Audit Report

Internal Audit Charter Review

Organization: Clackamas County
Auditor: Madeline Day

To Whom It May Concern:

Below, are the findings that are currently apparent in Clackamas County’s Internal Audit
Charter. There were thirteen observations in total. They are listed under the section in which they
appeared in correlation to the workpapers.

Mission
1A. According to the IIA, “the internal audit’s mission is to enhance and protect organizational
value by providing risk-based and objective assurance, advice, and insight.” The criterion is a
statement similar to this should be included in the Internal Audit Charter, whether written in this
exact language or not. The condition is that a statement regarding the mission is not currently
found within the charter. The effect on the organization is the mission of Clackamas County is
not clear to the Internal Audit Department, causing the department to not focus on the enhancing
and protecting of organizational value by providing services. This can result in a shift in the
goals of the organization. My recommendation is to create a mission statement, using verbiage
similar to that recommended by the IIA, for Clackamas County and add it to the “Purpose”
section of the Internal Audit Charter.

Purpose
1B. The purpose of an Internal Audit Department is to “provide independent, objective assurance
and consulting services designed to add value and improve the organization’s operations.” This
is the definition given by the IIA. The criteria are that a declaration similar to this definition is
stated within the charter, and that it is accepted by the Internal Audit Department. The existing
condition is that while a purpose exists, it is not clear nor similar to that recommended by the
IIA. The effect is the Internal Audit Department lacks a clear purpose to their work; therefore,
making the work meaningless and insignificant. This can result in the shortage of a good work
ethic put forth by the department. My recommendation is to adjust the current purpose. It would
be beneficial to add the specific services brought forth by the department, assurance and
consulting, and to specifically state that these services are intended to “add value.” These are the
points that are currently absent within the charter.

International Standards for the Professional Practice of Internal Auditing

2A. The Internal Audit Charter should clearly state adherence to the mandatory elements set
forth by the International Professional Practices Framework (IPPF), including the Standards,
Code of Ethics, Core Principles, and Definition of Internal Auditing. The criterion is that a
section should exist within the charter that expresses self-governance by following and obeying
the mandatory elements mentioned above. The condition is that adherence to the Standards and
Code of Ethics is mentioned sparingly throughout the entire charter, but a designated section and
adherence to the Core Principles and the Definition of Internal Auditing are not included. The
effect could be a complete and utter disregard for the Core Principles and Definition of Internal
Auditing. The IPPF has created mandatory elements for organizations to follow for a reason. My
recommendation is to add a small section or subsection for this component and craft a paragraph
specifically stating adherence to all the IPPF’s mandatory elements.

Authority
3B.1 There ought to be a statement regarding the approval of the Internal Audit Charter by the
internal audit activity. The criterion is that there should be a declaration within the charter that
the governing body will establish and assure that the internal audit activity has sufficient
authority to fulfill its duties by approving the Internal Audit Charter. The condition present is
that there is a statement regarding the approval of charter amendments by the Internal Audit
Oversight Committee (IAOC), not the charter entirely. The effect that could occur could be a
confusion regarding the approval of the charter. It calls into question who essentially is over the
approval of the Internal Audit Charter? By providing clarification, this potential confusion could
be cleared. The recommendation is that Clackamas County should further explain in a statement
that the approval of the entire Internal Audit Charter by the Internal Audit Department, not only
amendments to the charter.

3B.5 It is important to highlight the appointment and approval of the Chief Audit Executive
(CAE). The criterion is that there must be a statement set forth by the governing body that the
internal audit activity is participating in deliberations regarding the ultimate approval and/or
removal of the Chief Audit Executive. The condition is that the current statement mentions that
the Internal Audit Director is appointed by the County Administrator and is given powers
bestowed by the Board of County Commissioners. The possibility of removal is not mentioned,
nor is the active discussion of the internal audit activity in the ultimate decision. The effect is that
a certain individual could hold too much power over decision-making and makes choices based
on self-interests, rather than what is best for the county. My recommendation is to modify the
current statement. The language “actively participating” should be added so the department
understands their role in the discussion regarding either appointment or approval. The possibility
of the removal of the CAE should be included as this is something that could occur in the future.
The internal audit activity must be aware that their participation in this conversation is critical to
the county as well.

3B.6 The determination of the salary of the Chief Audit Executive (CAE) is vital. The criterion is
that within the Internal Audit Charter, there must be a statement affirming the active
participation of the internal audit activity regarding the approval of the remuneration of the CAE.
The condition is that this statement, or one similar, does not currently exist within Clackamas
County’s Internal Audit Charter. The effect is that there could be a misunderstanding
surrounding this element of who is involved in the conversation regarding the CAE’s payment.
This responsibility could be in the hands of the incorrect party. My recommendation is that a
statement, parallel or similar to the one recommended by the IIA, should be created and placed
within the charter. It is important to clarify the active role the Internal Audit Department has in
granting and approving the compensation of the CAE.

3B.7 The conclusion about the possibility of a there being a resource or scope limitation present
within management is important. The criterion is there ought to be a sentence or two declaring
that inquiries of management and the Chief Audit Executive are necessary to uncover if there are
possible resource or scope limitations that should be deemed inappropriate. The condition is
there is a current statement that needs further clarification. It presently mentions that internal
audit coverage includes measures taken to safeguard assets, this includes appropriate tests of
existence and ownership as appropriate. The effect is this statement could be taken numerous
different ways, creating the possibility that a proper inquiry of the CAE and management may
not occur. My recommendation is to expand upon the current statement. The specific word
“inquiry” and the phrase “scope or resource limitation” should be added to grant clarification.
This new verbiage would allow for a better understanding.

3B.8 Management does not perpetually nor constantly have to be in discussions with the
governing body and the Chief Audit Executive (CAE). The criterion is that there must be a
declaration that the internal audit activity will approve a statement affirming the fact that the
CAE will have unlimited and unrestricted access to the governing body without the presence of
management. The condition that presently exists is that there is no statement regarding the
approval of such statement, nor is it declared that the CAE will have unrestricted access to the
governing body without the attendance of management. The effect that could occur is that the
CAE does not develop the relationship with the governing body that it should, because
management will continue to be present within each meeting. This could affect the potential
uncovering of fraudulent behavior of management. My recommendation is to develop a
statement proclaiming that the CAE can have unlimited access to the governing body without the
attendance of management, and the internal audit activity will play an active role in approving
this statement.

Independence and Objectivity

4A. Independence is necessary for the internal audit function to operate effectively and
efficiently. The criterion set forth by the IIA is that the Chief Audit Executive (CAE) will ensure
the internal audit activity is free from conditions that could threaten independence or objectivity.
If independence or objectivity is impaired then the CAE will disclose this information to the
correct parties. The condition is that there is a statement explaining how it is essential that the
internal audit activity must remain independent to properly function and it shall remain free from
any influence. It does not state how the CAE should preside over this component and ensure
independence and objectivity, nor does the charter mention what should happen if there is an
impairment. The effect is that there could be that the internal audit activity is not being properly
monitored. The lack of supervision could allow the Internal Audit Department to be influenced
by inappropriate organizational elements. In addition, if personnel discover an impairment, it
might not be getting recorded or reported to the correct parties. An Internal Audit Department is
not fulfilling its duties if it is not free from influence. My recommendation is to add this verbiage
into the current statement to clarify that the CAE is the individual that holds the responsibility of
ensuring independence, and to further confirm that any impairment will be reported to the
appropriate governing body.

4D. Continuing with the topic of independence, it is important that this is established annually.
The criterion is that the independence of the internal audit activity must be confirmed each year
by the Chief Audit Executive (CAE), and reported to the appropriate governing body. The
condition is that a statement expressing this requirement is not found within the charter. The
effect is that this task will not happen, causing the independence of the internal audit activity to
potentially become impaired. The governing body will not be aware of this because
independence is not being monitored nor reported properly; therefore, they cannot fix the
situation due to their lack of knowledge that is supposed to be brought forth by the CAE. My
recommendation is to create this statement and add it under the “Independence and Code of
Ethics” section.

6A.2 It is critical to ensure there are no resource limitations. The criterion set forth by the IIA
says the internal audit activity should communicate to senior management and the governing
body the discovery of an impact of resource limitations on the audit plan. The condition is that it
is currently stated that the Internal Audit Department is responsible for ensuring that resources
are employed efficiently and effectively. It does not state that it is to be communicated to the
appropriate parties if there are any resource or limitations on the audit plan. The effect that could
occur is resource limitations are not properly communicated; therefore, limitations could
continuously be present within engagements without the awareness of the governing body and
senior management. This could impair the overall engagement. My recommendation is to add
this verbiage to the charter to further clarify what must occur if a resource limitation is present.

6A.3 Ensuring the proper access to resources is critical. The criterion is that the internal audit
function should have access to the correct resources regarding competency and skill. The
condition is that a statement similar to this is not found within the Internal Audit Charter of
Clackamas County. It is vital that the internal audit activity has access to those resources, as
competency and skill are important. The effect that could occur is the internal audit activity
could not be using those resources, causing a potential lack of necessary knowledge and
information relating to the engagement. My recommendation is to add language similar to that
suggested by the IIA to the charter of Clackamas County.

7B. The appropriate parties should be given information regarding the results of the Quality
Assurance and Improvement Program (QAIP). The criterion is that the internal audit function
must periodically report results of the Quality Assurance and Improvement Program to senior
management and the governing board. The condition is that the communication of the results are
not stated in the charter. It is stated that an external assessment will be performed, and that
internal reviews will be completed intermittently. The effect is the results are never recorded nor
communicated, disrupting the purpose of the Quality Assurance and Improvement Program. The
reason for the assessments are to gather results and further improve the function of the Internal
Audit Department. My recommendation is to add verbiage that declares the results of the
assessment and that this be delivered to the appropriate parties.