State of Michigan Civil Service Commission Capitol Commons Center, P.O. Box 30002 Lansing, MI 48909 Position Code 1. AUDSPL3A32N POSITION DESCRIPTION This position description serves as the official classification document of record for this position. Please complete the information as accurately as you can as the position description is used to determine the proper classification of the position. 2. Employee's Name (Last, First, M.I.) 8. Department/Agency TECH, MGMT AND BUDGET - MB 3. Employee Identification Number 9. Bureau (Institution, Board, or Commission) Office of Internal Audit Services 4. Civil Service Position Code Description AUDITING SPECIALIST-3 10. Division Government Services Division 5. Working Title (What the agency calls the position) 11. Section IT Auditing Specialist 14 6. Name and Position Code Description of Direct Supervisor 12. Unit John Juarez, State Administrative Manager 15 7. Name and Position Code Description of Second Level Supervisor 13. Work Location (City and Address)/Hours of Work Michael Williams, State Division Administrator 17 Mason Bldg., Lansing MI / 8-5 p.m. 14. General Summary of Function/Purpose of Position The Office of Internal Audit Services (OIAS) provides internal audit services to executive branch departments and agencies, including: financial, performance, compliance, and information technology (IT) related audits or reviews of agency programs or activities; external audit coordination and follow up; corrective action plan coordination; special investigations related to matters that have financial and/or internal control implications; review of management s internal control evaluation and reporting processes; and management consulting. The Auditing Specialist position will report to an Internal Audit Division Director. This position functions as the IT Auditing Specialist primarily responsible for performing complex engagements involving information system "general controls'. The general controls are the sole responsibility of the Department of Technology, Management, and Budget (DTMB). The engagement of will also occur during the system development life cycle (SDLC), to help ensure the inclusion of proper controls during system design, implementation, and on-going operations. This position also provides technical expertise to other OIAS staff.
15. Please describe the assigned duties, percent of time spent performing each duty, and what is done to complete each duty. List the duties from most important to least important. The total percentage of all duties performed must equal 100 percent. Duty 1 General Summary: Percentage: 65 Ensure that all requirements of Act 272, P.A. 1986 and Executive Order 2007-31 are met by DTMB, providing significant input on the development and implementation of a comprehensive internal audit plan for the department. This position performs assurance and consulting services at the advanced level. This position will primarily perform highly complex, assurance and consulting engagements of information systems development projects. This position will conduct engagements covering general controls, with a focus on the controls during system development so that controls are planned, developed, and implemented during each phase of development: Initiation and Planning, Requirements Definition, Functional Design, System Design, Construction Testing, and Implementation. This position will also participate on various System Engineering Process Group (SEPG) meetings and will be available as a consultant to DTMB on the design, development, validation/verification, and implementation of effective application and IT general controls within information systems during development. The position will also participate in other engagements of the effectiveness of controls already in place for existing State of Michigan systems. Assists the Division Director in developing and implementing a comprehensive audit planning approach that is the basis for preparing semi-annual internal audit plans for engagements of information systems general control activities and processes. Develops engagement budgets, objectives, alternative strategies, and procedures for the assigned engagement programs. Performs highly technical assurance and consulting engagements of information systems development controls and processes and will act as a liaison with agency staff to conduct audits and special projects. Provides DTMB controls expertise within the following information system general control activities, including: network architecture, information system application controls, IT general controls and DTMB adopted frameworks that govern existing SUITe processes and the maturity of those processes (i.e. CMMI, Cobit, ITIL). Collaborates with other OIAS IT Audit Specialist in the evaluation of information technology controls. Performs assurance and consulting engagements to assess the adequacy of the interanl control structure - including compliance with applicable laws and regulations, auditing adherence to generally accepted accounting principals, and auditing accomplishment of program objectives, and efficiency/effectiveness of programs. Develops audit programs from initial assignment to submission of completed audit working papers, in accordance with professional standards and OIAS policies and procedures. Analyzes and evaluates results of their work to identify errors, weaknesses, and areas with potential for improvement. Prepares working papers that provide sufficient documentation for findings, conclusions and recommendations in accordance with professional auditing standards and OIAS policies and procedures. Drafts findings and recommendations for the assigned audit programs. Discusses draft findings/recommendations with the responsible program managers. May assist the supervisor by reviewing/editing the draft findings/recommendations of less experience audit staff. Leads other OIAS staff in special assignments involving IT system development controls, and reviews the working papers of less experience OIAS staff. Researches laws and regulations applicable to assigned audit programs. This research includes State and Federal laws and regulations, policies and procedures. Researches laws, standards, policies, rules and regulations, applicable to internal auditing. Duty 2 General Summary: Percentage: 10 Prepare reports or other documents that summarize the findings, recommendations, or conclusions resulting from internal audit engagements and special projects. Prepares any additional written reports, including those to the Governor, the Legislature, and the Auditor General, required by Act 272, P.A. 1986. Utilize effective written communication skills to describe the scope of the engagement and background for the project; completes such written documentation within a reasonable timeframe of completion of the project or individual programs. Clearly draft findings, recommendations and conclusions, and ensure that such written documents are concise and accurate. Prepare executive briefing materials that summarize engagement results, for use in presentations to executive leadership. Draft other ad-hoc and internal documents and communications for internal purposes and those relating to external issues. Prepare reports, memos and internal control evaluation documents. Duty 3 General Summary: Percentage: 10
As an information system development controls and processes expert, works closely with DTMB staff, consulting and advising on projects with unique significance. Assists with information systems development efforts to help management ensure systems are designed to support required departmental and State of Michigan control objectives related to accuracy, completeness, access and security. Plans and coordinates training for OIAS and department staff. Completes professional assignments related to leading and participating in system design efforts, as necessary (e.g. review of controls, sufficiency of systems documentation, validating the sufficiency of testing efforts, etc.). Examines system work product for compliance with required departmental and/or State of Michigan control requirements and make recommendations, when necessary, for internal control improvements/considerations. Serves as a technical advisor, providing expert advice on IT general and application controls, during the roll-out and regular maintenance of DTMB's large information systems. In addition, the position serves as an advisor to audit staff in the audits of integrated business process/application controls of significant/critical IT applications. Serves as a technical advisor, providing expert advice and trains and assists audit staff in the use of computer assisted audit tools and techniques (CAATT's) as needed to validate and verify the implementation of effective controls within agency business processes and related information systems. Duty 4 Supports DTMB's internal control evaluation (ICE) and biennial reporting processes, required by Act 272, P.A. 1986. Assistance in this duty would be provided both for those portions of the ICE process involving DTMB-IT. Provide necessary consultation to ensure that DTMB management properly completes and documents their internal control structure evaluations in accordance with Act 272 requirements. Evaluates the internal control evaluation results and provides a report on the results of this evaluation, for submission with the Director's report to the Governor, the Auditor General and the Legislature. Serves as a technical advisor, on highly complex system development issues, and liaison with industry and government agencies. Develops and provides training designed to improve DTMB and other State Agency management and audit staffs' understanding of the importance of an effective internal control structure and responsibility for actively monitoring that control structure. Duty 5 Special projects as assigned Conduct internal audit services as part of cross-departmental projects. Develop training materials as needed. Perform peer review services. Maintain technical competence and stay informed on current developments in governmental accounting principles, professional auditing standards, regulations, laws and administrative policies and procedures. Duty 6 Investigates allegations of improprieties within DTMB, regarding the accounting and financial activities of the department, as well as IT security and controls within all State of Michigan IT environments. Follow-up allegations in a confidential manner. Provides information to allow OIAS management to report the results of investigative activities to the DTMB Director and assist in recommending appropriate corrective actions. 17. Describe the types of decisions that require the supervisor's review.
Instances of conflicting priorities among planned internal audits or individual audit assignments and unplanned audit-related projects/assignments. Interpretation of highly complex IT control issues/conditions. Approval of specific methods/strategies, decisions on the materiality of findings. The Auditing Specialist will report to the Division Director on significant policy issues (laws, standards, policies, rules and regulations, applicable to internal auditing) requiring executive-level direction. The Auditing Specialist should be comfortable working in a fast-paced environment, should be able to proactively determine the best course of action in ambiguous situations, and should be comfortable with varying levels of direction from the Government Services Division Director. 18. What kind of physical effort is used to perform this job? What environmental conditions in this position physically exposed to on the job? Indicate the amount of time and intensity of each activity and condition. Refer to instructions. Generally, business is conducted in an office environment in a sitting position. In very occasional situations, travel to out-state Michigan locations may be necessary and may require overnight travel. 19. List the names and position code descriptions of each classified employee whom this position immediately supervises or oversees on a fulltime, on-going basis. Additional Subordinates 20. This position's responsibilities for the above-listed employees includes the following (check as many as apply): N Complete and sign service ratings. N Assign work. N Provide formal written counseling. N Approve work. N Approve leave requests. N Review work. N Approve time and attendance. N Provide guidance on work methods. N Orally reprimand. N Train employees in the work. 22. Do you agree with the responses for items 1 through 20? If not, which items do you disagree with and why? Yes. 23. What are the essential functions of this position? Duties 1, 2, 3, 4,5, and 6 and all related tasks. The unique nature of auditing information system development controls and processes requires knowledge, skills and experience in the following areas: a solid understanding of "General" and "Application" controls, network architecture, system development frameworks, IT risk assessment methods, and usre of automated tools to identify, assess, and recommend remediation steps for application-level and host-based vulnerabilities. Some examples of audited areas within the umbrella of the system development life cycle include: IT Organization and Management, Logical Security, Physical Security, Change Management, Project Management, Backup and Disaster Recovery, Systems Development and Maintenance, application input/processing/output controls, etc. 24. Indicate specifically how the position's duties and responsibilities have changed since the position was last reviewed. This position has not changed; however was inadvertently inactivated and is being submitted for activation. 25. What is the function of the work area and how does this position fit into that function? The work area manages statewide information technology services (DTMB) for state agencies. OIAS provides independent, internal audit services to DTMB, and all principal State agencies, to help ensure compliance with applicable laws and regulations and to evaluate internal accounting, administrative, and information technology controls in the department. The mission of the OIAS is to improve the accountability for public funds, improve the internal control structure within DTMB, and to improve the operations of State of Michigan programs. The Auditing Specialist position performs a full range of professional auditing/consulting assignments, which includes highly complex information system development control/process assurance and consulting engagements of DTMB system development activities, as set forth in the OIAS (and DTMB) internal audit plan. The Auditing Specialist reports to the Division Director and often times will work with the Division Director very closely on significant policy issues (laws, standards, policies, rules and regulations, applicable to internal auditing) requiring executive-level direction. The Auditing Specialist should be comfortable working in a fast-paced environment, should be able to proactively determine the best course of action in ambiguous situations, and should be comfortable with varying levels of direction from the Government Services Division Director. 26. What are the minimum education and experience qualifications needed to perform the essential functions of this position. EDUCATION: Possession of a bachelor s degree with at least 24 semester (36 term) credits in accounting, finance, information systems, or management. Coursework and/or a degree in Computer Information Systems/Information Technology is desirable.
EXPERIENCE: Four years of professional experience equivalent to the Auditor, including two years equivalent to an Auditor P11 or Assistant Auditor General P11, or one year equivalent to the Auditor 12 or Assistant Auditor General 12. KNOWLEDGE, SKILLS, AND ABILITIES: Knowledge of generally accepted accounting principles and practices, professional auditing standards, and information technology system development audit/control principles and processes is required. Knowledge of the statutes, rules, and regulations applicable to operations is desired. Ability to communicate effectively and maintain good working relationships with executive leadership and auditee personnel. Experience using Microsoft Word, Excel and Access. CERTIFICATES, LICENSES, REGISTRATIONS: Licensure/certification as a Certified Public Accountant, Certified Internal Auditor, and/or Certified Information Systems Auditor desirable, but not required. NOTE: Civil Service approval does not constitute agreement with or acceptance of the desired qualifications of this position. I certify that the information presented in this position description provides a complete and accurate depiction of the duties and responsibilities assigned to this position. Supervisor TO BE FILLED OUT BY APPOINTING AUTHORITY I certify that the entries on these pages are accurate and complete. LALENA VANDEUSEN 6/27/2017 Appointing Authority I certify that the information presented in this position description provides a complete and accurate depiction of the duties and responsibilities assigned to this position. Employee