The Importance of Having an Internal Audit Function

image source: https://denverauditor.org/wp-content/uploads/2018/04/2008-Audit-Services-Annual-Report.pdf

​Most organizations use the COSO’s (Committee of Sponsoring Organizations of the Treadway Commission) internal control framework when assessing the adequacy of their internal controls. COSO states that “Internal auditors play an important role in evaluating the effectiveness of control systems, and contribute to ongoing effectiveness. Because of organizational position and authority in an organization, an internal audit function often plays a significant monitoring role.”

What if your government does not have an internal audit function?

GFOA recommends in its best practices: "Every government should consider the feasibility of establishing a formal internal audit function because such a function can play an important role in helping management to maintain a comprehensive framework of internal controls. As a rule, a formal internal audit function is particularly valuable for those activities involving a high degree of risk (e.g., complex accounting systems, contracts with outside parties, a rapidly changing environment). If it is not feasible to establish a separate internal audit function, a government is encouraged to consider either 1) assigning internal audit responsibilities to its regular employees or 2) obtaining the services of an accounting firm (other than the independent financial auditor) for this purpose." (click here to view the full link.)

​Local governments frequently have difficulty maintaining an effective internal audit function over time because:

• Qualified internal auditors are in demand and therefore difficult to hire.
• It is difficult for small and medium governments to provide a career path for an auditor.
• A small internal audit staff may not have technical expertise to conduct specialized audits (e.g., audits of information technology, litigation or complex contracts).
• It is difficult for non-auditors to supervise and mentor internal auditors.

Our Recommendation

If your government does not have an internal audit function in place yet, you should establish one. The internal audit function should report directly to the city manager, county administrator, superintendent or equivalent. An internal audit mission statement and written procedures should be developed, as well as an audit plan for review of key business processes, controls and departments on a rotational basis. The government should determine the appropriate portions of the audit plan and staffing to outsource.

By adding an internal audit function, a government can (a) enhance compliance with key internal controls, (b) be assigned to analyze areas of concern of elected officials and senior management, (c) assist in sharing best practices between departments and locations, and (d) provide expertise on risk and control matters.

Examples of local government internal audit mission statements or audit charter excerpts follow:
​

1) City of Milwaukee, Wisconsin
Internal Audit provides independent, objective assurance in order to add value and improve all City operations. Internal Audit achieves its mission by providing key information to stakeholders and the public to maintain accountability; to help improve program performance and operations; to reduce costs; to facilitate decision making; to stimulate improvements; and to identify current and projected issues that may affect government programs and the people those programs serve.

(source/see the full PDF document here: https://city.milwaukee.gov/ImageLibrary/Groups/comptrollerAuthors/AuditCharter081214.pdf)

​2) City and County of Denver, Colorado:
To promote open, accountable, efficient and effective government by performing impartial reviews and other audit services that provide objective and useful information to improve decision making by management and the people. We will monitor and report on recommendations and progress towards their implementation.

(source: https://denverauditor.org/wp-content/uploads/2018/04/2008-Audit-Services-Annual-Report.pdf)

3)  City of Boise, Idaho
Internal Audit functions as an independent, objective assurance and consulting service.  The Office strives to add value and improve the organization’s operations by bringing to bear a systematic and disciplined approach to the evaluation of risk management processes, activity-level controls, and governance processes.
 
Through a series of planned audits and assessments, Internal Audit reviews activities to determine:

• The effectiveness of controls that provide for the protection and safeguarding of assets.
• The reliability of the organization’s financial information.
• The effectiveness and efficiency of internal processes.
• The level of compliance achieved with internal policies and procedures; and with laws, rules, and regulations.

Audit resources are allocated based on perceived or demonstrated levels of risk.  Open and effective channels of communications are maintained to ensure that management, the City Council, and ultimately the citizens of Boise are informed of audit-related activities and findings.

(source: https://www.cityofboise.org/departments/city-council/internal-auditor/)

4) City Of San Diego, California
The Office of the City Auditor is an independent office that reports to and is accountable to the
Audit Committee and City Council. The City Auditor conducts primarily performance audits of
City departments, offices, and agencies in accordance with government auditing standards.
 
The audits may assess internal controls over financial reporting and evaluate how well the City
complies with all applicable laws, rules and regulations; achieves stated goals and objectives;
reports financial and performance information (reliability); efficiently and effectively uses
resources; and safeguards and protects assets.
 
The Department’s mission is:
To advance open and accountable government through accurate, independent,
and objective audits that seek to improve the economy, efficiency, and
effectiveness of City government
 
The City Auditor will conduct all audit work in accordance with GAGAS and provide decision
makers with audits that are timely, accurate, and objective.
 
(source: https://www.sandiego.gov/sites/default/files/legacy/auditor/pdf/auditmanual_complete.pdf)

---

For any questions on how to establish an internal audit function for your government, or on the samples provided in this post, please feel free to reach out to Kevin directly – he is available for a free consultation, via phone or email:


Kevin Harper, CPA
kharper@kevinharpercpa.com 
(510) 593-503

If you'd like to get more free tips, as well as downloadable tools and templates for your agency, please join our mailing list here! ​

(We’ll send you a monthly curated selection of our blog posts. You can unsubscribe at any time.)