External Auditors examine: financial records, audit grants and awards from State and Federal Governments.  They issue opinions regarding the material correctness of the financial statements and controls surrounding State and Federal grants. 

Departments are selected as the result of a risk identification / risk assessment process and other inputs.  Internal Audit's (IA) risk model lists all of the potential audit subjects for a given department.  Each department / audit subject combination gets a risk score.  There are five factors that are used to develop a risk score; these risk scores are used to determine the initial audit plan for the following year.  The higher the risk score, the more likely the department / audit subject is to get selected for audit.  The Internal Audit Director meets with each of the Directors and discuss risk and what concerns they have that IA could help with. Director input, County Management input and Audit Committee input all weigh heavily on audits selected as well.  Ethics investigations also go to the top of the list, bumping other audits.

Risk Factors include: financial risk, regulations / reputation, prior findings, time since previous audit, senior management concerns and Information Systems.

Financial Risk – Is based on the individual Department's Budget.  (e.g., Department' budget is over $70 million) this is automatically rated as high risk.

Regulations / Reputation Risk – Is based on the change in laws and regulations that will materially impact the department and reputational risk of the Department (e.g., very high profile media exposure on multiple issues) this is rated as high risk. 

Prior Findings – This category defaults to medium risk until audit results move the rating up or down. 

Time Since Previous Audit – This is based on when the prior last audit occurred and is high risk since most audit subjects have not been audited. 

Comfort with Management – This is set at the default of medium risk. Until we have extensively audited the Department and extensively interacted with the Department and staff.

Information Systems – This is defaulted at medium risk.

Once we have the subject identified we refer to the Standard List of Internal Controls (SLIC) to help us determine the specific areas in the subject that we are going to audit.

Findings are areas of minor or major concern or nonconformity to an audit criteria that will be reviewed and followed up on in six to eight months.   Audit Findings can show that audit criteria is not being met (non-conformity.)  Findings usually result in recommendations that will assist an area to better achieve its business objectives.  Action is required for a Finding.

Observations are areas of minor deviation or oversight where we note and bring awareness to the Department's management. Observations provide facts and data that shows there is a potential improvement opportunity.  Action is not required for an Observation.  

This date is a commitment that the Department and Internal Audit agree to for the remediation of the control deficiency.  If more time is needed, please feel free to contact Internal Audit to discuss.

An internal audit or consulting engagement can be very beneficial especially if there has been a change in either the management of the area or in key personnel. An audit or consulting engagement can provide an assessment of the current internal controls and assist in the modification of procedures. An audit or consulting engagement will provide an independent appraisal of the effectiveness and efficiency of an area's controls and / or activities.