Okaloosa County BOCC — August 4, 2015 — Audit Procedure Protocol — reading text

CLERK OF CIRCUIT COURT AND COMPTROLLER OKALOOSA COUNTY Inspector General Department Audit Procedure Protocol What is an audit and how are they selected? In our context an audit is a specific audit assignment undertaken by the Inspector General’s Department. Generally, the Inspector General’s approved annual work plan is the primary source for audit assignments. At that stage, the assignment has been vetted through a detailed, systematic risk assessment that applies various risk factors to areas under consideration and then ranks those areas highest to lowest. 1. Risk Assessment • Conducting risk assessments as a means of establishing the annual work plan is a best practice. • A risk assessment is required in the Standards for the Professional Practice of Internal Auditing promulgated by the Institute of Internal Auditors (IIA). The IIA is the preeminent association governing the professional practice of internal auditing worldwide with 180,000 members in 190 countries and regulates the professional practice of internal auditing worldwide. • A risk assessment is the process to select audit areas recommended by the Auditor general in one of their recent reports. 2. Audits can also be undertaken at the request of the Board. 3. Audits can be undertaken based on requests from the County Administrator. 4. Audits can also be performed based on direction of the Clerk of Courts & Comptroller. To address these additional sources of work, the Annual Work Plan provides for time allotted for assignments made by special request. Conducting the Audit Engagement Letter-An audit starts with an engagement letter that defines the scope and objectives of the assignment. It is sent to appropriate level management. For instance, an audit of the Clerk’s court fee receipting system would be noticed with a letter to the Clerk with copies sent to the Courts Director and Finance Director. An audit of Airports would be addressed to the Chairman with copies to the Board, County Administrator, Clerk of Courts and appropriate level staff. The engagement letter identifies, upfront, the specific areas to be reviewed and the work to be done. The scope and objectives may be refined based on discussions with management and or the Board or Clerk. Entrance Meeting-An audit entrance meeting is scheduled if needed to meet those who the auditors will be working with and to introduce those conducting the audit. The meeting should cover arrangements for a place to work onsite if needed as well as explaining the process and to establish the process to obtain access to systems, facilities, documents and personal. Audit Program-Work is conducted by following a written audit program. Steps are documented and signed off on and management is kept appraised of the progress as well as problems encountered throughout the process. Findings- Proposed findings are developed throughout the audit process. A finding has five elements: Condition, Criteria, Cause, Effect and Recommendation Exit Conference-An exit conference is held if needed to discuss the findings. Draft Report- a draft report is provided to management for review and comment. While management and the auditors may not always agree on the significance of the finding they should agree on the problem itself. Final Report-The final written report includes a written response from management addressing the findings contained in the report. The audit is published (final) when it is provided to management and the Board or Clerk as appropriate. Appropriate report distribution is critical to the success of the engagement. For audits of the county, audit reports are generally not presented to the Board on an agenda but there is nothing to prevent a Board Member from doing so. Workpapers-All workpapers of the audit become a public record when the audit is released. The above protocol is similar to the one used by the Auditor General and is defined in the Standards mentioned previously. Policies and procedures addressing these protocols are currently in draft form. External Quality Assurance Review (QAR)-The standards referenced previously require that the internal audit function undergo an external quality assurance review every five years.