School Board Adopted Policy No. 6550, “Internal Audit Policy,” establishes and defines the role of the Office of Internal Audit as providing, “independent and objective assurance and consulting services designed to add value and improve the District’s operations.” The purpose of this Procedure is to establish the functions of internal audit at the District, with the overarching goal of supporting achievement of District objectives.

Audit Standards

The Office of Internal Audit will govern itself by adherence to the mandatory elements of The Institute of Internal Auditors’ International Professional Practices Framework, including the Core Principles for the Professional Practice of Internal Auditing, the Code of Ethics, the international Standards for the Professional Practice of Internal Auditing (The Standards), and the Definition of Internal Auditing. The chief internal auditor executive will report periodically, at least every five years, to senior management and the Audit Committee regarding the Office of Internal Audit’s conformance to the Code of Ethics and The Standards.

The Office of Internal Audit shall require the Racial Equity Toolkit to be completed for each audit engagement undertaken by the District in conformance with Board Policy 0030.

Audit Plan Development

Every three years, the Office of Internal Audit shall require an enterprise risk assessment be conducted. In accordance with Board Policy No. 6500, Risk Management, the enterprise risk assessment should identify, assess, prioritize, and respond to opportunities and threats that affect the achievement of District objectives. Using the completed risk assessment and input from District management, stakeholders, and the Board, the Office of Internal Audit shall develop an annual risk-based audit work plan identifying areas or departments for review. Proposed projects may include internal controls reviews, capital program reviews, operational assessments, performance audits, or other advisory functions for any District function. Within the work plan, Internal Audit resources will be reserved for special audit requests to address pressing District needs. The annual work plan, as well as any revisions to the work plan, shall be reviewed and approved by the Audit Committee.

When scoping an internal audit, the chief internal auditor shall assess whether there are sufficient and appropriate resources internally to conduct the audit or if external resources are required to provide the highest possible value to the District. The Office of Internal Audit may contract with third parties to perform, in whole or in part, any project included in the audit plan to provide specialized expertise, ensure sufficient capacity to complete the audit plan, support the timely completion of projects, or resolve any other real or perceived constraint to performing the work internally.

External Audits and Reviews

Departments under audit or review shall notify the Office of Internal Audit and include the chief internal auditor in entrance and exit conferences. Engagements that the Office of Internal Audit shall be made aware of include the following:

• External audits completed by regulatory agencies such as the Office of Superintendent of Public Instruction, the State Auditor’s Office, the Department of Education, etc.
• Audits or reviews initiated by individual departments for specific, targeted purposes with the intention of assessing compliance or improving efficiency, effectiveness, and/or performance.

The chief internal auditor shall be notified of the engagement’s scope of work, methodology, and results to effectively oversee external reviews occurring at the District. Additionally, the Office of Internal Audit shall receive a copy of the final report and require a presentation of its results be made to the Audit Committee. Findings and recommendations provided in these reports shall be tracked as a component of the District’s Corrective Action Plan and validation process.

Reporting

At the conclusion of each audit, the chief internal auditor shall require a presentation of results be made to the Audit Committee. Following issuance of each final report, whether conducted internally or externally, the Superintendent shall assign a responsible senior executive to develop and implement a Corrective Action Plan.

In the event that Internal Audit becomes aware of any losses, abuse, illegal acts, or omissions or indications of such acts or omission that could affect the District, the chief internal auditor shall report the irregularities to the Audit Committee, the Superintendent, and the State Auditor’s Office. If the Superintendent is believed to be a party to abuse or illegal acts, the auditor shall report the acts directly to the School Board. Additionally, the chief internal auditor shall make any necessary notifications to the Ethics Officer. If it appears that the irregularity is criminal in nature, the auditor shall immediately notify the appropriate prosecuting authority, in addition to those officials previously cited.

Corrective Action Plan

The assigned senior executive will develop a Corrective Action Plan which includes specific activities that management will implement in order to address the audit finding and recommendation. Each activity should identify the estimated timeframe, associated cost, responsible party, and operational dependencies for completion. This timeline shall serve as the basis for audit validation reporting. Corrective Action Plans will be shared with the Audit Committee at the following intervals: 1) final audit report delivery, 2) resolution of the Corrective Action Plan, and 3) significant changes to the activities or deadlines of the Corrective Action Plan are anticipated. The development and implementation of Corrective Action Plans is a function of District management.

To support accountability and transparency in the Corrective Action Plan process, management activities should be validated to ascertain their completeness and adequacy in addressing the finding. Given the scope of the Office of Internal Audit, this function will span across District functions and should specify how validation was completed (i.e. what documentation was reviewed, walkthrough completed, or testing performed). The results of audit validation should be tracked comprehensively, reported to the Audit Committee on a quarterly basis, and made available to the public. For all validated corrective actions, both the employee performing validation and a designee responsible for corrective action plan implementation should be in attendance of the Audit Committee meeting to answer any potential questions from Committee members.

Internal Audit Communications

The Office of Internal Audit shall maintain a website which includes the Annual Risk Assessment & Audit Plan and published internal audit reports, external audit reports, and reports of external reviews. After the Audit Committee receives the audit, it is the expectation that management implement corrective actions necessary to resolve the audit issues. Following the receipt of each audit, the Audit Committee Chair or Board President shall announce and provide the completed audit at the next scheduled School Board regular meeting.

The chief internal auditor shall submit an annual report to the School Board within 90 days of the school year calendar end indicating audits completed, major findings, results of audit validation, and significant findings which have not been fully addressed by management.

Chief Internal Auditor Employment Contract Renewal

To promote independence and objectivity, the School Board authorizes the Chair of the Audit Committee to renew the chief internal auditor’s employment contract for up to three consecutive years. Subsequent renewals require the approval of the Audit Committee, which will also re-authorize the Chair of the Audit Committee to renew the contract for up to three additional consecutive years. During the years when the Chair of the Audit Committee is authorized to renew the contract, the Chair shall notify the Audit Committee of the Chair’s intent to renew the contract no later than 90 days before the contract will expire. If a member of the Audit Committee opposes the renewal of the contract, the Committee member may request that the full Audit Committee vote on the contract renewal. During the years when the Audit Committee is voting on the renewal of the contract, the vote must occur no later than 45 days before the contract will expire. If the Audit Committee votes in favor of terminating or not renewing the chief internal auditor’s employment contract, the action will move to the full School Board for a vote.

Quality Assurance

The Office of Internal Audit shall establish and maintain a quality assurance and improvement program that covers all aspects of the internal audit activity. The quality assurance program should evaluate conformance with standards as well as assess the efficiency and effectiveness of internal audit activity. Additionally, an external assessment must be conducted once every five years by a qualified, independent assessor from outside the organization. The purpose of the external review is to determine the conformance with The Standards and may include operational or strategic elements. Results from the quality assurance and improvement program shall be reported to the Audit Committee.