Lake County School District. Quality Assurance & Improvement Program. Internal Self-Assessment for. The Internal Audit Department

Transcription

1 Lake County School District Quality Assurance & Improvement Program Internal Self-Assessment for The Internal Audit Department Fiscal Year Completed By: Thomas A. Mock, CIA Date: January 31,

2 TABLE OF CONTENTS Cover Page...1 Table of Contents Quality Assurance & Improvement Program Mandatory Disclosure Organizational Independence Impairments to Independence or Objectivity Management s Acceptance of Risks 4 6. Internal Assessments.4 7. Conclusion Attachment A. QAIP Self-Assessment Analysis

3 1. Quality Assurance & Improvement Program (QAIP) The International Standards for the Professional Practice of Internal Auditing, developed by the Institute of Internal Auditors, provides that the Chief Audit Executive (CAE) must develop and maintain a quality assurance and improvement program (QAIP) that covers all aspects of the Internal Audit activity. The QAIP is to be designed to provide reasonable assurance to various stakeholders of the Internal Audit activity that Internal Audit: a. Performs its work in accordance with its Charter (Policy 7.61), which is consistent with The Institute of Internal Auditors International Standards for the Professional Practice of Internal Auditing (Standards), Definition of Internal Auditing and Code of Ethics; b. Operates in an effective and efficient manner; and c. Is perceived by stakeholders as adding value and improving Internal Audit s operations. To that end, Internal Audit s QAIP will cover all aspects of the Internal Audit activity. In this regard, a list of the features to be considered for the QAIP: Monitors the Internal Audit activity to ensure it operates in an effective and efficient manner. Assures compliance with the Standards, Definition of Internal Auditing and Code of Ethics. Helps the Internal Audit activity add value and improve organizational operations. Includes both periodic and ongoing internal assessments. Includes an external assessment at least once every five years, the results of which are communicated to the School Board through the Advisory Audit Committee of the School Board (Audit Committee). The CAE (Director of Internal Audit) is ultimately responsible for the QAIP, which covers all types of the Internal Audit activities, including consulting. In addition, each School Board member prepares their own performance evaluation of the Director of Internal Auditor annually. This year s Performance Review of the Director of Internal Audit provided an overall average score of out of a possible score of Mandatory Disclosures International Standards for the Professional Practice of Internal Auditing require the reporting of specific items to an organization s Board and Senior Administration. The following is a list of required disclosures. 3. Organizational Independence The CAE confirmed to the School Board, as directed by the Standards, that the Internal Audit activity is organizational independence. In Lake County Public Schools this is accomplished through the Internal Audit activity reporting administratively and functionally to the School Board. In addition, the Director of Internal Audit met periodically during the school year with the Audit Committee Chair and the School Board Liaison on matters relating to internal audit. Reporting to the School Board and meeting with the Audit Committee are key element in promoting the independence necessary for the Internal Audit activity to adequately perform its function. 4. Impairments to Independence or Objectivity The Standards require when independence or objectivity is impaired in fact or appearance, the details of the impairment must be disclosed. In 2017 the Superintendent retired effect in March and the School Board hired a new Superintendent. Internal Audit has not noted any restrictions to the scope of work in the current or future audit work plan conveyed by the Superintendent. 3

4 5. Management s Acceptance of Risks Each engagement can potentially identify activities that may present exposures to the School District that could potentially impede the School District from achieving its goals or expected outcomes. Such exposures are considered risks to School District operations. Risks are a part of any organization. The acceptance of some risk by management is understood due to cost/benefit constraints and progression of the organization. When the Internal Auditor concludes that management has accepted a level of risk that may be unacceptable to the organization based on the institution s risk tolerance appetite, the Internal Auditor must discuss the matter with Senior Administration and the School Board. There were no instances noted of unacceptable levels of risks during the school year. 6. Internal Assessments a. Ongoing Reviews Ongoing assessments are conducted through: Supervision of engagements Regular, documented review of work papers during engagements by appropriate Internal Audit Audit Policies and Procedures used for each engagement to ensure compliance with applicable planning, fieldwork and reporting standards Feedback from customer on individual engagements Analyses of performance metrics established to improve the Internal Audit activity effectiveness and efficiency All final reports and recommendations are reviewed and approved by a Director of Internal Audit b. Periodic Reviews Periodic assessments are designed to assess conformance with Internal Audit s Charter, the Standards, Definition of Internal Auditing, the Code of Ethics, and the efficiency and effectiveness of internal audit in meeting the needs of its various stakeholders. Periodic assessments will be conducted through: Customer feedback Annual risk assessments for purposes of annual audit planning Semi-annual work paper reviews for performance in accordance with internal audit policies and with the Standards) Review of internal audit performance metrics and benchmarking of best practices, prepared and analyzed in accordance with Internal Audit s Standard Operational Procedures Periodic activity and performance reporting to the School Board and the Audit Committee 7. Conclusion The Director of Internal Audit (CAE) completed the Internal Assessment of the Internal Audit activity and concluded the department is 96.7% in compliance with the Standards (see Attachment A). This year s self-assessment is a 1.3 point improvement over the prior year. Lake County Public School s Internal Audit activity is considered a small audit shop which provides difficulty in complying 100% with the Standards. The IIA published guidance to assist small Internal Audit activities of 2 to 5 person department implement the Standards. This guidance provides some helpful suggestions, however a one person shop s level of challenge is greater than a 2 to 5 person department. The following is guidance on the degree of challenge a small audit shop faces in implementing the Standards: 4

5 The fact the Internal Audit activity had not completed in the past with an Internal or External Assessment resulted in 2.3% loss in compliance to the Standards. The Director of Internal Audit has been working to resolve this deficiency and expects the Internal Audit activity to be in full compliance by the school year. With the completion of this Internal Assessment the Director of Internal Audit can continue to provide documentation that the Internal Audit activity s audits Conforms to the International Standards for the Professional Practice of Internal Auditing. Sincerely, Thomas A. Mock, CIA Director of Internal Audit 5

6 Summary Internal Self Evaluation QUALITY ASSESSMENT REVIEW LAKE COUNTY PUBLIC SCHOOL DISTRICT Conducted in January 2018 This analysis was completed to the IIA 2017 Standards. By Thomas Mock, CIA In January 2018 IIA STANDARDS Attribute Standards Weighted 40% 1000 Purpose, Authority, and Responsibility 5 40 The purpose, authority, and responsibility of the internal audit activity must be formally defined in a internal audit charter, consistent with the Definition of Internal Auditing, the Code of Ethics, and the Standards. The CAE must periodically review the internal audit charter and present to the School Board for approval. Weight of Standards Overall Compliance Attribute Performance 100% 96.7% 93.8% 98.7% Director of Internal Audit's 8% IAA of LCS Compliance with IIA Standards Raw Score Calculated Score Calculated Score Comments on Adherence to the Standards The Internal Audit Charter (Policy 7.61) was drafted in 2013/2014 and approved by the Audit Committee and School Board. Internal Audit reviews the Internal Audit Charter for potential updates annually. The Internal Audit Charter was last updated in Fiscal Year 2017/2018 based on changes to the IIA IPPF released in January Recognition of the Definition of Internal Auditing, the Code of Ethics, 5 10 and the Standards in the Internal Audit Charter The mandatory nature of the Core Principles for the Professional Practice of Internal Auditing, the Code of Ethics, the Standards, and the Definition of Internal Auditing must be recogized in the internal audit charter. The CAE should discuss the Mission of Internal Audit and the mandatory elements of the IPPF with senior 1100 Independence A di C and iobjectivity d h S h l B d 50 The internal audit activity must be independent, and internal auditors must be objective in performing their work. 10% 1110 Organizational Independence 5 20 The chief audit executive must report to a level within the organization that allows the internal audit activity to fulfil its responsibilities. 4% See above. The Director of Internal Audit (CAE) reports both administratively and functionally to the School Board. The School Board has established an Advisory Audit Committee to oversee the audits conducted in the School District. The CAE reports all work completed to the Audit Committee. The CAE does not live or have any children in Lake County Public Schools, allowing an unbias view of the school district. The CAE reports directly to the School Board. The Internal Audit Activity is working to esablish a great working relationship with the new Superintendent and to-date has not encountered any restrictions in audit work scheduled Direct Interaction with the School Board 5 10 The CAE must communicate and interact directly with the School Board. The CAE reports directly to the School Board Individual Objectivity 5 10 Internal auditors must have an impartial, unbiased attitude and avoid conflicts of interest Impairments to Independence or Objectivity 5 10 If independence or objectivity is impaired in fact or appearance, the details of the impairment must be disclosed to appropriate parties. The nature of the disclosure will depend upon the impairment Proficiency and Due Professional Care 75 15% Engagements must be performed with proficiency and due professional care Proficiency 5 25 Internal auditors must possess the knowledge, skills, and other competencies needed to perform their individual responsibilities. The internal audit activity collectively 5% must possess or obtain the knowledge, skills, and other competencies needed to perform its responsibilities. The CAE has no responsibilities for the daily activities of the School District. The CAE also has no vested interest (children) in Lake County Schools. The CAE lives in Orange County which helps provide a impartial and unbiased attitude to the School District for all work performed. The CAE objectivity has not been impaired in fact or appearance in any work performed or completed. The CAE has not been assigned or responsible for any of the School District's operations within the previous three years of employment with the School District. The CAE is an experienced Certified Internal Audit (CIA) with 35 years of knowledge in the field of auditing. The CAE has outsourced IT Audit work to an external professional audit firm to acquire the expertise to perform value added audit work for the School District. Any audit work that may come to the attention of the CAE that he doesn't have the appropriate or current knowledge will be considered for outsourced audit. Page 1 of 5

7 IIA STANDARDS Weight of Standards IAA of LCS Compliance with IIA Standards 1220 Due Professional Care 5 25 Internal auditors must apply the care and skill expected of a reasonably prudent and 5% competent internal auditor. Due professional care does not imply infallibility Continuing Professional Development 5 25 Internal auditors must enhance their knowledge, skills, and other competencies 5% through continuing professional development Quality Assurance and Improvement Program 12.5 The chief audit executive must develop and maintain a quality assurance and 5% improvement program that covers all aspects of the internal audit activity Quality Program Assessments 5 5 The quality assurance and improvement program must include both internal and external assessment. 1% 1311 Internal Assessments Internal assessments must include: - Ongoing monitoring of the performance of the internal audit activity; and - Periodic self-assessment or assessments by other persons within the organization with sufficient knowledge of internal audit practices External Assessments External assessments must be conducted at least once every five years by a qualified, independent assessor or assessment team from outside the organization. The CAE must discuss with the School Board: 1. The form and frequency of external assessment; and 2. The qualifications and independence of the external assessment team, including any potential conflict of interest Reporting on the Quality Program The chief audit executive must communicate the results of the quality assurance and improvement program to the School Board Use of "Conforms with the International Standards for the Professional Practice of Internal Auditing The chief audit executive may state that the IAA conforms with the International Standards for the Professional Practice of Internal Auditing only if the results of the quality assurance and improvement program support this statement Disclosure of Nonconformance When nonconformance with the Definition of Internal Auditing, the Code of Ethics, or the Standards impacts the overall scope or operations of the internal audit activity, the CAE must disclose the nonconformance and the impact to the School Board. Overall Compliance Attribute Performance 100% 96.7% 93.8% 98.7% Director of Internal Audit's Raw Score Calculated Score Calculated Score Comments on Adherence to the Standards 1% 5 5 1% 0 0 1% % % Attribute Standards Total Score The CAE uses due professional care in all audits. Meetings with management, online research, draft reviews and benchmarking have been completed to insure work is performed with the highest level of professionalism. The CAE completes 40 hours of professional development each year as required by the IIA and his CIA credentials. The CAE has restructured the Internal Audit Department since joining the School District in September The Internal Audit Department Charter was established following the IIA recommended model, and it was approved in early The CAE established the Internal Audit Department Standard Operational Procedures (SOPs), these are updated annually to insure they mirror the IAA actual and current work efforts. This is the IAA 2nd Internal Assessment and will be conducted annually to insure the IAA is following the IIA Standards for the Professional Practice of Internal Audit. The IA function was under its 1st full year in School Year. The External Assessment of the Internal Audit Activity is planning to perform in and external review some time in either 2019 or 202 based on Audit Committee and School Board approval. Since an External Assessment has not been performed, no reports to the Audit Committee or School Board has been completed. The CAE has provide all other appropriate communication to the School Board as required by the IIA Standards. Until this review, the CAE has not been able to state the audits conform to the International Standards for the Professional Practice of Internal Auditing. The CAE conforms with the Definition of Internal Auditing, the Code of Ethics and the Standards in all work performed for the School District. Page 2 of 5

8 IIA STANDARDS Weight of Standards Performance Standards Weighted 60% IAA of LCS Compliance with IIA Standards Overall Compliance Attribute Performance 100% 96.7% 93.8% 98.7% Director of Internal Audit's 2000 Managing the Internal Audit Activity 50 The chief audit executive must effectively manage the internal audit activity to 10% ensure it adds value to the organization Planning 5 15 The chief audit executive must establish risk-based plans to determine the priorities of the internal audit activity, consistent with the organization's goals. 3% 2020 Communication and Approval The chief audit executive must communicate the internal audit activity s plans and resource requirements, including significant interim changes, to senior management and to the board for review and approval. The chief audit executive must also communicate the impact of resource limitations. 1% Resource Management The chief audit executive must ensure that internal audit resources are appropriate, 1% 5 5 sufficient, and effectively deployed to achieve the approved plan Policies and Procedures The chief audit executive must establish policies and procedures to guide the 5 10 internal audit activity Coordination The chief audit executive should share information and coordinate activities with other internal and external providers of relevant assurance and consulting services to 1% 5 5 ensure proper coverage and minimize duplication of efforts Reporting to the Board and Senior Management The chief audit executive must report periodically to senior management and the board on the internal audit activity s purpose, authority, responsibility, and performance relative to its plan. Reporting must also include significant risk 5 10 exposures and control issues, including fraud risks, governance issues, and other matters needed or requested by senior management and the board External Service Provider and Organizational Responsibility of IA When an external service provider serves as the internal audit activity, the provider must make the organization aware that the organization has the responsibility for N/A 0 N/A maintaining an effective internal audit activity Nature of Work The internal audit activity must evaluate and contribute to the improvement of governance, risk management and control processes using a systematic and 15% 75 disciplined approach Governance 5 25 The internal audit activity must assess and make appropriate recommendations for 5% improving the governance process in its accomplishment of the following objectives: * Promoting appropriate ethics and values within the organization * Ensuring effective organizational performance management and accountability; * Communicating risk and control information to appropriate areas of the organization; and * Coordinating the activities of and communicating information among the board, external and internal auditors, and management Risk Management 5 25 The internal audit activity must evaluate the effectiveness and contribute to the improvement of risk management processes. 5% Raw Score Calculated Score Calculated Score Comments on Adherence to the Standards The CAE has completed the Audit Universe for the School District through a Risk Based process. The Risk Analysis have been completed through a bottom up approach and a top down approach. In addition meeting with key management, the CFO, Superintendent and School Board members has been completed to gain an understanding of the School District's risks and risk appetited. The CAE presents the Internal Audit Plan to the Audit Committee for approval to workshop with the School Board prior to placing on the School Board agenda for approval. The Internal Audit planning process begins in April to gain approval by the School Board before the close of the school year in June for the next school year. All planning incorporates the required and needed resources to complete the Internal Audit work presented in the Internal Audit Plan. The Internal Audit Activity has established detailed Standard Operational Procedures (SOPs). The SOPs are reviewed and updated at least annually. The CAE meets with the External Audit firm's partner annually. In addition, as needed the CAE communicates with other School Districts concerning audit work performed. Internal Audit's Plan incorporates audit work performed by other entities such as the State Audit General and External Auditors. The CAE provide periodic reports to the School Board in School Board Workshops. The CAE also provides the School Board's Advisory Audit Committee updates on all Internal Audit Departments activities in their 5 to 6 meetings completed during the School Year. All reporting follows IIA Standards and provides information on risks, control issues and other matters needing attention by the School Board and management. Not Applicable. The CAE meets with the Superintendent on many occasions to discuss areas for improvement in the School District. Suggestions such as: an Ethics Hotline, Annual Ethics Signing, staff with mobile technology acknowledgement, consolidation of district offices, areas for potential reorganization, etc. The CAE performs an annual Risk Assessment and provides the information to the Superintendent and the School Board. Page 3 of 5

9 IIA STANDARDS Weight of Standards IAA of LCS Compliance with IIA Standards Overall Compliance Attribute Performance 100% 96.7% 93.8% 98.7% Director of Internal Audit's 2130 Control 5% 5 25 The internal audit activity must assist the organization in maintaining effective controls by evaluating their effectiveness and efficiency and by promoting continuous improvement Engagement Planning 50 Internal auditors must develop and document a plan for each engagement, including the objectives, scope, timing and resource allocations Planning Considerations 10% 5 10 In planning the engagement, internal auditors must consider: - The objectives of the activity being reviewed and the means by which the activity controls its performance. - The significant risks to the activity, its objectives, resources, and operations and the means by which the potential impact of risk is kept to an acceptable level. - The adequacy and effectiveness of the activity s risk management and control systems compared to a relevant control framework or model. - The opportunities for making significant improvements to the activity s risk management and control systems Engagement Objectives 5 10 Objectives must be established for each engagement Engagement Scope 5 10 The established scope must be sufficient to satisfy the objectives of the engagement Engagement Resource Allocation 5 10 Internal auditors must determine appropriate and sufficient resources to achieve engagement objectives based on an evaluation of the nature and complexity of each engagement, time constraints, and available resources Engagement Work Program 5 10 Internal auditors must develop and document work programs that achieve the engagement objectives Performing the Engagement 71 Internal auditors must identify, analyze, evaluate, and document sufficient 15% information to achieve the engagement's objectives Identifying Information 5 20 Internal auditors must identify sufficient, reliable, relevant, and useful information to 4% achieve the engagement s objectives Analysis and Evaluation 5 20 Internal auditors must base conclusions and engagement results on appropriate 4% analyses and evaluations Documenting Information 5 15 Internal auditors must document relevant information to support the conclusions 3% and engagement results Engagement Supervision 4 16 Engagements must be properly supervised to ensure objectives are achieved, quality 4% is assured, and staff is developed Communicating Results 25 5% Internal auditors must communicate the engagement results Criteria for Communicating 5 5 Communications must include the engagement s objectives and scope as well as 1% applicable conclusions, recommendations, and action plans Quality of Communications 5 5 Communications must be accurate, objective, clear, concise, constructive, complete, 1% and timely. Raw Score Calculated Score Calculated Score Comments on Adherence to the Standards The CAE performs audits with an Add Value approach. The CAE provides management of each area audit feedback on areas that could be improved to reduce cost, increase productivity and save the School District dollars. The CAE uses a professional experience, knowledge and strong internal audit practices in the work performed for the School District. The CAE provides Scope of Work documentation prior to the start of all planned audits. The SOW is completed at the conclusion of the preliminary field work prior to the start of the field work. Follow-up audits don't require a SOW or do Forensic Audits. The Scope and Objective of all audit work are planned out prior to the start of every audit engagement and noted in the final report to management and the School Board. All audits take into consideration the controls, resources, risks, and areas for improvement. See 2201 above. See 2201 above. The CAE plans each audit during the planning process for the resources required and seeks management and School Approval prior to approval of the Annual Internal Audit Plan. Any additional resource needs would need to be approved by the School Board. The CAE completes a Audit Work Program for each audit and follow up audit prior to the start of the audit work. All work is performed by the CAE, and the goal is to achieve alignment with the IIA Standards. All work is performed by the CAE, and the goal is to achieve alignment with the IIA Standards. All work is performed by the CAE, and the goal is to achieve alignment with the IIA Standards. The Internal Audit is a one person shop, Engagement Supervision is not available and therefore achievable at Lake County Schools. The CAE performs the draft of all reports for the audit work completed. The work completed for the Scope of Work is used in the audit report to communicate the scope and objectives of the audit. All audit reports communicate accurate, objective, clear, concise, constructive, complete and timely information to management and the School Board. Page 4 of 5

10 IIA STANDARDS Weight of Standards IAA of LCS Compliance with IIA Standards Overall Compliance Attribute Performance 100% 96.7% 93.8% 98.7% Director of Internal Audit's 2421 Errors and Omissions 5 5 If a final communication contains a significant error or omission, the CAE must communicate corrected information to all parties who received the original 1% communication Use of "Conducted in Conformance with the International Standards for the Professional Practice of Internal Auditing with the International Standards for the Professional Practice of Internal Auditing", 0.5% only if the results of the quality assurance and improvement program support the statement Disseminating Results 5 5 1% The chief audit executive must communicate results to the appropriate parties Overall Opinions When an overall opinion is issued, it must take into account the expectations of senior management, the board and other stakeholders and must be supported by 0.5% sufficient, reliable, relevant and useful information Monitoring Progress The chief audit executive must establish and maintain a system to monitor the 2.5% disposition of results communicated to management Communicating the Acceptance of Risks When the CAE concludes that management has accepted a level of risk that may be unacceptable to the organization, the CAE must discuss the matter with senior 2.5% management. If the CAE determines that the matter has not been resolved, the CAE must communicate the matter to the board. Performance Standards Total Score 296 Raw Score Calculated Score Calculated Score Comments on Adherence to the Standards No issues have needed to be reported in this area as this time, however if required to because of errors or omissions the CAE will follow the Standards. The IAA does not use the statement conforms to the Standards, as the IAA has not been completing QAIP prior to 2014 and has not had an External Assessment performed. The CAE is responsible for the dissemination of all reports and information from the IAA. The CAE follows the Standards for issuing an overall opinion from the work completed on the audits. The CAE provides follow up meetings and reviews of all audit work completed. Updates are provided to the Audit Committee and School Board. Follow Up Audits are performed after sufficient time has elapsed to complete recommendations. The CAE communicate risks to the appropriate parties within the School District. Page 5 of 5