A: The federal government and the state of Oregon have implemented laws and regulations affecting Deschutes County. In addition, the Deschutes County Board of Commissioners have established policies and procedures for County management to follow in serving the citizens of Deschutes County. Further, the Board has entered into contracts and agreements and has expended public funds to provide these services.
Because these activities are very important, an independent internal auditor is needed to evaluate whether management has met its responsibilities in complying with laws, regulations, policies, procedures, contracts, and agreements. In addition to evaluating these areas, the internal auditor also recommends areas for improvement to each audited Department.
The internal auditing process can identify areas where economy and efficiency could be improved thereby reducing cost and/or liability to the County. It can also show how losses of assets and taxpayer funds can be prevented. An internal auditing process can make recommendations for better utilization of human resources.
A: Independence is paramount in performing the internal audit function since it provides an atmosphere of objectivity and uninhibited appraisal.
The County Administrator is appointed by the Board of County Commissioners and is responsible for management of all County departments. The County Internal Auditor is appointed and serves at the pleasure of the County Administrator in consultation with the Audit Committee and Board. The Audit Committee, formed by policy, is comprised of four public citizens and three County officials. They identify and approve the direction of audits as well as meet with County departments on the results of all audits.
The Audit Committee protects the independence of the County’s Internal Auditor by ensuring his findings are not influenced by the County Administrator or the Board of County Commissioners.
A: The following constitutes the authority for the Internal Audit function under the Deschutes County Code:
Added by Ordinance #2005-014, which became effective November 28, 2005.
A: Internal audit activities generally include one or more of the following:
- Determining if the Department’s activities and procedures are efficient and effective,
- Determining if the Department is in compliance with laws, regulations, policies, procedures, contracts, and agreements,
- Evaluating the adequacy and effectiveness of the Department’s internal controls, and/or
- Investigating matters related to thefts, frauds, and other financial misconduct reported or detected during the internal audit examination process.
A: A risk-based approach is used to select departments for audit. Each year the County Internal Auditor analyzes County departments for a selection of risk factors. The current selection of risk factors includes:
- Administration input,
- Trends in expenditures,
- Trends in revenues,
- Department management input,
- Numbers of employees and turnover, and
- Fund type.
After weighing the factors for their relative significance, an overall risk factor is computed for each area. After consideration of the number of audit-hours (staffing level) available for the year, those departments with the greatest assessed risk are recommended to the Audit Committee for inclusion in the audit plan for the year.
A: The internal audit process consists of planning, data gathering, testing, summarizing, evaluating, and reporting. As part of the planning stage, an initial meeting is held with the Department to be audited. The culmination of fieldwork results in a draft audit report, which includes the audit's purpose, scope of work, background, overall evaluation, and applicable findings. (Findings are instances of non-compliance with laws and regulations, internal control weaknesses, and areas where economy and efficiency can be improved.) Each finding should have five elements to it including: condition, criteria, cause, effect, and recommendation.
After the fieldwork is completed, a thorough quality review of the audit workpapers and draft report is performed to ensure that work was performed as planned and is properly documented. The draft report is reviewed to ensure that conclusions and findings are supported by evidence obtained through inquiry, observation, and third parties.
A draft audit report is presented to County Department management for review and discussion. Under Deschutes County policy (P-2004-107), the auditee is allowed two weeks to provide a written reply to the findings and recommendations. Once the response is received, the County Internal Auditor reviews it for adequacy and possible rebuttal. If none is warranted, management's response is attached as an exhibit to the audit report. The audit report is then issued. Copies are routinely issued to affected management, the Audit Committee, the County Administrator, and the Board of County Commissioners.
A: At the Audit Committee meetings (each quarter), reports are discussed with the applicable Departments that have been audited. No earlier than nine months after the audit is issued, a follow-up is performed to determine the status of the recommendations.
