HomeMy WebLinkAboutAudit Comm RecommendationsPage 1 of 1
H:\My Documents\Internal Audit Function\Audit committee\Audit Committee Ordinance
Work\2012 amendments\Topic Memo for 9-24-12 worksession.docx
Deschutes County Internal Audit Program
Memo
To: Board of County Commissioners (Work session item)
From: David Givans, County Internal Auditor
Date: September 14, 2012
Re: Audit committee recommendation item – Code changes to Code Sections 2.14 and
2.15
The agenda item is to discuss with the Board and provide direction to staff on whether they
want this brought up for further discussion at a worksession or a business meeting.
Your Audit Committee met 9/13/12 and discussed and approved a recommendation to the
Board for changes to Code chapters 2.14 (County Internal Auditor) and 2.15 (Audit
Committee). These changes were developed in response to recommendations from the last
peer review of the Internal Audit Program.
The following was the vote on each recommendation
Audit Committee Member
(PM=Public Member)
Code 2.14
County Internal Auditor
Code 2.15
Audit Committee
Gayle McConnell, Chair (PM) Yes Yes
Michael Shadrach, Prior Chair (PM) Yes Yes
Chris Earnest (PM) Yes Yes
Jean Pedelty (PM) Yes Yes
Jennifer Welander (PM) Yes Yes
Dan Despotopulos Yes Yes
Anthony DeBone Abstain Abstain
I have attached
Deschutes County Code sections 2.14 and 2.15 with the suggested changes
highlighted.
Michael Shadrach’s request for moving this item forward
An audit committee handout outlining the reasons for the change.
The intent of the overall changes is to assure independence of the County Internal Auditor
position. Some additional administrative changes were incorporated for errors, legal
concerns, and improvements.
Chapter 2.14 1 ( 4/121)
Chapter 2.14. COUNTY INTERNAL AUDITOR
2.14.010. Appointment of County Internal Auditor.
2.14.020. Qualifications of County Internal Auditor.
2.14.030 Scope of Audits.
2.14.040. Internal Audit Schedule.
2.14.050. Funding.
2.14.060. Access to Employees, Records and Property.
2.14.070. Audit Reporting and Records.
2.14.080. Contract Auditors, Consultants and Experts.
2.14.090. Quality Assurance Review.
2.14.100. Audit Committee.
2.14.010. Appointment or dismissal of County Internal Auditor.
The County Internal Auditor shall be appointed by or dismissed by and serve at the pleasure of the County
Administrator in consultation with a quorum of the public members of the Audit Committee and a majority
vote of the BOCC.
2.14.020. Qualifications of County Internal Auditor.
The County Internal Auditor shall possess adequate professional proficiency, demonstrated by relevant
certification, such as CPA (Certified Public Accountant), CIA (Certified Internal Auditor), CGAP (Certified
Government Auditing Professional) or a combination of education and experience as would be desired by the
County.
2.14.030 Scope of Audits.
1. The County Internal Auditor shall conduct work in accordance with government auditing standards and
county policies. The County Internal Auditor shall establish internal auditing policies and procedures to
assure that audit work is completed in accordance with those standards. Any audit work that is undertaken
not in compliance with standards shall be disclosed in the County Internal Auditor’s report.
2. The County Internal Auditor shall have authority to conduct financial, attestation, and performance audits
of all departments, offices, boards, activities and agencies of the County in order to independently and
objectively determine whether:
a. activities and programs being implemented have been authorized by County Code or adopted
policy, state law or applicable federal law or regulations;
b. activities and programs are being conducted as prescribed by management/governing body to
accomplish the objectives intended by County Code, state law or applicable federal law or
regulations;
c. activities or programs efficiently and effectively serve the purpose intended by County Code, state
law or applicable federal law or regulations;
d. activities and programs are being conducted and funds expended in compliance with applicable
laws;
Chapter 2.14 2 ( 4/121)
e. revenues are being properly collected, deposited and accounted for;
f. resources, including funds, property and personnel, are adequately safeguarded, controlled and
used in an effective and efficient manner;
g. financial and other reports are being provided that disclose fairly and fully all information that is
required by law, that is necessary to ascertain the nature and scope of programs and activities and
that is necessary to establish a proper basis for evaluating the programs and activities;
h. there are adequate operating and administrative procedures and practices, systems or accounting
internal control systems and internal management controls which have been established by
management; and
i. there are indications of fraud, abuse or illegal acts, which need further investigation.
3. The County Internal Auditor may also provide non-audit services (consulting) that are not covered by
governmental auditing standards. Non-audit services differ from audits in that the County Internal
Auditors may
a. Perform tasks requested by management that directly support the entity’s operations;
b. Provide information or data to a requesting party without providing verification, analysis or
evaluation.
These non-audit services should be approved by the County Administrator. The County Internal Auditor
should continue to work independently (in fact and appearance) when performing non-audit services. The
County Internal Auditor will decide and advise the County Administrator if the non-audit work may
jeopardize independence and whether the work should be performed.
4. The County Internal Auditor needs to consider three general classes of impairments to independence—
personal, external, and organizational. If one or more of these impairments affects the County Internal
Auditor’s capability to perform the work and report results impartially, that County Internal Auditor
should either decline to perform the work, or in those situations because of a legislative requirement or for
other reasons, cannot decline to perform the work, should disclose the impairment in their report.
The County Internal Auditor should not perform management functions or make management decisions.
Performing management functions or making management decisions might impair the County Internal
Auditor’s ability to perform audits of that or a related subject matter.
2.14.040. Internal Audit Schedule.
At the beginning of each calendar (or fiscal) year, the County Internal Auditor shall submit a one to five-
year audit work schedule to the Audit Committee for approval. This audit work schedule should incorporate
information from multiple sources including the County Internal Auditor’s assessment of significant risks to
the organization and input from Management, Audit Committee, and the Board of County Commissioners.
The schedule shall include the proposed plan for auditing departments, offices, boards, activities,
subcontractors and agencies for the period. The schedule may be amended. Additionally, the County
Internal Auditor (for cause) may spontaneously initiate and conduct any other audit deemed necessary. Any
significant changes (an expectation of scope of work changing by more or less than 150 hours) to the
workplan for audit or non-audit projects should be approved in advance by the County Administrator and,
except in cases of emergency, the Audit Committee.
In the selection of audit areas and audit objectives, the determination of audit scope and the timing of audit
work, the County Internal Auditor should consult with external auditors so that the desirable audit coverage
is provided and audit effort is properly coordinated.
Chapter 2.14 3 ( 4/121)
2.14.050. Funding.
The County shall provide sufficient funds to enable the County Internal Auditor to carry out the
responsibilities specified herein subject to annual appropriation by the BOCCCounty Budget Committee.
2.14.060. Access to Employees, Records and Property.
1. All officers and employees of Deschutes County shall furnish the County Internal Auditor with
unrestricted access to employees, information and records (including electronic/computerized data)
within their custody regarding powers, duties, activities, organization, property, financial transactions,
contracts and methods of business required to conduct an audit or otherwise perform audit duties. In
addition, they shall provide access for the County Internal Auditor to inspect all property, equipment
and facilities within their custody. A discussion of appropriate access should occur with County
Counsel if access to documents is restricted by applicable law.
2. Further, all contracts with outside contractors and subcontractors shall provide the County Internal Auditor
access to the contractually related financial and performance-related records; property, equipment and
services purchased in whole, or in part, with governmental funds
3. If such officers, employees or contractors fail to produce the aforementioned access and/or information,
the County Internal Auditor with the aide of County Legal Counsel may initiate a search (or obtain a
subpoena) to obtain exhibit copies (physical or electronic) from computerized systems, book, paper or
record of any such official or employee, or outside contractor or subcontractor, in accordance with state
law or the applicable contract.
4. Subject to public records laws, the County Internal Auditor shall not publicly disclose any information
received during an audit that is considered confidential by any local, state or federal law or regulation. The
County Internal Auditor shall maintain the confidential status of information and records furnished by
County officers and employees.
2.14.070. Audit Reporting and Records.
1. Each audit will result in a report containing relevant background information and findings an d
recommendations, and shall communicate results to the Board of County Commissioners, Audit
Committee, and appropriate management. Subject to applicable public records laws, the report shall
also be available for public examination. If certain pertinent information is prohibited from general
disclosure, the audit report should state the nature of the information omitted and the requirement that
makes the omission necessary.
2. The County Internal Auditor should follow state archive guidelines as appropriate and as identified
under OAR 166-150-0005(4) (currently - a retention schedule of 10 years).
3. The County Internal Auditor should periodically report to the Audit Committee (and Board of County
Commissioners) on the work performed and any significant findings, which have not been fully
addressed by management.
4. The County Internal Auditor shall follow-up on audit recommendations, as practical, to determine if
management is implementing corrective action as identified in their response to the audit report
findings and recommendations. The County Internal Auditor may request periodic status reports from
auditees regarding actions taken to address reported deficiencies and audit recommendations.
Chapter 2.14 4 ( 4/121)
2.14.80. Contract auditors, consultants and Experts.
1. Within budget limitations and approval by the County Administrator, the County Internal Auditor may
obtain the services of Certified Public Accountants, qualified management consultants, or other
professional experts necessary to perform auditor duties. An audit that is performed by contract must be
conducted by persons who are independent of the governmental unit and its officers. The County
Internal Auditor will coordinate and monitor auditing performed by public accounting, professional
experts, or other organizations employed under contract by Deschutes County.
2. The County Internal Auditor may participate with the Audit Committee in the selection of qualified
finalists for the provider of Deschutes County’s annual financial audit. The Audit Committee shall
select a provider from the finalists. This selection shall be presented to the Board of County
Commissioners for review and approval. The process will follow Deschutes County’s contracting
processes.
2.14.090. Quality Assurance Reviews.
1. The audit activities of the County Internal Auditor’s office shall be subject to quality review in
accordance with applicable government auditing standards by a professional, non-partisan objective
group (such as the Association of Local Government Auditors (ALGA)). A copy of the written report of
this independent review shall be furnished to the Audit Committee and the Board of County
Commissioners. This report shall be available to the public.
2. The quality control review shall determine compliance with government auditing standards and the
quality of the audit effort and reporting, including:
a. general standards such as competence, professional judgment, and quality assurance;
b. fieldwork standards such as planning, supervision, and evidence; and
c. reporting standards such as report content, timeliness and distribution.
3. The County shall reimburse the costs of the quality control review team from funds budgeted in the
County Internal Auditor’s budget. Within available time constraints, the County Internal Auditor may
reciprocate with other organizations by participation in quality control teams.
(Ord. 2005-014 §1, 2005)
Chapter 2.15 1 (_4/121)
Chapter 2.15. COUNTY AUDIT COMMITTEE
2.15.010 Authority.
2.15.020. Composition.
2.15.030 Meetings.
2.15.040. Responsibilities.
2.15.010. Authority.
A. The Board of County Commissioners (“Board”) hereby establishes the Audit Committee as an advisory
committee. The committee shall advise the Board and County Administrator on significant audit matters
including, but not limited to:
1. The selection, compensation, and removal of external auditors hired to audit the financial statements for
the County and its related entities;
2. Consultation with the County Administrator or Board regarding the appointment or dismissal of the
County Internal Auditor should include a quorum of the public members of the audit committee;
3. Increases and decreases to the requested budget for the internal audit program; and
4. The work plan for internal audits performed under DCC 2.14.040.
2.15.020. Composition.
A. The audit committee shall be comprised of not less than seven or more than nine members appointed by the
Board.
B. Each member shall be appointed to serve a term of two years. Upon initial formation of the committee, the
Board may appoint any member to a shorter term. A member may be appointed to more than one term. The
Board may remove a member of the committee at any time. In the event of a vacancy on the committee the
Board shall, as soon as practicable, appoint a person to serve the unexpired portion of the former member's
term.
C. The committee shall consist of one (1) member county commissioner, two (2) county department head
members, and four (4) to six (6) public members. The County Administrator shall be an ex-officio nonvoting
member.
D. A public member shall be a registered voter within Deschutes County. The chair of the committee shall be a
public member and shall be selected by a majority of the public members. The chair shall serve a one-year
term and may be selected for additional terms. If the public members cannot decide upon a chair, the larger
committee shall decide. The chair shall preside over meetings, as well as provide input on topics for the
agenda.
2.15.030 Meetings
A. The audit committee shall meet as the committee deems necessary. A quorum shall constitute a majority of
the members appointed. Vacant positions shall not be considered in determining whether a quorum exists.
Minutes shall be prepared in accordance with the Oregon Public Meeting Law. The committee may require
certain County management attend meetings to address reports being discussed. Auditee departments will be
invited to meetings where their internal audit report is discussed.
B. A department head audit committee member shall not vote on an issue relating to an audit directly pertaining
to his or her department. If there is any question as to whether audit committee members should recuse
themselves from a vote, the committee should vote to determine whether the member should recuse himself or
herself.
Chapter 2.15 2 (_4/121)
C. The County Internal Auditor shall facilitate and coordinate such meetings, as well as provide ancillary support
to the committee, as time permits.
2.15.040. Responsibilities. Responsibilities of the Audit Committee include:
A. Overseeing the independent audit of the County’s financial statements, including:
1. Overseeing the selection, renewal or removal of the independent external auditor by making a
recommendation to the Board for final approval;
2. Meeting with the external auditors during planning of the audit, presentation of the audited financial
statements, and discussion of the letter to management on recommendations; and
3. Overseeing the resolution of audit findings in, areas such as internal control, legal and regulatory
compliance, and ethics.
B. The committee shall work to assure coordination between the internal and external auditors, management, the
County Administrator and Board.
C. The audit committee shall ensure the internal audit program performs its function. The committee shall:
1. Review the internal audit ordinance (DCC 2.14) at least every other year;
2. Review proposed internal audit work plans and make recommendations concerning internal audit projects;
3. Review the budget and staffing levels of the internal audit program (DCC 2.14.050);
4. Review internal audit reports and other communications developed for the County;
5. Review and provide input on internal audit program goals; and
6. Review any quality assurance reviews created pursuant to DCC 2.14.090.
7. Discuss and provide input on the County Internal Auditor’s performance review each year.
D. The committee shall make appropriate recommendations concerning the internal audit program based upon the
reviews that it conducts pursuant to subsection C of this section.
E. The committee shall make an annual report to the Board summarizing the committee’s activities and
recommendations. The report may be delivered at an audit committee meeting attended by the Board or may
be scheduled for a regularly scheduled meeting of the Board.
F. The committee shall perform other activities related to this chapter as requested by the Board.
(Ord. 2009-011 §1, 2009)
(Ord. 2008-002 §1, 2008)
From: M Shadrach
Sent: Thursday, September 13, 2012 7:53 PM
To: Tammy Baney; Alan Unger
Cc: Erik Kropp; Tony DeBone; Gayle McConnell; David Givans
Subject: Audit Committee Recommendation
Tammy and Alan,
The Deschutes County Audit Committee met today and voted to recommended
changes to the Internal Audit and Audit Committee Ordinances. I
discussed these proposed changes individually with you on June 26. Erik
Kropp is expecting to discuss the proposed ordinance changes with you at
the next working session of the Commissioners scheduled for September 24.
At our Audit Committee today, there was some discussion about waiting to
take action on the recommendation until a new County Administrator is
hired. The proposed Ordinance changes are largely to help assure the
independence of the work of the County Internal Auditor (in fact and in
appearance to help assure unbiased internal audit recommendations to
enhance County operations). Therefore, linking a Commissioner policy
decision to the hiring of a new County Administrator does not seem
logical to me.
The proposed ordinance changes have been well researched and discussed.
I suggest that the Commissioners act on the Audit Committee proposed
Ordinance recommendations within the next 30 days, if possible. I would
be glad to address any questions or suggestions from the Commissioners.
Best Regards,
Mike Shadrach
Deschutes County Audit Committee Member
County Internal Auditor
Independence Issue
Current Ordinance:
2.14.010 Appointment of County Internal Auditor.
The County Internal Auditor shall be appointed by and serve at the pleasure of the County Administrator
in consultation with the Audit Committee and the BOCC.
Recommendation by the Peer Review:
We recommend the Audit Committee and BOCC consider modifying the language in the County Code to
specify that the Audit Committee and the BOCC must both approve the removal of the Internal Auditor
to reduce the risk of impairments that may restrict or interfere with the Internal Auditor’s work.
Revised Proposal to change 2.14.010 Chapter:
2.14.010 Appointment or Dismissal of the County Internal Auditor
The County Internal Auditor shall be appointed or dismissed by the County Administrator in consultation
with a quorum of the public members of the Audit Committee and a majority vote of the BOCC.
Reasoning for new language:
1. Greatly strengthens the independence of the Internal Auditor when appointment and dismissal
requires a vote of the majority of the BOCC.
2. The consultation provision required with a quorum of the public members of the Audit
Committee provides additional independent input for the BOCC (expected before the BOCC vote
on the Internal Auditor appointment/dismissal).
3. Vote of the Audit Committee not required because the Committee role is advisory. Requiring
approval of the Audit Committee for Internal Auditor appointment/dismissal expands the
Committee’s role beyond an advisory role to the BOCC.
4. Internal Auditor role is unique and requires as much independence as possible. Best practices
call for the independent auditor to report directly to an Audit Committee or other Governing
Board.
