0% Internal Charges & Settlements $ - $ - $ - $ - $ - 0% $ - $ - 0% TOTAL EXPENDITURES $ 406,820 $ 331,145 $ 331,145 $ 337,867 $ 6, % $ - $ 337, % Controllable Revenues $ - $ - $ - $ - $ - 0% $ - $ - 0% General Revenues & Recoveries $ (59,683) $ - $ - $ - $ - 0% $ - $ - 0% TOTAL REVENUES $ (59,683) $ - $ - $ - $ - 0% $ - $ - 0% NET OPERATING BUDGET $ 347,138 $ 331,145 $ 331,145 $ 337,867 $ 6, % $ - $ 337, %