north carolina office of the state auditor honesty integrity professionalism
TRANSCRIPT
North Carolina Office of North Carolina Office of the State Auditorthe State Auditor
Honesty Integrity Professionalism
Internal Auditing in North Internal Auditing in North Carolina Agencies and Carolina Agencies and
InstitutionsInstitutions
Presented byPresented byJeff Henderson, Deputy State AuditorJeff Henderson, Deputy State Auditor
North Carolina Office of the State AuditorNorth Carolina Office of the State AuditorJune 6, 2008June 6, 2008
Why conduct this audit?Why conduct this audit?
The Office of the State Auditor initiated The Office of the State Auditor initiated this audit to assess the internal auditing this audit to assess the internal auditing function across the state.function across the state.
The audit stemmed from increasing public The audit stemmed from increasing public awareness and concern over fraudulent awareness and concern over fraudulent activities in government entities and large activities in government entities and large organizations in the private sector.organizations in the private sector.
Why conduct this audit?Why conduct this audit?
The presence of a functioning internal The presence of a functioning internal audit operation is a key component of a audit operation is a key component of a good system of internal control. Internal good system of internal control. Internal auditors evaluate systems within an auditors evaluate systems within an organization, help to prevent and detect organization, help to prevent and detect errors and irregularities, help ensure the errors and irregularities, help ensure the reliability and integrity of financial and reliability and integrity of financial and operational information and compliance operational information and compliance with laws and regulations, and help with laws and regulations, and help safeguard assets.safeguard assets.
Why conduct this audit?Why conduct this audit?
Internal auditors also function as Internal auditors also function as management consultants by identifying management consultants by identifying problems and recommending methods to problems and recommending methods to improve the effectiveness and efficiency of improve the effectiveness and efficiency of an organization’s operations.an organization’s operations.
ObjectivesObjectives
The objectives of the audit were twofold:The objectives of the audit were twofold:1.1. To determine whether North Carolina state To determine whether North Carolina state
agencies, universities, and community colleges agencies, universities, and community colleges had sufficient internal audit resources.had sufficient internal audit resources.
2.2. To assess the level of compliance that existing To assess the level of compliance that existing internal audit functions have achieved with internal audit functions have achieved with generally recognized internal audit principles and generally recognized internal audit principles and best practices.best practices.
What was covered by this audit?What was covered by this audit?
31 major general government agencies 31 major general government agencies and their component units,and their component units,
all 16 universities in the University of North all 16 universities in the University of North Carolina System, andCarolina System, and
all 58 colleges in the community college all 58 colleges in the community college system.system.
The audit covered the three year period The audit covered the three year period from July 2002 through June 2005.from July 2002 through June 2005.
What did we do? What did we do?
We surveyed all state agencies, which We surveyed all state agencies, which included the universities and community included the universities and community colleges.colleges.We visited several general government We visited several general government agencies, universities and community agencies, universities and community colleges, including some that did not have colleges, including some that did not have an internal audit function.an internal audit function.We interviewed senior management and We interviewed senior management and internal audit staff.internal audit staff.
What did we do? What did we do?
We reviewed laws, rules, regulations, policies, We reviewed laws, rules, regulations, policies, and procedures related to the internal audit and procedures related to the internal audit function. function.
We examined reports and studies, both internal We examined reports and studies, both internal and external, regarding internal audit operations. and external, regarding internal audit operations.
We reviewed each entity’s organizational We reviewed each entity’s organizational structure, audit plan, and operating standards structure, audit plan, and operating standards and identified whether audit risk assessments and identified whether audit risk assessments were conducted. were conducted.
What did we do?What did we do?
And we reviewed personnel files, job And we reviewed personnel files, job descriptions, training records, time sheets, descriptions, training records, time sheets, and a sample of audit reports. and a sample of audit reports.
What did we find? What did we find?
We found that all universities, one We found that all universities, one community college, and 13 state agencies community college, and 13 state agencies had internal audit functions.had internal audit functions.
Overall though we found the internal audit Overall though we found the internal audit function in North Carolina is inadequately function in North Carolina is inadequately staffed and is in need of more direct staffed and is in need of more direct guidance from the General Assembly. guidance from the General Assembly.
ResultsResults
Our audit report included 10 audit findings. Our audit report included 10 audit findings. The first finding is the most critical, and I The first finding is the most critical, and I will spend a little more time on it. This first will spend a little more time on it. This first finding dealt with the overall internal audit finding dealt with the overall internal audit function for the State of North Carolina. function for the State of North Carolina. The remaining findings address specific The remaining findings address specific areas of concern within those agencies areas of concern within those agencies with existing internal audit functions. with existing internal audit functions.
Finding 1Finding 1
North Carolina State Government and Its North Carolina State Government and Its Institutions Lack Sufficient Internal Audit Institutions Lack Sufficient Internal Audit Resources Resources
a.a. There are 75 entities within state government There are 75 entities within state government with no internal audit function. These agencies with no internal audit function. These agencies have just under 25,000 employees and have have just under 25,000 employees and have operating expenditures of nearly $5.9 billion.operating expenditures of nearly $5.9 billion.
Finding 1Finding 1
b.b. There are a number of agencies with There are a number of agencies with inadequately staffed internal audit functions. inadequately staffed internal audit functions. Three of these agencies are the Department of Three of these agencies are the Department of Health and Human Services, the Department of Health and Human Services, the Department of Natural and Economic Resources, and the Natural and Economic Resources, and the Department of Public Instruction. DHHS, with Department of Public Instruction. DHHS, with total expenditures of approximately $13 billion, total expenditures of approximately $13 billion, has seven internal auditors. DENR and DPI, with has seven internal auditors. DENR and DPI, with total expenditures of approximately $569 million total expenditures of approximately $569 million and $7.7 billion respectively, have one internal and $7.7 billion respectively, have one internal auditor each. auditor each.
Finding 1Finding 1
c.c. The skill sets of some internal staffs are not The skill sets of some internal staffs are not adequate. In the ever increasing complexity of adequate. In the ever increasing complexity of our operating environments, the ability to audit our operating environments, the ability to audit computer operating systems is a critical need; computer operating systems is a critical need; however, we found very few internal auditors with however, we found very few internal auditors with technical expertise to meet this need. technical expertise to meet this need.
Finding 1Finding 1
Recommendations:Recommendations:1.1. Legislation is needed:Legislation is needed:
a.a. to establish minimum requirements for the development to establish minimum requirements for the development of an internal audit function at the agency level,of an internal audit function at the agency level,
b.b. to specify the minimum staffing criteria and to specify the minimum staffing criteria and qualifications, qualifications,
c.c. to mandate the internal auditing standards with which to mandate the internal auditing standards with which the state’s internal audit function should comply.the state’s internal audit function should comply.
2.2. Adequate funding should be provided to establish Adequate funding should be provided to establish the internal audit functions. the internal audit functions.
Finding 1Finding 1
Recommendations:Recommendations:3.3. Statewide staffing of internal audit functions should be Statewide staffing of internal audit functions should be
increased. Every agency should have some form of increased. Every agency should have some form of internal audit function. An assessment will need to be internal audit function. An assessment will need to be made to determine the level of staffing and funding. In made to determine the level of staffing and funding. In some cases, centralized internal audit efforts should be some cases, centralized internal audit efforts should be considered.considered.
4.4. The scope of the internal audit function should be broader The scope of the internal audit function should be broader than preventing fraud and safeguarding assets. It should than preventing fraud and safeguarding assets. It should include review and evaluation of internal controls and include review and evaluation of internal controls and compliance with laws and regulations. compliance with laws and regulations.
Finding 1Finding 1
Recommendations:Recommendations:5.5. All internal audit functions should be following the All internal audit functions should be following the
Institute of Internal Auditors International Institute of Internal Auditors International Standards for the Professional Practice of Standards for the Professional Practice of Internal Auditing. Internal Auditing.
6.6. Quality control should be maintained by having a Quality control should be maintained by having a peer review in accordance with the Institute of peer review in accordance with the Institute of Internal Auditors Standards. Internal Auditors Standards.
7.7. An internal audit charter is needed for each An internal audit charter is needed for each internal audit function. internal audit function.
Finding 1Finding 1
Recommendations:Recommendations:8.8. Independence of the internal audit function Independence of the internal audit function
should be maintained by requiring that the should be maintained by requiring that the internal audit function report to the agency head, internal audit function report to the agency head, college president, or university chancellor, and to college president, or university chancellor, and to the audit committee of any oversight board. the audit committee of any oversight board.
9.9. An annual audit plan should be formulated by An annual audit plan should be formulated by each internal audit function based on an agency-each internal audit function based on an agency-wide risk assessment. wide risk assessment.
Finding 2Finding 2
Some Internal Audit Organizations Do Not Some Internal Audit Organizations Do Not Follow Any Professional Auditing Follow Any Professional Auditing Standards Standards – These internal audit organizations should These internal audit organizations should
adopt and follow recognized professional adopt and follow recognized professional standards.standards.
Finding 3Finding 3
Internal Audit Organizations Are Not Internal Audit Organizations Are Not Obtaining Quality Assurance Reviews by Obtaining Quality Assurance Reviews by Outside parties Outside parties – All internal audit organizations should obtain All internal audit organizations should obtain
an external quality assessment review at an external quality assessment review at regular intervals.regular intervals.
Finding 4Finding 4
Some Internal Audit Sections Do Not Some Internal Audit Sections Do Not Report to the Highest Management Level Report to the Highest Management Level Within the Organization Within the Organization – The internal audit organizations mentioned The internal audit organizations mentioned
within should revise their internal audit within should revise their internal audit reporting structures so that the internal audit reporting structures so that the internal audit function reports to the highest level within the function reports to the highest level within the organization. organization.
Finding 5Finding 5
Some Internal Audit Organizations Did Not Some Internal Audit Organizations Did Not Execute an Annual Audit Plan While Execute an Annual Audit Plan While Others Did Not Perform Risk Assessments Others Did Not Perform Risk Assessments to Develop an Audit Plan to Develop an Audit Plan – Internal audit organizations should comply Internal audit organizations should comply
with internal auditing standards by with internal auditing standards by establishing an annual audit plan based on an establishing an annual audit plan based on an effective risk assessment. effective risk assessment.
Finding 6Finding 6
Internal Auditors Were Often Assigned Internal Auditors Were Often Assigned Tasks Unrelated to Their Primary Job Tasks Unrelated to Their Primary Job Responsibilities Responsibilities – Management should ensure that internal Management should ensure that internal
auditors focus their efforts on conducting auditors focus their efforts on conducting audits and strengthening internal controls. audits and strengthening internal controls.
Finding 7Finding 7
Some Internal Audit Sections Did Not Some Internal Audit Sections Did Not Have an Audit Charter Have an Audit Charter – All entities should have an internal audit All entities should have an internal audit
charter consistent with the Institute of Internal charter consistent with the Institute of Internal Auditors standards. Auditors standards.
Finding 8Finding 8
Some Internal Audit Sections Lacked Some Internal Audit Sections Lacked Adequate Policies and Procedures Adequate Policies and Procedures – Policies and procedures governing the Policies and procedures governing the
internal audit function should be established internal audit function should be established and maintained. and maintained.
Finding 9Finding 9
The Office of Information Technology The Office of Information Technology Services No Longer Has a Fully Dedicated Services No Longer Has a Fully Dedicated Information Systems Internal Auditor Information Systems Internal Auditor Position Position – ITS should reestablish an internal information ITS should reestablish an internal information
systems auditor position separate from the systems auditor position separate from the statewide information technology compliance statewide information technology compliance responsibilities. responsibilities.
Finding 10Finding 10
The Department of Transportation’s The Department of Transportation’s Internal Audit Section Has Experienced Internal Audit Section Has Experienced Significant Difficulties with Completing Significant Difficulties with Completing Audits and Producing Audit Reports Audits and Producing Audit Reports – The Chief Internal Auditor should report The Chief Internal Auditor should report
directly to the Secretary and/or to the audit directly to the Secretary and/or to the audit committee of the Board of Transportation, and committee of the Board of Transportation, and the Secretary should take steps to improve the Secretary should take steps to improve the performance of the internal audit section. the performance of the internal audit section.
State Response to AuditState Response to Audit
The General Assembly responded to this audit in The General Assembly responded to this audit in 2007 by enacting House Bill 1401 entitled 2007 by enacting House Bill 1401 entitled The The North Carolina Internal Audit ActNorth Carolina Internal Audit Act. Basically this . Basically this law required the establishment of a program of law required the establishment of a program of internal auditing in state government.internal auditing in state government.
– It required internal audits to comply with current It required internal audits to comply with current standards for the professional practice of internal standards for the professional practice of internal auditing issued by the Institute of Internal Auditors. auditing issued by the Institute of Internal Auditors.
– It set minimum qualifications for internal auditors. It set minimum qualifications for internal auditors. – It established the Council of Internal Auditing which is to It established the Council of Internal Auditing which is to
oversee the implementation of the Act.oversee the implementation of the Act.
State Response to AuditState Response to Audit
The General Assembly also enacted House Bill 1551 The General Assembly also enacted House Bill 1551 entitled entitled The State Governmental Accountability and The State Governmental Accountability and Internal Control ActInternal Control Act. This law required the establishment . This law required the establishment of a “strong and effective system of internal control within of a “strong and effective system of internal control within State government and to clearly indicate responsibilities State government and to clearly indicate responsibilities related to that system of internal control.”related to that system of internal control.”
– It required the State Controller, in consultation with the State It required the State Controller, in consultation with the State Auditor, to establish comprehensive standards, policies, and Auditor, to establish comprehensive standards, policies, and procedures to ensure a strong and effective system of internal procedures to ensure a strong and effective system of internal control within State government. control within State government.
– It stated that management of each state agency bears full It stated that management of each state agency bears full responsibility for establishing and maintaining a proper system responsibility for establishing and maintaining a proper system of internal control within that agency. of internal control within that agency.
– It required each State agency to maintain documentation of the It required each State agency to maintain documentation of the system of internal control within that agency.system of internal control within that agency.
North Carolina Office of the State North Carolina Office of the State AuditorAuditor
Public Website: Public Website: www.ncauditor.net
or by contacting:or by contacting: Kenneth BarnetteKenneth Barnette
Performance Audit ManagerPerformance Audit Manager919-807-7540919-807-7540
North Carolina Office of the State North Carolina Office of the State AuditorAuditor
Jeff HendersonJeff Henderson
Deputy State AuditorDeputy State Auditor
919-807-7513919-807-7513
Questions?Questions?